xmrig | ecbc4004c9a82bfd3de2ffee4e450d64c54b046f106b523953c8c96e35e84acc

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22649b5369179871788603682d0fd703_JaffaCakes118.exe
Size

1.7MB
MD5

22649b5369179871788603682d0fd703
SHA1

d4d2876fe3fa681f349dfa007fcd19fa1bd36347
SHA256

ecbc4004c9a82bfd3de2ffee4e450d64c54b046f106b523953c8c96e35e84acc
SHA512

c32e991d583ebeff058ffcbe9f899efa94f1c9cda6a28fc6d0d958e05555f9d4fb0b710a5b0786a8bfc8aa3cf82d3f80e4d9fba69605b09e60921f918e300062
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtx:Lz071uv4BPMkibTIA5I4TNrpDGgDQzR

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/3108-219-0x00007FF7BEFA0000-0x00007FF7BF392000-memory.dmp	xmrig
behavioral2/memory/1560-257-0x00007FF611060000-0x00007FF611452000-memory.dmp	xmrig
behavioral2/memory/3948-285-0x00007FF6EA4A0000-0x00007FF6EA892000-memory.dmp	xmrig
behavioral2/memory/2440-308-0x00007FF71A0C0000-0x00007FF71A4B2000-memory.dmp	xmrig
behavioral2/memory/2072-328-0x00007FF75B4A0000-0x00007FF75B892000-memory.dmp	xmrig
behavioral2/memory/1012-399-0x00007FF7B2CB0000-0x00007FF7B30A2000-memory.dmp	xmrig
behavioral2/memory/2264-407-0x00007FF7B3580000-0x00007FF7B3972000-memory.dmp	xmrig
behavioral2/memory/4716-409-0x00007FF64F430000-0x00007FF64F822000-memory.dmp	xmrig
behavioral2/memory/3048-408-0x00007FF710470000-0x00007FF710862000-memory.dmp	xmrig
behavioral2/memory/4440-406-0x00007FF696420000-0x00007FF696812000-memory.dmp	xmrig
behavioral2/memory/4360-404-0x00007FF7E8620000-0x00007FF7E8A12000-memory.dmp	xmrig
behavioral2/memory/400-403-0x00007FF6C1300000-0x00007FF6C16F2000-memory.dmp	xmrig
behavioral2/memory/5080-402-0x00007FF7418C0000-0x00007FF741CB2000-memory.dmp	xmrig
behavioral2/memory/2664-401-0x00007FF7CA440000-0x00007FF7CA832000-memory.dmp	xmrig
behavioral2/memory/4988-400-0x00007FF779240000-0x00007FF779632000-memory.dmp	xmrig
behavioral2/memory/3228-398-0x00007FF6E4A10000-0x00007FF6E4E02000-memory.dmp	xmrig
behavioral2/memory/1728-187-0x00007FF72C9F0000-0x00007FF72CDE2000-memory.dmp	xmrig
behavioral2/memory/516-190-0x00007FF7F35D0000-0x00007FF7F39C2000-memory.dmp	xmrig
behavioral2/memory/2784-146-0x00007FF707860000-0x00007FF707C52000-memory.dmp	xmrig
behavioral2/memory/4980-94-0x00007FF726360000-0x00007FF726752000-memory.dmp	xmrig
behavioral2/memory/2992-4970-0x00007FF6F89C0000-0x00007FF6F8DB2000-memory.dmp	xmrig
behavioral2/memory/4980-4977-0x00007FF726360000-0x00007FF726752000-memory.dmp	xmrig
behavioral2/memory/4760-5005-0x00007FF790000000-0x00007FF7903F2000-memory.dmp	xmrig
behavioral2/memory/2784-5025-0x00007FF707860000-0x00007FF707C52000-memory.dmp	xmrig
behavioral2/memory/2264-5022-0x00007FF7B3580000-0x00007FF7B3972000-memory.dmp	xmrig
behavioral2/memory/4440-5016-0x00007FF696420000-0x00007FF696812000-memory.dmp	xmrig
behavioral2/memory/1728-5019-0x00007FF72C9F0000-0x00007FF72CDE2000-memory.dmp	xmrig
behavioral2/memory/3948-5045-0x00007FF6EA4A0000-0x00007FF6EA892000-memory.dmp	xmrig
behavioral2/memory/4716-5103-0x00007FF64F430000-0x00007FF64F822000-memory.dmp	xmrig
behavioral2/memory/400-5083-0x00007FF6C1300000-0x00007FF6C16F2000-memory.dmp	xmrig
behavioral2/memory/1012-5091-0x00007FF7B2CB0000-0x00007FF7B30A2000-memory.dmp	xmrig
behavioral2/memory/5080-5077-0x00007FF7418C0000-0x00007FF741CB2000-memory.dmp	xmrig
behavioral2/memory/2440-5066-0x00007FF71A0C0000-0x00007FF71A4B2000-memory.dmp	xmrig
behavioral2/memory/3228-5061-0x00007FF6E4A10000-0x00007FF6E4E02000-memory.dmp	xmrig
behavioral2/memory/4988-5056-0x00007FF779240000-0x00007FF779632000-memory.dmp	xmrig
behavioral2/memory/4360-5065-0x00007FF7E8620000-0x00007FF7E8A12000-memory.dmp	xmrig
behavioral2/memory/3048-5059-0x00007FF710470000-0x00007FF710862000-memory.dmp	xmrig
behavioral2/memory/1560-5040-0x00007FF611060000-0x00007FF611452000-memory.dmp	xmrig
behavioral2/memory/3108-5039-0x00007FF7BEFA0000-0x00007FF7BF392000-memory.dmp	xmrig
behavioral2/memory/516-5051-0x00007FF7F35D0000-0x00007FF7F39C2000-memory.dmp	xmrig
behavioral2/memory/2072-5043-0x00007FF75B4A0000-0x00007FF75B892000-memory.dmp	xmrig
behavioral2/memory/2664-5035-0x00007FF7CA440000-0x00007FF7CA832000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4408	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2992	JfivpPn.exe
1764	UZQraci.exe
4440	rAviHBC.exe
4760	JmxegNo.exe
4980	uvONPeM.exe
440	HrIoNPr.exe
2784	sRYhnsF.exe
1728	zfrOiyQ.exe
2264	HQVxaGS.exe
516	JfxuaUr.exe
3108	upjFdbO.exe
1560	xntQEJf.exe
3948	EgIVAWz.exe
3048	LRMaQcu.exe
2440	UAstCOh.exe
2072	hoxQGia.exe
3228	pzEIoKz.exe
1012	EzyYedZ.exe
4716	nIQBriU.exe
4988	DvsCNkE.exe
2664	LJkVxiE.exe
5080	JeCbtev.exe
400	gcJqEvk.exe
4360	UUqUlHy.exe
2604	OZQXbJa.exe
2496	XyMVZSR.exe
3316	scNxCRD.exe
3416	FMBtjzR.exe
4572	uamkcrF.exe
2620	IyUGBja.exe
1964	kcAKRtu.exe
728	poyJhqH.exe
5052	faddwbA.exe
3884	GnLUhqf.exe
3284	XPUNJqh.exe
216	komRbsh.exe
3020	KPqJSZE.exe
2632	bpnFlsK.exe
4140	xLyPpFm.exe
1408	IQsyccd.exe
3780	msPwhDA.exe
4752	bJcMdeP.exe
4916	tijBgwY.exe
3152	eufiHGL.exe
4028	aTalRvV.exe
4372	suAaraW.exe
2380	RnliOdu.exe
4784	zkZLcLq.exe
452	ypyNMIx.exe
212	ybUCzkM.exe
412	rDMdUhn.exe
812	ppYknuH.exe
3852	TCTftOa.exe
3268	hOkcUZj.exe
2364	vdTyDxb.exe
3272	bdTftKw.exe
1584	QazLGDz.exe
4840	euhSywb.exe
1720	KYCFbMN.exe
1380	bcYIpiQ.exe
3644	BWPqEsB.exe
2652	rqyZXjL.exe
2384	WmJLlqp.exe
1672	TcNiRKa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2824-0-0x00007FF66BC30000-0x00007FF66C022000-memory.dmp	upx
behavioral2/files/0x000a00000002168f-5.dat	upx
behavioral2/files/0x000a000000023bc5-50.dat	upx
behavioral2/files/0x000a000000023bcf-112.dat	upx
behavioral2/files/0x000a000000023bc8-152.dat	upx
behavioral2/memory/3108-219-0x00007FF7BEFA0000-0x00007FF7BF392000-memory.dmp	upx
behavioral2/memory/1560-257-0x00007FF611060000-0x00007FF611452000-memory.dmp	upx
behavioral2/memory/3948-285-0x00007FF6EA4A0000-0x00007FF6EA892000-memory.dmp	upx
behavioral2/memory/2440-308-0x00007FF71A0C0000-0x00007FF71A4B2000-memory.dmp	upx
behavioral2/memory/2072-328-0x00007FF75B4A0000-0x00007FF75B892000-memory.dmp	upx
behavioral2/memory/1012-399-0x00007FF7B2CB0000-0x00007FF7B30A2000-memory.dmp	upx
behavioral2/memory/2264-407-0x00007FF7B3580000-0x00007FF7B3972000-memory.dmp	upx
behavioral2/memory/4716-409-0x00007FF64F430000-0x00007FF64F822000-memory.dmp	upx
behavioral2/memory/3048-408-0x00007FF710470000-0x00007FF710862000-memory.dmp	upx
behavioral2/memory/4440-406-0x00007FF696420000-0x00007FF696812000-memory.dmp	upx
behavioral2/memory/4360-404-0x00007FF7E8620000-0x00007FF7E8A12000-memory.dmp	upx
behavioral2/memory/400-403-0x00007FF6C1300000-0x00007FF6C16F2000-memory.dmp	upx
behavioral2/memory/5080-402-0x00007FF7418C0000-0x00007FF741CB2000-memory.dmp	upx
behavioral2/memory/2664-401-0x00007FF7CA440000-0x00007FF7CA832000-memory.dmp	upx
behavioral2/memory/4988-400-0x00007FF779240000-0x00007FF779632000-memory.dmp	upx
behavioral2/memory/3228-398-0x00007FF6E4A10000-0x00007FF6E4E02000-memory.dmp	upx
behavioral2/files/0x000a000000023be2-199.dat	upx
behavioral2/files/0x000a000000023bd1-197.dat	upx
behavioral2/files/0x000a000000023bd0-194.dat	upx
behavioral2/files/0x000a000000023bcd-193.dat	upx
behavioral2/memory/1728-187-0x00007FF72C9F0000-0x00007FF72CDE2000-memory.dmp	upx
behavioral2/files/0x000a000000023be1-183.dat	upx
behavioral2/files/0x000a000000023be0-182.dat	upx
behavioral2/files/0x000a000000023bd6-181.dat	upx
behavioral2/files/0x000a000000023bdf-178.dat	upx
behavioral2/files/0x000a000000023bde-177.dat	upx
behavioral2/files/0x000a000000023bcb-169.dat	upx
behavioral2/files/0x000a000000023bdb-168.dat	upx
behavioral2/files/0x000a000000023bc9-166.dat	upx
behavioral2/files/0x000a000000023bda-163.dat	upx
behavioral2/files/0x000a000000023bd9-161.dat	upx
behavioral2/files/0x000a000000023bd8-151.dat	upx
behavioral2/files/0x000a000000023bd7-149.dat	upx
behavioral2/memory/516-190-0x00007FF7F35D0000-0x00007FF7F39C2000-memory.dmp	upx
behavioral2/memory/2784-146-0x00007FF707860000-0x00007FF707C52000-memory.dmp	upx
behavioral2/files/0x000a000000023bd5-141.dat	upx
behavioral2/files/0x000a000000023bd4-138.dat	upx
behavioral2/files/0x000a000000023bd3-136.dat	upx
behavioral2/files/0x000a000000023bdc-172.dat	upx
behavioral2/files/0x000a000000023bd2-129.dat	upx
behavioral2/files/0x000a000000023bc7-120.dat	upx
behavioral2/files/0x000a000000023bc6-118.dat	upx
behavioral2/files/0x000a000000023bce-109.dat	upx
behavioral2/files/0x000a000000023bc4-102.dat	upx
behavioral2/memory/4980-94-0x00007FF726360000-0x00007FF726752000-memory.dmp	upx
behavioral2/files/0x000a000000023bc3-91.dat	upx
behavioral2/files/0x000a000000023bca-86.dat	upx
behavioral2/files/0x000a000000023bc2-81.dat	upx
behavioral2/files/0x000a000000023bc0-68.dat	upx
behavioral2/files/0x000a000000023bcc-90.dat	upx
behavioral2/memory/440-60-0x00007FF77BAC0000-0x00007FF77BEB2000-memory.dmp	upx
behavioral2/files/0x0031000000023bbd-51.dat	upx
behavioral2/files/0x000a000000023bc1-71.dat	upx
behavioral2/files/0x0031000000023bbe-45.dat	upx
behavioral2/files/0x0031000000023bbc-59.dat	upx
behavioral2/memory/4760-43-0x00007FF790000000-0x00007FF7903F2000-memory.dmp	upx
behavioral2/memory/1764-40-0x00007FF79A8E0000-0x00007FF79ACD2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-32.dat	upx
behavioral2/memory/2992-21-0x00007FF6F89C0000-0x00007FF6F8DB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AhlEIXL.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\YruynSO.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\JTbjKib.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\GzFpqJb.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\aCMdmpr.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\nAzMiZI.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\vJDbVpi.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\UbfVOqf.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\mikmDGn.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\NRjrECm.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\YIrXdmo.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\zUrIkmR.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\TpuqebN.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\IbmvbUm.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\nZyoFUp.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\rVDCRHW.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\vglooez.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\sVKhjxA.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\dfopjJI.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\xYZeMaR.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\yiNhhUz.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\UAtVMhK.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\QTWbhCZ.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\CFrGVBr.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\Ewcdyir.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\TbwoqWS.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\VYXZTxD.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\XgexjVy.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\fqZYyEK.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\JxAlZEw.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\xCVMwyB.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\heSCMGy.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\OFUEwwq.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\itmMVdK.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\SEIilux.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\jOSCyDy.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\xJJDNbM.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\Khnjnnb.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\ZVKbtIn.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\jHBPAgb.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\KdIoaOw.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\XFMoXAW.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\DKFEEYa.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\SPWKKeG.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\NoJGcup.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\atjhoHr.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\zbnyEnk.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\BmRupGA.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\bdCbgam.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\nlIyIkk.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\oZjGEKN.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\vzBbAmP.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\FjQrEaa.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\XaQCEtB.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\NlImdkT.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\IHYETwH.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\XgKhJgE.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\HdcNPbl.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\flHrSFf.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\zGTWVrR.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\LfSGiMs.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\CnBtcbL.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\ITTMnpp.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\twpsXzJ.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4408	powershell.exe
4408	powershell.exe
4408	powershell.exe
4408	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeLockMemoryPrivilege	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 4408	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	85
PID 2824 wrote to memory of 4408	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	85
PID 2824 wrote to memory of 2992	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	86
PID 2824 wrote to memory of 2992	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	86
PID 2824 wrote to memory of 4440	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	87
PID 2824 wrote to memory of 4440	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	87
PID 2824 wrote to memory of 1764	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	88
PID 2824 wrote to memory of 1764	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	88
PID 2824 wrote to memory of 4760	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	89
PID 2824 wrote to memory of 4760	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	89
PID 2824 wrote to memory of 4980	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	90
PID 2824 wrote to memory of 4980	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	90
PID 2824 wrote to memory of 440	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	91
PID 2824 wrote to memory of 440	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	91
PID 2824 wrote to memory of 2784	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	92
PID 2824 wrote to memory of 2784	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	92
PID 2824 wrote to memory of 1728	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	93
PID 2824 wrote to memory of 1728	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	93
PID 2824 wrote to memory of 2264	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	94
PID 2824 wrote to memory of 2264	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	94
PID 2824 wrote to memory of 516	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	95
PID 2824 wrote to memory of 516	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	95
PID 2824 wrote to memory of 3108	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	96
PID 2824 wrote to memory of 3108	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	96
PID 2824 wrote to memory of 1560	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	97
PID 2824 wrote to memory of 1560	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	97
PID 2824 wrote to memory of 3948	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	98
PID 2824 wrote to memory of 3948	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	98
PID 2824 wrote to memory of 3048	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	99
PID 2824 wrote to memory of 3048	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	99
PID 2824 wrote to memory of 2440	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	100
PID 2824 wrote to memory of 2440	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	100
PID 2824 wrote to memory of 2072	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	101
PID 2824 wrote to memory of 2072	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	101
PID 2824 wrote to memory of 3228	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	102
PID 2824 wrote to memory of 3228	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	102
PID 2824 wrote to memory of 1012	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	103
PID 2824 wrote to memory of 1012	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	103
PID 2824 wrote to memory of 4716	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	104
PID 2824 wrote to memory of 4716	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	104
PID 2824 wrote to memory of 4988	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	105
PID 2824 wrote to memory of 4988	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	105
PID 2824 wrote to memory of 2664	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	106
PID 2824 wrote to memory of 2664	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	106
PID 2824 wrote to memory of 5080	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	107
PID 2824 wrote to memory of 5080	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	107
PID 2824 wrote to memory of 400	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	108
PID 2824 wrote to memory of 400	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	108
PID 2824 wrote to memory of 4360	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	109
PID 2824 wrote to memory of 4360	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	109
PID 2824 wrote to memory of 2604	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	110
PID 2824 wrote to memory of 2604	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	110
PID 2824 wrote to memory of 2496	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	111
PID 2824 wrote to memory of 2496	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	111
PID 2824 wrote to memory of 3316	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	112
PID 2824 wrote to memory of 3316	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	112
PID 2824 wrote to memory of 3416	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	113
PID 2824 wrote to memory of 3416	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	113
PID 2824 wrote to memory of 4572	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	114
PID 2824 wrote to memory of 4572	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	114
PID 2824 wrote to memory of 2620	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	115
PID 2824 wrote to memory of 2620	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	115
PID 2824 wrote to memory of 1964	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	116
PID 2824 wrote to memory of 1964	2824	22649b5369179871788603682d0fd703_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\22649b5369179871788603682d0fd703_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22649b5369179871788603682d0fd703_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\System\JfivpPn.exe
  C:\Windows\System\JfivpPn.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\rAviHBC.exe
  C:\Windows\System\rAviHBC.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\UZQraci.exe
  C:\Windows\System\UZQraci.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\JmxegNo.exe
  C:\Windows\System\JmxegNo.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\uvONPeM.exe
  C:\Windows\System\uvONPeM.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\HrIoNPr.exe
  C:\Windows\System\HrIoNPr.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\sRYhnsF.exe
  C:\Windows\System\sRYhnsF.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\zfrOiyQ.exe
  C:\Windows\System\zfrOiyQ.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\HQVxaGS.exe
  C:\Windows\System\HQVxaGS.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\JfxuaUr.exe
  C:\Windows\System\JfxuaUr.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\upjFdbO.exe
  C:\Windows\System\upjFdbO.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\xntQEJf.exe
  C:\Windows\System\xntQEJf.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\EgIVAWz.exe
  C:\Windows\System\EgIVAWz.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\LRMaQcu.exe
  C:\Windows\System\LRMaQcu.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\UAstCOh.exe
  C:\Windows\System\UAstCOh.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\hoxQGia.exe
  C:\Windows\System\hoxQGia.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\pzEIoKz.exe
  C:\Windows\System\pzEIoKz.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\EzyYedZ.exe
  C:\Windows\System\EzyYedZ.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\nIQBriU.exe
  C:\Windows\System\nIQBriU.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\DvsCNkE.exe
  C:\Windows\System\DvsCNkE.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\LJkVxiE.exe
  C:\Windows\System\LJkVxiE.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\JeCbtev.exe
  C:\Windows\System\JeCbtev.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\gcJqEvk.exe
  C:\Windows\System\gcJqEvk.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\UUqUlHy.exe
  C:\Windows\System\UUqUlHy.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\OZQXbJa.exe
  C:\Windows\System\OZQXbJa.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\XyMVZSR.exe
  C:\Windows\System\XyMVZSR.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\scNxCRD.exe
  C:\Windows\System\scNxCRD.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\FMBtjzR.exe
  C:\Windows\System\FMBtjzR.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\uamkcrF.exe
  C:\Windows\System\uamkcrF.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\IyUGBja.exe
  C:\Windows\System\IyUGBja.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\kcAKRtu.exe
  C:\Windows\System\kcAKRtu.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\poyJhqH.exe
  C:\Windows\System\poyJhqH.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\faddwbA.exe
  C:\Windows\System\faddwbA.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\GnLUhqf.exe
  C:\Windows\System\GnLUhqf.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\aTalRvV.exe
  C:\Windows\System\aTalRvV.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\XPUNJqh.exe
  C:\Windows\System\XPUNJqh.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\komRbsh.exe
  C:\Windows\System\komRbsh.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\KPqJSZE.exe
  C:\Windows\System\KPqJSZE.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\bpnFlsK.exe
  C:\Windows\System\bpnFlsK.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\xLyPpFm.exe
  C:\Windows\System\xLyPpFm.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\IQsyccd.exe
  C:\Windows\System\IQsyccd.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\msPwhDA.exe
  C:\Windows\System\msPwhDA.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\bJcMdeP.exe
  C:\Windows\System\bJcMdeP.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\tijBgwY.exe
  C:\Windows\System\tijBgwY.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\eufiHGL.exe
  C:\Windows\System\eufiHGL.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\suAaraW.exe
  C:\Windows\System\suAaraW.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\RnliOdu.exe
  C:\Windows\System\RnliOdu.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\hOkcUZj.exe
  C:\Windows\System\hOkcUZj.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\vdTyDxb.exe
  C:\Windows\System\vdTyDxb.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\zkZLcLq.exe
  C:\Windows\System\zkZLcLq.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\ypyNMIx.exe
  C:\Windows\System\ypyNMIx.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\ybUCzkM.exe
  C:\Windows\System\ybUCzkM.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\rDMdUhn.exe
  C:\Windows\System\rDMdUhn.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\ppYknuH.exe
  C:\Windows\System\ppYknuH.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\TCTftOa.exe
  C:\Windows\System\TCTftOa.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\bdTftKw.exe
  C:\Windows\System\bdTftKw.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\QazLGDz.exe
  C:\Windows\System\QazLGDz.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\euhSywb.exe
  C:\Windows\System\euhSywb.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\KYCFbMN.exe
  C:\Windows\System\KYCFbMN.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\bcYIpiQ.exe
  C:\Windows\System\bcYIpiQ.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\BWPqEsB.exe
  C:\Windows\System\BWPqEsB.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\rqyZXjL.exe
  C:\Windows\System\rqyZXjL.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\WmJLlqp.exe
  C:\Windows\System\WmJLlqp.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\TcNiRKa.exe
  C:\Windows\System\TcNiRKa.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\jfAYBMQ.exe
  C:\Windows\System\jfAYBMQ.exe
  2⤵
  PID:2872
- C:\Windows\System\qXWpuSe.exe
  C:\Windows\System\qXWpuSe.exe
  2⤵
  PID:4100
- C:\Windows\System\JGyOSyV.exe
  C:\Windows\System\JGyOSyV.exe
  2⤵
  PID:4656
- C:\Windows\System\yhZpIMj.exe
  C:\Windows\System\yhZpIMj.exe
  2⤵
  PID:2768
- C:\Windows\System\IBaDadO.exe
  C:\Windows\System\IBaDadO.exe
  2⤵
  PID:1128
- C:\Windows\System\nRhyGnr.exe
  C:\Windows\System\nRhyGnr.exe
  2⤵
  PID:2924
- C:\Windows\System\seBVkIM.exe
  C:\Windows\System\seBVkIM.exe
  2⤵
  PID:2432
- C:\Windows\System\hxUdRZT.exe
  C:\Windows\System\hxUdRZT.exe
  2⤵
  PID:4424
- C:\Windows\System\scltSjr.exe
  C:\Windows\System\scltSjr.exe
  2⤵
  PID:5128
- C:\Windows\System\oSQhVGA.exe
  C:\Windows\System\oSQhVGA.exe
  2⤵
  PID:5144
- C:\Windows\System\ZhjePbR.exe
  C:\Windows\System\ZhjePbR.exe
  2⤵
  PID:5168
- C:\Windows\System\bCdZymV.exe
  C:\Windows\System\bCdZymV.exe
  2⤵
  PID:5200
- C:\Windows\System\rgQqYBw.exe
  C:\Windows\System\rgQqYBw.exe
  2⤵
  PID:5228
- C:\Windows\System\nKKzhKt.exe
  C:\Windows\System\nKKzhKt.exe
  2⤵
  PID:5408
- C:\Windows\System\myFWSqW.exe
  C:\Windows\System\myFWSqW.exe
  2⤵
  PID:5444
- C:\Windows\System\TiSwJfH.exe
  C:\Windows\System\TiSwJfH.exe
  2⤵
  PID:5468
- C:\Windows\System\NKMnfOC.exe
  C:\Windows\System\NKMnfOC.exe
  2⤵
  PID:5488
- C:\Windows\System\ecTrkeE.exe
  C:\Windows\System\ecTrkeE.exe
  2⤵
  PID:5504
- C:\Windows\System\FxHGRDt.exe
  C:\Windows\System\FxHGRDt.exe
  2⤵
  PID:5528
- C:\Windows\System\scAVyjQ.exe
  C:\Windows\System\scAVyjQ.exe
  2⤵
  PID:5628
- C:\Windows\System\XExGnNk.exe
  C:\Windows\System\XExGnNk.exe
  2⤵
  PID:5656
- C:\Windows\System\EoKPqkq.exe
  C:\Windows\System\EoKPqkq.exe
  2⤵
  PID:5672
- C:\Windows\System\koqJauL.exe
  C:\Windows\System\koqJauL.exe
  2⤵
  PID:5700
- C:\Windows\System\Jbaocxc.exe
  C:\Windows\System\Jbaocxc.exe
  2⤵
  PID:5772
- C:\Windows\System\zRTJHIu.exe
  C:\Windows\System\zRTJHIu.exe
  2⤵
  PID:5792
- C:\Windows\System\yTahBqD.exe
  C:\Windows\System\yTahBqD.exe
  2⤵
  PID:5812
- C:\Windows\System\XKtEdTe.exe
  C:\Windows\System\XKtEdTe.exe
  2⤵
  PID:5828
- C:\Windows\System\nbQomvm.exe
  C:\Windows\System\nbQomvm.exe
  2⤵
  PID:5848
- C:\Windows\System\ggsRNHB.exe
  C:\Windows\System\ggsRNHB.exe
  2⤵
  PID:5868
- C:\Windows\System\bctlmcx.exe
  C:\Windows\System\bctlmcx.exe
  2⤵
  PID:5884
- C:\Windows\System\ldkIEDd.exe
  C:\Windows\System\ldkIEDd.exe
  2⤵
  PID:5900
- C:\Windows\System\ybgBjvS.exe
  C:\Windows\System\ybgBjvS.exe
  2⤵
  PID:5920
- C:\Windows\System\AXRrAzN.exe
  C:\Windows\System\AXRrAzN.exe
  2⤵
  PID:5940
- C:\Windows\System\BgxyVtT.exe
  C:\Windows\System\BgxyVtT.exe
  2⤵
  PID:5960
- C:\Windows\System\AuvBKoA.exe
  C:\Windows\System\AuvBKoA.exe
  2⤵
  PID:5984
- C:\Windows\System\yybhWXQ.exe
  C:\Windows\System\yybhWXQ.exe
  2⤵
  PID:6004
- C:\Windows\System\xSDIGIZ.exe
  C:\Windows\System\xSDIGIZ.exe
  2⤵
  PID:6024
- C:\Windows\System\uGSNojU.exe
  C:\Windows\System\uGSNojU.exe
  2⤵
  PID:6044
- C:\Windows\System\pUQRZDC.exe
  C:\Windows\System\pUQRZDC.exe
  2⤵
  PID:6064
- C:\Windows\System\QqnQaKd.exe
  C:\Windows\System\QqnQaKd.exe
  2⤵
  PID:6084
- C:\Windows\System\MWkNXET.exe
  C:\Windows\System\MWkNXET.exe
  2⤵
  PID:6108
- C:\Windows\System\EFfPgeQ.exe
  C:\Windows\System\EFfPgeQ.exe
  2⤵
  PID:6132
- C:\Windows\System\BwlyeuQ.exe
  C:\Windows\System\BwlyeuQ.exe
  2⤵
  PID:2952
- C:\Windows\System\tWztJpO.exe
  C:\Windows\System\tWztJpO.exe
  2⤵
  PID:1956
- C:\Windows\System\qLGpxUA.exe
  C:\Windows\System\qLGpxUA.exe
  2⤵
  PID:2736
- C:\Windows\System\dNzNCof.exe
  C:\Windows\System\dNzNCof.exe
  2⤵
  PID:1288
- C:\Windows\System\ftRgvXG.exe
  C:\Windows\System\ftRgvXG.exe
  2⤵
  PID:3084
- C:\Windows\System\BnPtrLW.exe
  C:\Windows\System\BnPtrLW.exe
  2⤵
  PID:764
- C:\Windows\System\HcaCPGh.exe
  C:\Windows\System\HcaCPGh.exe
  2⤵
  PID:5140
- C:\Windows\System\qTaNofd.exe
  C:\Windows\System\qTaNofd.exe
  2⤵
  PID:4992
- C:\Windows\System\xgUYHrR.exe
  C:\Windows\System\xgUYHrR.exe
  2⤵
  PID:4972
- C:\Windows\System\WAzKhgs.exe
  C:\Windows\System\WAzKhgs.exe
  2⤵
  PID:5272
- C:\Windows\System\CqOPGIl.exe
  C:\Windows\System\CqOPGIl.exe
  2⤵
  PID:4112
- C:\Windows\System\wvONhxR.exe
  C:\Windows\System\wvONhxR.exe
  2⤵
  PID:5360
- C:\Windows\System\pBQBOwe.exe
  C:\Windows\System\pBQBOwe.exe
  2⤵
  PID:5404
- C:\Windows\System\ZyOQaHW.exe
  C:\Windows\System\ZyOQaHW.exe
  2⤵
  PID:5460
- C:\Windows\System\cxXQleJ.exe
  C:\Windows\System\cxXQleJ.exe
  2⤵
  PID:5596
- C:\Windows\System\UvBDyxb.exe
  C:\Windows\System\UvBDyxb.exe
  2⤵
  PID:5040
- C:\Windows\System\cqCweuv.exe
  C:\Windows\System\cqCweuv.exe
  2⤵
  PID:5536
- C:\Windows\System\mRXGOeX.exe
  C:\Windows\System\mRXGOeX.exe
  2⤵
  PID:5908
- C:\Windows\System\gYFsmXp.exe
  C:\Windows\System\gYFsmXp.exe
  2⤵
  PID:6016
- C:\Windows\System\kOcHGkw.exe
  C:\Windows\System\kOcHGkw.exe
  2⤵
  PID:5992
- C:\Windows\System\XvjmRGL.exe
  C:\Windows\System\XvjmRGL.exe
  2⤵
  PID:5928
- C:\Windows\System\ieZyTnn.exe
  C:\Windows\System\ieZyTnn.exe
  2⤵
  PID:1884
- C:\Windows\System\YYDjaNz.exe
  C:\Windows\System\YYDjaNz.exe
  2⤵
  PID:4352
- C:\Windows\System\GunVoYS.exe
  C:\Windows\System\GunVoYS.exe
  2⤵
  PID:5180
- C:\Windows\System\IvCQJOZ.exe
  C:\Windows\System\IvCQJOZ.exe
  2⤵
  PID:380
- C:\Windows\System\xiuCiLO.exe
  C:\Windows\System\xiuCiLO.exe
  2⤵
  PID:5280
- C:\Windows\System\MKYyZtx.exe
  C:\Windows\System\MKYyZtx.exe
  2⤵
  PID:5372
- C:\Windows\System\XJjnkHS.exe
  C:\Windows\System\XJjnkHS.exe
  2⤵
  PID:5500
- C:\Windows\System\fzXoPTl.exe
  C:\Windows\System\fzXoPTl.exe
  2⤵
  PID:5636
- C:\Windows\System\wlYhgQf.exe
  C:\Windows\System\wlYhgQf.exe
  2⤵
  PID:3900
- C:\Windows\System\mUOmELD.exe
  C:\Windows\System\mUOmELD.exe
  2⤵
  PID:3296
- C:\Windows\System\QzRJDKT.exe
  C:\Windows\System\QzRJDKT.exe
  2⤵
  PID:4720
- C:\Windows\System\qzBQgYA.exe
  C:\Windows\System\qzBQgYA.exe
  2⤵
  PID:3468
- C:\Windows\System\YdpcufV.exe
  C:\Windows\System\YdpcufV.exe
  2⤵
  PID:2328
- C:\Windows\System\Trmnwil.exe
  C:\Windows\System\Trmnwil.exe
  2⤵
  PID:4236
- C:\Windows\System\KUxZfbz.exe
  C:\Windows\System\KUxZfbz.exe
  2⤵
  PID:1032
- C:\Windows\System\URzpUWN.exe
  C:\Windows\System\URzpUWN.exe
  2⤵
  PID:2096
- C:\Windows\System\vzipcWF.exe
  C:\Windows\System\vzipcWF.exe
  2⤵
  PID:2284
- C:\Windows\System\pvyjvpg.exe
  C:\Windows\System\pvyjvpg.exe
  2⤵
  PID:4776
- C:\Windows\System\yBnfKwL.exe
  C:\Windows\System\yBnfKwL.exe
  2⤵
  PID:4552
- C:\Windows\System\pKsSaVO.exe
  C:\Windows\System\pKsSaVO.exe
  2⤵
  PID:5092
- C:\Windows\System\xthGNpD.exe
  C:\Windows\System\xthGNpD.exe
  2⤵
  PID:4596
- C:\Windows\System\pWdQUoZ.exe
  C:\Windows\System\pWdQUoZ.exe
  2⤵
  PID:2424
- C:\Windows\System\vbCmIRg.exe
  C:\Windows\System\vbCmIRg.exe
  2⤵
  PID:5512
- C:\Windows\System\YODGVos.exe
  C:\Windows\System\YODGVos.exe
  2⤵
  PID:3924
- C:\Windows\System\ApEDHlX.exe
  C:\Windows\System\ApEDHlX.exe
  2⤵
  PID:3156
- C:\Windows\System\xmvOtHR.exe
  C:\Windows\System\xmvOtHR.exe
  2⤵
  PID:3292
- C:\Windows\System\jrzKkLR.exe
  C:\Windows\System\jrzKkLR.exe
  2⤵
  PID:2788
- C:\Windows\System\kYDvrVK.exe
  C:\Windows\System\kYDvrVK.exe
  2⤵
  PID:5424
- C:\Windows\System\YSPKamu.exe
  C:\Windows\System\YSPKamu.exe
  2⤵
  PID:5452
- C:\Windows\System\UEiRgct.exe
  C:\Windows\System\UEiRgct.exe
  2⤵
  PID:6036
- C:\Windows\System\qOTGcwL.exe
  C:\Windows\System\qOTGcwL.exe
  2⤵
  PID:5996
- C:\Windows\System\WAwRNlT.exe
  C:\Windows\System\WAwRNlT.exe
  2⤵
  PID:2888
- C:\Windows\System\oQFJtFi.exe
  C:\Windows\System\oQFJtFi.exe
  2⤵
  PID:2052
- C:\Windows\System\RAnzqRn.exe
  C:\Windows\System\RAnzqRn.exe
  2⤵
  PID:1384
- C:\Windows\System\KxKMFRf.exe
  C:\Windows\System\KxKMFRf.exe
  2⤵
  PID:4824
- C:\Windows\System\bkHWPfY.exe
  C:\Windows\System\bkHWPfY.exe
  2⤵
  PID:6160
- C:\Windows\System\eHuIQvZ.exe
  C:\Windows\System\eHuIQvZ.exe
  2⤵
  PID:6184
- C:\Windows\System\YXqehUW.exe
  C:\Windows\System\YXqehUW.exe
  2⤵
  PID:6200
- C:\Windows\System\CbafXMa.exe
  C:\Windows\System\CbafXMa.exe
  2⤵
  PID:6220
- C:\Windows\System\CYfSrmx.exe
  C:\Windows\System\CYfSrmx.exe
  2⤵
  PID:6236
- C:\Windows\System\ZYqGmrx.exe
  C:\Windows\System\ZYqGmrx.exe
  2⤵
  PID:6260
- C:\Windows\System\vdmKcTs.exe
  C:\Windows\System\vdmKcTs.exe
  2⤵
  PID:6284
- C:\Windows\System\YaKnjaZ.exe
  C:\Windows\System\YaKnjaZ.exe
  2⤵
  PID:6304
- C:\Windows\System\kWZAfga.exe
  C:\Windows\System\kWZAfga.exe
  2⤵
  PID:6324
- C:\Windows\System\cYvfotY.exe
  C:\Windows\System\cYvfotY.exe
  2⤵
  PID:6352
- C:\Windows\System\HnoQrLF.exe
  C:\Windows\System\HnoQrLF.exe
  2⤵
  PID:6372
- C:\Windows\System\CaejbUj.exe
  C:\Windows\System\CaejbUj.exe
  2⤵
  PID:6392
- C:\Windows\System\VRtIhog.exe
  C:\Windows\System\VRtIhog.exe
  2⤵
  PID:6412
- C:\Windows\System\IkHmKSa.exe
  C:\Windows\System\IkHmKSa.exe
  2⤵
  PID:6436
- C:\Windows\System\nRBsAvD.exe
  C:\Windows\System\nRBsAvD.exe
  2⤵
  PID:6456
- C:\Windows\System\OFVzEXh.exe
  C:\Windows\System\OFVzEXh.exe
  2⤵
  PID:6480
- C:\Windows\System\mmRyRbr.exe
  C:\Windows\System\mmRyRbr.exe
  2⤵
  PID:6500
- C:\Windows\System\PrmAZMi.exe
  C:\Windows\System\PrmAZMi.exe
  2⤵
  PID:6520
- C:\Windows\System\jkrJbUo.exe
  C:\Windows\System\jkrJbUo.exe
  2⤵
  PID:6544
- C:\Windows\System\ivBtUwq.exe
  C:\Windows\System\ivBtUwq.exe
  2⤵
  PID:6560
- C:\Windows\System\CKBZYaM.exe
  C:\Windows\System\CKBZYaM.exe
  2⤵
  PID:6588
- C:\Windows\System\pygmSdy.exe
  C:\Windows\System\pygmSdy.exe
  2⤵
  PID:6612
- C:\Windows\System\bgDnaoi.exe
  C:\Windows\System\bgDnaoi.exe
  2⤵
  PID:6628
- C:\Windows\System\wzPTpeE.exe
  C:\Windows\System\wzPTpeE.exe
  2⤵
  PID:6648
- C:\Windows\System\YvFGAoZ.exe
  C:\Windows\System\YvFGAoZ.exe
  2⤵
  PID:6672
- C:\Windows\System\OPSLdtw.exe
  C:\Windows\System\OPSLdtw.exe
  2⤵
  PID:6700
- C:\Windows\System\leuDAOy.exe
  C:\Windows\System\leuDAOy.exe
  2⤵
  PID:6716
- C:\Windows\System\pDnPoDP.exe
  C:\Windows\System\pDnPoDP.exe
  2⤵
  PID:6736
- C:\Windows\System\jitEbBp.exe
  C:\Windows\System\jitEbBp.exe
  2⤵
  PID:6756
- C:\Windows\System\zfzeJql.exe
  C:\Windows\System\zfzeJql.exe
  2⤵
  PID:6776
- C:\Windows\System\MbLwBKl.exe
  C:\Windows\System\MbLwBKl.exe
  2⤵
  PID:6796
- C:\Windows\System\MgDthjq.exe
  C:\Windows\System\MgDthjq.exe
  2⤵
  PID:6816
- C:\Windows\System\QiyjfjG.exe
  C:\Windows\System\QiyjfjG.exe
  2⤵
  PID:6840
- C:\Windows\System\JXrGZAb.exe
  C:\Windows\System\JXrGZAb.exe
  2⤵
  PID:6860
- C:\Windows\System\BnYdvOY.exe
  C:\Windows\System\BnYdvOY.exe
  2⤵
  PID:6880
- C:\Windows\System\euKKVhI.exe
  C:\Windows\System\euKKVhI.exe
  2⤵
  PID:6900
- C:\Windows\System\TaWcMBh.exe
  C:\Windows\System\TaWcMBh.exe
  2⤵
  PID:6924
- C:\Windows\System\iZXgKQA.exe
  C:\Windows\System\iZXgKQA.exe
  2⤵
  PID:6940
- C:\Windows\System\rGbyLNR.exe
  C:\Windows\System\rGbyLNR.exe
  2⤵
  PID:6964
- C:\Windows\System\bsBBKXC.exe
  C:\Windows\System\bsBBKXC.exe
  2⤵
  PID:6988
- C:\Windows\System\EdKeRCN.exe
  C:\Windows\System\EdKeRCN.exe
  2⤵
  PID:7008
- C:\Windows\System\ZJOCHSz.exe
  C:\Windows\System\ZJOCHSz.exe
  2⤵
  PID:7028
- C:\Windows\System\RIXAwPz.exe
  C:\Windows\System\RIXAwPz.exe
  2⤵
  PID:7044
- C:\Windows\System\pTluTbU.exe
  C:\Windows\System\pTluTbU.exe
  2⤵
  PID:7068
- C:\Windows\System\hNhyHlj.exe
  C:\Windows\System\hNhyHlj.exe
  2⤵
  PID:7088
- C:\Windows\System\QCgynif.exe
  C:\Windows\System\QCgynif.exe
  2⤵
  PID:7108
- C:\Windows\System\NsEOBfp.exe
  C:\Windows\System\NsEOBfp.exe
  2⤵
  PID:7136
- C:\Windows\System\nZavjMj.exe
  C:\Windows\System\nZavjMj.exe
  2⤵
  PID:7152
- C:\Windows\System\Phcfizb.exe
  C:\Windows\System\Phcfizb.exe
  2⤵
  PID:5116
- C:\Windows\System\dAGhGqV.exe
  C:\Windows\System\dAGhGqV.exe
  2⤵
  PID:5380
- C:\Windows\System\NTPpSwi.exe
  C:\Windows\System\NTPpSwi.exe
  2⤵
  PID:2552
- C:\Windows\System\CvniUqs.exe
  C:\Windows\System\CvniUqs.exe
  2⤵
  PID:4180
- C:\Windows\System\XVhVihH.exe
  C:\Windows\System\XVhVihH.exe
  2⤵
  PID:6148
- C:\Windows\System\JbqvZdK.exe
  C:\Windows\System\JbqvZdK.exe
  2⤵
  PID:4532
- C:\Windows\System\OgsgJcr.exe
  C:\Windows\System\OgsgJcr.exe
  2⤵
  PID:6208
- C:\Windows\System\yevrvtU.exe
  C:\Windows\System\yevrvtU.exe
  2⤵
  PID:884
- C:\Windows\System\rwzeIob.exe
  C:\Windows\System\rwzeIob.exe
  2⤵
  PID:6360
- C:\Windows\System\tPLiTNk.exe
  C:\Windows\System\tPLiTNk.exe
  2⤵
  PID:2928
- C:\Windows\System\egZGcta.exe
  C:\Windows\System\egZGcta.exe
  2⤵
  PID:2472
- C:\Windows\System\xGWNITb.exe
  C:\Windows\System\xGWNITb.exe
  2⤵
  PID:5948
- C:\Windows\System\yLEXoCo.exe
  C:\Windows\System\yLEXoCo.exe
  2⤵
  PID:6608
- C:\Windows\System\HVFRrke.exe
  C:\Windows\System\HVFRrke.exe
  2⤵
  PID:6212
- C:\Windows\System\KThWqvt.exe
  C:\Windows\System\KThWqvt.exe
  2⤵
  PID:6256
- C:\Windows\System\ZcRGAHg.exe
  C:\Windows\System\ZcRGAHg.exe
  2⤵
  PID:6320
- C:\Windows\System\guizjKR.exe
  C:\Windows\System\guizjKR.exe
  2⤵
  PID:6848
- C:\Windows\System\BBKwxqG.exe
  C:\Windows\System\BBKwxqG.exe
  2⤵
  PID:1768
- C:\Windows\System\snIRjOf.exe
  C:\Windows\System\snIRjOf.exe
  2⤵
  PID:6952
- C:\Windows\System\tYfPBQb.exe
  C:\Windows\System\tYfPBQb.exe
  2⤵
  PID:6980
- C:\Windows\System\wRuynAu.exe
  C:\Windows\System\wRuynAu.exe
  2⤵
  PID:7060
- C:\Windows\System\XRYAnGu.exe
  C:\Windows\System\XRYAnGu.exe
  2⤵
  PID:7100
- C:\Windows\System\GmDYihg.exe
  C:\Windows\System\GmDYihg.exe
  2⤵
  PID:7176
- C:\Windows\System\ZjXrRMu.exe
  C:\Windows\System\ZjXrRMu.exe
  2⤵
  PID:7204
- C:\Windows\System\NIXqwyQ.exe
  C:\Windows\System\NIXqwyQ.exe
  2⤵
  PID:7224
- C:\Windows\System\HbwsYok.exe
  C:\Windows\System\HbwsYok.exe
  2⤵
  PID:7244
- C:\Windows\System\WesPgHj.exe
  C:\Windows\System\WesPgHj.exe
  2⤵
  PID:7268
- C:\Windows\System\OgqiOEt.exe
  C:\Windows\System\OgqiOEt.exe
  2⤵
  PID:7288
- C:\Windows\System\KVdqxEG.exe
  C:\Windows\System\KVdqxEG.exe
  2⤵
  PID:7304
- C:\Windows\System\cfLzECD.exe
  C:\Windows\System\cfLzECD.exe
  2⤵
  PID:7332
- C:\Windows\System\CkFfnmD.exe
  C:\Windows\System\CkFfnmD.exe
  2⤵
  PID:7348
- C:\Windows\System\obLxblp.exe
  C:\Windows\System\obLxblp.exe
  2⤵
  PID:7368
- C:\Windows\System\tvUloRk.exe
  C:\Windows\System\tvUloRk.exe
  2⤵
  PID:7388
- C:\Windows\System\vmCAnrP.exe
  C:\Windows\System\vmCAnrP.exe
  2⤵
  PID:7412
- C:\Windows\System\KxqqgJv.exe
  C:\Windows\System\KxqqgJv.exe
  2⤵
  PID:7428
- C:\Windows\System\xYMCUKO.exe
  C:\Windows\System\xYMCUKO.exe
  2⤵
  PID:7452
- C:\Windows\System\PzjDIat.exe
  C:\Windows\System\PzjDIat.exe
  2⤵
  PID:7476
- C:\Windows\System\bRxgWZl.exe
  C:\Windows\System\bRxgWZl.exe
  2⤵
  PID:7496
- C:\Windows\System\VctEVVt.exe
  C:\Windows\System\VctEVVt.exe
  2⤵
  PID:7516
- C:\Windows\System\ShMUUtS.exe
  C:\Windows\System\ShMUUtS.exe
  2⤵
  PID:7536
- C:\Windows\System\ZzTdhgc.exe
  C:\Windows\System\ZzTdhgc.exe
  2⤵
  PID:7560
- C:\Windows\System\suyeZrr.exe
  C:\Windows\System\suyeZrr.exe
  2⤵
  PID:7580
- C:\Windows\System\ngZiteD.exe
  C:\Windows\System\ngZiteD.exe
  2⤵
  PID:7600
- C:\Windows\System\yZGqnix.exe
  C:\Windows\System\yZGqnix.exe
  2⤵
  PID:7620
- C:\Windows\System\PqsEXPV.exe
  C:\Windows\System\PqsEXPV.exe
  2⤵
  PID:7640
- C:\Windows\System\dTkWONc.exe
  C:\Windows\System\dTkWONc.exe
  2⤵
  PID:7664
- C:\Windows\System\VmIIlNu.exe
  C:\Windows\System\VmIIlNu.exe
  2⤵
  PID:7684
- C:\Windows\System\cxZBGHI.exe
  C:\Windows\System\cxZBGHI.exe
  2⤵
  PID:7700
- C:\Windows\System\CJwRSUb.exe
  C:\Windows\System\CJwRSUb.exe
  2⤵
  PID:7728
- C:\Windows\System\IOZbOhm.exe
  C:\Windows\System\IOZbOhm.exe
  2⤵
  PID:7744
- C:\Windows\System\ILMopon.exe
  C:\Windows\System\ILMopon.exe
  2⤵
  PID:7764
- C:\Windows\System\doCUvbp.exe
  C:\Windows\System\doCUvbp.exe
  2⤵
  PID:7788
- C:\Windows\System\pNBzrGU.exe
  C:\Windows\System\pNBzrGU.exe
  2⤵
  PID:7812
- C:\Windows\System\BsokgOx.exe
  C:\Windows\System\BsokgOx.exe
  2⤵
  PID:7828
- C:\Windows\System\XZKkkny.exe
  C:\Windows\System\XZKkkny.exe
  2⤵
  PID:7852
- C:\Windows\System\XfYtsNZ.exe
  C:\Windows\System\XfYtsNZ.exe
  2⤵
  PID:7872
- C:\Windows\System\YehApJN.exe
  C:\Windows\System\YehApJN.exe
  2⤵
  PID:7892
- C:\Windows\System\KyTlexA.exe
  C:\Windows\System\KyTlexA.exe
  2⤵
  PID:7912
- C:\Windows\System\JJLRHmO.exe
  C:\Windows\System\JJLRHmO.exe
  2⤵
  PID:7928
- C:\Windows\System\Xspdgbs.exe
  C:\Windows\System\Xspdgbs.exe
  2⤵
  PID:7952
- C:\Windows\System\WutZIrs.exe
  C:\Windows\System\WutZIrs.exe
  2⤵
  PID:7976
- C:\Windows\System\XFtvhnu.exe
  C:\Windows\System\XFtvhnu.exe
  2⤵
  PID:7992
- C:\Windows\System\sTCHRww.exe
  C:\Windows\System\sTCHRww.exe
  2⤵
  PID:8020
- C:\Windows\System\eDTzkID.exe
  C:\Windows\System\eDTzkID.exe
  2⤵
  PID:8040
- C:\Windows\System\ionAakG.exe
  C:\Windows\System\ionAakG.exe
  2⤵
  PID:8056
- C:\Windows\System\tkBeYrB.exe
  C:\Windows\System\tkBeYrB.exe
  2⤵
  PID:8076
- C:\Windows\System\GEIHHus.exe
  C:\Windows\System\GEIHHus.exe
  2⤵
  PID:8100
- C:\Windows\System\woNJpdz.exe
  C:\Windows\System\woNJpdz.exe
  2⤵
  PID:8116
- C:\Windows\System\uBzbZZR.exe
  C:\Windows\System\uBzbZZR.exe
  2⤵
  PID:8140
- C:\Windows\System\jnyDnnX.exe
  C:\Windows\System\jnyDnnX.exe
  2⤵
  PID:8160
- C:\Windows\System\indkmJU.exe
  C:\Windows\System\indkmJU.exe
  2⤵
  PID:8180
- C:\Windows\System\XhBoaQo.exe
  C:\Windows\System\XhBoaQo.exe
  2⤵
  PID:7160
- C:\Windows\System\rYKNSdM.exe
  C:\Windows\System\rYKNSdM.exe
  2⤵
  PID:1512
- C:\Windows\System\OkwwzOt.exe
  C:\Windows\System\OkwwzOt.exe
  2⤵
  PID:3428
- C:\Windows\System\JKYDXEA.exe
  C:\Windows\System\JKYDXEA.exe
  2⤵
  PID:6176
- C:\Windows\System\jWeeiJD.exe
  C:\Windows\System\jWeeiJD.exe
  2⤵
  PID:6276
- C:\Windows\System\aTSwkdj.exe
  C:\Windows\System\aTSwkdj.exe
  2⤵
  PID:6344
- C:\Windows\System\RcEJYYv.exe
  C:\Windows\System\RcEJYYv.exe
  2⤵
  PID:6408
- C:\Windows\System\mTAGrIt.exe
  C:\Windows\System\mTAGrIt.exe
  2⤵
  PID:6784
- C:\Windows\System\ZXHUTKW.exe
  C:\Windows\System\ZXHUTKW.exe
  2⤵
  PID:7004
- C:\Windows\System\fCnvjeb.exe
  C:\Windows\System\fCnvjeb.exe
  2⤵
  PID:7036
- C:\Windows\System\gIuLmMB.exe
  C:\Windows\System\gIuLmMB.exe
  2⤵
  PID:7116
- C:\Windows\System\RSgEphN.exe
  C:\Windows\System\RSgEphN.exe
  2⤵
  PID:7216
- C:\Windows\System\gHBhnTn.exe
  C:\Windows\System\gHBhnTn.exe
  2⤵
  PID:7296
- C:\Windows\System\sDdAEAO.exe
  C:\Windows\System\sDdAEAO.exe
  2⤵
  PID:6680
- C:\Windows\System\TJoyqaP.exe
  C:\Windows\System\TJoyqaP.exe
  2⤵
  PID:6724
- C:\Windows\System\knCBpzW.exe
  C:\Windows\System\knCBpzW.exe
  2⤵
  PID:7340
- C:\Windows\System\UunLKqw.exe
  C:\Windows\System\UunLKqw.exe
  2⤵
  PID:7444
- C:\Windows\System\gwgggmY.exe
  C:\Windows\System\gwgggmY.exe
  2⤵
  PID:7492
- C:\Windows\System\WnySdOq.exe
  C:\Windows\System\WnySdOq.exe
  2⤵
  PID:6876
- C:\Windows\System\blUCBAy.exe
  C:\Windows\System\blUCBAy.exe
  2⤵
  PID:6892
- C:\Windows\System\HDPEqny.exe
  C:\Windows\System\HDPEqny.exe
  2⤵
  PID:8204
- C:\Windows\System\nfviDMi.exe
  C:\Windows\System\nfviDMi.exe
  2⤵
  PID:8224
- C:\Windows\System\uFRAWEw.exe
  C:\Windows\System\uFRAWEw.exe
  2⤵
  PID:8244
- C:\Windows\System\JDSpgFG.exe
  C:\Windows\System\JDSpgFG.exe
  2⤵
  PID:8264
- C:\Windows\System\IfDXiIq.exe
  C:\Windows\System\IfDXiIq.exe
  2⤵
  PID:8288
- C:\Windows\System\NrmEOcv.exe
  C:\Windows\System\NrmEOcv.exe
  2⤵
  PID:8308
- C:\Windows\System\jauiapL.exe
  C:\Windows\System\jauiapL.exe
  2⤵
  PID:8332
- C:\Windows\System\KVpABfT.exe
  C:\Windows\System\KVpABfT.exe
  2⤵
  PID:8352
- C:\Windows\System\TVMmKfg.exe
  C:\Windows\System\TVMmKfg.exe
  2⤵
  PID:8372
- C:\Windows\System\IiSzmip.exe
  C:\Windows\System\IiSzmip.exe
  2⤵
  PID:8392
- C:\Windows\System\KnoVSJK.exe
  C:\Windows\System\KnoVSJK.exe
  2⤵
  PID:8412
- C:\Windows\System\YWWoJpr.exe
  C:\Windows\System\YWWoJpr.exe
  2⤵
  PID:8436
- C:\Windows\System\drvhOBo.exe
  C:\Windows\System\drvhOBo.exe
  2⤵
  PID:8456
- C:\Windows\System\MrUIaRj.exe
  C:\Windows\System\MrUIaRj.exe
  2⤵
  PID:8476
- C:\Windows\System\DOLzXQt.exe
  C:\Windows\System\DOLzXQt.exe
  2⤵
  PID:8496
- C:\Windows\System\HYfuGAt.exe
  C:\Windows\System\HYfuGAt.exe
  2⤵
  PID:8516
- C:\Windows\System\uBxWXXN.exe
  C:\Windows\System\uBxWXXN.exe
  2⤵
  PID:8536
- C:\Windows\System\PLsNgUf.exe
  C:\Windows\System\PLsNgUf.exe
  2⤵
  PID:8552
- C:\Windows\System\ZmMyzSf.exe
  C:\Windows\System\ZmMyzSf.exe
  2⤵
  PID:8572
- C:\Windows\System\tOJlHHJ.exe
  C:\Windows\System\tOJlHHJ.exe
  2⤵
  PID:8592
- C:\Windows\System\JxuCvwS.exe
  C:\Windows\System\JxuCvwS.exe
  2⤵
  PID:8612
- C:\Windows\System\unIEzXw.exe
  C:\Windows\System\unIEzXw.exe
  2⤵
  PID:8636
- C:\Windows\System\yBITRgB.exe
  C:\Windows\System\yBITRgB.exe
  2⤵
  PID:8660
- C:\Windows\System\ACGmfjs.exe
  C:\Windows\System\ACGmfjs.exe
  2⤵
  PID:8680
- C:\Windows\System\YPqPmoI.exe
  C:\Windows\System\YPqPmoI.exe
  2⤵
  PID:8700
- C:\Windows\System\AGFIfXl.exe
  C:\Windows\System\AGFIfXl.exe
  2⤵
  PID:8716
- C:\Windows\System\dCgsCIK.exe
  C:\Windows\System\dCgsCIK.exe
  2⤵
  PID:8740
- C:\Windows\System\IUYgqwR.exe
  C:\Windows\System\IUYgqwR.exe
  2⤵
  PID:8756
- C:\Windows\System\guBltEe.exe
  C:\Windows\System\guBltEe.exe
  2⤵
  PID:8788
- C:\Windows\System\SabyxSr.exe
  C:\Windows\System\SabyxSr.exe
  2⤵
  PID:8808
- C:\Windows\System\CZVXOjo.exe
  C:\Windows\System\CZVXOjo.exe
  2⤵
  PID:8832
- C:\Windows\System\PZqaeSx.exe
  C:\Windows\System\PZqaeSx.exe
  2⤵
  PID:8852
- C:\Windows\System\pRONDFS.exe
  C:\Windows\System\pRONDFS.exe
  2⤵
  PID:8876
- C:\Windows\System\DIQyeAP.exe
  C:\Windows\System\DIQyeAP.exe
  2⤵
  PID:8896
- C:\Windows\System\rPMNjpF.exe
  C:\Windows\System\rPMNjpF.exe
  2⤵
  PID:8920
- C:\Windows\System\DLpyvIC.exe
  C:\Windows\System\DLpyvIC.exe
  2⤵
  PID:8940
- C:\Windows\System\yhXoNps.exe
  C:\Windows\System\yhXoNps.exe
  2⤵
  PID:8964
- C:\Windows\System\DqUJClo.exe
  C:\Windows\System\DqUJClo.exe
  2⤵
  PID:8984
- C:\Windows\System\sdXxgWw.exe
  C:\Windows\System\sdXxgWw.exe
  2⤵
  PID:9008
- C:\Windows\System\ZUsBzQu.exe
  C:\Windows\System\ZUsBzQu.exe
  2⤵
  PID:9028
- C:\Windows\System\RHTuAkN.exe
  C:\Windows\System\RHTuAkN.exe
  2⤵
  PID:9044
- C:\Windows\System\QOiiGAG.exe
  C:\Windows\System\QOiiGAG.exe
  2⤵
  PID:9068
- C:\Windows\System\PjcrkGP.exe
  C:\Windows\System\PjcrkGP.exe
  2⤵
  PID:9088
- C:\Windows\System\SDfHpZf.exe
  C:\Windows\System\SDfHpZf.exe
  2⤵
  PID:9112
- C:\Windows\System\ZGGBtYU.exe
  C:\Windows\System\ZGGBtYU.exe
  2⤵
  PID:9132
- C:\Windows\System\ZnkADiR.exe
  C:\Windows\System\ZnkADiR.exe
  2⤵
  PID:9156
- C:\Windows\System\CrtwQzE.exe
  C:\Windows\System\CrtwQzE.exe
  2⤵
  PID:9184
- C:\Windows\System\SUtNqIy.exe
  C:\Windows\System\SUtNqIy.exe
  2⤵
  PID:9204
- C:\Windows\System\FwmRWSk.exe
  C:\Windows\System\FwmRWSk.exe
  2⤵
  PID:208
- C:\Windows\System\mhXHSQN.exe
  C:\Windows\System\mhXHSQN.exe
  2⤵
  PID:6936
- C:\Windows\System\rjRNImp.exe
  C:\Windows\System\rjRNImp.exe
  2⤵
  PID:7844
- C:\Windows\System\KAztGkr.exe
  C:\Windows\System\KAztGkr.exe
  2⤵
  PID:1192
- C:\Windows\System\LkjOCRA.exe
  C:\Windows\System\LkjOCRA.exe
  2⤵
  PID:7260
- C:\Windows\System\rBPoLcx.exe
  C:\Windows\System\rBPoLcx.exe
  2⤵
  PID:8072
- C:\Windows\System\CQXzehS.exe
  C:\Windows\System\CQXzehS.exe
  2⤵
  PID:8188
- C:\Windows\System\BprTTtY.exe
  C:\Windows\System\BprTTtY.exe
  2⤵
  PID:6316
- C:\Windows\System\KOopAaG.exe
  C:\Windows\System\KOopAaG.exe
  2⤵
  PID:6752
- C:\Windows\System\BvprjUE.exe
  C:\Windows\System\BvprjUE.exe
  2⤵
  PID:7460
- C:\Windows\System\ItcAyMh.exe
  C:\Windows\System\ItcAyMh.exe
  2⤵
  PID:6472
- C:\Windows\System\KZVUnPL.exe
  C:\Windows\System\KZVUnPL.exe
  2⤵
  PID:7508
- C:\Windows\System\QkJLMea.exe
  C:\Windows\System\QkJLMea.exe
  2⤵
  PID:6576
- C:\Windows\System\IAfSkvD.exe
  C:\Windows\System\IAfSkvD.exe
  2⤵
  PID:6772
- C:\Windows\System\wgcXFsf.exe
  C:\Windows\System\wgcXFsf.exe
  2⤵
  PID:7572
- C:\Windows\System\lLNRSKu.exe
  C:\Windows\System\lLNRSKu.exe
  2⤵
  PID:8276
- C:\Windows\System\OncQsBt.exe
  C:\Windows\System\OncQsBt.exe
  2⤵
  PID:7740
- C:\Windows\System\LyxBOvg.exe
  C:\Windows\System\LyxBOvg.exe
  2⤵
  PID:9232
- C:\Windows\System\ZnShwyu.exe
  C:\Windows\System\ZnShwyu.exe
  2⤵
  PID:9252
- C:\Windows\System\MfsRaWX.exe
  C:\Windows\System\MfsRaWX.exe
  2⤵
  PID:9272
- C:\Windows\System\ReqhkYr.exe
  C:\Windows\System\ReqhkYr.exe
  2⤵
  PID:9300
- C:\Windows\System\ODKvXHu.exe
  C:\Windows\System\ODKvXHu.exe
  2⤵
  PID:9316
- C:\Windows\System\uoPSfqp.exe
  C:\Windows\System\uoPSfqp.exe
  2⤵
  PID:9336
- C:\Windows\System\YQFCKSo.exe
  C:\Windows\System\YQFCKSo.exe
  2⤵
  PID:9356
- C:\Windows\System\kwVMCzl.exe
  C:\Windows\System\kwVMCzl.exe
  2⤵
  PID:9384
- C:\Windows\System\oWtWNVL.exe
  C:\Windows\System\oWtWNVL.exe
  2⤵
  PID:9408
- C:\Windows\System\jkOYuKL.exe
  C:\Windows\System\jkOYuKL.exe
  2⤵
  PID:9424
- C:\Windows\System\eFkRSkP.exe
  C:\Windows\System\eFkRSkP.exe
  2⤵
  PID:9448
- C:\Windows\System\WRpyhaC.exe
  C:\Windows\System\WRpyhaC.exe
  2⤵
  PID:9472
- C:\Windows\System\xVzczTz.exe
  C:\Windows\System\xVzczTz.exe
  2⤵
  PID:9488
- C:\Windows\System\VfYXDYC.exe
  C:\Windows\System\VfYXDYC.exe
  2⤵
  PID:9508
- C:\Windows\System\FrPpTmc.exe
  C:\Windows\System\FrPpTmc.exe
  2⤵
  PID:9528
- C:\Windows\System\dViQpwI.exe
  C:\Windows\System\dViQpwI.exe
  2⤵
  PID:9552
- C:\Windows\System\bpQNmlc.exe
  C:\Windows\System\bpQNmlc.exe
  2⤵
  PID:9572
- C:\Windows\System\nQWqocz.exe
  C:\Windows\System\nQWqocz.exe
  2⤵
  PID:9592
- C:\Windows\System\QkmxDFv.exe
  C:\Windows\System\QkmxDFv.exe
  2⤵
  PID:9612
- C:\Windows\System\McGKXyE.exe
  C:\Windows\System\McGKXyE.exe
  2⤵
  PID:9632
- C:\Windows\System\vwvTFbH.exe
  C:\Windows\System\vwvTFbH.exe
  2⤵
  PID:9656
- C:\Windows\System\pGnlBje.exe
  C:\Windows\System\pGnlBje.exe
  2⤵
  PID:9680
- C:\Windows\System\zIeFMsV.exe
  C:\Windows\System\zIeFMsV.exe
  2⤵
  PID:9700
- C:\Windows\System\bEuozcR.exe
  C:\Windows\System\bEuozcR.exe
  2⤵
  PID:9720
- C:\Windows\System\KcGvcet.exe
  C:\Windows\System\KcGvcet.exe
  2⤵
  PID:9748
- C:\Windows\System\PLLovYE.exe
  C:\Windows\System\PLLovYE.exe
  2⤵
  PID:9768
- C:\Windows\System\XRUWOcT.exe
  C:\Windows\System\XRUWOcT.exe
  2⤵
  PID:9788
- C:\Windows\System\jIFBmwf.exe
  C:\Windows\System\jIFBmwf.exe
  2⤵
  PID:9808
- C:\Windows\System\diIstDB.exe
  C:\Windows\System\diIstDB.exe
  2⤵
  PID:9828
- C:\Windows\System\WozblQD.exe
  C:\Windows\System\WozblQD.exe
  2⤵
  PID:9844
- C:\Windows\System\KYnrtnZ.exe
  C:\Windows\System\KYnrtnZ.exe
  2⤵
  PID:9864
- C:\Windows\System\XkIIcjb.exe
  C:\Windows\System\XkIIcjb.exe
  2⤵
  PID:9888
- C:\Windows\System\kApmaQt.exe
  C:\Windows\System\kApmaQt.exe
  2⤵
  PID:9912
- C:\Windows\System\OMieQwN.exe
  C:\Windows\System\OMieQwN.exe
  2⤵
  PID:9936
- C:\Windows\System\lUFbmrH.exe
  C:\Windows\System\lUFbmrH.exe
  2⤵
  PID:9952
- C:\Windows\System\EGRwdoi.exe
  C:\Windows\System\EGRwdoi.exe
  2⤵
  PID:9976
- C:\Windows\System\eGcChbA.exe
  C:\Windows\System\eGcChbA.exe
  2⤵
  PID:9996
- C:\Windows\System\gLnamFW.exe
  C:\Windows\System\gLnamFW.exe
  2⤵
  PID:10016
- C:\Windows\System\WeybEUR.exe
  C:\Windows\System\WeybEUR.exe
  2⤵
  PID:10040
- C:\Windows\System\nWmhIOx.exe
  C:\Windows\System\nWmhIOx.exe
  2⤵
  PID:10060
- C:\Windows\System\royvwry.exe
  C:\Windows\System\royvwry.exe
  2⤵
  PID:10084
- C:\Windows\System\xSpbWeZ.exe
  C:\Windows\System\xSpbWeZ.exe
  2⤵
  PID:10100
- C:\Windows\System\iIGDpoU.exe
  C:\Windows\System\iIGDpoU.exe
  2⤵
  PID:10124
- C:\Windows\System\crpObiJ.exe
  C:\Windows\System\crpObiJ.exe
  2⤵
  PID:10144
- C:\Windows\System\ZdAnDxk.exe
  C:\Windows\System\ZdAnDxk.exe
  2⤵
  PID:10160
- C:\Windows\System\OvSHWTj.exe
  C:\Windows\System\OvSHWTj.exe
  2⤵
  PID:10184
- C:\Windows\System\tJNWImF.exe
  C:\Windows\System\tJNWImF.exe
  2⤵
  PID:10204
- C:\Windows\System\bvefTih.exe
  C:\Windows\System\bvefTih.exe
  2⤵
  PID:10224
- C:\Windows\System\ZwWUZmW.exe
  C:\Windows\System\ZwWUZmW.exe
  2⤵
  PID:8360
- C:\Windows\System\kFVGhEn.exe
  C:\Windows\System\kFVGhEn.exe
  2⤵
  PID:8452
- C:\Windows\System\RqjhGbB.exe
  C:\Windows\System\RqjhGbB.exe
  2⤵
  PID:8488
- C:\Windows\System\zZmhwGT.exe
  C:\Windows\System\zZmhwGT.exe
  2⤵
  PID:7200
- C:\Windows\System\hUdlGar.exe
  C:\Windows\System\hUdlGar.exe
  2⤵
  PID:8548
- C:\Windows\System\FmESbaP.exe
  C:\Windows\System\FmESbaP.exe
  2⤵
  PID:7920
- C:\Windows\System\CiNOkiL.exe
  C:\Windows\System\CiNOkiL.exe
  2⤵
  PID:8628
- C:\Windows\System\BrfAKLW.exe
  C:\Windows\System\BrfAKLW.exe
  2⤵
  PID:8012
- C:\Windows\System\VTqdLUy.exe
  C:\Windows\System\VTqdLUy.exe
  2⤵
  PID:8136
- C:\Windows\System\DHtixOw.exe
  C:\Windows\System\DHtixOw.exe
  2⤵
  PID:8848
- C:\Windows\System\URVKybi.exe
  C:\Windows\System\URVKybi.exe
  2⤵
  PID:2068
- C:\Windows\System\KCOflLm.exe
  C:\Windows\System\KCOflLm.exe
  2⤵
  PID:6828
- C:\Windows\System\azNAwtk.exe
  C:\Windows\System\azNAwtk.exe
  2⤵
  PID:9020
- C:\Windows\System\KqDCOor.exe
  C:\Windows\System\KqDCOor.exe
  2⤵
  PID:9036
- C:\Windows\System\xvygaem.exe
  C:\Windows\System\xvygaem.exe
  2⤵
  PID:6508
- C:\Windows\System\WouWLWn.exe
  C:\Windows\System\WouWLWn.exe
  2⤵
  PID:5968
- C:\Windows\System\wesBLAx.exe
  C:\Windows\System\wesBLAx.exe
  2⤵
  PID:10252
- C:\Windows\System\istzFKc.exe
  C:\Windows\System\istzFKc.exe
  2⤵
  PID:10268
- C:\Windows\System\ihqUynX.exe
  C:\Windows\System\ihqUynX.exe
  2⤵
  PID:10288
- C:\Windows\System\AVAYntZ.exe
  C:\Windows\System\AVAYntZ.exe
  2⤵
  PID:10312
- C:\Windows\System\eJxSIUy.exe
  C:\Windows\System\eJxSIUy.exe
  2⤵
  PID:10332
- C:\Windows\System\VyBxdee.exe
  C:\Windows\System\VyBxdee.exe
  2⤵
  PID:10348
- C:\Windows\System\jKFESLG.exe
  C:\Windows\System\jKFESLG.exe
  2⤵
  PID:10372
- C:\Windows\System\FpewHrB.exe
  C:\Windows\System\FpewHrB.exe
  2⤵
  PID:10388
- C:\Windows\System\AGJCqSP.exe
  C:\Windows\System\AGJCqSP.exe
  2⤵
  PID:10412
- C:\Windows\System\FceCUlB.exe
  C:\Windows\System\FceCUlB.exe
  2⤵
  PID:10428
- C:\Windows\System\nxvpaPS.exe
  C:\Windows\System\nxvpaPS.exe
  2⤵
  PID:10456
- C:\Windows\System\khicGgS.exe
  C:\Windows\System\khicGgS.exe
  2⤵
  PID:10480
- C:\Windows\System\fXlLLfM.exe
  C:\Windows\System\fXlLLfM.exe
  2⤵
  PID:10496
- C:\Windows\System\aKmcRHy.exe
  C:\Windows\System\aKmcRHy.exe
  2⤵
  PID:10520
- C:\Windows\System\YKuIHqn.exe
  C:\Windows\System\YKuIHqn.exe
  2⤵
  PID:10544
- C:\Windows\System\NKLRBIe.exe
  C:\Windows\System\NKLRBIe.exe
  2⤵
  PID:10568
- C:\Windows\System\aQZbLow.exe
  C:\Windows\System\aQZbLow.exe
  2⤵
  PID:10588
- C:\Windows\System\SyTHkLk.exe
  C:\Windows\System\SyTHkLk.exe
  2⤵
  PID:10608
- C:\Windows\System\YroKEJU.exe
  C:\Windows\System\YroKEJU.exe
  2⤵
  PID:10632
- C:\Windows\System\knsezWb.exe
  C:\Windows\System\knsezWb.exe
  2⤵
  PID:10656
- C:\Windows\System\appmqAu.exe
  C:\Windows\System\appmqAu.exe
  2⤵
  PID:10680
- C:\Windows\System\eQTQzRF.exe
  C:\Windows\System\eQTQzRF.exe
  2⤵
  PID:10700
- C:\Windows\System\KdZJxOC.exe
  C:\Windows\System\KdZJxOC.exe
  2⤵
  PID:10724
- C:\Windows\System\ZZgYmPp.exe
  C:\Windows\System\ZZgYmPp.exe
  2⤵
  PID:10744
- C:\Windows\System\gPnoLpH.exe
  C:\Windows\System\gPnoLpH.exe
  2⤵
  PID:10768
- C:\Windows\System\TXQQAdr.exe
  C:\Windows\System\TXQQAdr.exe
  2⤵
  PID:10788
- C:\Windows\System\TMcLQMw.exe
  C:\Windows\System\TMcLQMw.exe
  2⤵
  PID:10812
- C:\Windows\System\AFfdPKU.exe
  C:\Windows\System\AFfdPKU.exe
  2⤵
  PID:10832
- C:\Windows\System\BwjjImQ.exe
  C:\Windows\System\BwjjImQ.exe
  2⤵
  PID:10852
- C:\Windows\System\epnRssg.exe
  C:\Windows\System\epnRssg.exe
  2⤵
  PID:10884
- C:\Windows\System\nPepvRt.exe
  C:\Windows\System\nPepvRt.exe
  2⤵
  PID:10900
- C:\Windows\System\IcCpWfu.exe
  C:\Windows\System\IcCpWfu.exe
  2⤵
  PID:10920
- C:\Windows\System\gMiHoXy.exe
  C:\Windows\System\gMiHoXy.exe
  2⤵
  PID:10948
- C:\Windows\System\RNDDZEG.exe
  C:\Windows\System\RNDDZEG.exe
  2⤵
  PID:10964
- C:\Windows\System\LCqDamG.exe
  C:\Windows\System\LCqDamG.exe
  2⤵
  PID:10980
- C:\Windows\System\QyGZpwQ.exe
  C:\Windows\System\QyGZpwQ.exe
  2⤵
  PID:11000
- C:\Windows\System\KuGrQzo.exe
  C:\Windows\System\KuGrQzo.exe
  2⤵
  PID:11024
- C:\Windows\System\eqrqdWG.exe
  C:\Windows\System\eqrqdWG.exe
  2⤵
  PID:11048
- C:\Windows\System\goHtbBp.exe
  C:\Windows\System\goHtbBp.exe
  2⤵
  PID:11064
- C:\Windows\System\gXBqXyA.exe
  C:\Windows\System\gXBqXyA.exe
  2⤵
  PID:11092
- C:\Windows\System\QQOfzsk.exe
  C:\Windows\System\QQOfzsk.exe
  2⤵
  PID:11112
- C:\Windows\System\IQJXWjn.exe
  C:\Windows\System\IQJXWjn.exe
  2⤵
  PID:11140
- C:\Windows\System\dadqnSB.exe
  C:\Windows\System\dadqnSB.exe
  2⤵
  PID:11156
- C:\Windows\System\lTjzckL.exe
  C:\Windows\System\lTjzckL.exe
  2⤵
  PID:11180
- C:\Windows\System\WujDwxz.exe
  C:\Windows\System\WujDwxz.exe
  2⤵
  PID:11204
- C:\Windows\System\WsZfWGT.exe
  C:\Windows\System\WsZfWGT.exe
  2⤵
  PID:11224
- C:\Windows\System\ZhrcfQx.exe
  C:\Windows\System\ZhrcfQx.exe
  2⤵
  PID:11248
- C:\Windows\System\kjoqlSY.exe
  C:\Windows\System\kjoqlSY.exe
  2⤵
  PID:7588
- C:\Windows\System\YHljXfl.exe
  C:\Windows\System\YHljXfl.exe
  2⤵
  PID:6896
- C:\Windows\System\CmLytMu.exe
  C:\Windows\System\CmLytMu.exe
  2⤵
  PID:7636
- C:\Windows\System\YqjEApV.exe
  C:\Windows\System\YqjEApV.exe
  2⤵
  PID:6388
- C:\Windows\System\IhwfuAC.exe
  C:\Windows\System\IhwfuAC.exe
  2⤵
  PID:7680
- C:\Windows\System\FmHDJKi.exe
  C:\Windows\System\FmHDJKi.exe
  2⤵
  PID:6600
- C:\Windows\System\SIuHBVt.exe
  C:\Windows\System\SIuHBVt.exe
  2⤵
  PID:8032
- C:\Windows\System\cjOBxwL.exe
  C:\Windows\System\cjOBxwL.exe
  2⤵
  PID:5520
- C:\Windows\System\iRSkJwi.exe
  C:\Windows\System\iRSkJwi.exe
  2⤵
  PID:10156
- C:\Windows\System\IhQCxKl.exe
  C:\Windows\System\IhQCxKl.exe
  2⤵
  PID:10220
- C:\Windows\System\QNKosVT.exe
  C:\Windows\System\QNKosVT.exe
  2⤵
  PID:9052
- C:\Windows\System\VyVpGWg.exe
  C:\Windows\System\VyVpGWg.exe
  2⤵
  PID:7080
- C:\Windows\System\uSiXdhR.exe
  C:\Windows\System\uSiXdhR.exe
  2⤵
  PID:6832
- C:\Windows\System\uBenHct.exe
  C:\Windows\System\uBenHct.exe
  2⤵
  PID:9104
- C:\Windows\System\ziizUUd.exe
  C:\Windows\System\ziizUUd.exe
  2⤵
  PID:7408
- C:\Windows\System\HXhMWnL.exe
  C:\Windows\System\HXhMWnL.exe
  2⤵
  PID:8216
- C:\Windows\System\FjceQas.exe
  C:\Windows\System\FjceQas.exe
  2⤵
  PID:10452
- C:\Windows\System\rXboKBB.exe
  C:\Windows\System\rXboKBB.exe
  2⤵
  PID:7576
- C:\Windows\System\YwDUWXf.exe
  C:\Windows\System\YwDUWXf.exe
  2⤵
  PID:10092
- C:\Windows\System\gPEsjTp.exe
  C:\Windows\System\gPEsjTp.exe
  2⤵
  PID:7120
- C:\Windows\System\pLYOcso.exe
  C:\Windows\System\pLYOcso.exe
  2⤵
  PID:8676
- C:\Windows\System\TTrtlmW.exe
  C:\Windows\System\TTrtlmW.exe
  2⤵
  PID:10448
- C:\Windows\System\gWApRKN.exe
  C:\Windows\System\gWApRKN.exe
  2⤵
  PID:10300
- C:\Windows\System\UAvXBUw.exe
  C:\Windows\System\UAvXBUw.exe
  2⤵
  PID:10244
- C:\Windows\System\KuIumJD.exe
  C:\Windows\System\KuIumJD.exe
  2⤵
  PID:9944
- C:\Windows\System\Hoqhggr.exe
  C:\Windows\System\Hoqhggr.exe
  2⤵
  PID:7360
- C:\Windows\System\NgpYXxD.exe
  C:\Windows\System\NgpYXxD.exe
  2⤵
  PID:10692
- C:\Windows\System\kiXbDlk.exe
  C:\Windows\System\kiXbDlk.exe
  2⤵
  PID:8344
- C:\Windows\System\EIxxofa.exe
  C:\Windows\System\EIxxofa.exe
  2⤵
  PID:8408
- C:\Windows\System\Xjxnrvl.exe
  C:\Windows\System\Xjxnrvl.exe
  2⤵
  PID:8464
- C:\Windows\System\MtBkoCU.exe
  C:\Windows\System\MtBkoCU.exe
  2⤵
  PID:11268
- C:\Windows\System\dvMwzPf.exe
  C:\Windows\System\dvMwzPf.exe
  2⤵
  PID:11288
- C:\Windows\System\gxcbvLq.exe
  C:\Windows\System\gxcbvLq.exe
  2⤵
  PID:11316
- C:\Windows\System\xtiQVXf.exe
  C:\Windows\System\xtiQVXf.exe
  2⤵
  PID:11332
- C:\Windows\System\vGjTsLV.exe
  C:\Windows\System\vGjTsLV.exe
  2⤵
  PID:11348
- C:\Windows\System\DDjSXZr.exe
  C:\Windows\System\DDjSXZr.exe
  2⤵
  PID:11364
- C:\Windows\System\aEhXjSL.exe
  C:\Windows\System\aEhXjSL.exe
  2⤵
  PID:11380
- C:\Windows\System\eouebDF.exe
  C:\Windows\System\eouebDF.exe
  2⤵
  PID:11396
- C:\Windows\System\AbrGqqP.exe
  C:\Windows\System\AbrGqqP.exe
  2⤵
  PID:11420
- C:\Windows\System\IRLwOYM.exe
  C:\Windows\System\IRLwOYM.exe
  2⤵
  PID:11440
- C:\Windows\System\GMSyLxo.exe
  C:\Windows\System\GMSyLxo.exe
  2⤵
  PID:11464
- C:\Windows\System\BoRbsvo.exe
  C:\Windows\System\BoRbsvo.exe
  2⤵
  PID:11484
- C:\Windows\System\cmDJkDj.exe
  C:\Windows\System\cmDJkDj.exe
  2⤵
  PID:11504
- C:\Windows\System\CLVxMuz.exe
  C:\Windows\System\CLVxMuz.exe
  2⤵
  PID:11532
- C:\Windows\System\LZQdjgi.exe
  C:\Windows\System\LZQdjgi.exe
  2⤵
  PID:11552
- C:\Windows\System\YOhdnhP.exe
  C:\Windows\System\YOhdnhP.exe
  2⤵
  PID:11572
- C:\Windows\System\hnKBynI.exe
  C:\Windows\System\hnKBynI.exe
  2⤵
  PID:11592
- C:\Windows\System\NIhqpUa.exe
  C:\Windows\System\NIhqpUa.exe
  2⤵
  PID:11612
- C:\Windows\System\NRxxGfo.exe
  C:\Windows\System\NRxxGfo.exe
  2⤵
  PID:11632
- C:\Windows\System\rWLzXWN.exe
  C:\Windows\System\rWLzXWN.exe
  2⤵
  PID:11652
- C:\Windows\System\HYyBmOP.exe
  C:\Windows\System\HYyBmOP.exe
  2⤵
  PID:11684
- C:\Windows\System\JZnIRDo.exe
  C:\Windows\System\JZnIRDo.exe
  2⤵
  PID:11708
- C:\Windows\System\aKqtshX.exe
  C:\Windows\System\aKqtshX.exe
  2⤵
  PID:11728
- C:\Windows\System\UqvUrXd.exe
  C:\Windows\System\UqvUrXd.exe
  2⤵
  PID:11752
- C:\Windows\System\pqnXCXF.exe
  C:\Windows\System\pqnXCXF.exe
  2⤵
  PID:11768
- C:\Windows\System\oFmYHTW.exe
  C:\Windows\System\oFmYHTW.exe
  2⤵
  PID:11792
- C:\Windows\System\MNdBjyO.exe
  C:\Windows\System\MNdBjyO.exe
  2⤵
  PID:11816
- C:\Windows\System\mUfdxRR.exe
  C:\Windows\System\mUfdxRR.exe
  2⤵
  PID:11832
- C:\Windows\System\ZRrYPKN.exe
  C:\Windows\System\ZRrYPKN.exe
  2⤵
  PID:11864
- C:\Windows\System\AedLDLI.exe
  C:\Windows\System\AedLDLI.exe
  2⤵
  PID:11884
- C:\Windows\System\AeENRkF.exe
  C:\Windows\System\AeENRkF.exe
  2⤵
  PID:11904
- C:\Windows\System\sOFmnWm.exe
  C:\Windows\System\sOFmnWm.exe
  2⤵
  PID:11928
- C:\Windows\System\BWoSQoz.exe
  C:\Windows\System\BWoSQoz.exe
  2⤵
  PID:11948
- C:\Windows\System\uYwREbx.exe
  C:\Windows\System\uYwREbx.exe
  2⤵
  PID:11968
- C:\Windows\System\oIhkOgl.exe
  C:\Windows\System\oIhkOgl.exe
  2⤵
  PID:11988
- C:\Windows\System\DsJEZAu.exe
  C:\Windows\System\DsJEZAu.exe
  2⤵
  PID:12004
- C:\Windows\System\imwvgoR.exe
  C:\Windows\System\imwvgoR.exe
  2⤵
  PID:12028
- C:\Windows\System\rKBdIij.exe
  C:\Windows\System\rKBdIij.exe
  2⤵
  PID:12052
- C:\Windows\System\DcciTXm.exe
  C:\Windows\System\DcciTXm.exe
  2⤵
  PID:12072
- C:\Windows\System\KLykErC.exe
  C:\Windows\System\KLykErC.exe
  2⤵
  PID:12096
- C:\Windows\System\ccByGcL.exe
  C:\Windows\System\ccByGcL.exe
  2⤵
  PID:12120
- C:\Windows\System\tzFBBLL.exe
  C:\Windows\System\tzFBBLL.exe
  2⤵
  PID:12136
- C:\Windows\System\oYiDHLI.exe
  C:\Windows\System\oYiDHLI.exe
  2⤵
  PID:12164
- C:\Windows\System\PASwlrA.exe
  C:\Windows\System\PASwlrA.exe
  2⤵
  PID:12180
- C:\Windows\System\uqNuuiP.exe
  C:\Windows\System\uqNuuiP.exe
  2⤵
  PID:12204
- C:\Windows\System\yfeSYQN.exe
  C:\Windows\System\yfeSYQN.exe
  2⤵
  PID:12228
- C:\Windows\System\XKNshYy.exe
  C:\Windows\System\XKNshYy.exe
  2⤵
  PID:12244
- C:\Windows\System\XadmywX.exe
  C:\Windows\System\XadmywX.exe
  2⤵
  PID:12268
- C:\Windows\System\Iyzmpra.exe
  C:\Windows\System\Iyzmpra.exe
  2⤵
  PID:11032
- C:\Windows\System\qSSPacM.exe
  C:\Windows\System\qSSPacM.exe
  2⤵
  PID:11044
- C:\Windows\System\TezALOj.exe
  C:\Windows\System\TezALOj.exe
  2⤵
  PID:8568
- C:\Windows\System\zVjlaRA.exe
  C:\Windows\System\zVjlaRA.exe
  2⤵
  PID:9652
- C:\Windows\System\IrwGStH.exe
  C:\Windows\System\IrwGStH.exe
  2⤵
  PID:9696
- C:\Windows\System\afUWzyr.exe
  C:\Windows\System\afUWzyr.exe
  2⤵
  PID:9760
- C:\Windows\System\TMfJSjr.exe
  C:\Windows\System\TMfJSjr.exe
  2⤵
  PID:9840
- C:\Windows\System\hjbUaBP.exe
  C:\Windows\System\hjbUaBP.exe
  2⤵
  PID:7652
- C:\Windows\System\yPegLAH.exe
  C:\Windows\System\yPegLAH.exe
  2⤵
  PID:8772
- C:\Windows\System\vFoFFjq.exe
  C:\Windows\System\vFoFFjq.exe
  2⤵
  PID:10096
- C:\Windows\System\yoqeXHI.exe
  C:\Windows\System\yoqeXHI.exe
  2⤵
  PID:8932
- C:\Windows\System\vrLiQUp.exe
  C:\Windows\System\vrLiQUp.exe
  2⤵
  PID:8980
- C:\Windows\System\nrrWBmS.exe
  C:\Windows\System\nrrWBmS.exe
  2⤵
  PID:12292
- C:\Windows\System\JYfbBxA.exe
  C:\Windows\System\JYfbBxA.exe
  2⤵
  PID:12308
- C:\Windows\System\uLsOhTC.exe
  C:\Windows\System\uLsOhTC.exe
  2⤵
  PID:12328
- C:\Windows\System\ZXwOHxD.exe
  C:\Windows\System\ZXwOHxD.exe
  2⤵
  PID:12344
- C:\Windows\System\NaoRIjc.exe
  C:\Windows\System\NaoRIjc.exe
  2⤵
  PID:12360
- C:\Windows\System\sQMkCJD.exe
  C:\Windows\System\sQMkCJD.exe
  2⤵
  PID:12376
- C:\Windows\System\upjESxF.exe
  C:\Windows\System\upjESxF.exe
  2⤵
  PID:12392
- C:\Windows\System\LWoicBo.exe
  C:\Windows\System\LWoicBo.exe
  2⤵
  PID:12408
- C:\Windows\System\SuZcDwT.exe
  C:\Windows\System\SuZcDwT.exe
  2⤵
  PID:12424
- C:\Windows\System\FEzgbwB.exe
  C:\Windows\System\FEzgbwB.exe
  2⤵
  PID:12448
- C:\Windows\System\KRBYmsk.exe
  C:\Windows\System\KRBYmsk.exe
  2⤵
  PID:12464
- C:\Windows\System\EnhJDaO.exe
  C:\Windows\System\EnhJDaO.exe
  2⤵
  PID:12488
- C:\Windows\System\xLsfoTo.exe
  C:\Windows\System\xLsfoTo.exe
  2⤵
  PID:12512
- C:\Windows\System\XRTTKYb.exe
  C:\Windows\System\XRTTKYb.exe
  2⤵
  PID:12532
- C:\Windows\System\MzwpJCO.exe
  C:\Windows\System\MzwpJCO.exe
  2⤵
  PID:12560
- C:\Windows\System\SRvYHow.exe
  C:\Windows\System\SRvYHow.exe
  2⤵
  PID:12576
- C:\Windows\System\vAKdUCf.exe
  C:\Windows\System\vAKdUCf.exe
  2⤵
  PID:12600
- C:\Windows\System\lfCFBAB.exe
  C:\Windows\System\lfCFBAB.exe
  2⤵
  PID:12624
- C:\Windows\System\LwQeXUN.exe
  C:\Windows\System\LwQeXUN.exe
  2⤵
  PID:12652
- C:\Windows\System\gqCQyiP.exe
  C:\Windows\System\gqCQyiP.exe
  2⤵
  PID:12672
- C:\Windows\System\YGnzhuS.exe
  C:\Windows\System\YGnzhuS.exe
  2⤵
  PID:12700
- C:\Windows\System\RxCgSsk.exe
  C:\Windows\System\RxCgSsk.exe
  2⤵
  PID:12724
- C:\Windows\System\BfQurGd.exe
  C:\Windows\System\BfQurGd.exe
  2⤵
  PID:12748
- C:\Windows\System\SBtlorS.exe
  C:\Windows\System\SBtlorS.exe
  2⤵
  PID:12772
- C:\Windows\System\CvwXmwh.exe
  C:\Windows\System\CvwXmwh.exe
  2⤵
  PID:12796
- C:\Windows\System\nNEfhoZ.exe
  C:\Windows\System\nNEfhoZ.exe
  2⤵
  PID:12820
- C:\Windows\System\dsQuQbn.exe
  C:\Windows\System\dsQuQbn.exe
  2⤵
  PID:12852
- C:\Windows\System\zEjuBVS.exe
  C:\Windows\System\zEjuBVS.exe
  2⤵
  PID:12872
- C:\Windows\System\fUNbBfu.exe
  C:\Windows\System\fUNbBfu.exe
  2⤵
  PID:12896
- C:\Windows\System\ZpsCyCf.exe
  C:\Windows\System\ZpsCyCf.exe
  2⤵
  PID:12916
- C:\Windows\System\gkeOsWq.exe
  C:\Windows\System\gkeOsWq.exe
  2⤵
  PID:12932
- C:\Windows\System\rWtdAgU.exe
  C:\Windows\System\rWtdAgU.exe
  2⤵
  PID:12952
- C:\Windows\System\TxAkPRt.exe
  C:\Windows\System\TxAkPRt.exe
  2⤵
  PID:12968
- C:\Windows\System\nbhmRjp.exe
  C:\Windows\System\nbhmRjp.exe
  2⤵
  PID:12992
- C:\Windows\System\ZkXqaxY.exe
  C:\Windows\System\ZkXqaxY.exe
  2⤵
  PID:13036
- C:\Windows\System\NqRyHkK.exe
  C:\Windows\System\NqRyHkK.exe
  2⤵
  PID:13056
- C:\Windows\System\HdfyYBJ.exe
  C:\Windows\System\HdfyYBJ.exe
  2⤵
  PID:13084
- C:\Windows\System\ifMXyYO.exe
  C:\Windows\System\ifMXyYO.exe
  2⤵
  PID:13108
- C:\Windows\System\NfcIgaC.exe
  C:\Windows\System\NfcIgaC.exe
  2⤵
  PID:13132
- C:\Windows\System\huNUqPT.exe
  C:\Windows\System\huNUqPT.exe
  2⤵
  PID:13152
- C:\Windows\System\nmLzcGx.exe
  C:\Windows\System\nmLzcGx.exe
  2⤵
  PID:13168
- C:\Windows\System\ykNTwZs.exe
  C:\Windows\System\ykNTwZs.exe
  2⤵
  PID:8844
- C:\Windows\System\jUAXSik.exe
  C:\Windows\System\jUAXSik.exe
  2⤵
  PID:6404
- C:\Windows\System\oTmdqJP.exe
  C:\Windows\System\oTmdqJP.exe
  2⤵
  PID:10404
- C:\Windows\System\PmndyCD.exe
  C:\Windows\System\PmndyCD.exe
  2⤵
  PID:8960
- C:\Windows\System\vlYEzra.exe
  C:\Windows\System\vlYEzra.exe
  2⤵
  PID:9372
- C:\Windows\System\ytZfzqa.exe
  C:\Windows\System\ytZfzqa.exe
  2⤵
  PID:11600
- C:\Windows\System\eSpLJZi.exe
  C:\Windows\System\eSpLJZi.exe
  2⤵
  PID:11744
- C:\Windows\System\BSkFfxC.exe
  C:\Windows\System\BSkFfxC.exe
  2⤵
  PID:11804
- C:\Windows\System\xqVekOS.exe
  C:\Windows\System\xqVekOS.exe
  2⤵
  PID:11876
- C:\Windows\System\OkEQSEK.exe
  C:\Windows\System\OkEQSEK.exe
  2⤵
  PID:11912
- C:\Windows\System\nxayJlb.exe
  C:\Windows\System\nxayJlb.exe
  2⤵
  PID:11944
- C:\Windows\System\FjbBGrv.exe
  C:\Windows\System\FjbBGrv.exe
  2⤵
  PID:11984
- C:\Windows\System\OLOVupr.exe
  C:\Windows\System\OLOVupr.exe
  2⤵
  PID:12012
- C:\Windows\System\QyRPvxv.exe
  C:\Windows\System\QyRPvxv.exe
  2⤵
  PID:12036
- C:\Windows\System\BwFXBDj.exe
  C:\Windows\System\BwFXBDj.exe
  2⤵
  PID:12092
- C:\Windows\System\FOIbJnV.exe
  C:\Windows\System\FOIbJnV.exe
  2⤵
  PID:12156
- C:\Windows\System\gLrBQyS.exe
  C:\Windows\System\gLrBQyS.exe
  2⤵
  PID:12240
- C:\Windows\System\OYkShXN.exe
  C:\Windows\System\OYkShXN.exe
  2⤵
  PID:10648
- C:\Windows\System\yYnHfcm.exe
  C:\Windows\System\yYnHfcm.exe
  2⤵
  PID:12372
- C:\Windows\System\wMcTnIc.exe
  C:\Windows\System\wMcTnIc.exe
  2⤵
  PID:12520
- C:\Windows\System\WLlkLMf.exe
  C:\Windows\System\WLlkLMf.exe
  2⤵
  PID:12636
- C:\Windows\System\hNvnpDF.exe
  C:\Windows\System\hNvnpDF.exe
  2⤵
  PID:12720
- C:\Windows\System\gJbJVsG.exe
  C:\Windows\System\gJbJVsG.exe
  2⤵
  PID:12880
- C:\Windows\System\bcwAHtp.exe
  C:\Windows\System\bcwAHtp.exe
  2⤵
  PID:12944
- C:\Windows\System\jlcOEAG.exe
  C:\Windows\System\jlcOEAG.exe
  2⤵
  PID:13000
- C:\Windows\System\TsfRSRx.exe
  C:\Windows\System\TsfRSRx.exe
  2⤵
  PID:13096
- C:\Windows\System\VqXQOUN.exe
  C:\Windows\System\VqXQOUN.exe
  2⤵
  PID:13224
- C:\Windows\System\NpwlkNH.exe
  C:\Windows\System\NpwlkNH.exe
  2⤵
  PID:13272
- C:\Windows\System\gELNeNw.exe
  C:\Windows\System\gELNeNw.exe
  2⤵
  PID:8428
- C:\Windows\System\XcPolWB.exe
  C:\Windows\System\XcPolWB.exe
  2⤵
  PID:12940
- C:\Windows\System\flZOLuP.exe
  C:\Windows\System\flZOLuP.exe
  2⤵
  PID:4208
- C:\Windows\System\mLdLBuj.exe
  C:\Windows\System\mLdLBuj.exe
  2⤵
  PID:12196
- C:\Windows\System\MJsUgfS.exe
  C:\Windows\System\MJsUgfS.exe
  2⤵
  PID:9168
- C:\Windows\System\ixyFFLh.exe
  C:\Windows\System\ixyFFLh.exe
  2⤵
  PID:10972
- C:\Windows\System\vRYFOwU.exe
  C:\Windows\System\vRYFOwU.exe
  2⤵
  PID:8196
- C:\Windows\System\TLZDjaR.exe
  C:\Windows\System\TLZDjaR.exe
  2⤵
  PID:9876
- C:\Windows\System\vdXKEVY.exe
  C:\Windows\System\vdXKEVY.exe
  2⤵
  PID:8712
- C:\Windows\System\hsEjKJB.exe
  C:\Windows\System\hsEjKJB.exe
  2⤵
  PID:11824
- C:\Windows\System\LfHuvNl.exe
  C:\Windows\System\LfHuvNl.exe
  2⤵
  PID:13148
- C:\Windows\System\zMHFdwx.exe
  C:\Windows\System\zMHFdwx.exe
  2⤵
  PID:10740
- C:\Windows\System\eiRaTFW.exe
  C:\Windows\System\eiRaTFW.exe
  2⤵
  PID:10720
- C:\Windows\System\tCKAyCE.exe
  C:\Windows\System\tCKAyCE.exe
  2⤵
  PID:9224
- C:\Windows\System\oLYUTQd.exe
  C:\Windows\System\oLYUTQd.exe
  2⤵
  PID:8916
- C:\Windows\System\iABkhod.exe
  C:\Windows\System\iABkhod.exe
  2⤵
  PID:12804
- C:\Windows\System\zmIZWfO.exe
  C:\Windows\System\zmIZWfO.exe
  2⤵
  PID:10308
- C:\Windows\System\kJrXMns.exe
  C:\Windows\System\kJrXMns.exe
  2⤵
  PID:2224
- C:\Windows\System\cRyWHHZ.exe
  C:\Windows\System\cRyWHHZ.exe
  2⤵
  PID:12568
- C:\Windows\System\yPEMNEB.exe
  C:\Windows\System\yPEMNEB.exe
  2⤵
  PID:12432
- C:\Windows\System\whOhIWy.exe
  C:\Windows\System\whOhIWy.exe
  2⤵
  PID:7648
- C:\Windows\System\iVQqwch.exe
  C:\Windows\System\iVQqwch.exe
  2⤵
  PID:11840
- C:\Windows\System\SftNPCQ.exe
  C:\Windows\System\SftNPCQ.exe
  2⤵
  PID:10600
- C:\Windows\System\UFSzCaY.exe
  C:\Windows\System\UFSzCaY.exe
  2⤵
  PID:12188
- C:\Windows\System\YtvBUxI.exe
  C:\Windows\System\YtvBUxI.exe
  2⤵
  PID:11456
- C:\Windows\System\ngMUDzH.exe
  C:\Windows\System\ngMUDzH.exe
  2⤵
  PID:12680
- C:\Windows\System\IgBLxSi.exe
  C:\Windows\System\IgBLxSi.exe
  2⤵
  PID:9436
- C:\Windows\System\UuKFqiX.exe
  C:\Windows\System\UuKFqiX.exe
  2⤵
  PID:13064
- C:\Windows\System\bXilhuc.exe
  C:\Windows\System\bXilhuc.exe
  2⤵
  PID:13232
- C:\Windows\System\VYUuHSD.exe
  C:\Windows\System\VYUuHSD.exe
  2⤵
  PID:11624
- C:\Windows\System\dBmLHZM.exe
  C:\Windows\System\dBmLHZM.exe
  2⤵
  PID:13320
- C:\Windows\System\vRPdaym.exe
  C:\Windows\System\vRPdaym.exe
  2⤵
  PID:13336
- C:\Windows\System\ELXLqrl.exe
  C:\Windows\System\ELXLqrl.exe
  2⤵
  PID:13360
- C:\Windows\System\LxWiofJ.exe
  C:\Windows\System\LxWiofJ.exe
  2⤵
  PID:13388
- C:\Windows\System\sUiZulw.exe
  C:\Windows\System\sUiZulw.exe
  2⤵
  PID:13476
- C:\Windows\System\BhqZJpE.exe
  C:\Windows\System\BhqZJpE.exe
  2⤵
  PID:13496
- C:\Windows\System\oBSqzhS.exe
  C:\Windows\System\oBSqzhS.exe
  2⤵
  PID:13516
- C:\Windows\System\mUzhjwZ.exe
  C:\Windows\System\mUzhjwZ.exe
  2⤵
  PID:13544
- C:\Windows\System\jEDDHXg.exe
  C:\Windows\System\jEDDHXg.exe
  2⤵
  PID:13560
- C:\Windows\System\vFgieSn.exe
  C:\Windows\System\vFgieSn.exe
  2⤵
  PID:13584
- C:\Windows\System\moeGNET.exe
  C:\Windows\System\moeGNET.exe
  2⤵
  PID:13604
- C:\Windows\System\arOIJOd.exe
  C:\Windows\System\arOIJOd.exe
  2⤵
  PID:13628
- C:\Windows\System\nMaciaq.exe
  C:\Windows\System\nMaciaq.exe
  2⤵
  PID:13644
- C:\Windows\System\hYQEEQq.exe
  C:\Windows\System\hYQEEQq.exe
  2⤵
  PID:13672
- C:\Windows\System\xZjilFt.exe
  C:\Windows\System\xZjilFt.exe
  2⤵
  PID:13692
- C:\Windows\System\EjAqSou.exe
  C:\Windows\System\EjAqSou.exe
  2⤵
  PID:14164
- C:\Windows\System\bpfjALV.exe
  C:\Windows\System\bpfjALV.exe
  2⤵
  PID:14196
- C:\Windows\System\oWCaUXI.exe
  C:\Windows\System\oWCaUXI.exe
  2⤵
  PID:14216
- C:\Windows\System\FRsOoek.exe
  C:\Windows\System\FRsOoek.exe
  2⤵
  PID:14236
- C:\Windows\System\NzZAWAh.exe
  C:\Windows\System\NzZAWAh.exe
  2⤵
  PID:14256
- C:\Windows\System\MkFMtnM.exe
  C:\Windows\System\MkFMtnM.exe
  2⤵
  PID:14284
- C:\Windows\System\DXbDDqt.exe
  C:\Windows\System\DXbDDqt.exe
  2⤵
  PID:14320
- C:\Windows\System\xQkjFrr.exe
  C:\Windows\System\xQkjFrr.exe
  2⤵
  PID:7148
- C:\Windows\System\ZHcPfYG.exe
  C:\Windows\System\ZHcPfYG.exe
  2⤵
  PID:10196
- C:\Windows\System\DqruZUr.exe
  C:\Windows\System\DqruZUr.exe
  2⤵
  PID:11436
- C:\Windows\System\SOpyfOa.exe
  C:\Windows\System\SOpyfOa.exe
  2⤵
  PID:12892
- C:\Windows\System\ZmgsvZH.exe
  C:\Windows\System\ZmgsvZH.exe
  2⤵
  PID:12416
- C:\Windows\System\cRueDaq.exe
  C:\Windows\System\cRueDaq.exe
  2⤵
  PID:13220
- C:\Windows\System\zrfXgCX.exe
  C:\Windows\System\zrfXgCX.exe
  2⤵
  PID:10804
- C:\Windows\System\ZXAWqPN.exe
  C:\Windows\System\ZXAWqPN.exe
  2⤵
  PID:13216
- C:\Windows\System\coJiyWi.exe
  C:\Windows\System\coJiyWi.exe
  2⤵
  PID:13596
- C:\Windows\System\dqCaLPC.exe
  C:\Windows\System\dqCaLPC.exe
  2⤵
  PID:13620
- C:\Windows\System\mMfeTta.exe
  C:\Windows\System\mMfeTta.exe
  2⤵
  PID:11100
- C:\Windows\System\mvHSnBn.exe
  C:\Windows\System\mvHSnBn.exe
  2⤵
  PID:9716
- C:\Windows\System\mfaQnwg.exe
  C:\Windows\System\mfaQnwg.exe
  2⤵
  PID:9992
- C:\Windows\System\oKvcuPC.exe
  C:\Windows\System\oKvcuPC.exe
  2⤵
  PID:10236
- C:\Windows\System\XeKBxDC.exe
  C:\Windows\System\XeKBxDC.exe
  2⤵
  PID:11256
- C:\Windows\System\gRIZdDz.exe
  C:\Windows\System\gRIZdDz.exe
  2⤵
  PID:10536
- C:\Windows\System\CGYDEpF.exe
  C:\Windows\System\CGYDEpF.exe
  2⤵
  PID:12868
- C:\Windows\System\HToYVEA.exe
  C:\Windows\System\HToYVEA.exe
  2⤵
  PID:13904
- C:\Windows\System\mbHYhZx.exe
  C:\Windows\System\mbHYhZx.exe
  2⤵
  PID:13872
- C:\Windows\System\VJpCiGb.exe
  C:\Windows\System\VJpCiGb.exe
  2⤵
  PID:14060
- C:\Windows\System\trCDXna.exe
  C:\Windows\System\trCDXna.exe
  2⤵
  PID:14156
- C:\Windows\System\LydKqrA.exe
  C:\Windows\System\LydKqrA.exe
  2⤵
  PID:14064
- C:\Windows\System\rQWeyTn.exe
  C:\Windows\System\rQWeyTn.exe
  2⤵
  PID:14244
- C:\Windows\System\lIhMamr.exe
  C:\Windows\System\lIhMamr.exe
  2⤵
  PID:10736
- C:\Windows\System\uQuRFMH.exe
  C:\Windows\System\uQuRFMH.exe
  2⤵
  PID:12356
- C:\Windows\System\LyZUBtg.exe
  C:\Windows\System\LyZUBtg.exe
  2⤵
  PID:13936
- C:\Windows\System\tdFmnzK.exe
  C:\Windows\System\tdFmnzK.exe
  2⤵
  PID:10476
- C:\Windows\System\sTAitKE.exe
  C:\Windows\System\sTAitKE.exe
  2⤵
  PID:13440
- C:\Windows\System\poKNWzw.exe
  C:\Windows\System\poKNWzw.exe
  2⤵
  PID:13944
- C:\Windows\System\ailMrBg.exe
  C:\Windows\System\ailMrBg.exe
  2⤵
  PID:12144
- C:\Windows\System\tkCMzSN.exe
  C:\Windows\System\tkCMzSN.exe
  2⤵
  PID:14132
- C:\Windows\System\KmKuLJD.exe
  C:\Windows\System\KmKuLJD.exe
  2⤵
  PID:14172
- C:\Windows\System\ZncxvjI.exe
  C:\Windows\System\ZncxvjI.exe
  2⤵
  PID:740
- C:\Windows\System\BQFiNbB.exe
  C:\Windows\System\BQFiNbB.exe
  2⤵
  PID:13888
- C:\Windows\System\LFshCgt.exe
  C:\Windows\System\LFshCgt.exe
  2⤵
  PID:13708
- C:\Windows\System\gUsXiKh.exe
  C:\Windows\System\gUsXiKh.exe
  2⤵
  PID:3504
- C:\Windows\System\LuOnaSP.exe
  C:\Windows\System\LuOnaSP.exe
  2⤵
  PID:14028
- C:\Windows\System\lmiquAs.exe
  C:\Windows\System\lmiquAs.exe
  2⤵
  PID:13852
- C:\Windows\System\YLUXqYQ.exe
  C:\Windows\System\YLUXqYQ.exe
  2⤵
  PID:13864
- C:\Windows\System\UItBtND.exe
  C:\Windows\System\UItBtND.exe
  2⤵
  PID:14252
- C:\Windows\System\hEoHfaG.exe
  C:\Windows\System\hEoHfaG.exe
  2⤵
  PID:3912
- C:\Windows\System\OHpnhPp.exe
  C:\Windows\System\OHpnhPp.exe
  2⤵
  PID:1300
- C:\Windows\System\qdlXwFo.exe
  C:\Windows\System\qdlXwFo.exe
  2⤵
  PID:4416
- C:\Windows\System\orChuXu.exe
  C:\Windows\System\orChuXu.exe
  2⤵
  PID:14076
- C:\Windows\System\ZQUQGYy.exe
  C:\Windows\System\ZQUQGYy.exe
  2⤵
  PID:7908
- C:\Windows\System\QRWIlkc.exe
  C:\Windows\System\QRWIlkc.exe
  2⤵
  PID:3840
- C:\Windows\System\bPnAcGC.exe
  C:\Windows\System\bPnAcGC.exe
  2⤵
  PID:4184
- C:\Windows\System\mttmzft.exe
  C:\Windows\System\mttmzft.exe
  2⤵
  PID:4464
- C:\Windows\System\QJakACZ.exe
  C:\Windows\System\QJakACZ.exe
  2⤵
  PID:4480
- C:\Windows\System\YyvLKqV.exe
  C:\Windows\System\YyvLKqV.exe
  2⤵
  PID:4288
- C:\Windows\System\jGoqROc.exe
  C:\Windows\System\jGoqROc.exe
  2⤵
  PID:3480
- C:\Windows\System\TqrXfYq.exe
  C:\Windows\System\TqrXfYq.exe
  2⤵
  PID:13248
- C:\Windows\System\IERPnKQ.exe
  C:\Windows\System\IERPnKQ.exe
  2⤵
  PID:7936
- C:\Windows\System\hDZtsdt.exe
  C:\Windows\System\hDZtsdt.exe
  2⤵
  PID:13900
- C:\Windows\System\IGLjISn.exe
  C:\Windows\System\IGLjISn.exe
  2⤵
  PID:12716
- C:\Windows\System\SsKNpJX.exe
  C:\Windows\System\SsKNpJX.exe
  2⤵
  PID:12840
- C:\Windows\System\mKhEVco.exe
  C:\Windows\System\mKhEVco.exe
  2⤵
  PID:4088
- C:\Windows\System\qEebMLi.exe
  C:\Windows\System\qEebMLi.exe
  2⤵
  PID:3308
- C:\Windows\System\TrYPaFw.exe
  C:\Windows\System\TrYPaFw.exe
  2⤵
  PID:13356
- C:\Windows\System\dklLbaG.exe
  C:\Windows\System\dklLbaG.exe
  2⤵
  PID:3520
- C:\Windows\System\IhMinrY.exe
  C:\Windows\System\IhMinrY.exe
  2⤵
  PID:14296
- C:\Windows\System\YqZKKYl.exe
  C:\Windows\System\YqZKKYl.exe
  2⤵
  PID:3732
- C:\Windows\System\EYJNCcN.exe
  C:\Windows\System\EYJNCcN.exe
  2⤵
  PID:2764
- C:\Windows\System\SVbVzCp.exe
  C:\Windows\System\SVbVzCp.exe
  2⤵
  PID:14092
- C:\Windows\System\xGsuQvE.exe
  C:\Windows\System\xGsuQvE.exe
  2⤵
  PID:4944
- C:\Windows\System\ZZWxSZg.exe
  C:\Windows\System\ZZWxSZg.exe
  2⤵
  PID:5048
- C:\Windows\System\PpgRXuq.exe
  C:\Windows\System\PpgRXuq.exe
  2⤵
  PID:3056
- C:\Windows\System\dvYYREl.exe
  C:\Windows\System\dvYYREl.exe
  2⤵
  PID:1140
- C:\Windows\System\RFfiVic.exe
  C:\Windows\System\RFfiVic.exe
  2⤵
  PID:4712
- C:\Windows\System\yiLrNKo.exe
  C:\Windows\System\yiLrNKo.exe
  2⤵
  PID:2864
- C:\Windows\System\CFPKHgA.exe
  C:\Windows\System\CFPKHgA.exe
  2⤵
  PID:10556
- C:\Windows\System\yShabpW.exe
  C:\Windows\System\yShabpW.exe
  2⤵
  PID:10436
- C:\Windows\System\nLeOPnI.exe
  C:\Windows\System\nLeOPnI.exe
  2⤵
  PID:4068
- C:\Windows\System\SQjvZDt.exe
  C:\Windows\System\SQjvZDt.exe
  2⤵
  PID:4400
- C:\Windows\System\vaiWGcS.exe
  C:\Windows\System\vaiWGcS.exe
  2⤵
  PID:1700
- C:\Windows\System\NOhrREP.exe
  C:\Windows\System\NOhrREP.exe
  2⤵
  PID:7464
- C:\Windows\System\QSuHJBu.exe
  C:\Windows\System\QSuHJBu.exe
  2⤵
  PID:2656
- C:\Windows\System\NqIojFX.exe
  C:\Windows\System\NqIojFX.exe
  2⤵
  PID:4104
- C:\Windows\System\eCTMPgG.exe
  C:\Windows\System\eCTMPgG.exe
  2⤵
  PID:4380
- C:\Windows\System\WyMIrfG.exe
  C:\Windows\System\WyMIrfG.exe
  2⤵
  PID:3016
- C:\Windows\System\jmRjZRx.exe
  C:\Windows\System\jmRjZRx.exe
  2⤵
  PID:1572
- C:\Windows\System\JxKAmTr.exe
  C:\Windows\System\JxKAmTr.exe
  2⤵
  PID:368
- C:\Windows\System\KDZAHbE.exe
  C:\Windows\System\KDZAHbE.exe
  2⤵
  PID:2968
- C:\Windows\System\CWUOkeg.exe
  C:\Windows\System\CWUOkeg.exe
  2⤵
  PID:232
- C:\Windows\System\WECIkpb.exe
  C:\Windows\System\WECIkpb.exe
  2⤵
  PID:3940
- C:\Windows\System\WCTvDJe.exe
  C:\Windows\System\WCTvDJe.exe
  2⤵
  PID:14276
- C:\Windows\System\BItCsrV.exe
  C:\Windows\System\BItCsrV.exe
  2⤵
  PID:5592
- C:\Windows\System\QgWffTh.exe
  C:\Windows\System\QgWffTh.exe
  2⤵
  PID:5576
- C:\Windows\System\SfrVFyN.exe
  C:\Windows\System\SfrVFyN.exe
  2⤵
  PID:5348
- C:\Windows\System\AxkusdX.exe
  C:\Windows\System\AxkusdX.exe
  2⤵
  PID:4684
- C:\Windows\System\WYoHhtM.exe
  C:\Windows\System\WYoHhtM.exe
  2⤵
  PID:544
- C:\Windows\System\XTULMfN.exe
  C:\Windows\System\XTULMfN.exe
  2⤵
  PID:14208
- C:\Windows\System\HbcqQlj.exe
  C:\Windows\System\HbcqQlj.exe
  2⤵
  PID:2404
- C:\Windows\System\CtCTUkc.exe
  C:\Windows\System\CtCTUkc.exe
  2⤵
  PID:3368
- C:\Windows\System\ruZQcDE.exe
  C:\Windows\System\ruZQcDE.exe
  2⤵
  PID:2272
- C:\Windows\System\ColmSPZ.exe
  C:\Windows\System\ColmSPZ.exe
  2⤵
  PID:2808
- C:\Windows\System\yRqUGgr.exe
  C:\Windows\System\yRqUGgr.exe
  2⤵
  PID:5276
- C:\Windows\System\tpXLcMF.exe
  C:\Windows\System\tpXLcMF.exe
  2⤵
  PID:5644
- C:\Windows\System\TGGusfy.exe
  C:\Windows\System\TGGusfy.exe
  2⤵
  PID:12608
- C:\Windows\System\mBIkteu.exe
  C:\Windows\System\mBIkteu.exe
  2⤵
  PID:13924
- C:\Windows\System\wGcfNmM.exe
  C:\Windows\System\wGcfNmM.exe
  2⤵
  PID:348
- C:\Windows\System\euEHRgl.exe
  C:\Windows\System\euEHRgl.exe
  2⤵
  PID:5312
- C:\Windows\System\DApqFvx.exe
  C:\Windows\System\DApqFvx.exe
  2⤵
  PID:5396
- C:\Windows\System\hOUJvuT.exe
  C:\Windows\System\hOUJvuT.exe
  2⤵
  PID:3516
- C:\Windows\System\NDjlSZv.exe
  C:\Windows\System\NDjlSZv.exe
  2⤵
  PID:3136
- C:\Windows\System\CqFEGHY.exe
  C:\Windows\System\CqFEGHY.exe
  2⤵
  PID:2960
- C:\Windows\System\wLNoamK.exe
  C:\Windows\System\wLNoamK.exe
  2⤵
  PID:7544
- C:\Windows\System\qsUUDlu.exe
  C:\Windows\System\qsUUDlu.exe
  2⤵
  PID:8432
- C:\Windows\System\pbbfLRy.exe
  C:\Windows\System\pbbfLRy.exe
  2⤵
  PID:5720
- C:\Windows\System\OXFWjlm.exe
  C:\Windows\System\OXFWjlm.exe
  2⤵
  PID:1824
- C:\Windows\System\agnMkhV.exe
  C:\Windows\System\agnMkhV.exe
  2⤵
  PID:5728
- C:\Windows\System\tLnPTXF.exe
  C:\Windows\System\tLnPTXF.exe
  2⤵
  PID:2136
- C:\Windows\System\lWAoycy.exe
  C:\Windows\System\lWAoycy.exe
  2⤵
  PID:4152
- C:\Windows\System\TLyAAAL.exe
  C:\Windows\System\TLyAAAL.exe
  2⤵
  PID:3684
- C:\Windows\System\rNcQfmS.exe
  C:\Windows\System\rNcQfmS.exe
  2⤵
  PID:876
- C:\Windows\System\jHNewvy.exe
  C:\Windows\System\jHNewvy.exe
  2⤵
  PID:5824
- C:\Windows\System\pMSVLdy.exe
  C:\Windows\System\pMSVLdy.exe
  2⤵
  PID:4496
- C:\Windows\System\xQlSZBL.exe
  C:\Windows\System\xQlSZBL.exe
  2⤵
  PID:13504
- C:\Windows\System\sqjUqez.exe
  C:\Windows\System\sqjUqez.exe
  2⤵
  PID:5252
- C:\Windows\System\WoSWoZc.exe
  C:\Windows\System\WoSWoZc.exe
  2⤵
  PID:5568
- C:\Windows\System\twYJwkC.exe
  C:\Windows\System\twYJwkC.exe
  2⤵
  PID:3888
- C:\Windows\System\XJElLQM.exe
  C:\Windows\System\XJElLQM.exe
  2⤵
  PID:4396
- C:\Windows\System\qeqtWxc.exe
  C:\Windows\System\qeqtWxc.exe
  2⤵
  PID:3276
- C:\Windows\System\eOiUGgO.exe
  C:\Windows\System\eOiUGgO.exe
  2⤵
  PID:4448
- C:\Windows\System\GcKgWNQ.exe
  C:\Windows\System\GcKgWNQ.exe
  2⤵
  PID:8380
- C:\Windows\System\QiwCOkv.exe
  C:\Windows\System\QiwCOkv.exe
  2⤵
  PID:14292
- C:\Windows\System\ofLeaoI.exe
  C:\Windows\System\ofLeaoI.exe
  2⤵
  PID:5176
- C:\Windows\System\fBHeVFA.exe
  C:\Windows\System\fBHeVFA.exe
  2⤵
  PID:13524
- C:\Windows\System\wfUyZAp.exe
  C:\Windows\System\wfUyZAp.exe
  2⤵
  PID:1848
- C:\Windows\System\gXmRWua.exe
  C:\Windows\System\gXmRWua.exe
  2⤵
  PID:14372
- C:\Windows\System\YlDVKvG.exe
  C:\Windows\System\YlDVKvG.exe
  2⤵
  PID:14428
- C:\Windows\System\ZquoHhI.exe
  C:\Windows\System\ZquoHhI.exe
  2⤵
  PID:14648
- C:\Windows\System\qyMJeay.exe
  C:\Windows\System\qyMJeay.exe
  2⤵
  PID:15268
- C:\Windows\System\MSHxWvi.exe
  C:\Windows\System\MSHxWvi.exe
  2⤵
  PID:15332
- C:\Windows\System\KfrgyFs.exe
  C:\Windows\System\KfrgyFs.exe
  2⤵
  PID:2708
- C:\Windows\System\AQkeybQ.exe
  C:\Windows\System\AQkeybQ.exe
  2⤵
  PID:14380
- C:\Windows\System\FzeSnnz.exe
  C:\Windows\System\FzeSnnz.exe
  2⤵
  PID:14032
- C:\Windows\System\zHoXLUr.exe
  C:\Windows\System\zHoXLUr.exe
  2⤵
  PID:5768
- C:\Windows\System\igwnuTV.exe
  C:\Windows\System\igwnuTV.exe
  2⤵
  PID:14452
- C:\Windows\System\pLNxpCw.exe
  C:\Windows\System\pLNxpCw.exe
  2⤵
  PID:14484
- C:\Windows\System\BqFQZFh.exe
  C:\Windows\System\BqFQZFh.exe
  2⤵
  PID:8232
- C:\Windows\System\bMkdUfI.exe
  C:\Windows\System\bMkdUfI.exe
  2⤵
  PID:14368
- C:\Windows\System\gxDtzoK.exe
  C:\Windows\System\gxDtzoK.exe
  2⤵
  PID:14608
- C:\Windows\System\UDSoLbK.exe
  C:\Windows\System\UDSoLbK.exe
  2⤵
  PID:14684
- C:\Windows\System\RfNyOmo.exe
  C:\Windows\System\RfNyOmo.exe
  2⤵
  PID:14796
- C:\Windows\System\TznimTo.exe
  C:\Windows\System\TznimTo.exe
  2⤵
  PID:14812
- C:\Windows\System\oaGOxFl.exe
  C:\Windows\System\oaGOxFl.exe
  2⤵
  PID:14936
- C:\Windows\System\fZPkosM.exe
  C:\Windows\System\fZPkosM.exe
  2⤵
  PID:14980
- C:\Windows\System\uXyQCpe.exe
  C:\Windows\System\uXyQCpe.exe
  2⤵
  PID:15148
- C:\Windows\System\KOjgBty.exe
  C:\Windows\System\KOjgBty.exe
  2⤵
  PID:5784
- C:\Windows\System\fqbvfWu.exe
  C:\Windows\System\fqbvfWu.exe
  2⤵
  PID:3356
- C:\Windows\System\bROrntR.exe
  C:\Windows\System\bROrntR.exe
  2⤵
  PID:3196
- C:\Windows\System\vqridIC.exe
  C:\Windows\System\vqridIC.exe
  2⤵
  PID:5640
- C:\Windows\System\kudFWnr.exe
  C:\Windows\System\kudFWnr.exe
  2⤵
  PID:5840
- C:\Windows\System\mjZkFqY.exe
  C:\Windows\System\mjZkFqY.exe
  2⤵
  PID:14408
- C:\Windows\System\wLfxGba.exe
  C:\Windows\System\wLfxGba.exe
  2⤵
  PID:6056
- C:\Windows\System\aHtYoFL.exe
  C:\Windows\System\aHtYoFL.exe
  2⤵
  PID:14388
- C:\Windows\System\FYgTJBk.exe
  C:\Windows\System\FYgTJBk.exe
  2⤵
  PID:5072
- C:\Windows\System\PPNqCdS.exe
  C:\Windows\System\PPNqCdS.exe
  2⤵
  PID:3324
- C:\Windows\System\LCDBbfG.exe
  C:\Windows\System\LCDBbfG.exe
  2⤵
  PID:4132
- C:\Windows\System\ybNnpOs.exe
  C:\Windows\System\ybNnpOs.exe
  2⤵
  PID:14472
- C:\Windows\System\eNeJCkd.exe
  C:\Windows\System\eNeJCkd.exe
  2⤵
  PID:14344
- C:\Windows\System\OgLgGuv.exe
  C:\Windows\System\OgLgGuv.exe
  2⤵
  PID:14492
- C:\Windows\System\hzpjppm.exe
  C:\Windows\System\hzpjppm.exe
  2⤵
  PID:14732
- C:\Windows\System\vuRoobf.exe
  C:\Windows\System\vuRoobf.exe
  2⤵
  PID:14744
- C:\Windows\System\hDaYMan.exe
  C:\Windows\System\hDaYMan.exe
  2⤵
  PID:6348
- C:\Windows\System\DjjEoOa.exe
  C:\Windows\System\DjjEoOa.exe
  2⤵
  PID:15016
- C:\Windows\System\oFKgrsg.exe
  C:\Windows\System\oFKgrsg.exe
  2⤵
  PID:3876
- C:\Windows\System\HIQORdc.exe
  C:\Windows\System\HIQORdc.exe
  2⤵
  PID:14992
- C:\Windows\System\hDDxetZ.exe
  C:\Windows\System\hDDxetZ.exe
  2⤵
  PID:15004
- C:\Windows\System\xvdSlDz.exe
  C:\Windows\System\xvdSlDz.exe
  2⤵
  PID:15168
- C:\Windows\System\XOhwwze.exe
  C:\Windows\System\XOhwwze.exe
  2⤵
  PID:1936
- C:\Windows\System\GhKwzgp.exe
  C:\Windows\System\GhKwzgp.exe
  2⤵
  PID:15176
- C:\Windows\System\hYhNGHk.exe
  C:\Windows\System\hYhNGHk.exe
  2⤵
  PID:15248
- C:\Windows\System\VHSUlwL.exe
  C:\Windows\System\VHSUlwL.exe
  2⤵
  PID:6572
- C:\Windows\System\EkVINIa.exe
  C:\Windows\System\EkVINIa.exe
  2⤵
  PID:5496
- C:\Windows\System\OKkhReE.exe
  C:\Windows\System\OKkhReE.exe
  2⤵
  PID:14740
- C:\Windows\System\htvfxzc.exe
  C:\Windows\System\htvfxzc.exe
  2⤵
  PID:15320
- C:\Windows\System\oZuwFOe.exe
  C:\Windows\System\oZuwFOe.exe
  2⤵
  PID:6804
- C:\Windows\System\NaMpHDr.exe
  C:\Windows\System\NaMpHDr.exe
  2⤵
  PID:6336
- C:\Windows\System\XNPgmHE.exe
  C:\Windows\System\XNPgmHE.exe
  2⤵
  PID:2104
- C:\Windows\System\HxGQfve.exe
  C:\Windows\System\HxGQfve.exe
  2⤵
  PID:5188
- C:\Windows\System\LgAheNl.exe
  C:\Windows\System\LgAheNl.exe
  2⤵
  PID:4668
- C:\Windows\System\LiVyPuY.exe
  C:\Windows\System\LiVyPuY.exe
  2⤵
  PID:6764
- C:\Windows\System\KPsNVsS.exe
  C:\Windows\System\KPsNVsS.exe
  2⤵
  PID:3764
- C:\Windows\System\sYigABa.exe
  C:\Windows\System\sYigABa.exe
  2⤵
  PID:14396
- C:\Windows\System\SaShBuP.exe
  C:\Windows\System\SaShBuP.exe
  2⤵
  PID:6976
- C:\Windows\System\xygYSJW.exe
  C:\Windows\System\xygYSJW.exe
  2⤵
  PID:1188
- C:\Windows\System\ffetqxR.exe
  C:\Windows\System\ffetqxR.exe
  2⤵
  PID:2312
- C:\Windows\System\soPxPZs.exe
  C:\Windows\System\soPxPZs.exe
  2⤵
  PID:4384
- C:\Windows\System\UYIuWiv.exe
  C:\Windows\System\UYIuWiv.exe
  2⤵
  PID:6640
- C:\Windows\System\oCpRwAy.exe
  C:\Windows\System\oCpRwAy.exe
  2⤵
  PID:14804
- C:\Windows\System\Yoopnhf.exe
  C:\Windows\System\Yoopnhf.exe
  2⤵
  PID:2024
- C:\Windows\System\nFhGREQ.exe
  C:\Windows\System\nFhGREQ.exe
  2⤵
  PID:14712
- C:\Windows\System\qxdhDsB.exe
  C:\Windows\System\qxdhDsB.exe
  2⤵
  PID:14896
- C:\Windows\System\XBttBRh.exe
  C:\Windows\System\XBttBRh.exe
  2⤵
  PID:7440
- C:\Windows\System\xpTkpXX.exe
  C:\Windows\System\xpTkpXX.exe
  2⤵
  PID:14916
- C:\Windows\System\uFrYpNj.exe
  C:\Windows\System\uFrYpNj.exe
  2⤵
  PID:13684
- C:\Windows\System\mHeOUDq.exe
  C:\Windows\System\mHeOUDq.exe
  2⤵
  PID:15292
- C:\Windows\System\CsMdERt.exe
  C:\Windows\System\CsMdERt.exe
  2⤵
  PID:6476
- C:\Windows\System\ashQaXf.exe
  C:\Windows\System\ashQaXf.exe
  2⤵
  PID:15192
- C:\Windows\System\DyWaWld.exe
  C:\Windows\System\DyWaWld.exe
  2⤵
  PID:6380
- C:\Windows\System\kBsZmYI.exe
  C:\Windows\System\kBsZmYI.exe
  2⤵
  PID:9404
- C:\Windows\System\CCuHeSB.exe
  C:\Windows\System\CCuHeSB.exe
  2⤵
  PID:9676
- C:\Windows\System\osEnCqL.exe
  C:\Windows\System\osEnCqL.exe
  2⤵
  PID:9732
- C:\Windows\System\DoXayCW.exe
  C:\Windows\System\DoXayCW.exe
  2⤵
  PID:14424
- C:\Windows\System\qfhBYFG.exe
  C:\Windows\System\qfhBYFG.exe
  2⤵
  PID:5588
- C:\Windows\System\nZQTsXk.exe
  C:\Windows\System\nZQTsXk.exe
  2⤵
  PID:14928
- C:\Windows\System\ICEmBTa.exe
  C:\Windows\System\ICEmBTa.exe
  2⤵
  PID:7124
- C:\Windows\System\zTBusaV.exe
  C:\Windows\System\zTBusaV.exe
  2⤵
  PID:9100
- C:\Windows\System\SQxgwZL.exe
  C:\Windows\System\SQxgwZL.exe
  2⤵
  PID:7276
- C:\Windows\System\wHVAFdX.exe
  C:\Windows\System\wHVAFdX.exe
  2⤵
  PID:6300
- C:\Windows\System\AlTXQxC.exe
  C:\Windows\System\AlTXQxC.exe
  2⤵
  PID:8252
- C:\Windows\System\MrVgjRu.exe
  C:\Windows\System\MrVgjRu.exe
  2⤵
  PID:9260
- C:\Windows\System\fZHkVoj.exe
  C:\Windows\System\fZHkVoj.exe
  2⤵
  PID:9368
- C:\Windows\System\GzhlqZm.exe
  C:\Windows\System\GzhlqZm.exe
  2⤵
  PID:9432
- C:\Windows\System\CDjEGMa.exe
  C:\Windows\System\CDjEGMa.exe
  2⤵
  PID:6272
- C:\Windows\System\qhGwJJJ.exe
  C:\Windows\System\qhGwJJJ.exe
  2⤵
  PID:4836
- C:\Windows\System\TBCAMNC.exe
  C:\Windows\System\TBCAMNC.exe
  2⤵
  PID:11036
- C:\Windows\System\ehMwOqG.exe
  C:\Windows\System\ehMwOqG.exe
  2⤵
  PID:14824
- C:\Windows\System\rjnuKpG.exe
  C:\Windows\System\rjnuKpG.exe
  2⤵
  PID:15068
- C:\Windows\System\NlkpjGX.exe
  C:\Windows\System\NlkpjGX.exe
  2⤵
  PID:8524
- C:\Windows\System\dcuFuOf.exe
  C:\Windows\System\dcuFuOf.exe
  2⤵
  PID:7144
- C:\Windows\System\ZIgGVbZ.exe
  C:\Windows\System\ZIgGVbZ.exe
  2⤵
  PID:7692
- C:\Windows\System\wGCOVzE.exe
  C:\Windows\System\wGCOVzE.exe
  2⤵
  PID:8652
- C:\Windows\System\HnbLroZ.exe
  C:\Windows\System\HnbLroZ.exe
  2⤵
  PID:9968
- C:\Windows\System\KqrqaeR.exe
  C:\Windows\System\KqrqaeR.exe
  2⤵
  PID:8512
- C:\Windows\System\HakNUyb.exe
  C:\Windows\System\HakNUyb.exe
  2⤵
  PID:8200
- C:\Windows\System\VcvYOlb.exe
  C:\Windows\System\VcvYOlb.exe
  2⤵
  PID:3656
- C:\Windows\System\DOnmdUy.exe
  C:\Windows\System\DOnmdUy.exe
  2⤵
  PID:10368
- C:\Windows\System\VIIWFhO.exe
  C:\Windows\System\VIIWFhO.exe
  2⤵
  PID:8564
- C:\Windows\System\NJxZvvn.exe
  C:\Windows\System\NJxZvvn.exe
  2⤵
  PID:8816
- C:\Windows\System\NaPuJBj.exe
  C:\Windows\System\NaPuJBj.exe
  2⤵
  PID:6424
- C:\Windows\System\iAcfDuy.exe
  C:\Windows\System\iAcfDuy.exe
  2⤵
  PID:14448
- C:\Windows\System\FKLWKSq.exe
  C:\Windows\System\FKLWKSq.exe
  2⤵
  PID:7988
- C:\Windows\System\LrrfNRO.exe
  C:\Windows\System\LrrfNRO.exe
  2⤵
  PID:8588
- C:\Windows\System\HrgLHwP.exe
  C:\Windows\System\HrgLHwP.exe
  2⤵
  PID:12844
- C:\Windows\System\soPSQFI.exe
  C:\Windows\System\soPSQFI.exe
  2⤵
  PID:8088
- C:\Windows\System\mQgFRTH.exe
  C:\Windows\System\mQgFRTH.exe
  2⤵
  PID:12648
- C:\Windows\System\VPkbHpW.exe
  C:\Windows\System\VPkbHpW.exe
  2⤵
  PID:8956
- C:\Windows\System\uEbLOCC.exe
  C:\Windows\System\uEbLOCC.exe
  2⤵
  PID:15296
- C:\Windows\System\MMzcwVe.exe
  C:\Windows\System\MMzcwVe.exe
  2⤵
  PID:7084
- C:\Windows\System\HTGmhuR.exe
  C:\Windows\System\HTGmhuR.exe
  2⤵
  PID:9392
- C:\Windows\System\dOCnLHL.exe
  C:\Windows\System\dOCnLHL.exe
  2⤵
  PID:1468
- C:\Windows\System\HDmSNNq.exe
  C:\Windows\System\HDmSNNq.exe
  2⤵
  PID:3920
- C:\Windows\System\WeKXvEg.exe
  C:\Windows\System\WeKXvEg.exe
  2⤵
  PID:6656
- C:\Windows\System\RVwMYNP.exe
  C:\Windows\System\RVwMYNP.exe
  2⤵
  PID:8004
- C:\Windows\System\wiRQdge.exe
  C:\Windows\System\wiRQdge.exe
  2⤵
  PID:7972
- C:\Windows\System\PCRiLFf.exe
  C:\Windows\System\PCRiLFf.exe
  2⤵
  PID:8972
- C:\Windows\System\RDZKIgZ.exe
  C:\Windows\System\RDZKIgZ.exe
  2⤵
  PID:11852
- C:\Windows\System\KlssCYm.exe
  C:\Windows\System\KlssCYm.exe
  2⤵
  PID:4904
- C:\Windows\System\URgWyjx.exe
  C:\Windows\System\URgWyjx.exe
  2⤵
  PID:7760
- C:\Windows\System\fhFrZOK.exe
  C:\Windows\System\fhFrZOK.exe
  2⤵
  PID:12060
- C:\Windows\System\oKbsKlW.exe
  C:\Windows\System\oKbsKlW.exe
  2⤵
  PID:6708
- C:\Windows\System\dvsMvlp.exe
  C:\Windows\System\dvsMvlp.exe
  2⤵
  PID:7436
- C:\Windows\System\IrAEhmh.exe
  C:\Windows\System\IrAEhmh.exe
  2⤵
  PID:14808
- C:\Windows\System\YolGsdb.exe
  C:\Windows\System\YolGsdb.exe
  2⤵
  PID:10860
- C:\Windows\System\eibwyJv.exe
  C:\Windows\System\eibwyJv.exe
  2⤵
  PID:9540
- C:\Windows\System\dHgZiUu.exe
  C:\Windows\System\dHgZiUu.exe
  2⤵
  PID:9324
- C:\Windows\System\tvtMDtZ.exe
  C:\Windows\System\tvtMDtZ.exe
  2⤵
  PID:12712
- C:\Windows\System\FHXVRtW.exe
  C:\Windows\System\FHXVRtW.exe
  2⤵
  PID:12784
- C:\Windows\System\xKJthjP.exe
  C:\Windows\System\xKJthjP.exe
  2⤵
  PID:11844
- C:\Windows\System\hHvmGXe.exe
  C:\Windows\System\hHvmGXe.exe
  2⤵
  PID:7940
- C:\Windows\System\KNYqIyC.exe
  C:\Windows\System\KNYqIyC.exe
  2⤵
  PID:9480
- C:\Windows\System\SEvvTsN.exe
  C:\Windows\System\SEvvTsN.exe
  2⤵
  PID:7888
- C:\Windows\System\MONLpJm.exe
  C:\Windows\System\MONLpJm.exe
  2⤵
  PID:9988
- C:\Windows\System\DyfNPcN.exe
  C:\Windows\System\DyfNPcN.exe
  2⤵
  PID:15112
- C:\Windows\System\hGueCrB.exe
  C:\Windows\System\hGueCrB.exe
  2⤵
  PID:15040
- C:\Windows\System\UEmxSiQ.exe
  C:\Windows\System\UEmxSiQ.exe
  2⤵
  PID:10796
- C:\Windows\System\pHXqWES.exe
  C:\Windows\System\pHXqWES.exe
  2⤵
  PID:8444
- C:\Windows\System\uyuILwY.exe
  C:\Windows\System\uyuILwY.exe
  2⤵
  PID:13256
- C:\Windows\System\NusLjrE.exe
  C:\Windows\System\NusLjrE.exe
  2⤵
  PID:6696
- C:\Windows\System\kJVhjqG.exe
  C:\Windows\System\kJVhjqG.exe
  2⤵
  PID:9004
- C:\Windows\System\quNtGsN.exe
  C:\Windows\System\quNtGsN.exe
  2⤵
  PID:15140
- C:\Windows\System\VXHLNuZ.exe
  C:\Windows\System\VXHLNuZ.exe
  2⤵
  PID:6248
- C:\Windows\System\LmZByZp.exe
  C:\Windows\System\LmZByZp.exe
  2⤵
  PID:13124
- C:\Windows\System\DueFzxf.exe
  C:\Windows\System\DueFzxf.exe
  2⤵
  PID:13212
- C:\Windows\System\MIzTkUx.exe
  C:\Windows\System\MIzTkUx.exe
  2⤵
  PID:9820
- C:\Windows\System\bDpwgqg.exe
  C:\Windows\System\bDpwgqg.exe
  2⤵
  PID:13288
- C:\Windows\System\bttlzjI.exe
  C:\Windows\System\bttlzjI.exe
  2⤵
  PID:10668
- C:\Windows\System\POlQQvv.exe
  C:\Windows\System\POlQQvv.exe
  2⤵
  PID:4084
- C:\Windows\System\rnBtlNb.exe
  C:\Windows\System\rnBtlNb.exe
  2⤵
  PID:10080
- C:\Windows\System\LKdeXbY.exe
  C:\Windows\System\LKdeXbY.exe
  2⤵
  PID:10976
- C:\Windows\System\PkxiHFH.exe
  C:\Windows\System\PkxiHFH.exe
  2⤵
  PID:10212
- C:\Windows\System\XcxzQNZ.exe
  C:\Windows\System\XcxzQNZ.exe
  2⤵
  PID:7256
- C:\Windows\System\Xznarmv.exe
  C:\Windows\System\Xznarmv.exe
  2⤵
  PID:11372
- C:\Windows\System\SArDzsV.exe
  C:\Windows\System\SArDzsV.exe
  2⤵
  PID:12352
- C:\Windows\System\fhvwwLF.exe
  C:\Windows\System\fhvwwLF.exe
  2⤵
  PID:4080
- C:\Windows\System\HeeJyTz.exe
  C:\Windows\System\HeeJyTz.exe
  2⤵
  PID:13100
- C:\Windows\System\xMYrgHn.exe
  C:\Windows\System\xMYrgHn.exe
  2⤵
  PID:12084
- C:\Windows\System\TauMZrO.exe
  C:\Windows\System\TauMZrO.exe
  2⤵
  PID:11588
- C:\Windows\System\KpAnlrp.exe
  C:\Windows\System\KpAnlrp.exe
  2⤵
  PID:6920
- C:\Windows\System\cyVIasc.exe
  C:\Windows\System\cyVIasc.exe
  2⤵
  PID:6384
- C:\Windows\System\sPGLZuS.exe
  C:\Windows\System\sPGLZuS.exe
  2⤵
  PID:8048
- C:\Windows\System\IVoTbjJ.exe
  C:\Windows\System\IVoTbjJ.exe
  2⤵
  PID:10696
- C:\Windows\System\pXgfLSg.exe
  C:\Windows\System\pXgfLSg.exe
  2⤵
  PID:12500
- C:\Windows\System\UBOxKfn.exe
  C:\Windows\System\UBOxKfn.exe
  2⤵
  PID:14704
- C:\Windows\System\OBVdzMC.exe
  C:\Windows\System\OBVdzMC.exe
  2⤵
  PID:13240
- C:\Windows\System\BFRNdsk.exe
  C:\Windows\System\BFRNdsk.exe
  2⤵
  PID:12960
- C:\Windows\System\uweMrMa.exe
  C:\Windows\System\uweMrMa.exe
  2⤵
  PID:9344
- C:\Windows\System\LolSslU.exe
  C:\Windows\System\LolSslU.exe
  2⤵
  PID:11644
- C:\Windows\System\xzVebca.exe
  C:\Windows\System\xzVebca.exe
  2⤵
  PID:11996
- C:\Windows\System\iUDkFkM.exe
  C:\Windows\System\iUDkFkM.exe
  2⤵
  PID:8908
- C:\Windows\System\uuxGMpj.exe
  C:\Windows\System\uuxGMpj.exe
  2⤵
  PID:11328
- C:\Windows\System\PtgXxgC.exe
  C:\Windows\System\PtgXxgC.exe
  2⤵
  PID:11176
- C:\Windows\System\plHaxWU.exe
  C:\Windows\System\plHaxWU.exe
  2⤵
  PID:10028
- C:\Windows\System\VeVlGkm.exe
  C:\Windows\System\VeVlGkm.exe
  2⤵
  PID:10420
- C:\Windows\System\ztIMGsD.exe
  C:\Windows\System\ztIMGsD.exe
  2⤵
  PID:9764
- C:\Windows\System\BaqLXNV.exe
  C:\Windows\System\BaqLXNV.exe
  2⤵
  PID:9364
- C:\Windows\System\WZnsnen.exe
  C:\Windows\System\WZnsnen.exe
  2⤵
  PID:12340
- C:\Windows\System\rKPMGCi.exe
  C:\Windows\System\rKPMGCi.exe
  2⤵
  PID:7944
- C:\Windows\System\RgwxnsP.exe
  C:\Windows\System\RgwxnsP.exe
  2⤵
  PID:10024
- C:\Windows\System\qEDOwJn.exe
  C:\Windows\System\qEDOwJn.exe
  2⤵
  PID:12988
- C:\Windows\System\mpeYNyu.exe
  C:\Windows\System\mpeYNyu.exe
  2⤵
  PID:12860
- C:\Windows\System\IbHonpt.exe
  C:\Windows\System\IbHonpt.exe
  2⤵
  PID:7840
- C:\Windows\System\yKtumAm.exe
  C:\Windows\System\yKtumAm.exe
  2⤵
  PID:13012
- C:\Windows\System\wjpinPL.exe
  C:\Windows\System\wjpinPL.exe
  2⤵
  PID:11584
- C:\Windows\System\hkUZqdQ.exe
  C:\Windows\System\hkUZqdQ.exe
  2⤵
  PID:8028
- C:\Windows\System\GMDrFdm.exe
  C:\Windows\System\GMDrFdm.exe
  2⤵
  PID:13200
- C:\Windows\System\xrkanZm.exe
  C:\Windows\System\xrkanZm.exe
  2⤵
  PID:13492
- C:\Windows\System\JONXDnh.exe
  C:\Windows\System\JONXDnh.exe
  2⤵
  PID:12472
- C:\Windows\System\WNfbdHe.exe
  C:\Windows\System\WNfbdHe.exe
  2⤵
  PID:7736
- C:\Windows\System\RyAzhJZ.exe
  C:\Windows\System\RyAzhJZ.exe
  2⤵
  PID:13424
- C:\Windows\System\rcOOnnV.exe
  C:\Windows\System\rcOOnnV.exe
  2⤵
  PID:13740
- C:\Windows\System\qzxVwQE.exe
  C:\Windows\System\qzxVwQE.exe
  2⤵
  PID:10596
- C:\Windows\System\PpXcPgQ.exe
  C:\Windows\System\PpXcPgQ.exe
  2⤵
  PID:7968
- C:\Windows\System\xKjejpj.exe
  C:\Windows\System\xKjejpj.exe
  2⤵
  PID:9292
- C:\Windows\System\iDwxBDq.exe
  C:\Windows\System\iDwxBDq.exe
  2⤵
  PID:6556
- C:\Windows\System\oDXmPfW.exe
  C:\Windows\System\oDXmPfW.exe
  2⤵
  PID:15240
- C:\Windows\System\jrgiFxK.exe
  C:\Windows\System\jrgiFxK.exe
  2⤵
  PID:13996
- C:\Windows\System\AOclkuX.exe
  C:\Windows\System\AOclkuX.exe
  2⤵
  PID:10356
- C:\Windows\System\CsBuytJ.exe
  C:\Windows\System\CsBuytJ.exe
  2⤵
  PID:15308
- C:\Windows\System\jVkhndx.exe
  C:\Windows\System\jVkhndx.exe
  2⤵
  PID:13624

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:12948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wqr0vsxw.cfn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DvsCNkE.exe

Filesize
1.7MB

MD5
4d0d07b6f516882c007d540516978f82

SHA1
c8713bbfe3d28be4b2879218c8c2402665f5661a

SHA256
8436c57312e5f3c7306fd93973e932eeed3b2423a05693676b9c0ba817b7ffca

SHA512
42bef207b1b25fa41321b687934daba28d0f70e86256a6190e55006575273e38153f641c16fc1f083aa583d04e317c561967398b1e42ec7e25108d18aa63e704

Download Submit
C:\Windows\System\EgIVAWz.exe

Filesize
1.7MB

MD5
a376c053fa172f71428b2613f1f6cdf3

SHA1
25b32b21228abc29c6d758358b1330f2eeb21ce6

SHA256
d586ffece072a48642adbb99793f872a3a5ecaa365d6e7463e5b151ae5509303

SHA512
fb9877cf78f50e3525b6dac4e7ce636ff151baab78462eded7c023d8833cc70c84a2a64313d40695a44dd9c679cb428a3b4f3f624bb67b78f5eac1d7c2848e57

Download Submit
C:\Windows\System\EzyYedZ.exe

Filesize
1.7MB

MD5
beff5cf5843121eab813362e1ad6ed96

SHA1
472904d76388efe9ec72497009146a54a2b65acc

SHA256
81b3f3fbae792ca49fe041a6c5ed357055107880758c69ebf1b8f00e21dca14b

SHA512
8b6d1df45de678ced0d9b8dc02fd00a145d99060758c56d5b6114e6d5aa042a86c9a37f2da109cf7c170f37541797df1a8b71e6b495c88c8261f7a2147898e87

Download Submit
C:\Windows\System\FMBtjzR.exe

Filesize
1.7MB

MD5
589ab0ed6efe57b7e6c430b51308f93b

SHA1
29464898f85e6c69640335f581b03fed09bd908c

SHA256
6587001955f5f4f503bd56b7263899200335e6b52df0310bd216e4cb55dc225f

SHA512
a7b0409444f0ce7bf0126db1d04b89f3f084cc6063416c6389d95898a3a5d39ec6ae7b6b5ef2fded27a65ad64de1075b37696af81b0f1a6faecf5df9c47c6885

Download Submit
C:\Windows\System\GnLUhqf.exe

Filesize
1.7MB

MD5
44e31eaaae4c05570689668b11c5cdda

SHA1
9643359ff31007569d8e099cc39547ef55180565

SHA256
0efa817b841bf84d60b5c2fc9affdd4ff72e7f05c7dabac075cfe324c942b174

SHA512
d3bc40e22be158d6c2ca2bfa4bf6ca26a7b940cbea9544688d7e99387216172cef2264e0f356669eeb3b32665cb6aebd14c023b275805b22980d926c136b0759

Download Submit
C:\Windows\System\HQVxaGS.exe

Filesize
1.7MB

MD5
2f0ccd9f2f9c131eddf5334d6fded554

SHA1
c0e1122e12657796ff775fba457fea0111c8c9b5

SHA256
8c36890161508c1edce947045f842baeb0afe9292c1ae02459f78751cb6692e9

SHA512
653bb3d5a19650c79f73959eeb320b5496386f79c36449dc75b8111290db594263dd45e3efaca84e304326212c5025b773e5554979dafc71d8ebebae7ae2d09a

Download Submit
C:\Windows\System\HrIoNPr.exe

Filesize
1.7MB

MD5
9094c355c63708a331183d00b77c6ed7

SHA1
cfb3f2897ae834d5010892dcef184658085dd648

SHA256
2efc3bd5e69e0c06e0945710e4dcb14015a563431edb9dec6c9f81329a0f0fbe

SHA512
f088503a820b78849c42cf64b3c5250b2b44a9964ec4ad4fe2430bf368d64120aaf97743b3578fe8e5edb6b3083de5871ffb442dfebee78cc7a05f27b7f9ed5c

Download Submit
C:\Windows\System\IyUGBja.exe

Filesize
1.7MB

MD5
5d9528ebb295a3697f4e28663d2f971e

SHA1
bc8b183969a87b5c79e98f90b1f15ee719e0fc2f

SHA256
e4c654c49833d1b0f82f307277d73de823b6466521010004a6e924e982217838

SHA512
082ebe05675fa337df80c5ce51b8059f63f2c70385b51e7b112dd7b68f0538ae35d62328a10ac49cd13efaa674e30f54765409662d5db05926bae7be3f42a548

Download Submit
C:\Windows\System\JeCbtev.exe

Filesize
1.7MB

MD5
c48466b32a10841de0b45cbb03c75244

SHA1
9dd5e6faa5a97c5d29d6abf356669096026edaa0

SHA256
b1600d8c22cef60032f1bef45f1d79ed5173809d1eda0e1719135db754601862

SHA512
017edf5ac75ff8f61cf6514e4e23df65968393a5c621aace40bb4dcc6aaa3f55a380e37c57a878181c8282b3b189d5edbb5a89cbe566b1ba723a671c1b72a5d3

Download Submit
C:\Windows\System\JfivpPn.exe

Filesize
1.7MB

MD5
c48a4ce16b9fb6067da76070d58549b0

SHA1
e73480a48547470349ebe0350f75e4f5744bf6af

SHA256
63afa01e4e15b1ecbe7f8fbdd2f42f5156c2dc7d4a7659ccee9906f1b622f362

SHA512
29ee9df89b2166048d838bb71940d5f99ec832515149293bece5402aee21bed3b84493285726e64df4a09a304e73e97c9d009556e1d7e003c99a370566d6d0e6

Download Submit
C:\Windows\System\JfxuaUr.exe

Filesize
1.7MB

MD5
c50be50d1d65527eff26c206ebdd38d9

SHA1
7047536782b77053d74b86fa2c7b263dd0046217

SHA256
2f07e5028215bff6f593de2f050c9824c3e0323e0cdfed39c32f30ddaa514165

SHA512
2234775a5d39168606893d62d50c0e39ab31a71b6c9b2ed50dda03076bc4a6e9f49e611b25c012010feb76d22a0a713c17c4b63a5ff464db5fe1bc02c74abff4

Download Submit
C:\Windows\System\JmxegNo.exe

Filesize
1.7MB

MD5
66685264d10702e7d9f3e6c525c21af1

SHA1
f39142497a7d97996e04a0df4bfaa815078fe11f

SHA256
66e20ca308eb8032632c6325b388e5a6310676be2c72767185cffff957e81e1e

SHA512
c92215548aecfb4ce3a7d3e2bd29c9b29d5bd03a85523fcf43414c0b267bc9052996455ee0b4f478c14babbede9936c4dcd348c1f72683852064dbcfb983a380

Download Submit
C:\Windows\System\KPqJSZE.exe

Filesize
1.7MB

MD5
68036f62676dce3d813b2bbc8e258a35

SHA1
7ccafd1fa980f726c589aa435cd76af1fb791098

SHA256
cb80f9473857e6a1139c87209b116328913891f96c9f8c3c6d8562bd2c38ee2a

SHA512
167278d9891d1e75c846fb6dbeda3c074aa5adbb49dbb974b35306c5ecfa23505ef1c7672cbc94edc473f82d6e865eea13d1ce0f70d9256320eca9cfc41aa9d7

Download Submit
C:\Windows\System\LJkVxiE.exe

Filesize
1.7MB

MD5
86d3ae7c4f3a3b96a2b363702f04200c

SHA1
ad17fac8ee7908ed7a92545ee4421c915c6ba70e

SHA256
8e4f1c26a1de4a366e211cabe6d73aa35284e01442dcf54cd246635592d15981

SHA512
99b1acd4daf943907e6960ee967d0bf932ec7b8b27710c8092077749bf6052b4f2c358a839857dd23cf2caa48367419c08b6b202bd7763acc96c4e9f55aa2821

Download Submit
C:\Windows\System\LRMaQcu.exe

Filesize
1.7MB

MD5
2985755735ad724fb2f3b250207d90c4

SHA1
558e74ad22ce58f25262d5718e53eab3534592b5

SHA256
e993cc65d18e0369c241b3dd86a5862521fc3702eb4e94d34aca23adfb809147

SHA512
5fe05169a18c50b7b8c224bde0db0877ddda1508c76dc32b8b45aa407699e17e068e13fb026b0d98c11b3e706cca2655c449a2be03eae2efde1ba5d9b1ddbdf1

Download Submit
C:\Windows\System\OZQXbJa.exe

Filesize
1.7MB

MD5
ca77af7b2de53545dedeb9e5e4ad804c

SHA1
f8e236ee8d05d1f461cc859f06f92a6014b054e9

SHA256
9d1384d628a27bcec4a9df0946b4c2f9349b8582ad3eda99b3ef4ba1d66d01d0

SHA512
a24fb4b932804fe0b9c90ba7513d897f301658fb12c56e9421122816b9219fd98ceb42f6a01ccec140e41a5c7ce1e074653a1fa585b259032974761bc6508552

Download Submit
C:\Windows\System\QhggeVH.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\UAstCOh.exe

Filesize
1.7MB

MD5
eb00c4ff78e254713c3388911bfd2479

SHA1
f1d5ef04d0b81858dff4d076808edcb950708f68

SHA256
3afaae855f683e9eb999a44bb36a63fbbfaa2aa61b41677febd414d73f80a796

SHA512
ff0f0f6181a6f481c081e85e7687f343eba41532c6c3e1d8d9cc3a4f1352c5df613531f1b75add2c37416e2e32c5efe3a32526d184daba9bac7df265025bfc2d

Download Submit
C:\Windows\System\UUqUlHy.exe

Filesize
1.7MB

MD5
127ef08c19e22e1e337d10659bdd1641

SHA1
937d2380300cf21c567c2dc2b445f53aab13f61f

SHA256
d80c4635a6033b7d1238c2288214b52781be182d78931ed168bd5ae3a5562020

SHA512
4e9ee124369a65471251491666cd27442c0d1247c2caed9062dacd6a4a2d05abc70f3d03f44ec35b7a4d79fbb0d9a8f38c1df765134644aa1942a81fe2e830cc

Download Submit
C:\Windows\System\UZQraci.exe

Filesize
1.7MB

MD5
da3bdb904541f70c4a2352e03f17b326

SHA1
53fdd6035084962a25a3b267471b4792520cef95

SHA256
45568d2d875e4d7272b264146e5b336fa5617a6a97d087ecc01b17d8ba3a1e97

SHA512
14d6b986b1fe5b854893a12d50afe5c528f2964ef39f478532c361c97ca0e7ea797cbc6cde2b8b988a41ba13021417d98d6b5b2c185b481f70cee199d1bb18b7

Download Submit
C:\Windows\System\XPUNJqh.exe

Filesize
1.7MB

MD5
147684324fdad83949ed2b73b8792fa1

SHA1
9da3fbf912b102258083e625655885439b929700

SHA256
63a57cb1a68205f0d3bf52c15f2cd3c835d219e779a20f40e4ff930bb32853d1

SHA512
7bfbeeb8d86d44c4bc31ce4e5d0b1391cfdd2619f792ac9d600757f17d5c12145ea4524a20187ccabd7a2f2940850f2a4f40bff2c7d902a915ef41ad5c7f8eb7

Download Submit
C:\Windows\System\XyMVZSR.exe

Filesize
1.7MB

MD5
41761464ed64fc5cf726389212310dc2

SHA1
4d861e8ccca670e2c412b26d88b5cc8dfafea7db

SHA256
7d98d1ac47f2433317acdbb0986c927da670bf87cc67bdf8aa6e238b36a9a97a

SHA512
7121d5cbfd1c99240a33ea8341b5a8255ead08aa6782d186b2873dea3579c0a7c818a6422f753c5002dda9662d9e50a9156ebbb36a266868b18cbedbdbac6adb

Download Submit
C:\Windows\System\bpnFlsK.exe

Filesize
1.7MB

MD5
bf0f61af069ed18fcb9f7f16b1c5182a

SHA1
bcf46ea262408c3e617d2e632a1b484bbeac49b4

SHA256
f96ada0175a262f92e4acef7a91995f8ebf66585ab5feb0dd1587aed26b3dab8

SHA512
44466ec5ea03115dc5ae0004c78391686f0f9ddf39323c8f5ba141eca96fcf36877bd1bb26852d971d6ab1f802f7e4b1d5eb844ead00c3bf294c30904b4f8396

Download Submit
C:\Windows\System\faddwbA.exe

Filesize
1.7MB

MD5
526694c78f5e9f2f3ca89da2d6bd0b84

SHA1
51096cd26862eb93d356a9c4eb7334eea095e0e6

SHA256
5f5117bfe59b5909f4329946f723a238316628d19277af5f6015d3c08c788c99

SHA512
8a3c078d2c4901fcf10f3d5809ef80638b2d2cf9142e94fd83600ae7b1c454dd9d27f16cfe8ab2013c192311582e4c9739784b5dbe45c5e84ef638dbb06e820b

Download Submit
C:\Windows\System\gcJqEvk.exe

Filesize
1.7MB

MD5
0c647646ca65d7f4807626466d139de9

SHA1
2087e2296e02325a4d7de69e6d6c5f23da36525b

SHA256
223723f79a1b8c8ce2717e1b3821ec78d8322d21baea5dae185f687c8020ac3e

SHA512
4455113eeb38bcad37e310fd4ae27d72a09bbb2c97659d259deb640cadd151d44f9a1f4a8ba0788bb70d3ad2c17f223a4b486b528ab62460da2cb84a66ca6a50

Download Submit
C:\Windows\System\hoxQGia.exe

Filesize
1.7MB

MD5
d4002e0374579b61edff7c8bd67a7673

SHA1
cc0af748987533869ae94c2194d2d94f497bfe07

SHA256
c6d2dd29c975471da9e362606b87af7b0f998f347c6fa99cff99f7eee3903594

SHA512
c94e0673d66729fe55834317491fc700495375b59427ccdf8ef586e622d8c14cd794ba089930e109e8a5ee2cf0e0907b96fb40be5912a7f60aa95e894f733063

Download Submit
C:\Windows\System\kcAKRtu.exe

Filesize
1.7MB

MD5
920b2796a534a9d644acbc738843c9b0

SHA1
207d83bce21bae613144b38ccacbb1f7c22f0af0

SHA256
d7835b4b770a887beb3fe36db9d0d39a2f43ca721fef71fad107d8bb4e735b08

SHA512
2efff4211bf50f4daf53574a5e46863597ade828dec9845e925af38755fc5607a8368123d9ca5e51db28a61098e110e7d224d5345bcb626751a8a67e693715d2

Download Submit
C:\Windows\System\komRbsh.exe

Filesize
1.7MB

MD5
7f1232162fe20223b567d8b0ca1078c2

SHA1
148780a41b16cfe12cb9bf78581849d60261dc7d

SHA256
58bbd14f0cf2eb3e730576363244c2bf897d5d011092ee95bf782e8145b93154

SHA512
c083b15cae5bfc99ec2b06c9b985bbbe5e5accf7f39f84685645fb0c28b0919b0f9be5c6f6ff63f8dcc4f925d04aaa3b4770fb5bf585df848b8d47c3f4f4b648

Download Submit
C:\Windows\System\nIQBriU.exe

Filesize
1.7MB

MD5
6b3edd70bb5b703b4279e1a31b8be9bb

SHA1
339d15eff550dbd98ea95b540ffef111ab5b9148

SHA256
24821cd15eedc7c0c8c28c9d6db8ae928004f9aef8088f35e85663ec1a9f1ea7

SHA512
d2678e8885a977dd77d2b653814e468e9396479e2db1722b7d5b4d6e07c9bee6a701ae8f5c819b02af6c7c951ac7f232828bcf1e926a05a2c5c14a32b9e255fc

Download Submit
C:\Windows\System\poyJhqH.exe

Filesize
1.7MB

MD5
eda15f04b0468ebb2cf86184aca48a3e

SHA1
9789553f30878e65b1551f43b74863785fc5cffa

SHA256
c110a2ea71fbb21b023a158efbf4a2c6c48e640533c70b709efc047f16467945

SHA512
bc6f818eb5b1e44941879e57438f6c6509d41e291c382cf5d2a03f3098cf5a0f02306ed668c0265cc6ef840d4458885ccb6a64cccfdd79b394e197ba9092d810

Download Submit
C:\Windows\System\pzEIoKz.exe

Filesize
1.7MB

MD5
30bf993817d3bae3737134eb1773bd1e

SHA1
ea28d4914659c2e3627a73ddd4f9c55afd86608c

SHA256
3d60b857cca117d369c056fdfad2c221bf685e37bc902c6559163ae8eeaf0ea5

SHA512
89e24e74446b52ef45e0fbe2cfba5ae57f447f216174f9799902aa00aff53da12777b0c3b44209cfb03cfe74e9c79247d6bc1e2b6029bcd8827a7958a7cbf6ce

Download Submit
C:\Windows\System\rAviHBC.exe

Filesize
1.7MB

MD5
164c7b66359866053cb6af129d3ef8d9

SHA1
adac35f794b4dc38557fd29a40624e67c1da3435

SHA256
196ee7a6cf317987fa216d99092c465608c25cba1f4d21800ca51dc7b10389d5

SHA512
a458f655908a2bd02fcaa82dbe0e884ebbeb5eb67a8df5a6ea0530037b77a5770e2e204419daea9294cce1dac52ec5b581c87a8c75e4fae2dddf674fd0f53499

Download Submit
C:\Windows\System\sRYhnsF.exe

Filesize
1.7MB

MD5
10849f4cc5a3623d387cf675bcdef4bf

SHA1
a7ec91704af0457ac1ed769c9f49338a6ef78d6c

SHA256
9a669f8812cc3b14573ce1bd2addc0381d070ac484f7f07e369cd03dd90d8dce

SHA512
84a66b24b89c7b47fc17af4261f9f885b78b6b9817959b66c5120957cf4a3d86265a24e27cec27f65c005a0650affd3428e3f317a3f042be3ed7a98951aa4e1b

Download Submit
C:\Windows\System\scNxCRD.exe

Filesize
1.7MB

MD5
728a30989ffa1cbea016efbff3622c68

SHA1
56b61e3517bf83c41978f509c009ef5b1ca8bac5

SHA256
5eaa7c3c9efb9ad4502a243f13f0c18adbba5e15a46e01b4f7294cde101b2fce

SHA512
4c9fdc55ee894f82295289ca5d6a0312f224629ffa42e534746997dfa352581b502d04c98b7bf5ad6738e90ea951e080d9954b8e5142ff945bd9860da043d2be

Download Submit
C:\Windows\System\uQqQvhy.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\uamkcrF.exe

Filesize
1.7MB

MD5
17fc5e2f6d1c41e46143cfb84f350274

SHA1
2d4eb9e3d68466a754920ee14646a9619420b591

SHA256
dee485d5d8d168f6d9c01351c050c450dceb9fe2519cf09c0368fe2586286004

SHA512
a25bd8f1f7f98e0c98cf4b83cbfe2be25ebbe839292b7daa2e98eee192bc1472c048e77cca2a25232ef4362ed82c7a96c97dbcbb2c31498ffb4564a88d516342

Download Submit
C:\Windows\System\upjFdbO.exe

Filesize
1.7MB

MD5
bafb9ddeac576a2580664a055ef13970

SHA1
49737021ad64bd687a66ebd846637b6c1e6f1cbe

SHA256
a9d0012749217e9c6d3a4e7a5026fb26750079f3c9b4ba8185ede6659664ff4f

SHA512
4a42bd0fa5c6e9a20762bd18abfd7db84118b8d35ac20071e67336bf4dcc806bcce486730345b33a2bdd2a0ca128b17f0533b65e21e9321b8259806db5f694f0

Download Submit
C:\Windows\System\uvONPeM.exe

Filesize
1.7MB

MD5
e3c7f63871716ddc4de51974a0fd1a2a

SHA1
2d49d89447e49cd3645c1ebf76e30fc497fb3fdf

SHA256
7480b26d8b088d98672fb9d45c1c5631d407edec5677b8bd3b4259cfa94861dc

SHA512
4f4ac8cf32b27dd1aad5619883ac11d24df31b2317dd42b193d27afc763c23e6e03da773fc56791c5cccbab81875c2a3d1c54a8defe9a94d29c20851bb836969

Download Submit
C:\Windows\System\xLyPpFm.exe

Filesize
1.7MB

MD5
f697b967d5e45463ac8a37b33c127e93

SHA1
a9794b9e2d3e212c34fcd1309df88357239f51e0

SHA256
e279ede84f99d351e2ce4e1a816280fd77d4df7178e90126df1ea8740c38674f

SHA512
33baf46666e2b015d11b71e7b3f7a6436ec62893e51d835c3d86290bfbc6b4103793df223c6a80457c84cb4e705c32c3df833c658c02b88d437d2c5762ad08ca

Download Submit
C:\Windows\System\xntQEJf.exe

Filesize
1.7MB

MD5
72191a4939808fcf5442486b7e8be15e

SHA1
c48893898f2c011be88aba7fdbe789f65c8b70e0

SHA256
3b135129b2c011a57d4aedec5ee4275d6ab03a3d0015ca9c700c31e6d88aa2ca

SHA512
667775d124a718644ac537259a45ef768b9821b0686aff8f59e33116499fd143a4cab4290fa73e10ecec95921698fa65d27390a481655c14db3f6e958ef0252f

Download Submit
C:\Windows\System\zfrOiyQ.exe

Filesize
1.7MB

MD5
66ffb4bd5e89bac07f0305d2e3f1ec9c

SHA1
ee841290ab7bf2e2bc0515fbe0af01a59e6aef5c

SHA256
8ddf13ce2090f05af0a957c8d26675b341e413764c95901f55a9504451f08039

SHA512
58c0d4e7e5af8ee408fdb3bbc744fca7db82b05fe73be6c03f6cf28e7416d70ee0a6393ba17b6c451b41b11a636f9305cfd573007831ecefd8ee813c40de6a1e

Download Submit
memory/400-403-0x00007FF6C1300000-0x00007FF6C16F2000-memory.dmp

Filesize
3.9MB

Download
memory/400-5083-0x00007FF6C1300000-0x00007FF6C16F2000-memory.dmp

Filesize
3.9MB

Download
memory/440-60-0x00007FF77BAC0000-0x00007FF77BEB2000-memory.dmp

Filesize
3.9MB

Download
memory/516-190-0x00007FF7F35D0000-0x00007FF7F39C2000-memory.dmp

Filesize
3.9MB

Download
memory/516-5051-0x00007FF7F35D0000-0x00007FF7F39C2000-memory.dmp

Filesize
3.9MB

Download
memory/1012-5091-0x00007FF7B2CB0000-0x00007FF7B30A2000-memory.dmp

Filesize
3.9MB

Download
memory/1012-399-0x00007FF7B2CB0000-0x00007FF7B30A2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-257-0x00007FF611060000-0x00007FF611452000-memory.dmp

Filesize
3.9MB

Download
memory/1560-5040-0x00007FF611060000-0x00007FF611452000-memory.dmp

Filesize
3.9MB

Download
memory/1728-187-0x00007FF72C9F0000-0x00007FF72CDE2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-5019-0x00007FF72C9F0000-0x00007FF72CDE2000-memory.dmp

Filesize
3.9MB

Download
memory/1764-40-0x00007FF79A8E0000-0x00007FF79ACD2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-328-0x00007FF75B4A0000-0x00007FF75B892000-memory.dmp

Filesize
3.9MB

Download
memory/2072-5043-0x00007FF75B4A0000-0x00007FF75B892000-memory.dmp

Filesize
3.9MB

Download
memory/2264-5022-0x00007FF7B3580000-0x00007FF7B3972000-memory.dmp

Filesize
3.9MB

Download
memory/2264-407-0x00007FF7B3580000-0x00007FF7B3972000-memory.dmp

Filesize
3.9MB

Download
memory/2440-308-0x00007FF71A0C0000-0x00007FF71A4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-5066-0x00007FF71A0C0000-0x00007FF71A4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-401-0x00007FF7CA440000-0x00007FF7CA832000-memory.dmp

Filesize
3.9MB

Download
memory/2664-5035-0x00007FF7CA440000-0x00007FF7CA832000-memory.dmp

Filesize
3.9MB

Download
memory/2784-146-0x00007FF707860000-0x00007FF707C52000-memory.dmp

Filesize
3.9MB

Download
memory/2784-5025-0x00007FF707860000-0x00007FF707C52000-memory.dmp

Filesize
3.9MB

Download
memory/2824-1-0x000002517DB50000-0x000002517DB60000-memory.dmp

Filesize
64KB

Download
memory/2824-0-0x00007FF66BC30000-0x00007FF66C022000-memory.dmp

Filesize
3.9MB

Download
memory/2992-21-0x00007FF6F89C0000-0x00007FF6F8DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-4970-0x00007FF6F89C0000-0x00007FF6F8DB2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-408-0x00007FF710470000-0x00007FF710862000-memory.dmp

Filesize
3.9MB

Download
memory/3048-5059-0x00007FF710470000-0x00007FF710862000-memory.dmp

Filesize
3.9MB

Download
memory/3108-219-0x00007FF7BEFA0000-0x00007FF7BF392000-memory.dmp

Filesize
3.9MB

Download
memory/3108-5039-0x00007FF7BEFA0000-0x00007FF7BF392000-memory.dmp

Filesize
3.9MB

Download
memory/3228-398-0x00007FF6E4A10000-0x00007FF6E4E02000-memory.dmp

Filesize
3.9MB

Download
memory/3228-5061-0x00007FF6E4A10000-0x00007FF6E4E02000-memory.dmp

Filesize
3.9MB

Download
memory/3948-5045-0x00007FF6EA4A0000-0x00007FF6EA892000-memory.dmp

Filesize
3.9MB

Download
memory/3948-285-0x00007FF6EA4A0000-0x00007FF6EA892000-memory.dmp

Filesize
3.9MB

Download
memory/4360-5065-0x00007FF7E8620000-0x00007FF7E8A12000-memory.dmp

Filesize
3.9MB

Download
memory/4360-404-0x00007FF7E8620000-0x00007FF7E8A12000-memory.dmp

Filesize
3.9MB

Download
memory/4408-23-0x00000296FD850000-0x00000296FD860000-memory.dmp

Filesize
64KB

Download
memory/4408-300-0x00000296FFA00000-0x00000296FFA22000-memory.dmp

Filesize
136KB

Download
memory/4408-22-0x00000296FD850000-0x00000296FD860000-memory.dmp

Filesize
64KB

Download
memory/4408-405-0x00007FFA085D3000-0x00007FFA085D5000-memory.dmp

Filesize
8KB

Download
memory/4440-406-0x00007FF696420000-0x00007FF696812000-memory.dmp

Filesize
3.9MB

Download
memory/4440-5016-0x00007FF696420000-0x00007FF696812000-memory.dmp

Filesize
3.9MB

Download
memory/4716-5103-0x00007FF64F430000-0x00007FF64F822000-memory.dmp

Filesize
3.9MB

Download
memory/4716-409-0x00007FF64F430000-0x00007FF64F822000-memory.dmp

Filesize
3.9MB

Download
memory/4760-5005-0x00007FF790000000-0x00007FF7903F2000-memory.dmp

Filesize
3.9MB

Download
memory/4760-43-0x00007FF790000000-0x00007FF7903F2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-4977-0x00007FF726360000-0x00007FF726752000-memory.dmp

Filesize
3.9MB

Download
memory/4980-94-0x00007FF726360000-0x00007FF726752000-memory.dmp

Filesize
3.9MB

Download
memory/4988-5056-0x00007FF779240000-0x00007FF779632000-memory.dmp

Filesize
3.9MB

Download
memory/4988-400-0x00007FF779240000-0x00007FF779632000-memory.dmp

Filesize
3.9MB

Download
memory/5080-5077-0x00007FF7418C0000-0x00007FF741CB2000-memory.dmp

Filesize
3.9MB

Download
memory/5080-402-0x00007FF7418C0000-0x00007FF741CB2000-memory.dmp

Filesize
3.9MB

Download