xmrig | b65ce2f805ceadb07eb071b2e5d982a363015027e3e3afa713e4184feb2940e5

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
Size

1.8MB
MD5

32f5926964e117e81a4d7b7439f81f1b
SHA1

1a8b76daa18576daee2f9f95f5a227416e78c25c
SHA256

b65ce2f805ceadb07eb071b2e5d982a363015027e3e3afa713e4184feb2940e5
SHA512

432518a39744cd46ded0c43714ae7f349e7d69986fbf1ed0d12d2c0fc8540b74e11d86cd757fbc9ddc81d51eed3ced5e048d9099df3344ba844ddbec260777f1
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFti:Lz071uv4BPMkibTIA5I4TNrpDGgDQGpB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/2720-8-0x00007FF6B0FF0000-0x00007FF6B13E2000-memory.dmp	xmrig
behavioral2/memory/3844-46-0x00007FF7912A0000-0x00007FF791692000-memory.dmp	xmrig
behavioral2/memory/1116-54-0x00007FF73E4F0000-0x00007FF73E8E2000-memory.dmp	xmrig
behavioral2/memory/2932-83-0x00007FF62BC90000-0x00007FF62C082000-memory.dmp	xmrig
behavioral2/memory/4984-119-0x00007FF7ED860000-0x00007FF7EDC52000-memory.dmp	xmrig
behavioral2/memory/1852-171-0x00007FF634CB0000-0x00007FF6350A2000-memory.dmp	xmrig
behavioral2/memory/1744-165-0x00007FF6BE990000-0x00007FF6BED82000-memory.dmp	xmrig
behavioral2/memory/2212-159-0x00007FF723820000-0x00007FF723C12000-memory.dmp	xmrig
behavioral2/memory/1188-153-0x00007FF7C6680000-0x00007FF7C6A72000-memory.dmp	xmrig
behavioral2/memory/4880-152-0x00007FF6082D0000-0x00007FF6086C2000-memory.dmp	xmrig
behavioral2/memory/4768-146-0x00007FF701670000-0x00007FF701A62000-memory.dmp	xmrig
behavioral2/memory/3712-145-0x00007FF7B9D80000-0x00007FF7BA172000-memory.dmp	xmrig
behavioral2/memory/2108-139-0x00007FF7EF590000-0x00007FF7EF982000-memory.dmp	xmrig
behavioral2/memory/1948-133-0x00007FF66DE90000-0x00007FF66E282000-memory.dmp	xmrig
behavioral2/memory/116-127-0x00007FF62E420000-0x00007FF62E812000-memory.dmp	xmrig
behavioral2/memory/1128-126-0x00007FF6D2800000-0x00007FF6D2BF2000-memory.dmp	xmrig
behavioral2/memory/5028-120-0x00007FF6EEC30000-0x00007FF6EF022000-memory.dmp	xmrig
behavioral2/memory/4264-113-0x00007FF71D350000-0x00007FF71D742000-memory.dmp	xmrig
behavioral2/memory/3624-107-0x00007FF706760000-0x00007FF706B52000-memory.dmp	xmrig
behavioral2/memory/1796-89-0x00007FF6E31D0000-0x00007FF6E35C2000-memory.dmp	xmrig
behavioral2/memory/3356-88-0x00007FF75EA20000-0x00007FF75EE12000-memory.dmp	xmrig
behavioral2/memory/2880-69-0x00007FF666A40000-0x00007FF666E32000-memory.dmp	xmrig
behavioral2/memory/4736-68-0x00007FF66E650000-0x00007FF66EA42000-memory.dmp	xmrig
behavioral2/memory/1124-60-0x00007FF6E1C90000-0x00007FF6E2082000-memory.dmp	xmrig
behavioral2/memory/4264-3928-0x00007FF71D350000-0x00007FF71D742000-memory.dmp	xmrig
behavioral2/memory/5028-3936-0x00007FF6EEC30000-0x00007FF6EF022000-memory.dmp	xmrig
behavioral2/memory/4984-3941-0x00007FF7ED860000-0x00007FF7EDC52000-memory.dmp	xmrig
behavioral2/memory/1128-3946-0x00007FF6D2800000-0x00007FF6D2BF2000-memory.dmp	xmrig
behavioral2/memory/116-3950-0x00007FF62E420000-0x00007FF62E812000-memory.dmp	xmrig
behavioral2/memory/2108-3954-0x00007FF7EF590000-0x00007FF7EF982000-memory.dmp	xmrig
behavioral2/memory/3712-3958-0x00007FF7B9D80000-0x00007FF7BA172000-memory.dmp	xmrig
behavioral2/memory/1948-3967-0x00007FF66DE90000-0x00007FF66E282000-memory.dmp	xmrig
behavioral2/memory/4768-3970-0x00007FF701670000-0x00007FF701A62000-memory.dmp	xmrig
behavioral2/memory/1188-3978-0x00007FF7C6680000-0x00007FF7C6A72000-memory.dmp	xmrig
behavioral2/memory/1744-3984-0x00007FF6BE990000-0x00007FF6BED82000-memory.dmp	xmrig
behavioral2/memory/2212-3975-0x00007FF723820000-0x00007FF723C12000-memory.dmp	xmrig
behavioral2/memory/1852-3987-0x00007FF634CB0000-0x00007FF6350A2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	2572	powershell.exe
12	2572	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2572	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2720	CMQBBtq.exe
3844	YTXjBht.exe
1116	ncFgiDi.exe
1124	VLOQrUp.exe
4736	oVMQpzH.exe
2880	pTRAiPI.exe
2932	wNNOGNI.exe
3624	LjyMcaA.exe
3356	NlKFSvc.exe
1796	CWgoegN.exe
4264	ulpSBZg.exe
4984	mGBWkuO.exe
5028	bXuppPl.exe
1128	OSCPmlz.exe
116	faWQfyx.exe
2108	fMQbUVS.exe
1948	DybuccN.exe
3712	rAVXcDG.exe
4768	BdMfAXb.exe
4880	qCtMkzI.exe
1188	NGoLcNI.exe
2212	GSmgWZc.exe
1744	quTQMKa.exe
1852	MsEwqoF.exe
3156	pgjJJIH.exe
4608	ltPUVzP.exe
1928	RuLamFt.exe
412	pkGoXhs.exe
5052	oQwllqO.exe
4968	THJsFDM.exe
1488	otLYiKU.exe
4148	qMIQhTo.exe
4220	tDjiCgn.exe
4156	QVLdiFM.exe
1848	wxFTvGX.exe
1944	COfWbWN.exe
4360	gwyPtNp.exe
4964	LPqFflr.exe
4344	gytUsCT.exe
3436	HWFbHOj.exe
1068	hsnBLFU.exe
3148	bwUGLaT.exe
2328	IMWjOqR.exe
4356	NeKJCdj.exe
2096	dNuMUaw.exe
1104	mLmqeXf.exe
1408	DOOGYBF.exe
2688	JtZJwBO.exe
180	WOFiUIi.exe
3220	KLzWhbC.exe
1220	jVGrGDh.exe
2700	gfOqibz.exe
2360	vupSBTk.exe
3352	jICMjQV.exe
4388	tFgKUUY.exe
3360	QUFTGMA.exe
2472	dLwODaR.exe
4368	aLcEuvJ.exe
4624	gwJRONW.exe
996	EQScZTC.exe
2660	OPBEURk.exe
5020	quPmLuU.exe
1828	HGhBfCJ.exe
5132	hWIaLTF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2124-0-0x00007FF717820000-0x00007FF717C12000-memory.dmp	upx
behavioral2/files/0x0008000000023462-6.dat	upx
behavioral2/files/0x0007000000023467-15.dat	upx
behavioral2/memory/2720-8-0x00007FF6B0FF0000-0x00007FF6B13E2000-memory.dmp	upx
behavioral2/files/0x000700000002346a-28.dat	upx
behavioral2/files/0x000700000002346b-33.dat	upx
behavioral2/memory/3844-46-0x00007FF7912A0000-0x00007FF791692000-memory.dmp	upx
behavioral2/memory/1116-54-0x00007FF73E4F0000-0x00007FF73E8E2000-memory.dmp	upx
behavioral2/files/0x000700000002346e-62.dat	upx
behavioral2/files/0x0007000000023470-70.dat	upx
behavioral2/memory/2932-83-0x00007FF62BC90000-0x00007FF62C082000-memory.dmp	upx
behavioral2/files/0x0007000000023475-92.dat	upx
behavioral2/files/0x0008000000023474-108.dat	upx
behavioral2/memory/4984-119-0x00007FF7ED860000-0x00007FF7EDC52000-memory.dmp	upx
behavioral2/files/0x0008000000023463-128.dat	upx
behavioral2/files/0x0007000000023479-136.dat	upx
behavioral2/files/0x000700000002347b-149.dat	upx
behavioral2/files/0x000700000002347d-172.dat	upx
behavioral2/files/0x0007000000023482-189.dat	upx
behavioral2/files/0x0007000000023484-199.dat	upx
behavioral2/files/0x0007000000023483-194.dat	upx
behavioral2/files/0x0007000000023481-192.dat	upx
behavioral2/files/0x0007000000023480-187.dat	upx
behavioral2/files/0x000700000002347f-182.dat	upx
behavioral2/files/0x000700000002347e-177.dat	upx
behavioral2/memory/1852-171-0x00007FF634CB0000-0x00007FF6350A2000-memory.dmp	upx
behavioral2/files/0x000700000002347c-166.dat	upx
behavioral2/memory/1744-165-0x00007FF6BE990000-0x00007FF6BED82000-memory.dmp	upx
behavioral2/memory/2212-159-0x00007FF723820000-0x00007FF723C12000-memory.dmp	upx
behavioral2/files/0x000700000002347a-154.dat	upx
behavioral2/memory/1188-153-0x00007FF7C6680000-0x00007FF7C6A72000-memory.dmp	upx
behavioral2/memory/4880-152-0x00007FF6082D0000-0x00007FF6086C2000-memory.dmp	upx
behavioral2/memory/4768-146-0x00007FF701670000-0x00007FF701A62000-memory.dmp	upx
behavioral2/memory/3712-145-0x00007FF7B9D80000-0x00007FF7BA172000-memory.dmp	upx
behavioral2/files/0x0007000000023478-140.dat	upx
behavioral2/memory/2108-139-0x00007FF7EF590000-0x00007FF7EF982000-memory.dmp	upx
behavioral2/files/0x0008000000023473-134.dat	upx
behavioral2/memory/1948-133-0x00007FF66DE90000-0x00007FF66E282000-memory.dmp	upx
behavioral2/memory/116-127-0x00007FF62E420000-0x00007FF62E812000-memory.dmp	upx
behavioral2/memory/1128-126-0x00007FF6D2800000-0x00007FF6D2BF2000-memory.dmp	upx
behavioral2/files/0x0007000000023477-121.dat	upx
behavioral2/memory/5028-120-0x00007FF6EEC30000-0x00007FF6EF022000-memory.dmp	upx
behavioral2/files/0x0007000000023476-114.dat	upx
behavioral2/memory/4264-113-0x00007FF71D350000-0x00007FF71D742000-memory.dmp	upx
behavioral2/memory/3624-107-0x00007FF706760000-0x00007FF706B52000-memory.dmp	upx
behavioral2/files/0x0007000000023472-96.dat	upx
behavioral2/memory/1796-89-0x00007FF6E31D0000-0x00007FF6E35C2000-memory.dmp	upx
behavioral2/memory/3356-88-0x00007FF75EA20000-0x00007FF75EE12000-memory.dmp	upx
behavioral2/files/0x0007000000023471-90.dat	upx
behavioral2/memory/2880-69-0x00007FF666A40000-0x00007FF666E32000-memory.dmp	upx
behavioral2/memory/4736-68-0x00007FF66E650000-0x00007FF66EA42000-memory.dmp	upx
behavioral2/files/0x000700000002346f-65.dat	upx
behavioral2/memory/1124-60-0x00007FF6E1C90000-0x00007FF6E2082000-memory.dmp	upx
behavioral2/files/0x000700000002346d-56.dat	upx
behavioral2/files/0x000700000002346c-44.dat	upx
behavioral2/files/0x0007000000023468-32.dat	upx
behavioral2/files/0x0007000000023469-31.dat	upx
behavioral2/files/0x0007000000023466-19.dat	upx
behavioral2/memory/4264-3928-0x00007FF71D350000-0x00007FF71D742000-memory.dmp	upx
behavioral2/memory/5028-3936-0x00007FF6EEC30000-0x00007FF6EF022000-memory.dmp	upx
behavioral2/memory/4984-3941-0x00007FF7ED860000-0x00007FF7EDC52000-memory.dmp	upx
behavioral2/memory/1128-3946-0x00007FF6D2800000-0x00007FF6D2BF2000-memory.dmp	upx
behavioral2/memory/116-3950-0x00007FF62E420000-0x00007FF62E812000-memory.dmp	upx
behavioral2/memory/2108-3954-0x00007FF7EF590000-0x00007FF7EF982000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YCXzeBG.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\HwJCyoZ.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\axyqaJV.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\vkYkhfu.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\SHwdnhP.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\aLcEuvJ.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\kBcNwGn.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\mqKeFKn.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\YVWwaSD.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\LQAYfcL.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\LFVVhHS.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\kpfErHB.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\cxSlNDb.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\kfDLMqF.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\sUzWzRD.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\EhRSnik.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\NVvZTXb.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\tPHJdOy.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\sWzrbwP.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\YGqBdCu.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\PEurlqW.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\usSyDJN.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\aUFEgqa.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\TmYiOmC.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\MQeSnJW.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\gzwEMjD.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\bVLMMDk.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\vDRxgAh.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\kIZKnJL.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\iOsHaTr.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\ffVJrsS.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\HmjXYAj.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\MeoHjaZ.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\wHWdOYh.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\CsfyHRX.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\SgYZOVB.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\AUgjsJH.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\KSjvQyQ.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\kzHsaKL.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\dXydAuf.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\MdzQhIV.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\jLjQtsR.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\oBYOxQY.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\ZLqERXr.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\OFMyush.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\jaeVfib.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\kRTFhEU.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\GKgJOYD.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\zaAxKUh.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\ERXaaDZ.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\ERWWEmJ.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\VdOgcoa.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\CEYjHvb.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\GpHEGIN.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\uylvQBm.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\rbhmtlk.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\pZhRjdw.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\qbDdxHs.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\ZHknZoU.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\OyYYdwJ.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\OyEynWw.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\gjFWTSN.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\MaEPHcK.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\FMvtMec.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2572	powershell.exe
2572	powershell.exe
2572	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeLockMemoryPrivilege	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2572	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	84
PID 2124 wrote to memory of 2572	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	84
PID 2124 wrote to memory of 2720	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	85
PID 2124 wrote to memory of 2720	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	85
PID 2124 wrote to memory of 3844	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	86
PID 2124 wrote to memory of 3844	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	86
PID 2124 wrote to memory of 1116	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	87
PID 2124 wrote to memory of 1116	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	87
PID 2124 wrote to memory of 1124	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	88
PID 2124 wrote to memory of 1124	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	88
PID 2124 wrote to memory of 4736	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	89
PID 2124 wrote to memory of 4736	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	89
PID 2124 wrote to memory of 2880	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	90
PID 2124 wrote to memory of 2880	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	90
PID 2124 wrote to memory of 2932	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	91
PID 2124 wrote to memory of 2932	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	91
PID 2124 wrote to memory of 3624	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	92
PID 2124 wrote to memory of 3624	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	92
PID 2124 wrote to memory of 3356	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	93
PID 2124 wrote to memory of 3356	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	93
PID 2124 wrote to memory of 1796	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	94
PID 2124 wrote to memory of 1796	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	94
PID 2124 wrote to memory of 4264	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	95
PID 2124 wrote to memory of 4264	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	95
PID 2124 wrote to memory of 4984	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	96
PID 2124 wrote to memory of 4984	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	96
PID 2124 wrote to memory of 5028	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	97
PID 2124 wrote to memory of 5028	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	97
PID 2124 wrote to memory of 1128	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	98
PID 2124 wrote to memory of 1128	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	98
PID 2124 wrote to memory of 116	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	99
PID 2124 wrote to memory of 116	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	99
PID 2124 wrote to memory of 2108	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	100
PID 2124 wrote to memory of 2108	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	100
PID 2124 wrote to memory of 1948	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	101
PID 2124 wrote to memory of 1948	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	101
PID 2124 wrote to memory of 3712	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	102
PID 2124 wrote to memory of 3712	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	102
PID 2124 wrote to memory of 4768	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	103
PID 2124 wrote to memory of 4768	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	103
PID 2124 wrote to memory of 4880	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	104
PID 2124 wrote to memory of 4880	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	104
PID 2124 wrote to memory of 1188	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	105
PID 2124 wrote to memory of 1188	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	105
PID 2124 wrote to memory of 2212	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	106
PID 2124 wrote to memory of 2212	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	106
PID 2124 wrote to memory of 1744	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	107
PID 2124 wrote to memory of 1744	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	107
PID 2124 wrote to memory of 1852	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	108
PID 2124 wrote to memory of 1852	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	108
PID 2124 wrote to memory of 3156	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	109
PID 2124 wrote to memory of 3156	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	109
PID 2124 wrote to memory of 4608	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	110
PID 2124 wrote to memory of 4608	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	110
PID 2124 wrote to memory of 1928	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	111
PID 2124 wrote to memory of 1928	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	111
PID 2124 wrote to memory of 412	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	112
PID 2124 wrote to memory of 412	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	112
PID 2124 wrote to memory of 5052	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	113
PID 2124 wrote to memory of 5052	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	113
PID 2124 wrote to memory of 4968	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	114
PID 2124 wrote to memory of 4968	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	114
PID 2124 wrote to memory of 1488	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	115
PID 2124 wrote to memory of 1488	2124	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2572" "2972" "2916" "2976" "0" "0" "2980" "0" "0" "0" "0" "0"
    3⤵
    PID:12408
- C:\Windows\System\CMQBBtq.exe
  C:\Windows\System\CMQBBtq.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\YTXjBht.exe
  C:\Windows\System\YTXjBht.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\ncFgiDi.exe
  C:\Windows\System\ncFgiDi.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\VLOQrUp.exe
  C:\Windows\System\VLOQrUp.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\oVMQpzH.exe
  C:\Windows\System\oVMQpzH.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\pTRAiPI.exe
  C:\Windows\System\pTRAiPI.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\wNNOGNI.exe
  C:\Windows\System\wNNOGNI.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\LjyMcaA.exe
  C:\Windows\System\LjyMcaA.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\NlKFSvc.exe
  C:\Windows\System\NlKFSvc.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\CWgoegN.exe
  C:\Windows\System\CWgoegN.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\ulpSBZg.exe
  C:\Windows\System\ulpSBZg.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\mGBWkuO.exe
  C:\Windows\System\mGBWkuO.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\bXuppPl.exe
  C:\Windows\System\bXuppPl.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\OSCPmlz.exe
  C:\Windows\System\OSCPmlz.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\faWQfyx.exe
  C:\Windows\System\faWQfyx.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\fMQbUVS.exe
  C:\Windows\System\fMQbUVS.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\DybuccN.exe
  C:\Windows\System\DybuccN.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\rAVXcDG.exe
  C:\Windows\System\rAVXcDG.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\BdMfAXb.exe
  C:\Windows\System\BdMfAXb.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\qCtMkzI.exe
  C:\Windows\System\qCtMkzI.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\NGoLcNI.exe
  C:\Windows\System\NGoLcNI.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\GSmgWZc.exe
  C:\Windows\System\GSmgWZc.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\quTQMKa.exe
  C:\Windows\System\quTQMKa.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\MsEwqoF.exe
  C:\Windows\System\MsEwqoF.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\pgjJJIH.exe
  C:\Windows\System\pgjJJIH.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\ltPUVzP.exe
  C:\Windows\System\ltPUVzP.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\RuLamFt.exe
  C:\Windows\System\RuLamFt.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\pkGoXhs.exe
  C:\Windows\System\pkGoXhs.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\oQwllqO.exe
  C:\Windows\System\oQwllqO.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\THJsFDM.exe
  C:\Windows\System\THJsFDM.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\otLYiKU.exe
  C:\Windows\System\otLYiKU.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\qMIQhTo.exe
  C:\Windows\System\qMIQhTo.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\tDjiCgn.exe
  C:\Windows\System\tDjiCgn.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\QVLdiFM.exe
  C:\Windows\System\QVLdiFM.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\wxFTvGX.exe
  C:\Windows\System\wxFTvGX.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\COfWbWN.exe
  C:\Windows\System\COfWbWN.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\gwyPtNp.exe
  C:\Windows\System\gwyPtNp.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\LPqFflr.exe
  C:\Windows\System\LPqFflr.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\gytUsCT.exe
  C:\Windows\System\gytUsCT.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\HWFbHOj.exe
  C:\Windows\System\HWFbHOj.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\hsnBLFU.exe
  C:\Windows\System\hsnBLFU.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\bwUGLaT.exe
  C:\Windows\System\bwUGLaT.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\IMWjOqR.exe
  C:\Windows\System\IMWjOqR.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\NeKJCdj.exe
  C:\Windows\System\NeKJCdj.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\dNuMUaw.exe
  C:\Windows\System\dNuMUaw.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\mLmqeXf.exe
  C:\Windows\System\mLmqeXf.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\DOOGYBF.exe
  C:\Windows\System\DOOGYBF.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\JtZJwBO.exe
  C:\Windows\System\JtZJwBO.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\WOFiUIi.exe
  C:\Windows\System\WOFiUIi.exe
  2⤵
  - Executes dropped EXE
  PID:180
- C:\Windows\System\KLzWhbC.exe
  C:\Windows\System\KLzWhbC.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\jVGrGDh.exe
  C:\Windows\System\jVGrGDh.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\gfOqibz.exe
  C:\Windows\System\gfOqibz.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\vupSBTk.exe
  C:\Windows\System\vupSBTk.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\jICMjQV.exe
  C:\Windows\System\jICMjQV.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\tFgKUUY.exe
  C:\Windows\System\tFgKUUY.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\QUFTGMA.exe
  C:\Windows\System\QUFTGMA.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\dLwODaR.exe
  C:\Windows\System\dLwODaR.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\aLcEuvJ.exe
  C:\Windows\System\aLcEuvJ.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\gwJRONW.exe
  C:\Windows\System\gwJRONW.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\EQScZTC.exe
  C:\Windows\System\EQScZTC.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\OPBEURk.exe
  C:\Windows\System\OPBEURk.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\quPmLuU.exe
  C:\Windows\System\quPmLuU.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\HGhBfCJ.exe
  C:\Windows\System\HGhBfCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\hWIaLTF.exe
  C:\Windows\System\hWIaLTF.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\UuFmjpD.exe
  C:\Windows\System\UuFmjpD.exe
  2⤵
  PID:5160
- C:\Windows\System\MmnhEGM.exe
  C:\Windows\System\MmnhEGM.exe
  2⤵
  PID:5188
- C:\Windows\System\meBntuB.exe
  C:\Windows\System\meBntuB.exe
  2⤵
  PID:5216
- C:\Windows\System\IBLfJCZ.exe
  C:\Windows\System\IBLfJCZ.exe
  2⤵
  PID:5244
- C:\Windows\System\khjjAnm.exe
  C:\Windows\System\khjjAnm.exe
  2⤵
  PID:5272
- C:\Windows\System\REyNFHe.exe
  C:\Windows\System\REyNFHe.exe
  2⤵
  PID:5296
- C:\Windows\System\YxbHJdI.exe
  C:\Windows\System\YxbHJdI.exe
  2⤵
  PID:5328
- C:\Windows\System\uiaCGCI.exe
  C:\Windows\System\uiaCGCI.exe
  2⤵
  PID:5364
- C:\Windows\System\ahkwTwQ.exe
  C:\Windows\System\ahkwTwQ.exe
  2⤵
  PID:5384
- C:\Windows\System\xrceExu.exe
  C:\Windows\System\xrceExu.exe
  2⤵
  PID:5412
- C:\Windows\System\WwCACsd.exe
  C:\Windows\System\WwCACsd.exe
  2⤵
  PID:5436
- C:\Windows\System\OdxBrlz.exe
  C:\Windows\System\OdxBrlz.exe
  2⤵
  PID:5464
- C:\Windows\System\DvBocSr.exe
  C:\Windows\System\DvBocSr.exe
  2⤵
  PID:5496
- C:\Windows\System\HhnIvaP.exe
  C:\Windows\System\HhnIvaP.exe
  2⤵
  PID:5524
- C:\Windows\System\MvyRotC.exe
  C:\Windows\System\MvyRotC.exe
  2⤵
  PID:5548
- C:\Windows\System\dWHmxoc.exe
  C:\Windows\System\dWHmxoc.exe
  2⤵
  PID:5576
- C:\Windows\System\WJdLXrO.exe
  C:\Windows\System\WJdLXrO.exe
  2⤵
  PID:5604
- C:\Windows\System\oXaHoKP.exe
  C:\Windows\System\oXaHoKP.exe
  2⤵
  PID:5632
- C:\Windows\System\DNDjvup.exe
  C:\Windows\System\DNDjvup.exe
  2⤵
  PID:5672
- C:\Windows\System\cOAwaXb.exe
  C:\Windows\System\cOAwaXb.exe
  2⤵
  PID:5692
- C:\Windows\System\uZzHgnA.exe
  C:\Windows\System\uZzHgnA.exe
  2⤵
  PID:5720
- C:\Windows\System\TlvgOAD.exe
  C:\Windows\System\TlvgOAD.exe
  2⤵
  PID:5748
- C:\Windows\System\YVROqqT.exe
  C:\Windows\System\YVROqqT.exe
  2⤵
  PID:5772
- C:\Windows\System\YHtgHCH.exe
  C:\Windows\System\YHtgHCH.exe
  2⤵
  PID:5800
- C:\Windows\System\EmOwtSt.exe
  C:\Windows\System\EmOwtSt.exe
  2⤵
  PID:5832
- C:\Windows\System\XzUgiQO.exe
  C:\Windows\System\XzUgiQO.exe
  2⤵
  PID:5856
- C:\Windows\System\AqJXJzF.exe
  C:\Windows\System\AqJXJzF.exe
  2⤵
  PID:5884
- C:\Windows\System\DlLkVhe.exe
  C:\Windows\System\DlLkVhe.exe
  2⤵
  PID:5916
- C:\Windows\System\WfnTOEE.exe
  C:\Windows\System\WfnTOEE.exe
  2⤵
  PID:5940
- C:\Windows\System\TVnKkAO.exe
  C:\Windows\System\TVnKkAO.exe
  2⤵
  PID:5972
- C:\Windows\System\mfXEEdK.exe
  C:\Windows\System\mfXEEdK.exe
  2⤵
  PID:5996
- C:\Windows\System\AFLbEfi.exe
  C:\Windows\System\AFLbEfi.exe
  2⤵
  PID:6028
- C:\Windows\System\jtWBksr.exe
  C:\Windows\System\jtWBksr.exe
  2⤵
  PID:6052
- C:\Windows\System\tabCWko.exe
  C:\Windows\System\tabCWko.exe
  2⤵
  PID:6080
- C:\Windows\System\cRlxwLL.exe
  C:\Windows\System\cRlxwLL.exe
  2⤵
  PID:6108
- C:\Windows\System\SkPeWZh.exe
  C:\Windows\System\SkPeWZh.exe
  2⤵
  PID:6136
- C:\Windows\System\HcHyPpe.exe
  C:\Windows\System\HcHyPpe.exe
  2⤵
  PID:3776
- C:\Windows\System\uBBfTPF.exe
  C:\Windows\System\uBBfTPF.exe
  2⤵
  PID:2516
- C:\Windows\System\OBqEqZQ.exe
  C:\Windows\System\OBqEqZQ.exe
  2⤵
  PID:3896
- C:\Windows\System\DrxkghQ.exe
  C:\Windows\System\DrxkghQ.exe
  2⤵
  PID:984
- C:\Windows\System\gHxvPmB.exe
  C:\Windows\System\gHxvPmB.exe
  2⤵
  PID:5096
- C:\Windows\System\hRsfosj.exe
  C:\Windows\System\hRsfosj.exe
  2⤵
  PID:5176
- C:\Windows\System\XrcJKKF.exe
  C:\Windows\System\XrcJKKF.exe
  2⤵
  PID:5236
- C:\Windows\System\zMeTQst.exe
  C:\Windows\System\zMeTQst.exe
  2⤵
  PID:5312
- C:\Windows\System\uXEipQB.exe
  C:\Windows\System\uXEipQB.exe
  2⤵
  PID:5376
- C:\Windows\System\VgjyunA.exe
  C:\Windows\System\VgjyunA.exe
  2⤵
  PID:5432
- C:\Windows\System\AXsoaGZ.exe
  C:\Windows\System\AXsoaGZ.exe
  2⤵
  PID:5488
- C:\Windows\System\mbxchhO.exe
  C:\Windows\System\mbxchhO.exe
  2⤵
  PID:5564
- C:\Windows\System\VSFFUMP.exe
  C:\Windows\System\VSFFUMP.exe
  2⤵
  PID:5620
- C:\Windows\System\lEzczsn.exe
  C:\Windows\System\lEzczsn.exe
  2⤵
  PID:5684
- C:\Windows\System\WehRXMX.exe
  C:\Windows\System\WehRXMX.exe
  2⤵
  PID:5740
- C:\Windows\System\mMgPwMA.exe
  C:\Windows\System\mMgPwMA.exe
  2⤵
  PID:5816
- C:\Windows\System\CgyiEcN.exe
  C:\Windows\System\CgyiEcN.exe
  2⤵
  PID:5876
- C:\Windows\System\IwNRXpv.exe
  C:\Windows\System\IwNRXpv.exe
  2⤵
  PID:5936
- C:\Windows\System\wmiKYUL.exe
  C:\Windows\System\wmiKYUL.exe
  2⤵
  PID:6012
- C:\Windows\System\REBqAZS.exe
  C:\Windows\System\REBqAZS.exe
  2⤵
  PID:6076
- C:\Windows\System\CUnAWsg.exe
  C:\Windows\System\CUnAWsg.exe
  2⤵
  PID:716
- C:\Windows\System\fAfEeFm.exe
  C:\Windows\System\fAfEeFm.exe
  2⤵
  PID:3408
- C:\Windows\System\OLlaaTI.exe
  C:\Windows\System\OLlaaTI.exe
  2⤵
  PID:4708
- C:\Windows\System\vsIjhSK.exe
  C:\Windows\System\vsIjhSK.exe
  2⤵
  PID:5204
- C:\Windows\System\sgcoPBz.exe
  C:\Windows\System\sgcoPBz.exe
  2⤵
  PID:5348
- C:\Windows\System\HONrNfj.exe
  C:\Windows\System\HONrNfj.exe
  2⤵
  PID:5480
- C:\Windows\System\NlcqtKe.exe
  C:\Windows\System\NlcqtKe.exe
  2⤵
  PID:5600
- C:\Windows\System\qKkNtbt.exe
  C:\Windows\System\qKkNtbt.exe
  2⤵
  PID:5736
- C:\Windows\System\atbauvW.exe
  C:\Windows\System\atbauvW.exe
  2⤵
  PID:444
- C:\Windows\System\GwqXtIV.exe
  C:\Windows\System\GwqXtIV.exe
  2⤵
  PID:6100
- C:\Windows\System\bbAjEGx.exe
  C:\Windows\System\bbAjEGx.exe
  2⤵
  PID:6128
- C:\Windows\System\PXqwQfs.exe
  C:\Windows\System\PXqwQfs.exe
  2⤵
  PID:2176
- C:\Windows\System\CQlBbEy.exe
  C:\Windows\System\CQlBbEy.exe
  2⤵
  PID:6172
- C:\Windows\System\vfwodxf.exe
  C:\Windows\System\vfwodxf.exe
  2⤵
  PID:6196
- C:\Windows\System\nzYaGEP.exe
  C:\Windows\System\nzYaGEP.exe
  2⤵
  PID:6224
- C:\Windows\System\qkhscER.exe
  C:\Windows\System\qkhscER.exe
  2⤵
  PID:6252
- C:\Windows\System\HXbpCEX.exe
  C:\Windows\System\HXbpCEX.exe
  2⤵
  PID:6284
- C:\Windows\System\HqWXSgY.exe
  C:\Windows\System\HqWXSgY.exe
  2⤵
  PID:6308
- C:\Windows\System\wzNmGgw.exe
  C:\Windows\System\wzNmGgw.exe
  2⤵
  PID:6340
- C:\Windows\System\uyqzgku.exe
  C:\Windows\System\uyqzgku.exe
  2⤵
  PID:6364
- C:\Windows\System\pKrAHTM.exe
  C:\Windows\System\pKrAHTM.exe
  2⤵
  PID:6392
- C:\Windows\System\wRsUGFC.exe
  C:\Windows\System\wRsUGFC.exe
  2⤵
  PID:6420
- C:\Windows\System\pZPAGvC.exe
  C:\Windows\System\pZPAGvC.exe
  2⤵
  PID:6448
- C:\Windows\System\MwoMjMi.exe
  C:\Windows\System\MwoMjMi.exe
  2⤵
  PID:6476
- C:\Windows\System\NhyGEaS.exe
  C:\Windows\System\NhyGEaS.exe
  2⤵
  PID:6512
- C:\Windows\System\fduQcGF.exe
  C:\Windows\System\fduQcGF.exe
  2⤵
  PID:6536
- C:\Windows\System\YcYLeKA.exe
  C:\Windows\System\YcYLeKA.exe
  2⤵
  PID:6560
- C:\Windows\System\CgFDcSY.exe
  C:\Windows\System\CgFDcSY.exe
  2⤵
  PID:6588
- C:\Windows\System\kzNvPRQ.exe
  C:\Windows\System\kzNvPRQ.exe
  2⤵
  PID:6620
- C:\Windows\System\WFdnDnB.exe
  C:\Windows\System\WFdnDnB.exe
  2⤵
  PID:6644
- C:\Windows\System\GBcOxCX.exe
  C:\Windows\System\GBcOxCX.exe
  2⤵
  PID:6672
- C:\Windows\System\mpZxXmt.exe
  C:\Windows\System\mpZxXmt.exe
  2⤵
  PID:6700
- C:\Windows\System\TGWOmPJ.exe
  C:\Windows\System\TGWOmPJ.exe
  2⤵
  PID:6728
- C:\Windows\System\mkUUCKe.exe
  C:\Windows\System\mkUUCKe.exe
  2⤵
  PID:6756
- C:\Windows\System\NduwUqd.exe
  C:\Windows\System\NduwUqd.exe
  2⤵
  PID:6784
- C:\Windows\System\BYJqgjq.exe
  C:\Windows\System\BYJqgjq.exe
  2⤵
  PID:6816
- C:\Windows\System\RKVdjiz.exe
  C:\Windows\System\RKVdjiz.exe
  2⤵
  PID:6840
- C:\Windows\System\CXVaJYD.exe
  C:\Windows\System\CXVaJYD.exe
  2⤵
  PID:6872
- C:\Windows\System\YGgiLfm.exe
  C:\Windows\System\YGgiLfm.exe
  2⤵
  PID:6896
- C:\Windows\System\MRcfKgA.exe
  C:\Windows\System\MRcfKgA.exe
  2⤵
  PID:6924
- C:\Windows\System\lAKisQN.exe
  C:\Windows\System\lAKisQN.exe
  2⤵
  PID:6952
- C:\Windows\System\MmpiOsZ.exe
  C:\Windows\System\MmpiOsZ.exe
  2⤵
  PID:6984
- C:\Windows\System\KArrhdv.exe
  C:\Windows\System\KArrhdv.exe
  2⤵
  PID:7012
- C:\Windows\System\ZXrIKsW.exe
  C:\Windows\System\ZXrIKsW.exe
  2⤵
  PID:7040
- C:\Windows\System\EiuVGSt.exe
  C:\Windows\System\EiuVGSt.exe
  2⤵
  PID:7068
- C:\Windows\System\dkFPgjZ.exe
  C:\Windows\System\dkFPgjZ.exe
  2⤵
  PID:7096
- C:\Windows\System\zdYKNwY.exe
  C:\Windows\System\zdYKNwY.exe
  2⤵
  PID:6300
- C:\Windows\System\sffMDZB.exe
  C:\Windows\System\sffMDZB.exe
  2⤵
  PID:6328
- C:\Windows\System\XTAzNtp.exe
  C:\Windows\System\XTAzNtp.exe
  2⤵
  PID:6384
- C:\Windows\System\ZAQduPC.exe
  C:\Windows\System\ZAQduPC.exe
  2⤵
  PID:3616
- C:\Windows\System\Ipdjqiu.exe
  C:\Windows\System\Ipdjqiu.exe
  2⤵
  PID:6464
- C:\Windows\System\ATHkbhx.exe
  C:\Windows\System\ATHkbhx.exe
  2⤵
  PID:6496
- C:\Windows\System\BTNcaff.exe
  C:\Windows\System\BTNcaff.exe
  2⤵
  PID:6580
- C:\Windows\System\sDxhEOR.exe
  C:\Windows\System\sDxhEOR.exe
  2⤵
  PID:6696
- C:\Windows\System\ACHAEGc.exe
  C:\Windows\System\ACHAEGc.exe
  2⤵
  PID:6752
- C:\Windows\System\IYkDGND.exe
  C:\Windows\System\IYkDGND.exe
  2⤵
  PID:6800
- C:\Windows\System\XXNFSMn.exe
  C:\Windows\System\XXNFSMn.exe
  2⤵
  PID:6832
- C:\Windows\System\dHanJPN.exe
  C:\Windows\System\dHanJPN.exe
  2⤵
  PID:6912
- C:\Windows\System\YHpvjvy.exe
  C:\Windows\System\YHpvjvy.exe
  2⤵
  PID:3320
- C:\Windows\System\wGbeDth.exe
  C:\Windows\System\wGbeDth.exe
  2⤵
  PID:6976
- C:\Windows\System\XlBagvk.exe
  C:\Windows\System\XlBagvk.exe
  2⤵
  PID:4392
- C:\Windows\System\fkVxaZM.exe
  C:\Windows\System\fkVxaZM.exe
  2⤵
  PID:4496
- C:\Windows\System\cRKBKro.exe
  C:\Windows\System\cRKBKro.exe
  2⤵
  PID:7108
- C:\Windows\System\UcUMGkV.exe
  C:\Windows\System\UcUMGkV.exe
  2⤵
  PID:5144
- C:\Windows\System\XPbVKoJ.exe
  C:\Windows\System\XPbVKoJ.exe
  2⤵
  PID:5000
- C:\Windows\System\xEsVLPQ.exe
  C:\Windows\System\xEsVLPQ.exe
  2⤵
  PID:6044
- C:\Windows\System\peEEFjb.exe
  C:\Windows\System\peEEFjb.exe
  2⤵
  PID:3440
- C:\Windows\System\rdeQDpo.exe
  C:\Windows\System\rdeQDpo.exe
  2⤵
  PID:1492
- C:\Windows\System\UFlMNWe.exe
  C:\Windows\System\UFlMNWe.exe
  2⤵
  PID:5712
- C:\Windows\System\cXfCZXR.exe
  C:\Windows\System\cXfCZXR.exe
  2⤵
  PID:1108
- C:\Windows\System\qxTpdya.exe
  C:\Windows\System\qxTpdya.exe
  2⤵
  PID:4908
- C:\Windows\System\dyjNvZa.exe
  C:\Windows\System\dyjNvZa.exe
  2⤵
  PID:2812
- C:\Windows\System\fFNcLcY.exe
  C:\Windows\System\fFNcLcY.exe
  2⤵
  PID:7112
- C:\Windows\System\xCECTGq.exe
  C:\Windows\System\xCECTGq.exe
  2⤵
  PID:2576
- C:\Windows\System\SPlTHqZ.exe
  C:\Windows\System\SPlTHqZ.exe
  2⤵
  PID:1580
- C:\Windows\System\CycidHl.exe
  C:\Windows\System\CycidHl.exe
  2⤵
  PID:5072
- C:\Windows\System\qOGIlVi.exe
  C:\Windows\System\qOGIlVi.exe
  2⤵
  PID:6472
- C:\Windows\System\qrCNPDf.exe
  C:\Windows\System\qrCNPDf.exe
  2⤵
  PID:6604
- C:\Windows\System\eeHQIZE.exe
  C:\Windows\System\eeHQIZE.exe
  2⤵
  PID:4924
- C:\Windows\System\IKDvGWH.exe
  C:\Windows\System\IKDvGWH.exe
  2⤵
  PID:6860
- C:\Windows\System\ElSsCPY.exe
  C:\Windows\System\ElSsCPY.exe
  2⤵
  PID:7004
- C:\Windows\System\VxCMTAK.exe
  C:\Windows\System\VxCMTAK.exe
  2⤵
  PID:7028
- C:\Windows\System\gYPMCxr.exe
  C:\Windows\System\gYPMCxr.exe
  2⤵
  PID:5288
- C:\Windows\System\yfvbaJf.exe
  C:\Windows\System\yfvbaJf.exe
  2⤵
  PID:7160
- C:\Windows\System\pMLAtAz.exe
  C:\Windows\System\pMLAtAz.exe
  2⤵
  PID:5988
- C:\Windows\System\BaOtGUw.exe
  C:\Windows\System\BaOtGUw.exe
  2⤵
  PID:5004
- C:\Windows\System\BQwhGJs.exe
  C:\Windows\System\BQwhGJs.exe
  2⤵
  PID:4956
- C:\Windows\System\JosjTFp.exe
  C:\Windows\System\JosjTFp.exe
  2⤵
  PID:6576
- C:\Windows\System\PDpQqrl.exe
  C:\Windows\System\PDpQqrl.exe
  2⤵
  PID:6636
- C:\Windows\System\ouEdUvf.exe
  C:\Windows\System\ouEdUvf.exe
  2⤵
  PID:7144
- C:\Windows\System\WeIjcDn.exe
  C:\Windows\System\WeIjcDn.exe
  2⤵
  PID:4048
- C:\Windows\System\QbaTJQT.exe
  C:\Windows\System\QbaTJQT.exe
  2⤵
  PID:2868
- C:\Windows\System\ETFTmgF.exe
  C:\Windows\System\ETFTmgF.exe
  2⤵
  PID:5152
- C:\Windows\System\qqXbzEl.exe
  C:\Windows\System\qqXbzEl.exe
  2⤵
  PID:4616
- C:\Windows\System\TGzIdwu.exe
  C:\Windows\System\TGzIdwu.exe
  2⤵
  PID:7188
- C:\Windows\System\OyXdOjQ.exe
  C:\Windows\System\OyXdOjQ.exe
  2⤵
  PID:7212
- C:\Windows\System\FTOeVfc.exe
  C:\Windows\System\FTOeVfc.exe
  2⤵
  PID:7228
- C:\Windows\System\YnWdzZq.exe
  C:\Windows\System\YnWdzZq.exe
  2⤵
  PID:7256
- C:\Windows\System\PTWBTDa.exe
  C:\Windows\System\PTWBTDa.exe
  2⤵
  PID:7288
- C:\Windows\System\WoPCQWW.exe
  C:\Windows\System\WoPCQWW.exe
  2⤵
  PID:7320
- C:\Windows\System\iYyfjCL.exe
  C:\Windows\System\iYyfjCL.exe
  2⤵
  PID:7340
- C:\Windows\System\oKwYsHS.exe
  C:\Windows\System\oKwYsHS.exe
  2⤵
  PID:7360
- C:\Windows\System\NTRjgYl.exe
  C:\Windows\System\NTRjgYl.exe
  2⤵
  PID:7384
- C:\Windows\System\lsoDwiv.exe
  C:\Windows\System\lsoDwiv.exe
  2⤵
  PID:7432
- C:\Windows\System\iVbZKvr.exe
  C:\Windows\System\iVbZKvr.exe
  2⤵
  PID:7464
- C:\Windows\System\QZyXVWa.exe
  C:\Windows\System\QZyXVWa.exe
  2⤵
  PID:7488
- C:\Windows\System\KewdZtv.exe
  C:\Windows\System\KewdZtv.exe
  2⤵
  PID:7516
- C:\Windows\System\HPxoAqn.exe
  C:\Windows\System\HPxoAqn.exe
  2⤵
  PID:7564
- C:\Windows\System\eUAPglL.exe
  C:\Windows\System\eUAPglL.exe
  2⤵
  PID:7612
- C:\Windows\System\PxyeaXs.exe
  C:\Windows\System\PxyeaXs.exe
  2⤵
  PID:7632
- C:\Windows\System\YCXzeBG.exe
  C:\Windows\System\YCXzeBG.exe
  2⤵
  PID:7676
- C:\Windows\System\LtUVXCk.exe
  C:\Windows\System\LtUVXCk.exe
  2⤵
  PID:7700
- C:\Windows\System\uMHdcQE.exe
  C:\Windows\System\uMHdcQE.exe
  2⤵
  PID:7724
- C:\Windows\System\TPCyDDP.exe
  C:\Windows\System\TPCyDDP.exe
  2⤵
  PID:7744
- C:\Windows\System\zKsKNwP.exe
  C:\Windows\System\zKsKNwP.exe
  2⤵
  PID:7764
- C:\Windows\System\WXlzQus.exe
  C:\Windows\System\WXlzQus.exe
  2⤵
  PID:7812
- C:\Windows\System\VPUCqnK.exe
  C:\Windows\System\VPUCqnK.exe
  2⤵
  PID:7844
- C:\Windows\System\rzvyvRg.exe
  C:\Windows\System\rzvyvRg.exe
  2⤵
  PID:7860
- C:\Windows\System\RVuuhRq.exe
  C:\Windows\System\RVuuhRq.exe
  2⤵
  PID:7884
- C:\Windows\System\QgumPGQ.exe
  C:\Windows\System\QgumPGQ.exe
  2⤵
  PID:7920
- C:\Windows\System\NxCnRTh.exe
  C:\Windows\System\NxCnRTh.exe
  2⤵
  PID:7960
- C:\Windows\System\uSUOKrP.exe
  C:\Windows\System\uSUOKrP.exe
  2⤵
  PID:7984
- C:\Windows\System\buphcTq.exe
  C:\Windows\System\buphcTq.exe
  2⤵
  PID:8008
- C:\Windows\System\pmSsVgs.exe
  C:\Windows\System\pmSsVgs.exe
  2⤵
  PID:8032
- C:\Windows\System\GZChHbX.exe
  C:\Windows\System\GZChHbX.exe
  2⤵
  PID:8052
- C:\Windows\System\iWinukI.exe
  C:\Windows\System\iWinukI.exe
  2⤵
  PID:8072
- C:\Windows\System\bgxyKNJ.exe
  C:\Windows\System\bgxyKNJ.exe
  2⤵
  PID:8108
- C:\Windows\System\gSSDrbc.exe
  C:\Windows\System\gSSDrbc.exe
  2⤵
  PID:8124
- C:\Windows\System\nmQoXnF.exe
  C:\Windows\System\nmQoXnF.exe
  2⤵
  PID:8152
- C:\Windows\System\tAHBjDz.exe
  C:\Windows\System\tAHBjDz.exe
  2⤵
  PID:8168
- C:\Windows\System\GAJtPYb.exe
  C:\Windows\System\GAJtPYb.exe
  2⤵
  PID:4144
- C:\Windows\System\WcRAWOw.exe
  C:\Windows\System\WcRAWOw.exe
  2⤵
  PID:7180
- C:\Windows\System\OUdwLFe.exe
  C:\Windows\System\OUdwLFe.exe
  2⤵
  PID:7396
- C:\Windows\System\gBXsvmZ.exe
  C:\Windows\System\gBXsvmZ.exe
  2⤵
  PID:7368
- C:\Windows\System\QVyzjVw.exe
  C:\Windows\System\QVyzjVw.exe
  2⤵
  PID:7460
- C:\Windows\System\NdEhgnT.exe
  C:\Windows\System\NdEhgnT.exe
  2⤵
  PID:3636
- C:\Windows\System\ASAAKtV.exe
  C:\Windows\System\ASAAKtV.exe
  2⤵
  PID:4996
- C:\Windows\System\uakpMan.exe
  C:\Windows\System\uakpMan.exe
  2⤵
  PID:3600
- C:\Windows\System\mLyHhIu.exe
  C:\Windows\System\mLyHhIu.exe
  2⤵
  PID:1064
- C:\Windows\System\sbYzgDU.exe
  C:\Windows\System\sbYzgDU.exe
  2⤵
  PID:7736
- C:\Windows\System\fzhzXNc.exe
  C:\Windows\System\fzhzXNc.exe
  2⤵
  PID:7840
- C:\Windows\System\YrRhiFt.exe
  C:\Windows\System\YrRhiFt.exe
  2⤵
  PID:7868
- C:\Windows\System\tGKrsqU.exe
  C:\Windows\System\tGKrsqU.exe
  2⤵
  PID:7876
- C:\Windows\System\kOrqLeO.exe
  C:\Windows\System\kOrqLeO.exe
  2⤵
  PID:7952
- C:\Windows\System\wFpCgBo.exe
  C:\Windows\System\wFpCgBo.exe
  2⤵
  PID:1500
- C:\Windows\System\CfCOUtp.exe
  C:\Windows\System\CfCOUtp.exe
  2⤵
  PID:8132
- C:\Windows\System\ZZwrRDO.exe
  C:\Windows\System\ZZwrRDO.exe
  2⤵
  PID:8044
- C:\Windows\System\FutZJFw.exe
  C:\Windows\System\FutZJFw.exe
  2⤵
  PID:8164
- C:\Windows\System\WlFEvSm.exe
  C:\Windows\System\WlFEvSm.exe
  2⤵
  PID:7248
- C:\Windows\System\FcIVUFc.exe
  C:\Windows\System\FcIVUFc.exe
  2⤵
  PID:7284
- C:\Windows\System\uRKInBR.exe
  C:\Windows\System\uRKInBR.exe
  2⤵
  PID:7392
- C:\Windows\System\MQDiMvM.exe
  C:\Windows\System\MQDiMvM.exe
  2⤵
  PID:7504
- C:\Windows\System\tJYDOHu.exe
  C:\Windows\System\tJYDOHu.exe
  2⤵
  PID:7660
- C:\Windows\System\PSBtvtd.exe
  C:\Windows\System\PSBtvtd.exe
  2⤵
  PID:7732
- C:\Windows\System\WDnTydj.exe
  C:\Windows\System\WDnTydj.exe
  2⤵
  PID:7892
- C:\Windows\System\VzYxTJa.exe
  C:\Windows\System\VzYxTJa.exe
  2⤵
  PID:7416
- C:\Windows\System\JrICBAe.exe
  C:\Windows\System\JrICBAe.exe
  2⤵
  PID:3876
- C:\Windows\System\pwGizlw.exe
  C:\Windows\System\pwGizlw.exe
  2⤵
  PID:7556
- C:\Windows\System\QUgAYKE.exe
  C:\Windows\System\QUgAYKE.exe
  2⤵
  PID:7668
- C:\Windows\System\nmcuRFM.exe
  C:\Windows\System\nmcuRFM.exe
  2⤵
  PID:7200
- C:\Windows\System\IFHwlWZ.exe
  C:\Windows\System\IFHwlWZ.exe
  2⤵
  PID:804
- C:\Windows\System\TKjxeNP.exe
  C:\Windows\System\TKjxeNP.exe
  2⤵
  PID:7604
- C:\Windows\System\ycUftUk.exe
  C:\Windows\System\ycUftUk.exe
  2⤵
  PID:8228
- C:\Windows\System\PZKVyXz.exe
  C:\Windows\System\PZKVyXz.exe
  2⤵
  PID:8252
- C:\Windows\System\kJCNLzj.exe
  C:\Windows\System\kJCNLzj.exe
  2⤵
  PID:8276
- C:\Windows\System\HTsZcCA.exe
  C:\Windows\System\HTsZcCA.exe
  2⤵
  PID:8320
- C:\Windows\System\ewzpTgf.exe
  C:\Windows\System\ewzpTgf.exe
  2⤵
  PID:8344
- C:\Windows\System\sfLnxVa.exe
  C:\Windows\System\sfLnxVa.exe
  2⤵
  PID:8364
- C:\Windows\System\nTkuSCz.exe
  C:\Windows\System\nTkuSCz.exe
  2⤵
  PID:8404
- C:\Windows\System\yfNAQoA.exe
  C:\Windows\System\yfNAQoA.exe
  2⤵
  PID:8428
- C:\Windows\System\DTzjFtI.exe
  C:\Windows\System\DTzjFtI.exe
  2⤵
  PID:8460
- C:\Windows\System\lsuFEKy.exe
  C:\Windows\System\lsuFEKy.exe
  2⤵
  PID:8488
- C:\Windows\System\ekYalxr.exe
  C:\Windows\System\ekYalxr.exe
  2⤵
  PID:8516
- C:\Windows\System\JWXuKNF.exe
  C:\Windows\System\JWXuKNF.exe
  2⤵
  PID:8536
- C:\Windows\System\VUehJWs.exe
  C:\Windows\System\VUehJWs.exe
  2⤵
  PID:8576
- C:\Windows\System\rXsGqhi.exe
  C:\Windows\System\rXsGqhi.exe
  2⤵
  PID:8600
- C:\Windows\System\UGnKlyl.exe
  C:\Windows\System\UGnKlyl.exe
  2⤵
  PID:8620
- C:\Windows\System\qQygoZk.exe
  C:\Windows\System\qQygoZk.exe
  2⤵
  PID:8640
- C:\Windows\System\bCikRvV.exe
  C:\Windows\System\bCikRvV.exe
  2⤵
  PID:8660
- C:\Windows\System\icjkOaK.exe
  C:\Windows\System\icjkOaK.exe
  2⤵
  PID:8684
- C:\Windows\System\bSmsawJ.exe
  C:\Windows\System\bSmsawJ.exe
  2⤵
  PID:8732
- C:\Windows\System\hsCtbiB.exe
  C:\Windows\System\hsCtbiB.exe
  2⤵
  PID:8764
- C:\Windows\System\sqyqLDW.exe
  C:\Windows\System\sqyqLDW.exe
  2⤵
  PID:8784
- C:\Windows\System\RLmxrZx.exe
  C:\Windows\System\RLmxrZx.exe
  2⤵
  PID:8808
- C:\Windows\System\nwDwadV.exe
  C:\Windows\System\nwDwadV.exe
  2⤵
  PID:8836
- C:\Windows\System\yYogrLi.exe
  C:\Windows\System\yYogrLi.exe
  2⤵
  PID:8888
- C:\Windows\System\rFnTEnm.exe
  C:\Windows\System\rFnTEnm.exe
  2⤵
  PID:8912
- C:\Windows\System\Kuibgvd.exe
  C:\Windows\System\Kuibgvd.exe
  2⤵
  PID:8944
- C:\Windows\System\CtSlhka.exe
  C:\Windows\System\CtSlhka.exe
  2⤵
  PID:8960
- C:\Windows\System\htDbsTC.exe
  C:\Windows\System\htDbsTC.exe
  2⤵
  PID:8980
- C:\Windows\System\dNStTaz.exe
  C:\Windows\System\dNStTaz.exe
  2⤵
  PID:9004
- C:\Windows\System\yMeqIPk.exe
  C:\Windows\System\yMeqIPk.exe
  2⤵
  PID:9048
- C:\Windows\System\bypJzqw.exe
  C:\Windows\System\bypJzqw.exe
  2⤵
  PID:9072
- C:\Windows\System\nKayiYX.exe
  C:\Windows\System\nKayiYX.exe
  2⤵
  PID:9104
- C:\Windows\System\sdgedyr.exe
  C:\Windows\System\sdgedyr.exe
  2⤵
  PID:9132
- C:\Windows\System\NTEtHHP.exe
  C:\Windows\System\NTEtHHP.exe
  2⤵
  PID:9176
- C:\Windows\System\BXIBVgO.exe
  C:\Windows\System\BXIBVgO.exe
  2⤵
  PID:9192
- C:\Windows\System\sQfbSQd.exe
  C:\Windows\System\sQfbSQd.exe
  2⤵
  PID:7372
- C:\Windows\System\scfnbLp.exe
  C:\Windows\System\scfnbLp.exe
  2⤵
  PID:8220
- C:\Windows\System\nnEJabd.exe
  C:\Windows\System\nnEJabd.exe
  2⤵
  PID:8268
- C:\Windows\System\dELOWlM.exe
  C:\Windows\System\dELOWlM.exe
  2⤵
  PID:8316
- C:\Windows\System\hirkNQV.exe
  C:\Windows\System\hirkNQV.exe
  2⤵
  PID:8360
- C:\Windows\System\opwMrjD.exe
  C:\Windows\System\opwMrjD.exe
  2⤵
  PID:7532
- C:\Windows\System\WdsiENz.exe
  C:\Windows\System\WdsiENz.exe
  2⤵
  PID:8508
- C:\Windows\System\JrzGklB.exe
  C:\Windows\System\JrzGklB.exe
  2⤵
  PID:8572
- C:\Windows\System\GSQKXxq.exe
  C:\Windows\System\GSQKXxq.exe
  2⤵
  PID:8680
- C:\Windows\System\EeRZVaG.exe
  C:\Windows\System\EeRZVaG.exe
  2⤵
  PID:8796
- C:\Windows\System\JSGhEbp.exe
  C:\Windows\System\JSGhEbp.exe
  2⤵
  PID:8868
- C:\Windows\System\cBaSESa.exe
  C:\Windows\System\cBaSESa.exe
  2⤵
  PID:8936
- C:\Windows\System\kVcQVjR.exe
  C:\Windows\System\kVcQVjR.exe
  2⤵
  PID:8956
- C:\Windows\System\gVjpYnH.exe
  C:\Windows\System\gVjpYnH.exe
  2⤵
  PID:9056
- C:\Windows\System\XhfFXdC.exe
  C:\Windows\System\XhfFXdC.exe
  2⤵
  PID:9064
- C:\Windows\System\UVbpBGx.exe
  C:\Windows\System\UVbpBGx.exe
  2⤵
  PID:9100
- C:\Windows\System\dIsbUCH.exe
  C:\Windows\System\dIsbUCH.exe
  2⤵
  PID:9168
- C:\Windows\System\VSsRKJE.exe
  C:\Windows\System\VSsRKJE.exe
  2⤵
  PID:8248
- C:\Windows\System\sGhhISc.exe
  C:\Windows\System\sGhhISc.exe
  2⤵
  PID:8524
- C:\Windows\System\jNvxQHu.exe
  C:\Windows\System\jNvxQHu.exe
  2⤵
  PID:8596
- C:\Windows\System\fWoaZBh.exe
  C:\Windows\System\fWoaZBh.exe
  2⤵
  PID:8780
- C:\Windows\System\DwhbERM.exe
  C:\Windows\System\DwhbERM.exe
  2⤵
  PID:8908
- C:\Windows\System\OIyGbFr.exe
  C:\Windows\System\OIyGbFr.exe
  2⤵
  PID:9040
- C:\Windows\System\YadrLWU.exe
  C:\Windows\System\YadrLWU.exe
  2⤵
  PID:8308
- C:\Windows\System\ATtfOZp.exe
  C:\Windows\System\ATtfOZp.exe
  2⤵
  PID:8636
- C:\Windows\System\MzcyTjI.exe
  C:\Windows\System\MzcyTjI.exe
  2⤵
  PID:8776
- C:\Windows\System\BxMzYsU.exe
  C:\Windows\System\BxMzYsU.exe
  2⤵
  PID:9024
- C:\Windows\System\dYxsLwl.exe
  C:\Windows\System\dYxsLwl.exe
  2⤵
  PID:8356
- C:\Windows\System\jUzmOOJ.exe
  C:\Windows\System\jUzmOOJ.exe
  2⤵
  PID:9240
- C:\Windows\System\wplgXvu.exe
  C:\Windows\System\wplgXvu.exe
  2⤵
  PID:9268
- C:\Windows\System\HzOZeLA.exe
  C:\Windows\System\HzOZeLA.exe
  2⤵
  PID:9320
- C:\Windows\System\ldYLiZc.exe
  C:\Windows\System\ldYLiZc.exe
  2⤵
  PID:9340
- C:\Windows\System\ZhYXWoo.exe
  C:\Windows\System\ZhYXWoo.exe
  2⤵
  PID:9364
- C:\Windows\System\nvCibAn.exe
  C:\Windows\System\nvCibAn.exe
  2⤵
  PID:9384
- C:\Windows\System\psUDiiC.exe
  C:\Windows\System\psUDiiC.exe
  2⤵
  PID:9408
- C:\Windows\System\PquhnXp.exe
  C:\Windows\System\PquhnXp.exe
  2⤵
  PID:9448
- C:\Windows\System\xEoVDcX.exe
  C:\Windows\System\xEoVDcX.exe
  2⤵
  PID:9468
- C:\Windows\System\yPBBpDe.exe
  C:\Windows\System\yPBBpDe.exe
  2⤵
  PID:9488
- C:\Windows\System\TmJaBSL.exe
  C:\Windows\System\TmJaBSL.exe
  2⤵
  PID:9516
- C:\Windows\System\sUzWzRD.exe
  C:\Windows\System\sUzWzRD.exe
  2⤵
  PID:9532
- C:\Windows\System\btIVkHy.exe
  C:\Windows\System\btIVkHy.exe
  2⤵
  PID:9552
- C:\Windows\System\aUaSNFL.exe
  C:\Windows\System\aUaSNFL.exe
  2⤵
  PID:9576
- C:\Windows\System\mkKHBIC.exe
  C:\Windows\System\mkKHBIC.exe
  2⤵
  PID:9592
- C:\Windows\System\JWsBIHI.exe
  C:\Windows\System\JWsBIHI.exe
  2⤵
  PID:9768
- C:\Windows\System\HtGFUjW.exe
  C:\Windows\System\HtGFUjW.exe
  2⤵
  PID:9840
- C:\Windows\System\JJvPIDz.exe
  C:\Windows\System\JJvPIDz.exe
  2⤵
  PID:9868
- C:\Windows\System\XGSTqli.exe
  C:\Windows\System\XGSTqli.exe
  2⤵
  PID:9892
- C:\Windows\System\OgTiJaB.exe
  C:\Windows\System\OgTiJaB.exe
  2⤵
  PID:9908
- C:\Windows\System\veFyeKJ.exe
  C:\Windows\System\veFyeKJ.exe
  2⤵
  PID:9924
- C:\Windows\System\MEjwvcQ.exe
  C:\Windows\System\MEjwvcQ.exe
  2⤵
  PID:9972
- C:\Windows\System\ctQEXFg.exe
  C:\Windows\System\ctQEXFg.exe
  2⤵
  PID:9988
- C:\Windows\System\NIdKdmZ.exe
  C:\Windows\System\NIdKdmZ.exe
  2⤵
  PID:10012
- C:\Windows\System\eYzzDFq.exe
  C:\Windows\System\eYzzDFq.exe
  2⤵
  PID:10052
- C:\Windows\System\CbcObJn.exe
  C:\Windows\System\CbcObJn.exe
  2⤵
  PID:10068
- C:\Windows\System\bgnhoQm.exe
  C:\Windows\System\bgnhoQm.exe
  2⤵
  PID:10092
- C:\Windows\System\QzxKfKH.exe
  C:\Windows\System\QzxKfKH.exe
  2⤵
  PID:10112
- C:\Windows\System\kdRtHlL.exe
  C:\Windows\System\kdRtHlL.exe
  2⤵
  PID:10172
- C:\Windows\System\UXbrRfp.exe
  C:\Windows\System\UXbrRfp.exe
  2⤵
  PID:10192
- C:\Windows\System\hRldVNB.exe
  C:\Windows\System\hRldVNB.exe
  2⤵
  PID:10232
- C:\Windows\System\jUyogwJ.exe
  C:\Windows\System\jUyogwJ.exe
  2⤵
  PID:9224
- C:\Windows\System\HknahZf.exe
  C:\Windows\System\HknahZf.exe
  2⤵
  PID:9248
- C:\Windows\System\MlDcrqP.exe
  C:\Windows\System\MlDcrqP.exe
  2⤵
  PID:9348
- C:\Windows\System\TjQJazh.exe
  C:\Windows\System\TjQJazh.exe
  2⤵
  PID:9380
- C:\Windows\System\yMFpKMr.exe
  C:\Windows\System\yMFpKMr.exe
  2⤵
  PID:9460
- C:\Windows\System\ctQZixj.exe
  C:\Windows\System\ctQZixj.exe
  2⤵
  PID:9524
- C:\Windows\System\xLgkwkE.exe
  C:\Windows\System\xLgkwkE.exe
  2⤵
  PID:9568
- C:\Windows\System\uEuBOAL.exe
  C:\Windows\System\uEuBOAL.exe
  2⤵
  PID:9668
- C:\Windows\System\SwjKwMO.exe
  C:\Windows\System\SwjKwMO.exe
  2⤵
  PID:9588
- C:\Windows\System\JcQfxmo.exe
  C:\Windows\System\JcQfxmo.exe
  2⤵
  PID:9652
- C:\Windows\System\AHecInh.exe
  C:\Windows\System\AHecInh.exe
  2⤵
  PID:9736
- C:\Windows\System\HcRrmzM.exe
  C:\Windows\System\HcRrmzM.exe
  2⤵
  PID:9744
- C:\Windows\System\qzDBxGQ.exe
  C:\Windows\System\qzDBxGQ.exe
  2⤵
  PID:8924
- C:\Windows\System\TRAqmsN.exe
  C:\Windows\System\TRAqmsN.exe
  2⤵
  PID:9832
- C:\Windows\System\GRyRoCz.exe
  C:\Windows\System\GRyRoCz.exe
  2⤵
  PID:9960
- C:\Windows\System\sMoIkVR.exe
  C:\Windows\System\sMoIkVR.exe
  2⤵
  PID:10004
- C:\Windows\System\IrTTNXP.exe
  C:\Windows\System\IrTTNXP.exe
  2⤵
  PID:10076
- C:\Windows\System\ItIVByB.exe
  C:\Windows\System\ItIVByB.exe
  2⤵
  PID:10160
- C:\Windows\System\BLZUjHo.exe
  C:\Windows\System\BLZUjHo.exe
  2⤵
  PID:10188
- C:\Windows\System\lWqLuPU.exe
  C:\Windows\System\lWqLuPU.exe
  2⤵
  PID:9308
- C:\Windows\System\BlrpWvy.exe
  C:\Windows\System\BlrpWvy.exe
  2⤵
  PID:9436
- C:\Windows\System\pYHvNOI.exe
  C:\Windows\System\pYHvNOI.exe
  2⤵
  PID:9584
- C:\Windows\System\FULAWEa.exe
  C:\Windows\System\FULAWEa.exe
  2⤵
  PID:9660
- C:\Windows\System\qMJxoqF.exe
  C:\Windows\System\qMJxoqF.exe
  2⤵
  PID:9764
- C:\Windows\System\gJcxXxJ.exe
  C:\Windows\System\gJcxXxJ.exe
  2⤵
  PID:9876
- C:\Windows\System\EgXbYVN.exe
  C:\Windows\System\EgXbYVN.exe
  2⤵
  PID:9980
- C:\Windows\System\afdLtJd.exe
  C:\Windows\System\afdLtJd.exe
  2⤵
  PID:10184
- C:\Windows\System\mmZxUES.exe
  C:\Windows\System\mmZxUES.exe
  2⤵
  PID:9484
- C:\Windows\System\BMuvloT.exe
  C:\Windows\System\BMuvloT.exe
  2⤵
  PID:9728
- C:\Windows\System\OsOSaIx.exe
  C:\Windows\System\OsOSaIx.exe
  2⤵
  PID:9904
- C:\Windows\System\wDGLpjC.exe
  C:\Windows\System\wDGLpjC.exe
  2⤵
  PID:10064
- C:\Windows\System\ucuUHUZ.exe
  C:\Windows\System\ucuUHUZ.exe
  2⤵
  PID:9548
- C:\Windows\System\HwviLxE.exe
  C:\Windows\System\HwviLxE.exe
  2⤵
  PID:10260
- C:\Windows\System\RFBjtVf.exe
  C:\Windows\System\RFBjtVf.exe
  2⤵
  PID:10276
- C:\Windows\System\rYdudvl.exe
  C:\Windows\System\rYdudvl.exe
  2⤵
  PID:10328
- C:\Windows\System\gqmkDvr.exe
  C:\Windows\System\gqmkDvr.exe
  2⤵
  PID:10356
- C:\Windows\System\WogydgR.exe
  C:\Windows\System\WogydgR.exe
  2⤵
  PID:10372
- C:\Windows\System\KQJUuwD.exe
  C:\Windows\System\KQJUuwD.exe
  2⤵
  PID:10396
- C:\Windows\System\vHdttqa.exe
  C:\Windows\System\vHdttqa.exe
  2⤵
  PID:10444
- C:\Windows\System\jdDwLTv.exe
  C:\Windows\System\jdDwLTv.exe
  2⤵
  PID:10468
- C:\Windows\System\QmQGVLr.exe
  C:\Windows\System\QmQGVLr.exe
  2⤵
  PID:10512
- C:\Windows\System\ysUmhda.exe
  C:\Windows\System\ysUmhda.exe
  2⤵
  PID:10548
- C:\Windows\System\yOmUsNw.exe
  C:\Windows\System\yOmUsNw.exe
  2⤵
  PID:10576
- C:\Windows\System\MOcYAxj.exe
  C:\Windows\System\MOcYAxj.exe
  2⤵
  PID:10604
- C:\Windows\System\vHJdgzk.exe
  C:\Windows\System\vHJdgzk.exe
  2⤵
  PID:10620
- C:\Windows\System\MNjZksc.exe
  C:\Windows\System\MNjZksc.exe
  2⤵
  PID:10644
- C:\Windows\System\FtfhXYK.exe
  C:\Windows\System\FtfhXYK.exe
  2⤵
  PID:10664
- C:\Windows\System\ZVnEvgy.exe
  C:\Windows\System\ZVnEvgy.exe
  2⤵
  PID:10696
- C:\Windows\System\bSlNIXn.exe
  C:\Windows\System\bSlNIXn.exe
  2⤵
  PID:10728
- C:\Windows\System\OBwzMDh.exe
  C:\Windows\System\OBwzMDh.exe
  2⤵
  PID:10760
- C:\Windows\System\McqlKMb.exe
  C:\Windows\System\McqlKMb.exe
  2⤵
  PID:10788
- C:\Windows\System\rpZQQzh.exe
  C:\Windows\System\rpZQQzh.exe
  2⤵
  PID:10808
- C:\Windows\System\EFGtUZW.exe
  C:\Windows\System\EFGtUZW.exe
  2⤵
  PID:10824
- C:\Windows\System\gVVNCaE.exe
  C:\Windows\System\gVVNCaE.exe
  2⤵
  PID:10848
- C:\Windows\System\DjcFYBi.exe
  C:\Windows\System\DjcFYBi.exe
  2⤵
  PID:10868
- C:\Windows\System\JryTXSz.exe
  C:\Windows\System\JryTXSz.exe
  2⤵
  PID:10924
- C:\Windows\System\ednflqT.exe
  C:\Windows\System\ednflqT.exe
  2⤵
  PID:10972
- C:\Windows\System\lwcrjJK.exe
  C:\Windows\System\lwcrjJK.exe
  2⤵
  PID:10992
- C:\Windows\System\hIzwiER.exe
  C:\Windows\System\hIzwiER.exe
  2⤵
  PID:11012
- C:\Windows\System\buEhDxd.exe
  C:\Windows\System\buEhDxd.exe
  2⤵
  PID:11028
- C:\Windows\System\cFvihlE.exe
  C:\Windows\System\cFvihlE.exe
  2⤵
  PID:11052
- C:\Windows\System\yKbJkVC.exe
  C:\Windows\System\yKbJkVC.exe
  2⤵
  PID:11076
- C:\Windows\System\SCtWeGB.exe
  C:\Windows\System\SCtWeGB.exe
  2⤵
  PID:11096
- C:\Windows\System\TBScJcC.exe
  C:\Windows\System\TBScJcC.exe
  2⤵
  PID:11128
- C:\Windows\System\SLJSuMZ.exe
  C:\Windows\System\SLJSuMZ.exe
  2⤵
  PID:11188
- C:\Windows\System\TImnQsj.exe
  C:\Windows\System\TImnQsj.exe
  2⤵
  PID:11220
- C:\Windows\System\GQoSEOZ.exe
  C:\Windows\System\GQoSEOZ.exe
  2⤵
  PID:11248
- C:\Windows\System\dxgvaya.exe
  C:\Windows\System\dxgvaya.exe
  2⤵
  PID:10244
- C:\Windows\System\VVVNfOR.exe
  C:\Windows\System\VVVNfOR.exe
  2⤵
  PID:8448
- C:\Windows\System\rexZVlX.exe
  C:\Windows\System\rexZVlX.exe
  2⤵
  PID:10308
- C:\Windows\System\VnxsvAX.exe
  C:\Windows\System\VnxsvAX.exe
  2⤵
  PID:10316
- C:\Windows\System\XAribju.exe
  C:\Windows\System\XAribju.exe
  2⤵
  PID:10416
- C:\Windows\System\OsAdDGz.exe
  C:\Windows\System\OsAdDGz.exe
  2⤵
  PID:10460
- C:\Windows\System\fyAOhVk.exe
  C:\Windows\System\fyAOhVk.exe
  2⤵
  PID:10504
- C:\Windows\System\Bcqotlk.exe
  C:\Windows\System\Bcqotlk.exe
  2⤵
  PID:10544
- C:\Windows\System\RwGHGrr.exe
  C:\Windows\System\RwGHGrr.exe
  2⤵
  PID:10584
- C:\Windows\System\IpiIyBD.exe
  C:\Windows\System\IpiIyBD.exe
  2⤵
  PID:10740
- C:\Windows\System\dFITGjH.exe
  C:\Windows\System\dFITGjH.exe
  2⤵
  PID:10756
- C:\Windows\System\IMmjBgv.exe
  C:\Windows\System\IMmjBgv.exe
  2⤵
  PID:10844
- C:\Windows\System\dSArUwt.exe
  C:\Windows\System\dSArUwt.exe
  2⤵
  PID:10916
- C:\Windows\System\TiEjUvv.exe
  C:\Windows\System\TiEjUvv.exe
  2⤵
  PID:10964
- C:\Windows\System\pkvzFiq.exe
  C:\Windows\System\pkvzFiq.exe
  2⤵
  PID:11116
- C:\Windows\System\XpObNhB.exe
  C:\Windows\System\XpObNhB.exe
  2⤵
  PID:11152
- C:\Windows\System\TguXKFw.exe
  C:\Windows\System\TguXKFw.exe
  2⤵
  PID:11212
- C:\Windows\System\nwGabFO.exe
  C:\Windows\System\nwGabFO.exe
  2⤵
  PID:9624
- C:\Windows\System\sGcmAhl.exe
  C:\Windows\System\sGcmAhl.exe
  2⤵
  PID:10320
- C:\Windows\System\UovuRuD.exe
  C:\Windows\System\UovuRuD.exe
  2⤵
  PID:4116
- C:\Windows\System\JNckvjK.exe
  C:\Windows\System\JNckvjK.exe
  2⤵
  PID:10652
- C:\Windows\System\JfkOYPS.exe
  C:\Windows\System\JfkOYPS.exe
  2⤵
  PID:10712
- C:\Windows\System\EKfhubt.exe
  C:\Windows\System\EKfhubt.exe
  2⤵
  PID:10968
- C:\Windows\System\TqPIObH.exe
  C:\Windows\System\TqPIObH.exe
  2⤵
  PID:11092
- C:\Windows\System\KlYdrrs.exe
  C:\Windows\System\KlYdrrs.exe
  2⤵
  PID:10464
- C:\Windows\System\gKszrUu.exe
  C:\Windows\System\gKszrUu.exe
  2⤵
  PID:10508
- C:\Windows\System\oROYkDM.exe
  C:\Windows\System\oROYkDM.exe
  2⤵
  PID:11088
- C:\Windows\System\slQpAGo.exe
  C:\Windows\System\slQpAGo.exe
  2⤵
  PID:1684
- C:\Windows\System\oBfBVVD.exe
  C:\Windows\System\oBfBVVD.exe
  2⤵
  PID:11204
- C:\Windows\System\khVfsiJ.exe
  C:\Windows\System\khVfsiJ.exe
  2⤵
  PID:11280
- C:\Windows\System\FJakQIm.exe
  C:\Windows\System\FJakQIm.exe
  2⤵
  PID:11304
- C:\Windows\System\HvbAmcx.exe
  C:\Windows\System\HvbAmcx.exe
  2⤵
  PID:11320
- C:\Windows\System\HiXpKht.exe
  C:\Windows\System\HiXpKht.exe
  2⤵
  PID:11360
- C:\Windows\System\CDIYMor.exe
  C:\Windows\System\CDIYMor.exe
  2⤵
  PID:11380
- C:\Windows\System\TsPbfoJ.exe
  C:\Windows\System\TsPbfoJ.exe
  2⤵
  PID:11400
- C:\Windows\System\vglGZgv.exe
  C:\Windows\System\vglGZgv.exe
  2⤵
  PID:11420
- C:\Windows\System\XkeALuF.exe
  C:\Windows\System\XkeALuF.exe
  2⤵
  PID:11456
- C:\Windows\System\HfvaGzv.exe
  C:\Windows\System\HfvaGzv.exe
  2⤵
  PID:11496
- C:\Windows\System\hLwzrTC.exe
  C:\Windows\System\hLwzrTC.exe
  2⤵
  PID:11544
- C:\Windows\System\wRFSPdr.exe
  C:\Windows\System\wRFSPdr.exe
  2⤵
  PID:11580
- C:\Windows\System\deUsMAG.exe
  C:\Windows\System\deUsMAG.exe
  2⤵
  PID:11596
- C:\Windows\System\olaQEeB.exe
  C:\Windows\System\olaQEeB.exe
  2⤵
  PID:11616
- C:\Windows\System\pSWwBse.exe
  C:\Windows\System\pSWwBse.exe
  2⤵
  PID:11652
- C:\Windows\System\piAmHWD.exe
  C:\Windows\System\piAmHWD.exe
  2⤵
  PID:11668
- C:\Windows\System\vwaVFqH.exe
  C:\Windows\System\vwaVFqH.exe
  2⤵
  PID:11688
- C:\Windows\System\UIzEmSk.exe
  C:\Windows\System\UIzEmSk.exe
  2⤵
  PID:11724
- C:\Windows\System\SQUZLEI.exe
  C:\Windows\System\SQUZLEI.exe
  2⤵
  PID:11744
- C:\Windows\System\xVAkIie.exe
  C:\Windows\System\xVAkIie.exe
  2⤵
  PID:11792
- C:\Windows\System\netgwxW.exe
  C:\Windows\System\netgwxW.exe
  2⤵
  PID:11808
- C:\Windows\System\elkIjqn.exe
  C:\Windows\System\elkIjqn.exe
  2⤵
  PID:11832
- C:\Windows\System\xJuyDNC.exe
  C:\Windows\System\xJuyDNC.exe
  2⤵
  PID:11852
- C:\Windows\System\qnuDjQK.exe
  C:\Windows\System\qnuDjQK.exe
  2⤵
  PID:11916
- C:\Windows\System\XDKvOcG.exe
  C:\Windows\System\XDKvOcG.exe
  2⤵
  PID:11944
- C:\Windows\System\iErOGVv.exe
  C:\Windows\System\iErOGVv.exe
  2⤵
  PID:11964
- C:\Windows\System\JQQuLxX.exe
  C:\Windows\System\JQQuLxX.exe
  2⤵
  PID:11988
- C:\Windows\System\bUxHlgX.exe
  C:\Windows\System\bUxHlgX.exe
  2⤵
  PID:12028
- C:\Windows\System\bGWnOdK.exe
  C:\Windows\System\bGWnOdK.exe
  2⤵
  PID:12064
- C:\Windows\System\VerOyCJ.exe
  C:\Windows\System\VerOyCJ.exe
  2⤵
  PID:12084
- C:\Windows\System\YoCzGRk.exe
  C:\Windows\System\YoCzGRk.exe
  2⤵
  PID:12112
- C:\Windows\System\rmLUMtD.exe
  C:\Windows\System\rmLUMtD.exe
  2⤵
  PID:12136
- C:\Windows\System\FIDjVEs.exe
  C:\Windows\System\FIDjVEs.exe
  2⤵
  PID:12160
- C:\Windows\System\VbQlOYQ.exe
  C:\Windows\System\VbQlOYQ.exe
  2⤵
  PID:12184
- C:\Windows\System\mMAorgg.exe
  C:\Windows\System\mMAorgg.exe
  2⤵
  PID:12228
- C:\Windows\System\WWLUFvv.exe
  C:\Windows\System\WWLUFvv.exe
  2⤵
  PID:12276
- C:\Windows\System\jQGzcwV.exe
  C:\Windows\System\jQGzcwV.exe
  2⤵
  PID:9376
- C:\Windows\System\NZYOwFL.exe
  C:\Windows\System\NZYOwFL.exe
  2⤵
  PID:11272
- C:\Windows\System\mhPaNtC.exe
  C:\Windows\System\mhPaNtC.exe
  2⤵
  PID:11296
- C:\Windows\System\NtzmzLL.exe
  C:\Windows\System\NtzmzLL.exe
  2⤵
  PID:11356
- C:\Windows\System\SvDCnOq.exe
  C:\Windows\System\SvDCnOq.exe
  2⤵
  PID:11416
- C:\Windows\System\tSBJhDe.exe
  C:\Windows\System\tSBJhDe.exe
  2⤵
  PID:11576
- C:\Windows\System\vDfRtiI.exe
  C:\Windows\System\vDfRtiI.exe
  2⤵
  PID:11608
- C:\Windows\System\EsExqLT.exe
  C:\Windows\System\EsExqLT.exe
  2⤵
  PID:11660
- C:\Windows\System\xdgUPfZ.exe
  C:\Windows\System\xdgUPfZ.exe
  2⤵
  PID:1824
- C:\Windows\System\DPocyAC.exe
  C:\Windows\System\DPocyAC.exe
  2⤵
  PID:11712
- C:\Windows\System\NWyTcMY.exe
  C:\Windows\System\NWyTcMY.exe
  2⤵
  PID:11848
- C:\Windows\System\ZEgTvpN.exe
  C:\Windows\System\ZEgTvpN.exe
  2⤵
  PID:11776
- C:\Windows\System\PDPOYwa.exe
  C:\Windows\System\PDPOYwa.exe
  2⤵
  PID:11952
- C:\Windows\System\KSalFtN.exe
  C:\Windows\System\KSalFtN.exe
  2⤵
  PID:11976
- C:\Windows\System\MLxBwLn.exe
  C:\Windows\System\MLxBwLn.exe
  2⤵
  PID:12044
- C:\Windows\System\XKpCHIP.exe
  C:\Windows\System\XKpCHIP.exe
  2⤵
  PID:12076
- C:\Windows\System\BXyaYOz.exe
  C:\Windows\System\BXyaYOz.exe
  2⤵
  PID:12132
- C:\Windows\System\SdbWQIA.exe
  C:\Windows\System\SdbWQIA.exe
  2⤵
  PID:4244
- C:\Windows\System\jtNOwAv.exe
  C:\Windows\System\jtNOwAv.exe
  2⤵
  PID:12220
- C:\Windows\System\uFvdcjG.exe
  C:\Windows\System\uFvdcjG.exe
  2⤵
  PID:12252
- C:\Windows\System\blxMyCk.exe
  C:\Windows\System\blxMyCk.exe
  2⤵
  PID:10436
- C:\Windows\System\SWmyTki.exe
  C:\Windows\System\SWmyTki.exe
  2⤵
  PID:11348
- C:\Windows\System\pODinKr.exe
  C:\Windows\System\pODinKr.exe
  2⤵
  PID:11516
- C:\Windows\System\RfhgHph.exe
  C:\Windows\System\RfhgHph.exe
  2⤵
  PID:11824
- C:\Windows\System\WiJgUIF.exe
  C:\Windows\System\WiJgUIF.exe
  2⤵
  PID:11740
- C:\Windows\System\MmqzcZm.exe
  C:\Windows\System\MmqzcZm.exe
  2⤵
  PID:11932
- C:\Windows\System\SAIjLkG.exe
  C:\Windows\System\SAIjLkG.exe
  2⤵
  PID:11888
- C:\Windows\System\zAOShoE.exe
  C:\Windows\System\zAOShoE.exe
  2⤵
  PID:12052
- C:\Windows\System\vCiiKUV.exe
  C:\Windows\System\vCiiKUV.exe
  2⤵
  PID:12268
- C:\Windows\System\hfZFjdh.exe
  C:\Windows\System\hfZFjdh.exe
  2⤵
  PID:12224
- C:\Windows\System\eZxRWtW.exe
  C:\Windows\System\eZxRWtW.exe
  2⤵
  PID:11468
- C:\Windows\System\FNoSPel.exe
  C:\Windows\System\FNoSPel.exe
  2⤵
  PID:11696
- C:\Windows\System\PXlAznF.exe
  C:\Windows\System\PXlAznF.exe
  2⤵
  PID:408
- C:\Windows\System\DMKPHlS.exe
  C:\Windows\System\DMKPHlS.exe
  2⤵
  PID:12284
- C:\Windows\System\ohdEGHi.exe
  C:\Windows\System\ohdEGHi.exe
  2⤵
  PID:12024
- C:\Windows\System\uSdhqlz.exe
  C:\Windows\System\uSdhqlz.exe
  2⤵
  PID:12304
- C:\Windows\System\tLnwXmP.exe
  C:\Windows\System\tLnwXmP.exe
  2⤵
  PID:12324
- C:\Windows\System\HdbPQJJ.exe
  C:\Windows\System\HdbPQJJ.exe
  2⤵
  PID:12344
- C:\Windows\System\JKqIQmu.exe
  C:\Windows\System\JKqIQmu.exe
  2⤵
  PID:12368
- C:\Windows\System\wGjBWWn.exe
  C:\Windows\System\wGjBWWn.exe
  2⤵
  PID:12392
- C:\Windows\System\qsMDitY.exe
  C:\Windows\System\qsMDitY.exe
  2⤵
  PID:12416
- C:\Windows\System\OSRwUTX.exe
  C:\Windows\System\OSRwUTX.exe
  2⤵
  PID:12508
- C:\Windows\System\ZwhlErC.exe
  C:\Windows\System\ZwhlErC.exe
  2⤵
  PID:12524
- C:\Windows\System\opOxozm.exe
  C:\Windows\System\opOxozm.exe
  2⤵
  PID:12540
- C:\Windows\System\SXceLVQ.exe
  C:\Windows\System\SXceLVQ.exe
  2⤵
  PID:12600
- C:\Windows\System\YmmFNsL.exe
  C:\Windows\System\YmmFNsL.exe
  2⤵
  PID:12640
- C:\Windows\System\QOjDblr.exe
  C:\Windows\System\QOjDblr.exe
  2⤵
  PID:12660
- C:\Windows\System\YiNvahb.exe
  C:\Windows\System\YiNvahb.exe
  2⤵
  PID:12700
- C:\Windows\System\mEmNpRa.exe
  C:\Windows\System\mEmNpRa.exe
  2⤵
  PID:12780
- C:\Windows\System\HAtmJHh.exe
  C:\Windows\System\HAtmJHh.exe
  2⤵
  PID:12804
- C:\Windows\System\muEtbeu.exe
  C:\Windows\System\muEtbeu.exe
  2⤵
  PID:12824
- C:\Windows\System\odxgYPh.exe
  C:\Windows\System\odxgYPh.exe
  2⤵
  PID:12852
- C:\Windows\System\vrwutna.exe
  C:\Windows\System\vrwutna.exe
  2⤵
  PID:12876
- C:\Windows\System\HzenyIe.exe
  C:\Windows\System\HzenyIe.exe
  2⤵
  PID:12916
- C:\Windows\System\fCrNzuN.exe
  C:\Windows\System\fCrNzuN.exe
  2⤵
  PID:12936
- C:\Windows\System\uIyFkCG.exe
  C:\Windows\System\uIyFkCG.exe
  2⤵
  PID:12964
- C:\Windows\System\fPAXkoS.exe
  C:\Windows\System\fPAXkoS.exe
  2⤵
  PID:13016
- C:\Windows\System\YSdLzjz.exe
  C:\Windows\System\YSdLzjz.exe
  2⤵
  PID:13048
- C:\Windows\System\lvSYvop.exe
  C:\Windows\System\lvSYvop.exe
  2⤵
  PID:13068
- C:\Windows\System\ovkDars.exe
  C:\Windows\System\ovkDars.exe
  2⤵
  PID:13208
- C:\Windows\System\ZMRDFWq.exe
  C:\Windows\System\ZMRDFWq.exe
  2⤵
  PID:13236
- C:\Windows\System\AJDhcWW.exe
  C:\Windows\System\AJDhcWW.exe
  2⤵
  PID:13256
- C:\Windows\System\LVxwBmj.exe
  C:\Windows\System\LVxwBmj.exe
  2⤵
  PID:12488
- C:\Windows\System\nCvpIOs.exe
  C:\Windows\System\nCvpIOs.exe
  2⤵
  PID:12612
- C:\Windows\System\SIyWmrv.exe
  C:\Windows\System\SIyWmrv.exe
  2⤵
  PID:12596
- C:\Windows\System\BXVLrIW.exe
  C:\Windows\System\BXVLrIW.exe
  2⤵
  PID:12620
- C:\Windows\System\SaBVxki.exe
  C:\Windows\System\SaBVxki.exe
  2⤵
  PID:12724
- C:\Windows\System\NHpHiNC.exe
  C:\Windows\System\NHpHiNC.exe
  2⤵
  PID:12748
- C:\Windows\System\vkjTUJR.exe
  C:\Windows\System\vkjTUJR.exe
  2⤵
  PID:12796
- C:\Windows\System\vOXnpiZ.exe
  C:\Windows\System\vOXnpiZ.exe
  2⤵
  PID:12816
- C:\Windows\System\kLBUMqc.exe
  C:\Windows\System\kLBUMqc.exe
  2⤵
  PID:12892
- C:\Windows\System\ZfDGrFt.exe
  C:\Windows\System\ZfDGrFt.exe
  2⤵
  PID:12904
- C:\Windows\System\PlfQBiL.exe
  C:\Windows\System\PlfQBiL.exe
  2⤵
  PID:12944
- C:\Windows\System\JTkpdty.exe
  C:\Windows\System\JTkpdty.exe
  2⤵
  PID:13000
- C:\Windows\System\QZIBJRK.exe
  C:\Windows\System\QZIBJRK.exe
  2⤵
  PID:13008
- C:\Windows\System\kRTFhEU.exe
  C:\Windows\System\kRTFhEU.exe
  2⤵
  PID:3632
- C:\Windows\System\gSvCKwO.exe
  C:\Windows\System\gSvCKwO.exe
  2⤵
  PID:1080
- C:\Windows\System\ApCAerq.exe
  C:\Windows\System\ApCAerq.exe
  2⤵
  PID:13088
- C:\Windows\System\WiOhWtq.exe
  C:\Windows\System\WiOhWtq.exe
  2⤵
  PID:13044
- C:\Windows\System\GsaIbui.exe
  C:\Windows\System\GsaIbui.exe
  2⤵
  PID:13152
- C:\Windows\System\FsYlbju.exe
  C:\Windows\System\FsYlbju.exe
  2⤵
  PID:13076
- C:\Windows\System\smZRVTX.exe
  C:\Windows\System\smZRVTX.exe
  2⤵
  PID:13128
- C:\Windows\System\ZEJCdmz.exe
  C:\Windows\System\ZEJCdmz.exe
  2⤵
  PID:13132
- C:\Windows\System\hlPBYgc.exe
  C:\Windows\System\hlPBYgc.exe
  2⤵
  PID:13176
- C:\Windows\System\CJQHZHD.exe
  C:\Windows\System\CJQHZHD.exe
  2⤵
  PID:4204
- C:\Windows\System\dShDTzg.exe
  C:\Windows\System\dShDTzg.exe
  2⤵
  PID:13284
- C:\Windows\System\sFITtZr.exe
  C:\Windows\System\sFITtZr.exe
  2⤵
  PID:13260
- C:\Windows\System\XHVmDLm.exe
  C:\Windows\System\XHVmDLm.exe
  2⤵
  PID:4828
- C:\Windows\System\kBiZdUm.exe
  C:\Windows\System\kBiZdUm.exe
  2⤵
  PID:12412
- C:\Windows\System\HEOtELx.exe
  C:\Windows\System\HEOtELx.exe
  2⤵
  PID:12400
- C:\Windows\System\nWWHIQd.exe
  C:\Windows\System\nWWHIQd.exe
  2⤵
  PID:12444
- C:\Windows\System\IFBhNsa.exe
  C:\Windows\System\IFBhNsa.exe
  2⤵
  PID:11640
- C:\Windows\System\KAPZgLc.exe
  C:\Windows\System\KAPZgLc.exe
  2⤵
  PID:12376
- C:\Windows\System\cQKkBfd.exe
  C:\Windows\System\cQKkBfd.exe
  2⤵
  PID:13172
- C:\Windows\System\HjZzbjp.exe
  C:\Windows\System\HjZzbjp.exe
  2⤵
  PID:12652
- C:\Windows\System\tVcbaWY.exe
  C:\Windows\System\tVcbaWY.exe
  2⤵
  PID:4824
- C:\Windows\System\okFCUhM.exe
  C:\Windows\System\okFCUhM.exe
  2⤵
  PID:12584
- C:\Windows\System\BvFuPeb.exe
  C:\Windows\System\BvFuPeb.exe
  2⤵
  PID:4448
- C:\Windows\System\vuEGdor.exe
  C:\Windows\System\vuEGdor.exe
  2⤵
  PID:6748
- C:\Windows\System\VmHgYES.exe
  C:\Windows\System\VmHgYES.exe
  2⤵
  PID:12592
- C:\Windows\System\XCfjasN.exe
  C:\Windows\System\XCfjasN.exe
  2⤵
  PID:3396
- C:\Windows\System\jboDSzO.exe
  C:\Windows\System\jboDSzO.exe
  2⤵
  PID:12820
- C:\Windows\System\xrCGZxP.exe
  C:\Windows\System\xrCGZxP.exe
  2⤵
  PID:12868
- C:\Windows\System\HjYQqiE.exe
  C:\Windows\System\HjYQqiE.exe
  2⤵
  PID:12960
- C:\Windows\System\dAdhTlo.exe
  C:\Windows\System\dAdhTlo.exe
  2⤵
  PID:12980
- C:\Windows\System\oyWxuvE.exe
  C:\Windows\System\oyWxuvE.exe
  2⤵
  PID:13080
- C:\Windows\System\WDAtuSe.exe
  C:\Windows\System\WDAtuSe.exe
  2⤵
  PID:13104
- C:\Windows\System\cuWMfUK.exe
  C:\Windows\System\cuWMfUK.exe
  2⤵
  PID:13116
- C:\Windows\System\mXVABGE.exe
  C:\Windows\System\mXVABGE.exe
  2⤵
  PID:13184
- C:\Windows\System\cxdtKyn.exe
  C:\Windows\System\cxdtKyn.exe
  2⤵
  PID:13268
- C:\Windows\System\zDvwWSR.exe
  C:\Windows\System\zDvwWSR.exe
  2⤵
  PID:12408
- C:\Windows\System\huxJsJO.exe
  C:\Windows\System\huxJsJO.exe
  2⤵
  PID:13292
- C:\Windows\System\HwJCyoZ.exe
  C:\Windows\System\HwJCyoZ.exe
  2⤵
  PID:364
- C:\Windows\System\wFEKtti.exe
  C:\Windows\System\wFEKtti.exe
  2⤵
  PID:12504
- C:\Windows\System\RAwiNLw.exe
  C:\Windows\System\RAwiNLw.exe
  2⤵
  PID:432
- C:\Windows\System\PumjMfG.exe
  C:\Windows\System\PumjMfG.exe
  2⤵
  PID:6272
- C:\Windows\System\PyyvPSN.exe
  C:\Windows\System\PyyvPSN.exe
  2⤵
  PID:6268
- C:\Windows\System\EaLAPUx.exe
  C:\Windows\System\EaLAPUx.exe
  2⤵
  PID:12860
- C:\Windows\System\Adplrhm.exe
  C:\Windows\System\Adplrhm.exe
  2⤵
  PID:12932
- C:\Windows\System\cTxLaPD.exe
  C:\Windows\System\cTxLaPD.exe
  2⤵
  PID:3908
- C:\Windows\System\cXjizaS.exe
  C:\Windows\System\cXjizaS.exe
  2⤵
  PID:13060
- C:\Windows\System\qtAqueC.exe
  C:\Windows\System\qtAqueC.exe
  2⤵
  PID:13252
- C:\Windows\System\IQaUllx.exe
  C:\Windows\System\IQaUllx.exe
  2⤵
  PID:12520
- C:\Windows\System\DqygNDP.exe
  C:\Windows\System\DqygNDP.exe
  2⤵
  PID:13384
- C:\Windows\System\ADNGpqK.exe
  C:\Windows\System\ADNGpqK.exe
  2⤵
  PID:13400
- C:\Windows\System\auXAjRB.exe
  C:\Windows\System\auXAjRB.exe
  2⤵
  PID:13416
- C:\Windows\System\wFoCYZl.exe
  C:\Windows\System\wFoCYZl.exe
  2⤵
  PID:13432
- C:\Windows\System\zjAaxCN.exe
  C:\Windows\System\zjAaxCN.exe
  2⤵
  PID:13448
- C:\Windows\System\kxRjpEd.exe
  C:\Windows\System\kxRjpEd.exe
  2⤵
  PID:13464
- C:\Windows\System\AXMrnbD.exe
  C:\Windows\System\AXMrnbD.exe
  2⤵
  PID:13480
- C:\Windows\System\pJtGLJg.exe
  C:\Windows\System\pJtGLJg.exe
  2⤵
  PID:13496
- C:\Windows\System\TmwpYUQ.exe
  C:\Windows\System\TmwpYUQ.exe
  2⤵
  PID:13512
- C:\Windows\System\IRemOwJ.exe
  C:\Windows\System\IRemOwJ.exe
  2⤵
  PID:13528
- C:\Windows\System\zwahGsP.exe
  C:\Windows\System\zwahGsP.exe
  2⤵
  PID:13544
- C:\Windows\System\NpxOxvW.exe
  C:\Windows\System\NpxOxvW.exe
  2⤵
  PID:13564
- C:\Windows\System\pIZqHYe.exe
  C:\Windows\System\pIZqHYe.exe
  2⤵
  PID:13588
- C:\Windows\System\bIwJBkQ.exe
  C:\Windows\System\bIwJBkQ.exe
  2⤵
  PID:13612
- C:\Windows\System\WIsiiMo.exe
  C:\Windows\System\WIsiiMo.exe
  2⤵
  PID:13628
- C:\Windows\System\QpCoZvk.exe
  C:\Windows\System\QpCoZvk.exe
  2⤵
  PID:13644
- C:\Windows\System\TmBdwJe.exe
  C:\Windows\System\TmBdwJe.exe
  2⤵
  PID:13660
- C:\Windows\System\cEyzHVg.exe
  C:\Windows\System\cEyzHVg.exe
  2⤵
  PID:13676
- C:\Windows\System\WPloFjS.exe
  C:\Windows\System\WPloFjS.exe
  2⤵
  PID:13704
- C:\Windows\System\eNxqlVp.exe
  C:\Windows\System\eNxqlVp.exe
  2⤵
  PID:13728
- C:\Windows\System\PpSwtnq.exe
  C:\Windows\System\PpSwtnq.exe
  2⤵
  PID:13756
- C:\Windows\System\nggwCZS.exe
  C:\Windows\System\nggwCZS.exe
  2⤵
  PID:13776
- C:\Windows\System\zjkIZku.exe
  C:\Windows\System\zjkIZku.exe
  2⤵
  PID:13804
- C:\Windows\System\lIpJViw.exe
  C:\Windows\System\lIpJViw.exe
  2⤵
  PID:13828
- C:\Windows\System\NEQNEue.exe
  C:\Windows\System\NEQNEue.exe
  2⤵
  PID:13844
- C:\Windows\System\rWrsRwA.exe
  C:\Windows\System\rWrsRwA.exe
  2⤵
  PID:13864
- C:\Windows\System\AKBQEIW.exe
  C:\Windows\System\AKBQEIW.exe
  2⤵
  PID:13880
- C:\Windows\System\vqKwYgZ.exe
  C:\Windows\System\vqKwYgZ.exe
  2⤵
  PID:13896
- C:\Windows\System\ZBPqPTT.exe
  C:\Windows\System\ZBPqPTT.exe
  2⤵
  PID:13920
- C:\Windows\System\rMvvgwN.exe
  C:\Windows\System\rMvvgwN.exe
  2⤵
  PID:13952
- C:\Windows\System\ihQjQGo.exe
  C:\Windows\System\ihQjQGo.exe
  2⤵
  PID:13984
- C:\Windows\System\nOSbkIZ.exe
  C:\Windows\System\nOSbkIZ.exe
  2⤵
  PID:14024
- C:\Windows\System\ERPHPMp.exe
  C:\Windows\System\ERPHPMp.exe
  2⤵
  PID:14040
- C:\Windows\System\LuIIOcI.exe
  C:\Windows\System\LuIIOcI.exe
  2⤵
  PID:14060
- C:\Windows\System\zstZQfm.exe
  C:\Windows\System\zstZQfm.exe
  2⤵
  PID:14084
- C:\Windows\System\TzfBiJe.exe
  C:\Windows\System\TzfBiJe.exe
  2⤵
  PID:14104
- C:\Windows\System\RVtEFzc.exe
  C:\Windows\System\RVtEFzc.exe
  2⤵
  PID:14120
- C:\Windows\System\JuHwnlI.exe
  C:\Windows\System\JuHwnlI.exe
  2⤵
  PID:14136
- C:\Windows\System\XuHYTRc.exe
  C:\Windows\System\XuHYTRc.exe
  2⤵
  PID:14152
- C:\Windows\System\RPKeVBU.exe
  C:\Windows\System\RPKeVBU.exe
  2⤵
  PID:14168
- C:\Windows\System\xDTvTQT.exe
  C:\Windows\System\xDTvTQT.exe
  2⤵
  PID:14184
- C:\Windows\System\gTqmAXB.exe
  C:\Windows\System\gTqmAXB.exe
  2⤵
  PID:14200
- C:\Windows\System\lyezjOR.exe
  C:\Windows\System\lyezjOR.exe
  2⤵
  PID:14228
- C:\Windows\System\oekzfmv.exe
  C:\Windows\System\oekzfmv.exe
  2⤵
  PID:14244
- C:\Windows\System\SjTKLQV.exe
  C:\Windows\System\SjTKLQV.exe
  2⤵
  PID:14260
- C:\Windows\System\SUuBEVP.exe
  C:\Windows\System\SUuBEVP.exe
  2⤵
  PID:14280
- C:\Windows\System\sPmOpTG.exe
  C:\Windows\System\sPmOpTG.exe
  2⤵
  PID:14296
- C:\Windows\System\BRJmVoZ.exe
  C:\Windows\System\BRJmVoZ.exe
  2⤵
  PID:14312
- C:\Windows\System\lWwBdkl.exe
  C:\Windows\System\lWwBdkl.exe
  2⤵
  PID:14332
- C:\Windows\System\BXIurbB.exe
  C:\Windows\System\BXIurbB.exe
  2⤵
  PID:13396
- C:\Windows\System\mcSttRN.exe
  C:\Windows\System\mcSttRN.exe
  2⤵
  PID:1180
- C:\Windows\System\VxpHxoa.exe
  C:\Windows\System\VxpHxoa.exe
  2⤵
  PID:2288
- C:\Windows\System\MxYOMfH.exe
  C:\Windows\System\MxYOMfH.exe
  2⤵
  PID:12924
- C:\Windows\System\FwSNyuU.exe
  C:\Windows\System\FwSNyuU.exe
  2⤵
  PID:13472
- C:\Windows\System\ChsSicM.exe
  C:\Windows\System\ChsSicM.exe
  2⤵
  PID:13300
- C:\Windows\System\hIwVNxn.exe
  C:\Windows\System\hIwVNxn.exe
  2⤵
  PID:13328
- C:\Windows\System\sBNLxWW.exe
  C:\Windows\System\sBNLxWW.exe
  2⤵
  PID:13344
- C:\Windows\System\ztojMMF.exe
  C:\Windows\System\ztojMMF.exe
  2⤵
  PID:13360
- C:\Windows\System\vwizrQx.exe
  C:\Windows\System\vwizrQx.exe
  2⤵
  PID:13376
- C:\Windows\System\oqejNSj.exe
  C:\Windows\System\oqejNSj.exe
  2⤵
  PID:13424
- C:\Windows\System\zptCRJw.exe
  C:\Windows\System\zptCRJw.exe
  2⤵
  PID:13456
- C:\Windows\System\qbDdxHs.exe
  C:\Windows\System\qbDdxHs.exe
  2⤵
  PID:13536
- C:\Windows\System\ksAVUuj.exe
  C:\Windows\System\ksAVUuj.exe
  2⤵
  PID:13620
- C:\Windows\System\kBvGuMQ.exe
  C:\Windows\System\kBvGuMQ.exe
  2⤵
  PID:13656
- C:\Windows\System\DOrcrMg.exe
  C:\Windows\System\DOrcrMg.exe
  2⤵
  PID:13692
- C:\Windows\System\mSneOob.exe
  C:\Windows\System\mSneOob.exe
  2⤵
  PID:13744
- C:\Windows\System\mzVXNjg.exe
  C:\Windows\System\mzVXNjg.exe
  2⤵
  PID:13788
- C:\Windows\System\adrbTCH.exe
  C:\Windows\System\adrbTCH.exe
  2⤵
  PID:13856
- C:\Windows\System\APYNIgw.exe
  C:\Windows\System\APYNIgw.exe
  2⤵
  PID:13888
- C:\Windows\System\UjblWXT.exe
  C:\Windows\System\UjblWXT.exe
  2⤵
  PID:13944
- C:\Windows\System\uTieIYI.exe
  C:\Windows\System\uTieIYI.exe
  2⤵
  PID:14016
- C:\Windows\System\IojNzoF.exe
  C:\Windows\System\IojNzoF.exe
  2⤵
  PID:14052
- C:\Windows\System\BLpHpDI.exe
  C:\Windows\System\BLpHpDI.exe
  2⤵
  PID:14112
- C:\Windows\System\wzmoNts.exe
  C:\Windows\System\wzmoNts.exe
  2⤵
  PID:14128
- C:\Windows\System\PrSoJEJ.exe
  C:\Windows\System\PrSoJEJ.exe
  2⤵
  PID:14160
- C:\Windows\System\auuCioZ.exe
  C:\Windows\System\auuCioZ.exe
  2⤵
  PID:14192
- C:\Windows\System\QNzdxjU.exe
  C:\Windows\System\QNzdxjU.exe
  2⤵
  PID:14220
- C:\Windows\System\bLvWnkm.exe
  C:\Windows\System\bLvWnkm.exe
  2⤵
  PID:14252
- C:\Windows\System\ukhYfMv.exe
  C:\Windows\System\ukhYfMv.exe
  2⤵
  PID:14288
- C:\Windows\System\duLxMKs.exe
  C:\Windows\System\duLxMKs.exe
  2⤵
  PID:14328
- C:\Windows\System\NnESegH.exe
  C:\Windows\System\NnESegH.exe
  2⤵
  PID:13556
- C:\Windows\System\fqppXWR.exe
  C:\Windows\System\fqppXWR.exe
  2⤵
  PID:6724
- C:\Windows\System\JCbZBwr.exe
  C:\Windows\System\JCbZBwr.exe
  2⤵
  PID:13136
- C:\Windows\System\jEzamVR.exe
  C:\Windows\System\jEzamVR.exe
  2⤵
  PID:13336
- C:\Windows\System\wHWdOYh.exe
  C:\Windows\System\wHWdOYh.exe
  2⤵
  PID:13488
- C:\Windows\System\tYzYcWY.exe
  C:\Windows\System\tYzYcWY.exe
  2⤵
  PID:13508
- C:\Windows\System\aGiNScm.exe
  C:\Windows\System\aGiNScm.exe
  2⤵
  PID:13640
- C:\Windows\System\DoydLEn.exe
  C:\Windows\System\DoydLEn.exe
  2⤵
  PID:13720
- C:\Windows\System\UBffVyl.exe
  C:\Windows\System\UBffVyl.exe
  2⤵
  PID:13820
- C:\Windows\System\xXZBkpP.exe
  C:\Windows\System\xXZBkpP.exe
  2⤵
  PID:13912
- C:\Windows\System\ccpOqtw.exe
  C:\Windows\System\ccpOqtw.exe
  2⤵
  PID:14036
- C:\Windows\System\eiNtBcN.exe
  C:\Windows\System\eiNtBcN.exe
  2⤵
  PID:14116
- C:\Windows\System\gydybcb.exe
  C:\Windows\System\gydybcb.exe
  2⤵
  PID:1608
- C:\Windows\System\yqKykLt.exe
  C:\Windows\System\yqKykLt.exe
  2⤵
  PID:14276
- C:\Windows\System\gTvvpOb.exe
  C:\Windows\System\gTvvpOb.exe
  2⤵
  PID:6660
- C:\Windows\System\tnrhDLq.exe
  C:\Windows\System\tnrhDLq.exe
  2⤵
  PID:13672
- C:\Windows\System\CjeUzVT.exe
  C:\Windows\System\CjeUzVT.exe
  2⤵
  PID:13368
- C:\Windows\System\VKCmmOh.exe
  C:\Windows\System\VKCmmOh.exe
  2⤵
  PID:13876
- C:\Windows\System\GmPwsFF.exe
  C:\Windows\System\GmPwsFF.exe
  2⤵
  PID:14308
- C:\Windows\System\wxklbEU.exe
  C:\Windows\System\wxklbEU.exe
  2⤵
  PID:14148
- C:\Windows\System\rFoTRgb.exe
  C:\Windows\System\rFoTRgb.exe
  2⤵
  PID:14180
- C:\Windows\System\xRviMzU.exe
  C:\Windows\System\xRviMzU.exe
  2⤵
  PID:2324
- C:\Windows\System\TRoTtQp.exe
  C:\Windows\System\TRoTtQp.exe
  2⤵
  PID:1292
- C:\Windows\System\TMLiSaR.exe
  C:\Windows\System\TMLiSaR.exe
  2⤵
  PID:3956
- C:\Windows\System\oDiAYUQ.exe
  C:\Windows\System\oDiAYUQ.exe
  2⤵
  PID:2768
- C:\Windows\System\urdsOUj.exe
  C:\Windows\System\urdsOUj.exe
  2⤵
  PID:13584
- C:\Windows\System\TDyxZHc.exe
  C:\Windows\System\TDyxZHc.exe
  2⤵
  PID:13524
- C:\Windows\System\TDwEyhG.exe
  C:\Windows\System\TDwEyhG.exe
  2⤵
  PID:13576
- C:\Windows\System\WWsDMKq.exe
  C:\Windows\System\WWsDMKq.exe
  2⤵
  PID:13980
- C:\Windows\System\goNCThG.exe
  C:\Windows\System\goNCThG.exe
  2⤵
  PID:3644
- C:\Windows\System\sFJpayV.exe
  C:\Windows\System\sFJpayV.exe
  2⤵
  PID:13492
- C:\Windows\System\JKiVUdt.exe
  C:\Windows\System\JKiVUdt.exe
  2⤵
  PID:1936
- C:\Windows\System\QvpSaFf.exe
  C:\Windows\System\QvpSaFf.exe
  2⤵
  PID:2112
- C:\Windows\System\TnsQOSB.exe
  C:\Windows\System\TnsQOSB.exe
  2⤵
  PID:12712
- C:\Windows\System\qdOVPqk.exe
  C:\Windows\System\qdOVPqk.exe
  2⤵
  PID:14032
- C:\Windows\System\HHvziAj.exe
  C:\Windows\System\HHvziAj.exe
  2⤵
  PID:12768
- C:\Windows\System\xzssLzt.exe
  C:\Windows\System\xzssLzt.exe
  2⤵
  PID:2860
- C:\Windows\System\IjoMLvR.exe
  C:\Windows\System\IjoMLvR.exe
  2⤵
  PID:4896
- C:\Windows\System\raprtsQ.exe
  C:\Windows\System\raprtsQ.exe
  2⤵
  PID:12332
- C:\Windows\System\wkfetCF.exe
  C:\Windows\System\wkfetCF.exe
  2⤵
  PID:13504
- C:\Windows\System\BvxbBVF.exe
  C:\Windows\System\BvxbBVF.exe
  2⤵
  PID:4644
- C:\Windows\System\JWPjpMK.exe
  C:\Windows\System\JWPjpMK.exe
  2⤵
  PID:13144
- C:\Windows\System\QYHSLAh.exe
  C:\Windows\System\QYHSLAh.exe
  2⤵
  PID:3308
- C:\Windows\System\YyZBUDl.exe
  C:\Windows\System\YyZBUDl.exe
  2⤵
  PID:14352
- C:\Windows\System\sUQuIyu.exe
  C:\Windows\System\sUQuIyu.exe
  2⤵
  PID:14368
- C:\Windows\System\BQOrSFn.exe
  C:\Windows\System\BQOrSFn.exe
  2⤵
  PID:14384
- C:\Windows\System\MjBbUjA.exe
  C:\Windows\System\MjBbUjA.exe
  2⤵
  PID:14400
- C:\Windows\System\tvVqeZe.exe
  C:\Windows\System\tvVqeZe.exe
  2⤵
  PID:14416
- C:\Windows\System\YmZmeip.exe
  C:\Windows\System\YmZmeip.exe
  2⤵
  PID:14432
- C:\Windows\System\GHCoOvd.exe
  C:\Windows\System\GHCoOvd.exe
  2⤵
  PID:14448
- C:\Windows\System\sXOnjre.exe
  C:\Windows\System\sXOnjre.exe
  2⤵
  PID:14464
- C:\Windows\System\aGxuRbU.exe
  C:\Windows\System\aGxuRbU.exe
  2⤵
  PID:14480
- C:\Windows\System\njYetkB.exe
  C:\Windows\System\njYetkB.exe
  2⤵
  PID:14496
- C:\Windows\System\ZHrTBqZ.exe
  C:\Windows\System\ZHrTBqZ.exe
  2⤵
  PID:14512
- C:\Windows\System\OYSKrJm.exe
  C:\Windows\System\OYSKrJm.exe
  2⤵
  PID:14528
- C:\Windows\System\FnHujJa.exe
  C:\Windows\System\FnHujJa.exe
  2⤵
  PID:14544
- C:\Windows\System\RcYfbMn.exe
  C:\Windows\System\RcYfbMn.exe
  2⤵
  PID:14560
- C:\Windows\System\CNPGsGJ.exe
  C:\Windows\System\CNPGsGJ.exe
  2⤵
  PID:14576
- C:\Windows\System\mrcWhKf.exe
  C:\Windows\System\mrcWhKf.exe
  2⤵
  PID:14592
- C:\Windows\System\LAXmPSm.exe
  C:\Windows\System\LAXmPSm.exe
  2⤵
  PID:14608
- C:\Windows\System\paudiWi.exe
  C:\Windows\System\paudiWi.exe
  2⤵
  PID:14624
- C:\Windows\System\oFafSCC.exe
  C:\Windows\System\oFafSCC.exe
  2⤵
  PID:14640
- C:\Windows\System\UYhEZlq.exe
  C:\Windows\System\UYhEZlq.exe
  2⤵
  PID:14656
- C:\Windows\System\teNPGma.exe
  C:\Windows\System\teNPGma.exe
  2⤵
  PID:14672
- C:\Windows\System\DwRrQwb.exe
  C:\Windows\System\DwRrQwb.exe
  2⤵
  PID:14688
- C:\Windows\System\fpDVBWr.exe
  C:\Windows\System\fpDVBWr.exe
  2⤵
  PID:14704
- C:\Windows\System\mbuqZim.exe
  C:\Windows\System\mbuqZim.exe
  2⤵
  PID:14720
- C:\Windows\System\SxIoIeA.exe
  C:\Windows\System\SxIoIeA.exe
  2⤵
  PID:14736
- C:\Windows\System\MMTKgwn.exe
  C:\Windows\System\MMTKgwn.exe
  2⤵
  PID:14752
- C:\Windows\System\fvcGUjm.exe
  C:\Windows\System\fvcGUjm.exe
  2⤵
  PID:14768
- C:\Windows\System\QnJWMGy.exe
  C:\Windows\System\QnJWMGy.exe
  2⤵
  PID:14784
- C:\Windows\System\tNaakFU.exe
  C:\Windows\System\tNaakFU.exe
  2⤵
  PID:14800
- C:\Windows\System\YrnPIaL.exe
  C:\Windows\System\YrnPIaL.exe
  2⤵
  PID:14816
- C:\Windows\System\mldHoJE.exe
  C:\Windows\System\mldHoJE.exe
  2⤵
  PID:14832
- C:\Windows\System\NMKFnyJ.exe
  C:\Windows\System\NMKFnyJ.exe
  2⤵
  PID:14848
- C:\Windows\System\vntPTHV.exe
  C:\Windows\System\vntPTHV.exe
  2⤵
  PID:14864
- C:\Windows\System\OjCLgSP.exe
  C:\Windows\System\OjCLgSP.exe
  2⤵
  PID:14880
- C:\Windows\System\KavUOBE.exe
  C:\Windows\System\KavUOBE.exe
  2⤵
  PID:14896
- C:\Windows\System\GbklMxJ.exe
  C:\Windows\System\GbklMxJ.exe
  2⤵
  PID:14912
- C:\Windows\System\orEkysU.exe
  C:\Windows\System\orEkysU.exe
  2⤵
  PID:14928
- C:\Windows\System\EOZZgTb.exe
  C:\Windows\System\EOZZgTb.exe
  2⤵
  PID:14944
- C:\Windows\System\HfzIYMv.exe
  C:\Windows\System\HfzIYMv.exe
  2⤵
  PID:14960
- C:\Windows\System\wGELMuh.exe
  C:\Windows\System\wGELMuh.exe
  2⤵
  PID:14976
- C:\Windows\System\CNMeDYp.exe
  C:\Windows\System\CNMeDYp.exe
  2⤵
  PID:14992
- C:\Windows\System\rKJXqia.exe
  C:\Windows\System\rKJXqia.exe
  2⤵
  PID:15008
- C:\Windows\System\lsIfrxI.exe
  C:\Windows\System\lsIfrxI.exe
  2⤵
  PID:15028
- C:\Windows\System\JdiPQFl.exe
  C:\Windows\System\JdiPQFl.exe
  2⤵
  PID:15044
- C:\Windows\System\ESqoIow.exe
  C:\Windows\System\ESqoIow.exe
  2⤵
  PID:15060
- C:\Windows\System\tpCTDxT.exe
  C:\Windows\System\tpCTDxT.exe
  2⤵
  PID:15076
- C:\Windows\System\eWpZysg.exe
  C:\Windows\System\eWpZysg.exe
  2⤵
  PID:15092
- C:\Windows\System\BJNRLCC.exe
  C:\Windows\System\BJNRLCC.exe
  2⤵
  PID:15108
- C:\Windows\System\PRQHHYX.exe
  C:\Windows\System\PRQHHYX.exe
  2⤵
  PID:15124
- C:\Windows\System\RnDtbZM.exe
  C:\Windows\System\RnDtbZM.exe
  2⤵
  PID:15140
- C:\Windows\System\ORwaTbO.exe
  C:\Windows\System\ORwaTbO.exe
  2⤵
  PID:15156
- C:\Windows\System\eeJpPQB.exe
  C:\Windows\System\eeJpPQB.exe
  2⤵
  PID:15172
- C:\Windows\System\uuDAsvQ.exe
  C:\Windows\System\uuDAsvQ.exe
  2⤵
  PID:15188
- C:\Windows\System\DHoLbmX.exe
  C:\Windows\System\DHoLbmX.exe
  2⤵
  PID:15204
- C:\Windows\System\tBuAcvR.exe
  C:\Windows\System\tBuAcvR.exe
  2⤵
  PID:15220
- C:\Windows\System\LcBaPZq.exe
  C:\Windows\System\LcBaPZq.exe
  2⤵
  PID:15236
- C:\Windows\System\VwGCsps.exe
  C:\Windows\System\VwGCsps.exe
  2⤵
  PID:15252
- C:\Windows\System\XsApMdx.exe
  C:\Windows\System\XsApMdx.exe
  2⤵
  PID:15268
- C:\Windows\System\CdNvDNs.exe
  C:\Windows\System\CdNvDNs.exe
  2⤵
  PID:15284
- C:\Windows\System\eNKEgyC.exe
  C:\Windows\System\eNKEgyC.exe
  2⤵
  PID:15300
- C:\Windows\System\qpsplvW.exe
  C:\Windows\System\qpsplvW.exe
  2⤵
  PID:15316
- C:\Windows\System\YktSARb.exe
  C:\Windows\System\YktSARb.exe
  2⤵
  PID:15332
- C:\Windows\System\HWQvhFi.exe
  C:\Windows\System\HWQvhFi.exe
  2⤵
  PID:15348
- C:\Windows\System\IztcUGs.exe
  C:\Windows\System\IztcUGs.exe
  2⤵
  PID:14348
- C:\Windows\System\HDOZKLC.exe
  C:\Windows\System\HDOZKLC.exe
  2⤵
  PID:14380
- C:\Windows\System\zMJcGxV.exe
  C:\Windows\System\zMJcGxV.exe
  2⤵
  PID:14412
- C:\Windows\System\PxUthUn.exe
  C:\Windows\System\PxUthUn.exe
  2⤵
  PID:14444
- C:\Windows\System\DFVmOha.exe
  C:\Windows\System\DFVmOha.exe
  2⤵
  PID:14476
- C:\Windows\System\RlIogFx.exe
  C:\Windows\System\RlIogFx.exe
  2⤵
  PID:14508
- C:\Windows\System\LnniZNe.exe
  C:\Windows\System\LnniZNe.exe
  2⤵
  PID:14540
- C:\Windows\System\YDuHtzi.exe
  C:\Windows\System\YDuHtzi.exe
  2⤵
  PID:14572
- C:\Windows\System\DtYoKpj.exe
  C:\Windows\System\DtYoKpj.exe
  2⤵
  PID:14604
- C:\Windows\System\OuzRLbo.exe
  C:\Windows\System\OuzRLbo.exe
  2⤵
  PID:14636
- C:\Windows\System\UjqeARe.exe
  C:\Windows\System\UjqeARe.exe
  2⤵
  PID:14668
- C:\Windows\System\UbYssKZ.exe
  C:\Windows\System\UbYssKZ.exe
  2⤵
  PID:14700
- C:\Windows\System\RFQQjxs.exe
  C:\Windows\System\RFQQjxs.exe
  2⤵
  PID:14732
- C:\Windows\System\dtRbJkJ.exe
  C:\Windows\System\dtRbJkJ.exe
  2⤵
  PID:14764
- C:\Windows\System\UOZMgGG.exe
  C:\Windows\System\UOZMgGG.exe
  2⤵
  PID:14792
- C:\Windows\System\YgfOHri.exe
  C:\Windows\System\YgfOHri.exe
  2⤵
  PID:14824
- C:\Windows\System\wGwxjMF.exe
  C:\Windows\System\wGwxjMF.exe
  2⤵
  PID:14856
- C:\Windows\System\vjyKtkN.exe
  C:\Windows\System\vjyKtkN.exe
  2⤵
  PID:14888
- C:\Windows\System\vTApFyk.exe
  C:\Windows\System\vTApFyk.exe
  2⤵
  PID:14920
- C:\Windows\System\HIoddER.exe
  C:\Windows\System\HIoddER.exe
  2⤵
  PID:14952
- C:\Windows\System\ZhsIezF.exe
  C:\Windows\System\ZhsIezF.exe
  2⤵
  PID:14984
- C:\Windows\System\sQBLxON.exe
  C:\Windows\System\sQBLxON.exe
  2⤵
  PID:15148
- C:\Windows\System\GCSDqtH.exe
  C:\Windows\System\GCSDqtH.exe
  2⤵
  PID:15180
- C:\Windows\System\AXeESWC.exe
  C:\Windows\System\AXeESWC.exe
  2⤵
  PID:15212
- C:\Windows\System\BaHsvAT.exe
  C:\Windows\System\BaHsvAT.exe
  2⤵
  PID:15244
- C:\Windows\System\YuEbmpg.exe
  C:\Windows\System\YuEbmpg.exe
  2⤵
  PID:15276
- C:\Windows\System\ZjgTSYx.exe
  C:\Windows\System\ZjgTSYx.exe
  2⤵
  PID:15308
- C:\Windows\System\PRnVUpO.exe
  C:\Windows\System\PRnVUpO.exe
  2⤵
  PID:15340
- C:\Windows\System\hiQrhXR.exe
  C:\Windows\System\hiQrhXR.exe
  2⤵
  PID:14376
- C:\Windows\System\czluSRo.exe
  C:\Windows\System\czluSRo.exe
  2⤵
  PID:14440
- C:\Windows\System\zoZnXwx.exe
  C:\Windows\System\zoZnXwx.exe
  2⤵
  PID:14504
- C:\Windows\System\MEnYTuU.exe
  C:\Windows\System\MEnYTuU.exe
  2⤵
  PID:14568
- C:\Windows\System\IFMprzd.exe
  C:\Windows\System\IFMprzd.exe
  2⤵
  PID:14620
- C:\Windows\System\dFGpFpN.exe
  C:\Windows\System\dFGpFpN.exe
  2⤵
  PID:14664
- C:\Windows\System\bFTMBwY.exe
  C:\Windows\System\bFTMBwY.exe
  2⤵
  PID:14728
- C:\Windows\System\hbamfbA.exe
  C:\Windows\System\hbamfbA.exe
  2⤵
  PID:536
- C:\Windows\System\TyTNRXy.exe
  C:\Windows\System\TyTNRXy.exe
  2⤵
  PID:14840
- C:\Windows\System\bANjCKZ.exe
  C:\Windows\System\bANjCKZ.exe
  2⤵
  PID:14876
- C:\Windows\System\HdrjJVT.exe
  C:\Windows\System\HdrjJVT.exe
  2⤵
  PID:14936
- C:\Windows\System\KYUoanP.exe
  C:\Windows\System\KYUoanP.exe
  2⤵
  PID:15000
- C:\Windows\System\LIgKRpc.exe
  C:\Windows\System\LIgKRpc.exe
  2⤵
  PID:15052
- C:\Windows\System\sszgojw.exe
  C:\Windows\System\sszgojw.exe
  2⤵
  PID:15104
- C:\Windows\System\QmbRvPP.exe
  C:\Windows\System\QmbRvPP.exe
  2⤵
  PID:15024
- C:\Windows\System\GObEocQ.exe
  C:\Windows\System\GObEocQ.exe
  2⤵
  PID:15116
- C:\Windows\System\JHvhBTR.exe
  C:\Windows\System\JHvhBTR.exe
  2⤵
  PID:15164
- C:\Windows\System\zZsXrJu.exe
  C:\Windows\System\zZsXrJu.exe
  2⤵
  PID:15260
- C:\Windows\System\KbIhDiU.exe
  C:\Windows\System\KbIhDiU.exe
  2⤵
  PID:15324
- C:\Windows\System\qqDzYaq.exe
  C:\Windows\System\qqDzYaq.exe
  2⤵
  PID:14408
- C:\Windows\System\MSLhwfF.exe
  C:\Windows\System\MSLhwfF.exe
  2⤵
  PID:14536
- C:\Windows\System\zFRQNeg.exe
  C:\Windows\System\zFRQNeg.exe
  2⤵
  PID:1084
- C:\Windows\System\VHLVBze.exe
  C:\Windows\System\VHLVBze.exe
  2⤵
  PID:14760
- C:\Windows\System\ikYpUjf.exe
  C:\Windows\System\ikYpUjf.exe
  2⤵
  PID:1388
- C:\Windows\System\mDnsZpG.exe
  C:\Windows\System\mDnsZpG.exe
  2⤵
  PID:14908
- C:\Windows\System\aBINaQl.exe
  C:\Windows\System\aBINaQl.exe
  2⤵
  PID:15056
- C:\Windows\System\SnqCafW.exe
  C:\Windows\System\SnqCafW.exe
  2⤵
  PID:15004
- C:\Windows\System\wctLICU.exe
  C:\Windows\System\wctLICU.exe
  2⤵
  PID:15196
- C:\Windows\System\IlpuETp.exe
  C:\Windows\System\IlpuETp.exe
  2⤵
  PID:15292
- C:\Windows\System\EQcjPjN.exe
  C:\Windows\System\EQcjPjN.exe
  2⤵
  PID:14472
- C:\Windows\System\aTJsRYs.exe
  C:\Windows\System\aTJsRYs.exe
  2⤵
  PID:14696
- C:\Windows\System\qABtJJW.exe
  C:\Windows\System\qABtJJW.exe
  2⤵
  PID:14872
- C:\Windows\System\vQswkGW.exe
  C:\Windows\System\vQswkGW.exe
  2⤵
  PID:15084
- C:\Windows\System\JJDRrMV.exe
  C:\Windows\System\JJDRrMV.exe
  2⤵
  PID:15232
- C:\Windows\System\pAKgHor.exe
  C:\Windows\System\pAKgHor.exe
  2⤵
  PID:14588
- C:\Windows\System\miOcqES.exe
  C:\Windows\System\miOcqES.exe
  2⤵
  PID:14968
- C:\Windows\System\jWwCpXv.exe
  C:\Windows\System\jWwCpXv.exe
  2⤵
  PID:14344
- C:\Windows\System\NbNezIS.exe
  C:\Windows\System\NbNezIS.exe
  2⤵
  PID:15036
- C:\Windows\System\yIpSVph.exe
  C:\Windows\System\yIpSVph.exe
  2⤵
  PID:14808
- C:\Windows\System\dbrcKAq.exe
  C:\Windows\System\dbrcKAq.exe
  2⤵
  PID:15372
- C:\Windows\System\sPQgqDn.exe
  C:\Windows\System\sPQgqDn.exe
  2⤵
  PID:15388
- C:\Windows\System\SLrAXmZ.exe
  C:\Windows\System\SLrAXmZ.exe
  2⤵
  PID:15404
- C:\Windows\System\KBKtLzG.exe
  C:\Windows\System\KBKtLzG.exe
  2⤵
  PID:15420
- C:\Windows\System\eYUPHZP.exe
  C:\Windows\System\eYUPHZP.exe
  2⤵
  PID:15436
- C:\Windows\System\aXpLVGG.exe
  C:\Windows\System\aXpLVGG.exe
  2⤵
  PID:15452
- C:\Windows\System\qfSVugV.exe
  C:\Windows\System\qfSVugV.exe
  2⤵
  PID:15468
- C:\Windows\System\pLIHxvt.exe
  C:\Windows\System\pLIHxvt.exe
  2⤵
  PID:15484
- C:\Windows\System\nOvYvgD.exe
  C:\Windows\System\nOvYvgD.exe
  2⤵
  PID:15500
- C:\Windows\System\zGMfOyI.exe
  C:\Windows\System\zGMfOyI.exe
  2⤵
  PID:15516
- C:\Windows\System\umssKGS.exe
  C:\Windows\System\umssKGS.exe
  2⤵
  PID:15532
- C:\Windows\System\kYFmeJs.exe
  C:\Windows\System\kYFmeJs.exe
  2⤵
  PID:15548
- C:\Windows\System\VbobQmY.exe
  C:\Windows\System\VbobQmY.exe
  2⤵
  PID:15564
- C:\Windows\System\rReTngg.exe
  C:\Windows\System\rReTngg.exe
  2⤵
  PID:15580
- C:\Windows\System\JHgZDXu.exe
  C:\Windows\System\JHgZDXu.exe
  2⤵
  PID:15596
- C:\Windows\System\PllWbtJ.exe
  C:\Windows\System\PllWbtJ.exe
  2⤵
  PID:15612
- C:\Windows\System\gbHQFcv.exe
  C:\Windows\System\gbHQFcv.exe
  2⤵
  PID:15632
- C:\Windows\System\ZmTujGw.exe
  C:\Windows\System\ZmTujGw.exe
  2⤵
  PID:15648
- C:\Windows\System\ePrcoWT.exe
  C:\Windows\System\ePrcoWT.exe
  2⤵
  PID:15664
- C:\Windows\System\LzDgaUf.exe
  C:\Windows\System\LzDgaUf.exe
  2⤵
  PID:15680
- C:\Windows\System\vvtGXJm.exe
  C:\Windows\System\vvtGXJm.exe
  2⤵
  PID:15696
- C:\Windows\System\MdzQhIV.exe
  C:\Windows\System\MdzQhIV.exe
  2⤵
  PID:15712
- C:\Windows\System\YluCKgL.exe
  C:\Windows\System\YluCKgL.exe
  2⤵
  PID:15728
- C:\Windows\System\PEurlqW.exe
  C:\Windows\System\PEurlqW.exe
  2⤵
  PID:15744
- C:\Windows\System\aDlwZXS.exe
  C:\Windows\System\aDlwZXS.exe
  2⤵
  PID:15760
- C:\Windows\System\lBzpNRc.exe
  C:\Windows\System\lBzpNRc.exe
  2⤵
  PID:15776
- C:\Windows\System\EjuBaAV.exe
  C:\Windows\System\EjuBaAV.exe
  2⤵
  PID:15792
- C:\Windows\System\rpBsxJa.exe
  C:\Windows\System\rpBsxJa.exe
  2⤵
  PID:15808
- C:\Windows\System\SuwuOVP.exe
  C:\Windows\System\SuwuOVP.exe
  2⤵
  PID:15824
- C:\Windows\System\XNMKEaQ.exe
  C:\Windows\System\XNMKEaQ.exe
  2⤵
  PID:15840
- C:\Windows\System\ZVMQivx.exe
  C:\Windows\System\ZVMQivx.exe
  2⤵
  PID:15856
- C:\Windows\System\HEWFtXg.exe
  C:\Windows\System\HEWFtXg.exe
  2⤵
  PID:15872
- C:\Windows\System\wrhEYaE.exe
  C:\Windows\System\wrhEYaE.exe
  2⤵
  PID:15888
- C:\Windows\System\GKgJOYD.exe
  C:\Windows\System\GKgJOYD.exe
  2⤵
  PID:15904
- C:\Windows\System\UPsSaHy.exe
  C:\Windows\System\UPsSaHy.exe
  2⤵
  PID:15920
- C:\Windows\System\BArWURh.exe
  C:\Windows\System\BArWURh.exe
  2⤵
  PID:15936
- C:\Windows\System\DxzkUUB.exe
  C:\Windows\System\DxzkUUB.exe
  2⤵
  PID:15952
- C:\Windows\System\EpYpfEA.exe
  C:\Windows\System\EpYpfEA.exe
  2⤵
  PID:15968
- C:\Windows\System\UegETyI.exe
  C:\Windows\System\UegETyI.exe
  2⤵
  PID:15984
- C:\Windows\System\HbgPeWz.exe
  C:\Windows\System\HbgPeWz.exe
  2⤵
  PID:16000
- C:\Windows\System\TkWQiTg.exe
  C:\Windows\System\TkWQiTg.exe
  2⤵
  PID:16016
- C:\Windows\System\ebdQBiu.exe
  C:\Windows\System\ebdQBiu.exe
  2⤵
  PID:16032
- C:\Windows\System\mlLopNM.exe
  C:\Windows\System\mlLopNM.exe
  2⤵
  PID:16048
- C:\Windows\System\qpjwrFC.exe
  C:\Windows\System\qpjwrFC.exe
  2⤵
  PID:16064
- C:\Windows\System\pIfbnev.exe
  C:\Windows\System\pIfbnev.exe
  2⤵
  PID:16080
- C:\Windows\System\JCInTWw.exe
  C:\Windows\System\JCInTWw.exe
  2⤵
  PID:16096
- C:\Windows\System\tuDJuiu.exe
  C:\Windows\System\tuDJuiu.exe
  2⤵
  PID:16112
- C:\Windows\System\dlJXnqj.exe
  C:\Windows\System\dlJXnqj.exe
  2⤵
  PID:16128
- C:\Windows\System\TzQDJQB.exe
  C:\Windows\System\TzQDJQB.exe
  2⤵
  PID:16144
- C:\Windows\System\LQAYfcL.exe
  C:\Windows\System\LQAYfcL.exe
  2⤵
  PID:16160
- C:\Windows\System\YhbLujs.exe
  C:\Windows\System\YhbLujs.exe
  2⤵
  PID:16176
- C:\Windows\System\bKjCmQD.exe
  C:\Windows\System\bKjCmQD.exe
  2⤵
  PID:16192
- C:\Windows\System\RAyUoqv.exe
  C:\Windows\System\RAyUoqv.exe
  2⤵
  PID:16208
- C:\Windows\System\ATbohPS.exe
  C:\Windows\System\ATbohPS.exe
  2⤵
  PID:16224
- C:\Windows\System\GgZREXQ.exe
  C:\Windows\System\GgZREXQ.exe
  2⤵
  PID:16240
- C:\Windows\System\ZegxRGA.exe
  C:\Windows\System\ZegxRGA.exe
  2⤵
  PID:16256
- C:\Windows\System\lvjZPmP.exe
  C:\Windows\System\lvjZPmP.exe
  2⤵
  PID:16272
- C:\Windows\System\zRcKJTW.exe
  C:\Windows\System\zRcKJTW.exe
  2⤵
  PID:16288
- C:\Windows\System\hYeexsp.exe
  C:\Windows\System\hYeexsp.exe
  2⤵
  PID:16304
- C:\Windows\System\DgYnHVX.exe
  C:\Windows\System\DgYnHVX.exe
  2⤵
  PID:16320
- C:\Windows\System\ZLkrfSs.exe
  C:\Windows\System\ZLkrfSs.exe
  2⤵
  PID:16336
- C:\Windows\System\YnZCngE.exe
  C:\Windows\System\YnZCngE.exe
  2⤵
  PID:16352
- C:\Windows\System\qiATdeg.exe
  C:\Windows\System\qiATdeg.exe
  2⤵
  PID:16368
- C:\Windows\System\govScVI.exe
  C:\Windows\System\govScVI.exe
  2⤵
  PID:15364
- C:\Windows\System\OGlwOLl.exe
  C:\Windows\System\OGlwOLl.exe
  2⤵
  PID:15396
- C:\Windows\System\RMYwHJY.exe
  C:\Windows\System\RMYwHJY.exe
  2⤵
  PID:15416
- C:\Windows\System\KnfSENI.exe
  C:\Windows\System\KnfSENI.exe
  2⤵
  PID:15448
- C:\Windows\System\EZasXWN.exe
  C:\Windows\System\EZasXWN.exe
  2⤵
  PID:15480
- C:\Windows\System\dKmbEfp.exe
  C:\Windows\System\dKmbEfp.exe
  2⤵
  PID:15508
- C:\Windows\System\gsjYWOp.exe
  C:\Windows\System\gsjYWOp.exe
  2⤵
  PID:15540
- C:\Windows\System\wmFQxwp.exe
  C:\Windows\System\wmFQxwp.exe
  2⤵
  PID:15572
- C:\Windows\System\BuzeVZi.exe
  C:\Windows\System\BuzeVZi.exe
  2⤵
  PID:15604
- C:\Windows\System\EtmNSJg.exe
  C:\Windows\System\EtmNSJg.exe
  2⤵
  PID:15640
- C:\Windows\System\gYbDYYG.exe
  C:\Windows\System\gYbDYYG.exe
  2⤵
  PID:15672
- C:\Windows\System\LaBKbDL.exe
  C:\Windows\System\LaBKbDL.exe
  2⤵
  PID:15708
- C:\Windows\System\elRHNsZ.exe
  C:\Windows\System\elRHNsZ.exe
  2⤵
  PID:15736
- C:\Windows\System\eERAVVP.exe
  C:\Windows\System\eERAVVP.exe
  2⤵
  PID:15768
- C:\Windows\System\HiENyto.exe
  C:\Windows\System\HiENyto.exe
  2⤵
  PID:15800
- C:\Windows\System\juGPWWa.exe
  C:\Windows\System\juGPWWa.exe
  2⤵
  PID:15832
- C:\Windows\System\SPijVll.exe
  C:\Windows\System\SPijVll.exe
  2⤵
  PID:15864
- C:\Windows\System\PUZwcjk.exe
  C:\Windows\System\PUZwcjk.exe
  2⤵
  PID:15896
- C:\Windows\System\EMXBVKR.exe
  C:\Windows\System\EMXBVKR.exe
  2⤵
  PID:15928
- C:\Windows\System\vZWVALH.exe
  C:\Windows\System\vZWVALH.exe
  2⤵
  PID:5784
- C:\Windows\System\ULoPvDK.exe
  C:\Windows\System\ULoPvDK.exe
  2⤵
  PID:15980
- C:\Windows\System\LMlabSd.exe
  C:\Windows\System\LMlabSd.exe
  2⤵
  PID:16012
- C:\Windows\System\VHTjtIx.exe
  C:\Windows\System\VHTjtIx.exe
  2⤵
  PID:16044
- C:\Windows\System\wBCgqNi.exe
  C:\Windows\System\wBCgqNi.exe
  2⤵
  PID:16076
- C:\Windows\System\CeqlHbM.exe
  C:\Windows\System\CeqlHbM.exe
  2⤵
  PID:16108
- C:\Windows\System\nsPnXSl.exe
  C:\Windows\System\nsPnXSl.exe
  2⤵
  PID:16140
- C:\Windows\System\aNgsMOW.exe
  C:\Windows\System\aNgsMOW.exe
  2⤵
  PID:16172
- C:\Windows\System\eNPzmEh.exe
  C:\Windows\System\eNPzmEh.exe
  2⤵
  PID:16204
- C:\Windows\System\TRelYPK.exe
  C:\Windows\System\TRelYPK.exe
  2⤵
  PID:16236
- C:\Windows\System\qVTvtWb.exe
  C:\Windows\System\qVTvtWb.exe
  2⤵
  PID:16268
- C:\Windows\System\QkVXCWq.exe
  C:\Windows\System\QkVXCWq.exe
  2⤵
  PID:16296
- C:\Windows\System\yeodzpl.exe
  C:\Windows\System\yeodzpl.exe
  2⤵
  PID:16328
- C:\Windows\System\bQDRMJX.exe
  C:\Windows\System\bQDRMJX.exe
  2⤵
  PID:16360
- C:\Windows\System\LdxCGxp.exe
  C:\Windows\System\LdxCGxp.exe
  2⤵
  PID:15384
- C:\Windows\System\pKfgLLc.exe
  C:\Windows\System\pKfgLLc.exe
  2⤵
  PID:15432
- C:\Windows\System\ccEUUcm.exe
  C:\Windows\System\ccEUUcm.exe
  2⤵
  PID:15496
- C:\Windows\System\reLpYLS.exe
  C:\Windows\System\reLpYLS.exe
  2⤵
  PID:5392
- C:\Windows\System\lvEqkbX.exe
  C:\Windows\System\lvEqkbX.exe
  2⤵
  PID:15592
- C:\Windows\System\rtYATnu.exe
  C:\Windows\System\rtYATnu.exe
  2⤵
  PID:15660
- C:\Windows\System\dtWlanc.exe
  C:\Windows\System\dtWlanc.exe
  2⤵
  PID:15724
- C:\Windows\System\kRMSvIm.exe
  C:\Windows\System\kRMSvIm.exe
  2⤵
  PID:14092
- C:\Windows\System\jgBwKKG.exe
  C:\Windows\System\jgBwKKG.exe
  2⤵
  PID:15820
- C:\Windows\System\FzCoszG.exe
  C:\Windows\System\FzCoszG.exe
  2⤵
  PID:15884
- C:\Windows\System\gkScIqI.exe
  C:\Windows\System\gkScIqI.exe
  2⤵
  PID:15948
- C:\Windows\System\hNdjkLn.exe
  C:\Windows\System\hNdjkLn.exe
  2⤵
  PID:16008
- C:\Windows\System\mraZach.exe
  C:\Windows\System\mraZach.exe
  2⤵
  PID:16072
- C:\Windows\System\lQqpHKd.exe
  C:\Windows\System\lQqpHKd.exe
  2⤵
  PID:16136
- C:\Windows\System\jTDDKbc.exe
  C:\Windows\System\jTDDKbc.exe
  2⤵
  PID:16200
- C:\Windows\System\uYgmdzw.exe
  C:\Windows\System\uYgmdzw.exe
  2⤵
  PID:16232
- C:\Windows\System\vkotvTx.exe
  C:\Windows\System\vkotvTx.exe
  2⤵
  PID:16284
- C:\Windows\System\gyjZRuj.exe
  C:\Windows\System\gyjZRuj.exe
  2⤵
  PID:16348
- C:\Windows\System\BkiALPR.exe
  C:\Windows\System\BkiALPR.exe
  2⤵
  PID:15356
- C:\Windows\System\zTshYKj.exe
  C:\Windows\System\zTshYKj.exe
  2⤵
  PID:15524
- C:\Windows\System\QGmfEVT.exe
  C:\Windows\System\QGmfEVT.exe
  2⤵
  PID:15692
- C:\Windows\System\jwdQPYR.exe
  C:\Windows\System\jwdQPYR.exe
  2⤵
  PID:15788
- C:\Windows\System\ZwJNrWH.exe
  C:\Windows\System\ZwJNrWH.exe
  2⤵
  PID:15916
- C:\Windows\System\YCRIBSP.exe
  C:\Windows\System\YCRIBSP.exe
  2⤵
  PID:16040
- C:\Windows\System\OJBImLL.exe
  C:\Windows\System\OJBImLL.exe
  2⤵
  PID:15528
- C:\Windows\System\RLCWWnf.exe
  C:\Windows\System\RLCWWnf.exe
  2⤵
  PID:16220
- C:\Windows\System\JKdeoco.exe
  C:\Windows\System\JKdeoco.exe
  2⤵
  PID:16344
- C:\Windows\System\AwbGADm.exe
  C:\Windows\System\AwbGADm.exe
  2⤵
  PID:2164
- C:\Windows\System\BIMwjTl.exe
  C:\Windows\System\BIMwjTl.exe
  2⤵
  PID:15752
- C:\Windows\System\BzRrean.exe
  C:\Windows\System\BzRrean.exe
  2⤵
  PID:15976
- C:\Windows\System\kCOYXvX.exe
  C:\Windows\System\kCOYXvX.exe
  2⤵
  PID:16188
- C:\Windows\System\woXwTAI.exe
  C:\Windows\System\woXwTAI.exe
  2⤵
  PID:15380
- C:\Windows\System\awjEnHt.exe
  C:\Windows\System\awjEnHt.exe
  2⤵
  PID:15852
- C:\Windows\System\GJhBHmW.exe
  C:\Windows\System\GJhBHmW.exe
  2⤵
  PID:15624
- C:\Windows\System\GCzUyZR.exe
  C:\Windows\System\GCzUyZR.exe
  2⤵
  PID:16092
- C:\Windows\System\poCrspC.exe
  C:\Windows\System\poCrspC.exe
  2⤵
  PID:15628
- C:\Windows\System\iEyQNbH.exe
  C:\Windows\System\iEyQNbH.exe
  2⤵
  PID:16396
- C:\Windows\System\VrRNVZX.exe
  C:\Windows\System\VrRNVZX.exe
  2⤵
  PID:16412
- C:\Windows\System\rRvYbHV.exe
  C:\Windows\System\rRvYbHV.exe
  2⤵
  PID:16428
- C:\Windows\System\KSjvQyQ.exe
  C:\Windows\System\KSjvQyQ.exe
  2⤵
  PID:16444
- C:\Windows\System\IqJEeKf.exe
  C:\Windows\System\IqJEeKf.exe
  2⤵
  PID:16460
- C:\Windows\System\jaxEEER.exe
  C:\Windows\System\jaxEEER.exe
  2⤵
  PID:16476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1fsmfgzj.qrv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BdMfAXb.exe

Filesize
1.8MB

MD5
7d1c01c2eccac9bff787f0d86566e9f2

SHA1
83b23fcafdaee7f53127cb1e26aeb327d4db5160

SHA256
139231711308911a1003ec8681dec7b2d7a67deadd59406c38dda9eacac0e1d8

SHA512
0a4052e21cfab0bf1c729d353466280af6af977df87f787c0a774f47094a68fc1e419908f278e8810c16654588f9ac4924edcf78c3104301c448cb1a9e315bd4

Download Submit
C:\Windows\System\CMQBBtq.exe

Filesize
1.8MB

MD5
7d15b56335494e843f7abfb3b3d79115

SHA1
8b42d88ff9e6e9cda03aa801d2de9fb663b3d170

SHA256
8d2abe1531a99477f3437cb3fc5b3e44de964006ef4dbe0e53d5127dc37eb0b7

SHA512
30dbbb34ef5b4b202bdd376fd85ed571ac39a2e90f078f1dba076ba5867a61304949a71e3ab616c8c86101c71f4adcdbbf81e20cbc97f5a63ddde9a7618941b2

Download Submit
C:\Windows\System\CWgoegN.exe

Filesize
1.8MB

MD5
a1e9adc024b8dff4cd49d7734d89215c

SHA1
be1b70e0978bacc2e6441e372134c5b2b900b0d9

SHA256
6f5d50751c8e020f65349c23af66444f284500878be0b70a1be3b11393da5fd2

SHA512
8f6e4b273329d352040cf851f2147406ef032f3deae2a97cca0cd00c271cdbe5800fba9f22c35722c5a2a2fa31c97f194ad0c8d7de10344396de1f22a3347b7f

Download Submit
C:\Windows\System\DybuccN.exe

Filesize
1.8MB

MD5
abee05d4b077b359cc33a0933d6c3fe8

SHA1
5fa3b142226b47a432bf5b96d6846b6609461219

SHA256
b0acf093434c9db0af8695de1485a5e58eb3f2890a63245c6ca9e0aa888cac69

SHA512
a0e2d49655ba8a6a06388fc77ca8b4f2df1913425f2e8c2ed9b837057479f6f09541f9f1e9d7e47ede8c938a3d168ec68536d9741d7e2d817fd263d2aa9b77e0

Download Submit
C:\Windows\System\GSmgWZc.exe

Filesize
1.8MB

MD5
58f4a4cb00d691f7db28e64a3c5b969c

SHA1
34fc08201ed80aaea06efea5a8974bf34036ab1a

SHA256
a054d910c2cd109e7da79df0cebd84da5a32d74b2a2057e4c3289688cbf23fcd

SHA512
b19f6ec815680437d58a129c59c3bc8d12b4503901fc1250e0c6d4f99cb5581884bd0f8091fc450cdcde8fbb93b05bcc661e16bc3e52ff7f356fa1d164583611

Download Submit
C:\Windows\System\LjyMcaA.exe

Filesize
1.8MB

MD5
830dc166b8e632c8be37ad593fbb48de

SHA1
52a855057f6de6de89e13318eb4942e01abd6629

SHA256
36e4481b719ea7db1338213fd38a7e29634acfcec669fa24bc9367dc37a8da71

SHA512
0078b2acce49294f1c36ade62de58337d29209f7d4db7ae9b4d847783132928f4cf15c3bbf7b28b73c596117aef93007a58a24a9500a8c1eb91af5ab5726b976

Download Submit
C:\Windows\System\MsEwqoF.exe

Filesize
1.8MB

MD5
f36fc44c91c7e7bf7fb2d08a042a852c

SHA1
7655b9655906da6786fb1f2e6022c68c8cb9d952

SHA256
4f88a10c58b8a44a0d1304d3882c8d88e3d3acafe02ef36960ac55513671dc8d

SHA512
16e05dbaff5a386e91c3d852806718cc84d80b56d09b60e866df5652c44fb5b38452101190c8e0446479fca463124d5c9132d42fca9031528bcce48e120fa065

Download Submit
C:\Windows\System\NGoLcNI.exe

Filesize
1.8MB

MD5
a43946295690482127b3c00ed18744c1

SHA1
3a79fb9b279a76a63e7538970eb1adaa66c6172a

SHA256
c043d36b7edc0a0664506e604c4dc40f03bde2fcb461dc760ab883543e833acf

SHA512
a51ee9e57ea34350e4e07f8b4e6526bcb3b1fc6f3d1e208a30ec1d3221a54daa358055892d5fad43f6ca520c3f4958bbad6afec36946c407e2888a9ad8c891e5

Download Submit
C:\Windows\System\NlKFSvc.exe

Filesize
1.8MB

MD5
a234393babc7c890214bd6a78246d42c

SHA1
6a4044e1e5b8d4553a1573e4fa519fa7f4ab12fd

SHA256
c79fcbbd8c64222725b87832ecd98a65731491c4742f10147b84a36dea173687

SHA512
17430489cc45f69b39ce60eb62e37d819d978c0d2c343ee8cb323c503f2905d07bc50fd3c72225e21118fc8a4921ece48f228464c899316119606ab4f1811064

Download Submit
C:\Windows\System\OSCPmlz.exe

Filesize
1.8MB

MD5
5dc391bdd2d65e4c051e6ae88e88b7a4

SHA1
8f8fbd557d7ca80385d8dfbdb67b54f6c41601ec

SHA256
d0d1e7012dc0755518cdc6c6295ef741338120f475d7dcea7e7e598cd7955a4a

SHA512
78aaab58748ba618df9eeaf214a697d81f8969da618fcfad059ed8337202ba92da697c470a8bc79868cc2ea453b73da280b3532660d746262660fa9c03e843a8

Download Submit
C:\Windows\System\RuLamFt.exe

Filesize
1.8MB

MD5
1a5272a383c48d888e86752c807a342a

SHA1
5bf42e62fdd8cba7ad36c022ea37fd4a28b2fa9d

SHA256
e57d76380f55478a2fe3565bdab4e39fcec911892460617970e1990f6ee13ab6

SHA512
b1a7dcd15f5982c7cafbab64a49cdf9faa45e104e0c9c7cc6e6bffb115729a2397a2bd4c7bc8c729a92a6bc3ce0253a0f5246278605ba7b90e5af058994514af

Download Submit
C:\Windows\System\THJsFDM.exe

Filesize
1.8MB

MD5
5b3d40691098ec2153ff69a829d1dee5

SHA1
488ce348660f5bee69e9ce337b6ee25e44243627

SHA256
e58d170fba3c67a8439cf478ca934075bf12777c484a15b92e2bea89d8a0d5ca

SHA512
5a4a3c28891b2007807d9ec197beb2e30863129a3f7806ab41b341d16a5da9343b9db2d8d9499be14c04522bdcf8497a61c5033a0496fddda4c639c88ec5cb07

Download Submit
C:\Windows\System\VLOQrUp.exe

Filesize
1.8MB

MD5
cced486f8e19dd9c96b80368f9172280

SHA1
19fc2eedac5dca25194525fcdbf19880d411d5c7

SHA256
0224dcc6eadabd33172ccd2b2444bbcbb8e0a93e82f86ef206b5a93a968f85a5

SHA512
64b0e01f71497ec9c704faec25a10df458bb00904f5d00cc46516c5db9ad139e940717b0a034bb69155e02e393e78eb49e0c0c1ebdf9b78a92d3550d8b242421

Download Submit
C:\Windows\System\YTXjBht.exe

Filesize
1.8MB

MD5
3b050f3615170b2fa165f1daea664699

SHA1
0050feddb854512a8b4ee12a44f0de5a57f0327d

SHA256
97c31682bf1599f5bf39f70f958ea4df9dadd843932e0abbe542bbdb1cdfdbfa

SHA512
2d908d6d72f00c62efef9481dcb27d913cc69a29a91a8c4f41425b7d374c0f9ab29bedd4961df95043ae1802767f79b15ebb847f6cf435fe2bea1bffc7b19268

Download Submit
C:\Windows\System\bXuppPl.exe

Filesize
1.8MB

MD5
2dbd4b8b06a193ac285660f78ed4ec6e

SHA1
d5b44be199bcc6b15beed047c33e9f1c82e24128

SHA256
dc4970babf58809f6debc01efcd0ceba5349d7e32f2f40846f77ee60500e7f89

SHA512
42b3f310c4f5dafabd6ec5d23263006a24225f8ceab18038a29184462fe680da2e4ea04e8451313e6615a53dd41d6be33aa453ff0e5fec129831614cbe6fa1b5

Download Submit
C:\Windows\System\fMQbUVS.exe

Filesize
1.8MB

MD5
1cd5224888371e3788a1b0c0c00fd952

SHA1
a4b2b13636c2f0d949638954d1a2aecab04b98ae

SHA256
6e6ea03c97ce07f8881415127781b9f61ca5eba0fcafd9cfcc23e31c3a657e8a

SHA512
192e4db47cad6ad3fccaf057bac6d7a90ee9d634b8aca98a45aa031fd078352cc7f7546d132b30aea6548303b022cb8602507b42cf72704a8922dd329aebe57d

Download Submit
C:\Windows\System\faWQfyx.exe

Filesize
1.8MB

MD5
e60b74c53bb486c4cdeca599b3fca766

SHA1
971a64aaa6f44268cb90749cff48b7349dea4afa

SHA256
2478d2b12a55eebf85eaca7494472ee1203de716e4fa2f0d49e5356f95bc8075

SHA512
828c4b32892730c528ff386dfbe534ceab0b1bc999d652b7d94f1f86de1092eab76f84614f80119677f1b792b167666f032defd9a11919559322d63bdfc6a39d

Download Submit
C:\Windows\System\ltPUVzP.exe

Filesize
1.8MB

MD5
747a502a0e0b09925f9081dfbcf1bd40

SHA1
dcf301b13beca3e13a3c62e00ef733ee0a300e74

SHA256
5dd1231ce5daad83035d64af83d782a44c6e5c529b07d8d9993be58d4cd82858

SHA512
0a2d99a2e5297cb15cb64c9d6955a71a5b713a662475078f250cc19e34b2b05344a1bdac7c4a95f9c2e60752b9ec81d853acfdbaa707076ad133c7bec915bad7

Download Submit
C:\Windows\System\mGBWkuO.exe

Filesize
1.8MB

MD5
ab24051fa606e89f51ad30f8caef5776

SHA1
76a44da2fbd19361f5c9751c90a377a52e8bf1c0

SHA256
530cc499d21e020fbcd9b75ff8564514c8c1ae20939be629d3f82dd41f3a6f68

SHA512
c1c203484e6f149970b56871f883549b3bc6b4f13c4e6e745a0dcb3a1e6b36f110e7296de0701e8e25459844e568675e8d0359afafbef3c06e2fa8436697a80c

Download Submit
C:\Windows\System\nCDYMIH.exe

Filesize
8B

MD5
20f50227b408431507e9e4298a89a7d5

SHA1
021be5cef03ca413a261257f3fa674d51e4eaecb

SHA256
f053af72ebaae8c20b4aa760dccbaa50d5e8c1b0612207e6dff562e592b0ee16

SHA512
a69e9f155961cdfb2c580f410cf1f9148255cadde0f420c64800ffc84ebbf2c4fc4d8c24eda7cee14ae357ad0398853cbe4f84f9db0bb9573e1f43351f2da9c0

Download Submit
C:\Windows\System\ncFgiDi.exe

Filesize
1.8MB

MD5
8a533706d05e5238fc8f46b19e33b030

SHA1
5c05581da2616f42c5599a138d03ab73b219a0b8

SHA256
3c563c297733d02f815d912544bf47895e5aaeeefde396e2faae413258116113

SHA512
4b8a4c296b317caea0bdd1de20ccdc55a37e6beba832ad722326fc5907818df00d8c930305e19a0a06cb02b2bedc7c2393b96821b7cabb21efc775d9f2d1a231

Download Submit
C:\Windows\System\oQwllqO.exe

Filesize
1.8MB

MD5
dc889a8176ec73cd8ce0f1d1dfa75c90

SHA1
2f5cf98e6a20e75da6931fceb6d4e9b8657e120d

SHA256
298bdf5f30c165e18eb8fe91e142ec09233090897d6a92c936ef1e70164abeea

SHA512
166f2a7ab303f8e8bc2108bb7a2dd65a48ce10482d66cf60136686b47764e28f444aee96491d4187824a97d7b2be75019fb436ddcbaba6dedddff1567fc55acb

Download Submit
C:\Windows\System\oVMQpzH.exe

Filesize
1.8MB

MD5
21a92b9aef5b66b68cc92966ac06bf66

SHA1
46a91760cd0b2d0a1cc88f464b2a63709a0fe744

SHA256
e3901c63114a297af234b6bc16444f13cb73c9a5c66ac88a9ae9c0b9474eca85

SHA512
3fac879961a976d25ff4a90786d7caff4bdbc1689bf6f26289bf3070970d63c4e5040373a4905f664993a5329d9b813199ac641dd92d439ed0dc587ed7d64551

Download Submit
C:\Windows\System\otLYiKU.exe

Filesize
1.8MB

MD5
e48b40d9ecb81fd9a0d916a91a62e817

SHA1
74ccce47ad821c10729d641fbfeea5279dae7891

SHA256
819fa103c51f5b3abf2fce17e64a9be99a64126b55098f245a6979de43b3a713

SHA512
44ec8be2de68afc73ab2279d1d07b9bcdc2ecbe66c244d5e13cd08df5c8d8244d9abdfebac2dd40112593154874cdb7e0887b8cb66d8510e3c9b6cdce36ba614

Download Submit
C:\Windows\System\pTRAiPI.exe

Filesize
1.8MB

MD5
7bb35ee54903f92970cca61457034cc3

SHA1
769b5819da26ed89ce2f9e33e294c2df5c0d1548

SHA256
a98992fcc5000d68a6645142e666a1a60b26abe3c142efe80326367dbdbc27e4

SHA512
927b35f95a1eb8f8a4a9c53067544d2c0587e756294af9922255c903ca0d0048a1f6a38cbb571a5d54f15690aff089dad830dde1c5b3fa9be2a4737b8470d92b

Download Submit
C:\Windows\System\pgjJJIH.exe

Filesize
1.8MB

MD5
17159922530178fd613890a5aabf3159

SHA1
8beb7bd3f3beb9fd95363f99e4b93832fb43b7b2

SHA256
077de8c025cb255c8da3bd0d49c120ec6b616177b6de258a02cedea3a5f65120

SHA512
ecdd96145bd255a2dc752c52bf86f89cbc7b70f9fab381b0927c3d854d65558581f2e9fa67fd633c15c6c9f0edb1e2be9e4828e8a50875fa6f83da10e6e95de0

Download Submit
C:\Windows\System\pkGoXhs.exe

Filesize
1.8MB

MD5
00399cc72fee3ed3d85f0c450060bcbe

SHA1
094151ebedb6e2fe050afa78d84d5a8528c6563b

SHA256
c4bc34d7effbaef0ab201d485a3a702971e9b5f182ce8903c6c858929534ca85

SHA512
b4743d3dbf97f30c3fa00356a85c9acd659c146ad392a3b78766a4f998763828d237d7921a9be4be8e7c00a8a4c5c2a356e5eed5fd8a5f7c6d6bde88a36c443c

Download Submit
C:\Windows\System\qCtMkzI.exe

Filesize
1.8MB

MD5
f1604c3f16f06144228a5d0c6241fec5

SHA1
b07075e544726ece813bc42f147f52a03fb73889

SHA256
e7d512f0f692b360cec21bd4b24ea594427c015f5bb0caf7f597c64d72712e4d

SHA512
e9e6830ac42d324b8dc983b7225c2cb88ac177228be54d1e7f3de3bf113413ad3db7969ff7304784e39c95f21db8320da606b9b595939666d888caf45cdf30c0

Download Submit
C:\Windows\System\qMIQhTo.exe

Filesize
1.8MB

MD5
0593406c509bb2a1cefcb5a178f63d3f

SHA1
c9f7f92cbc7e4a9db2ec1a4e95521b252bdad828

SHA256
3b02c89b0418963bf7efba82ef8c0141a0269cfdc5de0e5f70571abfde0221c1

SHA512
ad632f8022481e7d5b27704f55bac3a17add023190c89c1e91b3fea887641207185565938d2d2860a137697ff7f2b986e571eb466b92ea4dad5bfcde5541b5dd

Download Submit
C:\Windows\System\quTQMKa.exe

Filesize
1.8MB

MD5
b8c9de1d2d6d95807e90716176b52847

SHA1
efb56eabe53bd7f295f1b89f041961ce8343256a

SHA256
86cef2635b5ccd7dd8e12f8e919937a2aa6f0e5ca3b0ff3d2fdaa1daf1e6e766

SHA512
0536b682305358e180974575cb28c01f9f095b91bee67b5eabffb41617f82eef23fd1b9486436785aac959983b0b59476c761fa5732ebb625a607d6fe292e004

Download Submit
C:\Windows\System\rAVXcDG.exe

Filesize
1.8MB

MD5
8e05e9316329034513d194df778497be

SHA1
d9ff9b2e4eece1bbe63e705d8dbc1299e61b54e5

SHA256
e63dc55fc63fb82fcd7f43f0b97ddc5027fefcab26b8517692b3a770cb88c1c5

SHA512
214755b2f2176e87332b7005ac9516bd17afe5870f18c7759a360e279e4dbee22716801c89780cd1c004a1a55e409def4df3334ebada2d81f1cddde7f912798d

Download Submit
C:\Windows\System\tDjiCgn.exe

Filesize
1.8MB

MD5
7447907b00990daf50a1ed3153af1860

SHA1
94e2f14b96cffdf896c5145985d38d014704136c

SHA256
297e10f3174f0b8a160272f8a4d150bbd9cd44ac894a793c9aa9206aea14fd07

SHA512
64fe991c317c30e5eaf180ec45f73fb2d0510efcbf18630fb17b0859904d509ba56c97aef5c23ff9cafe82e16396d869dded02455c190770633c7d332da1da1e

Download Submit
C:\Windows\System\ulpSBZg.exe

Filesize
1.8MB

MD5
ea5d72b0e32b236f900c45f6d70832f6

SHA1
515ea70d97c18c40d46a21f28cc7dd8f8c030e3f

SHA256
af5c4659450fa2988ba2fb47bf95682be877fa5a056470ab3f1610bdfdf94ec5

SHA512
c9d52cb2547f1b2441ca229363273ea8ba38eef9d35e126f92001afb2496ba3cecb375196c8ccfa373c259ccbb0393ef43fa4e4876424b6b6fe7f30202ded4ff

Download Submit
C:\Windows\System\wNNOGNI.exe

Filesize
1.8MB

MD5
5967aa1ffd4ffb712a2c16de8eeb95c7

SHA1
46b2d0523dea650183adb4e1ed564646339b5639

SHA256
3eb2a3a4e71b6000953f165386572d9d4ca1de2391fd716a6c140675b640916b

SHA512
f71f35b4579b1fe639dc5e3050621b829a39acf3e5f06bec813e87112ffbe8fdfcef5f4bbb4c21aa52fec2cfb1225c3e1fedf89a4312df7a1714fc2c25f4ae6d

Download Submit
memory/116-3950-0x00007FF62E420000-0x00007FF62E812000-memory.dmp

Filesize
3.9MB

Download
memory/116-127-0x00007FF62E420000-0x00007FF62E812000-memory.dmp

Filesize
3.9MB

Download
memory/1116-54-0x00007FF73E4F0000-0x00007FF73E8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1124-60-0x00007FF6E1C90000-0x00007FF6E2082000-memory.dmp

Filesize
3.9MB

Download
memory/1128-3946-0x00007FF6D2800000-0x00007FF6D2BF2000-memory.dmp

Filesize
3.9MB

Download
memory/1128-126-0x00007FF6D2800000-0x00007FF6D2BF2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-3978-0x00007FF7C6680000-0x00007FF7C6A72000-memory.dmp

Filesize
3.9MB

Download
memory/1188-153-0x00007FF7C6680000-0x00007FF7C6A72000-memory.dmp

Filesize
3.9MB

Download
memory/1744-165-0x00007FF6BE990000-0x00007FF6BED82000-memory.dmp

Filesize
3.9MB

Download
memory/1744-3984-0x00007FF6BE990000-0x00007FF6BED82000-memory.dmp

Filesize
3.9MB

Download
memory/1796-89-0x00007FF6E31D0000-0x00007FF6E35C2000-memory.dmp

Filesize
3.9MB

Download
memory/1852-171-0x00007FF634CB0000-0x00007FF6350A2000-memory.dmp

Filesize
3.9MB

Download
memory/1852-3987-0x00007FF634CB0000-0x00007FF6350A2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-3967-0x00007FF66DE90000-0x00007FF66E282000-memory.dmp

Filesize
3.9MB

Download
memory/1948-133-0x00007FF66DE90000-0x00007FF66E282000-memory.dmp

Filesize
3.9MB

Download
memory/2108-3954-0x00007FF7EF590000-0x00007FF7EF982000-memory.dmp

Filesize
3.9MB

Download
memory/2108-139-0x00007FF7EF590000-0x00007FF7EF982000-memory.dmp

Filesize
3.9MB

Download
memory/2124-0-0x00007FF717820000-0x00007FF717C12000-memory.dmp

Filesize
3.9MB

Download
memory/2124-1-0x000001D972C50000-0x000001D972C60000-memory.dmp

Filesize
64KB

Download
memory/2212-3975-0x00007FF723820000-0x00007FF723C12000-memory.dmp

Filesize
3.9MB

Download
memory/2212-159-0x00007FF723820000-0x00007FF723C12000-memory.dmp

Filesize
3.9MB

Download
memory/2572-100-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmp

Filesize
10.8MB

Download
memory/2572-842-0x000001ACAD390000-0x000001ACADB36000-memory.dmp

Filesize
7.6MB

Download
memory/2572-597-0x000001ACAC870000-0x000001ACAC892000-memory.dmp

Filesize
136KB

Download
memory/2572-40-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmp

Filesize
10.8MB

Download
memory/2572-10-0x00007FFD9E693000-0x00007FFD9E695000-memory.dmp

Filesize
8KB

Download
memory/2720-8-0x00007FF6B0FF0000-0x00007FF6B13E2000-memory.dmp

Filesize
3.9MB

Download
memory/2880-69-0x00007FF666A40000-0x00007FF666E32000-memory.dmp

Filesize
3.9MB

Download
memory/2932-83-0x00007FF62BC90000-0x00007FF62C082000-memory.dmp

Filesize
3.9MB

Download
memory/3356-88-0x00007FF75EA20000-0x00007FF75EE12000-memory.dmp

Filesize
3.9MB

Download
memory/3624-107-0x00007FF706760000-0x00007FF706B52000-memory.dmp

Filesize
3.9MB

Download
memory/3712-3958-0x00007FF7B9D80000-0x00007FF7BA172000-memory.dmp

Filesize
3.9MB

Download
memory/3712-145-0x00007FF7B9D80000-0x00007FF7BA172000-memory.dmp

Filesize
3.9MB

Download
memory/3844-46-0x00007FF7912A0000-0x00007FF791692000-memory.dmp

Filesize
3.9MB

Download
memory/4264-3928-0x00007FF71D350000-0x00007FF71D742000-memory.dmp

Filesize
3.9MB

Download
memory/4264-113-0x00007FF71D350000-0x00007FF71D742000-memory.dmp

Filesize
3.9MB

Download
memory/4736-68-0x00007FF66E650000-0x00007FF66EA42000-memory.dmp

Filesize
3.9MB

Download
memory/4768-3970-0x00007FF701670000-0x00007FF701A62000-memory.dmp

Filesize
3.9MB

Download
memory/4768-146-0x00007FF701670000-0x00007FF701A62000-memory.dmp

Filesize
3.9MB

Download
memory/4880-152-0x00007FF6082D0000-0x00007FF6086C2000-memory.dmp

Filesize
3.9MB

Download
memory/4984-3941-0x00007FF7ED860000-0x00007FF7EDC52000-memory.dmp

Filesize
3.9MB

Download
memory/4984-119-0x00007FF7ED860000-0x00007FF7EDC52000-memory.dmp

Filesize
3.9MB

Download
memory/5028-3936-0x00007FF6EEC30000-0x00007FF6EF022000-memory.dmp

Filesize
3.9MB

Download
memory/5028-120-0x00007FF6EEC30000-0x00007FF6EF022000-memory.dmp

Filesize
3.9MB

Download