xmrig | 6c31b6a5815edd4774b38a2806b0641b3e231de5633b9cbf95ebfd0448bcf78d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
Size

2.0MB
MD5

dbf1685f4978ee693a05f0107eeb52e8
SHA1

d21485470fa8a9e181c81af451aeda77d97b3172
SHA256

6c31b6a5815edd4774b38a2806b0641b3e231de5633b9cbf95ebfd0448bcf78d
SHA512

3edc81bc27a3cd742825e16a9e75b204db8da1250a682e65671fd323c3b67ad14c09dea29d10b1b734b8070eedffcb7793a7e1506dd6ebe0c1091a7d942a9f47
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMB:NAB5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/3496-168-0x00007FF78C4D0000-0x00007FF78C8C2000-memory.dmp	xmrig
behavioral2/memory/3372-175-0x00007FF7C3A00000-0x00007FF7C3DF2000-memory.dmp	xmrig
behavioral2/memory/1160-182-0x00007FF640FC0000-0x00007FF6413B2000-memory.dmp	xmrig
behavioral2/memory/2352-188-0x00007FF708450000-0x00007FF708842000-memory.dmp	xmrig
behavioral2/memory/3156-187-0x00007FF7D0000000-0x00007FF7D03F2000-memory.dmp	xmrig
behavioral2/memory/4016-186-0x00007FF7A1A70000-0x00007FF7A1E62000-memory.dmp	xmrig
behavioral2/memory/3744-183-0x00007FF725390000-0x00007FF725782000-memory.dmp	xmrig
behavioral2/memory/4720-181-0x00007FF6419E0000-0x00007FF641DD2000-memory.dmp	xmrig
behavioral2/memory/4220-179-0x00007FF7D9480000-0x00007FF7D9872000-memory.dmp	xmrig
behavioral2/memory/1400-176-0x00007FF691150000-0x00007FF691542000-memory.dmp	xmrig
behavioral2/memory/1436-174-0x00007FF750BC0000-0x00007FF750FB2000-memory.dmp	xmrig
behavioral2/memory/4820-171-0x00007FF71A8F0000-0x00007FF71ACE2000-memory.dmp	xmrig
behavioral2/memory/4080-170-0x00007FF646B00000-0x00007FF646EF2000-memory.dmp	xmrig
behavioral2/memory/2728-169-0x00007FF7443C0000-0x00007FF7447B2000-memory.dmp	xmrig
behavioral2/memory/1888-166-0x00007FF77D540000-0x00007FF77D932000-memory.dmp	xmrig
behavioral2/memory/4376-152-0x00007FF720D00000-0x00007FF7210F2000-memory.dmp	xmrig
behavioral2/memory/3788-141-0x00007FF77A800000-0x00007FF77ABF2000-memory.dmp	xmrig
behavioral2/memory/4728-44-0x00007FF713620000-0x00007FF713A12000-memory.dmp	xmrig
behavioral2/memory/4244-25-0x00007FF6221B0000-0x00007FF6225A2000-memory.dmp	xmrig
behavioral2/memory/4892-2227-0x00007FF7507B0000-0x00007FF750BA2000-memory.dmp	xmrig
behavioral2/memory/4976-2214-0x00007FF6DB380000-0x00007FF6DB772000-memory.dmp	xmrig
behavioral2/memory/860-5392-0x00007FF7B7410000-0x00007FF7B7802000-memory.dmp	xmrig
behavioral2/memory/4376-5381-0x00007FF720D00000-0x00007FF7210F2000-memory.dmp	xmrig
behavioral2/memory/3788-5368-0x00007FF77A800000-0x00007FF77ABF2000-memory.dmp	xmrig
behavioral2/memory/3156-5410-0x00007FF7D0000000-0x00007FF7D03F2000-memory.dmp	xmrig
behavioral2/memory/3496-5417-0x00007FF78C4D0000-0x00007FF78C8C2000-memory.dmp	xmrig
behavioral2/memory/2728-5456-0x00007FF7443C0000-0x00007FF7447B2000-memory.dmp	xmrig
behavioral2/memory/4080-5464-0x00007FF646B00000-0x00007FF646EF2000-memory.dmp	xmrig
behavioral2/memory/3372-5479-0x00007FF7C3A00000-0x00007FF7C3DF2000-memory.dmp	xmrig
behavioral2/memory/1400-5483-0x00007FF691150000-0x00007FF691542000-memory.dmp	xmrig
behavioral2/memory/4720-5491-0x00007FF6419E0000-0x00007FF641DD2000-memory.dmp	xmrig
behavioral2/memory/3744-5504-0x00007FF725390000-0x00007FF725782000-memory.dmp	xmrig
behavioral2/memory/4220-5495-0x00007FF7D9480000-0x00007FF7D9872000-memory.dmp	xmrig
behavioral2/memory/1160-5487-0x00007FF640FC0000-0x00007FF6413B2000-memory.dmp	xmrig
behavioral2/memory/2352-5515-0x00007FF708450000-0x00007FF708842000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	2220	powershell.exe
10	2220	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2220	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2548	AdNyzvR.exe
4244	cBiCsIa.exe
4152	wMCALnx.exe
4976	OutLEFC.exe
4728	CaPFNVQ.exe
3788	fJEsSkB.exe
4892	JDdNqaR.exe
860	vCdMIoR.exe
4376	nbUaraP.exe
1888	jckkYsB.exe
3156	vfMMplU.exe
3496	CYhMJrF.exe
2728	fZhTTWJ.exe
4080	hACsIqx.exe
4820	zHbffJB.exe
1436	riaYtrS.exe
3372	iDQVQkg.exe
1400	fhxqFKd.exe
4220	tGzrpqz.exe
4720	FLhiKnT.exe
1160	pOwxKvq.exe
3744	FppmPYV.exe
4016	okEHWHv.exe
2352	oBdcrhK.exe
4304	vyqsZyJ.exe
3664	GnXAtuK.exe
3764	OowLLGs.exe
4208	SMlsZSI.exe
3520	tNQGBcK.exe
4676	pUnZgOy.exe
2420	qlKJWQU.exe
2692	GXofrCa.exe
2248	ONgPnuT.exe
4804	HuMvljD.exe
704	tZvRUzG.exe
4288	dYakQoU.exe
2552	wSCssoj.exe
2960	UVbzPDe.exe
4868	qVkxIQS.exe
2916	ENLDRBE.exe
1728	mnJnhjI.exe
680	sDRvVEp.exe
4312	JmSlmfg.exe
4340	dtUWWci.exe
1572	hrybtLa.exe
628	UNdMWwU.exe
1940	cuJEdOT.exe
1704	ycJIWie.exe
4392	lnTPysk.exe
640	knJvipk.exe
2764	BZAFjwq.exe
516	aHfOhAM.exe
3388	xvdCFUi.exe
4436	oJzYmLk.exe
3680	LJjraQH.exe
4484	gNdfgGU.exe
1568	aXFWjcH.exe
5104	YnRkdYm.exe
3972	oYSgaJh.exe
4528	VCGsncD.exe
3660	ZzAnaip.exe
4000	hDiilTB.exe
4480	BtUEXuR.exe
1180	cXRhwfv.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2488-0-0x00007FF726350000-0x00007FF726742000-memory.dmp	upx
behavioral2/files/0x0007000000023441-7.dat	upx
behavioral2/files/0x000800000002343f-17.dat	upx
behavioral2/files/0x0007000000023445-41.dat	upx
behavioral2/files/0x0007000000023444-47.dat	upx
behavioral2/files/0x0007000000023446-53.dat	upx
behavioral2/files/0x0007000000023447-55.dat	upx
behavioral2/files/0x000700000002344f-97.dat	upx
behavioral2/files/0x0007000000023451-122.dat	upx
behavioral2/files/0x0007000000023453-127.dat	upx
behavioral2/files/0x0007000000023454-154.dat	upx
behavioral2/memory/3496-168-0x00007FF78C4D0000-0x00007FF78C8C2000-memory.dmp	upx
behavioral2/memory/3372-175-0x00007FF7C3A00000-0x00007FF7C3DF2000-memory.dmp	upx
behavioral2/memory/1160-182-0x00007FF640FC0000-0x00007FF6413B2000-memory.dmp	upx
behavioral2/files/0x000700000002345d-197.dat	upx
behavioral2/files/0x000700000002345c-192.dat	upx
behavioral2/memory/2352-188-0x00007FF708450000-0x00007FF708842000-memory.dmp	upx
behavioral2/memory/3156-187-0x00007FF7D0000000-0x00007FF7D03F2000-memory.dmp	upx
behavioral2/memory/4016-186-0x00007FF7A1A70000-0x00007FF7A1E62000-memory.dmp	upx
behavioral2/files/0x000700000002345b-184.dat	upx
behavioral2/memory/3744-183-0x00007FF725390000-0x00007FF725782000-memory.dmp	upx
behavioral2/memory/4720-181-0x00007FF6419E0000-0x00007FF641DD2000-memory.dmp	upx
behavioral2/memory/4220-179-0x00007FF7D9480000-0x00007FF7D9872000-memory.dmp	upx
behavioral2/memory/1400-176-0x00007FF691150000-0x00007FF691542000-memory.dmp	upx
behavioral2/memory/1436-174-0x00007FF750BC0000-0x00007FF750FB2000-memory.dmp	upx
behavioral2/files/0x0007000000023455-172.dat	upx
behavioral2/memory/4820-171-0x00007FF71A8F0000-0x00007FF71ACE2000-memory.dmp	upx
behavioral2/memory/4080-170-0x00007FF646B00000-0x00007FF646EF2000-memory.dmp	upx
behavioral2/memory/2728-169-0x00007FF7443C0000-0x00007FF7447B2000-memory.dmp	upx
behavioral2/memory/1888-166-0x00007FF77D540000-0x00007FF77D932000-memory.dmp	upx
behavioral2/files/0x000700000002345a-164.dat	upx
behavioral2/files/0x0007000000023459-162.dat	upx
behavioral2/files/0x0007000000023458-160.dat	upx
behavioral2/files/0x0007000000023457-158.dat	upx
behavioral2/files/0x0007000000023456-156.dat	upx
behavioral2/memory/4376-152-0x00007FF720D00000-0x00007FF7210F2000-memory.dmp	upx
behavioral2/files/0x000800000002344a-145.dat	upx
behavioral2/files/0x000800000002343d-143.dat	upx
behavioral2/memory/3788-141-0x00007FF77A800000-0x00007FF77ABF2000-memory.dmp	upx
behavioral2/files/0x0007000000023450-120.dat	upx
behavioral2/files/0x000700000002344e-116.dat	upx
behavioral2/files/0x000700000002344d-114.dat	upx
behavioral2/files/0x0007000000023452-126.dat	upx
behavioral2/files/0x000700000002344c-112.dat	upx
behavioral2/files/0x000800000002344b-85.dat	upx
behavioral2/files/0x0007000000023449-75.dat	upx
behavioral2/files/0x0007000000023448-60.dat	upx
behavioral2/memory/860-58-0x00007FF7B7410000-0x00007FF7B7802000-memory.dmp	upx
behavioral2/memory/4892-49-0x00007FF7507B0000-0x00007FF750BA2000-memory.dmp	upx
behavioral2/files/0x0007000000023442-46.dat	upx
behavioral2/memory/4728-44-0x00007FF713620000-0x00007FF713A12000-memory.dmp	upx
behavioral2/memory/4976-43-0x00007FF6DB380000-0x00007FF6DB772000-memory.dmp	upx
behavioral2/files/0x0007000000023443-37.dat	upx
behavioral2/memory/4152-28-0x00007FF629A70000-0x00007FF629E62000-memory.dmp	upx
behavioral2/memory/4244-25-0x00007FF6221B0000-0x00007FF6225A2000-memory.dmp	upx
behavioral2/memory/2548-14-0x00007FF73B480000-0x00007FF73B872000-memory.dmp	upx
behavioral2/files/0x0007000000023440-11.dat	upx
behavioral2/memory/4892-2227-0x00007FF7507B0000-0x00007FF750BA2000-memory.dmp	upx
behavioral2/memory/4976-2214-0x00007FF6DB380000-0x00007FF6DB772000-memory.dmp	upx
behavioral2/memory/860-5392-0x00007FF7B7410000-0x00007FF7B7802000-memory.dmp	upx
behavioral2/memory/4376-5381-0x00007FF720D00000-0x00007FF7210F2000-memory.dmp	upx
behavioral2/memory/3788-5368-0x00007FF77A800000-0x00007FF77ABF2000-memory.dmp	upx
behavioral2/memory/3156-5410-0x00007FF7D0000000-0x00007FF7D03F2000-memory.dmp	upx
behavioral2/memory/3496-5417-0x00007FF78C4D0000-0x00007FF78C8C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LtirQVl.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\wLMBHos.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\pDxvKUI.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\GcDfOxr.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\pzEVvAa.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\CSrAbHW.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\gYHIcNF.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\oPxhtIu.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\XDGXBqU.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\nbbQzPJ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\dDQVepF.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\NHaPwkG.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\JhZqTiR.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\jqHwDdH.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\cKJPdLd.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\obvnTzX.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\TilGHIZ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\nPvcngh.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\ArTPuSh.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\fBtZfAg.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\ItKpHyk.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\uUYewgo.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\QJraiIt.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\RyZbEjJ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\vTPLEhX.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\JgxTloU.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\QakNfzU.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\SdWzzUr.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\xGgVcSE.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\SnQZKAU.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\Absamdi.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\DaxglYQ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\cvHCarV.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\KlijSJz.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\kctyOtN.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\bqzEuYz.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\IZLEDpz.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\vYDxbdn.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\alileHS.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\lMwChhe.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\bOOjHgb.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\ZjsFcms.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\AeicXfA.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\IGVNOlJ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\xHhXsPM.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\dRqOeRD.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\cbeEOBP.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\GBdxPLK.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\iceqAXZ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\lYgUQUc.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\ZdsZIXC.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\YczqcFl.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\OyfzJXq.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\CJurGBq.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\RXCHKNV.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\dSwIFyH.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\kDEStaI.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\azHBOvL.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\bgfdDTH.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\DVBvWsi.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\zKxpPUI.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\oPNmWHK.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\UCFPTxw.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\oBaNorQ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2220	powershell.exe
2220	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
Token: SeDebugPrivilege	2220	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2220	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	84
PID 2488 wrote to memory of 2220	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	84
PID 2488 wrote to memory of 2548	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	85
PID 2488 wrote to memory of 2548	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	85
PID 2488 wrote to memory of 4244	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	86
PID 2488 wrote to memory of 4244	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	86
PID 2488 wrote to memory of 4152	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	87
PID 2488 wrote to memory of 4152	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	87
PID 2488 wrote to memory of 4976	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	88
PID 2488 wrote to memory of 4976	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	88
PID 2488 wrote to memory of 4728	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	89
PID 2488 wrote to memory of 4728	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	89
PID 2488 wrote to memory of 3788	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	90
PID 2488 wrote to memory of 3788	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	90
PID 2488 wrote to memory of 4892	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	91
PID 2488 wrote to memory of 4892	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	91
PID 2488 wrote to memory of 860	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	92
PID 2488 wrote to memory of 860	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	92
PID 2488 wrote to memory of 4376	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	93
PID 2488 wrote to memory of 4376	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	93
PID 2488 wrote to memory of 1888	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	94
PID 2488 wrote to memory of 1888	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	94
PID 2488 wrote to memory of 3156	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	95
PID 2488 wrote to memory of 3156	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	95
PID 2488 wrote to memory of 3496	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	96
PID 2488 wrote to memory of 3496	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	96
PID 2488 wrote to memory of 2728	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	97
PID 2488 wrote to memory of 2728	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	97
PID 2488 wrote to memory of 4080	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	98
PID 2488 wrote to memory of 4080	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	98
PID 2488 wrote to memory of 4820	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	99
PID 2488 wrote to memory of 4820	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	99
PID 2488 wrote to memory of 1436	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	100
PID 2488 wrote to memory of 1436	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	100
PID 2488 wrote to memory of 3372	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	101
PID 2488 wrote to memory of 3372	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	101
PID 2488 wrote to memory of 1400	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	102
PID 2488 wrote to memory of 1400	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	102
PID 2488 wrote to memory of 4220	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	103
PID 2488 wrote to memory of 4220	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	103
PID 2488 wrote to memory of 4720	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	104
PID 2488 wrote to memory of 4720	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	104
PID 2488 wrote to memory of 1160	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	105
PID 2488 wrote to memory of 1160	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	105
PID 2488 wrote to memory of 3744	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	106
PID 2488 wrote to memory of 3744	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	106
PID 2488 wrote to memory of 4016	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	107
PID 2488 wrote to memory of 4016	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	107
PID 2488 wrote to memory of 2352	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	108
PID 2488 wrote to memory of 2352	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	108
PID 2488 wrote to memory of 4304	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	109
PID 2488 wrote to memory of 4304	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	109
PID 2488 wrote to memory of 3664	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	110
PID 2488 wrote to memory of 3664	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	110
PID 2488 wrote to memory of 3764	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	111
PID 2488 wrote to memory of 3764	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	111
PID 2488 wrote to memory of 4208	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	112
PID 2488 wrote to memory of 4208	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	112
PID 2488 wrote to memory of 3520	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	113
PID 2488 wrote to memory of 3520	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	113
PID 2488 wrote to memory of 4676	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	114
PID 2488 wrote to memory of 4676	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	114
PID 2488 wrote to memory of 2420	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	115
PID 2488 wrote to memory of 2420	2488	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\System\AdNyzvR.exe
  C:\Windows\System\AdNyzvR.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\cBiCsIa.exe
  C:\Windows\System\cBiCsIa.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\wMCALnx.exe
  C:\Windows\System\wMCALnx.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\OutLEFC.exe
  C:\Windows\System\OutLEFC.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\CaPFNVQ.exe
  C:\Windows\System\CaPFNVQ.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\fJEsSkB.exe
  C:\Windows\System\fJEsSkB.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\JDdNqaR.exe
  C:\Windows\System\JDdNqaR.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\vCdMIoR.exe
  C:\Windows\System\vCdMIoR.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\nbUaraP.exe
  C:\Windows\System\nbUaraP.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\jckkYsB.exe
  C:\Windows\System\jckkYsB.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\vfMMplU.exe
  C:\Windows\System\vfMMplU.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\CYhMJrF.exe
  C:\Windows\System\CYhMJrF.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\fZhTTWJ.exe
  C:\Windows\System\fZhTTWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\hACsIqx.exe
  C:\Windows\System\hACsIqx.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\zHbffJB.exe
  C:\Windows\System\zHbffJB.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\riaYtrS.exe
  C:\Windows\System\riaYtrS.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\iDQVQkg.exe
  C:\Windows\System\iDQVQkg.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\fhxqFKd.exe
  C:\Windows\System\fhxqFKd.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\tGzrpqz.exe
  C:\Windows\System\tGzrpqz.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\FLhiKnT.exe
  C:\Windows\System\FLhiKnT.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\pOwxKvq.exe
  C:\Windows\System\pOwxKvq.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\FppmPYV.exe
  C:\Windows\System\FppmPYV.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\okEHWHv.exe
  C:\Windows\System\okEHWHv.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\oBdcrhK.exe
  C:\Windows\System\oBdcrhK.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\vyqsZyJ.exe
  C:\Windows\System\vyqsZyJ.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\GnXAtuK.exe
  C:\Windows\System\GnXAtuK.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\OowLLGs.exe
  C:\Windows\System\OowLLGs.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\SMlsZSI.exe
  C:\Windows\System\SMlsZSI.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\tNQGBcK.exe
  C:\Windows\System\tNQGBcK.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\pUnZgOy.exe
  C:\Windows\System\pUnZgOy.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\qlKJWQU.exe
  C:\Windows\System\qlKJWQU.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\GXofrCa.exe
  C:\Windows\System\GXofrCa.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\ONgPnuT.exe
  C:\Windows\System\ONgPnuT.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\HuMvljD.exe
  C:\Windows\System\HuMvljD.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\tZvRUzG.exe
  C:\Windows\System\tZvRUzG.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\dYakQoU.exe
  C:\Windows\System\dYakQoU.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\wSCssoj.exe
  C:\Windows\System\wSCssoj.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\UVbzPDe.exe
  C:\Windows\System\UVbzPDe.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\qVkxIQS.exe
  C:\Windows\System\qVkxIQS.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\ENLDRBE.exe
  C:\Windows\System\ENLDRBE.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\mnJnhjI.exe
  C:\Windows\System\mnJnhjI.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\sDRvVEp.exe
  C:\Windows\System\sDRvVEp.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\JmSlmfg.exe
  C:\Windows\System\JmSlmfg.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\dtUWWci.exe
  C:\Windows\System\dtUWWci.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\hrybtLa.exe
  C:\Windows\System\hrybtLa.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\UNdMWwU.exe
  C:\Windows\System\UNdMWwU.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\cuJEdOT.exe
  C:\Windows\System\cuJEdOT.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\ycJIWie.exe
  C:\Windows\System\ycJIWie.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\lnTPysk.exe
  C:\Windows\System\lnTPysk.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\knJvipk.exe
  C:\Windows\System\knJvipk.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\BZAFjwq.exe
  C:\Windows\System\BZAFjwq.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\aHfOhAM.exe
  C:\Windows\System\aHfOhAM.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\xvdCFUi.exe
  C:\Windows\System\xvdCFUi.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\oJzYmLk.exe
  C:\Windows\System\oJzYmLk.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\LJjraQH.exe
  C:\Windows\System\LJjraQH.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\gNdfgGU.exe
  C:\Windows\System\gNdfgGU.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\aXFWjcH.exe
  C:\Windows\System\aXFWjcH.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\YnRkdYm.exe
  C:\Windows\System\YnRkdYm.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\oYSgaJh.exe
  C:\Windows\System\oYSgaJh.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\VCGsncD.exe
  C:\Windows\System\VCGsncD.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\ZzAnaip.exe
  C:\Windows\System\ZzAnaip.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\hDiilTB.exe
  C:\Windows\System\hDiilTB.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\BtUEXuR.exe
  C:\Windows\System\BtUEXuR.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\cXRhwfv.exe
  C:\Windows\System\cXRhwfv.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\vLUZMgL.exe
  C:\Windows\System\vLUZMgL.exe
  2⤵
  PID:916
- C:\Windows\System\zNtJygp.exe
  C:\Windows\System\zNtJygp.exe
  2⤵
  PID:3180
- C:\Windows\System\ERTfZiU.exe
  C:\Windows\System\ERTfZiU.exe
  2⤵
  PID:2392
- C:\Windows\System\ksbxdaA.exe
  C:\Windows\System\ksbxdaA.exe
  2⤵
  PID:2644
- C:\Windows\System\LCSQjNq.exe
  C:\Windows\System\LCSQjNq.exe
  2⤵
  PID:2328
- C:\Windows\System\SGRwmMJ.exe
  C:\Windows\System\SGRwmMJ.exe
  2⤵
  PID:1988
- C:\Windows\System\jEicbiU.exe
  C:\Windows\System\jEicbiU.exe
  2⤵
  PID:4736
- C:\Windows\System\JMdetVu.exe
  C:\Windows\System\JMdetVu.exe
  2⤵
  PID:5048
- C:\Windows\System\yVjtFXw.exe
  C:\Windows\System\yVjtFXw.exe
  2⤵
  PID:4972
- C:\Windows\System\cRWBAca.exe
  C:\Windows\System\cRWBAca.exe
  2⤵
  PID:756
- C:\Windows\System\TWsOGjQ.exe
  C:\Windows\System\TWsOGjQ.exe
  2⤵
  PID:1064
- C:\Windows\System\unHjIth.exe
  C:\Windows\System\unHjIth.exe
  2⤵
  PID:2404
- C:\Windows\System\ceZxfuQ.exe
  C:\Windows\System\ceZxfuQ.exe
  2⤵
  PID:468
- C:\Windows\System\PotWDBb.exe
  C:\Windows\System\PotWDBb.exe
  2⤵
  PID:1632
- C:\Windows\System\fGuQvTa.exe
  C:\Windows\System\fGuQvTa.exe
  2⤵
  PID:220
- C:\Windows\System\oUvyVwT.exe
  C:\Windows\System\oUvyVwT.exe
  2⤵
  PID:4352
- C:\Windows\System\NHXZwEN.exe
  C:\Windows\System\NHXZwEN.exe
  2⤵
  PID:2324
- C:\Windows\System\xYCMFZC.exe
  C:\Windows\System\xYCMFZC.exe
  2⤵
  PID:60
- C:\Windows\System\FoBGbTh.exe
  C:\Windows\System\FoBGbTh.exe
  2⤵
  PID:3968
- C:\Windows\System\pWWsYsy.exe
  C:\Windows\System\pWWsYsy.exe
  2⤵
  PID:3076
- C:\Windows\System\EjVGZRB.exe
  C:\Windows\System\EjVGZRB.exe
  2⤵
  PID:2460
- C:\Windows\System\IkPUpzg.exe
  C:\Windows\System\IkPUpzg.exe
  2⤵
  PID:4824
- C:\Windows\System\fMzYyjK.exe
  C:\Windows\System\fMzYyjK.exe
  2⤵
  PID:4032
- C:\Windows\System\GHgPlJW.exe
  C:\Windows\System\GHgPlJW.exe
  2⤵
  PID:4940
- C:\Windows\System\fEiELOv.exe
  C:\Windows\System\fEiELOv.exe
  2⤵
  PID:2224
- C:\Windows\System\HQMgMUm.exe
  C:\Windows\System\HQMgMUm.exe
  2⤵
  PID:4840
- C:\Windows\System\anEcqgr.exe
  C:\Windows\System\anEcqgr.exe
  2⤵
  PID:5124
- C:\Windows\System\BSNJUFo.exe
  C:\Windows\System\BSNJUFo.exe
  2⤵
  PID:5148
- C:\Windows\System\dUgumcP.exe
  C:\Windows\System\dUgumcP.exe
  2⤵
  PID:5168
- C:\Windows\System\YjkCLdR.exe
  C:\Windows\System\YjkCLdR.exe
  2⤵
  PID:5196
- C:\Windows\System\bHGfVhs.exe
  C:\Windows\System\bHGfVhs.exe
  2⤵
  PID:5224
- C:\Windows\System\ioMHspI.exe
  C:\Windows\System\ioMHspI.exe
  2⤵
  PID:5240
- C:\Windows\System\EqnHvTe.exe
  C:\Windows\System\EqnHvTe.exe
  2⤵
  PID:5264
- C:\Windows\System\uGTlXsf.exe
  C:\Windows\System\uGTlXsf.exe
  2⤵
  PID:5292
- C:\Windows\System\syFvDry.exe
  C:\Windows\System\syFvDry.exe
  2⤵
  PID:5320
- C:\Windows\System\itMbJxC.exe
  C:\Windows\System\itMbJxC.exe
  2⤵
  PID:5336
- C:\Windows\System\HvDQmyt.exe
  C:\Windows\System\HvDQmyt.exe
  2⤵
  PID:5360
- C:\Windows\System\Spfhufq.exe
  C:\Windows\System\Spfhufq.exe
  2⤵
  PID:5384
- C:\Windows\System\lnXXXOg.exe
  C:\Windows\System\lnXXXOg.exe
  2⤵
  PID:5404
- C:\Windows\System\fDIfXGr.exe
  C:\Windows\System\fDIfXGr.exe
  2⤵
  PID:5428
- C:\Windows\System\iBRoJak.exe
  C:\Windows\System\iBRoJak.exe
  2⤵
  PID:5448
- C:\Windows\System\uGpANIe.exe
  C:\Windows\System\uGpANIe.exe
  2⤵
  PID:5476
- C:\Windows\System\HjQYFzg.exe
  C:\Windows\System\HjQYFzg.exe
  2⤵
  PID:5500
- C:\Windows\System\HBEwDUB.exe
  C:\Windows\System\HBEwDUB.exe
  2⤵
  PID:5524
- C:\Windows\System\GCSPhkP.exe
  C:\Windows\System\GCSPhkP.exe
  2⤵
  PID:5544
- C:\Windows\System\HNmWrxV.exe
  C:\Windows\System\HNmWrxV.exe
  2⤵
  PID:5564
- C:\Windows\System\fgMapgE.exe
  C:\Windows\System\fgMapgE.exe
  2⤵
  PID:5592
- C:\Windows\System\VwQGBNv.exe
  C:\Windows\System\VwQGBNv.exe
  2⤵
  PID:5608
- C:\Windows\System\fqWBikG.exe
  C:\Windows\System\fqWBikG.exe
  2⤵
  PID:5632
- C:\Windows\System\quzvCOy.exe
  C:\Windows\System\quzvCOy.exe
  2⤵
  PID:5648
- C:\Windows\System\JDCnqiW.exe
  C:\Windows\System\JDCnqiW.exe
  2⤵
  PID:5672
- C:\Windows\System\VoYsMBL.exe
  C:\Windows\System\VoYsMBL.exe
  2⤵
  PID:5696
- C:\Windows\System\OKwrvFt.exe
  C:\Windows\System\OKwrvFt.exe
  2⤵
  PID:5724
- C:\Windows\System\ePgfgyE.exe
  C:\Windows\System\ePgfgyE.exe
  2⤵
  PID:5744
- C:\Windows\System\PaPPdSp.exe
  C:\Windows\System\PaPPdSp.exe
  2⤵
  PID:5764
- C:\Windows\System\BONQnvV.exe
  C:\Windows\System\BONQnvV.exe
  2⤵
  PID:5784
- C:\Windows\System\XxTiLKb.exe
  C:\Windows\System\XxTiLKb.exe
  2⤵
  PID:5808
- C:\Windows\System\itpUzMa.exe
  C:\Windows\System\itpUzMa.exe
  2⤵
  PID:5824
- C:\Windows\System\uMFDQeH.exe
  C:\Windows\System\uMFDQeH.exe
  2⤵
  PID:5848
- C:\Windows\System\sZopool.exe
  C:\Windows\System\sZopool.exe
  2⤵
  PID:5868
- C:\Windows\System\xNwRknE.exe
  C:\Windows\System\xNwRknE.exe
  2⤵
  PID:5892
- C:\Windows\System\KHFCCQe.exe
  C:\Windows\System\KHFCCQe.exe
  2⤵
  PID:5912
- C:\Windows\System\gGgrubx.exe
  C:\Windows\System\gGgrubx.exe
  2⤵
  PID:5944
- C:\Windows\System\VJPxQMh.exe
  C:\Windows\System\VJPxQMh.exe
  2⤵
  PID:5960
- C:\Windows\System\QmpOEwm.exe
  C:\Windows\System\QmpOEwm.exe
  2⤵
  PID:5984
- C:\Windows\System\qlQRSCv.exe
  C:\Windows\System\qlQRSCv.exe
  2⤵
  PID:6008
- C:\Windows\System\nZhjGPt.exe
  C:\Windows\System\nZhjGPt.exe
  2⤵
  PID:6036
- C:\Windows\System\rrZevKu.exe
  C:\Windows\System\rrZevKu.exe
  2⤵
  PID:6060
- C:\Windows\System\stJQQmP.exe
  C:\Windows\System\stJQQmP.exe
  2⤵
  PID:6088
- C:\Windows\System\rNkyVgZ.exe
  C:\Windows\System\rNkyVgZ.exe
  2⤵
  PID:6108
- C:\Windows\System\vyuBAjY.exe
  C:\Windows\System\vyuBAjY.exe
  2⤵
  PID:6132
- C:\Windows\System\ouuDfvL.exe
  C:\Windows\System\ouuDfvL.exe
  2⤵
  PID:208
- C:\Windows\System\XUoRnPP.exe
  C:\Windows\System\XUoRnPP.exe
  2⤵
  PID:764
- C:\Windows\System\cZomXXL.exe
  C:\Windows\System\cZomXXL.exe
  2⤵
  PID:5140
- C:\Windows\System\zpVaYdk.exe
  C:\Windows\System\zpVaYdk.exe
  2⤵
  PID:5164
- C:\Windows\System\ZwAZyjW.exe
  C:\Windows\System\ZwAZyjW.exe
  2⤵
  PID:5260
- C:\Windows\System\JBuTokT.exe
  C:\Windows\System\JBuTokT.exe
  2⤵
  PID:5304
- C:\Windows\System\bdwArkq.exe
  C:\Windows\System\bdwArkq.exe
  2⤵
  PID:5332
- C:\Windows\System\ZCJmENn.exe
  C:\Windows\System\ZCJmENn.exe
  2⤵
  PID:5204
- C:\Windows\System\ReFRLOQ.exe
  C:\Windows\System\ReFRLOQ.exe
  2⤵
  PID:5424
- C:\Windows\System\DVWcITT.exe
  C:\Windows\System\DVWcITT.exe
  2⤵
  PID:5584
- C:\Windows\System\nfVaayZ.exe
  C:\Windows\System\nfVaayZ.exe
  2⤵
  PID:5440
- C:\Windows\System\lucSjVe.exe
  C:\Windows\System\lucSjVe.exe
  2⤵
  PID:5776
- C:\Windows\System\LpnwbGB.exe
  C:\Windows\System\LpnwbGB.exe
  2⤵
  PID:5380
- C:\Windows\System\XkqXqdX.exe
  C:\Windows\System\XkqXqdX.exe
  2⤵
  PID:5484
- C:\Windows\System\KGHQrZw.exe
  C:\Windows\System\KGHQrZw.exe
  2⤵
  PID:6104
- C:\Windows\System\wGxkjDP.exe
  C:\Windows\System\wGxkjDP.exe
  2⤵
  PID:5532
- C:\Windows\System\vcxXJDQ.exe
  C:\Windows\System\vcxXJDQ.exe
  2⤵
  PID:5560
- C:\Windows\System\WPWQRLN.exe
  C:\Windows\System\WPWQRLN.exe
  2⤵
  PID:6160
- C:\Windows\System\XcXFtex.exe
  C:\Windows\System\XcXFtex.exe
  2⤵
  PID:6180
- C:\Windows\System\udtLPrS.exe
  C:\Windows\System\udtLPrS.exe
  2⤵
  PID:6200
- C:\Windows\System\RCIqeTq.exe
  C:\Windows\System\RCIqeTq.exe
  2⤵
  PID:6224
- C:\Windows\System\VLUXZJD.exe
  C:\Windows\System\VLUXZJD.exe
  2⤵
  PID:6248
- C:\Windows\System\qYNaPEI.exe
  C:\Windows\System\qYNaPEI.exe
  2⤵
  PID:6276
- C:\Windows\System\hSBzILV.exe
  C:\Windows\System\hSBzILV.exe
  2⤵
  PID:6296
- C:\Windows\System\dHgTLha.exe
  C:\Windows\System\dHgTLha.exe
  2⤵
  PID:6324
- C:\Windows\System\kMEJMXR.exe
  C:\Windows\System\kMEJMXR.exe
  2⤵
  PID:6340
- C:\Windows\System\tWzDgWf.exe
  C:\Windows\System\tWzDgWf.exe
  2⤵
  PID:6372
- C:\Windows\System\ffEFNBl.exe
  C:\Windows\System\ffEFNBl.exe
  2⤵
  PID:6392
- C:\Windows\System\kTxNHBl.exe
  C:\Windows\System\kTxNHBl.exe
  2⤵
  PID:6416
- C:\Windows\System\WIFkdOm.exe
  C:\Windows\System\WIFkdOm.exe
  2⤵
  PID:6440
- C:\Windows\System\uSSBWSr.exe
  C:\Windows\System\uSSBWSr.exe
  2⤵
  PID:6464
- C:\Windows\System\yeJTtQq.exe
  C:\Windows\System\yeJTtQq.exe
  2⤵
  PID:6480
- C:\Windows\System\pFZrixW.exe
  C:\Windows\System\pFZrixW.exe
  2⤵
  PID:6508
- C:\Windows\System\cWNMlMh.exe
  C:\Windows\System\cWNMlMh.exe
  2⤵
  PID:6524
- C:\Windows\System\lonKOBi.exe
  C:\Windows\System\lonKOBi.exe
  2⤵
  PID:6556
- C:\Windows\System\VfYMLlA.exe
  C:\Windows\System\VfYMLlA.exe
  2⤵
  PID:6572
- C:\Windows\System\PfXlfMh.exe
  C:\Windows\System\PfXlfMh.exe
  2⤵
  PID:6596
- C:\Windows\System\XOUoQPv.exe
  C:\Windows\System\XOUoQPv.exe
  2⤵
  PID:6612
- C:\Windows\System\cYuLZVD.exe
  C:\Windows\System\cYuLZVD.exe
  2⤵
  PID:6640
- C:\Windows\System\wgnyiuH.exe
  C:\Windows\System\wgnyiuH.exe
  2⤵
  PID:6668
- C:\Windows\System\NbZOjmn.exe
  C:\Windows\System\NbZOjmn.exe
  2⤵
  PID:6688
- C:\Windows\System\AnsteHZ.exe
  C:\Windows\System\AnsteHZ.exe
  2⤵
  PID:6720
- C:\Windows\System\QdqgVET.exe
  C:\Windows\System\QdqgVET.exe
  2⤵
  PID:6736
- C:\Windows\System\NleFbpt.exe
  C:\Windows\System\NleFbpt.exe
  2⤵
  PID:6760
- C:\Windows\System\GuQyOms.exe
  C:\Windows\System\GuQyOms.exe
  2⤵
  PID:6776
- C:\Windows\System\fFodnLD.exe
  C:\Windows\System\fFodnLD.exe
  2⤵
  PID:6800
- C:\Windows\System\bXkAaMV.exe
  C:\Windows\System\bXkAaMV.exe
  2⤵
  PID:6828
- C:\Windows\System\uxnfMEg.exe
  C:\Windows\System\uxnfMEg.exe
  2⤵
  PID:6844
- C:\Windows\System\rjiXUJR.exe
  C:\Windows\System\rjiXUJR.exe
  2⤵
  PID:6864
- C:\Windows\System\HNQpHdd.exe
  C:\Windows\System\HNQpHdd.exe
  2⤵
  PID:6888
- C:\Windows\System\tXfNPqx.exe
  C:\Windows\System\tXfNPqx.exe
  2⤵
  PID:6912
- C:\Windows\System\wBxNYcJ.exe
  C:\Windows\System\wBxNYcJ.exe
  2⤵
  PID:6932
- C:\Windows\System\eeZMIAG.exe
  C:\Windows\System\eeZMIAG.exe
  2⤵
  PID:6948
- C:\Windows\System\xAZQAFF.exe
  C:\Windows\System\xAZQAFF.exe
  2⤵
  PID:6972
- C:\Windows\System\sljagMI.exe
  C:\Windows\System\sljagMI.exe
  2⤵
  PID:6992
- C:\Windows\System\yAnNlgn.exe
  C:\Windows\System\yAnNlgn.exe
  2⤵
  PID:7012
- C:\Windows\System\uaeJuMm.exe
  C:\Windows\System\uaeJuMm.exe
  2⤵
  PID:7040
- C:\Windows\System\LMeKtQi.exe
  C:\Windows\System\LMeKtQi.exe
  2⤵
  PID:7060
- C:\Windows\System\NZgicRo.exe
  C:\Windows\System\NZgicRo.exe
  2⤵
  PID:7080
- C:\Windows\System\GWcgYiq.exe
  C:\Windows\System\GWcgYiq.exe
  2⤵
  PID:7104
- C:\Windows\System\BgZhFKi.exe
  C:\Windows\System\BgZhFKi.exe
  2⤵
  PID:7124
- C:\Windows\System\hLOpios.exe
  C:\Windows\System\hLOpios.exe
  2⤵
  PID:7144
- C:\Windows\System\ixrowbX.exe
  C:\Windows\System\ixrowbX.exe
  2⤵
  PID:7164
- C:\Windows\System\dbKpUeS.exe
  C:\Windows\System\dbKpUeS.exe
  2⤵
  PID:3228
- C:\Windows\System\SghSsnv.exe
  C:\Windows\System\SghSsnv.exe
  2⤵
  PID:5620
- C:\Windows\System\iqZRZEC.exe
  C:\Windows\System\iqZRZEC.exe
  2⤵
  PID:5176
- C:\Windows\System\oJEZDrv.exe
  C:\Windows\System\oJEZDrv.exe
  2⤵
  PID:5420
- C:\Windows\System\IbUmJqD.exe
  C:\Windows\System\IbUmJqD.exe
  2⤵
  PID:5308
- C:\Windows\System\aecBpRc.exe
  C:\Windows\System\aecBpRc.exe
  2⤵
  PID:5756
- C:\Windows\System\yNlWQok.exe
  C:\Windows\System\yNlWQok.exe
  2⤵
  PID:2924
- C:\Windows\System\lNCHOSL.exe
  C:\Windows\System\lNCHOSL.exe
  2⤵
  PID:5860
- C:\Windows\System\hJCkkzS.exe
  C:\Windows\System\hJCkkzS.exe
  2⤵
  PID:5888
- C:\Windows\System\nQIJEiA.exe
  C:\Windows\System\nQIJEiA.exe
  2⤵
  PID:5908
- C:\Windows\System\exoZLSD.exe
  C:\Windows\System\exoZLSD.exe
  2⤵
  PID:6288
- C:\Windows\System\xqEQepQ.exe
  C:\Windows\System\xqEQepQ.exe
  2⤵
  PID:6000
- C:\Windows\System\yPpLlpz.exe
  C:\Windows\System\yPpLlpz.exe
  2⤵
  PID:6052
- C:\Windows\System\rzqPCzu.exe
  C:\Windows\System\rzqPCzu.exe
  2⤵
  PID:6384
- C:\Windows\System\PsRFGCc.exe
  C:\Windows\System\PsRFGCc.exe
  2⤵
  PID:5704
- C:\Windows\System\tEyjWLu.exe
  C:\Windows\System\tEyjWLu.exe
  2⤵
  PID:3296
- C:\Windows\System\ImaTMTh.exe
  C:\Windows\System\ImaTMTh.exe
  2⤵
  PID:6592
- C:\Windows\System\lMGnXqe.exe
  C:\Windows\System\lMGnXqe.exe
  2⤵
  PID:6624
- C:\Windows\System\WvZijrh.exe
  C:\Windows\System\WvZijrh.exe
  2⤵
  PID:6680
- C:\Windows\System\MgLawzw.exe
  C:\Windows\System\MgLawzw.exe
  2⤵
  PID:6312
- C:\Windows\System\WbcKGUT.exe
  C:\Windows\System\WbcKGUT.exe
  2⤵
  PID:5680
- C:\Windows\System\wYKNlgR.exe
  C:\Windows\System\wYKNlgR.exe
  2⤵
  PID:6412
- C:\Windows\System\VZWkeQj.exe
  C:\Windows\System\VZWkeQj.exe
  2⤵
  PID:5368
- C:\Windows\System\tbspail.exe
  C:\Windows\System\tbspail.exe
  2⤵
  PID:6944
- C:\Windows\System\mfgjUbz.exe
  C:\Windows\System\mfgjUbz.exe
  2⤵
  PID:6988
- C:\Windows\System\oyusgEm.exe
  C:\Windows\System\oyusgEm.exe
  2⤵
  PID:7184
- C:\Windows\System\agIbZLO.exe
  C:\Windows\System\agIbZLO.exe
  2⤵
  PID:7212
- C:\Windows\System\MSIGLXp.exe
  C:\Windows\System\MSIGLXp.exe
  2⤵
  PID:7248
- C:\Windows\System\bbrYZpz.exe
  C:\Windows\System\bbrYZpz.exe
  2⤵
  PID:7268
- C:\Windows\System\VfSRxpJ.exe
  C:\Windows\System\VfSRxpJ.exe
  2⤵
  PID:7292
- C:\Windows\System\WMoJDom.exe
  C:\Windows\System\WMoJDom.exe
  2⤵
  PID:7308
- C:\Windows\System\sFITtRG.exe
  C:\Windows\System\sFITtRG.exe
  2⤵
  PID:7340
- C:\Windows\System\JPOTIlP.exe
  C:\Windows\System\JPOTIlP.exe
  2⤵
  PID:7356
- C:\Windows\System\cjsvcCb.exe
  C:\Windows\System\cjsvcCb.exe
  2⤵
  PID:7384
- C:\Windows\System\QAjbtGP.exe
  C:\Windows\System\QAjbtGP.exe
  2⤵
  PID:7404
- C:\Windows\System\jNJtegd.exe
  C:\Windows\System\jNJtegd.exe
  2⤵
  PID:7424
- C:\Windows\System\bLpwnQC.exe
  C:\Windows\System\bLpwnQC.exe
  2⤵
  PID:7448
- C:\Windows\System\RGhtEbS.exe
  C:\Windows\System\RGhtEbS.exe
  2⤵
  PID:7472
- C:\Windows\System\wJHtBrK.exe
  C:\Windows\System\wJHtBrK.exe
  2⤵
  PID:7492
- C:\Windows\System\XUCeTxq.exe
  C:\Windows\System\XUCeTxq.exe
  2⤵
  PID:7520
- C:\Windows\System\bZoMSEa.exe
  C:\Windows\System\bZoMSEa.exe
  2⤵
  PID:7536
- C:\Windows\System\gTvarRT.exe
  C:\Windows\System\gTvarRT.exe
  2⤵
  PID:7560
- C:\Windows\System\qZVANGt.exe
  C:\Windows\System\qZVANGt.exe
  2⤵
  PID:7580
- C:\Windows\System\iHzUFvI.exe
  C:\Windows\System\iHzUFvI.exe
  2⤵
  PID:7600
- C:\Windows\System\WSYQymX.exe
  C:\Windows\System\WSYQymX.exe
  2⤵
  PID:7628
- C:\Windows\System\RqruNbV.exe
  C:\Windows\System\RqruNbV.exe
  2⤵
  PID:7652
- C:\Windows\System\dLOPdjD.exe
  C:\Windows\System\dLOPdjD.exe
  2⤵
  PID:7676
- C:\Windows\System\ZRfhJmb.exe
  C:\Windows\System\ZRfhJmb.exe
  2⤵
  PID:7696
- C:\Windows\System\PmuQvZp.exe
  C:\Windows\System\PmuQvZp.exe
  2⤵
  PID:7724
- C:\Windows\System\FXgNzOQ.exe
  C:\Windows\System\FXgNzOQ.exe
  2⤵
  PID:7748
- C:\Windows\System\wqIHrDj.exe
  C:\Windows\System\wqIHrDj.exe
  2⤵
  PID:7764
- C:\Windows\System\EBdHtxL.exe
  C:\Windows\System\EBdHtxL.exe
  2⤵
  PID:7784
- C:\Windows\System\Tgilasb.exe
  C:\Windows\System\Tgilasb.exe
  2⤵
  PID:7808
- C:\Windows\System\iNQLhED.exe
  C:\Windows\System\iNQLhED.exe
  2⤵
  PID:7836
- C:\Windows\System\RWzXCxC.exe
  C:\Windows\System\RWzXCxC.exe
  2⤵
  PID:7852
- C:\Windows\System\JxIIyZL.exe
  C:\Windows\System\JxIIyZL.exe
  2⤵
  PID:7880
- C:\Windows\System\NrJpEtp.exe
  C:\Windows\System\NrJpEtp.exe
  2⤵
  PID:7904
- C:\Windows\System\kYeSati.exe
  C:\Windows\System\kYeSati.exe
  2⤵
  PID:7924
- C:\Windows\System\AGCMqgY.exe
  C:\Windows\System\AGCMqgY.exe
  2⤵
  PID:7956
- C:\Windows\System\VUaHsiA.exe
  C:\Windows\System\VUaHsiA.exe
  2⤵
  PID:7972
- C:\Windows\System\qOtxNuR.exe
  C:\Windows\System\qOtxNuR.exe
  2⤵
  PID:7996
- C:\Windows\System\QzZrDWK.exe
  C:\Windows\System\QzZrDWK.exe
  2⤵
  PID:8020
- C:\Windows\System\HqkSHxY.exe
  C:\Windows\System\HqkSHxY.exe
  2⤵
  PID:8040
- C:\Windows\System\DPRAwyb.exe
  C:\Windows\System\DPRAwyb.exe
  2⤵
  PID:8060
- C:\Windows\System\tpEIeZM.exe
  C:\Windows\System\tpEIeZM.exe
  2⤵
  PID:8084
- C:\Windows\System\xmwNSVO.exe
  C:\Windows\System\xmwNSVO.exe
  2⤵
  PID:8104
- C:\Windows\System\HQWrXEf.exe
  C:\Windows\System\HQWrXEf.exe
  2⤵
  PID:8120
- C:\Windows\System\NBRsmEd.exe
  C:\Windows\System\NBRsmEd.exe
  2⤵
  PID:8136
- C:\Windows\System\ckrykot.exe
  C:\Windows\System\ckrykot.exe
  2⤵
  PID:8152
- C:\Windows\System\umEAsPw.exe
  C:\Windows\System\umEAsPw.exe
  2⤵
  PID:8172
- C:\Windows\System\vwEeqJZ.exe
  C:\Windows\System\vwEeqJZ.exe
  2⤵
  PID:7004
- C:\Windows\System\ZpDeycc.exe
  C:\Windows\System\ZpDeycc.exe
  2⤵
  PID:7076
- C:\Windows\System\nBjMolG.exe
  C:\Windows\System\nBjMolG.exe
  2⤵
  PID:6580
- C:\Windows\System\ohNRzHL.exe
  C:\Windows\System\ohNRzHL.exe
  2⤵
  PID:6836
- C:\Windows\System\IqIeXVL.exe
  C:\Windows\System\IqIeXVL.exe
  2⤵
  PID:2312
- C:\Windows\System\wERwrue.exe
  C:\Windows\System\wERwrue.exe
  2⤵
  PID:8016
- C:\Windows\System\aEbkhHi.exe
  C:\Windows\System\aEbkhHi.exe
  2⤵
  PID:8036
- C:\Windows\System\JZFwpXA.exe
  C:\Windows\System\JZFwpXA.exe
  2⤵
  PID:6568
- C:\Windows\System\ytVvXsV.exe
  C:\Windows\System\ytVvXsV.exe
  2⤵
  PID:7072
- C:\Windows\System\HkVJUlE.exe
  C:\Windows\System\HkVJUlE.exe
  2⤵
  PID:5352
- C:\Windows\System\SQrYtSw.exe
  C:\Windows\System\SQrYtSw.exe
  2⤵
  PID:2340
- C:\Windows\System\XNNULHq.exe
  C:\Windows\System\XNNULHq.exe
  2⤵
  PID:5688
- C:\Windows\System\xZDXtzm.exe
  C:\Windows\System\xZDXtzm.exe
  2⤵
  PID:6152
- C:\Windows\System\oXQQdZt.exe
  C:\Windows\System\oXQQdZt.exe
  2⤵
  PID:7744
- C:\Windows\System\edHKLjg.exe
  C:\Windows\System\edHKLjg.exe
  2⤵
  PID:7820
- C:\Windows\System\QozyIew.exe
  C:\Windows\System\QozyIew.exe
  2⤵
  PID:6124
- C:\Windows\System\hntmldl.exe
  C:\Windows\System\hntmldl.exe
  2⤵
  PID:7948
- C:\Windows\System\HzHWikH.exe
  C:\Windows\System\HzHWikH.exe
  2⤵
  PID:7664
- C:\Windows\System\lNZkjIG.exe
  C:\Windows\System\lNZkjIG.exe
  2⤵
  PID:8184
- C:\Windows\System\wZkJDce.exe
  C:\Windows\System\wZkJDce.exe
  2⤵
  PID:7396
- C:\Windows\System\WqUiiXA.exe
  C:\Windows\System\WqUiiXA.exe
  2⤵
  PID:6264
- C:\Windows\System\gJalVMT.exe
  C:\Windows\System\gJalVMT.exe
  2⤵
  PID:8196
- C:\Windows\System\WbwDmqw.exe
  C:\Windows\System\WbwDmqw.exe
  2⤵
  PID:8220
- C:\Windows\System\bkFtzwK.exe
  C:\Windows\System\bkFtzwK.exe
  2⤵
  PID:8244
- C:\Windows\System\VUZHXPV.exe
  C:\Windows\System\VUZHXPV.exe
  2⤵
  PID:8268
- C:\Windows\System\xSKtZwO.exe
  C:\Windows\System\xSKtZwO.exe
  2⤵
  PID:8292
- C:\Windows\System\vaGEkCI.exe
  C:\Windows\System\vaGEkCI.exe
  2⤵
  PID:8312
- C:\Windows\System\jsoNXUX.exe
  C:\Windows\System\jsoNXUX.exe
  2⤵
  PID:8336
- C:\Windows\System\qDFFpoG.exe
  C:\Windows\System\qDFFpoG.exe
  2⤵
  PID:8364
- C:\Windows\System\yvosbQD.exe
  C:\Windows\System\yvosbQD.exe
  2⤵
  PID:8392
- C:\Windows\System\ZjCtcFz.exe
  C:\Windows\System\ZjCtcFz.exe
  2⤵
  PID:8412
- C:\Windows\System\JDiLEfs.exe
  C:\Windows\System\JDiLEfs.exe
  2⤵
  PID:8444
- C:\Windows\System\VggXPxp.exe
  C:\Windows\System\VggXPxp.exe
  2⤵
  PID:8464
- C:\Windows\System\MRQQdtu.exe
  C:\Windows\System\MRQQdtu.exe
  2⤵
  PID:8484
- C:\Windows\System\gUcSaBD.exe
  C:\Windows\System\gUcSaBD.exe
  2⤵
  PID:8500
- C:\Windows\System\MBCeoNl.exe
  C:\Windows\System\MBCeoNl.exe
  2⤵
  PID:8516
- C:\Windows\System\LiNmZMS.exe
  C:\Windows\System\LiNmZMS.exe
  2⤵
  PID:8536
- C:\Windows\System\ZhAqIFv.exe
  C:\Windows\System\ZhAqIFv.exe
  2⤵
  PID:8564
- C:\Windows\System\eTSwngM.exe
  C:\Windows\System\eTSwngM.exe
  2⤵
  PID:8588
- C:\Windows\System\GgttwrL.exe
  C:\Windows\System\GgttwrL.exe
  2⤵
  PID:8612
- C:\Windows\System\OZoZWdT.exe
  C:\Windows\System\OZoZWdT.exe
  2⤵
  PID:8640
- C:\Windows\System\WEZQoTC.exe
  C:\Windows\System\WEZQoTC.exe
  2⤵
  PID:8656
- C:\Windows\System\BMcZKOm.exe
  C:\Windows\System\BMcZKOm.exe
  2⤵
  PID:8680
- C:\Windows\System\uwopsLe.exe
  C:\Windows\System\uwopsLe.exe
  2⤵
  PID:8708
- C:\Windows\System\YNAPAkL.exe
  C:\Windows\System\YNAPAkL.exe
  2⤵
  PID:8732
- C:\Windows\System\uuROFCc.exe
  C:\Windows\System\uuROFCc.exe
  2⤵
  PID:8788
- C:\Windows\System\ZUkRmhP.exe
  C:\Windows\System\ZUkRmhP.exe
  2⤵
  PID:8812
- C:\Windows\System\vFXzObd.exe
  C:\Windows\System\vFXzObd.exe
  2⤵
  PID:8840
- C:\Windows\System\JLbTDiX.exe
  C:\Windows\System\JLbTDiX.exe
  2⤵
  PID:8856
- C:\Windows\System\cWZMMgk.exe
  C:\Windows\System\cWZMMgk.exe
  2⤵
  PID:8896
- C:\Windows\System\PoOskZp.exe
  C:\Windows\System\PoOskZp.exe
  2⤵
  PID:8928
- C:\Windows\System\pgPksMq.exe
  C:\Windows\System\pgPksMq.exe
  2⤵
  PID:8956
- C:\Windows\System\kPpBbvu.exe
  C:\Windows\System\kPpBbvu.exe
  2⤵
  PID:8976
- C:\Windows\System\MbohWRX.exe
  C:\Windows\System\MbohWRX.exe
  2⤵
  PID:9008
- C:\Windows\System\lemnwkQ.exe
  C:\Windows\System\lemnwkQ.exe
  2⤵
  PID:9028
- C:\Windows\System\ufoHpRI.exe
  C:\Windows\System\ufoHpRI.exe
  2⤵
  PID:9052
- C:\Windows\System\kYHIevu.exe
  C:\Windows\System\kYHIevu.exe
  2⤵
  PID:9076
- C:\Windows\System\WCOWUYf.exe
  C:\Windows\System\WCOWUYf.exe
  2⤵
  PID:9100
- C:\Windows\System\zUGBfIc.exe
  C:\Windows\System\zUGBfIc.exe
  2⤵
  PID:6044
- C:\Windows\System\EWVAPMw.exe
  C:\Windows\System\EWVAPMw.exe
  2⤵
  PID:5816
- C:\Windows\System\CJRAKvI.exe
  C:\Windows\System\CJRAKvI.exe
  2⤵
  PID:6728
- C:\Windows\System\ycfPLTf.exe
  C:\Windows\System\ycfPLTf.exe
  2⤵
  PID:9092
- C:\Windows\System\ICrodMW.exe
  C:\Windows\System\ICrodMW.exe
  2⤵
  PID:9124
- C:\Windows\System\zoXNOvR.exe
  C:\Windows\System\zoXNOvR.exe
  2⤵
  PID:7988
- C:\Windows\System\latqKwh.exe
  C:\Windows\System\latqKwh.exe
  2⤵
  PID:8008
- C:\Windows\System\sMnXGZr.exe
  C:\Windows\System\sMnXGZr.exe
  2⤵
  PID:9228
- C:\Windows\System\najilOT.exe
  C:\Windows\System\najilOT.exe
  2⤵
  PID:9252
- C:\Windows\System\CdGCLzZ.exe
  C:\Windows\System\CdGCLzZ.exe
  2⤵
  PID:9276
- C:\Windows\System\ItAYofF.exe
  C:\Windows\System\ItAYofF.exe
  2⤵
  PID:9304
- C:\Windows\System\aeHkPUH.exe
  C:\Windows\System\aeHkPUH.exe
  2⤵
  PID:9336
- C:\Windows\System\TdtiUOl.exe
  C:\Windows\System\TdtiUOl.exe
  2⤵
  PID:9372
- C:\Windows\System\VeTcYvT.exe
  C:\Windows\System\VeTcYvT.exe
  2⤵
  PID:9404
- C:\Windows\System\usCimVs.exe
  C:\Windows\System\usCimVs.exe
  2⤵
  PID:9424
- C:\Windows\System\PujNTCs.exe
  C:\Windows\System\PujNTCs.exe
  2⤵
  PID:9440
- C:\Windows\System\iTCcmFc.exe
  C:\Windows\System\iTCcmFc.exe
  2⤵
  PID:9456
- C:\Windows\System\YYpCWSm.exe
  C:\Windows\System\YYpCWSm.exe
  2⤵
  PID:9480
- C:\Windows\System\mxMeHjg.exe
  C:\Windows\System\mxMeHjg.exe
  2⤵
  PID:9512
- C:\Windows\System\tuTrcwq.exe
  C:\Windows\System\tuTrcwq.exe
  2⤵
  PID:9536
- C:\Windows\System\rqcmrPI.exe
  C:\Windows\System\rqcmrPI.exe
  2⤵
  PID:9568
- C:\Windows\System\btAWLPl.exe
  C:\Windows\System\btAWLPl.exe
  2⤵
  PID:9588
- C:\Windows\System\xktMnLD.exe
  C:\Windows\System\xktMnLD.exe
  2⤵
  PID:9608
- C:\Windows\System\XJZCuFW.exe
  C:\Windows\System\XJZCuFW.exe
  2⤵
  PID:9668
- C:\Windows\System\tVGpaQr.exe
  C:\Windows\System\tVGpaQr.exe
  2⤵
  PID:9684
- C:\Windows\System\DcsbENp.exe
  C:\Windows\System\DcsbENp.exe
  2⤵
  PID:9708
- C:\Windows\System\tZXRLij.exe
  C:\Windows\System\tZXRLij.exe
  2⤵
  PID:9736
- C:\Windows\System\ngRtoIk.exe
  C:\Windows\System\ngRtoIk.exe
  2⤵
  PID:9764
- C:\Windows\System\SOPgaIx.exe
  C:\Windows\System\SOPgaIx.exe
  2⤵
  PID:9808
- C:\Windows\System\YLwmVUU.exe
  C:\Windows\System\YLwmVUU.exe
  2⤵
  PID:9836
- C:\Windows\System\tciZNcn.exe
  C:\Windows\System\tciZNcn.exe
  2⤵
  PID:9876
- C:\Windows\System\XomtYyq.exe
  C:\Windows\System\XomtYyq.exe
  2⤵
  PID:9904
- C:\Windows\System\KzdtTXS.exe
  C:\Windows\System\KzdtTXS.exe
  2⤵
  PID:9928
- C:\Windows\System\dlmnhIf.exe
  C:\Windows\System\dlmnhIf.exe
  2⤵
  PID:9948
- C:\Windows\System\jhOxFBe.exe
  C:\Windows\System\jhOxFBe.exe
  2⤵
  PID:9968
- C:\Windows\System\doJMzKJ.exe
  C:\Windows\System\doJMzKJ.exe
  2⤵
  PID:9992
- C:\Windows\System\QKtywsg.exe
  C:\Windows\System\QKtywsg.exe
  2⤵
  PID:10008
- C:\Windows\System\rdiEJZH.exe
  C:\Windows\System\rdiEJZH.exe
  2⤵
  PID:10028
- C:\Windows\System\uCVCAVK.exe
  C:\Windows\System\uCVCAVK.exe
  2⤵
  PID:10052
- C:\Windows\System\stqUzZT.exe
  C:\Windows\System\stqUzZT.exe
  2⤵
  PID:10072
- C:\Windows\System\sIomHuU.exe
  C:\Windows\System\sIomHuU.exe
  2⤵
  PID:10096
- C:\Windows\System\nQWbcvD.exe
  C:\Windows\System\nQWbcvD.exe
  2⤵
  PID:10124
- C:\Windows\System\aDByius.exe
  C:\Windows\System\aDByius.exe
  2⤵
  PID:10144
- C:\Windows\System\kXiElIa.exe
  C:\Windows\System\kXiElIa.exe
  2⤵
  PID:10168
- C:\Windows\System\rDlgHkY.exe
  C:\Windows\System\rDlgHkY.exe
  2⤵
  PID:10192
- C:\Windows\System\CTqqorX.exe
  C:\Windows\System\CTqqorX.exe
  2⤵
  PID:10212
- C:\Windows\System\wzQlEUb.exe
  C:\Windows\System\wzQlEUb.exe
  2⤵
  PID:10236
- C:\Windows\System\JcqFGNe.exe
  C:\Windows\System\JcqFGNe.exe
  2⤵
  PID:8308
- C:\Windows\System\CkZkOPV.exe
  C:\Windows\System\CkZkOPV.exe
  2⤵
  PID:8356
- C:\Windows\System\gzwVQPr.exe
  C:\Windows\System\gzwVQPr.exe
  2⤵
  PID:7112
- C:\Windows\System\WOvZsmP.exe
  C:\Windows\System\WOvZsmP.exe
  2⤵
  PID:7352
- C:\Windows\System\NPCBrUI.exe
  C:\Windows\System\NPCBrUI.exe
  2⤵
  PID:8604
- C:\Windows\System\TzDeRUK.exe
  C:\Windows\System\TzDeRUK.exe
  2⤵
  PID:8672
- C:\Windows\System\HrhbnpB.exe
  C:\Windows\System\HrhbnpB.exe
  2⤵
  PID:2024
- C:\Windows\System\KFLwRdO.exe
  C:\Windows\System\KFLwRdO.exe
  2⤵
  PID:8752
- C:\Windows\System\dQAnekF.exe
  C:\Windows\System\dQAnekF.exe
  2⤵
  PID:7192
- C:\Windows\System\nzuCPBu.exe
  C:\Windows\System\nzuCPBu.exe
  2⤵
  PID:8964
- C:\Windows\System\vNyOgUY.exe
  C:\Windows\System\vNyOgUY.exe
  2⤵
  PID:8164
- C:\Windows\System\JxIpwiq.exe
  C:\Windows\System\JxIpwiq.exe
  2⤵
  PID:9060
- C:\Windows\System\oWozKRS.exe
  C:\Windows\System\oWozKRS.exe
  2⤵
  PID:8092
- C:\Windows\System\FJtOxTq.exe
  C:\Windows\System\FJtOxTq.exe
  2⤵
  PID:8716
- C:\Windows\System\idPuDoz.exe
  C:\Windows\System\idPuDoz.exe
  2⤵
  PID:7736
- C:\Windows\System\Opbuvqs.exe
  C:\Windows\System\Opbuvqs.exe
  2⤵
  PID:4396
- C:\Windows\System\wIKgzmE.exe
  C:\Windows\System\wIKgzmE.exe
  2⤵
  PID:8228
- C:\Windows\System\wFPMoLV.exe
  C:\Windows\System\wFPMoLV.exe
  2⤵
  PID:8276
- C:\Windows\System\XzLEiRd.exe
  C:\Windows\System\XzLEiRd.exe
  2⤵
  PID:8404
- C:\Windows\System\gzbfcGz.exe
  C:\Windows\System\gzbfcGz.exe
  2⤵
  PID:8456
- C:\Windows\System\bLaPVwo.exe
  C:\Windows\System\bLaPVwo.exe
  2⤵
  PID:8496
- C:\Windows\System\hzVZAmy.exe
  C:\Windows\System\hzVZAmy.exe
  2⤵
  PID:8532
- C:\Windows\System\WXYGJga.exe
  C:\Windows\System\WXYGJga.exe
  2⤵
  PID:9468
- C:\Windows\System\aQDnwkA.exe
  C:\Windows\System\aQDnwkA.exe
  2⤵
  PID:8636
- C:\Windows\System\YECHuXj.exe
  C:\Windows\System\YECHuXj.exe
  2⤵
  PID:6856
- C:\Windows\System\ylGMNbm.exe
  C:\Windows\System\ylGMNbm.exe
  2⤵
  PID:8820
- C:\Windows\System\YypDqPG.exe
  C:\Windows\System\YypDqPG.exe
  2⤵
  PID:8848
- C:\Windows\System\eFbKAVI.exe
  C:\Windows\System\eFbKAVI.exe
  2⤵
  PID:9664
- C:\Windows\System\BICsdwj.exe
  C:\Windows\System\BICsdwj.exe
  2⤵
  PID:9756
- C:\Windows\System\rJFZITm.exe
  C:\Windows\System\rJFZITm.exe
  2⤵
  PID:8984
- C:\Windows\System\wsMLLrH.exe
  C:\Windows\System\wsMLLrH.exe
  2⤵
  PID:9000
- C:\Windows\System\NIdyoLz.exe
  C:\Windows\System\NIdyoLz.exe
  2⤵
  PID:3492
- C:\Windows\System\RWYsyHE.exe
  C:\Windows\System\RWYsyHE.exe
  2⤵
  PID:9064
- C:\Windows\System\gjhWsDp.exe
  C:\Windows\System\gjhWsDp.exe
  2⤵
  PID:8544
- C:\Windows\System\msSZemh.exe
  C:\Windows\System\msSZemh.exe
  2⤵
  PID:9920
- C:\Windows\System\xnoQGaT.exe
  C:\Windows\System\xnoQGaT.exe
  2⤵
  PID:9244
- C:\Windows\System\WdabyNW.exe
  C:\Windows\System\WdabyNW.exe
  2⤵
  PID:9196
- C:\Windows\System\LDWTYJq.exe
  C:\Windows\System\LDWTYJq.exe
  2⤵
  PID:3836
- C:\Windows\System\oTjdGLH.exe
  C:\Windows\System\oTjdGLH.exe
  2⤵
  PID:9496
- C:\Windows\System\OhODKrQ.exe
  C:\Windows\System\OhODKrQ.exe
  2⤵
  PID:10204
- C:\Windows\System\RUWQCXK.exe
  C:\Windows\System\RUWQCXK.exe
  2⤵
  PID:1496
- C:\Windows\System\wyeAGbM.exe
  C:\Windows\System\wyeAGbM.exe
  2⤵
  PID:7228
- C:\Windows\System\jGleMgT.exe
  C:\Windows\System\jGleMgT.exe
  2⤵
  PID:7552
- C:\Windows\System\NecaIVn.exe
  C:\Windows\System\NecaIVn.exe
  2⤵
  PID:7992
- C:\Windows\System\vaByVxA.exe
  C:\Windows\System\vaByVxA.exe
  2⤵
  PID:6752
- C:\Windows\System\uNSkkdw.exe
  C:\Windows\System\uNSkkdw.exe
  2⤵
  PID:10256
- C:\Windows\System\rwRzXuM.exe
  C:\Windows\System\rwRzXuM.exe
  2⤵
  PID:10280
- C:\Windows\System\gTdclqB.exe
  C:\Windows\System\gTdclqB.exe
  2⤵
  PID:10304
- C:\Windows\System\cEWDcAA.exe
  C:\Windows\System\cEWDcAA.exe
  2⤵
  PID:10324
- C:\Windows\System\kRwwSIp.exe
  C:\Windows\System\kRwwSIp.exe
  2⤵
  PID:10348
- C:\Windows\System\opotJyq.exe
  C:\Windows\System\opotJyq.exe
  2⤵
  PID:10372
- C:\Windows\System\dnaPKGU.exe
  C:\Windows\System\dnaPKGU.exe
  2⤵
  PID:10392
- C:\Windows\System\UcqlFiO.exe
  C:\Windows\System\UcqlFiO.exe
  2⤵
  PID:10416
- C:\Windows\System\uxOVisE.exe
  C:\Windows\System\uxOVisE.exe
  2⤵
  PID:10436
- C:\Windows\System\UBKviQf.exe
  C:\Windows\System\UBKviQf.exe
  2⤵
  PID:10460
- C:\Windows\System\EMbVrWf.exe
  C:\Windows\System\EMbVrWf.exe
  2⤵
  PID:10488
- C:\Windows\System\NiXXJgF.exe
  C:\Windows\System\NiXXJgF.exe
  2⤵
  PID:10508
- C:\Windows\System\RquEnDP.exe
  C:\Windows\System\RquEnDP.exe
  2⤵
  PID:10532
- C:\Windows\System\neLdGnE.exe
  C:\Windows\System\neLdGnE.exe
  2⤵
  PID:10552
- C:\Windows\System\bqzEuYz.exe
  C:\Windows\System\bqzEuYz.exe
  2⤵
  PID:10592
- C:\Windows\System\qEWPMUI.exe
  C:\Windows\System\qEWPMUI.exe
  2⤵
  PID:10612
- C:\Windows\System\AruNIiA.exe
  C:\Windows\System\AruNIiA.exe
  2⤵
  PID:10632
- C:\Windows\System\rETvTfw.exe
  C:\Windows\System\rETvTfw.exe
  2⤵
  PID:10652
- C:\Windows\System\qkxRRBp.exe
  C:\Windows\System\qkxRRBp.exe
  2⤵
  PID:10676
- C:\Windows\System\OfTWBVL.exe
  C:\Windows\System\OfTWBVL.exe
  2⤵
  PID:10700
- C:\Windows\System\hJRSpDA.exe
  C:\Windows\System\hJRSpDA.exe
  2⤵
  PID:10724
- C:\Windows\System\DmOdJYQ.exe
  C:\Windows\System\DmOdJYQ.exe
  2⤵
  PID:10744
- C:\Windows\System\qgYrFnN.exe
  C:\Windows\System\qgYrFnN.exe
  2⤵
  PID:10764
- C:\Windows\System\MUUoUMU.exe
  C:\Windows\System\MUUoUMU.exe
  2⤵
  PID:10784
- C:\Windows\System\GWsfBNJ.exe
  C:\Windows\System\GWsfBNJ.exe
  2⤵
  PID:10808
- C:\Windows\System\tqClkUN.exe
  C:\Windows\System\tqClkUN.exe
  2⤵
  PID:10828
- C:\Windows\System\WqBBaiY.exe
  C:\Windows\System\WqBBaiY.exe
  2⤵
  PID:10848
- C:\Windows\System\EhXZUjQ.exe
  C:\Windows\System\EhXZUjQ.exe
  2⤵
  PID:10872
- C:\Windows\System\JPRWDUU.exe
  C:\Windows\System\JPRWDUU.exe
  2⤵
  PID:10892
- C:\Windows\System\VVVFLKe.exe
  C:\Windows\System\VVVFLKe.exe
  2⤵
  PID:10916
- C:\Windows\System\RlVYCBq.exe
  C:\Windows\System\RlVYCBq.exe
  2⤵
  PID:10936
- C:\Windows\System\YkxeVrP.exe
  C:\Windows\System\YkxeVrP.exe
  2⤵
  PID:10956
- C:\Windows\System\hIRVEsX.exe
  C:\Windows\System\hIRVEsX.exe
  2⤵
  PID:10984
- C:\Windows\System\YQIAOyP.exe
  C:\Windows\System\YQIAOyP.exe
  2⤵
  PID:11012
- C:\Windows\System\EWcRazh.exe
  C:\Windows\System\EWcRazh.exe
  2⤵
  PID:11032
- C:\Windows\System\TaxjTIj.exe
  C:\Windows\System\TaxjTIj.exe
  2⤵
  PID:11052
- C:\Windows\System\mUDfGNP.exe
  C:\Windows\System\mUDfGNP.exe
  2⤵
  PID:11080
- C:\Windows\System\OLyhnrx.exe
  C:\Windows\System\OLyhnrx.exe
  2⤵
  PID:11096
- C:\Windows\System\sWRdnhH.exe
  C:\Windows\System\sWRdnhH.exe
  2⤵
  PID:11124
- C:\Windows\System\kduAuXN.exe
  C:\Windows\System\kduAuXN.exe
  2⤵
  PID:11144
- C:\Windows\System\lLEcBdV.exe
  C:\Windows\System\lLEcBdV.exe
  2⤵
  PID:11164
- C:\Windows\System\QgJQNsx.exe
  C:\Windows\System\QgJQNsx.exe
  2⤵
  PID:11188
- C:\Windows\System\kOCQwHa.exe
  C:\Windows\System\kOCQwHa.exe
  2⤵
  PID:11208
- C:\Windows\System\ruIhqIA.exe
  C:\Windows\System\ruIhqIA.exe
  2⤵
  PID:11228
- C:\Windows\System\KmMgWzN.exe
  C:\Windows\System\KmMgWzN.exe
  2⤵
  PID:11252
- C:\Windows\System\SNldfOb.exe
  C:\Windows\System\SNldfOb.exe
  2⤵
  PID:9892
- C:\Windows\System\aHFSwbH.exe
  C:\Windows\System\aHFSwbH.exe
  2⤵
  PID:6256
- C:\Windows\System\oxGhVRP.exe
  C:\Windows\System\oxGhVRP.exe
  2⤵
  PID:9120
- C:\Windows\System\kxOkjFX.exe
  C:\Windows\System\kxOkjFX.exe
  2⤵
  PID:8388
- C:\Windows\System\cssVnaA.exe
  C:\Windows\System\cssVnaA.exe
  2⤵
  PID:9420
- C:\Windows\System\BrYaHeR.exe
  C:\Windows\System\BrYaHeR.exe
  2⤵
  PID:8632
- C:\Windows\System\BDgWlwS.exe
  C:\Windows\System\BDgWlwS.exe
  2⤵
  PID:9288
- C:\Windows\System\YhrLFlz.exe
  C:\Windows\System\YhrLFlz.exe
  2⤵
  PID:8828
- C:\Windows\System\JfEIhUn.exe
  C:\Windows\System\JfEIhUn.exe
  2⤵
  PID:9400
- C:\Windows\System\KmXJAxM.exe
  C:\Windows\System\KmXJAxM.exe
  2⤵
  PID:8096
- C:\Windows\System\HHjSJAh.exe
  C:\Windows\System\HHjSJAh.exe
  2⤵
  PID:9896
- C:\Windows\System\YrdRAho.exe
  C:\Windows\System\YrdRAho.exe
  2⤵
  PID:7528
- C:\Windows\System\LQCflDr.exe
  C:\Windows\System\LQCflDr.exe
  2⤵
  PID:8344
- C:\Windows\System\ruMrgps.exe
  C:\Windows\System\ruMrgps.exe
  2⤵
  PID:9552
- C:\Windows\System\FhaVvXj.exe
  C:\Windows\System\FhaVvXj.exe
  2⤵
  PID:9772
- C:\Windows\System\pmNBmvr.exe
  C:\Windows\System\pmNBmvr.exe
  2⤵
  PID:7980
- C:\Windows\System\LAnptZY.exe
  C:\Windows\System\LAnptZY.exe
  2⤵
  PID:10340
- C:\Windows\System\kVpyhzU.exe
  C:\Windows\System\kVpyhzU.exe
  2⤵
  PID:5556
- C:\Windows\System\vwSjloP.exe
  C:\Windows\System\vwSjloP.exe
  2⤵
  PID:10000
- C:\Windows\System\iAaWFXD.exe
  C:\Windows\System\iAaWFXD.exe
  2⤵
  PID:8204
- C:\Windows\System\cGeGOJQ.exe
  C:\Windows\System\cGeGOJQ.exe
  2⤵
  PID:10548
- C:\Windows\System\AuIrvuB.exe
  C:\Windows\System\AuIrvuB.exe
  2⤵
  PID:10068
- C:\Windows\System\uGJMkVj.exe
  C:\Windows\System\uGJMkVj.exe
  2⤵
  PID:9604
- C:\Windows\System\LAhdukS.exe
  C:\Windows\System\LAhdukS.exe
  2⤵
  PID:11288
- C:\Windows\System\sFLAzlX.exe
  C:\Windows\System\sFLAzlX.exe
  2⤵
  PID:11316
- C:\Windows\System\yExxjrq.exe
  C:\Windows\System\yExxjrq.exe
  2⤵
  PID:11332
- C:\Windows\System\bJFCZrN.exe
  C:\Windows\System\bJFCZrN.exe
  2⤵
  PID:11352
- C:\Windows\System\BbPnjmu.exe
  C:\Windows\System\BbPnjmu.exe
  2⤵
  PID:11376
- C:\Windows\System\aDwhoKp.exe
  C:\Windows\System\aDwhoKp.exe
  2⤵
  PID:11396
- C:\Windows\System\hOftJlT.exe
  C:\Windows\System\hOftJlT.exe
  2⤵
  PID:11424
- C:\Windows\System\tEntjWF.exe
  C:\Windows\System\tEntjWF.exe
  2⤵
  PID:11444
- C:\Windows\System\RRUeIbr.exe
  C:\Windows\System\RRUeIbr.exe
  2⤵
  PID:11468
- C:\Windows\System\vUaQaok.exe
  C:\Windows\System\vUaQaok.exe
  2⤵
  PID:11504
- C:\Windows\System\erBieNM.exe
  C:\Windows\System\erBieNM.exe
  2⤵
  PID:11524
- C:\Windows\System\NhrbhvZ.exe
  C:\Windows\System\NhrbhvZ.exe
  2⤵
  PID:11548
- C:\Windows\System\pzTvcVa.exe
  C:\Windows\System\pzTvcVa.exe
  2⤵
  PID:11572
- C:\Windows\System\nfWpWCa.exe
  C:\Windows\System\nfWpWCa.exe
  2⤵
  PID:11592
- C:\Windows\System\wZTZfnG.exe
  C:\Windows\System\wZTZfnG.exe
  2⤵
  PID:11612
- C:\Windows\System\ZnKAEqZ.exe
  C:\Windows\System\ZnKAEqZ.exe
  2⤵
  PID:11636
- C:\Windows\System\SYRuNzF.exe
  C:\Windows\System\SYRuNzF.exe
  2⤵
  PID:11660
- C:\Windows\System\xlRPheb.exe
  C:\Windows\System\xlRPheb.exe
  2⤵
  PID:11684
- C:\Windows\System\AEpXRnw.exe
  C:\Windows\System\AEpXRnw.exe
  2⤵
  PID:11704
- C:\Windows\System\rMPhSme.exe
  C:\Windows\System\rMPhSme.exe
  2⤵
  PID:11728
- C:\Windows\System\NEhBMTa.exe
  C:\Windows\System\NEhBMTa.exe
  2⤵
  PID:11748
- C:\Windows\System\djrWhij.exe
  C:\Windows\System\djrWhij.exe
  2⤵
  PID:11772
- C:\Windows\System\zqwPIkS.exe
  C:\Windows\System\zqwPIkS.exe
  2⤵
  PID:11792
- C:\Windows\System\ZbhVGdY.exe
  C:\Windows\System\ZbhVGdY.exe
  2⤵
  PID:11812
- C:\Windows\System\RVMRrzE.exe
  C:\Windows\System\RVMRrzE.exe
  2⤵
  PID:11836
- C:\Windows\System\rwWlraP.exe
  C:\Windows\System\rwWlraP.exe
  2⤵
  PID:11856
- C:\Windows\System\uelBvLo.exe
  C:\Windows\System\uelBvLo.exe
  2⤵
  PID:11876
- C:\Windows\System\ECjGVTI.exe
  C:\Windows\System\ECjGVTI.exe
  2⤵
  PID:11904
- C:\Windows\System\RSWMtPM.exe
  C:\Windows\System\RSWMtPM.exe
  2⤵
  PID:11928
- C:\Windows\System\wtkkAVM.exe
  C:\Windows\System\wtkkAVM.exe
  2⤵
  PID:11952
- C:\Windows\System\KfqFPax.exe
  C:\Windows\System\KfqFPax.exe
  2⤵
  PID:11976
- C:\Windows\System\tXsKzxa.exe
  C:\Windows\System\tXsKzxa.exe
  2⤵
  PID:11996
- C:\Windows\System\vlKgbfi.exe
  C:\Windows\System\vlKgbfi.exe
  2⤵
  PID:12020
- C:\Windows\System\FXuDWfY.exe
  C:\Windows\System\FXuDWfY.exe
  2⤵
  PID:12044
- C:\Windows\System\ZoJOhod.exe
  C:\Windows\System\ZoJOhod.exe
  2⤵
  PID:12064
- C:\Windows\System\tfIeCzc.exe
  C:\Windows\System\tfIeCzc.exe
  2⤵
  PID:12088
- C:\Windows\System\iEnXgFv.exe
  C:\Windows\System\iEnXgFv.exe
  2⤵
  PID:12116
- C:\Windows\System\wqxGMYx.exe
  C:\Windows\System\wqxGMYx.exe
  2⤵
  PID:12132
- C:\Windows\System\FEiKKyk.exe
  C:\Windows\System\FEiKKyk.exe
  2⤵
  PID:12152
- C:\Windows\System\LJiurkC.exe
  C:\Windows\System\LJiurkC.exe
  2⤵
  PID:12172
- C:\Windows\System\VAumnTC.exe
  C:\Windows\System\VAumnTC.exe
  2⤵
  PID:12192
- C:\Windows\System\QVegfaq.exe
  C:\Windows\System\QVegfaq.exe
  2⤵
  PID:12208
- C:\Windows\System\oPbVEIc.exe
  C:\Windows\System\oPbVEIc.exe
  2⤵
  PID:12224
- C:\Windows\System\rRrjnEF.exe
  C:\Windows\System\rRrjnEF.exe
  2⤵
  PID:12244
- C:\Windows\System\JQdsYiL.exe
  C:\Windows\System\JQdsYiL.exe
  2⤵
  PID:12260
- C:\Windows\System\LFbZuCz.exe
  C:\Windows\System\LFbZuCz.exe
  2⤵
  PID:12276
- C:\Windows\System\FFxbRjh.exe
  C:\Windows\System\FFxbRjh.exe
  2⤵
  PID:10140
- C:\Windows\System\zOnesQB.exe
  C:\Windows\System\zOnesQB.exe
  2⤵
  PID:10716
- C:\Windows\System\StsnHjv.exe
  C:\Windows\System\StsnHjv.exe
  2⤵
  PID:9728
- C:\Windows\System\benfRbU.exe
  C:\Windows\System\benfRbU.exe
  2⤵
  PID:10820
- C:\Windows\System\JiKIjjx.exe
  C:\Windows\System\JiKIjjx.exe
  2⤵
  PID:10860
- C:\Windows\System\sxgjvpD.exe
  C:\Windows\System\sxgjvpD.exe
  2⤵
  PID:7500
- C:\Windows\System\xvFzueq.exe
  C:\Windows\System\xvFzueq.exe
  2⤵
  PID:8252
- C:\Windows\System\otUTMLD.exe
  C:\Windows\System\otUTMLD.exe
  2⤵
  PID:7420
- C:\Windows\System\raQrUEP.exe
  C:\Windows\System\raQrUEP.exe
  2⤵
  PID:11072
- C:\Windows\System\DwSdvEp.exe
  C:\Windows\System\DwSdvEp.exe
  2⤵
  PID:8508
- C:\Windows\System\xWPJiSb.exe
  C:\Windows\System\xWPJiSb.exe
  2⤵
  PID:8936
- C:\Windows\System\HxCpNzh.exe
  C:\Windows\System\HxCpNzh.exe
  2⤵
  PID:11196
- C:\Windows\System\RRNQDdW.exe
  C:\Windows\System\RRNQDdW.exe
  2⤵
  PID:10296
- C:\Windows\System\fCRdTMV.exe
  C:\Windows\System\fCRdTMV.exe
  2⤵
  PID:11260
- C:\Windows\System\CqIsTSt.exe
  C:\Windows\System\CqIsTSt.exe
  2⤵
  PID:7224
- C:\Windows\System\vKuvgWa.exe
  C:\Windows\System\vKuvgWa.exe
  2⤵
  PID:10444
- C:\Windows\System\kVlfnst.exe
  C:\Windows\System\kVlfnst.exe
  2⤵
  PID:9800
- C:\Windows\System\zViMVOY.exe
  C:\Windows\System\zViMVOY.exe
  2⤵
  PID:10160
- C:\Windows\System\tJquJnc.exe
  C:\Windows\System\tJquJnc.exe
  2⤵
  PID:10364
- C:\Windows\System\rxscQyE.exe
  C:\Windows\System\rxscQyE.exe
  2⤵
  PID:10568
- C:\Windows\System\NWnknHe.exe
  C:\Windows\System\NWnknHe.exe
  2⤵
  PID:10092
- C:\Windows\System\SRFQvOQ.exe
  C:\Windows\System\SRFQvOQ.exe
  2⤵
  PID:11284
- C:\Windows\System\UxVDZKs.exe
  C:\Windows\System\UxVDZKs.exe
  2⤵
  PID:12292
- C:\Windows\System\jymahbD.exe
  C:\Windows\System\jymahbD.exe
  2⤵
  PID:12312
- C:\Windows\System\rjspUGR.exe
  C:\Windows\System\rjspUGR.exe
  2⤵
  PID:12512
- C:\Windows\System\nkWNOpq.exe
  C:\Windows\System\nkWNOpq.exe
  2⤵
  PID:12544
- C:\Windows\System\ePBmRTk.exe
  C:\Windows\System\ePBmRTk.exe
  2⤵
  PID:12568
- C:\Windows\System\PtFDMDP.exe
  C:\Windows\System\PtFDMDP.exe
  2⤵
  PID:12596
- C:\Windows\System\MyeafGR.exe
  C:\Windows\System\MyeafGR.exe
  2⤵
  PID:12620
- C:\Windows\System\YawbgaY.exe
  C:\Windows\System\YawbgaY.exe
  2⤵
  PID:12640
- C:\Windows\System\aOyFmiw.exe
  C:\Windows\System\aOyFmiw.exe
  2⤵
  PID:12660
- C:\Windows\System\VbVPmJs.exe
  C:\Windows\System\VbVPmJs.exe
  2⤵
  PID:12684
- C:\Windows\System\ypSLcTz.exe
  C:\Windows\System\ypSLcTz.exe
  2⤵
  PID:12712
- C:\Windows\System\zUtGACN.exe
  C:\Windows\System\zUtGACN.exe
  2⤵
  PID:12732
- C:\Windows\System\eZHdEer.exe
  C:\Windows\System\eZHdEer.exe
  2⤵
  PID:12752
- C:\Windows\System\DwNFiPy.exe
  C:\Windows\System\DwNFiPy.exe
  2⤵
  PID:12776
- C:\Windows\System\BBRJyHI.exe
  C:\Windows\System\BBRJyHI.exe
  2⤵
  PID:12796
- C:\Windows\System\vkDarxI.exe
  C:\Windows\System\vkDarxI.exe
  2⤵
  PID:12824
- C:\Windows\System\EiYzJPv.exe
  C:\Windows\System\EiYzJPv.exe
  2⤵
  PID:12844
- C:\Windows\System\YWyBuba.exe
  C:\Windows\System\YWyBuba.exe
  2⤵
  PID:12864
- C:\Windows\System\wKUehoS.exe
  C:\Windows\System\wKUehoS.exe
  2⤵
  PID:12880
- C:\Windows\System\ciRAFTA.exe
  C:\Windows\System\ciRAFTA.exe
  2⤵
  PID:12900
- C:\Windows\System\UJaabmI.exe
  C:\Windows\System\UJaabmI.exe
  2⤵
  PID:12916
- C:\Windows\System\VAAJCfS.exe
  C:\Windows\System\VAAJCfS.exe
  2⤵
  PID:12932
- C:\Windows\System\GppYNBj.exe
  C:\Windows\System\GppYNBj.exe
  2⤵
  PID:12948
- C:\Windows\System\knuqUEX.exe
  C:\Windows\System\knuqUEX.exe
  2⤵
  PID:12964
- C:\Windows\System\ZkAdBXD.exe
  C:\Windows\System\ZkAdBXD.exe
  2⤵
  PID:12984
- C:\Windows\System\mgMTjCG.exe
  C:\Windows\System\mgMTjCG.exe
  2⤵
  PID:13000
- C:\Windows\System\MjllLWx.exe
  C:\Windows\System\MjllLWx.exe
  2⤵
  PID:13016
- C:\Windows\System\BVhHUSv.exe
  C:\Windows\System\BVhHUSv.exe
  2⤵
  PID:13032
- C:\Windows\System\WLFnpke.exe
  C:\Windows\System\WLFnpke.exe
  2⤵
  PID:13052
- C:\Windows\System\lzvxbVP.exe
  C:\Windows\System\lzvxbVP.exe
  2⤵
  PID:13072
- C:\Windows\System\dvxVsSz.exe
  C:\Windows\System\dvxVsSz.exe
  2⤵
  PID:13088
- C:\Windows\System\elukPFe.exe
  C:\Windows\System\elukPFe.exe
  2⤵
  PID:13108
- C:\Windows\System\HfoztcJ.exe
  C:\Windows\System\HfoztcJ.exe
  2⤵
  PID:13128
- C:\Windows\System\RyRmjcy.exe
  C:\Windows\System\RyRmjcy.exe
  2⤵
  PID:13156
- C:\Windows\System\zxzhKYA.exe
  C:\Windows\System\zxzhKYA.exe
  2⤵
  PID:13184
- C:\Windows\System\SKrCjAR.exe
  C:\Windows\System\SKrCjAR.exe
  2⤵
  PID:13208
- C:\Windows\System\KQCfADL.exe
  C:\Windows\System\KQCfADL.exe
  2⤵
  PID:13228
- C:\Windows\System\LyLcvAO.exe
  C:\Windows\System\LyLcvAO.exe
  2⤵
  PID:12324
- C:\Windows\System\PvuLUmf.exe
  C:\Windows\System\PvuLUmf.exe
  2⤵
  PID:12532
- C:\Windows\System\ozBdncU.exe
  C:\Windows\System\ozBdncU.exe
  2⤵
  PID:13268
- C:\Windows\System\CzVEUMM.exe
  C:\Windows\System\CzVEUMM.exe
  2⤵
  PID:9020
- C:\Windows\System\GrOJoRj.exe
  C:\Windows\System\GrOJoRj.exe
  2⤵
  PID:10620
- C:\Windows\System\hxXsgTL.exe
  C:\Windows\System\hxXsgTL.exe
  2⤵
  PID:5736
- C:\Windows\System\UiNsSgw.exe
  C:\Windows\System\UiNsSgw.exe
  2⤵
  PID:10360
- C:\Windows\System\FpaGbgg.exe
  C:\Windows\System\FpaGbgg.exe
  2⤵
  PID:10432
- C:\Windows\System\elnUBwi.exe
  C:\Windows\System\elnUBwi.exe
  2⤵
  PID:12792
- C:\Windows\System\nqpJoil.exe
  C:\Windows\System\nqpJoil.exe
  2⤵
  PID:12144
- C:\Windows\System\yVXcxbz.exe
  C:\Windows\System\yVXcxbz.exe
  2⤵
  PID:10932
- C:\Windows\System\XYLGgXs.exe
  C:\Windows\System\XYLGgXs.exe
  2⤵
  PID:8972
- C:\Windows\System\JXbxplU.exe
  C:\Windows\System\JXbxplU.exe
  2⤵
  PID:11556
- C:\Windows\System\GauTMug.exe
  C:\Windows\System\GauTMug.exe
  2⤵
  PID:10500
- C:\Windows\System\IBXJYzg.exe
  C:\Windows\System\IBXJYzg.exe
  2⤵
  PID:12860
- C:\Windows\System\kUdCZFn.exe
  C:\Windows\System\kUdCZFn.exe
  2⤵
  PID:11324
- C:\Windows\System\UcVsldy.exe
  C:\Windows\System\UcVsldy.exe
  2⤵
  PID:9348
- C:\Windows\System\ZtWSTft.exe
  C:\Windows\System\ZtWSTft.exe
  2⤵
  PID:11136
- C:\Windows\System\hmTGHLn.exe
  C:\Windows\System\hmTGHLn.exe
  2⤵
  PID:11244
- C:\Windows\System\oHMFyiM.exe
  C:\Windows\System\oHMFyiM.exe
  2⤵
  PID:12284
- C:\Windows\System\ytuOngG.exe
  C:\Windows\System\ytuOngG.exe
  2⤵
  PID:7532
- C:\Windows\System\nJpjSrJ.exe
  C:\Windows\System\nJpjSrJ.exe
  2⤵
  PID:11624
- C:\Windows\System\VmTUAAJ.exe
  C:\Windows\System\VmTUAAJ.exe
  2⤵
  PID:12972
- C:\Windows\System\qxZLcho.exe
  C:\Windows\System\qxZLcho.exe
  2⤵
  PID:9864
- C:\Windows\System\QWBnYfP.exe
  C:\Windows\System\QWBnYfP.exe
  2⤵
  PID:13064
- C:\Windows\System\tuyqIHO.exe
  C:\Windows\System\tuyqIHO.exe
  2⤵
  PID:11140
- C:\Windows\System\dNnFjuy.exe
  C:\Windows\System\dNnFjuy.exe
  2⤵
  PID:10540
- C:\Windows\System\lwJffzi.exe
  C:\Windows\System\lwJffzi.exe
  2⤵
  PID:12764
- C:\Windows\System\ArsFTTm.exe
  C:\Windows\System\ArsFTTm.exe
  2⤵
  PID:13224
- C:\Windows\System\BylaYdQ.exe
  C:\Windows\System\BylaYdQ.exe
  2⤵
  PID:10952
- C:\Windows\System\pdCdWNG.exe
  C:\Windows\System\pdCdWNG.exe
  2⤵
  PID:13068
- C:\Windows\System\oZdezCo.exe
  C:\Windows\System\oZdezCo.exe
  2⤵
  PID:11844
- C:\Windows\System\GRxOvXG.exe
  C:\Windows\System\GRxOvXG.exe
  2⤵
  PID:12476
- C:\Windows\System\tkyEbFR.exe
  C:\Windows\System\tkyEbFR.exe
  2⤵
  PID:11156
- C:\Windows\System\MpaaDst.exe
  C:\Windows\System\MpaaDst.exe
  2⤵
  PID:11392
- C:\Windows\System\MBcNjRQ.exe
  C:\Windows\System\MBcNjRQ.exe
  2⤵
  PID:12348
- C:\Windows\System\qPKVQmn.exe
  C:\Windows\System\qPKVQmn.exe
  2⤵
  PID:10264
- C:\Windows\System\vrBPQvW.exe
  C:\Windows\System\vrBPQvW.exe
  2⤵
  PID:12696
- C:\Windows\System\SEQqcOQ.exe
  C:\Windows\System\SEQqcOQ.exe
  2⤵
  PID:12040
- C:\Windows\System\mSGvlkM.exe
  C:\Windows\System\mSGvlkM.exe
  2⤵
  PID:12200
- C:\Windows\System\eTSlVUb.exe
  C:\Windows\System\eTSlVUb.exe
  2⤵
  PID:11604
- C:\Windows\System\eBtUUxJ.exe
  C:\Windows\System\eBtUUxJ.exe
  2⤵
  PID:9960
- C:\Windows\System\GeiDMEg.exe
  C:\Windows\System\GeiDMEg.exe
  2⤵
  PID:13168
- C:\Windows\System\ziiJPsT.exe
  C:\Windows\System\ziiJPsT.exe
  2⤵
  PID:10228
- C:\Windows\System\bXIQAXt.exe
  C:\Windows\System\bXIQAXt.exe
  2⤵
  PID:10388
- C:\Windows\System\hRtoktg.exe
  C:\Windows\System\hRtoktg.exe
  2⤵
  PID:12028
- C:\Windows\System\HIfFVVR.exe
  C:\Windows\System\HIfFVVR.exe
  2⤵
  PID:13028
- C:\Windows\System\vmdrhQY.exe
  C:\Windows\System\vmdrhQY.exe
  2⤵
  PID:8332
- C:\Windows\System\hvtICBu.exe
  C:\Windows\System\hvtICBu.exe
  2⤵
  PID:11828
- C:\Windows\System\HjzpjtW.exe
  C:\Windows\System\HjzpjtW.exe
  2⤵
  PID:10660
- C:\Windows\System\GkxiYVu.exe
  C:\Windows\System\GkxiYVu.exe
  2⤵
  PID:13220
- C:\Windows\System\pBAcQZI.exe
  C:\Windows\System\pBAcQZI.exe
  2⤵
  PID:8780
- C:\Windows\System\lMglqJY.exe
  C:\Windows\System\lMglqJY.exe
  2⤵
  PID:13408
- C:\Windows\System\aOQOGwc.exe
  C:\Windows\System\aOQOGwc.exe
  2⤵
  PID:13428
- C:\Windows\System\ggjWEYE.exe
  C:\Windows\System\ggjWEYE.exe
  2⤵
  PID:13536
- C:\Windows\System\RdEUvIW.exe
  C:\Windows\System\RdEUvIW.exe
  2⤵
  PID:13560
- C:\Windows\System\rrgfxtp.exe
  C:\Windows\System\rrgfxtp.exe
  2⤵
  PID:13588
- C:\Windows\System\okzefZT.exe
  C:\Windows\System\okzefZT.exe
  2⤵
  PID:13872
- C:\Windows\System\lvHoEhX.exe
  C:\Windows\System\lvHoEhX.exe
  2⤵
  PID:13896
- C:\Windows\System\MarEVXE.exe
  C:\Windows\System\MarEVXE.exe
  2⤵
  PID:13916
- C:\Windows\System\nEmeSjO.exe
  C:\Windows\System\nEmeSjO.exe
  2⤵
  PID:14000
- C:\Windows\System\gwBhMSa.exe
  C:\Windows\System\gwBhMSa.exe
  2⤵
  PID:14192
- C:\Windows\System\RCNgGNI.exe
  C:\Windows\System\RCNgGNI.exe
  2⤵
  PID:14212
- C:\Windows\System\wKWsZDn.exe
  C:\Windows\System\wKWsZDn.exe
  2⤵
  PID:14236
- C:\Windows\System\DSSIMvF.exe
  C:\Windows\System\DSSIMvF.exe
  2⤵
  PID:14276
- C:\Windows\System\QIWODqk.exe
  C:\Windows\System\QIWODqk.exe
  2⤵
  PID:14308
- C:\Windows\System\geXuVkL.exe
  C:\Windows\System\geXuVkL.exe
  2⤵
  PID:14324
- C:\Windows\System\XUCfbxR.exe
  C:\Windows\System\XUCfbxR.exe
  2⤵
  PID:12060
- C:\Windows\System\fFDFoqx.exe
  C:\Windows\System\fFDFoqx.exe
  2⤵
  PID:9452
- C:\Windows\System\yYBXvrx.exe
  C:\Windows\System\yYBXvrx.exe
  2⤵
  PID:11644
- C:\Windows\System\gkrRhJU.exe
  C:\Windows\System\gkrRhJU.exe
  2⤵
  PID:9240
- C:\Windows\System\XFSuiSv.exe
  C:\Windows\System\XFSuiSv.exe
  2⤵
  PID:3472
- C:\Windows\System\ItmpKAt.exe
  C:\Windows\System\ItmpKAt.exe
  2⤵
  PID:10780
- C:\Windows\System\hciQLyT.exe
  C:\Windows\System\hciQLyT.exe
  2⤵
  PID:12404
- C:\Windows\System\aFXhwIU.exe
  C:\Windows\System\aFXhwIU.exe
  2⤵
  PID:10064
- C:\Windows\System\XQmcQgz.exe
  C:\Windows\System\XQmcQgz.exe
  2⤵
  PID:10132
- C:\Windows\System\TaOlDTW.exe
  C:\Windows\System\TaOlDTW.exe
  2⤵
  PID:9380
- C:\Windows\System\mslsoJS.exe
  C:\Windows\System\mslsoJS.exe
  2⤵
  PID:11440
- C:\Windows\System\vXKWBkh.exe
  C:\Windows\System\vXKWBkh.exe
  2⤵
  PID:11580
- C:\Windows\System\ZLRUdyg.exe
  C:\Windows\System\ZLRUdyg.exe
  2⤵
  PID:4348
- C:\Windows\System\EZNGdaV.exe
  C:\Windows\System\EZNGdaV.exe
  2⤵
  PID:13468
- C:\Windows\System\zlniFzt.exe
  C:\Windows\System\zlniFzt.exe
  2⤵
  PID:10200
- C:\Windows\System\TMTzvpU.exe
  C:\Windows\System\TMTzvpU.exe
  2⤵
  PID:11868
- C:\Windows\System\HQwMvXQ.exe
  C:\Windows\System\HQwMvXQ.exe
  2⤵
  PID:10516
- C:\Windows\System\BYLzkAi.exe
  C:\Windows\System\BYLzkAi.exe
  2⤵
  PID:13632
- C:\Windows\System\yMuhMIe.exe
  C:\Windows\System\yMuhMIe.exe
  2⤵
  PID:13336
- C:\Windows\System\xCOatBz.exe
  C:\Windows\System\xCOatBz.exe
  2⤵
  PID:13520
- C:\Windows\System\ZSSGRvV.exe
  C:\Windows\System\ZSSGRvV.exe
  2⤵
  PID:13932
- C:\Windows\System\DPBxOHn.exe
  C:\Windows\System\DPBxOHn.exe
  2⤵
  PID:14052
- C:\Windows\System\mOsSFEX.exe
  C:\Windows\System\mOsSFEX.exe
  2⤵
  PID:14084
- C:\Windows\System\mRiRsFx.exe
  C:\Windows\System\mRiRsFx.exe
  2⤵
  PID:14208
- C:\Windows\System\LcKsFDS.exe
  C:\Windows\System\LcKsFDS.exe
  2⤵
  PID:10272
- C:\Windows\System\RguiDER.exe
  C:\Windows\System\RguiDER.exe
  2⤵
  PID:13772
- C:\Windows\System\cnAVgZc.exe
  C:\Windows\System\cnAVgZc.exe
  2⤵
  PID:14032
- C:\Windows\System\ZUgKmLX.exe
  C:\Windows\System\ZUgKmLX.exe
  2⤵
  PID:14172
- C:\Windows\System\mClHvji.exe
  C:\Windows\System\mClHvji.exe
  2⤵
  PID:14124
- C:\Windows\System\GudVVks.exe
  C:\Windows\System\GudVVks.exe
  2⤵
  PID:14224
- C:\Windows\System\ngkFNet.exe
  C:\Windows\System\ngkFNet.exe
  2⤵
  PID:14268
- C:\Windows\System\TeSfwlE.exe
  C:\Windows\System\TeSfwlE.exe
  2⤵
  PID:14188
- C:\Windows\System\coxZOWn.exe
  C:\Windows\System\coxZOWn.exe
  2⤵
  PID:14332
- C:\Windows\System\YIngZEs.exe
  C:\Windows\System\YIngZEs.exe
  2⤵
  PID:14260
- C:\Windows\System\iEsiYGH.exe
  C:\Windows\System\iEsiYGH.exe
  2⤵
  PID:1404
- C:\Windows\System\WfnOTvX.exe
  C:\Windows\System\WfnOTvX.exe
  2⤵
  PID:12876
- C:\Windows\System\KLsvXEe.exe
  C:\Windows\System\KLsvXEe.exe
  2⤵
  PID:8304
- C:\Windows\System\cZEZroa.exe
  C:\Windows\System\cZEZroa.exe
  2⤵
  PID:12584
- C:\Windows\System\HVpfwjF.exe
  C:\Windows\System\HVpfwjF.exe
  2⤵
  PID:8428
- C:\Windows\System\efOfwFL.exe
  C:\Windows\System\efOfwFL.exe
  2⤵
  PID:13320
- C:\Windows\System\XAOgiLb.exe
  C:\Windows\System\XAOgiLb.exe
  2⤵
  PID:13388
- C:\Windows\System\RaCcveh.exe
  C:\Windows\System\RaCcveh.exe
  2⤵
  PID:12036
- C:\Windows\System\SwGrSIC.exe
  C:\Windows\System\SwGrSIC.exe
  2⤵
  PID:13352
- C:\Windows\System\xbbXXRs.exe
  C:\Windows\System\xbbXXRs.exe
  2⤵
  PID:13420
- C:\Windows\System\mXDMZYl.exe
  C:\Windows\System\mXDMZYl.exe
  2⤵
  PID:12100
- C:\Windows\System\vAPqlPm.exe
  C:\Windows\System\vAPqlPm.exe
  2⤵
  PID:5252
- C:\Windows\System\MXftRuN.exe
  C:\Windows\System\MXftRuN.exe
  2⤵
  PID:13552
- C:\Windows\System\soYlNNh.exe
  C:\Windows\System\soYlNNh.exe
  2⤵
  PID:3000
- C:\Windows\System\QdfjVSw.exe
  C:\Windows\System\QdfjVSw.exe
  2⤵
  PID:624
- C:\Windows\System\VsyISNw.exe
  C:\Windows\System\VsyISNw.exe
  2⤵
  PID:13680
- C:\Windows\System\YvjCCIO.exe
  C:\Windows\System\YvjCCIO.exe
  2⤵
  PID:11920
- C:\Windows\System\bGPynOx.exe
  C:\Windows\System\bGPynOx.exe
  2⤵
  PID:13700
- C:\Windows\System\HpYyycX.exe
  C:\Windows\System\HpYyycX.exe
  2⤵
  PID:13704
- C:\Windows\System\lXQRgdn.exe
  C:\Windows\System\lXQRgdn.exe
  2⤵
  PID:13492
- C:\Windows\System\sfHjhXw.exe
  C:\Windows\System\sfHjhXw.exe
  2⤵
  PID:13800
- C:\Windows\System\UoicjZM.exe
  C:\Windows\System\UoicjZM.exe
  2⤵
  PID:13768
- C:\Windows\System\lYAAmwy.exe
  C:\Windows\System\lYAAmwy.exe
  2⤵
  PID:13968
- C:\Windows\System\YroJsYP.exe
  C:\Windows\System\YroJsYP.exe
  2⤵
  PID:13784
- C:\Windows\System\JQynuHl.exe
  C:\Windows\System\JQynuHl.exe
  2⤵
  PID:13852
- C:\Windows\System\KtbnUpb.exe
  C:\Windows\System\KtbnUpb.exe
  2⤵
  PID:13868
- C:\Windows\System\ogpfVqC.exe
  C:\Windows\System\ogpfVqC.exe
  2⤵
  PID:7160
- C:\Windows\System\ckFlEXh.exe
  C:\Windows\System\ckFlEXh.exe
  2⤵
  PID:14072
- C:\Windows\System\kFlfnrK.exe
  C:\Windows\System\kFlfnrK.exe
  2⤵
  PID:13976
- C:\Windows\System\RaMLZGH.exe
  C:\Windows\System\RaMLZGH.exe
  2⤵
  PID:14128
- C:\Windows\System\PEmdKBe.exe
  C:\Windows\System\PEmdKBe.exe
  2⤵
  PID:1884
- C:\Windows\System\kLbYRwA.exe
  C:\Windows\System\kLbYRwA.exe
  2⤵
  PID:13944
- C:\Windows\System\SFSWJZI.exe
  C:\Windows\System\SFSWJZI.exe
  2⤵
  PID:780
- C:\Windows\System\deDXLMH.exe
  C:\Windows\System\deDXLMH.exe
  2⤵
  PID:2840
- C:\Windows\System\xQaWCWE.exe
  C:\Windows\System\xQaWCWE.exe
  2⤵
  PID:1780
- C:\Windows\System\RNFayAK.exe
  C:\Windows\System\RNFayAK.exe
  2⤵
  PID:3644
- C:\Windows\System\qgCeiCP.exe
  C:\Windows\System\qgCeiCP.exe
  2⤵
  PID:11028
- C:\Windows\System\sUrZFgn.exe
  C:\Windows\System\sUrZFgn.exe
  2⤵
  PID:14256
- C:\Windows\System\qcVRcak.exe
  C:\Windows\System\qcVRcak.exe
  2⤵
  PID:14220
- C:\Windows\System\guGnQZA.exe
  C:\Windows\System\guGnQZA.exe
  2⤵
  PID:10104
- C:\Windows\System\KVOVlnu.exe
  C:\Windows\System\KVOVlnu.exe
  2⤵
  PID:14292
- C:\Windows\System\uVmZXLO.exe
  C:\Windows\System\uVmZXLO.exe
  2⤵
  PID:8944
- C:\Windows\System\nfVzdPW.exe
  C:\Windows\System\nfVzdPW.exe
  2⤵
  PID:13396
- C:\Windows\System\sgAGaAv.exe
  C:\Windows\System\sgAGaAv.exe
  2⤵
  PID:13508
- C:\Windows\System\HCgTcaM.exe
  C:\Windows\System\HCgTcaM.exe
  2⤵
  PID:8284
- C:\Windows\System\HXVfHmd.exe
  C:\Windows\System\HXVfHmd.exe
  2⤵
  PID:11000
- C:\Windows\System\CAtRneU.exe
  C:\Windows\System\CAtRneU.exe
  2⤵
  PID:13692
- C:\Windows\System\EUwZmTV.exe
  C:\Windows\System\EUwZmTV.exe
  2⤵
  PID:13340
- C:\Windows\System\HYOXCNJ.exe
  C:\Windows\System\HYOXCNJ.exe
  2⤵
  PID:13732
- C:\Windows\System\RZflhQS.exe
  C:\Windows\System\RZflhQS.exe
  2⤵
  PID:13488
- C:\Windows\System\PaUGVZn.exe
  C:\Windows\System\PaUGVZn.exe
  2⤵
  PID:13888
- C:\Windows\System\NvSphgx.exe
  C:\Windows\System\NvSphgx.exe
  2⤵
  PID:13844
- C:\Windows\System\OsjghJZ.exe
  C:\Windows\System\OsjghJZ.exe
  2⤵
  PID:14080
- C:\Windows\System\YfIpyFA.exe
  C:\Windows\System\YfIpyFA.exe
  2⤵
  PID:1492
- C:\Windows\System\YKveyHS.exe
  C:\Windows\System\YKveyHS.exe
  2⤵
  PID:1140
- C:\Windows\System\tPCtuyq.exe
  C:\Windows\System\tPCtuyq.exe
  2⤵
  PID:4640
- C:\Windows\System\BLAwIxL.exe
  C:\Windows\System\BLAwIxL.exe
  2⤵
  PID:3560
- C:\Windows\System\nrXGEOs.exe
  C:\Windows\System\nrXGEOs.exe
  2⤵
  PID:13720
- C:\Windows\System\JLbCHpg.exe
  C:\Windows\System\JLbCHpg.exe
  2⤵
  PID:3552
- C:\Windows\System\WFvyVgZ.exe
  C:\Windows\System\WFvyVgZ.exe
  2⤵
  PID:2600
- C:\Windows\System\kRKpJUb.exe
  C:\Windows\System\kRKpJUb.exe
  2⤵
  PID:14144
- C:\Windows\System\lhmAapW.exe
  C:\Windows\System\lhmAapW.exe
  2⤵
  PID:3140
- C:\Windows\System\konVAzJ.exe
  C:\Windows\System\konVAzJ.exe
  2⤵
  PID:1928
- C:\Windows\System\RLyvosE.exe
  C:\Windows\System\RLyvosE.exe
  2⤵
  PID:14244
- C:\Windows\System\luUCEav.exe
  C:\Windows\System\luUCEav.exe
  2⤵
  PID:4672
- C:\Windows\System\ejULPNi.exe
  C:\Windows\System\ejULPNi.exe
  2⤵
  PID:3184
- C:\Windows\System\mfUSuqn.exe
  C:\Windows\System\mfUSuqn.exe
  2⤵
  PID:1908
- C:\Windows\System\KQtTgZq.exe
  C:\Windows\System\KQtTgZq.exe
  2⤵
  PID:4928
- C:\Windows\System\lHYgHio.exe
  C:\Windows\System\lHYgHio.exe
  2⤵
  PID:14140
- C:\Windows\System\RzeVXal.exe
  C:\Windows\System\RzeVXal.exe
  2⤵
  PID:3828
- C:\Windows\System\wSrBsqh.exe
  C:\Windows\System\wSrBsqh.exe
  2⤵
  PID:2476
- C:\Windows\System\dgiQnqg.exe
  C:\Windows\System\dgiQnqg.exe
  2⤵
  PID:13624
- C:\Windows\System\JpiwGEa.exe
  C:\Windows\System\JpiwGEa.exe
  2⤵
  PID:2752
- C:\Windows\System\YWoaGMM.exe
  C:\Windows\System\YWoaGMM.exe
  2⤵
  PID:868
- C:\Windows\System\caIRqWC.exe
  C:\Windows\System\caIRqWC.exe
  2⤵
  PID:4092
- C:\Windows\System\rGmpcGL.exe
  C:\Windows\System\rGmpcGL.exe
  2⤵
  PID:2480
- C:\Windows\System\Wxbnibq.exe
  C:\Windows\System\Wxbnibq.exe
  2⤵
  PID:13860
- C:\Windows\System\mEreCws.exe
  C:\Windows\System\mEreCws.exe
  2⤵
  PID:3444
- C:\Windows\System\JbGDpnG.exe
  C:\Windows\System\JbGDpnG.exe
  2⤵
  PID:2400
- C:\Windows\System\IvXDbsX.exe
  C:\Windows\System\IvXDbsX.exe
  2⤵
  PID:452
- C:\Windows\System\OJANwSP.exe
  C:\Windows\System\OJANwSP.exe
  2⤵
  PID:1332
- C:\Windows\System\gSpmYSC.exe
  C:\Windows\System\gSpmYSC.exe
  2⤵
  PID:3368
- C:\Windows\System\wgyFcaQ.exe
  C:\Windows\System\wgyFcaQ.exe
  2⤵
  PID:2836
- C:\Windows\System\whEMVeD.exe
  C:\Windows\System\whEMVeD.exe
  2⤵
  PID:8
- C:\Windows\System\KREfavi.exe
  C:\Windows\System\KREfavi.exe
  2⤵
  PID:1912
- C:\Windows\System\GXExiNG.exe
  C:\Windows\System\GXExiNG.exe
  2⤵
  PID:4592
- C:\Windows\System\kkwwmZs.exe
  C:\Windows\System\kkwwmZs.exe
  2⤵
  PID:4616
- C:\Windows\System\fIhcOaU.exe
  C:\Windows\System\fIhcOaU.exe
  2⤵
  PID:3260
- C:\Windows\System\mtjywtZ.exe
  C:\Windows\System\mtjywtZ.exe
  2⤵
  PID:2332
- C:\Windows\System\yJDfXbf.exe
  C:\Windows\System\yJDfXbf.exe
  2⤵
  PID:14288
- C:\Windows\System\mNYdNib.exe
  C:\Windows\System\mNYdNib.exe
  2⤵
  PID:2796
- C:\Windows\System\RrpfSqN.exe
  C:\Windows\System\RrpfSqN.exe
  2⤵
  PID:13528
- C:\Windows\System\vmAdITe.exe
  C:\Windows\System\vmAdITe.exe
  2⤵
  PID:2464
- C:\Windows\System\WgJXVHJ.exe
  C:\Windows\System\WgJXVHJ.exe
  2⤵
  PID:2468
- C:\Windows\System\BguDozV.exe
  C:\Windows\System\BguDozV.exe
  2⤵
  PID:5080
- C:\Windows\System\CpWJyaa.exe
  C:\Windows\System\CpWJyaa.exe
  2⤵
  PID:4936
- C:\Windows\System\PfRSRIl.exe
  C:\Windows\System\PfRSRIl.exe
  2⤵
  PID:748
- C:\Windows\System\tXPFTEG.exe
  C:\Windows\System\tXPFTEG.exe
  2⤵
  PID:3036
- C:\Windows\System\YxrDKbm.exe
  C:\Windows\System\YxrDKbm.exe
  2⤵
  PID:3528
- C:\Windows\System\HMoQxZg.exe
  C:\Windows\System\HMoQxZg.exe
  2⤵
  PID:1480
- C:\Windows\System\jSdbJat.exe
  C:\Windows\System\jSdbJat.exe
  2⤵
  PID:2932
- C:\Windows\System\ViIZGJW.exe
  C:\Windows\System\ViIZGJW.exe
  2⤵
  PID:4780
- C:\Windows\System\rWnMeHQ.exe
  C:\Windows\System\rWnMeHQ.exe
  2⤵
  PID:4760
- C:\Windows\System\hbQrqHV.exe
  C:\Windows\System\hbQrqHV.exe
  2⤵
  PID:4784
- C:\Windows\System\mSJpYRz.exe
  C:\Windows\System\mSJpYRz.exe
  2⤵
  PID:4180
- C:\Windows\System\QrlCYqh.exe
  C:\Windows\System\QrlCYqh.exe
  2⤵
  PID:2828
- C:\Windows\System\BkasctY.exe
  C:\Windows\System\BkasctY.exe
  2⤵
  PID:3020
- C:\Windows\System\PqOmgWY.exe
  C:\Windows\System\PqOmgWY.exe
  2⤵
  PID:4752
- C:\Windows\System\qfWaVOx.exe
  C:\Windows\System\qfWaVOx.exe
  2⤵
  PID:3508
- C:\Windows\System\UBtRVKN.exe
  C:\Windows\System\UBtRVKN.exe
  2⤵
  PID:4948
- C:\Windows\System\dgIKdrT.exe
  C:\Windows\System\dgIKdrT.exe
  2⤵
  PID:1488
- C:\Windows\System\ABDvuae.exe
  C:\Windows\System\ABDvuae.exe
  2⤵
  PID:1664
- C:\Windows\System\myhMaDd.exe
  C:\Windows\System\myhMaDd.exe
  2⤵
  PID:636
- C:\Windows\System\MwLXlSu.exe
  C:\Windows\System\MwLXlSu.exe
  2⤵
  PID:3144
- C:\Windows\System\wxVRimB.exe
  C:\Windows\System\wxVRimB.exe
  2⤵
  PID:10564
- C:\Windows\System\QoUzhSX.exe
  C:\Windows\System\QoUzhSX.exe
  2⤵
  PID:1980
- C:\Windows\System\RaqgCEb.exe
  C:\Windows\System\RaqgCEb.exe
  2⤵
  PID:3252
- C:\Windows\System\aIPgXco.exe
  C:\Windows\System\aIPgXco.exe
  2⤵
  PID:3340
- C:\Windows\System\sEPEsQW.exe
  C:\Windows\System\sEPEsQW.exe
  2⤵
  PID:3064
- C:\Windows\System\NfupOlm.exe
  C:\Windows\System\NfupOlm.exe
  2⤵
  PID:4524
- C:\Windows\System\XVGkiJn.exe
  C:\Windows\System\XVGkiJn.exe
  2⤵
  PID:392
- C:\Windows\System\TUXhGnm.exe
  C:\Windows\System\TUXhGnm.exe
  2⤵
  PID:3172
- C:\Windows\System\NnLRIbV.exe
  C:\Windows\System\NnLRIbV.exe
  2⤵
  PID:3176
- C:\Windows\System\MCcPMQD.exe
  C:\Windows\System\MCcPMQD.exe
  2⤵
  PID:3412
- C:\Windows\System\ABEzxvh.exe
  C:\Windows\System\ABEzxvh.exe
  2⤵
  PID:1300
- C:\Windows\System\kheIwTk.exe
  C:\Windows\System\kheIwTk.exe
  2⤵
  PID:12840
- C:\Windows\System\ebEmoRa.exe
  C:\Windows\System\ebEmoRa.exe
  2⤵
  PID:2844
- C:\Windows\System\zgSaKYv.exe
  C:\Windows\System\zgSaKYv.exe
  2⤵
  PID:4216
- C:\Windows\System\ZUhgQGJ.exe
  C:\Windows\System\ZUhgQGJ.exe
  2⤵
  PID:13776
- C:\Windows\System\tUKMsSk.exe
  C:\Windows\System\tUKMsSk.exe
  2⤵
  PID:3544
- C:\Windows\System\ozljEze.exe
  C:\Windows\System\ozljEze.exe
  2⤵
  PID:3532
- C:\Windows\System\moguoTM.exe
  C:\Windows\System\moguoTM.exe
  2⤵
  PID:5000
- C:\Windows\System\zHNDBoC.exe
  C:\Windows\System\zHNDBoC.exe
  2⤵
  PID:3344
- C:\Windows\System\dTsYOrb.exe
  C:\Windows\System\dTsYOrb.exe
  2⤵
  PID:992
- C:\Windows\System\jELnxll.exe
  C:\Windows\System\jELnxll.exe
  2⤵
  PID:4028
- C:\Windows\System\CzzNiVb.exe
  C:\Windows\System\CzzNiVb.exe
  2⤵
  PID:3356
- C:\Windows\System\IRSHtpb.exe
  C:\Windows\System\IRSHtpb.exe
  2⤵
  PID:5064
- C:\Windows\System\xemoWxI.exe
  C:\Windows\System\xemoWxI.exe
  2⤵
  PID:3912
- C:\Windows\System\zhckxja.exe
  C:\Windows\System\zhckxja.exe
  2⤵
  PID:4604
- C:\Windows\System\TlPYyXt.exe
  C:\Windows\System\TlPYyXt.exe
  2⤵
  PID:3916
- C:\Windows\System\EFwSsKa.exe
  C:\Windows\System\EFwSsKa.exe
  2⤵
  PID:2284
- C:\Windows\System\TcBwkLy.exe
  C:\Windows\System\TcBwkLy.exe
  2⤵
  PID:3708
- C:\Windows\System\qjyUjZf.exe
  C:\Windows\System\qjyUjZf.exe
  2⤵
  PID:4664
- C:\Windows\System\wHEtWEj.exe
  C:\Windows\System\wHEtWEj.exe
  2⤵
  PID:11564
- C:\Windows\System\QpdnzWk.exe
  C:\Windows\System\QpdnzWk.exe
  2⤵
  PID:2688
- C:\Windows\System\rBPTipY.exe
  C:\Windows\System\rBPTipY.exe
  2⤵
  PID:2776
- C:\Windows\System\gnlpmmn.exe
  C:\Windows\System\gnlpmmn.exe
  2⤵
  PID:1892
- C:\Windows\System\URVyjkn.exe
  C:\Windows\System\URVyjkn.exe
  2⤵
  PID:4444
- C:\Windows\System\oJrwiMs.exe
  C:\Windows\System\oJrwiMs.exe
  2⤵
  PID:3308
- C:\Windows\System\vvnFFqC.exe
  C:\Windows\System\vvnFFqC.exe
  2⤵
  PID:14076
- C:\Windows\System\pqRCWFB.exe
  C:\Windows\System\pqRCWFB.exe
  2⤵
  PID:2344
- C:\Windows\System\OXcUEWq.exe
  C:\Windows\System\OXcUEWq.exe
  2⤵
  PID:14416
- C:\Windows\System\ZFbxduO.exe
  C:\Windows\System\ZFbxduO.exe
  2⤵
  PID:14432
- C:\Windows\System\bxardsB.exe
  C:\Windows\System\bxardsB.exe
  2⤵
  PID:14448
- C:\Windows\System\uNnvxxY.exe
  C:\Windows\System\uNnvxxY.exe
  2⤵
  PID:14464
- C:\Windows\System\QIhUHIv.exe
  C:\Windows\System\QIhUHIv.exe
  2⤵
  PID:14480
- C:\Windows\System\BmHfLxZ.exe
  C:\Windows\System\BmHfLxZ.exe
  2⤵
  PID:14496
- C:\Windows\System\uAdKvnY.exe
  C:\Windows\System\uAdKvnY.exe
  2⤵
  PID:14512
- C:\Windows\System\NoFfeuc.exe
  C:\Windows\System\NoFfeuc.exe
  2⤵
  PID:14528
- C:\Windows\System\VhbwRlo.exe
  C:\Windows\System\VhbwRlo.exe
  2⤵
  PID:14544
- C:\Windows\System\oRSePQD.exe
  C:\Windows\System\oRSePQD.exe
  2⤵
  PID:14560
- C:\Windows\System\wJgGOGA.exe
  C:\Windows\System\wJgGOGA.exe
  2⤵
  PID:14576
- C:\Windows\System\IjbndKF.exe
  C:\Windows\System\IjbndKF.exe
  2⤵
  PID:14592
- C:\Windows\System\zFpxDdv.exe
  C:\Windows\System\zFpxDdv.exe
  2⤵
  PID:14608
- C:\Windows\System\yCJjfrx.exe
  C:\Windows\System\yCJjfrx.exe
  2⤵
  PID:14624
- C:\Windows\System\ICCBnpR.exe
  C:\Windows\System\ICCBnpR.exe
  2⤵
  PID:14640
- C:\Windows\System\KZsnRtM.exe
  C:\Windows\System\KZsnRtM.exe
  2⤵
  PID:14656
- C:\Windows\System\eInwQBU.exe
  C:\Windows\System\eInwQBU.exe
  2⤵
  PID:14672
- C:\Windows\System\vyAdjTO.exe
  C:\Windows\System\vyAdjTO.exe
  2⤵
  PID:14688
- C:\Windows\System\RCMPSlR.exe
  C:\Windows\System\RCMPSlR.exe
  2⤵
  PID:14704
- C:\Windows\System\ArtYHlB.exe
  C:\Windows\System\ArtYHlB.exe
  2⤵
  PID:14720
- C:\Windows\System\GBcCCBU.exe
  C:\Windows\System\GBcCCBU.exe
  2⤵
  PID:14736
- C:\Windows\System\XOorCgT.exe
  C:\Windows\System\XOorCgT.exe
  2⤵
  PID:14752
- C:\Windows\System\tCotXkV.exe
  C:\Windows\System\tCotXkV.exe
  2⤵
  PID:14768
- C:\Windows\System\DWOLMNL.exe
  C:\Windows\System\DWOLMNL.exe
  2⤵
  PID:14844
- C:\Windows\System\XWzbLzN.exe
  C:\Windows\System\XWzbLzN.exe
  2⤵
  PID:14900
- C:\Windows\System\YmjsETs.exe
  C:\Windows\System\YmjsETs.exe
  2⤵
  PID:14920
- C:\Windows\System\qsHcKSS.exe
  C:\Windows\System\qsHcKSS.exe
  2⤵
  PID:14936
- C:\Windows\System\ysTMKyK.exe
  C:\Windows\System\ysTMKyK.exe
  2⤵
  PID:14952
- C:\Windows\System\QldPiuV.exe
  C:\Windows\System\QldPiuV.exe
  2⤵
  PID:14968
- C:\Windows\System\RACaMPf.exe
  C:\Windows\System\RACaMPf.exe
  2⤵
  PID:15008
- C:\Windows\System\nhRJUjW.exe
  C:\Windows\System\nhRJUjW.exe
  2⤵
  PID:15064
- C:\Windows\System\mHQhkzA.exe
  C:\Windows\System\mHQhkzA.exe
  2⤵
  PID:15080
- C:\Windows\System\wowReLL.exe
  C:\Windows\System\wowReLL.exe
  2⤵
  PID:15096
- C:\Windows\System\hQmDdEz.exe
  C:\Windows\System\hQmDdEz.exe
  2⤵
  PID:15112
- C:\Windows\System\IoVZhiJ.exe
  C:\Windows\System\IoVZhiJ.exe
  2⤵
  PID:15128
- C:\Windows\System\gIlQici.exe
  C:\Windows\System\gIlQici.exe
  2⤵
  PID:15144
- C:\Windows\System\TZVZeky.exe
  C:\Windows\System\TZVZeky.exe
  2⤵
  PID:15172
- C:\Windows\System\gPHBnFS.exe
  C:\Windows\System\gPHBnFS.exe
  2⤵
  PID:15188
- C:\Windows\System\NaJobmW.exe
  C:\Windows\System\NaJobmW.exe
  2⤵
  PID:15204
- C:\Windows\System\argyeVf.exe
  C:\Windows\System\argyeVf.exe
  2⤵
  PID:15220
- C:\Windows\System\KLBSlTg.exe
  C:\Windows\System\KLBSlTg.exe
  2⤵
  PID:15236
- C:\Windows\System\bqKcDsx.exe
  C:\Windows\System\bqKcDsx.exe
  2⤵
  PID:15252
- C:\Windows\System\pCSMIAL.exe
  C:\Windows\System\pCSMIAL.exe
  2⤵
  PID:15268
- C:\Windows\System\xGbRcoI.exe
  C:\Windows\System\xGbRcoI.exe
  2⤵
  PID:15284
- C:\Windows\System\zzZSHpO.exe
  C:\Windows\System\zzZSHpO.exe
  2⤵
  PID:15300
- C:\Windows\System\AgwfrCK.exe
  C:\Windows\System\AgwfrCK.exe
  2⤵
  PID:15316
- C:\Windows\System\TLWDqmR.exe
  C:\Windows\System\TLWDqmR.exe
  2⤵
  PID:15332
- C:\Windows\System\PcYSSSH.exe
  C:\Windows\System\PcYSSSH.exe
  2⤵
  PID:15348
- C:\Windows\System\smwVUet.exe
  C:\Windows\System\smwVUet.exe
  2⤵
  PID:4148
- C:\Windows\System\yVXYtMi.exe
  C:\Windows\System\yVXYtMi.exe
  2⤵
  PID:14344
- C:\Windows\System\FiSgRKX.exe
  C:\Windows\System\FiSgRKX.exe
  2⤵
  PID:1760
- C:\Windows\System\qtrGCid.exe
  C:\Windows\System\qtrGCid.exe
  2⤵
  PID:14388
- C:\Windows\System\MHtHssl.exe
  C:\Windows\System\MHtHssl.exe
  2⤵
  PID:1748
- C:\Windows\System\bFKcOdA.exe
  C:\Windows\System\bFKcOdA.exe
  2⤵
  PID:14364
- C:\Windows\System\NPJFEqA.exe
  C:\Windows\System\NPJFEqA.exe
  2⤵
  PID:14396
- C:\Windows\System\yFsYExo.exe
  C:\Windows\System\yFsYExo.exe
  2⤵
  PID:14412
- C:\Windows\System\mgWZiUO.exe
  C:\Windows\System\mgWZiUO.exe
  2⤵
  PID:14444
- C:\Windows\System\bLnxzQn.exe
  C:\Windows\System\bLnxzQn.exe
  2⤵
  PID:14488
- C:\Windows\System\vCjpeHR.exe
  C:\Windows\System\vCjpeHR.exe
  2⤵
  PID:14520
- C:\Windows\System\YjFcefc.exe
  C:\Windows\System\YjFcefc.exe
  2⤵
  PID:14552
- C:\Windows\System\sLdzBtr.exe
  C:\Windows\System\sLdzBtr.exe
  2⤵
  PID:14584
- C:\Windows\System\ATYWYEq.exe
  C:\Windows\System\ATYWYEq.exe
  2⤵
  PID:14616
- C:\Windows\System\SusysrJ.exe
  C:\Windows\System\SusysrJ.exe
  2⤵
  PID:14648
- C:\Windows\System\cmtTDfB.exe
  C:\Windows\System\cmtTDfB.exe
  2⤵
  PID:2956
- C:\Windows\System\JBbMBiZ.exe
  C:\Windows\System\JBbMBiZ.exe
  2⤵
  PID:14960
- C:\Windows\System\pHAeUSW.exe
  C:\Windows\System\pHAeUSW.exe
  2⤵
  PID:14992
- C:\Windows\System\ImHVCvE.exe
  C:\Windows\System\ImHVCvE.exe
  2⤵
  PID:14788
- C:\Windows\System\SAePFkl.exe
  C:\Windows\System\SAePFkl.exe
  2⤵
  PID:15028
- C:\Windows\System\APjMgsW.exe
  C:\Windows\System\APjMgsW.exe
  2⤵
  PID:15044
- C:\Windows\System\PhSYJKj.exe
  C:\Windows\System\PhSYJKj.exe
  2⤵
  PID:14792
- C:\Windows\System\nmLmxWY.exe
  C:\Windows\System\nmLmxWY.exe
  2⤵
  PID:15072
- C:\Windows\System\GJLiVyh.exe
  C:\Windows\System\GJLiVyh.exe
  2⤵
  PID:14888
- C:\Windows\System\ZXfLXcw.exe
  C:\Windows\System\ZXfLXcw.exe
  2⤵
  PID:14944
- C:\Windows\System\hsghyuG.exe
  C:\Windows\System\hsghyuG.exe
  2⤵
  PID:14884
- C:\Windows\System\sPTCFbl.exe
  C:\Windows\System\sPTCFbl.exe
  2⤵
  PID:15108
- C:\Windows\System\hlehXFg.exe
  C:\Windows\System\hlehXFg.exe
  2⤵
  PID:15196
- C:\Windows\System\aVkBiGk.exe
  C:\Windows\System\aVkBiGk.exe
  2⤵
  PID:15232
- C:\Windows\System\pQqkCxb.exe
  C:\Windows\System\pQqkCxb.exe
  2⤵
  PID:15264
- C:\Windows\System\WzBvCQp.exe
  C:\Windows\System\WzBvCQp.exe
  2⤵
  PID:15296
- C:\Windows\System\yrbdpFC.exe
  C:\Windows\System\yrbdpFC.exe
  2⤵
  PID:15328
- C:\Windows\System\eNMhxfu.exe
  C:\Windows\System\eNMhxfu.exe
  2⤵
  PID:4844
- C:\Windows\System\AmPYJes.exe
  C:\Windows\System\AmPYJes.exe
  2⤵
  PID:4168
- C:\Windows\System\GsUVdsS.exe
  C:\Windows\System\GsUVdsS.exe
  2⤵
  PID:4432
- C:\Windows\System\BPpvYjV.exe
  C:\Windows\System\BPpvYjV.exe
  2⤵
  PID:14348
- C:\Windows\System\spoAQlU.exe
  C:\Windows\System\spoAQlU.exe
  2⤵
  PID:14408
- C:\Windows\System\GwjVKJK.exe
  C:\Windows\System\GwjVKJK.exe
  2⤵
  PID:14504
- C:\Windows\System\MMXTtIP.exe
  C:\Windows\System\MMXTtIP.exe
  2⤵
  PID:14572
- C:\Windows\System\oZqazzT.exe
  C:\Windows\System\oZqazzT.exe
  2⤵
  PID:14664
- C:\Windows\System\FIsaADF.exe
  C:\Windows\System\FIsaADF.exe
  2⤵
  PID:14700
- C:\Windows\System\hTyUYQi.exe
  C:\Windows\System\hTyUYQi.exe
  2⤵
  PID:14896
- C:\Windows\System\VwhOMjs.exe
  C:\Windows\System\VwhOMjs.exe
  2⤵
  PID:14980
- C:\Windows\System\QyOwHjx.exe
  C:\Windows\System\QyOwHjx.exe
  2⤵
  PID:14784
- C:\Windows\System\PKyGXnP.exe
  C:\Windows\System\PKyGXnP.exe
  2⤵
  PID:15024
- C:\Windows\System\lUUNNZP.exe
  C:\Windows\System\lUUNNZP.exe
  2⤵
  PID:940
- C:\Windows\System\XtWIION.exe
  C:\Windows\System\XtWIION.exe
  2⤵
  PID:5016
- C:\Windows\System\yohelWb.exe
  C:\Windows\System\yohelWb.exe
  2⤵
  PID:2716
- C:\Windows\System\nJmZznh.exe
  C:\Windows\System\nJmZznh.exe
  2⤵
  PID:14928
- C:\Windows\System\bKJaEgt.exe
  C:\Windows\System\bKJaEgt.exe
  2⤵
  PID:15156
- C:\Windows\System\GKADKfU.exe
  C:\Windows\System\GKADKfU.exe
  2⤵
  PID:432
- C:\Windows\System\EiCxhze.exe
  C:\Windows\System\EiCxhze.exe
  2⤵
  PID:15076
- C:\Windows\System\Hmdvbyg.exe
  C:\Windows\System\Hmdvbyg.exe
  2⤵
  PID:15092
- C:\Windows\System\CupGNZg.exe
  C:\Windows\System\CupGNZg.exe
  2⤵
  PID:4828
- C:\Windows\System\uDWRvYq.exe
  C:\Windows\System\uDWRvYq.exe
  2⤵
  PID:15280
- C:\Windows\System\wLTtyba.exe
  C:\Windows\System\wLTtyba.exe
  2⤵
  PID:15344
- C:\Windows\System\GRnUzBx.exe
  C:\Windows\System\GRnUzBx.exe
  2⤵
  PID:3204
- C:\Windows\System\LSXWKEg.exe
  C:\Windows\System\LSXWKEg.exe
  2⤵
  PID:372
- C:\Windows\System\DtNeixm.exe
  C:\Windows\System\DtNeixm.exe
  2⤵
  PID:14404
- C:\Windows\System\OFyJyYR.exe
  C:\Windows\System\OFyJyYR.exe
  2⤵
  PID:5416
- C:\Windows\System\URFNKfn.exe
  C:\Windows\System\URFNKfn.exe
  2⤵
  PID:5272
- C:\Windows\System\aoFIqrQ.exe
  C:\Windows\System\aoFIqrQ.exe
  2⤵
  PID:14632
- C:\Windows\System\gxlWcma.exe
  C:\Windows\System\gxlWcma.exe
  2⤵
  PID:14712
- C:\Windows\System\EGNUwbl.exe
  C:\Windows\System\EGNUwbl.exe
  2⤵
  PID:5536
- C:\Windows\System\iFhMHsT.exe
  C:\Windows\System\iFhMHsT.exe
  2⤵
  PID:5588
- C:\Windows\System\hadrNJv.exe
  C:\Windows\System\hadrNJv.exe
  2⤵
  PID:14472
- C:\Windows\System\NRdIQti.exe
  C:\Windows\System\NRdIQti.exe
  2⤵
  PID:14728
- C:\Windows\System\ksfTpaj.exe
  C:\Windows\System\ksfTpaj.exe
  2⤵
  PID:14764
- C:\Windows\System\TVgdxwz.exe
  C:\Windows\System\TVgdxwz.exe
  2⤵
  PID:5436
- C:\Windows\System\SkmCgff.exe
  C:\Windows\System\SkmCgff.exe
  2⤵
  PID:14828
- C:\Windows\System\zSpkCwQ.exe
  C:\Windows\System\zSpkCwQ.exe
  2⤵
  PID:14852
- C:\Windows\System\FtITbLR.exe
  C:\Windows\System\FtITbLR.exe
  2⤵
  PID:3028
- C:\Windows\System\nnxQucm.exe
  C:\Windows\System\nnxQucm.exe
  2⤵
  PID:5772
- C:\Windows\System\LdzjlTY.exe
  C:\Windows\System\LdzjlTY.exe
  2⤵
  PID:15136
- C:\Windows\System\WqAFgpG.exe
  C:\Windows\System\WqAFgpG.exe
  2⤵
  PID:15088
- C:\Windows\System\mDZDREs.exe
  C:\Windows\System\mDZDREs.exe
  2⤵
  PID:15140
- C:\Windows\System\Joxmzir.exe
  C:\Windows\System\Joxmzir.exe
  2⤵
  PID:3256
- C:\Windows\System\aADkijT.exe
  C:\Windows\System\aADkijT.exe
  2⤵
  PID:5136
- C:\Windows\System\lOoPHLW.exe
  C:\Windows\System\lOoPHLW.exe
  2⤵
  PID:3200
- C:\Windows\System\hMAXmji.exe
  C:\Windows\System\hMAXmji.exe
  2⤵
  PID:5972
- C:\Windows\System\thVAxdA.exe
  C:\Windows\System\thVAxdA.exe
  2⤵
  PID:5740
- C:\Windows\System\ZrWHSPO.exe
  C:\Windows\System\ZrWHSPO.exe
  2⤵
  PID:14440
- C:\Windows\System\bRbfYDC.exe
  C:\Windows\System\bRbfYDC.exe
  2⤵
  PID:14540
- C:\Windows\System\grgXYie.exe
  C:\Windows\System\grgXYie.exe
  2⤵
  PID:4644
- C:\Windows\System\dJmBXcM.exe
  C:\Windows\System\dJmBXcM.exe
  2⤵
  PID:6220
- C:\Windows\System\ZYznbaX.exe
  C:\Windows\System\ZYznbaX.exe
  2⤵
  PID:14668
- C:\Windows\System\cEsHajt.exe
  C:\Windows\System\cEsHajt.exe
  2⤵
  PID:5184
- C:\Windows\System\XCoxijm.exe
  C:\Windows\System\XCoxijm.exe
  2⤵
  PID:864
- C:\Windows\System\rAkGGqu.exe
  C:\Windows\System\rAkGGqu.exe
  2⤵
  PID:14776
- C:\Windows\System\vYZezPb.exe
  C:\Windows\System\vYZezPb.exe
  2⤵
  PID:5300
- C:\Windows\System\DIvkNwG.exe
  C:\Windows\System\DIvkNwG.exe
  2⤵
  PID:14796
- C:\Windows\System\zVItesM.exe
  C:\Windows\System\zVItesM.exe
  2⤵
  PID:4448
- C:\Windows\System\wphklYj.exe
  C:\Windows\System\wphklYj.exe
  2⤵
  PID:2216
- C:\Windows\System\SffxgFf.exe
  C:\Windows\System\SffxgFf.exe
  2⤵
  PID:5712
- C:\Windows\System\KGthojW.exe
  C:\Windows\System\KGthojW.exe
  2⤵
  PID:3516
- C:\Windows\System\cKecAYI.exe
  C:\Windows\System\cKecAYI.exe
  2⤵
  PID:5720
- C:\Windows\System\OwuzPKf.exe
  C:\Windows\System\OwuzPKf.exe
  2⤵
  PID:15056
- C:\Windows\System\XPVpBgF.exe
  C:\Windows\System\XPVpBgF.exe
  2⤵
  PID:2304
- C:\Windows\System\tTAWukv.exe
  C:\Windows\System\tTAWukv.exe
  2⤵
  PID:15164
- C:\Windows\System\OjuzMSb.exe
  C:\Windows\System\OjuzMSb.exe
  2⤵
  PID:5752
- C:\Windows\System\yHEwQRp.exe
  C:\Windows\System\yHEwQRp.exe
  2⤵
  PID:6208
- C:\Windows\System\jSHHCso.exe
  C:\Windows\System\jSHHCso.exe
  2⤵
  PID:6664
- C:\Windows\System\AfrQlrn.exe
  C:\Windows\System\AfrQlrn.exe
  2⤵
  PID:2064
- C:\Windows\System\QwBaVip.exe
  C:\Windows\System\QwBaVip.exe
  2⤵
  PID:5156
- C:\Windows\System\vxtsyhm.exe
  C:\Windows\System\vxtsyhm.exe
  2⤵
  PID:14856
- C:\Windows\System\NmEjRtG.exe
  C:\Windows\System\NmEjRtG.exe
  2⤵
  PID:5248
- C:\Windows\System\BGOYsqc.exe
  C:\Windows\System\BGOYsqc.exe
  2⤵
  PID:14988
- C:\Windows\System\aqQAtkr.exe
  C:\Windows\System\aqQAtkr.exe
  2⤵
  PID:6548
- C:\Windows\System\SkEzdEh.exe
  C:\Windows\System\SkEzdEh.exe
  2⤵
  PID:3724
- C:\Windows\System\oRErPDg.exe
  C:\Windows\System\oRErPDg.exe
  2⤵
  PID:6716
- C:\Windows\System\kirAFUM.exe
  C:\Windows\System\kirAFUM.exe
  2⤵
  PID:6436
- C:\Windows\System\ndkLCMA.exe
  C:\Windows\System\ndkLCMA.exe
  2⤵
  PID:6588
- C:\Windows\System\urupneY.exe
  C:\Windows\System\urupneY.exe
  2⤵
  PID:6460
- C:\Windows\System\PWTtDlZ.exe
  C:\Windows\System\PWTtDlZ.exe
  2⤵
  PID:15000
- C:\Windows\System\rLyqMqC.exe
  C:\Windows\System\rLyqMqC.exe
  2⤵
  PID:7024
- C:\Windows\System\Bsjrjtn.exe
  C:\Windows\System\Bsjrjtn.exe
  2⤵
  PID:5836
- C:\Windows\System\lFJgYXU.exe
  C:\Windows\System\lFJgYXU.exe
  2⤵
  PID:4992
- C:\Windows\System\wOuIYaa.exe
  C:\Windows\System\wOuIYaa.exe
  2⤵
  PID:5460
- C:\Windows\System\sNQFvGe.exe
  C:\Windows\System\sNQFvGe.exe
  2⤵
  PID:5668
- C:\Windows\System\XiyBuHK.exe
  C:\Windows\System\XiyBuHK.exe
  2⤵
  PID:5640
- C:\Windows\System\SsjYpuT.exe
  C:\Windows\System\SsjYpuT.exe
  2⤵
  PID:5796
- C:\Windows\System\qXheKjz.exe
  C:\Windows\System\qXheKjz.exe
  2⤵
  PID:5932
- C:\Windows\System\DeUBjPQ.exe
  C:\Windows\System\DeUBjPQ.exe
  2⤵
  PID:2720
- C:\Windows\System\aFFxgEY.exe
  C:\Windows\System\aFFxgEY.exe
  2⤵
  PID:7832
- C:\Windows\System\doaKFBn.exe
  C:\Windows\System\doaKFBn.exe
  2⤵
  PID:6656
- C:\Windows\System\hdhtfmE.exe
  C:\Windows\System\hdhtfmE.exe
  2⤵
  PID:6368
- C:\Windows\System\bHFJDFj.exe
  C:\Windows\System\bHFJDFj.exe
  2⤵
  PID:6712
- C:\Windows\System\GsBNZnV.exe
  C:\Windows\System\GsBNZnV.exe
  2⤵
  PID:5684
- C:\Windows\System\CfXNOdm.exe
  C:\Windows\System\CfXNOdm.exe
  2⤵
  PID:6876
- C:\Windows\System\LySdVDk.exe
  C:\Windows\System\LySdVDk.exe
  2⤵
  PID:7096

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 3132 -i 3132 -h 364 -j 440 -s 496 -d 11132
1⤵
PID:14144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sya5kung.t1e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AdNyzvR.exe

Filesize
2.0MB

MD5
88f67b8bbf9badd791b020e875333358

SHA1
95d762a8a519487a98658cd7c3c01f91d79310e4

SHA256
0f923cce8f62a03461411004dcbce964a250d4091bf0ede50cfbe2ab27a75a22

SHA512
8f0e5c28d6612f0aff2402b213821ecdfd55fc165c1fc8bc11d81cef23afa52d07afa67d634395a5f885509e7bd3fccf965432d6dc1097e8534d680415367a5c

Download Submit
C:\Windows\System\CYhMJrF.exe

Filesize
2.1MB

MD5
0680708a43ff375c4ed6e53bf2f0cfa9

SHA1
e6726d3941e6d5fffd394025de7979f6e89d8a15

SHA256
234b485eec0c78317196bee68e8491579e8c5976d2d69c7f8cd2193791e86080

SHA512
0259ba6d8976396d1190269172faed5f3c34528653edfa25e83679c21d9dcd767dfb17d43bd4fb5b63a81189930b3142e4a63516d4af765b437a7472a4395db8

Download Submit
C:\Windows\System\CaPFNVQ.exe

Filesize
2.0MB

MD5
9415558c5f83aea229c2a90f4245a4be

SHA1
7adc95460e23c87aa4a2eefbcc9efddd1a904232

SHA256
433b7ab58644876bf1560f84cad9bd829a4f9bcfe4805bb90e1e1bfd845279cd

SHA512
7155714cb52bb8a0324de3eda7bb449611ab9edad360c1437f0023d8e5beaa017a82454ff3c9770e8d74808948c08b05fb48c7e494600efc00f219acbac788ae

Download Submit
C:\Windows\System\FLhiKnT.exe

Filesize
2.1MB

MD5
c24f176f6b4e7f50ff3afbf4ff595ac5

SHA1
289d73d8e6a1a66de951680ddc5850d8474813de

SHA256
5eb536aa1bea284015182ce4d69baf5ffb961f052056bfe8f389b35b29a2128b

SHA512
db2e9b5d8c541b00e8c9f834ac2d49c7216c49ad6e5e6dad59af61d35645b9e1fc50c8e21ff991ee5a9a93d2c81380eaa3c5bfc4f93484ea21d83c4e5dfc5d61

Download Submit
C:\Windows\System\FppmPYV.exe

Filesize
2.1MB

MD5
793c6d9f2e677fbf8752e03a90c91251

SHA1
029543ddf67019e056ff502d3dd3a4f617b453ea

SHA256
79c242afdc5f91d5fa2d35975898ddc8a22e0004287f4fc7c21e6b49d3fb10ae

SHA512
1b5c7905e25826f875f9227216e33ee71c693f6083d54446542b2ff015d7c06a363cd09e9ce54ae11316a7bc956c6df9a287c84ce12744737f477b1f59f19eab

Download Submit
C:\Windows\System\GXofrCa.exe

Filesize
2.1MB

MD5
8f84171bc879da973a4a6d3fabc2013f

SHA1
5b0a5a324e05b53fb99e690784b8430e4a6eafb1

SHA256
e62c49b2843250d95d940b9dac43f1a3d78fc54d5f5ffd0db552420d7b62f991

SHA512
a50f7e3ce8a12d021e893dead5c719e7a44c35f4b9388300bfbc54c2e400367b1edac8809aa66069d46df1e34cfecb7e47ff226ba3d4ee37cb0ccdd8e4cd7e1a

Download Submit
C:\Windows\System\GnXAtuK.exe

Filesize
2.1MB

MD5
9ee8bfc7bf3a11c7233f9cb6a5fac866

SHA1
4a53e6107986c53917c6f25b2a4447e3b143bfce

SHA256
39bc15049eb73a8239d5c8a0b9dfe667ed4eafd6ea4cf21302724d7ae72df73e

SHA512
af629faa30079e065dce1240e0c28e9519629366bde49a6e8b82898100531857ee00ae2ef3644e1ac0a5825dfc1fa49468ed1d29896495507cab4736579af314

Download Submit
C:\Windows\System\JDdNqaR.exe

Filesize
2.0MB

MD5
7c422869911eb7c1181c8e768287220e

SHA1
1d17f083f00b7f7dd036706083852d568554b44e

SHA256
68ac1f275019be2bb55b1ae90e3b697bf632914753b2f0986fff5ecccfcb563f

SHA512
1bd8f7036146c8a2e94e5f6b8fa30bb39c91459ad7b6d4c6ed48763225fb9a3282ce829b1d4fa2043fa8458ab30e818e20ab280da1d2830414a5ad298e3f3dee

Download Submit
C:\Windows\System\NeiksUP.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\OowLLGs.exe

Filesize
2.1MB

MD5
3db7e2a8f55b99033099b1c58b142e72

SHA1
d2275ec6ab2a24bae6368927fd8daf96a3ae0fdc

SHA256
8994987f2db0a0feed09efaa27f1ee49ae1d709aa251a079299667cf18744643

SHA512
9877dcbf4598dc996081ce25b8f71b8ea7b8b088fb6a4e58c802e3aae2dfe324eea3c91803c9eff3c9f84995cf943c8c950f8bbe218d2d5cf2a6bc30c1eaa463

Download Submit
C:\Windows\System\OutLEFC.exe

Filesize
2.0MB

MD5
a59afdd3abe93a8728a120d3805c6996

SHA1
0eb7e37ce0c72d1e935a9bb23745b4073c0f540a

SHA256
f42515028ea01328e685989063e77f7d27d35e55dff323ab0cecdd435262c3a8

SHA512
51052ca6c3f2204c8f98a74cb57e0af58e97bf61f1e64c3d4b3b49072640fc8f4af325fef8e48fd083235e720020d755e9cb7cc7e22ecca79fcf05f435b2b5a8

Download Submit
C:\Windows\System\SMlsZSI.exe

Filesize
2.1MB

MD5
9c68d866055a6f4db4c373b56f2d7da4

SHA1
c9c9125838cec29e43e2be700742c3c5794b7cf4

SHA256
1c44d84e679f5584f25f69e6442aa0a8b580f18afa2f77303e0020800a8d7045

SHA512
81e48fe7e2ac88fe857719f7a736dd444d440fe332844252b72afd150ef2961f55da8c09a89da05383d1b8ff71df3eedaaaa4c900decda245d54b355ab093c21

Download Submit
C:\Windows\System\ZZJOCRu.exe

Filesize
18B

MD5
ef758e56e906b9892f08e5e0fd0f13b2

SHA1
5d91983aa1bb61c5754ee9a01242f0bb098e7d43

SHA256
55949f339b372645d839eaa0847f4e244396f7e39c4586ddc776fb793deda110

SHA512
efd8bb7ef71cf583c97f5d0eac4e2fae239c80d85643b80c586971498ace127bb0c9565e46052e55211bb3dead5ae54145b84fc68e9ff4a6be2a5f6b0f086760

Download Submit
C:\Windows\System\cBiCsIa.exe

Filesize
2.0MB

MD5
5e88190dbbf8902d38981d718a7aebad

SHA1
11991cee1fb4ad2e2e3cfa19a396aa03fe1b070b

SHA256
0a5c11081e2de4aa3182fc1d76cfe026d31474ed6a93aa8cf5f3e4b7cc62cf06

SHA512
f1ccd4ed8206757f499150887ec6c8c81b46213b5e67a00183400cb04c1b1ea04028acacf8d699bed834f5a06c648692ae63d9c76788f5387e11a3a69f6f06e0

Download Submit
C:\Windows\System\fJEsSkB.exe

Filesize
2.0MB

MD5
41aef1e93efcaa62ea2100fbb571f1e5

SHA1
a206395be1cd29a9d84c08398ccd05bad58bbbd8

SHA256
bd6ad439b96ccf7405bc2bbb17baae233a60be0b0d0fcc777e078228ff493e24

SHA512
afc834263965745cb285232bf0bfbbfcd3ac4990d9ed56547500938e40775271b0868ac1bfa856818ab74a4faf38bb686bedd30764abb6ae731614c502e3b0f1

Download Submit
C:\Windows\System\fZhTTWJ.exe

Filesize
2.1MB

MD5
c2e6c1820145da0e11edd9976eded9ae

SHA1
ed53603541d8700a5f00fc89ce8cc8ad2328b07e

SHA256
2095db4a64daca62d4a1655b76597c60ac864ff1bd04a92a3e571950b73dc6ba

SHA512
215286a3cb321b2f7aaf35fee3ba78ec014dfed1bd3e60a9788b2f029cadeb3f6d4791f81b9d7671c62fc1265d586c1bdd4aab7ecb18ff427737456d224f8779

Download Submit
C:\Windows\System\fhxqFKd.exe

Filesize
2.1MB

MD5
c96e8d79f5d0d9992cf6faba75618752

SHA1
cb50c0e90a99a560078a3d81e6accaa704619397

SHA256
dc31b8c6a589589200ed1f4c1ada95234c1f169f04fbc236a892ee5c585f764a

SHA512
9a325e5d034989f87d121483d38b954095e6d4acba630fb11437959ae82b06a6251c72ab5444894b70f7998fdcbf16b0c5e854f4ea5f89a18e3c84ad71c2a119

Download Submit
C:\Windows\System\hACsIqx.exe

Filesize
2.1MB

MD5
17f72e9e444a718798289f5647929f77

SHA1
4e06fdb43cb3bb16d17b79db4df17739479a19da

SHA256
6685f1786932b9b69a7faeb427b843b7918a62ded92775c8de74cc5d52d4d825

SHA512
fbc239de83319b9bd06e949b41cf0742be53853341fea2ded0319d7102e72a43eafd82dc0d8987b3bf73aea4331544e7bac6ddbc6802802bd40c0db2d6e0741e

Download Submit
C:\Windows\System\iDQVQkg.exe

Filesize
2.1MB

MD5
cec7afa649f0f001d47a90c395790c9d

SHA1
3741bbec807cd466b5601dfa594800d369a3eac6

SHA256
1733d816bb1b8625aff8ae517f0e2bb290d4ccd990c117eed264bcb2106cc2f3

SHA512
9a715ecd5defa02809ab3e89368fe56770bd914ab833c7b992be7b82497df0c68c672806324dcb17426dd96c86a4615a23b5a0ea4a6a3c41af48b9287ac0d9cf

Download Submit
C:\Windows\System\jckkYsB.exe

Filesize
2.1MB

MD5
c985e77ea2ae70c60c097d823bde70b2

SHA1
9c7fdbfab0326c6eb9bb4e87d8cf1b3af83762d6

SHA256
2ed4e57fa007795f9c2f12a0619abf6e39af2ce4e5c183bd8297fb49cbf503b6

SHA512
e9f0e849827ab11d09cc42c4737deb1c66678c736618e63e9abb7741822bc355af3006b5041c96fc5898331cbbe2bace9afb02f8ad933a6bfd639f25c7bac097

Download Submit
C:\Windows\System\nbUaraP.exe

Filesize
2.1MB

MD5
cfb59c07c56a84e90ae72b0a6ece9d30

SHA1
4e760166a3863665a38c244ab27da798e6025937

SHA256
d376c3713c629868d10a9b1f5f4749bf4cd8569844ed2ea376ad4463a6332879

SHA512
1a08b750dfe8ea57a8800747f9aa1090f86d870e2a0bd71936d102750cf87dc45ab2973d28dfca1457b27dd84ba29f74831d12c3a4149d49292348a766615fcb

Download Submit
C:\Windows\System\oBdcrhK.exe

Filesize
2.1MB

MD5
56d81d89d967d972db3e324bec9a6467

SHA1
b029dde6a07cccd1b623483c3abf03abf288e6d9

SHA256
06204465ca7df3579e40d0d6d975e91b0640eefa28c602db3e67de3f46a754c6

SHA512
5d4336b30472a0abecbecc956bf0c8ebec2418a3482d8f70b49d922d51005bf7742763d8123008f04ef1b7120625021d84eca6cafb9bbd8c3c9f78e9fb5a654e

Download Submit
C:\Windows\System\okEHWHv.exe

Filesize
2.1MB

MD5
9eebd155bc8e0fe49e8d58a51962e4b3

SHA1
2377d96c5b7ee79418410dfa258fb0f23b866d6f

SHA256
5d8fe7be108760fc2ec8b37b2e370da72f90611c1f25fa1c1c7825cdcc292aea

SHA512
e5a7a1c4fbe8a08257d165386bdc627dc46d1d22d8f7b08944ed05aa42ac2d462c248e912fb48b6acb8423be7f322d0d813aebe73cae6fbb1709c10cac8484f9

Download Submit
C:\Windows\System\pOwxKvq.exe

Filesize
2.1MB

MD5
6ea8eeb42875e5bb456251ca96a8f8ab

SHA1
87658cc3a0367eac31f95f00cdd8f38efb5ae5e9

SHA256
c0faa3253a7fd88046c64b7d783fbf6c11c3fe5e2a952e9e8387abec7bd9eeaa

SHA512
b6a8ee68ea0478283ac4a024b0a94b386859079f31097bb02fb61eb47a9b3517a354bec4ff9a8c19a4b2c98b6fe9626147c68decb959f089248f11db4b11faae

Download Submit
C:\Windows\System\pUnZgOy.exe

Filesize
2.1MB

MD5
0bac674446692f1ca886cdd68976aa45

SHA1
a8ca4038e538e989e7ab80d434624313108653f5

SHA256
ee2fdeac9dd12831a92d746fc4da5732931ae7d419e45eef6aa9633636b73108

SHA512
6b07466114f929911253b10ced8e8a278c6fae6b0ca88ea60a197ba9b1843e520020a17ed0c518ab86914c180f9d61858b2ee28cce097607f120abbf71c682bd

Download Submit
C:\Windows\System\qlKJWQU.exe

Filesize
2.1MB

MD5
caf00d585f6c8d068ff87c3e0e0b5f1c

SHA1
43a77158307f790de214fbdd87b1aa4dd281970a

SHA256
bb50153776e66d70e632ce83c4d94b8e5958b7a3cd705758165f027f825da5cb

SHA512
c0c34092339b88ad837009247116244aa0cfbb2d5146badec21a018a94194e2f1771d6b886abeaec93ecc68564289a3adf01e9cb360ba9f6be27485b3a4f8270

Download Submit
C:\Windows\System\riaYtrS.exe

Filesize
2.1MB

MD5
32911db05ad25ce14959b6c669d3ce67

SHA1
477655cc6ac7eb0b02bc54dbe5c4e7017a2b3df6

SHA256
f8fc328e3d43673e58815f46a521000228f493060402635091c9972bb535f63b

SHA512
55a976019c7ecac6862ad370bd85840d4d736b22a279af8c42dc4b9e83153247709bd01d11debab1ffb8003ec4d8069ae2992dfe50d01596101bfdda80951863

Download Submit
C:\Windows\System\tGzrpqz.exe

Filesize
2.1MB

MD5
cc50a6de59cba592231f79891e06ca26

SHA1
5e1468cc7bd9074f1058971d38e010564bad7af6

SHA256
5b296a574de68cd799fc15b09bd7b80377ba074fbaab99322cde56e5587ed496

SHA512
648748ff6088363f16214c8ce83b8ffc1cdf7267096ef8d584c21656c9775fdc9fc74bc0957791c6ae10494d0a26d5260f857b1bcab7ffac8621516effe2df78

Download Submit
C:\Windows\System\tNQGBcK.exe

Filesize
2.1MB

MD5
e9a02d6449067807216c4b32cad66521

SHA1
40d0a487f6ebc3871f6262eb7ad7e60288ec2d05

SHA256
16ed98942b2c711adde711c82cc7efc1d950584659d5dfd6aed57cf68372360c

SHA512
eca74c8f8ae86f608029f94e957ad80ec55a2c7b8db36cf7027743f98ccba496fe1a0548519482d84f28d36952d7b7233972b98b8edff20554aeee0f0fbbcb9e

Download Submit
C:\Windows\System\vCdMIoR.exe

Filesize
2.0MB

MD5
a3189645ec2f3bb15d4091c5d8e8a955

SHA1
9d04bfea5c4f2116c75390e65889760114a60eec

SHA256
9f65ecdd9a3bebbe3a8f42b60adeeb1bc4a14162c4adc9374f7fe08005da544d

SHA512
383c915b1c284f6a1395a455ebf7796da1ffdb187f1a5fcf5d452a4cdbb2583ab3df88b2850ef40e88a2f2eaa997d055c899d84c58d002a145f1e26a6e411834

Download Submit
C:\Windows\System\vfMMplU.exe

Filesize
2.1MB

MD5
44b23b03edb1061ee2b007bd6947bf1d

SHA1
8afa6aa94e9539cd936d9da38124301715ef1199

SHA256
c3206a787240eabb53e81783f2185328fe375ec385832c18a043780491b1d8ba

SHA512
a8fc48b194e39c866e5ff52ff6699436e86c04d7506df9083099b7e95ed48cceba469e1e6688918b5420a6473100906bd1f336a44e9f9db1bba5e1ea45df7a58

Download Submit
C:\Windows\System\vyqsZyJ.exe

Filesize
2.1MB

MD5
91367324b8f326d80794a745b8f237d9

SHA1
a5798a2d1315318ca25a42da99ac8186ecd0ff23

SHA256
39ccdafacb36994d653c91e7503ab7267327e6600ba1da7d62ef037fbd6b80eb

SHA512
87b4448aa218790080c277effe0bf6f033607f142f3b8370fe7706ad64d05ea4f2b62b86019356d92bc34745ad58cb82fabad1ecfd69a5f352b7d1c190e5b4dc

Download Submit
C:\Windows\System\wMCALnx.exe

Filesize
2.0MB

MD5
041b862988cdb14e791d8435876ff642

SHA1
026eb3c39fc7556535a047354a5a1217bf29ce6c

SHA256
5132c3126ef1a2a40f7317f3f2140031b8d2a0627a88562931a23b0842e7dc28

SHA512
5fd83127f74ba8f1c038c9dde58e78206d632cb4a78b75dd2a87873c1a9f48df57c39fbfb17e4709be9d7525d7b46cf83b87258cd35643273ed0b35a6bbbe820

Download Submit
C:\Windows\System\zHbffJB.exe

Filesize
2.1MB

MD5
72757cc1a8fd13d2badf1b04d7bafa86

SHA1
abd7e4955c9b46652a5a1c7d4d5146fc66ee50fb

SHA256
943e9e109bc25cb723d0bedfcafd933d984b068f7facdad7d6f68ab0b6568f7f

SHA512
b1e539c0c707a607537613a7c5958bae9fb9f86d028c6d5f6fd3aa9e6ee9941275caffde26f9d98f4820154fd6013016f0e91019735154665c42dc543b02d556

Download Submit
memory/860-58-0x00007FF7B7410000-0x00007FF7B7802000-memory.dmp

Filesize
3.9MB

Download
memory/860-5392-0x00007FF7B7410000-0x00007FF7B7802000-memory.dmp

Filesize
3.9MB

Download
memory/1160-182-0x00007FF640FC0000-0x00007FF6413B2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-5487-0x00007FF640FC0000-0x00007FF6413B2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-5483-0x00007FF691150000-0x00007FF691542000-memory.dmp

Filesize
3.9MB

Download
memory/1400-176-0x00007FF691150000-0x00007FF691542000-memory.dmp

Filesize
3.9MB

Download
memory/1436-174-0x00007FF750BC0000-0x00007FF750FB2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-166-0x00007FF77D540000-0x00007FF77D932000-memory.dmp

Filesize
3.9MB

Download
memory/2220-286-0x000001F54E1E0000-0x000001F54E986000-memory.dmp

Filesize
7.6MB

Download
memory/2220-59-0x00007FFF42593000-0x00007FFF42595000-memory.dmp

Filesize
8KB

Download
memory/2220-29-0x000001F54B340000-0x000001F54B350000-memory.dmp

Filesize
64KB

Download
memory/2220-2592-0x00007FFF42593000-0x00007FFF42595000-memory.dmp

Filesize
8KB

Download
memory/2220-68-0x000001F533210000-0x000001F533232000-memory.dmp

Filesize
136KB

Download
memory/2352-5515-0x00007FF708450000-0x00007FF708842000-memory.dmp

Filesize
3.9MB

Download
memory/2352-188-0x00007FF708450000-0x00007FF708842000-memory.dmp

Filesize
3.9MB

Download
memory/2488-0-0x00007FF726350000-0x00007FF726742000-memory.dmp

Filesize
3.9MB

Download
memory/2488-1-0x000002BBBEC40000-0x000002BBBEC50000-memory.dmp

Filesize
64KB

Download
memory/2548-14-0x00007FF73B480000-0x00007FF73B872000-memory.dmp

Filesize
3.9MB

Download
memory/2728-5456-0x00007FF7443C0000-0x00007FF7447B2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-169-0x00007FF7443C0000-0x00007FF7447B2000-memory.dmp

Filesize
3.9MB

Download
memory/3156-187-0x00007FF7D0000000-0x00007FF7D03F2000-memory.dmp

Filesize
3.9MB

Download
memory/3156-5410-0x00007FF7D0000000-0x00007FF7D03F2000-memory.dmp

Filesize
3.9MB

Download
memory/3372-5479-0x00007FF7C3A00000-0x00007FF7C3DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3372-175-0x00007FF7C3A00000-0x00007FF7C3DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3496-168-0x00007FF78C4D0000-0x00007FF78C8C2000-memory.dmp

Filesize
3.9MB

Download
memory/3496-5417-0x00007FF78C4D0000-0x00007FF78C8C2000-memory.dmp

Filesize
3.9MB

Download
memory/3744-5504-0x00007FF725390000-0x00007FF725782000-memory.dmp

Filesize
3.9MB

Download
memory/3744-183-0x00007FF725390000-0x00007FF725782000-memory.dmp

Filesize
3.9MB

Download
memory/3788-141-0x00007FF77A800000-0x00007FF77ABF2000-memory.dmp

Filesize
3.9MB

Download
memory/3788-5368-0x00007FF77A800000-0x00007FF77ABF2000-memory.dmp

Filesize
3.9MB

Download
memory/4016-186-0x00007FF7A1A70000-0x00007FF7A1E62000-memory.dmp

Filesize
3.9MB

Download
memory/4080-5464-0x00007FF646B00000-0x00007FF646EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4080-170-0x00007FF646B00000-0x00007FF646EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4152-28-0x00007FF629A70000-0x00007FF629E62000-memory.dmp

Filesize
3.9MB

Download
memory/4220-5495-0x00007FF7D9480000-0x00007FF7D9872000-memory.dmp

Filesize
3.9MB

Download
memory/4220-179-0x00007FF7D9480000-0x00007FF7D9872000-memory.dmp

Filesize
3.9MB

Download
memory/4244-25-0x00007FF6221B0000-0x00007FF6225A2000-memory.dmp

Filesize
3.9MB

Download
memory/4376-152-0x00007FF720D00000-0x00007FF7210F2000-memory.dmp

Filesize
3.9MB

Download
memory/4376-5381-0x00007FF720D00000-0x00007FF7210F2000-memory.dmp

Filesize
3.9MB

Download
memory/4720-181-0x00007FF6419E0000-0x00007FF641DD2000-memory.dmp

Filesize
3.9MB

Download
memory/4720-5491-0x00007FF6419E0000-0x00007FF641DD2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-44-0x00007FF713620000-0x00007FF713A12000-memory.dmp

Filesize
3.9MB

Download
memory/4820-171-0x00007FF71A8F0000-0x00007FF71ACE2000-memory.dmp

Filesize
3.9MB

Download
memory/4892-2227-0x00007FF7507B0000-0x00007FF750BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4892-49-0x00007FF7507B0000-0x00007FF750BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4976-2214-0x00007FF6DB380000-0x00007FF6DB772000-memory.dmp

Filesize
3.9MB

Download
memory/4976-43-0x00007FF6DB380000-0x00007FF6DB772000-memory.dmp

Filesize
3.9MB

Download