xmrig | fe0cd5a61365bee7b4d685936d147c407bd7208736a3e3018d8bc139d190ae2f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
Size

1.8MB
MD5

5c429d27bf04c528172ca0b9e026f287
SHA1

26e5028613de5853009c18499a7f3e68433d4b04
SHA256

fe0cd5a61365bee7b4d685936d147c407bd7208736a3e3018d8bc139d190ae2f
SHA512

2d5a9ace0463a1ff23d8c9d85cb1839af2e98e71d93c0cfc8f0db3c244c7e9bf8682da76d99d82ca842320afd7c443ad631fd38778c5488eeabd941740c39283
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4puWbm:NABG

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/536-14-0x00007FF7C6F20000-0x00007FF7C7312000-memory.dmp	xmrig
behavioral2/memory/3464-78-0x00007FF777950000-0x00007FF777D42000-memory.dmp	xmrig
behavioral2/memory/2012-97-0x00007FF609120000-0x00007FF609512000-memory.dmp	xmrig
behavioral2/memory/3016-109-0x00007FF7DE310000-0x00007FF7DE702000-memory.dmp	xmrig
behavioral2/memory/4444-408-0x00007FF6A3000000-0x00007FF6A33F2000-memory.dmp	xmrig
behavioral2/memory/4384-409-0x00007FF60FE50000-0x00007FF610242000-memory.dmp	xmrig
behavioral2/memory/4048-412-0x00007FF69A5E0000-0x00007FF69A9D2000-memory.dmp	xmrig
behavioral2/memory/4832-411-0x00007FF738B00000-0x00007FF738EF2000-memory.dmp	xmrig
behavioral2/memory/2992-410-0x00007FF649220000-0x00007FF649612000-memory.dmp	xmrig
behavioral2/memory/2904-407-0x00007FF76B940000-0x00007FF76BD32000-memory.dmp	xmrig
behavioral2/memory/3152-406-0x00007FF6F9990000-0x00007FF6F9D82000-memory.dmp	xmrig
behavioral2/memory/3872-405-0x00007FF6DED00000-0x00007FF6DF0F2000-memory.dmp	xmrig
behavioral2/memory/408-110-0x00007FF735BB0000-0x00007FF735FA2000-memory.dmp	xmrig
behavioral2/memory/2924-108-0x00007FF7DAB70000-0x00007FF7DAF62000-memory.dmp	xmrig
behavioral2/memory/4388-107-0x00007FF6A4220000-0x00007FF6A4612000-memory.dmp	xmrig
behavioral2/memory/1608-102-0x00007FF68C520000-0x00007FF68C912000-memory.dmp	xmrig
behavioral2/memory/2748-101-0x00007FF631EC0000-0x00007FF6322B2000-memory.dmp	xmrig
behavioral2/memory/752-92-0x00007FF77BA80000-0x00007FF77BE72000-memory.dmp	xmrig
behavioral2/memory/1696-88-0x00007FF7F3DB0000-0x00007FF7F41A2000-memory.dmp	xmrig
behavioral2/memory/3148-82-0x00007FF7A6CF0000-0x00007FF7A70E2000-memory.dmp	xmrig
behavioral2/memory/3776-81-0x00007FF6CBCF0000-0x00007FF6CC0E2000-memory.dmp	xmrig
behavioral2/memory/3672-74-0x00007FF6A4170000-0x00007FF6A4562000-memory.dmp	xmrig
behavioral2/memory/216-61-0x00007FF7100F0000-0x00007FF7104E2000-memory.dmp	xmrig
behavioral2/memory/4388-3208-0x00007FF6A4220000-0x00007FF6A4612000-memory.dmp	xmrig
behavioral2/memory/216-3397-0x00007FF7100F0000-0x00007FF7104E2000-memory.dmp	xmrig
behavioral2/memory/3672-3409-0x00007FF6A4170000-0x00007FF6A4562000-memory.dmp	xmrig
behavioral2/memory/1608-3508-0x00007FF68C520000-0x00007FF68C912000-memory.dmp	xmrig
behavioral2/memory/408-3535-0x00007FF735BB0000-0x00007FF735FA2000-memory.dmp	xmrig
behavioral2/memory/3016-3547-0x00007FF7DE310000-0x00007FF7DE702000-memory.dmp	xmrig
behavioral2/memory/2924-3515-0x00007FF7DAB70000-0x00007FF7DAF62000-memory.dmp	xmrig
behavioral2/memory/3872-3554-0x00007FF6DED00000-0x00007FF6DF0F2000-memory.dmp	xmrig
behavioral2/memory/3152-3561-0x00007FF6F9990000-0x00007FF6F9D82000-memory.dmp	xmrig
behavioral2/memory/2904-3566-0x00007FF76B940000-0x00007FF76BD32000-memory.dmp	xmrig
behavioral2/memory/4444-3570-0x00007FF6A3000000-0x00007FF6A33F2000-memory.dmp	xmrig
behavioral2/memory/4384-3576-0x00007FF60FE50000-0x00007FF610242000-memory.dmp	xmrig
behavioral2/memory/2992-3582-0x00007FF649220000-0x00007FF649612000-memory.dmp	xmrig
behavioral2/memory/4048-3590-0x00007FF69A5E0000-0x00007FF69A9D2000-memory.dmp	xmrig
behavioral2/memory/4832-3587-0x00007FF738B00000-0x00007FF738EF2000-memory.dmp	xmrig
behavioral2/memory/4388-3974-0x00007FF6A4220000-0x00007FF6A4612000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4420	powershell.exe
5	4420	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4420	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
536	LydspXT.exe
752	NksdAAG.exe
3348	UIRGSCo.exe
2012	gvmgorF.exe
216	mtsGiqi.exe
3672	lSjdrcl.exe
3464	kBfDXHb.exe
3776	YqkAMeH.exe
3148	JpKhUUJ.exe
1696	iktBpXU.exe
2748	xdCOpAA.exe
1608	xHnlgFa.exe
4388	LYQwhdN.exe
2924	Ubbkrba.exe
3016	mMXAvMN.exe
408	TeDOGOY.exe
3872	NGTxlaT.exe
3152	rLfGYMR.exe
2904	gHLtUto.exe
4444	cqlsBee.exe
4384	kiOWDWt.exe
2992	SsVniMd.exe
4832	uyWLXrJ.exe
4048	JHOYfdR.exe
828	uGvxZZO.exe
4312	wlycqWE.exe
3584	kMpfQWE.exe
1068	XYNtHUo.exe
2844	HxxilMz.exe
3588	wPGTuRK.exe
4860	chQEFhI.exe
1632	vqOfCdh.exe
2852	owhUWdi.exe
5072	IXupKBZ.exe
4776	nabWXwq.exe
4084	gPKNBRl.exe
3424	lOzJzda.exe
3920	bMSvnzP.exe
2916	ByepXCx.exe
3168	WZDYCEd.exe
448	NbjMpgc.exe
3820	RImxCvC.exe
4924	hzvcmBe.exe
2720	lKAaWXu.exe
3232	QsjDLhW.exe
2136	yZJYgbm.exe
3616	vIKvVOo.exe
1260	narsWAy.exe
792	OwkjdVX.exe
1760	YzCvvjE.exe
3764	jzDLnWt.exe
4468	qjWghaN.exe
2336	PrgGGHZ.exe
4496	gulXMsE.exe
628	lEMLMoC.exe
212	JvatedU.exe
1976	CLiRZkT.exe
4416	uQBtMTh.exe
4984	XNkQWUI.exe
3888	dSwyBSG.exe
4076	uCleQON.exe
4448	UlzuEKi.exe
2224	hZHpqVQ.exe
3124	qHUdMcu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/804-0-0x00007FF70AC10000-0x00007FF70B002000-memory.dmp	upx
behavioral2/files/0x0006000000022fa8-5.dat	upx
behavioral2/files/0x0007000000023469-10.dat	upx
behavioral2/files/0x000700000002346a-13.dat	upx
behavioral2/memory/536-14-0x00007FF7C6F20000-0x00007FF7C7312000-memory.dmp	upx
behavioral2/files/0x000700000002346c-28.dat	upx
behavioral2/files/0x000700000002346d-35.dat	upx
behavioral2/files/0x0007000000023470-46.dat	upx
behavioral2/files/0x0007000000023471-63.dat	upx
behavioral2/files/0x0007000000023472-75.dat	upx
behavioral2/memory/3464-78-0x00007FF777950000-0x00007FF777D42000-memory.dmp	upx
behavioral2/files/0x0007000000023473-84.dat	upx
behavioral2/files/0x0008000000023474-89.dat	upx
behavioral2/memory/2012-97-0x00007FF609120000-0x00007FF609512000-memory.dmp	upx
behavioral2/files/0x0007000000023476-103.dat	upx
behavioral2/memory/3016-109-0x00007FF7DE310000-0x00007FF7DE702000-memory.dmp	upx
behavioral2/files/0x0007000000023479-121.dat	upx
behavioral2/files/0x000700000002347d-149.dat	upx
behavioral2/files/0x0007000000023483-179.dat	upx
behavioral2/memory/4444-408-0x00007FF6A3000000-0x00007FF6A33F2000-memory.dmp	upx
behavioral2/memory/4384-409-0x00007FF60FE50000-0x00007FF610242000-memory.dmp	upx
behavioral2/memory/4048-412-0x00007FF69A5E0000-0x00007FF69A9D2000-memory.dmp	upx
behavioral2/memory/4832-411-0x00007FF738B00000-0x00007FF738EF2000-memory.dmp	upx
behavioral2/memory/2992-410-0x00007FF649220000-0x00007FF649612000-memory.dmp	upx
behavioral2/memory/2904-407-0x00007FF76B940000-0x00007FF76BD32000-memory.dmp	upx
behavioral2/memory/3152-406-0x00007FF6F9990000-0x00007FF6F9D82000-memory.dmp	upx
behavioral2/memory/3872-405-0x00007FF6DED00000-0x00007FF6DF0F2000-memory.dmp	upx
behavioral2/files/0x0007000000023487-191.dat	upx
behavioral2/files/0x0007000000023485-189.dat	upx
behavioral2/files/0x0007000000023486-186.dat	upx
behavioral2/files/0x0007000000023484-184.dat	upx
behavioral2/files/0x0007000000023482-174.dat	upx
behavioral2/files/0x0007000000023481-169.dat	upx
behavioral2/files/0x0007000000023480-164.dat	upx
behavioral2/files/0x000700000002347f-159.dat	upx
behavioral2/files/0x000700000002347e-154.dat	upx
behavioral2/files/0x000700000002347c-144.dat	upx
behavioral2/files/0x000700000002347b-139.dat	upx
behavioral2/files/0x000700000002347a-132.dat	upx
behavioral2/files/0x0007000000023478-122.dat	upx
behavioral2/files/0x0007000000023477-117.dat	upx
behavioral2/memory/408-110-0x00007FF735BB0000-0x00007FF735FA2000-memory.dmp	upx
behavioral2/memory/2924-108-0x00007FF7DAB70000-0x00007FF7DAF62000-memory.dmp	upx
behavioral2/memory/4388-107-0x00007FF6A4220000-0x00007FF6A4612000-memory.dmp	upx
behavioral2/files/0x0008000000023475-105.dat	upx
behavioral2/memory/1608-102-0x00007FF68C520000-0x00007FF68C912000-memory.dmp	upx
behavioral2/memory/2748-101-0x00007FF631EC0000-0x00007FF6322B2000-memory.dmp	upx
behavioral2/files/0x0008000000023466-93.dat	upx
behavioral2/memory/752-92-0x00007FF77BA80000-0x00007FF77BE72000-memory.dmp	upx
behavioral2/memory/1696-88-0x00007FF7F3DB0000-0x00007FF7F41A2000-memory.dmp	upx
behavioral2/memory/3148-82-0x00007FF7A6CF0000-0x00007FF7A70E2000-memory.dmp	upx
behavioral2/memory/3776-81-0x00007FF6CBCF0000-0x00007FF6CC0E2000-memory.dmp	upx
behavioral2/memory/3672-74-0x00007FF6A4170000-0x00007FF6A4562000-memory.dmp	upx
behavioral2/memory/216-61-0x00007FF7100F0000-0x00007FF7104E2000-memory.dmp	upx
behavioral2/files/0x000700000002346f-50.dat	upx
behavioral2/files/0x000700000002346e-45.dat	upx
behavioral2/files/0x000700000002346b-22.dat	upx
behavioral2/memory/3348-20-0x00007FF709FD0000-0x00007FF70A3C2000-memory.dmp	upx
behavioral2/memory/4388-3208-0x00007FF6A4220000-0x00007FF6A4612000-memory.dmp	upx
behavioral2/memory/216-3397-0x00007FF7100F0000-0x00007FF7104E2000-memory.dmp	upx
behavioral2/memory/3672-3409-0x00007FF6A4170000-0x00007FF6A4562000-memory.dmp	upx
behavioral2/memory/1608-3508-0x00007FF68C520000-0x00007FF68C912000-memory.dmp	upx
behavioral2/memory/408-3535-0x00007FF735BB0000-0x00007FF735FA2000-memory.dmp	upx
behavioral2/memory/3016-3547-0x00007FF7DE310000-0x00007FF7DE702000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dPtzuri.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\vEvwdTY.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\HZwjUWT.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\pGKBpRa.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\XDRCoeF.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\yPalLsO.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\HOCVGzA.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\drfMcgM.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\ICpCqrI.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\wmhSATG.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\irvzzQf.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\byMrVry.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\qPCWZxT.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\BBqzBif.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\bclnWSv.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\adyJAxf.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\xhjEHzk.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\edlgXuC.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\KwajrrH.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\FVvuCSa.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\ipPCZbE.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\OoxhRca.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\pqdhUvi.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\jXkbIiD.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\xRLBsYh.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\VfcXLuQ.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\yLKRBFN.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\XUXiIyj.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\bezScQK.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\eLcBUed.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\BygDokF.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\ALuLDsw.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\PimisFH.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\KMWVBjp.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\mLHEeVd.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\ySTOrsr.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\YvstqPT.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\IwFWftT.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\vNwfnhS.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\XJxFvvA.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\gLbpkoX.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\CmckuOk.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\XmCczon.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\uLYHLis.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\rMYoBex.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\lCksyfP.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\iBXVkuQ.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\nCGLODd.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\AecfFPD.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\UcQuaHn.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\LYQwhdN.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\YzCvvjE.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\xWOoXWZ.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\WLNiIHb.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\sANhicg.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\XtQpPxM.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\KGjjWgg.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\cvHKkny.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\XKVulYt.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\OMSIxFA.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\bBvKwaQ.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\TNtJrHo.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\AFModwg.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
File created	C:\Windows\System\WiAavYt.exe	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeLockMemoryPrivilege	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 4420	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	86
PID 804 wrote to memory of 4420	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	86
PID 804 wrote to memory of 536	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	87
PID 804 wrote to memory of 536	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	87
PID 804 wrote to memory of 752	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	88
PID 804 wrote to memory of 752	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	88
PID 804 wrote to memory of 3348	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	89
PID 804 wrote to memory of 3348	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	89
PID 804 wrote to memory of 2012	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	90
PID 804 wrote to memory of 2012	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	90
PID 804 wrote to memory of 216	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	91
PID 804 wrote to memory of 216	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	91
PID 804 wrote to memory of 3672	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	92
PID 804 wrote to memory of 3672	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	92
PID 804 wrote to memory of 3464	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	93
PID 804 wrote to memory of 3464	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	93
PID 804 wrote to memory of 3776	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	94
PID 804 wrote to memory of 3776	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	94
PID 804 wrote to memory of 3148	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	95
PID 804 wrote to memory of 3148	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	95
PID 804 wrote to memory of 1696	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	96
PID 804 wrote to memory of 1696	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	96
PID 804 wrote to memory of 2748	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	97
PID 804 wrote to memory of 2748	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	97
PID 804 wrote to memory of 1608	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	98
PID 804 wrote to memory of 1608	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	98
PID 804 wrote to memory of 4388	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	99
PID 804 wrote to memory of 4388	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	99
PID 804 wrote to memory of 2924	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	100
PID 804 wrote to memory of 2924	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	100
PID 804 wrote to memory of 3016	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	101
PID 804 wrote to memory of 3016	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	101
PID 804 wrote to memory of 408	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	102
PID 804 wrote to memory of 408	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	102
PID 804 wrote to memory of 3872	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	103
PID 804 wrote to memory of 3872	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	103
PID 804 wrote to memory of 3152	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	104
PID 804 wrote to memory of 3152	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	104
PID 804 wrote to memory of 2904	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	105
PID 804 wrote to memory of 2904	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	105
PID 804 wrote to memory of 4444	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	106
PID 804 wrote to memory of 4444	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	106
PID 804 wrote to memory of 4384	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	107
PID 804 wrote to memory of 4384	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	107
PID 804 wrote to memory of 2992	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	108
PID 804 wrote to memory of 2992	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	108
PID 804 wrote to memory of 4832	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	109
PID 804 wrote to memory of 4832	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	109
PID 804 wrote to memory of 4048	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	110
PID 804 wrote to memory of 4048	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	110
PID 804 wrote to memory of 828	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	111
PID 804 wrote to memory of 828	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	111
PID 804 wrote to memory of 4312	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	112
PID 804 wrote to memory of 4312	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	112
PID 804 wrote to memory of 3584	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	113
PID 804 wrote to memory of 3584	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	113
PID 804 wrote to memory of 1068	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	114
PID 804 wrote to memory of 1068	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	114
PID 804 wrote to memory of 2844	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	115
PID 804 wrote to memory of 2844	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	115
PID 804 wrote to memory of 3588	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	116
PID 804 wrote to memory of 3588	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	116
PID 804 wrote to memory of 4860	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	117
PID 804 wrote to memory of 4860	804	5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c429d27bf04c528172ca0b9e026f287_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4420" "2904" "2928" "2912" "0" "0" "2796" "0" "0" "0" "0" "0"
    3⤵
    PID:12752
- C:\Windows\System\LydspXT.exe
  C:\Windows\System\LydspXT.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\NksdAAG.exe
  C:\Windows\System\NksdAAG.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\UIRGSCo.exe
  C:\Windows\System\UIRGSCo.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\gvmgorF.exe
  C:\Windows\System\gvmgorF.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\mtsGiqi.exe
  C:\Windows\System\mtsGiqi.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\lSjdrcl.exe
  C:\Windows\System\lSjdrcl.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\kBfDXHb.exe
  C:\Windows\System\kBfDXHb.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\YqkAMeH.exe
  C:\Windows\System\YqkAMeH.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\JpKhUUJ.exe
  C:\Windows\System\JpKhUUJ.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\iktBpXU.exe
  C:\Windows\System\iktBpXU.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\xdCOpAA.exe
  C:\Windows\System\xdCOpAA.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\xHnlgFa.exe
  C:\Windows\System\xHnlgFa.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\LYQwhdN.exe
  C:\Windows\System\LYQwhdN.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\Ubbkrba.exe
  C:\Windows\System\Ubbkrba.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\mMXAvMN.exe
  C:\Windows\System\mMXAvMN.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\TeDOGOY.exe
  C:\Windows\System\TeDOGOY.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\NGTxlaT.exe
  C:\Windows\System\NGTxlaT.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\rLfGYMR.exe
  C:\Windows\System\rLfGYMR.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\gHLtUto.exe
  C:\Windows\System\gHLtUto.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\cqlsBee.exe
  C:\Windows\System\cqlsBee.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\kiOWDWt.exe
  C:\Windows\System\kiOWDWt.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\SsVniMd.exe
  C:\Windows\System\SsVniMd.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\uyWLXrJ.exe
  C:\Windows\System\uyWLXrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\JHOYfdR.exe
  C:\Windows\System\JHOYfdR.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\uGvxZZO.exe
  C:\Windows\System\uGvxZZO.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\wlycqWE.exe
  C:\Windows\System\wlycqWE.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\kMpfQWE.exe
  C:\Windows\System\kMpfQWE.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\XYNtHUo.exe
  C:\Windows\System\XYNtHUo.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\HxxilMz.exe
  C:\Windows\System\HxxilMz.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\wPGTuRK.exe
  C:\Windows\System\wPGTuRK.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\chQEFhI.exe
  C:\Windows\System\chQEFhI.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\vqOfCdh.exe
  C:\Windows\System\vqOfCdh.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\owhUWdi.exe
  C:\Windows\System\owhUWdi.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\IXupKBZ.exe
  C:\Windows\System\IXupKBZ.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\nabWXwq.exe
  C:\Windows\System\nabWXwq.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\gPKNBRl.exe
  C:\Windows\System\gPKNBRl.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\lOzJzda.exe
  C:\Windows\System\lOzJzda.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\bMSvnzP.exe
  C:\Windows\System\bMSvnzP.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\ByepXCx.exe
  C:\Windows\System\ByepXCx.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\WZDYCEd.exe
  C:\Windows\System\WZDYCEd.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\NbjMpgc.exe
  C:\Windows\System\NbjMpgc.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\RImxCvC.exe
  C:\Windows\System\RImxCvC.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\hzvcmBe.exe
  C:\Windows\System\hzvcmBe.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\lKAaWXu.exe
  C:\Windows\System\lKAaWXu.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\QsjDLhW.exe
  C:\Windows\System\QsjDLhW.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\yZJYgbm.exe
  C:\Windows\System\yZJYgbm.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\vIKvVOo.exe
  C:\Windows\System\vIKvVOo.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\narsWAy.exe
  C:\Windows\System\narsWAy.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\OwkjdVX.exe
  C:\Windows\System\OwkjdVX.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\YzCvvjE.exe
  C:\Windows\System\YzCvvjE.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\jzDLnWt.exe
  C:\Windows\System\jzDLnWt.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\qjWghaN.exe
  C:\Windows\System\qjWghaN.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\PrgGGHZ.exe
  C:\Windows\System\PrgGGHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\gulXMsE.exe
  C:\Windows\System\gulXMsE.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\lEMLMoC.exe
  C:\Windows\System\lEMLMoC.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\JvatedU.exe
  C:\Windows\System\JvatedU.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\CLiRZkT.exe
  C:\Windows\System\CLiRZkT.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\uQBtMTh.exe
  C:\Windows\System\uQBtMTh.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\XNkQWUI.exe
  C:\Windows\System\XNkQWUI.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\dSwyBSG.exe
  C:\Windows\System\dSwyBSG.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\uCleQON.exe
  C:\Windows\System\uCleQON.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\UlzuEKi.exe
  C:\Windows\System\UlzuEKi.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\hZHpqVQ.exe
  C:\Windows\System\hZHpqVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\qHUdMcu.exe
  C:\Windows\System\qHUdMcu.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\juLGlCE.exe
  C:\Windows\System\juLGlCE.exe
  2⤵
  PID:4236
- C:\Windows\System\JAyFHbD.exe
  C:\Windows\System\JAyFHbD.exe
  2⤵
  PID:3000
- C:\Windows\System\YvstqPT.exe
  C:\Windows\System\YvstqPT.exe
  2⤵
  PID:940
- C:\Windows\System\uLEfEyR.exe
  C:\Windows\System\uLEfEyR.exe
  2⤵
  PID:864
- C:\Windows\System\lgIftIa.exe
  C:\Windows\System\lgIftIa.exe
  2⤵
  PID:3156
- C:\Windows\System\uOLWhWJ.exe
  C:\Windows\System\uOLWhWJ.exe
  2⤵
  PID:3912
- C:\Windows\System\mTGKMHk.exe
  C:\Windows\System\mTGKMHk.exe
  2⤵
  PID:3436
- C:\Windows\System\StfMtdj.exe
  C:\Windows\System\StfMtdj.exe
  2⤵
  PID:2300
- C:\Windows\System\XnMFVXH.exe
  C:\Windows\System\XnMFVXH.exe
  2⤵
  PID:4072
- C:\Windows\System\WTEquvt.exe
  C:\Windows\System\WTEquvt.exe
  2⤵
  PID:4492
- C:\Windows\System\HyXDdWe.exe
  C:\Windows\System\HyXDdWe.exe
  2⤵
  PID:4424
- C:\Windows\System\CVWKJfV.exe
  C:\Windows\System\CVWKJfV.exe
  2⤵
  PID:4936
- C:\Windows\System\LmhaPeH.exe
  C:\Windows\System\LmhaPeH.exe
  2⤵
  PID:3688
- C:\Windows\System\axKfgwe.exe
  C:\Windows\System\axKfgwe.exe
  2⤵
  PID:5144
- C:\Windows\System\UDZMKGM.exe
  C:\Windows\System\UDZMKGM.exe
  2⤵
  PID:5168
- C:\Windows\System\hOeSdsB.exe
  C:\Windows\System\hOeSdsB.exe
  2⤵
  PID:5196
- C:\Windows\System\DApEMlM.exe
  C:\Windows\System\DApEMlM.exe
  2⤵
  PID:5224
- C:\Windows\System\ZnaGeZV.exe
  C:\Windows\System\ZnaGeZV.exe
  2⤵
  PID:5252
- C:\Windows\System\RscvVaS.exe
  C:\Windows\System\RscvVaS.exe
  2⤵
  PID:5280
- C:\Windows\System\vGgvVzo.exe
  C:\Windows\System\vGgvVzo.exe
  2⤵
  PID:5308
- C:\Windows\System\dAZGxKB.exe
  C:\Windows\System\dAZGxKB.exe
  2⤵
  PID:5336
- C:\Windows\System\ZjISKqZ.exe
  C:\Windows\System\ZjISKqZ.exe
  2⤵
  PID:5364
- C:\Windows\System\HHFREND.exe
  C:\Windows\System\HHFREND.exe
  2⤵
  PID:5392
- C:\Windows\System\CFhMXba.exe
  C:\Windows\System\CFhMXba.exe
  2⤵
  PID:5420
- C:\Windows\System\rwSFqdh.exe
  C:\Windows\System\rwSFqdh.exe
  2⤵
  PID:5448
- C:\Windows\System\glOvzmL.exe
  C:\Windows\System\glOvzmL.exe
  2⤵
  PID:5476
- C:\Windows\System\uSTRUvT.exe
  C:\Windows\System\uSTRUvT.exe
  2⤵
  PID:5504
- C:\Windows\System\kNlFxfA.exe
  C:\Windows\System\kNlFxfA.exe
  2⤵
  PID:5532
- C:\Windows\System\pvyMzER.exe
  C:\Windows\System\pvyMzER.exe
  2⤵
  PID:5560
- C:\Windows\System\UcCtbCv.exe
  C:\Windows\System\UcCtbCv.exe
  2⤵
  PID:5588
- C:\Windows\System\kSFmrAf.exe
  C:\Windows\System\kSFmrAf.exe
  2⤵
  PID:5616
- C:\Windows\System\uVMGbgJ.exe
  C:\Windows\System\uVMGbgJ.exe
  2⤵
  PID:5644
- C:\Windows\System\aRYQqiV.exe
  C:\Windows\System\aRYQqiV.exe
  2⤵
  PID:5672
- C:\Windows\System\bMOjRTU.exe
  C:\Windows\System\bMOjRTU.exe
  2⤵
  PID:5700
- C:\Windows\System\neQcPwc.exe
  C:\Windows\System\neQcPwc.exe
  2⤵
  PID:5728
- C:\Windows\System\VwUawKv.exe
  C:\Windows\System\VwUawKv.exe
  2⤵
  PID:5756
- C:\Windows\System\xBffJEb.exe
  C:\Windows\System\xBffJEb.exe
  2⤵
  PID:5784
- C:\Windows\System\maqOgTZ.exe
  C:\Windows\System\maqOgTZ.exe
  2⤵
  PID:5812
- C:\Windows\System\bYwwinl.exe
  C:\Windows\System\bYwwinl.exe
  2⤵
  PID:5840
- C:\Windows\System\bBvKwaQ.exe
  C:\Windows\System\bBvKwaQ.exe
  2⤵
  PID:5868
- C:\Windows\System\ztBcLHx.exe
  C:\Windows\System\ztBcLHx.exe
  2⤵
  PID:5956
- C:\Windows\System\SvBzJFg.exe
  C:\Windows\System\SvBzJFg.exe
  2⤵
  PID:6004
- C:\Windows\System\xgwhETx.exe
  C:\Windows\System\xgwhETx.exe
  2⤵
  PID:6040
- C:\Windows\System\EwanttJ.exe
  C:\Windows\System\EwanttJ.exe
  2⤵
  PID:6072
- C:\Windows\System\TrFvGZT.exe
  C:\Windows\System\TrFvGZT.exe
  2⤵
  PID:6112
- C:\Windows\System\wHnDuwG.exe
  C:\Windows\System\wHnDuwG.exe
  2⤵
  PID:6136
- C:\Windows\System\IMcsEzx.exe
  C:\Windows\System\IMcsEzx.exe
  2⤵
  PID:2620
- C:\Windows\System\VGxMACE.exe
  C:\Windows\System\VGxMACE.exe
  2⤵
  PID:116
- C:\Windows\System\fGKUsSy.exe
  C:\Windows\System\fGKUsSy.exe
  2⤵
  PID:5128
- C:\Windows\System\mMmWaDA.exe
  C:\Windows\System\mMmWaDA.exe
  2⤵
  PID:5188
- C:\Windows\System\QSxQgvZ.exe
  C:\Windows\System\QSxQgvZ.exe
  2⤵
  PID:5220
- C:\Windows\System\DEWcVZt.exe
  C:\Windows\System\DEWcVZt.exe
  2⤵
  PID:5268
- C:\Windows\System\dGSzKnN.exe
  C:\Windows\System\dGSzKnN.exe
  2⤵
  PID:5304
- C:\Windows\System\Jmovkwm.exe
  C:\Windows\System\Jmovkwm.exe
  2⤵
  PID:5356
- C:\Windows\System\fsSUKar.exe
  C:\Windows\System\fsSUKar.exe
  2⤵
  PID:5388
- C:\Windows\System\cjujvSE.exe
  C:\Windows\System\cjujvSE.exe
  2⤵
  PID:5436
- C:\Windows\System\kznszEu.exe
  C:\Windows\System\kznszEu.exe
  2⤵
  PID:5472
- C:\Windows\System\zZhQHYs.exe
  C:\Windows\System\zZhQHYs.exe
  2⤵
  PID:5576
- C:\Windows\System\iAWvYOs.exe
  C:\Windows\System\iAWvYOs.exe
  2⤵
  PID:5028
- C:\Windows\System\uhSqbtN.exe
  C:\Windows\System\uhSqbtN.exe
  2⤵
  PID:4804
- C:\Windows\System\wmsnmVO.exe
  C:\Windows\System\wmsnmVO.exe
  2⤵
  PID:5748
- C:\Windows\System\xNdHCMq.exe
  C:\Windows\System\xNdHCMq.exe
  2⤵
  PID:5808
- C:\Windows\System\LzpgjRV.exe
  C:\Windows\System\LzpgjRV.exe
  2⤵
  PID:5836
- C:\Windows\System\OhexrUn.exe
  C:\Windows\System\OhexrUn.exe
  2⤵
  PID:1168
- C:\Windows\System\PwHfoph.exe
  C:\Windows\System\PwHfoph.exe
  2⤵
  PID:4300
- C:\Windows\System\sANhicg.exe
  C:\Windows\System\sANhicg.exe
  2⤵
  PID:3004
- C:\Windows\System\sVWaSCI.exe
  C:\Windows\System\sVWaSCI.exe
  2⤵
  PID:5976
- C:\Windows\System\dFPhydt.exe
  C:\Windows\System\dFPhydt.exe
  2⤵
  PID:4616
- C:\Windows\System\mEkRBtv.exe
  C:\Windows\System\mEkRBtv.exe
  2⤵
  PID:6000
- C:\Windows\System\nBIyhko.exe
  C:\Windows\System\nBIyhko.exe
  2⤵
  PID:6024
- C:\Windows\System\ZIHxAUs.exe
  C:\Windows\System\ZIHxAUs.exe
  2⤵
  PID:6068
- C:\Windows\System\HrxBjCG.exe
  C:\Windows\System\HrxBjCG.exe
  2⤵
  PID:6124
- C:\Windows\System\CMZRsyg.exe
  C:\Windows\System\CMZRsyg.exe
  2⤵
  PID:1228
- C:\Windows\System\lfbxkpw.exe
  C:\Windows\System\lfbxkpw.exe
  2⤵
  PID:5276
- C:\Windows\System\IEotFii.exe
  C:\Windows\System\IEotFii.exe
  2⤵
  PID:5384
- C:\Windows\System\lNHrOeX.exe
  C:\Windows\System\lNHrOeX.exe
  2⤵
  PID:5328
- C:\Windows\System\pEZwCaW.exe
  C:\Windows\System\pEZwCaW.exe
  2⤵
  PID:4036
- C:\Windows\System\QqTZvYB.exe
  C:\Windows\System\QqTZvYB.exe
  2⤵
  PID:3644
- C:\Windows\System\ywQDUxD.exe
  C:\Windows\System\ywQDUxD.exe
  2⤵
  PID:5772
- C:\Windows\System\VSpOZPX.exe
  C:\Windows\System\VSpOZPX.exe
  2⤵
  PID:232
- C:\Windows\System\GzIniIx.exe
  C:\Windows\System\GzIniIx.exe
  2⤵
  PID:5952
- C:\Windows\System\WfcnhBk.exe
  C:\Windows\System\WfcnhBk.exe
  2⤵
  PID:4964
- C:\Windows\System\VIYWnWS.exe
  C:\Windows\System\VIYWnWS.exe
  2⤵
  PID:316
- C:\Windows\System\CosFloO.exe
  C:\Windows\System\CosFloO.exe
  2⤵
  PID:2404
- C:\Windows\System\ArkXTXq.exe
  C:\Windows\System\ArkXTXq.exe
  2⤵
  PID:3632
- C:\Windows\System\cDtkNEA.exe
  C:\Windows\System\cDtkNEA.exe
  2⤵
  PID:1284
- C:\Windows\System\BWaqPjw.exe
  C:\Windows\System\BWaqPjw.exe
  2⤵
  PID:2624
- C:\Windows\System\RsbqFLp.exe
  C:\Windows\System\RsbqFLp.exe
  2⤵
  PID:5464
- C:\Windows\System\ErmrRZc.exe
  C:\Windows\System\ErmrRZc.exe
  2⤵
  PID:1008
- C:\Windows\System\iOmLtPT.exe
  C:\Windows\System\iOmLtPT.exe
  2⤵
  PID:3596
- C:\Windows\System\qBohszk.exe
  C:\Windows\System\qBohszk.exe
  2⤵
  PID:5988
- C:\Windows\System\KfjchDj.exe
  C:\Windows\System\KfjchDj.exe
  2⤵
  PID:5380
- C:\Windows\System\OFqzVeQ.exe
  C:\Windows\System\OFqzVeQ.exe
  2⤵
  PID:2420
- C:\Windows\System\yeHWCkX.exe
  C:\Windows\System\yeHWCkX.exe
  2⤵
  PID:6148
- C:\Windows\System\wEUmoii.exe
  C:\Windows\System\wEUmoii.exe
  2⤵
  PID:6164
- C:\Windows\System\jwlGFdv.exe
  C:\Windows\System\jwlGFdv.exe
  2⤵
  PID:6188
- C:\Windows\System\VEoqEog.exe
  C:\Windows\System\VEoqEog.exe
  2⤵
  PID:6208
- C:\Windows\System\NqiClXI.exe
  C:\Windows\System\NqiClXI.exe
  2⤵
  PID:6228
- C:\Windows\System\qTgDPuw.exe
  C:\Windows\System\qTgDPuw.exe
  2⤵
  PID:6272
- C:\Windows\System\KjciKjZ.exe
  C:\Windows\System\KjciKjZ.exe
  2⤵
  PID:6312
- C:\Windows\System\wpqFnGW.exe
  C:\Windows\System\wpqFnGW.exe
  2⤵
  PID:6336
- C:\Windows\System\mJMTsDX.exe
  C:\Windows\System\mJMTsDX.exe
  2⤵
  PID:6364
- C:\Windows\System\CAAdbTh.exe
  C:\Windows\System\CAAdbTh.exe
  2⤵
  PID:6388
- C:\Windows\System\muziryl.exe
  C:\Windows\System\muziryl.exe
  2⤵
  PID:6408
- C:\Windows\System\uNQEDqL.exe
  C:\Windows\System\uNQEDqL.exe
  2⤵
  PID:6432
- C:\Windows\System\GvoPxgM.exe
  C:\Windows\System\GvoPxgM.exe
  2⤵
  PID:6460
- C:\Windows\System\jaZcfEp.exe
  C:\Windows\System\jaZcfEp.exe
  2⤵
  PID:6484
- C:\Windows\System\OrOLLcz.exe
  C:\Windows\System\OrOLLcz.exe
  2⤵
  PID:6512
- C:\Windows\System\UrApxQJ.exe
  C:\Windows\System\UrApxQJ.exe
  2⤵
  PID:6528
- C:\Windows\System\XmOozBd.exe
  C:\Windows\System\XmOozBd.exe
  2⤵
  PID:6552
- C:\Windows\System\oKwAtjm.exe
  C:\Windows\System\oKwAtjm.exe
  2⤵
  PID:6620
- C:\Windows\System\PpcVqjP.exe
  C:\Windows\System\PpcVqjP.exe
  2⤵
  PID:6696
- C:\Windows\System\wTGZNss.exe
  C:\Windows\System\wTGZNss.exe
  2⤵
  PID:6712
- C:\Windows\System\zGmVdml.exe
  C:\Windows\System\zGmVdml.exe
  2⤵
  PID:6732
- C:\Windows\System\PoQFCtA.exe
  C:\Windows\System\PoQFCtA.exe
  2⤵
  PID:6760
- C:\Windows\System\cOPoAUQ.exe
  C:\Windows\System\cOPoAUQ.exe
  2⤵
  PID:6776
- C:\Windows\System\mIplPqz.exe
  C:\Windows\System\mIplPqz.exe
  2⤵
  PID:6812
- C:\Windows\System\XHyPOAI.exe
  C:\Windows\System\XHyPOAI.exe
  2⤵
  PID:6836
- C:\Windows\System\lWqJbcw.exe
  C:\Windows\System\lWqJbcw.exe
  2⤵
  PID:6868
- C:\Windows\System\nUWTBxB.exe
  C:\Windows\System\nUWTBxB.exe
  2⤵
  PID:6884
- C:\Windows\System\qebarwc.exe
  C:\Windows\System\qebarwc.exe
  2⤵
  PID:6908
- C:\Windows\System\vRtEUfF.exe
  C:\Windows\System\vRtEUfF.exe
  2⤵
  PID:6932
- C:\Windows\System\YzrPrmV.exe
  C:\Windows\System\YzrPrmV.exe
  2⤵
  PID:6948
- C:\Windows\System\MXXRZRk.exe
  C:\Windows\System\MXXRZRk.exe
  2⤵
  PID:6980
- C:\Windows\System\gCmAIjE.exe
  C:\Windows\System\gCmAIjE.exe
  2⤵
  PID:7004
- C:\Windows\System\nvdMfii.exe
  C:\Windows\System\nvdMfii.exe
  2⤵
  PID:7068
- C:\Windows\System\SuVSDue.exe
  C:\Windows\System\SuVSDue.exe
  2⤵
  PID:7120
- C:\Windows\System\BoLlAeu.exe
  C:\Windows\System\BoLlAeu.exe
  2⤵
  PID:7152
- C:\Windows\System\tRYLGtZ.exe
  C:\Windows\System\tRYLGtZ.exe
  2⤵
  PID:5636
- C:\Windows\System\xgTLGrQ.exe
  C:\Windows\System\xgTLGrQ.exe
  2⤵
  PID:6220
- C:\Windows\System\aARQrLn.exe
  C:\Windows\System\aARQrLn.exe
  2⤵
  PID:6184
- C:\Windows\System\pxTLEgE.exe
  C:\Windows\System\pxTLEgE.exe
  2⤵
  PID:6304
- C:\Windows\System\qMLECXn.exe
  C:\Windows\System\qMLECXn.exe
  2⤵
  PID:6320
- C:\Windows\System\FSeqteY.exe
  C:\Windows\System\FSeqteY.exe
  2⤵
  PID:6344
- C:\Windows\System\UzNWzBA.exe
  C:\Windows\System\UzNWzBA.exe
  2⤵
  PID:6400
- C:\Windows\System\aSfkehh.exe
  C:\Windows\System\aSfkehh.exe
  2⤵
  PID:6524
- C:\Windows\System\VfGEmJC.exe
  C:\Windows\System\VfGEmJC.exe
  2⤵
  PID:6500
- C:\Windows\System\uqmpKdo.exe
  C:\Windows\System\uqmpKdo.exe
  2⤵
  PID:6580
- C:\Windows\System\viEBOff.exe
  C:\Windows\System\viEBOff.exe
  2⤵
  PID:6684
- C:\Windows\System\EIiqlsE.exe
  C:\Windows\System\EIiqlsE.exe
  2⤵
  PID:6704
- C:\Windows\System\KqpQmgb.exe
  C:\Windows\System\KqpQmgb.exe
  2⤵
  PID:6808
- C:\Windows\System\fYleWVs.exe
  C:\Windows\System\fYleWVs.exe
  2⤵
  PID:6876
- C:\Windows\System\NHxNRrC.exe
  C:\Windows\System\NHxNRrC.exe
  2⤵
  PID:6940
- C:\Windows\System\vRioSRb.exe
  C:\Windows\System\vRioSRb.exe
  2⤵
  PID:6992
- C:\Windows\System\yZJtPst.exe
  C:\Windows\System\yZJtPst.exe
  2⤵
  PID:5860
- C:\Windows\System\WveBgLP.exe
  C:\Windows\System\WveBgLP.exe
  2⤵
  PID:6248
- C:\Windows\System\cNoKxYX.exe
  C:\Windows\System\cNoKxYX.exe
  2⤵
  PID:6300
- C:\Windows\System\SLmGneX.exe
  C:\Windows\System\SLmGneX.exe
  2⤵
  PID:6480
- C:\Windows\System\aSuKyDt.exe
  C:\Windows\System\aSuKyDt.exe
  2⤵
  PID:6612
- C:\Windows\System\FFbZnGM.exe
  C:\Windows\System\FFbZnGM.exe
  2⤵
  PID:6804
- C:\Windows\System\rTpKWdl.exe
  C:\Windows\System\rTpKWdl.exe
  2⤵
  PID:6972
- C:\Windows\System\WOMwTEN.exe
  C:\Windows\System\WOMwTEN.exe
  2⤵
  PID:7100
- C:\Windows\System\zYxJmVK.exe
  C:\Windows\System\zYxJmVK.exe
  2⤵
  PID:6452
- C:\Windows\System\rjFILTN.exe
  C:\Windows\System\rjFILTN.exe
  2⤵
  PID:5944
- C:\Windows\System\pkaxRov.exe
  C:\Windows\System\pkaxRov.exe
  2⤵
  PID:5916
- C:\Windows\System\okqzfqN.exe
  C:\Windows\System\okqzfqN.exe
  2⤵
  PID:5640
- C:\Windows\System\RfLHDDh.exe
  C:\Windows\System\RfLHDDh.exe
  2⤵
  PID:6544
- C:\Windows\System\wfBVUGf.exe
  C:\Windows\System\wfBVUGf.exe
  2⤵
  PID:7184
- C:\Windows\System\xpcyjRN.exe
  C:\Windows\System\xpcyjRN.exe
  2⤵
  PID:7200
- C:\Windows\System\AzGbQcD.exe
  C:\Windows\System\AzGbQcD.exe
  2⤵
  PID:7228
- C:\Windows\System\VGXoFpa.exe
  C:\Windows\System\VGXoFpa.exe
  2⤵
  PID:7244
- C:\Windows\System\qgmbBJj.exe
  C:\Windows\System\qgmbBJj.exe
  2⤵
  PID:7268
- C:\Windows\System\rMYoBex.exe
  C:\Windows\System\rMYoBex.exe
  2⤵
  PID:7296
- C:\Windows\System\IAJNrEX.exe
  C:\Windows\System\IAJNrEX.exe
  2⤵
  PID:7316
- C:\Windows\System\JpVhGJa.exe
  C:\Windows\System\JpVhGJa.exe
  2⤵
  PID:7376
- C:\Windows\System\KnPwvvg.exe
  C:\Windows\System\KnPwvvg.exe
  2⤵
  PID:7424
- C:\Windows\System\KhdSrgZ.exe
  C:\Windows\System\KhdSrgZ.exe
  2⤵
  PID:7444
- C:\Windows\System\NbXHKAn.exe
  C:\Windows\System\NbXHKAn.exe
  2⤵
  PID:7464
- C:\Windows\System\qDceLFw.exe
  C:\Windows\System\qDceLFw.exe
  2⤵
  PID:7488
- C:\Windows\System\dKLnyBd.exe
  C:\Windows\System\dKLnyBd.exe
  2⤵
  PID:7520
- C:\Windows\System\gcRMeHr.exe
  C:\Windows\System\gcRMeHr.exe
  2⤵
  PID:7540
- C:\Windows\System\WszGnbI.exe
  C:\Windows\System\WszGnbI.exe
  2⤵
  PID:7560
- C:\Windows\System\ckOfdJQ.exe
  C:\Windows\System\ckOfdJQ.exe
  2⤵
  PID:7588
- C:\Windows\System\eQzJzCA.exe
  C:\Windows\System\eQzJzCA.exe
  2⤵
  PID:7636
- C:\Windows\System\iuuMVsP.exe
  C:\Windows\System\iuuMVsP.exe
  2⤵
  PID:7660
- C:\Windows\System\WlpbRek.exe
  C:\Windows\System\WlpbRek.exe
  2⤵
  PID:7688
- C:\Windows\System\GWkoghP.exe
  C:\Windows\System\GWkoghP.exe
  2⤵
  PID:7732
- C:\Windows\System\ekqaMTM.exe
  C:\Windows\System\ekqaMTM.exe
  2⤵
  PID:7760
- C:\Windows\System\lbSQcyg.exe
  C:\Windows\System\lbSQcyg.exe
  2⤵
  PID:7780
- C:\Windows\System\ePKfpof.exe
  C:\Windows\System\ePKfpof.exe
  2⤵
  PID:7804
- C:\Windows\System\hPOsEHP.exe
  C:\Windows\System\hPOsEHP.exe
  2⤵
  PID:7828
- C:\Windows\System\SLQSApV.exe
  C:\Windows\System\SLQSApV.exe
  2⤵
  PID:7848
- C:\Windows\System\kiolLKl.exe
  C:\Windows\System\kiolLKl.exe
  2⤵
  PID:7872
- C:\Windows\System\UwlxfWM.exe
  C:\Windows\System\UwlxfWM.exe
  2⤵
  PID:7892
- C:\Windows\System\MukQmwm.exe
  C:\Windows\System\MukQmwm.exe
  2⤵
  PID:7912
- C:\Windows\System\FaIewcH.exe
  C:\Windows\System\FaIewcH.exe
  2⤵
  PID:7932
- C:\Windows\System\JqwgSsR.exe
  C:\Windows\System\JqwgSsR.exe
  2⤵
  PID:7956
- C:\Windows\System\aToylQm.exe
  C:\Windows\System\aToylQm.exe
  2⤵
  PID:7976
- C:\Windows\System\bCozrGA.exe
  C:\Windows\System\bCozrGA.exe
  2⤵
  PID:8000
- C:\Windows\System\dvvLuAu.exe
  C:\Windows\System\dvvLuAu.exe
  2⤵
  PID:8020
- C:\Windows\System\OIOLBTX.exe
  C:\Windows\System\OIOLBTX.exe
  2⤵
  PID:8048
- C:\Windows\System\XXPrZfq.exe
  C:\Windows\System\XXPrZfq.exe
  2⤵
  PID:8120
- C:\Windows\System\vTDSygq.exe
  C:\Windows\System\vTDSygq.exe
  2⤵
  PID:8144
- C:\Windows\System\BMYSLJB.exe
  C:\Windows\System\BMYSLJB.exe
  2⤵
  PID:7144
- C:\Windows\System\GPzjFXb.exe
  C:\Windows\System\GPzjFXb.exe
  2⤵
  PID:7208
- C:\Windows\System\tEePAUE.exe
  C:\Windows\System\tEePAUE.exe
  2⤵
  PID:7256
- C:\Windows\System\JcdwLAY.exe
  C:\Windows\System\JcdwLAY.exe
  2⤵
  PID:7292
- C:\Windows\System\ktXAqUj.exe
  C:\Windows\System\ktXAqUj.exe
  2⤵
  PID:7352
- C:\Windows\System\IcFWQWU.exe
  C:\Windows\System\IcFWQWU.exe
  2⤵
  PID:7460
- C:\Windows\System\bJkfFbL.exe
  C:\Windows\System\bJkfFbL.exe
  2⤵
  PID:7500
- C:\Windows\System\ZUaOCga.exe
  C:\Windows\System\ZUaOCga.exe
  2⤵
  PID:7596
- C:\Windows\System\meINNkW.exe
  C:\Windows\System\meINNkW.exe
  2⤵
  PID:7648
- C:\Windows\System\RNcBfTO.exe
  C:\Windows\System\RNcBfTO.exe
  2⤵
  PID:7704
- C:\Windows\System\IQWNOTK.exe
  C:\Windows\System\IQWNOTK.exe
  2⤵
  PID:7768
- C:\Windows\System\tMhFmEN.exe
  C:\Windows\System\tMhFmEN.exe
  2⤵
  PID:7820
- C:\Windows\System\DlZuPKv.exe
  C:\Windows\System\DlZuPKv.exe
  2⤵
  PID:7840
- C:\Windows\System\RkzuwCI.exe
  C:\Windows\System\RkzuwCI.exe
  2⤵
  PID:7972
- C:\Windows\System\MRsDbRZ.exe
  C:\Windows\System\MRsDbRZ.exe
  2⤵
  PID:8060
- C:\Windows\System\epnaSrx.exe
  C:\Windows\System\epnaSrx.exe
  2⤵
  PID:8040
- C:\Windows\System\FzbIsPh.exe
  C:\Windows\System\FzbIsPh.exe
  2⤵
  PID:8156
- C:\Windows\System\dCYjEUO.exe
  C:\Windows\System\dCYjEUO.exe
  2⤵
  PID:7236
- C:\Windows\System\OJqCkTw.exe
  C:\Windows\System\OJqCkTw.exe
  2⤵
  PID:7328
- C:\Windows\System\fpzildF.exe
  C:\Windows\System\fpzildF.exe
  2⤵
  PID:7396
- C:\Windows\System\OmHukMa.exe
  C:\Windows\System\OmHukMa.exe
  2⤵
  PID:7584
- C:\Windows\System\aXqxHvd.exe
  C:\Windows\System\aXqxHvd.exe
  2⤵
  PID:7696
- C:\Windows\System\fpeAhYr.exe
  C:\Windows\System\fpeAhYr.exe
  2⤵
  PID:7812
- C:\Windows\System\OUROWVk.exe
  C:\Windows\System\OUROWVk.exe
  2⤵
  PID:8012
- C:\Windows\System\XzEqHxo.exe
  C:\Windows\System\XzEqHxo.exe
  2⤵
  PID:8176
- C:\Windows\System\XQDHXnD.exe
  C:\Windows\System\XQDHXnD.exe
  2⤵
  PID:7556
- C:\Windows\System\vfSstKw.exe
  C:\Windows\System\vfSstKw.exe
  2⤵
  PID:7728
- C:\Windows\System\gBqIfhs.exe
  C:\Windows\System\gBqIfhs.exe
  2⤵
  PID:8208
- C:\Windows\System\zPpENMX.exe
  C:\Windows\System\zPpENMX.exe
  2⤵
  PID:8256
- C:\Windows\System\bgyVxMj.exe
  C:\Windows\System\bgyVxMj.exe
  2⤵
  PID:8280
- C:\Windows\System\DejljmY.exe
  C:\Windows\System\DejljmY.exe
  2⤵
  PID:8316
- C:\Windows\System\uhzRtes.exe
  C:\Windows\System\uhzRtes.exe
  2⤵
  PID:8336
- C:\Windows\System\xiNMiqK.exe
  C:\Windows\System\xiNMiqK.exe
  2⤵
  PID:8384
- C:\Windows\System\XtQpPxM.exe
  C:\Windows\System\XtQpPxM.exe
  2⤵
  PID:8416
- C:\Windows\System\DoFbqyo.exe
  C:\Windows\System\DoFbqyo.exe
  2⤵
  PID:8440
- C:\Windows\System\qFsmSLE.exe
  C:\Windows\System\qFsmSLE.exe
  2⤵
  PID:8464
- C:\Windows\System\vUANYAw.exe
  C:\Windows\System\vUANYAw.exe
  2⤵
  PID:8500
- C:\Windows\System\GJoCOld.exe
  C:\Windows\System\GJoCOld.exe
  2⤵
  PID:8524
- C:\Windows\System\Bjexldv.exe
  C:\Windows\System\Bjexldv.exe
  2⤵
  PID:8544
- C:\Windows\System\WvrkEMd.exe
  C:\Windows\System\WvrkEMd.exe
  2⤵
  PID:8572
- C:\Windows\System\uCJAHBw.exe
  C:\Windows\System\uCJAHBw.exe
  2⤵
  PID:8612
- C:\Windows\System\bPJYqQj.exe
  C:\Windows\System\bPJYqQj.exe
  2⤵
  PID:8644
- C:\Windows\System\uUekONV.exe
  C:\Windows\System\uUekONV.exe
  2⤵
  PID:8664
- C:\Windows\System\nsYutAm.exe
  C:\Windows\System\nsYutAm.exe
  2⤵
  PID:8684
- C:\Windows\System\ibWNtHK.exe
  C:\Windows\System\ibWNtHK.exe
  2⤵
  PID:8708
- C:\Windows\System\kRRqnZX.exe
  C:\Windows\System\kRRqnZX.exe
  2⤵
  PID:8740
- C:\Windows\System\ptHysXj.exe
  C:\Windows\System\ptHysXj.exe
  2⤵
  PID:8784
- C:\Windows\System\tzjPPGp.exe
  C:\Windows\System\tzjPPGp.exe
  2⤵
  PID:8804
- C:\Windows\System\UaBckSI.exe
  C:\Windows\System\UaBckSI.exe
  2⤵
  PID:8832
- C:\Windows\System\JmjkvpJ.exe
  C:\Windows\System\JmjkvpJ.exe
  2⤵
  PID:8868
- C:\Windows\System\RuLQlvG.exe
  C:\Windows\System\RuLQlvG.exe
  2⤵
  PID:8888
- C:\Windows\System\rassKOc.exe
  C:\Windows\System\rassKOc.exe
  2⤵
  PID:8916
- C:\Windows\System\BUpQjRl.exe
  C:\Windows\System\BUpQjRl.exe
  2⤵
  PID:8940
- C:\Windows\System\DxnzBsd.exe
  C:\Windows\System\DxnzBsd.exe
  2⤵
  PID:8960
- C:\Windows\System\zVlfWJZ.exe
  C:\Windows\System\zVlfWJZ.exe
  2⤵
  PID:9000
- C:\Windows\System\AFHUbdw.exe
  C:\Windows\System\AFHUbdw.exe
  2⤵
  PID:9032
- C:\Windows\System\uvPlaDo.exe
  C:\Windows\System\uvPlaDo.exe
  2⤵
  PID:9072
- C:\Windows\System\EdheWJi.exe
  C:\Windows\System\EdheWJi.exe
  2⤵
  PID:9088
- C:\Windows\System\Opwbbcx.exe
  C:\Windows\System\Opwbbcx.exe
  2⤵
  PID:9112
- C:\Windows\System\kSOqvsO.exe
  C:\Windows\System\kSOqvsO.exe
  2⤵
  PID:9132
- C:\Windows\System\dVaiAmJ.exe
  C:\Windows\System\dVaiAmJ.exe
  2⤵
  PID:9168
- C:\Windows\System\yQkIffX.exe
  C:\Windows\System\yQkIffX.exe
  2⤵
  PID:9212
- C:\Windows\System\nCwNHFc.exe
  C:\Windows\System\nCwNHFc.exe
  2⤵
  PID:5936
- C:\Windows\System\psshVUp.exe
  C:\Windows\System\psshVUp.exe
  2⤵
  PID:8328
- C:\Windows\System\XURqgFf.exe
  C:\Windows\System\XURqgFf.exe
  2⤵
  PID:8356
- C:\Windows\System\dKATbwh.exe
  C:\Windows\System\dKATbwh.exe
  2⤵
  PID:8400
- C:\Windows\System\KcSbWry.exe
  C:\Windows\System\KcSbWry.exe
  2⤵
  PID:8432
- C:\Windows\System\nsoCNea.exe
  C:\Windows\System\nsoCNea.exe
  2⤵
  PID:8452
- C:\Windows\System\AOpibyR.exe
  C:\Windows\System\AOpibyR.exe
  2⤵
  PID:8508
- C:\Windows\System\hLjmMjT.exe
  C:\Windows\System\hLjmMjT.exe
  2⤵
  PID:8540
- C:\Windows\System\jflMxqa.exe
  C:\Windows\System\jflMxqa.exe
  2⤵
  PID:8660
- C:\Windows\System\JjXDNET.exe
  C:\Windows\System\JjXDNET.exe
  2⤵
  PID:3740
- C:\Windows\System\JOCTVUi.exe
  C:\Windows\System\JOCTVUi.exe
  2⤵
  PID:8796
- C:\Windows\System\SLUiaxm.exe
  C:\Windows\System\SLUiaxm.exe
  2⤵
  PID:8848
- C:\Windows\System\cvITeqT.exe
  C:\Windows\System\cvITeqT.exe
  2⤵
  PID:8952
- C:\Windows\System\zTtTruh.exe
  C:\Windows\System\zTtTruh.exe
  2⤵
  PID:8956
- C:\Windows\System\HrClCPl.exe
  C:\Windows\System\HrClCPl.exe
  2⤵
  PID:9068
- C:\Windows\System\akfSuJe.exe
  C:\Windows\System\akfSuJe.exe
  2⤵
  PID:9080
- C:\Windows\System\sdpahHl.exe
  C:\Windows\System\sdpahHl.exe
  2⤵
  PID:9196
- C:\Windows\System\HITfDzJ.exe
  C:\Windows\System\HITfDzJ.exe
  2⤵
  PID:8604
- C:\Windows\System\ePMoIdk.exe
  C:\Windows\System\ePMoIdk.exe
  2⤵
  PID:8264
- C:\Windows\System\JPPNTyC.exe
  C:\Windows\System\JPPNTyC.exe
  2⤵
  PID:8348
- C:\Windows\System\PpsNrht.exe
  C:\Windows\System\PpsNrht.exe
  2⤵
  PID:8652
- C:\Windows\System\KEwWZpn.exe
  C:\Windows\System\KEwWZpn.exe
  2⤵
  PID:8820
- C:\Windows\System\nhcBzGp.exe
  C:\Windows\System\nhcBzGp.exe
  2⤵
  PID:9052
- C:\Windows\System\SwcbOxx.exe
  C:\Windows\System\SwcbOxx.exe
  2⤵
  PID:8812
- C:\Windows\System\FQupUKa.exe
  C:\Windows\System\FQupUKa.exe
  2⤵
  PID:8104
- C:\Windows\System\JBaGVKR.exe
  C:\Windows\System\JBaGVKR.exe
  2⤵
  PID:7552
- C:\Windows\System\hIPhuJZ.exe
  C:\Windows\System\hIPhuJZ.exe
  2⤵
  PID:8424
- C:\Windows\System\vvXNhdV.exe
  C:\Windows\System\vvXNhdV.exe
  2⤵
  PID:4328
- C:\Windows\System\KAhxByt.exe
  C:\Windows\System\KAhxByt.exe
  2⤵
  PID:8636
- C:\Windows\System\oAyezCN.exe
  C:\Windows\System\oAyezCN.exe
  2⤵
  PID:220
- C:\Windows\System\OsDPwae.exe
  C:\Windows\System\OsDPwae.exe
  2⤵
  PID:8244
- C:\Windows\System\uNlbSyd.exe
  C:\Windows\System\uNlbSyd.exe
  2⤵
  PID:8924
- C:\Windows\System\glLArxX.exe
  C:\Windows\System\glLArxX.exe
  2⤵
  PID:4276
- C:\Windows\System\qHsRjoa.exe
  C:\Windows\System\qHsRjoa.exe
  2⤵
  PID:9228
- C:\Windows\System\rAYnQlI.exe
  C:\Windows\System\rAYnQlI.exe
  2⤵
  PID:9252
- C:\Windows\System\NebciRZ.exe
  C:\Windows\System\NebciRZ.exe
  2⤵
  PID:9296
- C:\Windows\System\Gltcwfw.exe
  C:\Windows\System\Gltcwfw.exe
  2⤵
  PID:9332
- C:\Windows\System\whasmOD.exe
  C:\Windows\System\whasmOD.exe
  2⤵
  PID:9356
- C:\Windows\System\NOTgHgt.exe
  C:\Windows\System\NOTgHgt.exe
  2⤵
  PID:9372
- C:\Windows\System\PPElHOI.exe
  C:\Windows\System\PPElHOI.exe
  2⤵
  PID:9420
- C:\Windows\System\ZkJMKjN.exe
  C:\Windows\System\ZkJMKjN.exe
  2⤵
  PID:9436
- C:\Windows\System\LdfkBTZ.exe
  C:\Windows\System\LdfkBTZ.exe
  2⤵
  PID:9464
- C:\Windows\System\WOGfxDs.exe
  C:\Windows\System\WOGfxDs.exe
  2⤵
  PID:9484
- C:\Windows\System\ZVRKeTc.exe
  C:\Windows\System\ZVRKeTc.exe
  2⤵
  PID:9504
- C:\Windows\System\SRTtTkK.exe
  C:\Windows\System\SRTtTkK.exe
  2⤵
  PID:9536
- C:\Windows\System\pQVPTlx.exe
  C:\Windows\System\pQVPTlx.exe
  2⤵
  PID:9556
- C:\Windows\System\fRioOQo.exe
  C:\Windows\System\fRioOQo.exe
  2⤵
  PID:9604
- C:\Windows\System\eFiMVqL.exe
  C:\Windows\System\eFiMVqL.exe
  2⤵
  PID:9632
- C:\Windows\System\KesvFiv.exe
  C:\Windows\System\KesvFiv.exe
  2⤵
  PID:9652
- C:\Windows\System\wyElsYO.exe
  C:\Windows\System\wyElsYO.exe
  2⤵
  PID:9676
- C:\Windows\System\YdkCpIC.exe
  C:\Windows\System\YdkCpIC.exe
  2⤵
  PID:9700
- C:\Windows\System\AVMdTGg.exe
  C:\Windows\System\AVMdTGg.exe
  2⤵
  PID:9740
- C:\Windows\System\dDFxYfh.exe
  C:\Windows\System\dDFxYfh.exe
  2⤵
  PID:9772
- C:\Windows\System\nphFofr.exe
  C:\Windows\System\nphFofr.exe
  2⤵
  PID:9808
- C:\Windows\System\FMPlCxC.exe
  C:\Windows\System\FMPlCxC.exe
  2⤵
  PID:9828
- C:\Windows\System\HBoNiWt.exe
  C:\Windows\System\HBoNiWt.exe
  2⤵
  PID:9852
- C:\Windows\System\ZevKxGb.exe
  C:\Windows\System\ZevKxGb.exe
  2⤵
  PID:9872
- C:\Windows\System\TOLnLBF.exe
  C:\Windows\System\TOLnLBF.exe
  2⤵
  PID:9892
- C:\Windows\System\dwVYYcN.exe
  C:\Windows\System\dwVYYcN.exe
  2⤵
  PID:9928
- C:\Windows\System\SpZpPjk.exe
  C:\Windows\System\SpZpPjk.exe
  2⤵
  PID:9952
- C:\Windows\System\hJFYVsa.exe
  C:\Windows\System\hJFYVsa.exe
  2⤵
  PID:9972
- C:\Windows\System\oXbzLfN.exe
  C:\Windows\System\oXbzLfN.exe
  2⤵
  PID:10012
- C:\Windows\System\QOqrwQU.exe
  C:\Windows\System\QOqrwQU.exe
  2⤵
  PID:10036
- C:\Windows\System\LulHrsC.exe
  C:\Windows\System\LulHrsC.exe
  2⤵
  PID:10068
- C:\Windows\System\yZAFZOc.exe
  C:\Windows\System\yZAFZOc.exe
  2⤵
  PID:10096
- C:\Windows\System\lfOzzDV.exe
  C:\Windows\System\lfOzzDV.exe
  2⤵
  PID:10136
- C:\Windows\System\gwOneGs.exe
  C:\Windows\System\gwOneGs.exe
  2⤵
  PID:10160
- C:\Windows\System\LFtkqcJ.exe
  C:\Windows\System\LFtkqcJ.exe
  2⤵
  PID:10176
- C:\Windows\System\kTjuEXZ.exe
  C:\Windows\System\kTjuEXZ.exe
  2⤵
  PID:10196
- C:\Windows\System\LIyZEHz.exe
  C:\Windows\System\LIyZEHz.exe
  2⤵
  PID:10216
- C:\Windows\System\oSUnmVv.exe
  C:\Windows\System\oSUnmVv.exe
  2⤵
  PID:9240
- C:\Windows\System\KQWtOoS.exe
  C:\Windows\System\KQWtOoS.exe
  2⤵
  PID:9236
- C:\Windows\System\GyuZWci.exe
  C:\Windows\System\GyuZWci.exe
  2⤵
  PID:9284
- C:\Windows\System\ukSDzLb.exe
  C:\Windows\System\ukSDzLb.exe
  2⤵
  PID:9328
- C:\Windows\System\quTaRDX.exe
  C:\Windows\System\quTaRDX.exe
  2⤵
  PID:9472
- C:\Windows\System\dtXFYBs.exe
  C:\Windows\System\dtXFYBs.exe
  2⤵
  PID:9460
- C:\Windows\System\ZrgDlZb.exe
  C:\Windows\System\ZrgDlZb.exe
  2⤵
  PID:9524
- C:\Windows\System\oRQysmH.exe
  C:\Windows\System\oRQysmH.exe
  2⤵
  PID:9620
- C:\Windows\System\ccZkkwH.exe
  C:\Windows\System\ccZkkwH.exe
  2⤵
  PID:9664
- C:\Windows\System\yBhRzMA.exe
  C:\Windows\System\yBhRzMA.exe
  2⤵
  PID:9708
- C:\Windows\System\HyuwHrK.exe
  C:\Windows\System\HyuwHrK.exe
  2⤵
  PID:464
- C:\Windows\System\MklmISc.exe
  C:\Windows\System\MklmISc.exe
  2⤵
  PID:9848
- C:\Windows\System\KTZumJl.exe
  C:\Windows\System\KTZumJl.exe
  2⤵
  PID:10020
- C:\Windows\System\vkGJXWU.exe
  C:\Windows\System\vkGJXWU.exe
  2⤵
  PID:10076
- C:\Windows\System\JQHsxCq.exe
  C:\Windows\System\JQHsxCq.exe
  2⤵
  PID:10128
- C:\Windows\System\oHFUmAb.exe
  C:\Windows\System\oHFUmAb.exe
  2⤵
  PID:10168
- C:\Windows\System\eafsAdP.exe
  C:\Windows\System\eafsAdP.exe
  2⤵
  PID:10192
- C:\Windows\System\qEbtUzJ.exe
  C:\Windows\System\qEbtUzJ.exe
  2⤵
  PID:9272
- C:\Windows\System\jXfboPX.exe
  C:\Windows\System\jXfboPX.exe
  2⤵
  PID:9552
- C:\Windows\System\WhRlOqi.exe
  C:\Windows\System\WhRlOqi.exe
  2⤵
  PID:9492
- C:\Windows\System\ulqaHMk.exe
  C:\Windows\System\ulqaHMk.exe
  2⤵
  PID:9908
- C:\Windows\System\KSExwds.exe
  C:\Windows\System\KSExwds.exe
  2⤵
  PID:10000
- C:\Windows\System\mjpcjiv.exe
  C:\Windows\System\mjpcjiv.exe
  2⤵
  PID:10112
- C:\Windows\System\wyNVnFX.exe
  C:\Windows\System\wyNVnFX.exe
  2⤵
  PID:10204
- C:\Windows\System\CfXQywR.exe
  C:\Windows\System\CfXQywR.exe
  2⤵
  PID:9396
- C:\Windows\System\ZgucNNK.exe
  C:\Windows\System\ZgucNNK.exe
  2⤵
  PID:9644
- C:\Windows\System\sMKwoDH.exe
  C:\Windows\System\sMKwoDH.exe
  2⤵
  PID:5040
- C:\Windows\System\cHbZYuH.exe
  C:\Windows\System\cHbZYuH.exe
  2⤵
  PID:8276
- C:\Windows\System\vnzrKtr.exe
  C:\Windows\System\vnzrKtr.exe
  2⤵
  PID:10048
- C:\Windows\System\vzmvRoY.exe
  C:\Windows\System\vzmvRoY.exe
  2⤵
  PID:10276
- C:\Windows\System\uxwUpVk.exe
  C:\Windows\System\uxwUpVk.exe
  2⤵
  PID:10296
- C:\Windows\System\WRobrYs.exe
  C:\Windows\System\WRobrYs.exe
  2⤵
  PID:10336
- C:\Windows\System\jSEyKot.exe
  C:\Windows\System\jSEyKot.exe
  2⤵
  PID:10360
- C:\Windows\System\VLawzIW.exe
  C:\Windows\System\VLawzIW.exe
  2⤵
  PID:10376
- C:\Windows\System\vtXIvgd.exe
  C:\Windows\System\vtXIvgd.exe
  2⤵
  PID:10400
- C:\Windows\System\gRswEXx.exe
  C:\Windows\System\gRswEXx.exe
  2⤵
  PID:10420
- C:\Windows\System\wCEmseS.exe
  C:\Windows\System\wCEmseS.exe
  2⤵
  PID:10440
- C:\Windows\System\qLIGDcv.exe
  C:\Windows\System\qLIGDcv.exe
  2⤵
  PID:10464
- C:\Windows\System\Qxuegrj.exe
  C:\Windows\System\Qxuegrj.exe
  2⤵
  PID:10484
- C:\Windows\System\pxOIcVJ.exe
  C:\Windows\System\pxOIcVJ.exe
  2⤵
  PID:10512
- C:\Windows\System\MBoCtZa.exe
  C:\Windows\System\MBoCtZa.exe
  2⤵
  PID:10528
- C:\Windows\System\qcolFvW.exe
  C:\Windows\System\qcolFvW.exe
  2⤵
  PID:10548
- C:\Windows\System\CaoUhXd.exe
  C:\Windows\System\CaoUhXd.exe
  2⤵
  PID:10576
- C:\Windows\System\DgPCvSv.exe
  C:\Windows\System\DgPCvSv.exe
  2⤵
  PID:10604
- C:\Windows\System\DHuaavR.exe
  C:\Windows\System\DHuaavR.exe
  2⤵
  PID:10632
- C:\Windows\System\GRZvkhh.exe
  C:\Windows\System\GRZvkhh.exe
  2⤵
  PID:10648
- C:\Windows\System\ROlpJzX.exe
  C:\Windows\System\ROlpJzX.exe
  2⤵
  PID:10712
- C:\Windows\System\etVobrH.exe
  C:\Windows\System\etVobrH.exe
  2⤵
  PID:10788
- C:\Windows\System\FyXdnCV.exe
  C:\Windows\System\FyXdnCV.exe
  2⤵
  PID:10832
- C:\Windows\System\QMSOtUl.exe
  C:\Windows\System\QMSOtUl.exe
  2⤵
  PID:10848
- C:\Windows\System\abCLlRf.exe
  C:\Windows\System\abCLlRf.exe
  2⤵
  PID:10868
- C:\Windows\System\IolGeqa.exe
  C:\Windows\System\IolGeqa.exe
  2⤵
  PID:10892
- C:\Windows\System\zNQdLkd.exe
  C:\Windows\System\zNQdLkd.exe
  2⤵
  PID:10912
- C:\Windows\System\yIGmYkF.exe
  C:\Windows\System\yIGmYkF.exe
  2⤵
  PID:10936
- C:\Windows\System\iPwLMww.exe
  C:\Windows\System\iPwLMww.exe
  2⤵
  PID:10972
- C:\Windows\System\ffIZsRi.exe
  C:\Windows\System\ffIZsRi.exe
  2⤵
  PID:11012
- C:\Windows\System\VkgEfyn.exe
  C:\Windows\System\VkgEfyn.exe
  2⤵
  PID:11032
- C:\Windows\System\IaXCdle.exe
  C:\Windows\System\IaXCdle.exe
  2⤵
  PID:11072
- C:\Windows\System\DdnCIhN.exe
  C:\Windows\System\DdnCIhN.exe
  2⤵
  PID:11096
- C:\Windows\System\xbCzzrY.exe
  C:\Windows\System\xbCzzrY.exe
  2⤵
  PID:11136
- C:\Windows\System\ogmuhmW.exe
  C:\Windows\System\ogmuhmW.exe
  2⤵
  PID:11168
- C:\Windows\System\gsuuCGy.exe
  C:\Windows\System\gsuuCGy.exe
  2⤵
  PID:11204
- C:\Windows\System\SYzLwLb.exe
  C:\Windows\System\SYzLwLb.exe
  2⤵
  PID:11228
- C:\Windows\System\GAvwzmc.exe
  C:\Windows\System\GAvwzmc.exe
  2⤵
  PID:11256
- C:\Windows\System\sjtzXXd.exe
  C:\Windows\System\sjtzXXd.exe
  2⤵
  PID:2388
- C:\Windows\System\jHTajdN.exe
  C:\Windows\System\jHTajdN.exe
  2⤵
  PID:3796
- C:\Windows\System\olWMjTA.exe
  C:\Windows\System\olWMjTA.exe
  2⤵
  PID:10292
- C:\Windows\System\YEaffbD.exe
  C:\Windows\System\YEaffbD.exe
  2⤵
  PID:10316
- C:\Windows\System\OecfGcG.exe
  C:\Windows\System\OecfGcG.exe
  2⤵
  PID:10436
- C:\Windows\System\XUaJQUM.exe
  C:\Windows\System\XUaJQUM.exe
  2⤵
  PID:10332
- C:\Windows\System\KyNHLEE.exe
  C:\Windows\System\KyNHLEE.exe
  2⤵
  PID:10372
- C:\Windows\System\zsXqKRa.exe
  C:\Windows\System\zsXqKRa.exe
  2⤵
  PID:10412
- C:\Windows\System\enmdZCd.exe
  C:\Windows\System\enmdZCd.exe
  2⤵
  PID:10524
- C:\Windows\System\gdUImvN.exe
  C:\Windows\System\gdUImvN.exe
  2⤵
  PID:10612
- C:\Windows\System\QGTqfpM.exe
  C:\Windows\System\QGTqfpM.exe
  2⤵
  PID:10696
- C:\Windows\System\qSttmSj.exe
  C:\Windows\System\qSttmSj.exe
  2⤵
  PID:10812
- C:\Windows\System\UYZALoT.exe
  C:\Windows\System\UYZALoT.exe
  2⤵
  PID:10840
- C:\Windows\System\AGFuUQM.exe
  C:\Windows\System\AGFuUQM.exe
  2⤵
  PID:10880
- C:\Windows\System\YsjWdoZ.exe
  C:\Windows\System\YsjWdoZ.exe
  2⤵
  PID:10964
- C:\Windows\System\IWSHnkM.exe
  C:\Windows\System\IWSHnkM.exe
  2⤵
  PID:11088
- C:\Windows\System\oxrdVAh.exe
  C:\Windows\System\oxrdVAh.exe
  2⤵
  PID:11156
- C:\Windows\System\vqRJJRN.exe
  C:\Windows\System\vqRJJRN.exe
  2⤵
  PID:11224
- C:\Windows\System\LyjSItq.exe
  C:\Windows\System\LyjSItq.exe
  2⤵
  PID:9340
- C:\Windows\System\jjifijn.exe
  C:\Windows\System\jjifijn.exe
  2⤵
  PID:10268
- C:\Windows\System\tiMfIQE.exe
  C:\Windows\System\tiMfIQE.exe
  2⤵
  PID:10356
- C:\Windows\System\gavKoOh.exe
  C:\Windows\System\gavKoOh.exe
  2⤵
  PID:10616
- C:\Windows\System\LJmHoCI.exe
  C:\Windows\System\LJmHoCI.exe
  2⤵
  PID:10724
- C:\Windows\System\qNYuchT.exe
  C:\Windows\System\qNYuchT.exe
  2⤵
  PID:10828
- C:\Windows\System\PdUgiWX.exe
  C:\Windows\System\PdUgiWX.exe
  2⤵
  PID:11124
- C:\Windows\System\VJVUjRw.exe
  C:\Windows\System\VJVUjRw.exe
  2⤵
  PID:11068
- C:\Windows\System\rHGiBnp.exe
  C:\Windows\System\rHGiBnp.exe
  2⤵
  PID:10572
- C:\Windows\System\apEPQMc.exe
  C:\Windows\System\apEPQMc.exe
  2⤵
  PID:10596
- C:\Windows\System\KdtwlgQ.exe
  C:\Windows\System\KdtwlgQ.exe
  2⤵
  PID:11020
- C:\Windows\System\akBElVM.exe
  C:\Windows\System\akBElVM.exe
  2⤵
  PID:10476
- C:\Windows\System\LDYsETY.exe
  C:\Windows\System\LDYsETY.exe
  2⤵
  PID:11268
- C:\Windows\System\SiZMkcr.exe
  C:\Windows\System\SiZMkcr.exe
  2⤵
  PID:11292
- C:\Windows\System\WpicvlF.exe
  C:\Windows\System\WpicvlF.exe
  2⤵
  PID:11308
- C:\Windows\System\vuKhxlV.exe
  C:\Windows\System\vuKhxlV.exe
  2⤵
  PID:11344
- C:\Windows\System\IapVsri.exe
  C:\Windows\System\IapVsri.exe
  2⤵
  PID:11388
- C:\Windows\System\usrrpPF.exe
  C:\Windows\System\usrrpPF.exe
  2⤵
  PID:11420
- C:\Windows\System\BqJLPca.exe
  C:\Windows\System\BqJLPca.exe
  2⤵
  PID:11448
- C:\Windows\System\FSzedcb.exe
  C:\Windows\System\FSzedcb.exe
  2⤵
  PID:11476
- C:\Windows\System\JjaVqeT.exe
  C:\Windows\System\JjaVqeT.exe
  2⤵
  PID:11500
- C:\Windows\System\rdbjjKv.exe
  C:\Windows\System\rdbjjKv.exe
  2⤵
  PID:11520
- C:\Windows\System\aHbfzPj.exe
  C:\Windows\System\aHbfzPj.exe
  2⤵
  PID:11548
- C:\Windows\System\uhpRHYp.exe
  C:\Windows\System\uhpRHYp.exe
  2⤵
  PID:11580
- C:\Windows\System\EaJPrCw.exe
  C:\Windows\System\EaJPrCw.exe
  2⤵
  PID:11604
- C:\Windows\System\cbTitYU.exe
  C:\Windows\System\cbTitYU.exe
  2⤵
  PID:11620
- C:\Windows\System\VthMMAW.exe
  C:\Windows\System\VthMMAW.exe
  2⤵
  PID:11648
- C:\Windows\System\SUCaZDA.exe
  C:\Windows\System\SUCaZDA.exe
  2⤵
  PID:11676
- C:\Windows\System\KMWVBjp.exe
  C:\Windows\System\KMWVBjp.exe
  2⤵
  PID:11696
- C:\Windows\System\sUGfLsp.exe
  C:\Windows\System\sUGfLsp.exe
  2⤵
  PID:11716
- C:\Windows\System\jKsQCGh.exe
  C:\Windows\System\jKsQCGh.exe
  2⤵
  PID:11752
- C:\Windows\System\lpumnOI.exe
  C:\Windows\System\lpumnOI.exe
  2⤵
  PID:11780
- C:\Windows\System\ecEoyOU.exe
  C:\Windows\System\ecEoyOU.exe
  2⤵
  PID:11832
- C:\Windows\System\VdhIbqC.exe
  C:\Windows\System\VdhIbqC.exe
  2⤵
  PID:11856
- C:\Windows\System\QKhfWhK.exe
  C:\Windows\System\QKhfWhK.exe
  2⤵
  PID:11880
- C:\Windows\System\FsBvmHH.exe
  C:\Windows\System\FsBvmHH.exe
  2⤵
  PID:11904
- C:\Windows\System\DYUpXYt.exe
  C:\Windows\System\DYUpXYt.exe
  2⤵
  PID:11928
- C:\Windows\System\UQcgNRh.exe
  C:\Windows\System\UQcgNRh.exe
  2⤵
  PID:11948
- C:\Windows\System\WJEAVpx.exe
  C:\Windows\System\WJEAVpx.exe
  2⤵
  PID:11968
- C:\Windows\System\GJeYODB.exe
  C:\Windows\System\GJeYODB.exe
  2⤵
  PID:11984
- C:\Windows\System\zAKcXuo.exe
  C:\Windows\System\zAKcXuo.exe
  2⤵
  PID:12004
- C:\Windows\System\dKUPeXr.exe
  C:\Windows\System\dKUPeXr.exe
  2⤵
  PID:12028
- C:\Windows\System\yxmFcEp.exe
  C:\Windows\System\yxmFcEp.exe
  2⤵
  PID:12108
- C:\Windows\System\zQKKeGF.exe
  C:\Windows\System\zQKKeGF.exe
  2⤵
  PID:12128
- C:\Windows\System\JazceXd.exe
  C:\Windows\System\JazceXd.exe
  2⤵
  PID:12152
- C:\Windows\System\TNtJrHo.exe
  C:\Windows\System\TNtJrHo.exe
  2⤵
  PID:12168
- C:\Windows\System\CPkyQin.exe
  C:\Windows\System\CPkyQin.exe
  2⤵
  PID:12192
- C:\Windows\System\KwajrrH.exe
  C:\Windows\System\KwajrrH.exe
  2⤵
  PID:12208
- C:\Windows\System\UlCkFRI.exe
  C:\Windows\System\UlCkFRI.exe
  2⤵
  PID:12228
- C:\Windows\System\SBEhiCi.exe
  C:\Windows\System\SBEhiCi.exe
  2⤵
  PID:12252
- C:\Windows\System\sWNEXjb.exe
  C:\Windows\System\sWNEXjb.exe
  2⤵
  PID:12272
- C:\Windows\System\YiNZcgd.exe
  C:\Windows\System\YiNZcgd.exe
  2⤵
  PID:10504
- C:\Windows\System\dDETLfU.exe
  C:\Windows\System\dDETLfU.exe
  2⤵
  PID:11412
- C:\Windows\System\huBnxRP.exe
  C:\Windows\System\huBnxRP.exe
  2⤵
  PID:11472
- C:\Windows\System\QwkuEvK.exe
  C:\Windows\System\QwkuEvK.exe
  2⤵
  PID:11544
- C:\Windows\System\SjVNYim.exe
  C:\Windows\System\SjVNYim.exe
  2⤵
  PID:11568
- C:\Windows\System\rzTJuyh.exe
  C:\Windows\System\rzTJuyh.exe
  2⤵
  PID:11688
- C:\Windows\System\dzVGYeC.exe
  C:\Windows\System\dzVGYeC.exe
  2⤵
  PID:11768
- C:\Windows\System\BUtwCcf.exe
  C:\Windows\System\BUtwCcf.exe
  2⤵
  PID:11872
- C:\Windows\System\sbvviZl.exe
  C:\Windows\System\sbvviZl.exe
  2⤵
  PID:11896
- C:\Windows\System\jaFKxKF.exe
  C:\Windows\System\jaFKxKF.exe
  2⤵
  PID:11964
- C:\Windows\System\PuywVrb.exe
  C:\Windows\System\PuywVrb.exe
  2⤵
  PID:12056
- C:\Windows\System\UWimkOe.exe
  C:\Windows\System\UWimkOe.exe
  2⤵
  PID:12116
- C:\Windows\System\NNQZkMA.exe
  C:\Windows\System\NNQZkMA.exe
  2⤵
  PID:4640
- C:\Windows\System\aRfKKRq.exe
  C:\Windows\System\aRfKKRq.exe
  2⤵
  PID:12188
- C:\Windows\System\cnoQpcv.exe
  C:\Windows\System\cnoQpcv.exe
  2⤵
  PID:12264
- C:\Windows\System\nQZWNba.exe
  C:\Windows\System\nQZWNba.exe
  2⤵
  PID:11368
- C:\Windows\System\kifMIOE.exe
  C:\Windows\System\kifMIOE.exe
  2⤵
  PID:11444
- C:\Windows\System\JEFdIiR.exe
  C:\Windows\System\JEFdIiR.exe
  2⤵
  PID:11416
- C:\Windows\System\OIGraNM.exe
  C:\Windows\System\OIGraNM.exe
  2⤵
  PID:11664
- C:\Windows\System\EoSQNhN.exe
  C:\Windows\System\EoSQNhN.exe
  2⤵
  PID:11848
- C:\Windows\System\xhuorEU.exe
  C:\Windows\System\xhuorEU.exe
  2⤵
  PID:10900
- C:\Windows\System\gHtMTtZ.exe
  C:\Windows\System\gHtMTtZ.exe
  2⤵
  PID:10124
- C:\Windows\System\ptWYCKk.exe
  C:\Windows\System\ptWYCKk.exe
  2⤵
  PID:11576
- C:\Windows\System\sYPexdW.exe
  C:\Windows\System\sYPexdW.exe
  2⤵
  PID:12300
- C:\Windows\System\dObmtsV.exe
  C:\Windows\System\dObmtsV.exe
  2⤵
  PID:12316
- C:\Windows\System\MzhyCdQ.exe
  C:\Windows\System\MzhyCdQ.exe
  2⤵
  PID:12332
- C:\Windows\System\BSGtzyz.exe
  C:\Windows\System\BSGtzyz.exe
  2⤵
  PID:12352
- C:\Windows\System\qxhAauA.exe
  C:\Windows\System\qxhAauA.exe
  2⤵
  PID:12368
- C:\Windows\System\BGzJOnL.exe
  C:\Windows\System\BGzJOnL.exe
  2⤵
  PID:12444
- C:\Windows\System\vQTIqEc.exe
  C:\Windows\System\vQTIqEc.exe
  2⤵
  PID:12460
- C:\Windows\System\NMAVuqo.exe
  C:\Windows\System\NMAVuqo.exe
  2⤵
  PID:12492
- C:\Windows\System\BTplXYX.exe
  C:\Windows\System\BTplXYX.exe
  2⤵
  PID:12508
- C:\Windows\System\jtBTvJt.exe
  C:\Windows\System\jtBTvJt.exe
  2⤵
  PID:12532
- C:\Windows\System\oXTQsaK.exe
  C:\Windows\System\oXTQsaK.exe
  2⤵
  PID:12556
- C:\Windows\System\ICLTKCP.exe
  C:\Windows\System\ICLTKCP.exe
  2⤵
  PID:12580
- C:\Windows\System\wvIrIkY.exe
  C:\Windows\System\wvIrIkY.exe
  2⤵
  PID:12596
- C:\Windows\System\GQGoQRk.exe
  C:\Windows\System\GQGoQRk.exe
  2⤵
  PID:12620
- C:\Windows\System\RHhTZUF.exe
  C:\Windows\System\RHhTZUF.exe
  2⤵
  PID:12636
- C:\Windows\System\lpJxeCp.exe
  C:\Windows\System\lpJxeCp.exe
  2⤵
  PID:12652
- C:\Windows\System\dsqerMR.exe
  C:\Windows\System\dsqerMR.exe
  2⤵
  PID:12756
- C:\Windows\System\RzuGiiE.exe
  C:\Windows\System\RzuGiiE.exe
  2⤵
  PID:12780
- C:\Windows\System\zLJfEju.exe
  C:\Windows\System\zLJfEju.exe
  2⤵
  PID:12804
- C:\Windows\System\QwyoHMF.exe
  C:\Windows\System\QwyoHMF.exe
  2⤵
  PID:12824
- C:\Windows\System\IYrXgTQ.exe
  C:\Windows\System\IYrXgTQ.exe
  2⤵
  PID:12940
- C:\Windows\System\XowaEBz.exe
  C:\Windows\System\XowaEBz.exe
  2⤵
  PID:12976
- C:\Windows\System\EVZvHuv.exe
  C:\Windows\System\EVZvHuv.exe
  2⤵
  PID:13000
- C:\Windows\System\jAaVXDe.exe
  C:\Windows\System\jAaVXDe.exe
  2⤵
  PID:13020
- C:\Windows\System\UvDCutF.exe
  C:\Windows\System\UvDCutF.exe
  2⤵
  PID:13044
- C:\Windows\System\WfUORoG.exe
  C:\Windows\System\WfUORoG.exe
  2⤵
  PID:13092
- C:\Windows\System\wemTkVl.exe
  C:\Windows\System\wemTkVl.exe
  2⤵
  PID:13128
- C:\Windows\System\OEIVMcA.exe
  C:\Windows\System\OEIVMcA.exe
  2⤵
  PID:12216
- C:\Windows\System\Cditwcs.exe
  C:\Windows\System\Cditwcs.exe
  2⤵
  PID:11812
- C:\Windows\System\OOLyQNf.exe
  C:\Windows\System\OOLyQNf.exe
  2⤵
  PID:12488
- C:\Windows\System\YqgFsPm.exe
  C:\Windows\System\YqgFsPm.exe
  2⤵
  PID:1356
- C:\Windows\System\rElTRCq.exe
  C:\Windows\System\rElTRCq.exe
  2⤵
  PID:13272
- C:\Windows\System\OpuhcKK.exe
  C:\Windows\System\OpuhcKK.exe
  2⤵
  PID:13288
- C:\Windows\System\WSMULqB.exe
  C:\Windows\System\WSMULqB.exe
  2⤵
  PID:13308
- C:\Windows\System\nLfnAbC.exe
  C:\Windows\System\nLfnAbC.exe
  2⤵
  PID:12296
- C:\Windows\System\yTwCZbx.exe
  C:\Windows\System\yTwCZbx.exe
  2⤵
  PID:11616
- C:\Windows\System\KdNgmHT.exe
  C:\Windows\System\KdNgmHT.exe
  2⤵
  PID:2680
- C:\Windows\System\iBEeMMl.exe
  C:\Windows\System\iBEeMMl.exe
  2⤵
  PID:12380
- C:\Windows\System\eLcBUed.exe
  C:\Windows\System\eLcBUed.exe
  2⤵
  PID:12020
- C:\Windows\System\qKeNypg.exe
  C:\Windows\System\qKeNypg.exe
  2⤵
  PID:12312
- C:\Windows\System\hlKLrsy.exe
  C:\Windows\System\hlKLrsy.exe
  2⤵
  PID:12308
- C:\Windows\System\awqvMTk.exe
  C:\Windows\System\awqvMTk.exe
  2⤵
  PID:12260
- C:\Windows\System\aAfrTTp.exe
  C:\Windows\System\aAfrTTp.exe
  2⤵
  PID:12408
- C:\Windows\System\INOGark.exe
  C:\Windows\System\INOGark.exe
  2⤵
  PID:12632
- C:\Windows\System\Hjozkjw.exe
  C:\Windows\System\Hjozkjw.exe
  2⤵
  PID:528
- C:\Windows\System\yyasQKD.exe
  C:\Windows\System\yyasQKD.exe
  2⤵
  PID:5060
- C:\Windows\System\kwXEJVK.exe
  C:\Windows\System\kwXEJVK.exe
  2⤵
  PID:12476
- C:\Windows\System\uYxfKVW.exe
  C:\Windows\System\uYxfKVW.exe
  2⤵
  PID:5184
- C:\Windows\System\AsjailY.exe
  C:\Windows\System\AsjailY.exe
  2⤵
  PID:4748
- C:\Windows\System\XpjuOib.exe
  C:\Windows\System\XpjuOib.exe
  2⤵
  PID:12500
- C:\Windows\System\sEWejRR.exe
  C:\Windows\System\sEWejRR.exe
  2⤵
  PID:12564
- C:\Windows\System\LuPyvTr.exe
  C:\Windows\System\LuPyvTr.exe
  2⤵
  PID:12716
- C:\Windows\System\DaEVUlW.exe
  C:\Windows\System\DaEVUlW.exe
  2⤵
  PID:12752
- C:\Windows\System\QpnbYPJ.exe
  C:\Windows\System\QpnbYPJ.exe
  2⤵
  PID:12604
- C:\Windows\System\BDDlbvU.exe
  C:\Windows\System\BDDlbvU.exe
  2⤵
  PID:12772
- C:\Windows\System\QtTlTjx.exe
  C:\Windows\System\QtTlTjx.exe
  2⤵
  PID:12852
- C:\Windows\System\KlEcupP.exe
  C:\Windows\System\KlEcupP.exe
  2⤵
  PID:12800
- C:\Windows\System\fPvoYjb.exe
  C:\Windows\System\fPvoYjb.exe
  2⤵
  PID:12876
- C:\Windows\System\VKwaScg.exe
  C:\Windows\System\VKwaScg.exe
  2⤵
  PID:12996
- C:\Windows\System\yLKRBFN.exe
  C:\Windows\System\yLKRBFN.exe
  2⤵
  PID:13036
- C:\Windows\System\JFViamu.exe
  C:\Windows\System\JFViamu.exe
  2⤵
  PID:13060
- C:\Windows\System\rCbXpFN.exe
  C:\Windows\System\rCbXpFN.exe
  2⤵
  PID:13072
- C:\Windows\System\KlJQwja.exe
  C:\Windows\System\KlJQwja.exe
  2⤵
  PID:13084
- C:\Windows\System\mUAKNek.exe
  C:\Windows\System\mUAKNek.exe
  2⤵
  PID:13140
- C:\Windows\System\IXDXQvi.exe
  C:\Windows\System\IXDXQvi.exe
  2⤵
  PID:13120
- C:\Windows\System\jXkbIiD.exe
  C:\Windows\System\jXkbIiD.exe
  2⤵
  PID:2476
- C:\Windows\System\IenBhmv.exe
  C:\Windows\System\IenBhmv.exe
  2⤵
  PID:13196
- C:\Windows\System\IIvGACx.exe
  C:\Windows\System\IIvGACx.exe
  2⤵
  PID:13216
- C:\Windows\System\BfgaILR.exe
  C:\Windows\System\BfgaILR.exe
  2⤵
  PID:13188
- C:\Windows\System\kKFyzBH.exe
  C:\Windows\System\kKFyzBH.exe
  2⤵
  PID:880
- C:\Windows\System\XSPWeKM.exe
  C:\Windows\System\XSPWeKM.exe
  2⤵
  PID:13280
- C:\Windows\System\rIWkXHW.exe
  C:\Windows\System\rIWkXHW.exe
  2⤵
  PID:4852
- C:\Windows\System\uDJYQJL.exe
  C:\Windows\System\uDJYQJL.exe
  2⤵
  PID:3032
- C:\Windows\System\uPkCdXt.exe
  C:\Windows\System\uPkCdXt.exe
  2⤵
  PID:640
- C:\Windows\System\LEfDGTS.exe
  C:\Windows\System\LEfDGTS.exe
  2⤵
  PID:544
- C:\Windows\System\UDhWkeu.exe
  C:\Windows\System\UDhWkeu.exe
  2⤵
  PID:2604
- C:\Windows\System\ZcDIHvY.exe
  C:\Windows\System\ZcDIHvY.exe
  2⤵
  PID:12096
- C:\Windows\System\ENrLKer.exe
  C:\Windows\System\ENrLKer.exe
  2⤵
  PID:11532
- C:\Windows\System\ZFRlGRK.exe
  C:\Windows\System\ZFRlGRK.exe
  2⤵
  PID:11920
- C:\Windows\System\CgVSMKV.exe
  C:\Windows\System\CgVSMKV.exe
  2⤵
  PID:11560
- C:\Windows\System\cibFZHZ.exe
  C:\Windows\System\cibFZHZ.exe
  2⤵
  PID:12364
- C:\Windows\System\vJxlYUl.exe
  C:\Windows\System\vJxlYUl.exe
  2⤵
  PID:12472
- C:\Windows\System\OPKXDry.exe
  C:\Windows\System\OPKXDry.exe
  2⤵
  PID:12644
- C:\Windows\System\rbjAvWY.exe
  C:\Windows\System\rbjAvWY.exe
  2⤵
  PID:3560
- C:\Windows\System\atSuXKd.exe
  C:\Windows\System\atSuXKd.exe
  2⤵
  PID:12524
- C:\Windows\System\QaDETsV.exe
  C:\Windows\System\QaDETsV.exe
  2⤵
  PID:12544
- C:\Windows\System\AcegMcD.exe
  C:\Windows\System\AcegMcD.exe
  2⤵
  PID:12612
- C:\Windows\System\yTVQLCl.exe
  C:\Windows\System\yTVQLCl.exe
  2⤵
  PID:12932
- C:\Windows\System\pFRraAx.exe
  C:\Windows\System\pFRraAx.exe
  2⤵
  PID:12896
- C:\Windows\System\eyuYxfz.exe
  C:\Windows\System\eyuYxfz.exe
  2⤵
  PID:13008
- C:\Windows\System\lOcNboF.exe
  C:\Windows\System\lOcNboF.exe
  2⤵
  PID:13124
- C:\Windows\System\jNkqyoL.exe
  C:\Windows\System\jNkqyoL.exe
  2⤵
  PID:13112
- C:\Windows\System\hOksmYg.exe
  C:\Windows\System\hOksmYg.exe
  2⤵
  PID:13208
- C:\Windows\System\RZUhUBd.exe
  C:\Windows\System\RZUhUBd.exe
  2⤵
  PID:13172
- C:\Windows\System\ZForuHq.exe
  C:\Windows\System\ZForuHq.exe
  2⤵
  PID:13264
- C:\Windows\System\ACqanOs.exe
  C:\Windows\System\ACqanOs.exe
  2⤵
  PID:4336
- C:\Windows\System\CxMSyME.exe
  C:\Windows\System\CxMSyME.exe
  2⤵
  PID:3088
- C:\Windows\System\BQbptRA.exe
  C:\Windows\System\BQbptRA.exe
  2⤵
  PID:1888
- C:\Windows\System\MBGidBy.exe
  C:\Windows\System\MBGidBy.exe
  2⤵
  PID:11936
- C:\Windows\System\jesWkWP.exe
  C:\Windows\System\jesWkWP.exe
  2⤵
  PID:12424
- C:\Windows\System\eFXUcwx.exe
  C:\Windows\System\eFXUcwx.exe
  2⤵
  PID:11320
- C:\Windows\System\SGLKdej.exe
  C:\Windows\System\SGLKdej.exe
  2⤵
  PID:4332
- C:\Windows\System\JNDNPiz.exe
  C:\Windows\System\JNDNPiz.exe
  2⤵
  PID:12648
- C:\Windows\System\MiSjeWj.exe
  C:\Windows\System\MiSjeWj.exe
  2⤵
  PID:12592
- C:\Windows\System\tDTzuBd.exe
  C:\Windows\System\tDTzuBd.exe
  2⤵
  PID:12868
- C:\Windows\System\HFDLlOg.exe
  C:\Windows\System\HFDLlOg.exe
  2⤵
  PID:12988
- C:\Windows\System\QNofFEr.exe
  C:\Windows\System\QNofFEr.exe
  2⤵
  PID:12344
- C:\Windows\System\HrTZEaT.exe
  C:\Windows\System\HrTZEaT.exe
  2⤵
  PID:13240
- C:\Windows\System\wNvrhoX.exe
  C:\Windows\System\wNvrhoX.exe
  2⤵
  PID:1556
- C:\Windows\System\hsvjexZ.exe
  C:\Windows\System\hsvjexZ.exe
  2⤵
  PID:13304
- C:\Windows\System\zOGixSI.exe
  C:\Windows\System\zOGixSI.exe
  2⤵
  PID:12360
- C:\Windows\System\jOOyvlj.exe
  C:\Windows\System\jOOyvlj.exe
  2⤵
  PID:4472
- C:\Windows\System\OKkhVTH.exe
  C:\Windows\System\OKkhVTH.exe
  2⤵
  PID:12820
- C:\Windows\System\WNDFYIe.exe
  C:\Windows\System\WNDFYIe.exe
  2⤵
  PID:13204
- C:\Windows\System\azyJPUk.exe
  C:\Windows\System\azyJPUk.exe
  2⤵
  PID:652
- C:\Windows\System\kKiHtAM.exe
  C:\Windows\System\kKiHtAM.exe
  2⤵
  PID:10764
- C:\Windows\System\ZOszKaV.exe
  C:\Windows\System\ZOszKaV.exe
  2⤵
  PID:12860
- C:\Windows\System\PBVaOkh.exe
  C:\Windows\System\PBVaOkh.exe
  2⤵
  PID:13268
- C:\Windows\System\bCwwbgg.exe
  C:\Windows\System\bCwwbgg.exe
  2⤵
  PID:12588
- C:\Windows\System\jeogbGp.exe
  C:\Windows\System\jeogbGp.exe
  2⤵
  PID:5332
- C:\Windows\System\FtXuWEY.exe
  C:\Windows\System\FtXuWEY.exe
  2⤵
  PID:13328
- C:\Windows\System\bmQETAF.exe
  C:\Windows\System\bmQETAF.exe
  2⤵
  PID:13344
- C:\Windows\System\cNLztbj.exe
  C:\Windows\System\cNLztbj.exe
  2⤵
  PID:13360
- C:\Windows\System\RLjSbWs.exe
  C:\Windows\System\RLjSbWs.exe
  2⤵
  PID:13376
- C:\Windows\System\nJqHBLA.exe
  C:\Windows\System\nJqHBLA.exe
  2⤵
  PID:13392
- C:\Windows\System\FeyvTPM.exe
  C:\Windows\System\FeyvTPM.exe
  2⤵
  PID:13408
- C:\Windows\System\VooAPua.exe
  C:\Windows\System\VooAPua.exe
  2⤵
  PID:13424
- C:\Windows\System\lwTNOUh.exe
  C:\Windows\System\lwTNOUh.exe
  2⤵
  PID:13440
- C:\Windows\System\YeBXaOl.exe
  C:\Windows\System\YeBXaOl.exe
  2⤵
  PID:13456
- C:\Windows\System\JYnFqoq.exe
  C:\Windows\System\JYnFqoq.exe
  2⤵
  PID:13472
- C:\Windows\System\xUymXkF.exe
  C:\Windows\System\xUymXkF.exe
  2⤵
  PID:13488
- C:\Windows\System\FELNmTD.exe
  C:\Windows\System\FELNmTD.exe
  2⤵
  PID:13504
- C:\Windows\System\ycgJUBf.exe
  C:\Windows\System\ycgJUBf.exe
  2⤵
  PID:13520
- C:\Windows\System\IPleOMi.exe
  C:\Windows\System\IPleOMi.exe
  2⤵
  PID:13536
- C:\Windows\System\RjpahXH.exe
  C:\Windows\System\RjpahXH.exe
  2⤵
  PID:13552
- C:\Windows\System\xMihkNo.exe
  C:\Windows\System\xMihkNo.exe
  2⤵
  PID:13568
- C:\Windows\System\oykFiwq.exe
  C:\Windows\System\oykFiwq.exe
  2⤵
  PID:13584
- C:\Windows\System\wJeForr.exe
  C:\Windows\System\wJeForr.exe
  2⤵
  PID:13600
- C:\Windows\System\rLCPzTQ.exe
  C:\Windows\System\rLCPzTQ.exe
  2⤵
  PID:13616
- C:\Windows\System\lwhGSoa.exe
  C:\Windows\System\lwhGSoa.exe
  2⤵
  PID:13632
- C:\Windows\System\pFyFPhf.exe
  C:\Windows\System\pFyFPhf.exe
  2⤵
  PID:13648
- C:\Windows\System\OxKeEwJ.exe
  C:\Windows\System\OxKeEwJ.exe
  2⤵
  PID:13664
- C:\Windows\System\kwhXFMH.exe
  C:\Windows\System\kwhXFMH.exe
  2⤵
  PID:13680
- C:\Windows\System\pIhpABl.exe
  C:\Windows\System\pIhpABl.exe
  2⤵
  PID:13700
- C:\Windows\System\zYIKhdS.exe
  C:\Windows\System\zYIKhdS.exe
  2⤵
  PID:13716
- C:\Windows\System\JTENxSA.exe
  C:\Windows\System\JTENxSA.exe
  2⤵
  PID:13732
- C:\Windows\System\JOroAHT.exe
  C:\Windows\System\JOroAHT.exe
  2⤵
  PID:13748
- C:\Windows\System\BMDUihk.exe
  C:\Windows\System\BMDUihk.exe
  2⤵
  PID:13764
- C:\Windows\System\RazTLQP.exe
  C:\Windows\System\RazTLQP.exe
  2⤵
  PID:13780
- C:\Windows\System\HyyqOXp.exe
  C:\Windows\System\HyyqOXp.exe
  2⤵
  PID:13796
- C:\Windows\System\BpjkAOP.exe
  C:\Windows\System\BpjkAOP.exe
  2⤵
  PID:13820
- C:\Windows\System\ZXepclW.exe
  C:\Windows\System\ZXepclW.exe
  2⤵
  PID:13836
- C:\Windows\System\pGKBpRa.exe
  C:\Windows\System\pGKBpRa.exe
  2⤵
  PID:13852
- C:\Windows\System\miMoWBk.exe
  C:\Windows\System\miMoWBk.exe
  2⤵
  PID:13868
- C:\Windows\System\rLWacGy.exe
  C:\Windows\System\rLWacGy.exe
  2⤵
  PID:13884
- C:\Windows\System\RtRcDtK.exe
  C:\Windows\System\RtRcDtK.exe
  2⤵
  PID:13900
- C:\Windows\System\aNDzyUP.exe
  C:\Windows\System\aNDzyUP.exe
  2⤵
  PID:13920
- C:\Windows\System\JrWBWSA.exe
  C:\Windows\System\JrWBWSA.exe
  2⤵
  PID:13936
- C:\Windows\System\VBYWXUJ.exe
  C:\Windows\System\VBYWXUJ.exe
  2⤵
  PID:13952
- C:\Windows\System\tgoerfw.exe
  C:\Windows\System\tgoerfw.exe
  2⤵
  PID:13968
- C:\Windows\System\eQDLJAt.exe
  C:\Windows\System\eQDLJAt.exe
  2⤵
  PID:13984
- C:\Windows\System\CbBwTQU.exe
  C:\Windows\System\CbBwTQU.exe
  2⤵
  PID:14016
- C:\Windows\System\yzypPQN.exe
  C:\Windows\System\yzypPQN.exe
  2⤵
  PID:14036
- C:\Windows\System\auCYQRb.exe
  C:\Windows\System\auCYQRb.exe
  2⤵
  PID:14072
- C:\Windows\System\BEsmmYx.exe
  C:\Windows\System\BEsmmYx.exe
  2⤵
  PID:14104
- C:\Windows\System\mQnsMez.exe
  C:\Windows\System\mQnsMez.exe
  2⤵
  PID:14124
- C:\Windows\System\CsMijjn.exe
  C:\Windows\System\CsMijjn.exe
  2⤵
  PID:14152
- C:\Windows\System\upDGQJi.exe
  C:\Windows\System\upDGQJi.exe
  2⤵
  PID:14168
- C:\Windows\System\GABMsCU.exe
  C:\Windows\System\GABMsCU.exe
  2⤵
  PID:14184
- C:\Windows\System\pnrpyMV.exe
  C:\Windows\System\pnrpyMV.exe
  2⤵
  PID:14200
- C:\Windows\System\CWWLhPg.exe
  C:\Windows\System\CWWLhPg.exe
  2⤵
  PID:14216
- C:\Windows\System\PHDTzcU.exe
  C:\Windows\System\PHDTzcU.exe
  2⤵
  PID:14232
- C:\Windows\System\oEOGNGc.exe
  C:\Windows\System\oEOGNGc.exe
  2⤵
  PID:14260
- C:\Windows\System\VWFLuST.exe
  C:\Windows\System\VWFLuST.exe
  2⤵
  PID:14284
- C:\Windows\System\gezAqXX.exe
  C:\Windows\System\gezAqXX.exe
  2⤵
  PID:14308
- C:\Windows\System\YsQNpKm.exe
  C:\Windows\System\YsQNpKm.exe
  2⤵
  PID:14332
- C:\Windows\System\FEfZSma.exe
  C:\Windows\System\FEfZSma.exe
  2⤵
  PID:13388
- C:\Windows\System\wLmVhBJ.exe
  C:\Windows\System\wLmVhBJ.exe
  2⤵
  PID:13432
- C:\Windows\System\ZyjZlwf.exe
  C:\Windows\System\ZyjZlwf.exe
  2⤵
  PID:3884
- C:\Windows\System\esIKvNC.exe
  C:\Windows\System\esIKvNC.exe
  2⤵
  PID:13500
- C:\Windows\System\NsHUUuB.exe
  C:\Windows\System\NsHUUuB.exe
  2⤵
  PID:13544
- C:\Windows\System\exVmLfr.exe
  C:\Windows\System\exVmLfr.exe
  2⤵
  PID:13576
- C:\Windows\System\multfxR.exe
  C:\Windows\System\multfxR.exe
  2⤵
  PID:13612
- C:\Windows\System\meGTZak.exe
  C:\Windows\System\meGTZak.exe
  2⤵
  PID:13624
- C:\Windows\System\vzvQcIn.exe
  C:\Windows\System\vzvQcIn.exe
  2⤵
  PID:13672
- C:\Windows\System\ZWnHuYw.exe
  C:\Windows\System\ZWnHuYw.exe
  2⤵
  PID:13696
- C:\Windows\System\YzHIJcU.exe
  C:\Windows\System\YzHIJcU.exe
  2⤵
  PID:13740
- C:\Windows\System\qaQposk.exe
  C:\Windows\System\qaQposk.exe
  2⤵
  PID:1588
- C:\Windows\System\YflgkPs.exe
  C:\Windows\System\YflgkPs.exe
  2⤵
  PID:13816
- C:\Windows\System\CGbwweL.exe
  C:\Windows\System\CGbwweL.exe
  2⤵
  PID:13844
- C:\Windows\System\dJdehdH.exe
  C:\Windows\System\dJdehdH.exe
  2⤵
  PID:13876
- C:\Windows\System\EzkxxgV.exe
  C:\Windows\System\EzkxxgV.exe
  2⤵
  PID:13908
- C:\Windows\System\nJBPLLT.exe
  C:\Windows\System\nJBPLLT.exe
  2⤵
  PID:13944
- C:\Windows\System\BegJQnb.exe
  C:\Windows\System\BegJQnb.exe
  2⤵
  PID:13976
- C:\Windows\System\LROsucB.exe
  C:\Windows\System\LROsucB.exe
  2⤵
  PID:14012
- C:\Windows\System\eRDzHXF.exe
  C:\Windows\System\eRDzHXF.exe
  2⤵
  PID:1620
- C:\Windows\System\OEPrlrZ.exe
  C:\Windows\System\OEPrlrZ.exe
  2⤵
  PID:2256
- C:\Windows\System\Jkqlaco.exe
  C:\Windows\System\Jkqlaco.exe
  2⤵
  PID:14120
- C:\Windows\System\hBqRAPL.exe
  C:\Windows\System\hBqRAPL.exe
  2⤵
  PID:14160
- C:\Windows\System\PvkHDdQ.exe
  C:\Windows\System\PvkHDdQ.exe
  2⤵
  PID:14192
- C:\Windows\System\rYxSbZg.exe
  C:\Windows\System\rYxSbZg.exe
  2⤵
  PID:14224
- C:\Windows\System\DUUGDHn.exe
  C:\Windows\System\DUUGDHn.exe
  2⤵
  PID:14280
- C:\Windows\System\KGjjWgg.exe
  C:\Windows\System\KGjjWgg.exe
  2⤵
  PID:14304
- C:\Windows\System\lHJxtmw.exe
  C:\Windows\System\lHJxtmw.exe
  2⤵
  PID:13372
- C:\Windows\System\ArwJfyo.exe
  C:\Windows\System\ArwJfyo.exe
  2⤵
  PID:13464
- C:\Windows\System\INPaDnL.exe
  C:\Windows\System\INPaDnL.exe
  2⤵
  PID:13532
- C:\Windows\System\WQUgACs.exe
  C:\Windows\System\WQUgACs.exe
  2⤵
  PID:13596
- C:\Windows\System\UEZkGxQ.exe
  C:\Windows\System\UEZkGxQ.exe
  2⤵
  PID:13656
- C:\Windows\System\aiLIAFy.exe
  C:\Windows\System\aiLIAFy.exe
  2⤵
  PID:13728
- C:\Windows\System\qwfHjXg.exe
  C:\Windows\System\qwfHjXg.exe
  2⤵
  PID:13864
- C:\Windows\System\EUEeDUY.exe
  C:\Windows\System\EUEeDUY.exe
  2⤵
  PID:13932
- C:\Windows\System\MbjieHo.exe
  C:\Windows\System\MbjieHo.exe
  2⤵
  PID:14004
- C:\Windows\System\Scovoiu.exe
  C:\Windows\System\Scovoiu.exe
  2⤵
  PID:3100
- C:\Windows\System\mGqXQeJ.exe
  C:\Windows\System\mGqXQeJ.exe
  2⤵
  PID:14180
- C:\Windows\System\HUerdPd.exe
  C:\Windows\System\HUerdPd.exe
  2⤵
  PID:13416
- C:\Windows\System\cEpqaSW.exe
  C:\Windows\System\cEpqaSW.exe
  2⤵
  PID:13628
- C:\Windows\System\OelLSwR.exe
  C:\Windows\System\OelLSwR.exe
  2⤵
  PID:13964
- C:\Windows\System\lmlifXK.exe
  C:\Windows\System\lmlifXK.exe
  2⤵
  PID:14116
- C:\Windows\System\FnwMQKE.exe
  C:\Windows\System\FnwMQKE.exe
  2⤵
  PID:13564
- C:\Windows\System\laxdNab.exe
  C:\Windows\System\laxdNab.exe
  2⤵
  PID:14100
- C:\Windows\System\xGmlxUn.exe
  C:\Windows\System\xGmlxUn.exe
  2⤵
  PID:13896
- C:\Windows\System\VMseyJM.exe
  C:\Windows\System\VMseyJM.exe
  2⤵
  PID:14344
- C:\Windows\System\JQcmkQH.exe
  C:\Windows\System\JQcmkQH.exe
  2⤵
  PID:14372
- C:\Windows\System\YSHEzbA.exe
  C:\Windows\System\YSHEzbA.exe
  2⤵
  PID:14424
- C:\Windows\System\uCiZAjZ.exe
  C:\Windows\System\uCiZAjZ.exe
  2⤵
  PID:14468
- C:\Windows\System\SgsBeuE.exe
  C:\Windows\System\SgsBeuE.exe
  2⤵
  PID:14484
- C:\Windows\System\EKHtUAo.exe
  C:\Windows\System\EKHtUAo.exe
  2⤵
  PID:14500
- C:\Windows\System\hbNhTbc.exe
  C:\Windows\System\hbNhTbc.exe
  2⤵
  PID:14516
- C:\Windows\System\UhOeoLy.exe
  C:\Windows\System\UhOeoLy.exe
  2⤵
  PID:14532
- C:\Windows\System\FqhIUBA.exe
  C:\Windows\System\FqhIUBA.exe
  2⤵
  PID:14548
- C:\Windows\System\JOpUxat.exe
  C:\Windows\System\JOpUxat.exe
  2⤵
  PID:14564
- C:\Windows\System\pDODjJt.exe
  C:\Windows\System\pDODjJt.exe
  2⤵
  PID:14588
- C:\Windows\System\qHkfWnl.exe
  C:\Windows\System\qHkfWnl.exe
  2⤵
  PID:14620
- C:\Windows\System\dgNWsZr.exe
  C:\Windows\System\dgNWsZr.exe
  2⤵
  PID:14652
- C:\Windows\System\WKEpdRN.exe
  C:\Windows\System\WKEpdRN.exe
  2⤵
  PID:14684
- C:\Windows\System\nhTjSUA.exe
  C:\Windows\System\nhTjSUA.exe
  2⤵
  PID:14712
- C:\Windows\System\FaKcXju.exe
  C:\Windows\System\FaKcXju.exe
  2⤵
  PID:14784
- C:\Windows\System\uDOWOsw.exe
  C:\Windows\System\uDOWOsw.exe
  2⤵
  PID:14844
- C:\Windows\System\uJDZmej.exe
  C:\Windows\System\uJDZmej.exe
  2⤵
  PID:14860
- C:\Windows\System\omkukmp.exe
  C:\Windows\System\omkukmp.exe
  2⤵
  PID:14360
- C:\Windows\System\BQIgzVQ.exe
  C:\Windows\System\BQIgzVQ.exe
  2⤵
  PID:14376
- C:\Windows\System\YSnfSAF.exe
  C:\Windows\System\YSnfSAF.exe
  2⤵
  PID:14456
- C:\Windows\System\oNnYyPQ.exe
  C:\Windows\System\oNnYyPQ.exe
  2⤵
  PID:14480
- C:\Windows\System\rvKPmnx.exe
  C:\Windows\System\rvKPmnx.exe
  2⤵
  PID:14512
- C:\Windows\System\ZtgrUAF.exe
  C:\Windows\System\ZtgrUAF.exe
  2⤵
  PID:14544
- C:\Windows\System\bKrLWLw.exe
  C:\Windows\System\bKrLWLw.exe
  2⤵
  PID:14576
- C:\Windows\System\DzKDpQZ.exe
  C:\Windows\System\DzKDpQZ.exe
  2⤵
  PID:14604
- C:\Windows\System\NOcpOYA.exe
  C:\Windows\System\NOcpOYA.exe
  2⤵
  PID:2480
- C:\Windows\System\tEBfhon.exe
  C:\Windows\System\tEBfhon.exe
  2⤵
  PID:14632
- C:\Windows\System\MogScHE.exe
  C:\Windows\System\MogScHE.exe
  2⤵
  PID:14672
- C:\Windows\System\NyCYYYQ.exe
  C:\Windows\System\NyCYYYQ.exe
  2⤵
  PID:14692
- C:\Windows\System\PWDQUEM.exe
  C:\Windows\System\PWDQUEM.exe
  2⤵
  PID:14708
- C:\Windows\System\sxIYhqs.exe
  C:\Windows\System\sxIYhqs.exe
  2⤵
  PID:14724
- C:\Windows\System\WGKUDCb.exe
  C:\Windows\System\WGKUDCb.exe
  2⤵
  PID:14748
- C:\Windows\System\NvekIhb.exe
  C:\Windows\System\NvekIhb.exe
  2⤵
  PID:14132
- C:\Windows\System\owXNszb.exe
  C:\Windows\System\owXNszb.exe
  2⤵
  PID:14112
- C:\Windows\System\pealisc.exe
  C:\Windows\System\pealisc.exe
  2⤵
  PID:14136
- C:\Windows\System\LMAGKob.exe
  C:\Windows\System\LMAGKob.exe
  2⤵
  PID:14780
- C:\Windows\System\RzqeUSn.exe
  C:\Windows\System\RzqeUSn.exe
  2⤵
  PID:14816
- C:\Windows\System\PlBpbZk.exe
  C:\Windows\System\PlBpbZk.exe
  2⤵
  PID:14876
- C:\Windows\System\uTbLkKo.exe
  C:\Windows\System\uTbLkKo.exe
  2⤵
  PID:14888
- C:\Windows\System\MxTiswX.exe
  C:\Windows\System\MxTiswX.exe
  2⤵
  PID:14924
- C:\Windows\System\VJzRxTR.exe
  C:\Windows\System\VJzRxTR.exe
  2⤵
  PID:14936
- C:\Windows\System\dWTOKhi.exe
  C:\Windows\System\dWTOKhi.exe
  2⤵
  PID:14992
- C:\Windows\System\dbaRRIR.exe
  C:\Windows\System\dbaRRIR.exe
  2⤵
  PID:15044
- C:\Windows\System\veNAtGx.exe
  C:\Windows\System\veNAtGx.exe
  2⤵
  PID:15064
- C:\Windows\System\eQkTuSQ.exe
  C:\Windows\System\eQkTuSQ.exe
  2⤵
  PID:15088
- C:\Windows\System\TUJghMi.exe
  C:\Windows\System\TUJghMi.exe
  2⤵
  PID:15100
- C:\Windows\System\NhOzVIj.exe
  C:\Windows\System\NhOzVIj.exe
  2⤵
  PID:15116
- C:\Windows\System\NxaLpUG.exe
  C:\Windows\System\NxaLpUG.exe
  2⤵
  PID:15136
- C:\Windows\System\enGazct.exe
  C:\Windows\System\enGazct.exe
  2⤵
  PID:15172
- C:\Windows\System\avQHWob.exe
  C:\Windows\System\avQHWob.exe
  2⤵
  PID:15184
- C:\Windows\System\qGTSUMw.exe
  C:\Windows\System\qGTSUMw.exe
  2⤵
  PID:15200
- C:\Windows\System\aZmiBuw.exe
  C:\Windows\System\aZmiBuw.exe
  2⤵
  PID:4484
- C:\Windows\System\comVspD.exe
  C:\Windows\System\comVspD.exe
  2⤵
  PID:15228
- C:\Windows\System\UfTDlzG.exe
  C:\Windows\System\UfTDlzG.exe
  2⤵
  PID:15248
- C:\Windows\System\MZyzVtE.exe
  C:\Windows\System\MZyzVtE.exe
  2⤵
  PID:15264
- C:\Windows\System\IMqXlPp.exe
  C:\Windows\System\IMqXlPp.exe
  2⤵
  PID:15280
- C:\Windows\System\kNvfaGk.exe
  C:\Windows\System\kNvfaGk.exe
  2⤵
  PID:15300
- C:\Windows\System\PaEBwPe.exe
  C:\Windows\System\PaEBwPe.exe
  2⤵
  PID:15308
- C:\Windows\System\jEYIHQl.exe
  C:\Windows\System\jEYIHQl.exe
  2⤵
  PID:15324
- C:\Windows\System\CHARvFQ.exe
  C:\Windows\System\CHARvFQ.exe
  2⤵
  PID:15340
- C:\Windows\System\KzvsKKM.exe
  C:\Windows\System\KzvsKKM.exe
  2⤵
  PID:15356
- C:\Windows\System\gWlcfaP.exe
  C:\Windows\System\gWlcfaP.exe
  2⤵
  PID:14356
- C:\Windows\System\ANaWsFG.exe
  C:\Windows\System\ANaWsFG.exe
  2⤵
  PID:14476
- C:\Windows\System\VrvlinL.exe
  C:\Windows\System\VrvlinL.exe
  2⤵
  PID:14540
- C:\Windows\System\LjjliqZ.exe
  C:\Windows\System\LjjliqZ.exe
  2⤵
  PID:14600
- C:\Windows\System\dDDtbPU.exe
  C:\Windows\System\dDDtbPU.exe
  2⤵
  PID:14648
- C:\Windows\System\yLClHff.exe
  C:\Windows\System\yLClHff.exe
  2⤵
  PID:14696
- C:\Windows\System\LLZHaij.exe
  C:\Windows\System\LLZHaij.exe
  2⤵
  PID:14740
- C:\Windows\System\Nkxprdy.exe
  C:\Windows\System\Nkxprdy.exe
  2⤵
  PID:14768
- C:\Windows\System\YTLhRbO.exe
  C:\Windows\System\YTLhRbO.exe
  2⤵
  PID:14096
- C:\Windows\System\frbZxms.exe
  C:\Windows\System\frbZxms.exe
  2⤵
  PID:14832
- C:\Windows\System\SnkhKIG.exe
  C:\Windows\System\SnkhKIG.exe
  2⤵
  PID:14912
- C:\Windows\System\oiWMcaY.exe
  C:\Windows\System\oiWMcaY.exe
  2⤵
  PID:14812
- C:\Windows\System\LKopwBT.exe
  C:\Windows\System\LKopwBT.exe
  2⤵
  PID:15024
- C:\Windows\System\FRgUURa.exe
  C:\Windows\System\FRgUURa.exe
  2⤵
  PID:4944
- C:\Windows\System\AsOsENf.exe
  C:\Windows\System\AsOsENf.exe
  2⤵
  PID:15096
- C:\Windows\System\LHmxdJM.exe
  C:\Windows\System\LHmxdJM.exe
  2⤵
  PID:15156
- C:\Windows\System\RwhwCve.exe
  C:\Windows\System\RwhwCve.exe
  2⤵
  PID:4636
- C:\Windows\System\aekTFfl.exe
  C:\Windows\System\aekTFfl.exe
  2⤵
  PID:15196
- C:\Windows\System\fVpwZXv.exe
  C:\Windows\System\fVpwZXv.exe
  2⤵
  PID:15224
- C:\Windows\System\efrdfBm.exe
  C:\Windows\System\efrdfBm.exe
  2⤵
  PID:15260
- C:\Windows\System\nHKLugW.exe
  C:\Windows\System\nHKLugW.exe
  2⤵
  PID:15348
- C:\Windows\System\vGVcarF.exe
  C:\Windows\System\vGVcarF.exe
  2⤵
  PID:14416
- C:\Windows\System\VZVXDvK.exe
  C:\Windows\System\VZVXDvK.exe
  2⤵
  PID:14636
- C:\Windows\System\nqfESyM.exe
  C:\Windows\System\nqfESyM.exe
  2⤵
  PID:14760
- C:\Windows\System\GZICVFo.exe
  C:\Windows\System\GZICVFo.exe
  2⤵
  PID:14880
- C:\Windows\System\oopPYKC.exe
  C:\Windows\System\oopPYKC.exe
  2⤵
  PID:14984
- C:\Windows\System\VIGVrWn.exe
  C:\Windows\System\VIGVrWn.exe
  2⤵
  PID:15112
- C:\Windows\System\VMQpSfT.exe
  C:\Windows\System\VMQpSfT.exe
  2⤵
  PID:15148
- C:\Windows\System\bezScQK.exe
  C:\Windows\System\bezScQK.exe
  2⤵
  PID:15212
- C:\Windows\System\kmwYFfe.exe
  C:\Windows\System\kmwYFfe.exe
  2⤵
  PID:15016
- C:\Windows\System\ylPqEXn.exe
  C:\Windows\System\ylPqEXn.exe
  2⤵
  PID:15332
- C:\Windows\System\yGaZyVW.exe
  C:\Windows\System\yGaZyVW.exe
  2⤵
  PID:14596
- C:\Windows\System\CSdsyRp.exe
  C:\Windows\System\CSdsyRp.exe
  2⤵
  PID:14556
- C:\Windows\System\gBPhpGd.exe
  C:\Windows\System\gBPhpGd.exe
  2⤵
  PID:14732
- C:\Windows\System\zgQpLCC.exe
  C:\Windows\System\zgQpLCC.exe
  2⤵
  PID:14088
- C:\Windows\System\eggeeQJ.exe
  C:\Windows\System\eggeeQJ.exe
  2⤵
  PID:14932
- C:\Windows\System\ebONPfs.exe
  C:\Windows\System\ebONPfs.exe
  2⤵
  PID:15168
- C:\Windows\System\anSknZT.exe
  C:\Windows\System\anSknZT.exe
  2⤵
  PID:15304
- C:\Windows\System\LvtqNLK.exe
  C:\Windows\System\LvtqNLK.exe
  2⤵
  PID:14508
- C:\Windows\System\XjQSEbo.exe
  C:\Windows\System\XjQSEbo.exe
  2⤵
  PID:14728
- C:\Windows\System\VUHieIj.exe
  C:\Windows\System\VUHieIj.exe
  2⤵
  PID:14928
- C:\Windows\System\tPPTiFF.exe
  C:\Windows\System\tPPTiFF.exe
  2⤵
  PID:15256
- C:\Windows\System\OZFKwyx.exe
  C:\Windows\System\OZFKwyx.exe
  2⤵
  PID:15244
- C:\Windows\System\jPttsAg.exe
  C:\Windows\System\jPttsAg.exe
  2⤵
  PID:15076
- C:\Windows\System\cXtHIyZ.exe
  C:\Windows\System\cXtHIyZ.exe
  2⤵
  PID:14352
- C:\Windows\System\cUJkyxU.exe
  C:\Windows\System\cUJkyxU.exe
  2⤵
  PID:14796
- C:\Windows\System\ldbRlzj.exe
  C:\Windows\System\ldbRlzj.exe
  2⤵
  PID:6120
- C:\Windows\System\qslOccO.exe
  C:\Windows\System\qslOccO.exe
  2⤵
  PID:15376
- C:\Windows\System\hgNSpxy.exe
  C:\Windows\System\hgNSpxy.exe
  2⤵
  PID:15396
- C:\Windows\System\juPcYln.exe
  C:\Windows\System\juPcYln.exe
  2⤵
  PID:15412
- C:\Windows\System\QzeBVvm.exe
  C:\Windows\System\QzeBVvm.exe
  2⤵
  PID:15432
- C:\Windows\System\wsdqQiV.exe
  C:\Windows\System\wsdqQiV.exe
  2⤵
  PID:15448
- C:\Windows\System\EnXzTtn.exe
  C:\Windows\System\EnXzTtn.exe
  2⤵
  PID:15464
- C:\Windows\System\ZAhjygn.exe
  C:\Windows\System\ZAhjygn.exe
  2⤵
  PID:15496
- C:\Windows\System\ayTfqqQ.exe
  C:\Windows\System\ayTfqqQ.exe
  2⤵
  PID:15516
- C:\Windows\System\GKomQXh.exe
  C:\Windows\System\GKomQXh.exe
  2⤵
  PID:15544
- C:\Windows\System\mQtSspA.exe
  C:\Windows\System\mQtSspA.exe
  2⤵
  PID:15568
- C:\Windows\System\AhkuvUp.exe
  C:\Windows\System\AhkuvUp.exe
  2⤵
  PID:15624
- C:\Windows\System\dOnwbak.exe
  C:\Windows\System\dOnwbak.exe
  2⤵
  PID:15640
- C:\Windows\System\levsVwX.exe
  C:\Windows\System\levsVwX.exe
  2⤵
  PID:15656
- C:\Windows\System\bmmMHyo.exe
  C:\Windows\System\bmmMHyo.exe
  2⤵
  PID:15672
- C:\Windows\System\pBPLoXD.exe
  C:\Windows\System\pBPLoXD.exe
  2⤵
  PID:15688
- C:\Windows\System\hVaquLX.exe
  C:\Windows\System\hVaquLX.exe
  2⤵
  PID:15704
- C:\Windows\System\iJMCueR.exe
  C:\Windows\System\iJMCueR.exe
  2⤵
  PID:15732
- C:\Windows\System\loVowBO.exe
  C:\Windows\System\loVowBO.exe
  2⤵
  PID:15756
- C:\Windows\System\FFriVek.exe
  C:\Windows\System\FFriVek.exe
  2⤵
  PID:15776
- C:\Windows\System\hLIzczI.exe
  C:\Windows\System\hLIzczI.exe
  2⤵
  PID:15796
- C:\Windows\System\YamYxDv.exe
  C:\Windows\System\YamYxDv.exe
  2⤵
  PID:16140
- C:\Windows\System\iBiEXUf.exe
  C:\Windows\System\iBiEXUf.exe
  2⤵
  PID:15392
- C:\Windows\System\rIJglCc.exe
  C:\Windows\System\rIJglCc.exe
  2⤵
  PID:15512
- C:\Windows\System\fzMiayo.exe
  C:\Windows\System\fzMiayo.exe
  2⤵
  PID:14140
- C:\Windows\System\pozwxrD.exe
  C:\Windows\System\pozwxrD.exe
  2⤵
  PID:15580
- C:\Windows\System\eevQDjO.exe
  C:\Windows\System\eevQDjO.exe
  2⤵
  PID:14144
- C:\Windows\System\lpFoyDc.exe
  C:\Windows\System\lpFoyDc.exe
  2⤵
  PID:14028
- C:\Windows\System\ikHuVom.exe
  C:\Windows\System\ikHuVom.exe
  2⤵
  PID:13812
- C:\Windows\System\cvHKkny.exe
  C:\Windows\System\cvHKkny.exe
  2⤵
  PID:15632
- C:\Windows\System\dpCsenf.exe
  C:\Windows\System\dpCsenf.exe
  2⤵
  PID:15684
- C:\Windows\System\DEqyOCM.exe
  C:\Windows\System\DEqyOCM.exe
  2⤵
  PID:15724
- C:\Windows\System\jemzIhX.exe
  C:\Windows\System\jemzIhX.exe
  2⤵
  PID:15840
- C:\Windows\System\IUlHaJl.exe
  C:\Windows\System\IUlHaJl.exe
  2⤵
  PID:15856
- C:\Windows\System\qIaQxEd.exe
  C:\Windows\System\qIaQxEd.exe
  2⤵
  PID:1964
- C:\Windows\System\xUqUuMv.exe
  C:\Windows\System\xUqUuMv.exe
  2⤵
  PID:14964
- C:\Windows\System\NEkddsq.exe
  C:\Windows\System\NEkddsq.exe
  2⤵
  PID:14948
- C:\Windows\System\BTxvIto.exe
  C:\Windows\System\BTxvIto.exe
  2⤵
  PID:14980
- C:\Windows\System\RDrAmxc.exe
  C:\Windows\System\RDrAmxc.exe
  2⤵
  PID:15900
- C:\Windows\System\vHeVsuV.exe
  C:\Windows\System\vHeVsuV.exe
  2⤵
  PID:15920
- C:\Windows\System\HkGwmOY.exe
  C:\Windows\System\HkGwmOY.exe
  2⤵
  PID:15940
- C:\Windows\System\JZIwFVv.exe
  C:\Windows\System\JZIwFVv.exe
  2⤵
  PID:15948
- C:\Windows\System\osNpGmJ.exe
  C:\Windows\System\osNpGmJ.exe
  2⤵
  PID:15972
- C:\Windows\System\TgotIOz.exe
  C:\Windows\System\TgotIOz.exe
  2⤵
  PID:15992
- C:\Windows\System\AtCQHbn.exe
  C:\Windows\System\AtCQHbn.exe
  2⤵
  PID:16008
- C:\Windows\System\KHOKkmV.exe
  C:\Windows\System\KHOKkmV.exe
  2⤵
  PID:16032
- C:\Windows\System\cpmOPsx.exe
  C:\Windows\System\cpmOPsx.exe
  2⤵
  PID:16044
- C:\Windows\System\yALaHVy.exe
  C:\Windows\System\yALaHVy.exe
  2⤵
  PID:16072
- C:\Windows\System\ucwhIqq.exe
  C:\Windows\System\ucwhIqq.exe
  2⤵
  PID:16092
- C:\Windows\System\osFyrpg.exe
  C:\Windows\System\osFyrpg.exe
  2⤵
  PID:16108
- C:\Windows\System\QtMmBVL.exe
  C:\Windows\System\QtMmBVL.exe
  2⤵
  PID:16128
- C:\Windows\System\FNlRoKx.exe
  C:\Windows\System\FNlRoKx.exe
  2⤵
  PID:16156
- C:\Windows\System\MJquXed.exe
  C:\Windows\System\MJquXed.exe
  2⤵
  PID:16184
- C:\Windows\System\qaHkiBW.exe
  C:\Windows\System\qaHkiBW.exe
  2⤵
  PID:16200
- C:\Windows\System\kahVTPE.exe
  C:\Windows\System\kahVTPE.exe
  2⤵
  PID:16208
- C:\Windows\System\auhltYH.exe
  C:\Windows\System\auhltYH.exe
  2⤵
  PID:16224
- C:\Windows\System\ATquuRG.exe
  C:\Windows\System\ATquuRG.exe
  2⤵
  PID:16248
- C:\Windows\System\UdvTFtr.exe
  C:\Windows\System\UdvTFtr.exe
  2⤵
  PID:16260
- C:\Windows\System\lngmpbl.exe
  C:\Windows\System\lngmpbl.exe
  2⤵
  PID:16268
- C:\Windows\System\RZtGQXh.exe
  C:\Windows\System\RZtGQXh.exe
  2⤵
  PID:16284
- C:\Windows\System\bpysxXo.exe
  C:\Windows\System\bpysxXo.exe
  2⤵
  PID:16300
- C:\Windows\System\zIrajTI.exe
  C:\Windows\System\zIrajTI.exe
  2⤵
  PID:16336
- C:\Windows\System\geFqNkx.exe
  C:\Windows\System\geFqNkx.exe
  2⤵
  PID:16332
- C:\Windows\System\sqboLQm.exe
  C:\Windows\System\sqboLQm.exe
  2⤵
  PID:16364
- C:\Windows\System\lwSsThV.exe
  C:\Windows\System\lwSsThV.exe
  2⤵
  PID:15368
- C:\Windows\System\WNVEYLD.exe
  C:\Windows\System\WNVEYLD.exe
  2⤵
  PID:15388
- C:\Windows\System\vaBqKLV.exe
  C:\Windows\System\vaBqKLV.exe
  2⤵
  PID:7084
- C:\Windows\System\vCESPEl.exe
  C:\Windows\System\vCESPEl.exe
  2⤵
  PID:7108
- C:\Windows\System\BrfWyGJ.exe
  C:\Windows\System\BrfWyGJ.exe
  2⤵
  PID:15440
- C:\Windows\System\wfjyyrd.exe
  C:\Windows\System\wfjyyrd.exe
  2⤵
  PID:7140
- C:\Windows\System\LsqMLVw.exe
  C:\Windows\System\LsqMLVw.exe
  2⤵
  PID:4532
- C:\Windows\System\iSdFNgY.exe
  C:\Windows\System\iSdFNgY.exe
  2⤵
  PID:15560
- C:\Windows\System\LzVzLaj.exe
  C:\Windows\System\LzVzLaj.exe
  2⤵
  PID:15584
- C:\Windows\System\dkcqxga.exe
  C:\Windows\System\dkcqxga.exe
  2⤵
  PID:6200
- C:\Windows\System\sIYvJDV.exe
  C:\Windows\System\sIYvJDV.exe
  2⤵
  PID:6224
- C:\Windows\System\ODxpati.exe
  C:\Windows\System\ODxpati.exe
  2⤵
  PID:15576
- C:\Windows\System\FmJhvGq.exe
  C:\Windows\System\FmJhvGq.exe
  2⤵
  PID:6356
- C:\Windows\System\uKUnNDB.exe
  C:\Windows\System\uKUnNDB.exe
  2⤵
  PID:14044
- C:\Windows\System\XXkqBAN.exe
  C:\Windows\System\XXkqBAN.exe
  2⤵
  PID:14064
- C:\Windows\System\zKtCoyr.exe
  C:\Windows\System\zKtCoyr.exe
  2⤵
  PID:1108
- C:\Windows\System\uPVuDPR.exe
  C:\Windows\System\uPVuDPR.exe
  2⤵
  PID:7148
- C:\Windows\System\YpFVPxp.exe
  C:\Windows\System\YpFVPxp.exe
  2⤵
  PID:3932
- C:\Windows\System\ZvUZUbW.exe
  C:\Windows\System\ZvUZUbW.exe
  2⤵
  PID:15772
- C:\Windows\System\ZyDMgyK.exe
  C:\Windows\System\ZyDMgyK.exe
  2⤵
  PID:15664
- C:\Windows\System\umjkqRF.exe
  C:\Windows\System\umjkqRF.exe
  2⤵
  PID:6636
- C:\Windows\System\VcVclgt.exe
  C:\Windows\System\VcVclgt.exe
  2⤵
  PID:15768
- C:\Windows\System\OpmCtOi.exe
  C:\Windows\System\OpmCtOi.exe
  2⤵
  PID:3680
- C:\Windows\System\NrYjrPU.exe
  C:\Windows\System\NrYjrPU.exe
  2⤵
  PID:15764
- C:\Windows\System\ZwTBuje.exe
  C:\Windows\System\ZwTBuje.exe
  2⤵
  PID:15792
- C:\Windows\System\zMIaZkr.exe
  C:\Windows\System\zMIaZkr.exe
  2⤵
  PID:15820
- C:\Windows\System\aPlzWoi.exe
  C:\Windows\System\aPlzWoi.exe
  2⤵
  PID:6668
- C:\Windows\System\itzdiHQ.exe
  C:\Windows\System\itzdiHQ.exe
  2⤵
  PID:15852
- C:\Windows\System\dNfIgqs.exe
  C:\Windows\System\dNfIgqs.exe
  2⤵
  PID:14272
- C:\Windows\System\KufVcrS.exe
  C:\Windows\System\KufVcrS.exe
  2⤵
  PID:15864
- C:\Windows\System\rZpEQFL.exe
  C:\Windows\System\rZpEQFL.exe
  2⤵
  PID:1332
- C:\Windows\System\rSnmvPM.exe
  C:\Windows\System\rSnmvPM.exe
  2⤵
  PID:7276
- C:\Windows\System\ZtsgukA.exe
  C:\Windows\System\ZtsgukA.exe
  2⤵
  PID:15128
- C:\Windows\System\CVnYhWF.exe
  C:\Windows\System\CVnYhWF.exe
  2⤵
  PID:7324
- C:\Windows\System\aKAXNJL.exe
  C:\Windows\System\aKAXNJL.exe
  2⤵
  PID:15020
- C:\Windows\System\CuOmOkD.exe
  C:\Windows\System\CuOmOkD.exe
  2⤵
  PID:1384
- C:\Windows\System\YOyBpcf.exe
  C:\Windows\System\YOyBpcf.exe
  2⤵
  PID:7404
- C:\Windows\System\iRzbEjz.exe
  C:\Windows\System\iRzbEjz.exe
  2⤵
  PID:7412
- C:\Windows\System\xpVhqSG.exe
  C:\Windows\System\xpVhqSG.exe
  2⤵
  PID:7452
- C:\Windows\System\qQthAqp.exe
  C:\Windows\System\qQthAqp.exe
  2⤵
  PID:15932
- C:\Windows\System\iwOeuWy.exe
  C:\Windows\System\iwOeuWy.exe
  2⤵
  PID:15952
- C:\Windows\System\BKttUfd.exe
  C:\Windows\System\BKttUfd.exe
  2⤵
  PID:7600
- C:\Windows\System\NeWvpbJ.exe
  C:\Windows\System\NeWvpbJ.exe
  2⤵
  PID:2548
- C:\Windows\System\HhwEkoS.exe
  C:\Windows\System\HhwEkoS.exe
  2⤵
  PID:7624
- C:\Windows\System\mbFhWyw.exe
  C:\Windows\System\mbFhWyw.exe
  2⤵
  PID:7716
- C:\Windows\System\UVeclVZ.exe
  C:\Windows\System\UVeclVZ.exe
  2⤵
  PID:3352
- C:\Windows\System\IhppQYn.exe
  C:\Windows\System\IhppQYn.exe
  2⤵
  PID:16040
- C:\Windows\System\RdJrNBf.exe
  C:\Windows\System\RdJrNBf.exe
  2⤵
  PID:7824
- C:\Windows\System\WIJDPSd.exe
  C:\Windows\System\WIJDPSd.exe
  2⤵
  PID:7880
- C:\Windows\System\PzgwdyM.exe
  C:\Windows\System\PzgwdyM.exe
  2⤵
  PID:8056
- C:\Windows\System\uNRTewl.exe
  C:\Windows\System\uNRTewl.exe
  2⤵
  PID:2376
- C:\Windows\System\QPTlcPt.exe
  C:\Windows\System\QPTlcPt.exe
  2⤵
  PID:16064
- C:\Windows\System\oXQpFWB.exe
  C:\Windows\System\oXQpFWB.exe
  2⤵
  PID:16148
- C:\Windows\System\tlnougs.exe
  C:\Windows\System\tlnougs.exe
  2⤵
  PID:16104
- C:\Windows\System\WoJZnFf.exe
  C:\Windows\System\WoJZnFf.exe
  2⤵
  PID:16136
- C:\Windows\System\iJdBFVq.exe
  C:\Windows\System\iJdBFVq.exe
  2⤵
  PID:2808
- C:\Windows\System\XUqNpDe.exe
  C:\Windows\System\XUqNpDe.exe
  2⤵
  PID:7604
- C:\Windows\System\csncqBM.exe
  C:\Windows\System\csncqBM.exe
  2⤵
  PID:7628
- C:\Windows\System\PCLoPFi.exe
  C:\Windows\System\PCLoPFi.exe
  2⤵
  PID:7844
- C:\Windows\System\QaQURWG.exe
  C:\Windows\System\QaQURWG.exe
  2⤵
  PID:4116
- C:\Windows\System\CnmdsYd.exe
  C:\Windows\System\CnmdsYd.exe
  2⤵
  PID:16172
- C:\Windows\System\wnzDHrr.exe
  C:\Windows\System\wnzDHrr.exe
  2⤵
  PID:7996
- C:\Windows\System\emRYbtv.exe
  C:\Windows\System\emRYbtv.exe
  2⤵
  PID:16180
- C:\Windows\System\FxvGJKI.exe
  C:\Windows\System\FxvGJKI.exe
  2⤵
  PID:5928
- C:\Windows\System\mKATeUP.exe
  C:\Windows\System\mKATeUP.exe
  2⤵
  PID:3456
- C:\Windows\System\rlryTZg.exe
  C:\Windows\System\rlryTZg.exe
  2⤵
  PID:3816
- C:\Windows\System\dpeWmuS.exe
  C:\Windows\System\dpeWmuS.exe
  2⤵
  PID:668
- C:\Windows\System\yZtDMug.exe
  C:\Windows\System\yZtDMug.exe
  2⤵
  PID:3056
- C:\Windows\System\XDcyRkO.exe
  C:\Windows\System\XDcyRkO.exe
  2⤵
  PID:16292
- C:\Windows\System\uFiYnuW.exe
  C:\Windows\System\uFiYnuW.exe
  2⤵
  PID:1088
- C:\Windows\System\KpznryL.exe
  C:\Windows\System\KpznryL.exe
  2⤵
  PID:8360
- C:\Windows\System\hzNbrVp.exe
  C:\Windows\System\hzNbrVp.exe
  2⤵
  PID:16360
- C:\Windows\System\gsixKMD.exe
  C:\Windows\System\gsixKMD.exe
  2⤵
  PID:2612
- C:\Windows\System\CSipakT.exe
  C:\Windows\System\CSipakT.exe
  2⤵
  PID:8448
- C:\Windows\System\RmGXxxb.exe
  C:\Windows\System\RmGXxxb.exe
  2⤵
  PID:15712
- C:\Windows\System\yGdNjeC.exe
  C:\Windows\System\yGdNjeC.exe
  2⤵
  PID:16376
- C:\Windows\System\ATJAHTd.exe
  C:\Windows\System\ATJAHTd.exe
  2⤵
  PID:15488
- C:\Windows\System\auKmpER.exe
  C:\Windows\System\auKmpER.exe
  2⤵
  PID:4624
- C:\Windows\System\ccgQxiC.exe
  C:\Windows\System\ccgQxiC.exe
  2⤵
  PID:8580
- C:\Windows\System\sFGTFRA.exe
  C:\Windows\System\sFGTFRA.exe
  2⤵
  PID:5044
- C:\Windows\System\WRilCHU.exe
  C:\Windows\System\WRilCHU.exe
  2⤵
  PID:244
- C:\Windows\System\VDvMthx.exe
  C:\Windows\System\VDvMthx.exe
  2⤵
  PID:1820
- C:\Windows\System\VYDSAFw.exe
  C:\Windows\System\VYDSAFw.exe
  2⤵
  PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4gnw54fz.0fk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\HxxilMz.exe

Filesize
1.8MB

MD5
4caecc586cb82d58e5f42e998fbcb9cf

SHA1
d99d34ecbe7634459042324e5c6da9fb037207bc

SHA256
25119042bff159f2408dbffe507b504d5f3e70218adfe0d7596eaa0e2caf9011

SHA512
88d7ef2f19f68bf8c5ae39f4babcc640f87d77fb56fa549ba8aaca8d8b5e9724ba47305bfeaef636955d2dbde8d388c91eaf2c7617c3fb7837b4635b326d6b78

Download Submit
C:\Windows\System\JHOYfdR.exe

Filesize
1.8MB

MD5
5148efde63fe78c7ea855b36ae1f0dcf

SHA1
d0ee08829129756d2acc9a3d8ca64074d819a27a

SHA256
165fcc4a3dc0d2f913edae96ecd9437e5042bcbc77df6cb9bd4f7f51fc862266

SHA512
42c481005fe2f869acc8e7ce2783b4a1012768a622856b83c12a14ecffe955323145bee8d48f9e4e66d77d2fd6589b586b085897aa584962ca4b97f13905304f

Download Submit
C:\Windows\System\JpKhUUJ.exe

Filesize
1.8MB

MD5
081003ddf0f53e0cb9ce12eace651ae7

SHA1
2f0c714db879190aa26c50b9c7a34464eebe199f

SHA256
3cf8a2218de34c2d56a610d65c96aaf98f04f486aea206ad6eb893d9ca9c8953

SHA512
0dbfa5908f63f0adebeeaae105e0b444dcf1db8d16ef6c15616d4eeb8dc6932490e3c111f5c84b399ea76fd68933204dc1f21f11c2c1d0d6a88a05f7f643054b

Download Submit
C:\Windows\System\LYQwhdN.exe

Filesize
1.8MB

MD5
445ecda1c733011c5352f6b863085076

SHA1
36792c0c3eaf66e1cc431c0b6485ed7f3a32738d

SHA256
d5999f7e55aaa337242b75355fee06e594acbe7776240f77b34839e2408f9120

SHA512
261f4610d0760c8201f067f348189707517c229e9c6b3c094346df9ee02267e7944ff0370eb8920ff872930865aac305a6ad598bbeec6eab1bf7c91cc41055c5

Download Submit
C:\Windows\System\LydspXT.exe

Filesize
1.8MB

MD5
a1fd9dc7e463ee70a165d998bf959a21

SHA1
268714de869f9a2ae33d3125df591d292cc3406c

SHA256
1b1df34f9123ad220f6f2b3d989a2d975d20e7ac54c997cbb4407fe37cd56e7c

SHA512
59a4fd8d92e85685b75dff5b9145921447098a98b13f04feb5097f74c33c09ef0843ac2f1316e82583e0446b51334dd6bce51aaf11cea0f690a956159291523e

Download Submit
C:\Windows\System\NGTxlaT.exe

Filesize
1.8MB

MD5
077e94f6e18179e3ce23a6bb919d2001

SHA1
7e46d9d73af97abd1124b3d84c3588705186c232

SHA256
e397acf7a8d7dde3cac7b75c0874ac557cd71f9b44c7596f04a07b28df01d527

SHA512
4bffe1ad088e4bd9cde0abd64994d1d65b36492a16413981e85fdfa6e3b6ba81016348d63083d0290776eb4074cb8dd6105d6341b9fc3f186902e2b82ab29e96

Download Submit
C:\Windows\System\NksdAAG.exe

Filesize
1.8MB

MD5
c820d19112b80cb51f5fc66276fab0c3

SHA1
55c71a52d24cb9867405f920a96dacd97739dd6e

SHA256
9f189d70dc95b2534b180697e6d6796a1b2007cbcca0ecdf8d17e7d90d637713

SHA512
dbea362e8166d69c737b4f6b53cbcf119f5e104bd2c12f5f000914fcf1bee314e456f2a4009f1800e566239296d777b57421be0bbd127d9e797fc53ce5bfb0a9

Download Submit
C:\Windows\System\RXfyLjL.exe

Filesize
8B

MD5
92dce7fd7ec69f225baee909f1f20d27

SHA1
0fe748b20df273698767537e59de10e23a351a61

SHA256
3a8d52b801fd1c8bd120153342611f7386eb5ce0ad255d57304ec96ec9b31a84

SHA512
1e58e425b780ebf633a365e2d3edf8bb342f5bfe09e8d802b0d4dd60a53770b35758c32e598b9a4f78c23d6a0841ec0499f88be809f17838167d0c02b8f0c743

Download Submit
C:\Windows\System\SsVniMd.exe

Filesize
1.8MB

MD5
6fad5dcd3fd1cf408878309245d4f82a

SHA1
81f4b8689fc137e2720419b19fa86f57beee5cc4

SHA256
e370c82f1a5505c87c904a39c2341b5409eb3d26477a5fa88a14fd437e5db3f9

SHA512
afa6148c9f165b25197dbc8b0b5985fa466e13a76fa340bcfa1774204f07c5050a5ce5c8ff099b984d5fb693f483c0bab3fee4a2f1d6f76e3efc960885061dc4

Download Submit
C:\Windows\System\TeDOGOY.exe

Filesize
1.8MB

MD5
aaf8fdff1658a1f28b0ab1b3bd413727

SHA1
74fc97217be45e176958888f9a9d3a4f51fe2246

SHA256
e3e10028dcbbc6ab44f874efb045942707aab4a407cd68ef82e1b92b87f79e25

SHA512
06c52ba102607198d1e57928f28338df6c66e9eba35f2dbff174751d31fae008e9035e5a95d25e567402d86ec6a53b0b0ea230eaae671391ef5b56bfb5edfaa2

Download Submit
C:\Windows\System\UIRGSCo.exe

Filesize
1.8MB

MD5
0d7e44ef44c7cbf122b509a864607c7c

SHA1
a194f13bdbf1c02d0e4eaf8f61efaa8a24a070f1

SHA256
dc3d09048d6860f0cb1a5c19646a2c95f47e417f185a758cb91ba7d2fbbd06a1

SHA512
584c8ee949354cad019137027271ddb901dcaafc750872d097e47c65cbef79ea4c948a226666f80bf50100506c6eda4b298504b397ba4c3da62119b15163adf9

Download Submit
C:\Windows\System\Ubbkrba.exe

Filesize
1.8MB

MD5
ae0c50699d0dea5a04ec63419aae748d

SHA1
05aad3207f4f568a5a337e2e9a0f13db096e6f64

SHA256
3895fe502351ec016faec86b0abc26f1a874421e035004a3080366db314d5c55

SHA512
2d0c478ce5f6bc06f41033869bfe944e6abdf23350392466cd7a24ce5c5595c256c0137d69be66bcc21aae976b8a0065dc4afc8715f2ab12373444e4a0167896

Download Submit
C:\Windows\System\XYNtHUo.exe

Filesize
1.8MB

MD5
ecebca76d72dd0fc741591cdaf903eb5

SHA1
fbde6adf611cee4df7c70dfcf052eb72e5d30475

SHA256
94b9209e65305afe65f2c38f548d4bf0f9f396e111ddf5d2fb3b8343274ed6d7

SHA512
f75f9bf1ba915d5a118811ca188f147fa86df24720e4d99187680dd000112ff3830f4c66d45e8b0f0f9c8dcefb7e99bf1f580d1dbfdb601964958dbaf741c551

Download Submit
C:\Windows\System\YqkAMeH.exe

Filesize
1.8MB

MD5
7a526ac6c0a67d1172a3b76709889ad0

SHA1
fc9844901f167c2af9f551c2ba6496250861d613

SHA256
2db80d58691bec5efcf05ea9a6a2c1c49d1fb901b3466e7d7219ef11c35822d7

SHA512
6d5e7908083ab4ec5eea911e3aebf84f77f40278a50814fd3796559f3ae054b6f3ec13eda772473eb5dc22c9fd4b97cfb89fda74797b48b4d7394157dfe4ec64

Download Submit
C:\Windows\System\chQEFhI.exe

Filesize
1.8MB

MD5
985910c93ef51161104c1150cea51723

SHA1
adbbd2b642fac1f0256fdc83335b30e827e2bff2

SHA256
79929687c63518f27f78302b2b0b65e07fe562cb35ed77c99462410ed39be80c

SHA512
612d3b6750fc35fe90801a8e24cfe0cf330a6528547793b7172418be63a72540c228c9b059c80efd7c5601dd7327b991e53b4237a457e186c6d06855d5f5df81

Download Submit
C:\Windows\System\cqlsBee.exe

Filesize
1.8MB

MD5
2ddb790b6d6064981da3cb41cda0f4aa

SHA1
7db2c0d359fc033a2a54d0390a3f02eec1113f2c

SHA256
58fdb6c849a6de624096dfba1982e2e8cb181e2b31a0431d02ff4f7ffeebdc2e

SHA512
a6a1ecc91b7551a7a672be1635bc44a68fa921e039b24dbbb866e56cd8d41d121b7c9b17713d3a048334024b83fda33b85130ba63a576b1a48ea855fab63d7fd

Download Submit
C:\Windows\System\gHLtUto.exe

Filesize
1.8MB

MD5
fc5b513df1c66f1ca2de7600dfc74478

SHA1
84e9294ea6ca2391c865a71f1cfca517d77bb612

SHA256
5220f5ae44b40804830e9b62870d5ba40dafa8bc1ea609056fdf94a32aa8cff1

SHA512
8d4eff424fccf84cc29a8311d98d890ad2259e6b5b9df3db2b55b2d6d3a910e466d3744103868a8fbbe3bac0cda4c3a525762ed6635a20a644b21518c2426ec3

Download Submit
C:\Windows\System\gvmgorF.exe

Filesize
1.8MB

MD5
31e31bda07acc591b18e9439a99d519a

SHA1
b4f30a0f64f42cf95ddc45cc79e40e969d20804e

SHA256
23cb57fdb806e8d99f3a98b9c17f8326486a3e15894a697fa1dc4c700aad9e57

SHA512
99ceb24f67026b4157a0714e43bf16d3bcb0bec8c18b793fdee244477a978b798343572578b132428bbf0523d3816ff42ca1cea71bb5b28d58384f71d9e2b530

Download Submit
C:\Windows\System\iktBpXU.exe

Filesize
1.8MB

MD5
96baf80fa14ec8878164624abc5841c5

SHA1
5b6c98abcdb7dcbfaf1a1b12db795ef3501d2ca9

SHA256
fc6d0ba084ab02a76c936d472732c246d1bcb0c3e5ee24c4dc885a4593f63cba

SHA512
269ba365bf6f739a8b7e4c2e7d1721b3e3a2959cc056eab373bf50e41a9d6c08657341d6701c332621bba5b91c08126d2d9eb74809406b3d5bf7ea72d03975c6

Download Submit
C:\Windows\System\kBfDXHb.exe

Filesize
1.8MB

MD5
6de638be96a48d9eb13221ba36f7f0c9

SHA1
407468e5abe9aee89adbf4c8918701dca7f3779a

SHA256
77e29a6af3a110edaa2a05349919e0f9443b57ab5cbe7b8f602f3603cc003ce9

SHA512
15df1fd6f9a0589affc9379c5f005756ce8888420333400c096048d548f84c24e95c6d16e7a9a149f3835a815f007c8b22ac28dfa5a15b680bb5b10e400a1723

Download Submit
C:\Windows\System\kMpfQWE.exe

Filesize
1.8MB

MD5
c20d6de9531fbdb65396e78ffc21aa8b

SHA1
fc4f77c26425a7694bf08d1646cb1d3116f75fa7

SHA256
3ab1a61d646754630791776480b808ee01e734d6fc915f36091cf64db2707cdb

SHA512
f90cab7b6165df1e2289ffe3c6e89d10019838ef987f59099345b98837415c42fee1c8938d025269d57667d0ee84b1fe653b8407b06ad31eabd213838ceb3d97

Download Submit
C:\Windows\System\kiOWDWt.exe

Filesize
1.8MB

MD5
6267f36ec623bbdd05c6ba2f6936a93b

SHA1
0f9a12925e8141dd570ddfe6ca3b8c4fb68ef4eb

SHA256
dd221946b81b021dc279e54bccb19b68911f20c760fda71c0d717ee65b199313

SHA512
f35e90a78bb58954a8f1bf8995b865147db3815150cf2be1bb3f3ef9a700f9b5d37a66bfd93da327f06a208ecf6b1686629b37233a627d0276112af5eed01ac1

Download Submit
C:\Windows\System\lSjdrcl.exe

Filesize
1.8MB

MD5
35897c2a77749f35f0e82905251b5ae3

SHA1
e713f267c3f329b036461d93074d4e0136f187ec

SHA256
c2c0cfe7556cc1173bffd96e8cf8ea234c0a26445ce0fd8e8090844ca6d59da0

SHA512
92ff83e3e5b62d5f2f29fd2790470db36d6fcb5def99367879a0c1a4f8aa417b68662550b5cf3e1600069aaac74fad62429da4c05db0a0751054a722758a41d7

Download Submit
C:\Windows\System\mMXAvMN.exe

Filesize
1.8MB

MD5
f056f05f5f680d46b640d4f70741a956

SHA1
c4ef9e089ea794666d5aaf9425376a9f51440de2

SHA256
11145c71f45a3558916964bfe1332ba8ae72d4e24e707373bfa598940b7a9167

SHA512
944af8b08296c9bce8ffcd8c7c0cae71a5ae72b2a40c4e2b88208933b2832c7b6ee2b76deff3d7a1af517d129ff32d2a8979731d465d36a5f881eb0521dd7143

Download Submit
C:\Windows\System\mtsGiqi.exe

Filesize
1.8MB

MD5
63f6f83d3e893eaa17641fd8a7b85062

SHA1
4a8303fb6c6f6f998cfc6c513db397e867713d73

SHA256
807358874ffa4cf221ff8a72767e31c6367984ec716676c0f3873d945ed3901b

SHA512
f41005923d457fd0bd9a23d0b14cabd0b826d2ff83a05dbe65cb7902916424c7b5b1e1122c6fe7397247287f4ffe89c7d6b184d28bc6af7ef6f840e7b3620fed

Download Submit
C:\Windows\System\owhUWdi.exe

Filesize
1.8MB

MD5
e0b603d1ff780ae48d18c0f43fc81800

SHA1
6fe56cdac4886bda84002ec8cc281c8cdecdd4f4

SHA256
b6adfbf5137ea5ae6086fff89b048574327d7c7bc3935949b62f670a383a4a6d

SHA512
2a5dbc52adf49a99aed4809b0f77a9e3d7ac63cfcf1df3fc6280808681d26ea83d60df3122fb5f1973cdd096a3fec8e4e89baa15d69cb02c983eccd38fad82f2

Download Submit
C:\Windows\System\rLfGYMR.exe

Filesize
1.8MB

MD5
a52013f0c82cf92761473453eec9a5e5

SHA1
501589162a4e55aa4b25949dda345bbc1ec82326

SHA256
ee8a57867170067552aa2e12101bc85ccba6c3bb13095f86384ca5d72288e61d

SHA512
868d02a1c1f1d333027c47a04991a4b4de12a97cf60fe5e3cb08b764f2ddafb1d777e57a4e5177d3bda122c6a4ab84cb1ac88daf1903aabb43ce4583a44dd648

Download Submit
C:\Windows\System\uGvxZZO.exe

Filesize
1.8MB

MD5
3b48ae3c30d8e593042dd6302c87e405

SHA1
f0c304291889f79ff44dc142a74a8bb913a5111b

SHA256
9a350331c845db88fd990f66148096ffa4b1aada78a6a599c4d9b075db9c1421

SHA512
7360169daec6c839099090f004f76f96deb0ec6bfd1e27a5ac4d43ff077822324d2a28f01e0b7b1f8c5480ecc655b358e114bf4cead8bbbba1ef276672bdae34

Download Submit
C:\Windows\System\uyWLXrJ.exe

Filesize
1.8MB

MD5
4fe32c8ebb8d49ce0d0c5071213e0575

SHA1
78275f5fc016affc67228a8f0f9b4f54d2331255

SHA256
ff27a9f7a47ef9bc4389225c809cfe17cdd0068130f08e528c7a8072c06eda88

SHA512
571f9358aaf00ab321c6fb9856ab385f1306fdb771feb4cb2467b2df14fc1f1fd3b93ec567c6319bb02e89023e2daa48682067f9ae2fdf467a4d0c615649f42a

Download Submit
C:\Windows\System\vqOfCdh.exe

Filesize
1.8MB

MD5
b9cc0f4413c9f815d9ec776bfbe63f23

SHA1
afdbb02e00bf20cf9a821a783f9ef1e0e3e3ca84

SHA256
3b97ad8b078f7a95f7d34a7d687c19ce7612c0e1b34b7af406dd62c332a6f189

SHA512
04fdcae0769508487f86ed87b7ab8295a6a3152b6876cb2ef9fe2e9209078175421f8bc5d4dfbfa32c6a9fe5d0bd23df9a70719eca5bd09ff84c6197acccd138

Download Submit
C:\Windows\System\wPGTuRK.exe

Filesize
1.8MB

MD5
6cbda03bc7cf720685ad4496f1c549cb

SHA1
be8f390c17338797cfc69a61f50c5b83dddc74b0

SHA256
2b3813f3a37246d988b161b07da58df821f1f409857ce1c2d44086bfe7aecc29

SHA512
2dffbe0f5609439040769ec90f0f42b96e52ac433cdcaa475e2dbf4eef733c44cbe88746373d8325c0a60b3fdd5b510dd25e520cdba274b7d48c0b6c32a1d6b1

Download Submit
C:\Windows\System\wlycqWE.exe

Filesize
1.8MB

MD5
f411d6adf8f856dc5e262ef5eef80ece

SHA1
c4236cd5525ba61b6a3420e943d9dc182702e6a9

SHA256
36209557cfabb4847a73e5bd7d3fe86ac82ed33d6b2518f7f926dd510766242f

SHA512
b84818ce96da86607ae75b55b1332863f4cb012b79a2fd15ee5961aee1486314c34645fee80b2a3499ef5e14baedc313b052bb2168206c22058c6d0762c6ac3c

Download Submit
C:\Windows\System\xHnlgFa.exe

Filesize
1.8MB

MD5
530b02ba9f96c8027cd94c04c1db803e

SHA1
b3098f03f4743dd224e9a240002ae3a786661e44

SHA256
702481bbb7e69e7ecf2f19facfc3884451312662c0e6788df794d25b9206c9df

SHA512
3f0e4811b3b05ed947359cc01ac15eb5071ea8c0f8f825033646bf85ae520f61082aee369ec964c2261cbd5c4527496f040bccb90e2ea4b54f5e113314209ed3

Download Submit
C:\Windows\System\xdCOpAA.exe

Filesize
1.8MB

MD5
7a5df8461e53f445a3c22fb7f69fe1bc

SHA1
7f5ea38e0546a53f34dc9a01b9c0c4ac7fde284b

SHA256
aaec0e5e043698aaac8b48939cda1aaba2e978ddeb26f0f2d5c802b137fee762

SHA512
da3f9c89988851fc6d7d4db20ae2f46d320eb1d8849ea533af7b0cb99085121fffab8fa1da166b65a773967479241702e36a9f3b3753f035c70eb5dcb4b6f9d6

Download Submit
memory/216-61-0x00007FF7100F0000-0x00007FF7104E2000-memory.dmp

Filesize
3.9MB

Download
memory/216-3397-0x00007FF7100F0000-0x00007FF7104E2000-memory.dmp

Filesize
3.9MB

Download
memory/408-110-0x00007FF735BB0000-0x00007FF735FA2000-memory.dmp

Filesize
3.9MB

Download
memory/408-3535-0x00007FF735BB0000-0x00007FF735FA2000-memory.dmp

Filesize
3.9MB

Download
memory/536-14-0x00007FF7C6F20000-0x00007FF7C7312000-memory.dmp

Filesize
3.9MB

Download
memory/752-92-0x00007FF77BA80000-0x00007FF77BE72000-memory.dmp

Filesize
3.9MB

Download
memory/804-1-0x000001DDE3150000-0x000001DDE3160000-memory.dmp

Filesize
64KB

Download
memory/804-0-0x00007FF70AC10000-0x00007FF70B002000-memory.dmp

Filesize
3.9MB

Download
memory/1608-3508-0x00007FF68C520000-0x00007FF68C912000-memory.dmp

Filesize
3.9MB

Download
memory/1608-102-0x00007FF68C520000-0x00007FF68C912000-memory.dmp

Filesize
3.9MB

Download
memory/1696-88-0x00007FF7F3DB0000-0x00007FF7F41A2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-97-0x00007FF609120000-0x00007FF609512000-memory.dmp

Filesize
3.9MB

Download
memory/2748-101-0x00007FF631EC0000-0x00007FF6322B2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-3566-0x00007FF76B940000-0x00007FF76BD32000-memory.dmp

Filesize
3.9MB

Download
memory/2904-407-0x00007FF76B940000-0x00007FF76BD32000-memory.dmp

Filesize
3.9MB

Download
memory/2924-3515-0x00007FF7DAB70000-0x00007FF7DAF62000-memory.dmp

Filesize
3.9MB

Download
memory/2924-108-0x00007FF7DAB70000-0x00007FF7DAF62000-memory.dmp

Filesize
3.9MB

Download
memory/2992-410-0x00007FF649220000-0x00007FF649612000-memory.dmp

Filesize
3.9MB

Download
memory/2992-3582-0x00007FF649220000-0x00007FF649612000-memory.dmp

Filesize
3.9MB

Download
memory/3016-3547-0x00007FF7DE310000-0x00007FF7DE702000-memory.dmp

Filesize
3.9MB

Download
memory/3016-109-0x00007FF7DE310000-0x00007FF7DE702000-memory.dmp

Filesize
3.9MB

Download
memory/3148-82-0x00007FF7A6CF0000-0x00007FF7A70E2000-memory.dmp

Filesize
3.9MB

Download
memory/3152-406-0x00007FF6F9990000-0x00007FF6F9D82000-memory.dmp

Filesize
3.9MB

Download
memory/3152-3561-0x00007FF6F9990000-0x00007FF6F9D82000-memory.dmp

Filesize
3.9MB

Download
memory/3348-20-0x00007FF709FD0000-0x00007FF70A3C2000-memory.dmp

Filesize
3.9MB

Download
memory/3464-78-0x00007FF777950000-0x00007FF777D42000-memory.dmp

Filesize
3.9MB

Download
memory/3672-74-0x00007FF6A4170000-0x00007FF6A4562000-memory.dmp

Filesize
3.9MB

Download
memory/3672-3409-0x00007FF6A4170000-0x00007FF6A4562000-memory.dmp

Filesize
3.9MB

Download
memory/3776-81-0x00007FF6CBCF0000-0x00007FF6CC0E2000-memory.dmp

Filesize
3.9MB

Download
memory/3872-3554-0x00007FF6DED00000-0x00007FF6DF0F2000-memory.dmp

Filesize
3.9MB

Download
memory/3872-405-0x00007FF6DED00000-0x00007FF6DF0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4048-412-0x00007FF69A5E0000-0x00007FF69A9D2000-memory.dmp

Filesize
3.9MB

Download
memory/4048-3590-0x00007FF69A5E0000-0x00007FF69A9D2000-memory.dmp

Filesize
3.9MB

Download
memory/4384-3576-0x00007FF60FE50000-0x00007FF610242000-memory.dmp

Filesize
3.9MB

Download
memory/4384-409-0x00007FF60FE50000-0x00007FF610242000-memory.dmp

Filesize
3.9MB

Download
memory/4388-3208-0x00007FF6A4220000-0x00007FF6A4612000-memory.dmp

Filesize
3.9MB

Download
memory/4388-107-0x00007FF6A4220000-0x00007FF6A4612000-memory.dmp

Filesize
3.9MB

Download
memory/4388-3974-0x00007FF6A4220000-0x00007FF6A4612000-memory.dmp

Filesize
3.9MB

Download
memory/4420-51-0x00007FFBCDF40000-0x00007FFBCEA01000-memory.dmp

Filesize
10.8MB

Download
memory/4420-15-0x00007FFBCDF43000-0x00007FFBCDF45000-memory.dmp

Filesize
8KB

Download
memory/4420-44-0x000002941AAF0000-0x000002941AB12000-memory.dmp

Filesize
136KB

Download
memory/4420-287-0x00000294343C0000-0x0000029434B66000-memory.dmp

Filesize
7.6MB

Download
memory/4420-58-0x00007FFBCDF40000-0x00007FFBCEA01000-memory.dmp

Filesize
10.8MB

Download
memory/4444-408-0x00007FF6A3000000-0x00007FF6A33F2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-3570-0x00007FF6A3000000-0x00007FF6A33F2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-411-0x00007FF738B00000-0x00007FF738EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-3587-0x00007FF738B00000-0x00007FF738EF2000-memory.dmp

Filesize
3.9MB

Download