xmrig | 764eceabe8c3f10cee79941066e217f5948da65783ca9bcb2b1f0793d54cf705

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
Size

2.1MB
MD5

01ce2ce7f73002278fa46fef14c64444
SHA1

9c4de40b305c774ad1645352a27459c10e819383
SHA256

764eceabe8c3f10cee79941066e217f5948da65783ca9bcb2b1f0793d54cf705
SHA512

006c68a41c4f853300a817c141e7d3c25909aa8599fa5deed6e2b22d6d8f600117875065b04b2a28ae6b94d644a19cd95301255a3e8518b94e43d198331cddff
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafws1PQ:NABd

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/4788-81-0x00007FF727510000-0x00007FF727902000-memory.dmp	xmrig
behavioral2/memory/1512-84-0x00007FF62DF50000-0x00007FF62E342000-memory.dmp	xmrig
behavioral2/memory/2920-83-0x00007FF7D65C0000-0x00007FF7D69B2000-memory.dmp	xmrig
behavioral2/memory/1700-80-0x00007FF75D830000-0x00007FF75DC22000-memory.dmp	xmrig
behavioral2/memory/1060-79-0x00007FF69DAD0000-0x00007FF69DEC2000-memory.dmp	xmrig
behavioral2/memory/4500-78-0x00007FF67D160000-0x00007FF67D552000-memory.dmp	xmrig
behavioral2/memory/2628-77-0x00007FF7137F0000-0x00007FF713BE2000-memory.dmp	xmrig
behavioral2/memory/4416-71-0x00007FF71A740000-0x00007FF71AB32000-memory.dmp	xmrig
behavioral2/memory/3192-338-0x00007FF685AE0000-0x00007FF685ED2000-memory.dmp	xmrig
behavioral2/memory/4016-123-0x00007FF76D900000-0x00007FF76DCF2000-memory.dmp	xmrig
behavioral2/memory/2484-122-0x00007FF77A6D0000-0x00007FF77AAC2000-memory.dmp	xmrig
behavioral2/memory/2800-104-0x00007FF6C4510000-0x00007FF6C4902000-memory.dmp	xmrig
behavioral2/memory/996-1470-0x00007FF6F5570000-0x00007FF6F5962000-memory.dmp	xmrig
behavioral2/memory/4348-1941-0x00007FF6F4BF0000-0x00007FF6F4FE2000-memory.dmp	xmrig
behavioral2/memory/5088-2166-0x00007FF61BF80000-0x00007FF61C372000-memory.dmp	xmrig
behavioral2/memory/4168-2169-0x00007FF7D9A60000-0x00007FF7D9E52000-memory.dmp	xmrig
behavioral2/memory/1736-2551-0x00007FF721150000-0x00007FF721542000-memory.dmp	xmrig
behavioral2/memory/1428-2567-0x00007FF686CC0000-0x00007FF6870B2000-memory.dmp	xmrig
behavioral2/memory/1856-2568-0x00007FF72D060000-0x00007FF72D452000-memory.dmp	xmrig
behavioral2/memory/4416-2648-0x00007FF71A740000-0x00007FF71AB32000-memory.dmp	xmrig
behavioral2/memory/4348-2652-0x00007FF6F4BF0000-0x00007FF6F4FE2000-memory.dmp	xmrig
behavioral2/memory/4888-2657-0x00007FF7790C0000-0x00007FF7794B2000-memory.dmp	xmrig
behavioral2/memory/2920-2659-0x00007FF7D65C0000-0x00007FF7D69B2000-memory.dmp	xmrig
behavioral2/memory/2628-2667-0x00007FF7137F0000-0x00007FF713BE2000-memory.dmp	xmrig
behavioral2/memory/4228-2640-0x00007FF78A460000-0x00007FF78A852000-memory.dmp	xmrig
behavioral2/memory/4812-2631-0x00007FF6595E0000-0x00007FF6599D2000-memory.dmp	xmrig
behavioral2/memory/1700-2681-0x00007FF75D830000-0x00007FF75DC22000-memory.dmp	xmrig
behavioral2/memory/1060-2682-0x00007FF69DAD0000-0x00007FF69DEC2000-memory.dmp	xmrig
behavioral2/memory/4788-2679-0x00007FF727510000-0x00007FF727902000-memory.dmp	xmrig
behavioral2/memory/4500-2684-0x00007FF67D160000-0x00007FF67D552000-memory.dmp	xmrig
behavioral2/memory/1512-2677-0x00007FF62DF50000-0x00007FF62E342000-memory.dmp	xmrig
behavioral2/memory/4168-2872-0x00007FF7D9A60000-0x00007FF7D9E52000-memory.dmp	xmrig
behavioral2/memory/2800-2880-0x00007FF6C4510000-0x00007FF6C4902000-memory.dmp	xmrig
behavioral2/memory/5088-2870-0x00007FF61BF80000-0x00007FF61C372000-memory.dmp	xmrig
behavioral2/memory/2484-2892-0x00007FF77A6D0000-0x00007FF77AAC2000-memory.dmp	xmrig
behavioral2/memory/1736-2903-0x00007FF721150000-0x00007FF721542000-memory.dmp	xmrig
behavioral2/memory/3192-2907-0x00007FF685AE0000-0x00007FF685ED2000-memory.dmp	xmrig
behavioral2/memory/1428-2898-0x00007FF686CC0000-0x00007FF6870B2000-memory.dmp	xmrig
behavioral2/memory/4016-2888-0x00007FF76D900000-0x00007FF76DCF2000-memory.dmp	xmrig
behavioral2/memory/1856-3147-0x00007FF72D060000-0x00007FF72D452000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	744	powershell.exe
5	744	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4812	NEaYOsI.exe
4228	krrFAZe.exe
4888	vGTjKCp.exe
4348	IDTpCay.exe
4416	VacuZAZ.exe
2920	YPbHxJH.exe
2628	LWDmKEP.exe
1512	JInxgPb.exe
4500	YZtbxKW.exe
1060	YLEENsM.exe
1700	AmZfiVr.exe
4788	bxGwceo.exe
5088	CcFzciI.exe
4168	jjGIpKX.exe
2800	BlhRcQx.exe
2484	JDeWYyl.exe
4016	AoHUSQL.exe
1428	hSBVtwK.exe
1736	rZVRQdz.exe
1856	Nadjonz.exe
3192	jMWQfEF.exe
4232	FHMouYj.exe
4852	MMeIuji.exe
4732	oJmYYME.exe
2428	iqVNnDP.exe
548	AiOVaur.exe
312	uOnZJCR.exe
1936	qElXzdA.exe
636	gYhONtC.exe
3184	bslHoUK.exe
4536	eoAAhJl.exe
1048	awTGEnq.exe
4540	TVGIWcQ.exe
436	fgjsnId.exe
3616	fLgufuY.exe
4976	WUTUyaf.exe
4936	PxQIbCo.exe
4616	rHStdJj.exe
5060	fFZyYay.exe
4188	fxnOAwY.exe
4372	ierhQYg.exe
3780	rAChPSS.exe
936	uKIcsHX.exe
1016	lQKgoir.exe
1724	yFnZjwe.exe
1232	DTSaSLi.exe
628	aqlHENh.exe
592	LEzYpIm.exe
5104	eMxkxkF.exe
3752	QeiLwYu.exe
4392	bGVVYrc.exe
4108	EWHcfsu.exe
4964	GSIBLGv.exe
1588	GCcfokM.exe
5092	TazoWly.exe
1976	uFJrZUU.exe
3712	TEiMHSG.exe
60	XRKIOYn.exe
1900	aAQcMcn.exe
2472	JlLKPCV.exe
2036	LZsIsIS.exe
4028	eTVGvVx.exe
1240	YzRboaP.exe
840	cgeQYpn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/996-0-0x00007FF6F5570000-0x00007FF6F5962000-memory.dmp	upx
behavioral2/files/0x0006000000022fa8-5.dat	upx
behavioral2/files/0x000800000002346d-7.dat	upx
behavioral2/files/0x0007000000023470-31.dat	upx
behavioral2/files/0x0007000000023473-53.dat	upx
behavioral2/files/0x0007000000023476-61.dat	upx
behavioral2/files/0x0007000000023475-66.dat	upx
behavioral2/files/0x0007000000023478-76.dat	upx
behavioral2/memory/4788-81-0x00007FF727510000-0x00007FF727902000-memory.dmp	upx
behavioral2/memory/1512-84-0x00007FF62DF50000-0x00007FF62E342000-memory.dmp	upx
behavioral2/files/0x0007000000023477-86.dat	upx
behavioral2/memory/4168-85-0x00007FF7D9A60000-0x00007FF7D9E52000-memory.dmp	upx
behavioral2/memory/2920-83-0x00007FF7D65C0000-0x00007FF7D69B2000-memory.dmp	upx
behavioral2/memory/5088-82-0x00007FF61BF80000-0x00007FF61C372000-memory.dmp	upx
behavioral2/memory/1700-80-0x00007FF75D830000-0x00007FF75DC22000-memory.dmp	upx
behavioral2/memory/1060-79-0x00007FF69DAD0000-0x00007FF69DEC2000-memory.dmp	upx
behavioral2/memory/4500-78-0x00007FF67D160000-0x00007FF67D552000-memory.dmp	upx
behavioral2/memory/2628-77-0x00007FF7137F0000-0x00007FF713BE2000-memory.dmp	upx
behavioral2/memory/4416-71-0x00007FF71A740000-0x00007FF71AB32000-memory.dmp	upx
behavioral2/files/0x0007000000023474-59.dat	upx
behavioral2/files/0x0007000000023472-57.dat	upx
behavioral2/files/0x0007000000023471-48.dat	upx
behavioral2/memory/4348-39-0x00007FF6F4BF0000-0x00007FF6F4FE2000-memory.dmp	upx
behavioral2/files/0x000700000002346e-38.dat	upx
behavioral2/files/0x000700000002346f-32.dat	upx
behavioral2/memory/4888-28-0x00007FF7790C0000-0x00007FF7794B2000-memory.dmp	upx
behavioral2/memory/4228-27-0x00007FF78A460000-0x00007FF78A852000-memory.dmp	upx
behavioral2/files/0x000800000002346a-23.dat	upx
behavioral2/files/0x000800000002346b-102.dat	upx
behavioral2/files/0x0008000000023479-112.dat	upx
behavioral2/files/0x000800000002347a-111.dat	upx
behavioral2/files/0x000700000002347c-121.dat	upx
behavioral2/files/0x000700000002347b-124.dat	upx
behavioral2/files/0x000700000002347d-129.dat	upx
behavioral2/memory/1428-130-0x00007FF686CC0000-0x00007FF6870B2000-memory.dmp	upx
behavioral2/files/0x000700000002347f-140.dat	upx
behavioral2/files/0x0007000000023480-145.dat	upx
behavioral2/files/0x0007000000023486-175.dat	upx
behavioral2/files/0x0007000000023488-185.dat	upx
behavioral2/files/0x000700000002348a-195.dat	upx
behavioral2/memory/3192-338-0x00007FF685AE0000-0x00007FF685ED2000-memory.dmp	upx
behavioral2/files/0x0007000000023489-190.dat	upx
behavioral2/files/0x0007000000023487-188.dat	upx
behavioral2/files/0x0007000000023485-178.dat	upx
behavioral2/files/0x0007000000023484-173.dat	upx
behavioral2/files/0x0007000000023483-168.dat	upx
behavioral2/files/0x0007000000023482-163.dat	upx
behavioral2/files/0x0007000000023481-158.dat	upx
behavioral2/files/0x000700000002347e-141.dat	upx
behavioral2/memory/1856-131-0x00007FF72D060000-0x00007FF72D452000-memory.dmp	upx
behavioral2/memory/1736-125-0x00007FF721150000-0x00007FF721542000-memory.dmp	upx
behavioral2/memory/4016-123-0x00007FF76D900000-0x00007FF76DCF2000-memory.dmp	upx
behavioral2/memory/2484-122-0x00007FF77A6D0000-0x00007FF77AAC2000-memory.dmp	upx
behavioral2/memory/2800-104-0x00007FF6C4510000-0x00007FF6C4902000-memory.dmp	upx
behavioral2/memory/4812-12-0x00007FF6595E0000-0x00007FF6599D2000-memory.dmp	upx
behavioral2/memory/996-1470-0x00007FF6F5570000-0x00007FF6F5962000-memory.dmp	upx
behavioral2/memory/4348-1941-0x00007FF6F4BF0000-0x00007FF6F4FE2000-memory.dmp	upx
behavioral2/memory/5088-2166-0x00007FF61BF80000-0x00007FF61C372000-memory.dmp	upx
behavioral2/memory/4168-2169-0x00007FF7D9A60000-0x00007FF7D9E52000-memory.dmp	upx
behavioral2/memory/1736-2551-0x00007FF721150000-0x00007FF721542000-memory.dmp	upx
behavioral2/memory/1428-2567-0x00007FF686CC0000-0x00007FF6870B2000-memory.dmp	upx
behavioral2/memory/1856-2568-0x00007FF72D060000-0x00007FF72D452000-memory.dmp	upx
behavioral2/memory/4416-2648-0x00007FF71A740000-0x00007FF71AB32000-memory.dmp	upx
behavioral2/memory/4348-2652-0x00007FF6F4BF0000-0x00007FF6F4FE2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YchlPOk.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\yvPQnQV.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\mbVzwLX.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ogTcePM.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\HCFioUb.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ENNkohe.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\KshyuMm.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\KjusiGt.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\GQgxbfk.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ozcIjOt.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\IZgbuup.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\afnwsQW.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\HWmVhna.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\fjQRhUm.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\EqVdZwI.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\aEctMIg.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\iqnJOlt.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\YLEENsM.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ZjirbuW.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\pKeEIgi.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\VmPVhLT.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\DsKnnXF.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\tuPAZxP.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\EEjUWGY.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\hpxcFhP.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\SVwptPZ.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ZxdbLBH.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\MGbaBeh.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\unIREBa.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\xcvuAso.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\VNrZNyq.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\LMWkSNb.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\UqEnDAU.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\GJmzHrJ.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\mXDDyMz.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ypiweXZ.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\fRPoEoa.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\LuDMaLN.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\pnzjVTN.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\gTIRWwy.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\qhqfpuB.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\rTjcdJd.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\jQljkkN.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\BRcpMKB.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\pSSuxGs.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\zrxRdra.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\oxTagfa.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\jjGIpKX.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\rMqVAGh.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\VRxxmjd.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\nTeJyfD.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ODCWJrY.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\GWXdziJ.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\dwnZLEL.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\qVDjnAf.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\TbVEfrJ.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\PvNGdDv.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\jRaIqhm.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\LdRdMGO.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\MmrlqOT.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\zPBrZVv.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\owDXsAY.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\GmbCOuL.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\acUZnLc.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
744	powershell.exe
744	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	744	powershell.exe
Token: SeLockMemoryPrivilege	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 744	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	84
PID 996 wrote to memory of 744	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	84
PID 996 wrote to memory of 4812	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	85
PID 996 wrote to memory of 4812	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	85
PID 996 wrote to memory of 4228	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	86
PID 996 wrote to memory of 4228	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	86
PID 996 wrote to memory of 4888	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	87
PID 996 wrote to memory of 4888	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	87
PID 996 wrote to memory of 4348	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	88
PID 996 wrote to memory of 4348	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	88
PID 996 wrote to memory of 4416	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	89
PID 996 wrote to memory of 4416	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	89
PID 996 wrote to memory of 2920	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	90
PID 996 wrote to memory of 2920	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	90
PID 996 wrote to memory of 2628	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	91
PID 996 wrote to memory of 2628	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	91
PID 996 wrote to memory of 4500	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	92
PID 996 wrote to memory of 4500	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	92
PID 996 wrote to memory of 1512	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	93
PID 996 wrote to memory of 1512	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	93
PID 996 wrote to memory of 1060	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	94
PID 996 wrote to memory of 1060	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	94
PID 996 wrote to memory of 1700	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	95
PID 996 wrote to memory of 1700	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	95
PID 996 wrote to memory of 4788	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	96
PID 996 wrote to memory of 4788	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	96
PID 996 wrote to memory of 5088	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	97
PID 996 wrote to memory of 5088	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	97
PID 996 wrote to memory of 4168	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	98
PID 996 wrote to memory of 4168	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	98
PID 996 wrote to memory of 2800	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	99
PID 996 wrote to memory of 2800	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	99
PID 996 wrote to memory of 2484	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	100
PID 996 wrote to memory of 2484	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	100
PID 996 wrote to memory of 4016	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	101
PID 996 wrote to memory of 4016	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	101
PID 996 wrote to memory of 1428	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	102
PID 996 wrote to memory of 1428	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	102
PID 996 wrote to memory of 1736	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	103
PID 996 wrote to memory of 1736	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	103
PID 996 wrote to memory of 1856	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	104
PID 996 wrote to memory of 1856	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	104
PID 996 wrote to memory of 3192	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	105
PID 996 wrote to memory of 3192	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	105
PID 996 wrote to memory of 4232	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	106
PID 996 wrote to memory of 4232	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	106
PID 996 wrote to memory of 4852	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	107
PID 996 wrote to memory of 4852	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	107
PID 996 wrote to memory of 4732	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	108
PID 996 wrote to memory of 4732	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	108
PID 996 wrote to memory of 2428	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	109
PID 996 wrote to memory of 2428	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	109
PID 996 wrote to memory of 548	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	110
PID 996 wrote to memory of 548	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	110
PID 996 wrote to memory of 312	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	111
PID 996 wrote to memory of 312	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	111
PID 996 wrote to memory of 1936	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	112
PID 996 wrote to memory of 1936	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	112
PID 996 wrote to memory of 636	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	113
PID 996 wrote to memory of 636	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	113
PID 996 wrote to memory of 3184	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	114
PID 996 wrote to memory of 3184	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	114
PID 996 wrote to memory of 4536	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	115
PID 996 wrote to memory of 4536	996	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:744
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "744" "2940" "2884" "2944" "0" "0" "2948" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4052
- C:\Windows\System\NEaYOsI.exe
  C:\Windows\System\NEaYOsI.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\krrFAZe.exe
  C:\Windows\System\krrFAZe.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\vGTjKCp.exe
  C:\Windows\System\vGTjKCp.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\IDTpCay.exe
  C:\Windows\System\IDTpCay.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\VacuZAZ.exe
  C:\Windows\System\VacuZAZ.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\YPbHxJH.exe
  C:\Windows\System\YPbHxJH.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\LWDmKEP.exe
  C:\Windows\System\LWDmKEP.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\YZtbxKW.exe
  C:\Windows\System\YZtbxKW.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\JInxgPb.exe
  C:\Windows\System\JInxgPb.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\YLEENsM.exe
  C:\Windows\System\YLEENsM.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\AmZfiVr.exe
  C:\Windows\System\AmZfiVr.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\bxGwceo.exe
  C:\Windows\System\bxGwceo.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\CcFzciI.exe
  C:\Windows\System\CcFzciI.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\jjGIpKX.exe
  C:\Windows\System\jjGIpKX.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\BlhRcQx.exe
  C:\Windows\System\BlhRcQx.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\JDeWYyl.exe
  C:\Windows\System\JDeWYyl.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\AoHUSQL.exe
  C:\Windows\System\AoHUSQL.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\hSBVtwK.exe
  C:\Windows\System\hSBVtwK.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\rZVRQdz.exe
  C:\Windows\System\rZVRQdz.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\Nadjonz.exe
  C:\Windows\System\Nadjonz.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\jMWQfEF.exe
  C:\Windows\System\jMWQfEF.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\FHMouYj.exe
  C:\Windows\System\FHMouYj.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\MMeIuji.exe
  C:\Windows\System\MMeIuji.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\oJmYYME.exe
  C:\Windows\System\oJmYYME.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\iqVNnDP.exe
  C:\Windows\System\iqVNnDP.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\AiOVaur.exe
  C:\Windows\System\AiOVaur.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\uOnZJCR.exe
  C:\Windows\System\uOnZJCR.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\qElXzdA.exe
  C:\Windows\System\qElXzdA.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\gYhONtC.exe
  C:\Windows\System\gYhONtC.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\bslHoUK.exe
  C:\Windows\System\bslHoUK.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\eoAAhJl.exe
  C:\Windows\System\eoAAhJl.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\awTGEnq.exe
  C:\Windows\System\awTGEnq.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\TVGIWcQ.exe
  C:\Windows\System\TVGIWcQ.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\fgjsnId.exe
  C:\Windows\System\fgjsnId.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\fLgufuY.exe
  C:\Windows\System\fLgufuY.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\WUTUyaf.exe
  C:\Windows\System\WUTUyaf.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\PxQIbCo.exe
  C:\Windows\System\PxQIbCo.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\rHStdJj.exe
  C:\Windows\System\rHStdJj.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\fFZyYay.exe
  C:\Windows\System\fFZyYay.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\fxnOAwY.exe
  C:\Windows\System\fxnOAwY.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\ierhQYg.exe
  C:\Windows\System\ierhQYg.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\rAChPSS.exe
  C:\Windows\System\rAChPSS.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\uKIcsHX.exe
  C:\Windows\System\uKIcsHX.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\lQKgoir.exe
  C:\Windows\System\lQKgoir.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\yFnZjwe.exe
  C:\Windows\System\yFnZjwe.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\DTSaSLi.exe
  C:\Windows\System\DTSaSLi.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\aqlHENh.exe
  C:\Windows\System\aqlHENh.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\LEzYpIm.exe
  C:\Windows\System\LEzYpIm.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\eMxkxkF.exe
  C:\Windows\System\eMxkxkF.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\QeiLwYu.exe
  C:\Windows\System\QeiLwYu.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\bGVVYrc.exe
  C:\Windows\System\bGVVYrc.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\EWHcfsu.exe
  C:\Windows\System\EWHcfsu.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\GSIBLGv.exe
  C:\Windows\System\GSIBLGv.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\GCcfokM.exe
  C:\Windows\System\GCcfokM.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\TazoWly.exe
  C:\Windows\System\TazoWly.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\uFJrZUU.exe
  C:\Windows\System\uFJrZUU.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\TEiMHSG.exe
  C:\Windows\System\TEiMHSG.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\XRKIOYn.exe
  C:\Windows\System\XRKIOYn.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\aAQcMcn.exe
  C:\Windows\System\aAQcMcn.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\JlLKPCV.exe
  C:\Windows\System\JlLKPCV.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\LZsIsIS.exe
  C:\Windows\System\LZsIsIS.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\eTVGvVx.exe
  C:\Windows\System\eTVGvVx.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\YzRboaP.exe
  C:\Windows\System\YzRboaP.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\cgeQYpn.exe
  C:\Windows\System\cgeQYpn.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\fMOJSlI.exe
  C:\Windows\System\fMOJSlI.exe
  2⤵
  PID:3720
- C:\Windows\System\qgjbZuY.exe
  C:\Windows\System\qgjbZuY.exe
  2⤵
  PID:2032
- C:\Windows\System\dkxtgpS.exe
  C:\Windows\System\dkxtgpS.exe
  2⤵
  PID:4388
- C:\Windows\System\CyfFDLl.exe
  C:\Windows\System\CyfFDLl.exe
  2⤵
  PID:3212
- C:\Windows\System\fvCNjqT.exe
  C:\Windows\System\fvCNjqT.exe
  2⤵
  PID:4716
- C:\Windows\System\JqMlruq.exe
  C:\Windows\System\JqMlruq.exe
  2⤵
  PID:4572
- C:\Windows\System\VspGfgB.exe
  C:\Windows\System\VspGfgB.exe
  2⤵
  PID:1644
- C:\Windows\System\nkqodQp.exe
  C:\Windows\System\nkqodQp.exe
  2⤵
  PID:4620
- C:\Windows\System\BSsfwev.exe
  C:\Windows\System\BSsfwev.exe
  2⤵
  PID:3152
- C:\Windows\System\zSgCxYo.exe
  C:\Windows\System\zSgCxYo.exe
  2⤵
  PID:2752
- C:\Windows\System\hNeVorX.exe
  C:\Windows\System\hNeVorX.exe
  2⤵
  PID:2080
- C:\Windows\System\IsBVHph.exe
  C:\Windows\System\IsBVHph.exe
  2⤵
  PID:3264
- C:\Windows\System\teEBBZM.exe
  C:\Windows\System\teEBBZM.exe
  2⤵
  PID:5040
- C:\Windows\System\mKGOrBq.exe
  C:\Windows\System\mKGOrBq.exe
  2⤵
  PID:3244
- C:\Windows\System\TjnVoAL.exe
  C:\Windows\System\TjnVoAL.exe
  2⤵
  PID:216
- C:\Windows\System\gyYYfFk.exe
  C:\Windows\System\gyYYfFk.exe
  2⤵
  PID:3544
- C:\Windows\System\sfYsJmM.exe
  C:\Windows\System\sfYsJmM.exe
  2⤵
  PID:2488
- C:\Windows\System\rHdMmNy.exe
  C:\Windows\System\rHdMmNy.exe
  2⤵
  PID:1772
- C:\Windows\System\vuCKwpw.exe
  C:\Windows\System\vuCKwpw.exe
  2⤵
  PID:5144
- C:\Windows\System\vFPIHPA.exe
  C:\Windows\System\vFPIHPA.exe
  2⤵
  PID:5220
- C:\Windows\System\AWjQLQj.exe
  C:\Windows\System\AWjQLQj.exe
  2⤵
  PID:5244
- C:\Windows\System\GBhBHOH.exe
  C:\Windows\System\GBhBHOH.exe
  2⤵
  PID:5268
- C:\Windows\System\aCOENdH.exe
  C:\Windows\System\aCOENdH.exe
  2⤵
  PID:5288
- C:\Windows\System\WUkuhKA.exe
  C:\Windows\System\WUkuhKA.exe
  2⤵
  PID:5312
- C:\Windows\System\ajbbwYh.exe
  C:\Windows\System\ajbbwYh.exe
  2⤵
  PID:5332
- C:\Windows\System\kroJLTC.exe
  C:\Windows\System\kroJLTC.exe
  2⤵
  PID:5368
- C:\Windows\System\vLupwNz.exe
  C:\Windows\System\vLupwNz.exe
  2⤵
  PID:5412
- C:\Windows\System\njpAmlP.exe
  C:\Windows\System\njpAmlP.exe
  2⤵
  PID:5432
- C:\Windows\System\HEdBRgc.exe
  C:\Windows\System\HEdBRgc.exe
  2⤵
  PID:5460
- C:\Windows\System\GuvWPFL.exe
  C:\Windows\System\GuvWPFL.exe
  2⤵
  PID:5480
- C:\Windows\System\TQKHlmk.exe
  C:\Windows\System\TQKHlmk.exe
  2⤵
  PID:5504
- C:\Windows\System\wTgRCJK.exe
  C:\Windows\System\wTgRCJK.exe
  2⤵
  PID:5524
- C:\Windows\System\olVEHdf.exe
  C:\Windows\System\olVEHdf.exe
  2⤵
  PID:5548
- C:\Windows\System\LQaCKSc.exe
  C:\Windows\System\LQaCKSc.exe
  2⤵
  PID:5580
- C:\Windows\System\GgqUDXp.exe
  C:\Windows\System\GgqUDXp.exe
  2⤵
  PID:5608
- C:\Windows\System\TyOcAXq.exe
  C:\Windows\System\TyOcAXq.exe
  2⤵
  PID:5628
- C:\Windows\System\VxwtwfZ.exe
  C:\Windows\System\VxwtwfZ.exe
  2⤵
  PID:5664
- C:\Windows\System\VeFTheh.exe
  C:\Windows\System\VeFTheh.exe
  2⤵
  PID:5688
- C:\Windows\System\zIwThEf.exe
  C:\Windows\System\zIwThEf.exe
  2⤵
  PID:5720
- C:\Windows\System\DAgPjAc.exe
  C:\Windows\System\DAgPjAc.exe
  2⤵
  PID:5744
- C:\Windows\System\HYJAwNL.exe
  C:\Windows\System\HYJAwNL.exe
  2⤵
  PID:5772
- C:\Windows\System\apQBHSt.exe
  C:\Windows\System\apQBHSt.exe
  2⤵
  PID:5788
- C:\Windows\System\aHfYahm.exe
  C:\Windows\System\aHfYahm.exe
  2⤵
  PID:5812
- C:\Windows\System\MNZKPbK.exe
  C:\Windows\System\MNZKPbK.exe
  2⤵
  PID:5864
- C:\Windows\System\LMWkSNb.exe
  C:\Windows\System\LMWkSNb.exe
  2⤵
  PID:5880
- C:\Windows\System\QvzWPTj.exe
  C:\Windows\System\QvzWPTj.exe
  2⤵
  PID:5920
- C:\Windows\System\gjCyhqG.exe
  C:\Windows\System\gjCyhqG.exe
  2⤵
  PID:5936
- C:\Windows\System\RZmhUyY.exe
  C:\Windows\System\RZmhUyY.exe
  2⤵
  PID:5968
- C:\Windows\System\GywfaDJ.exe
  C:\Windows\System\GywfaDJ.exe
  2⤵
  PID:6016
- C:\Windows\System\DnerAWb.exe
  C:\Windows\System\DnerAWb.exe
  2⤵
  PID:6040
- C:\Windows\System\IfqaWxp.exe
  C:\Windows\System\IfqaWxp.exe
  2⤵
  PID:6064
- C:\Windows\System\PFoxHYD.exe
  C:\Windows\System\PFoxHYD.exe
  2⤵
  PID:6088
- C:\Windows\System\yCXbHFx.exe
  C:\Windows\System\yCXbHFx.exe
  2⤵
  PID:6108
- C:\Windows\System\ffkQzOn.exe
  C:\Windows\System\ffkQzOn.exe
  2⤵
  PID:4712
- C:\Windows\System\AFAeHlE.exe
  C:\Windows\System\AFAeHlE.exe
  2⤵
  PID:1108
- C:\Windows\System\ycmJkrd.exe
  C:\Windows\System\ycmJkrd.exe
  2⤵
  PID:5140
- C:\Windows\System\BTCfDer.exe
  C:\Windows\System\BTCfDer.exe
  2⤵
  PID:2564
- C:\Windows\System\OgGGzAw.exe
  C:\Windows\System\OgGGzAw.exe
  2⤵
  PID:4880
- C:\Windows\System\zXNLEKY.exe
  C:\Windows\System\zXNLEKY.exe
  2⤵
  PID:1944
- C:\Windows\System\tNHYllC.exe
  C:\Windows\System\tNHYllC.exe
  2⤵
  PID:1440
- C:\Windows\System\XkwALQB.exe
  C:\Windows\System\XkwALQB.exe
  2⤵
  PID:5232
- C:\Windows\System\bCDmcLk.exe
  C:\Windows\System\bCDmcLk.exe
  2⤵
  PID:5260
- C:\Windows\System\FqugFbp.exe
  C:\Windows\System\FqugFbp.exe
  2⤵
  PID:5328
- C:\Windows\System\BZmBaOm.exe
  C:\Windows\System\BZmBaOm.exe
  2⤵
  PID:5396
- C:\Windows\System\ovzRUKb.exe
  C:\Windows\System\ovzRUKb.exe
  2⤵
  PID:4724
- C:\Windows\System\nZquqtp.exe
  C:\Windows\System\nZquqtp.exe
  2⤵
  PID:832
- C:\Windows\System\WZvQWbR.exe
  C:\Windows\System\WZvQWbR.exe
  2⤵
  PID:3696
- C:\Windows\System\cwQlLED.exe
  C:\Windows\System\cwQlLED.exe
  2⤵
  PID:5544
- C:\Windows\System\MhcdAlD.exe
  C:\Windows\System\MhcdAlD.exe
  2⤵
  PID:5620
- C:\Windows\System\jXqDMTp.exe
  C:\Windows\System\jXqDMTp.exe
  2⤵
  PID:5592
- C:\Windows\System\PZyiosb.exe
  C:\Windows\System\PZyiosb.exe
  2⤵
  PID:5680
- C:\Windows\System\kHPVSAd.exe
  C:\Windows\System\kHPVSAd.exe
  2⤵
  PID:5712
- C:\Windows\System\hWPEvuL.exe
  C:\Windows\System\hWPEvuL.exe
  2⤵
  PID:5780
- C:\Windows\System\YmldZza.exe
  C:\Windows\System\YmldZza.exe
  2⤵
  PID:5892
- C:\Windows\System\wsGTjPU.exe
  C:\Windows\System\wsGTjPU.exe
  2⤵
  PID:5964
- C:\Windows\System\emUlUMq.exe
  C:\Windows\System\emUlUMq.exe
  2⤵
  PID:6000
- C:\Windows\System\zFfIODq.exe
  C:\Windows\System\zFfIODq.exe
  2⤵
  PID:6052
- C:\Windows\System\pbIATfN.exe
  C:\Windows\System\pbIATfN.exe
  2⤵
  PID:6080
- C:\Windows\System\STqPTdk.exe
  C:\Windows\System\STqPTdk.exe
  2⤵
  PID:6140
- C:\Windows\System\mVGfmPK.exe
  C:\Windows\System\mVGfmPK.exe
  2⤵
  PID:4748
- C:\Windows\System\hdlWYVf.exe
  C:\Windows\System\hdlWYVf.exe
  2⤵
  PID:944
- C:\Windows\System\AxtIXzz.exe
  C:\Windows\System\AxtIXzz.exe
  2⤵
  PID:4444
- C:\Windows\System\GmfMpEa.exe
  C:\Windows\System\GmfMpEa.exe
  2⤵
  PID:1484
- C:\Windows\System\fbbcMHZ.exe
  C:\Windows\System\fbbcMHZ.exe
  2⤵
  PID:5532
- C:\Windows\System\MDhkQes.exe
  C:\Windows\System\MDhkQes.exe
  2⤵
  PID:5576
- C:\Windows\System\joYeIIi.exe
  C:\Windows\System\joYeIIi.exe
  2⤵
  PID:5760
- C:\Windows\System\RiDzFrv.exe
  C:\Windows\System\RiDzFrv.exe
  2⤵
  PID:5852
- C:\Windows\System\zglpSCW.exe
  C:\Windows\System\zglpSCW.exe
  2⤵
  PID:6024
- C:\Windows\System\qzjwwyj.exe
  C:\Windows\System\qzjwwyj.exe
  2⤵
  PID:6128
- C:\Windows\System\KcOHRji.exe
  C:\Windows\System\KcOHRji.exe
  2⤵
  PID:5160
- C:\Windows\System\DZlCoCj.exe
  C:\Windows\System\DZlCoCj.exe
  2⤵
  PID:5456
- C:\Windows\System\BtGDUma.exe
  C:\Windows\System\BtGDUma.exe
  2⤵
  PID:5660
- C:\Windows\System\AnxlmBz.exe
  C:\Windows\System\AnxlmBz.exe
  2⤵
  PID:5796
- C:\Windows\System\mDmroFn.exe
  C:\Windows\System\mDmroFn.exe
  2⤵
  PID:6076
- C:\Windows\System\RGBwTwW.exe
  C:\Windows\System\RGBwTwW.exe
  2⤵
  PID:5252
- C:\Windows\System\gaWlAVM.exe
  C:\Windows\System\gaWlAVM.exe
  2⤵
  PID:5656
- C:\Windows\System\ffBcjvm.exe
  C:\Windows\System\ffBcjvm.exe
  2⤵
  PID:6152
- C:\Windows\System\xhxxeSJ.exe
  C:\Windows\System\xhxxeSJ.exe
  2⤵
  PID:6188
- C:\Windows\System\kioHcBx.exe
  C:\Windows\System\kioHcBx.exe
  2⤵
  PID:6244
- C:\Windows\System\WDiTUFT.exe
  C:\Windows\System\WDiTUFT.exe
  2⤵
  PID:6272
- C:\Windows\System\RgnoCtc.exe
  C:\Windows\System\RgnoCtc.exe
  2⤵
  PID:6292
- C:\Windows\System\HeeIjvE.exe
  C:\Windows\System\HeeIjvE.exe
  2⤵
  PID:6332
- C:\Windows\System\IGlIoHr.exe
  C:\Windows\System\IGlIoHr.exe
  2⤵
  PID:6356
- C:\Windows\System\aPIJLdZ.exe
  C:\Windows\System\aPIJLdZ.exe
  2⤵
  PID:6380
- C:\Windows\System\iWQzavF.exe
  C:\Windows\System\iWQzavF.exe
  2⤵
  PID:6412
- C:\Windows\System\qzCfYsx.exe
  C:\Windows\System\qzCfYsx.exe
  2⤵
  PID:6432
- C:\Windows\System\EkZpRoC.exe
  C:\Windows\System\EkZpRoC.exe
  2⤵
  PID:6472
- C:\Windows\System\NQysjcI.exe
  C:\Windows\System\NQysjcI.exe
  2⤵
  PID:6492
- C:\Windows\System\qyRolzt.exe
  C:\Windows\System\qyRolzt.exe
  2⤵
  PID:6524
- C:\Windows\System\qJKVPMM.exe
  C:\Windows\System\qJKVPMM.exe
  2⤵
  PID:6548
- C:\Windows\System\ceIEVSo.exe
  C:\Windows\System\ceIEVSo.exe
  2⤵
  PID:6572
- C:\Windows\System\mqynsHg.exe
  C:\Windows\System\mqynsHg.exe
  2⤵
  PID:6588
- C:\Windows\System\AHtlStU.exe
  C:\Windows\System\AHtlStU.exe
  2⤵
  PID:6612
- C:\Windows\System\dFtnEZm.exe
  C:\Windows\System\dFtnEZm.exe
  2⤵
  PID:6644
- C:\Windows\System\srjRpEo.exe
  C:\Windows\System\srjRpEo.exe
  2⤵
  PID:6672
- C:\Windows\System\TivIJYI.exe
  C:\Windows\System\TivIJYI.exe
  2⤵
  PID:6700
- C:\Windows\System\NGLDwmY.exe
  C:\Windows\System\NGLDwmY.exe
  2⤵
  PID:6724
- C:\Windows\System\keVgdAu.exe
  C:\Windows\System\keVgdAu.exe
  2⤵
  PID:6740
- C:\Windows\System\VKbXTJm.exe
  C:\Windows\System\VKbXTJm.exe
  2⤵
  PID:6776
- C:\Windows\System\EgwgbIf.exe
  C:\Windows\System\EgwgbIf.exe
  2⤵
  PID:6800
- C:\Windows\System\MnaiGJm.exe
  C:\Windows\System\MnaiGJm.exe
  2⤵
  PID:6820
- C:\Windows\System\EHOSdSH.exe
  C:\Windows\System\EHOSdSH.exe
  2⤵
  PID:6836
- C:\Windows\System\aPRCwNX.exe
  C:\Windows\System\aPRCwNX.exe
  2⤵
  PID:6872
- C:\Windows\System\dbZVHgK.exe
  C:\Windows\System\dbZVHgK.exe
  2⤵
  PID:6896
- C:\Windows\System\ygAdjCx.exe
  C:\Windows\System\ygAdjCx.exe
  2⤵
  PID:6928
- C:\Windows\System\NMkhZey.exe
  C:\Windows\System\NMkhZey.exe
  2⤵
  PID:6952
- C:\Windows\System\wYMJINb.exe
  C:\Windows\System\wYMJINb.exe
  2⤵
  PID:6968
- C:\Windows\System\cihzVJi.exe
  C:\Windows\System\cihzVJi.exe
  2⤵
  PID:6992
- C:\Windows\System\XNaQhnZ.exe
  C:\Windows\System\XNaQhnZ.exe
  2⤵
  PID:7028
- C:\Windows\System\yCgBUyu.exe
  C:\Windows\System\yCgBUyu.exe
  2⤵
  PID:7092
- C:\Windows\System\erpfpmx.exe
  C:\Windows\System\erpfpmx.exe
  2⤵
  PID:7116
- C:\Windows\System\WLzfRVU.exe
  C:\Windows\System\WLzfRVU.exe
  2⤵
  PID:7148
- C:\Windows\System\gvNeyrY.exe
  C:\Windows\System\gvNeyrY.exe
  2⤵
  PID:6148
- C:\Windows\System\emZDAMX.exe
  C:\Windows\System\emZDAMX.exe
  2⤵
  PID:6184
- C:\Windows\System\WAsACYx.exe
  C:\Windows\System\WAsACYx.exe
  2⤵
  PID:6288
- C:\Windows\System\FKTIMPz.exe
  C:\Windows\System\FKTIMPz.exe
  2⤵
  PID:6348
- C:\Windows\System\uwnsdhD.exe
  C:\Windows\System\uwnsdhD.exe
  2⤵
  PID:6404
- C:\Windows\System\IZsGGIF.exe
  C:\Windows\System\IZsGGIF.exe
  2⤵
  PID:6468
- C:\Windows\System\eAfrmSM.exe
  C:\Windows\System\eAfrmSM.exe
  2⤵
  PID:6536
- C:\Windows\System\gKSYwPi.exe
  C:\Windows\System\gKSYwPi.exe
  2⤵
  PID:6584
- C:\Windows\System\obaYLXd.exe
  C:\Windows\System\obaYLXd.exe
  2⤵
  PID:6680
- C:\Windows\System\pSANuVD.exe
  C:\Windows\System\pSANuVD.exe
  2⤵
  PID:6664
- C:\Windows\System\JVjVAJd.exe
  C:\Windows\System\JVjVAJd.exe
  2⤵
  PID:6736
- C:\Windows\System\aUngmux.exe
  C:\Windows\System\aUngmux.exe
  2⤵
  PID:6856
- C:\Windows\System\blpgQLP.exe
  C:\Windows\System\blpgQLP.exe
  2⤵
  PID:6864
- C:\Windows\System\fjQRhUm.exe
  C:\Windows\System\fjQRhUm.exe
  2⤵
  PID:6936
- C:\Windows\System\nPonKVN.exe
  C:\Windows\System\nPonKVN.exe
  2⤵
  PID:7048
- C:\Windows\System\LbEAUfl.exe
  C:\Windows\System\LbEAUfl.exe
  2⤵
  PID:7132
- C:\Windows\System\CFqiNiS.exe
  C:\Windows\System\CFqiNiS.exe
  2⤵
  PID:6176
- C:\Windows\System\lSYJXah.exe
  C:\Windows\System\lSYJXah.exe
  2⤵
  PID:6312
- C:\Windows\System\IBfCRdH.exe
  C:\Windows\System\IBfCRdH.exe
  2⤵
  PID:6464
- C:\Windows\System\zFCMkAh.exe
  C:\Windows\System\zFCMkAh.exe
  2⤵
  PID:6488
- C:\Windows\System\DcUkSIN.exe
  C:\Windows\System\DcUkSIN.exe
  2⤵
  PID:6636
- C:\Windows\System\DdIFDMT.exe
  C:\Windows\System\DdIFDMT.exe
  2⤵
  PID:6880
- C:\Windows\System\ZqroExF.exe
  C:\Windows\System\ZqroExF.exe
  2⤵
  PID:6892
- C:\Windows\System\EspmRHc.exe
  C:\Windows\System\EspmRHc.exe
  2⤵
  PID:7080
- C:\Windows\System\FjprcEg.exe
  C:\Windows\System\FjprcEg.exe
  2⤵
  PID:6280
- C:\Windows\System\WmfEINP.exe
  C:\Windows\System\WmfEINP.exe
  2⤵
  PID:6796
- C:\Windows\System\ALLosJw.exe
  C:\Windows\System\ALLosJw.exe
  2⤵
  PID:7144
- C:\Windows\System\HBrlfDM.exe
  C:\Windows\System\HBrlfDM.exe
  2⤵
  PID:5324
- C:\Windows\System\NnDqSIE.exe
  C:\Windows\System\NnDqSIE.exe
  2⤵
  PID:7172
- C:\Windows\System\SejeOAU.exe
  C:\Windows\System\SejeOAU.exe
  2⤵
  PID:7200
- C:\Windows\System\Zslktha.exe
  C:\Windows\System\Zslktha.exe
  2⤵
  PID:7244
- C:\Windows\System\BRcpMKB.exe
  C:\Windows\System\BRcpMKB.exe
  2⤵
  PID:7268
- C:\Windows\System\wAWoFqA.exe
  C:\Windows\System\wAWoFqA.exe
  2⤵
  PID:7292
- C:\Windows\System\SUoUjkp.exe
  C:\Windows\System\SUoUjkp.exe
  2⤵
  PID:7312
- C:\Windows\System\GqcJyhu.exe
  C:\Windows\System\GqcJyhu.exe
  2⤵
  PID:7328
- C:\Windows\System\IigQfVo.exe
  C:\Windows\System\IigQfVo.exe
  2⤵
  PID:7360
- C:\Windows\System\pNBBTVm.exe
  C:\Windows\System\pNBBTVm.exe
  2⤵
  PID:7380
- C:\Windows\System\Cksiljf.exe
  C:\Windows\System\Cksiljf.exe
  2⤵
  PID:7420
- C:\Windows\System\ZqbMptU.exe
  C:\Windows\System\ZqbMptU.exe
  2⤵
  PID:7436
- C:\Windows\System\hBgtvRq.exe
  C:\Windows\System\hBgtvRq.exe
  2⤵
  PID:7472
- C:\Windows\System\gpTBVgu.exe
  C:\Windows\System\gpTBVgu.exe
  2⤵
  PID:7492
- C:\Windows\System\wymkBgk.exe
  C:\Windows\System\wymkBgk.exe
  2⤵
  PID:7512
- C:\Windows\System\rzTxMfA.exe
  C:\Windows\System\rzTxMfA.exe
  2⤵
  PID:7540
- C:\Windows\System\ybwCQVG.exe
  C:\Windows\System\ybwCQVG.exe
  2⤵
  PID:7560
- C:\Windows\System\qSPXkrI.exe
  C:\Windows\System\qSPXkrI.exe
  2⤵
  PID:7580
- C:\Windows\System\SnFVUvi.exe
  C:\Windows\System\SnFVUvi.exe
  2⤵
  PID:7636
- C:\Windows\System\rQXwQmF.exe
  C:\Windows\System\rQXwQmF.exe
  2⤵
  PID:7660
- C:\Windows\System\jNDzHJE.exe
  C:\Windows\System\jNDzHJE.exe
  2⤵
  PID:7676
- C:\Windows\System\LGJLmpp.exe
  C:\Windows\System\LGJLmpp.exe
  2⤵
  PID:7704
- C:\Windows\System\CekLKuB.exe
  C:\Windows\System\CekLKuB.exe
  2⤵
  PID:7756
- C:\Windows\System\TirrSCI.exe
  C:\Windows\System\TirrSCI.exe
  2⤵
  PID:7776
- C:\Windows\System\dNxhoTD.exe
  C:\Windows\System\dNxhoTD.exe
  2⤵
  PID:7828
- C:\Windows\System\bCUXwZm.exe
  C:\Windows\System\bCUXwZm.exe
  2⤵
  PID:7848
- C:\Windows\System\sGtDzTj.exe
  C:\Windows\System\sGtDzTj.exe
  2⤵
  PID:7884
- C:\Windows\System\kKtXNrc.exe
  C:\Windows\System\kKtXNrc.exe
  2⤵
  PID:7916
- C:\Windows\System\qMNqLAa.exe
  C:\Windows\System\qMNqLAa.exe
  2⤵
  PID:7940
- C:\Windows\System\UMvjreG.exe
  C:\Windows\System\UMvjreG.exe
  2⤵
  PID:7956
- C:\Windows\System\wURzcss.exe
  C:\Windows\System\wURzcss.exe
  2⤵
  PID:7988
- C:\Windows\System\jvkFbeR.exe
  C:\Windows\System\jvkFbeR.exe
  2⤵
  PID:8024
- C:\Windows\System\bffHwiA.exe
  C:\Windows\System\bffHwiA.exe
  2⤵
  PID:8048
- C:\Windows\System\iQHypZn.exe
  C:\Windows\System\iQHypZn.exe
  2⤵
  PID:8068
- C:\Windows\System\ornefRq.exe
  C:\Windows\System\ornefRq.exe
  2⤵
  PID:8112
- C:\Windows\System\MQOodYb.exe
  C:\Windows\System\MQOodYb.exe
  2⤵
  PID:8136
- C:\Windows\System\SVwptPZ.exe
  C:\Windows\System\SVwptPZ.exe
  2⤵
  PID:8160
- C:\Windows\System\eZdVNLA.exe
  C:\Windows\System\eZdVNLA.exe
  2⤵
  PID:6376
- C:\Windows\System\dEDrupw.exe
  C:\Windows\System\dEDrupw.exe
  2⤵
  PID:7196
- C:\Windows\System\WlfCgJX.exe
  C:\Windows\System\WlfCgJX.exe
  2⤵
  PID:7288
- C:\Windows\System\DVDvuPD.exe
  C:\Windows\System\DVDvuPD.exe
  2⤵
  PID:7348
- C:\Windows\System\XIQktNu.exe
  C:\Windows\System\XIQktNu.exe
  2⤵
  PID:7408
- C:\Windows\System\XMELgDa.exe
  C:\Windows\System\XMELgDa.exe
  2⤵
  PID:7464
- C:\Windows\System\WXTASqc.exe
  C:\Windows\System\WXTASqc.exe
  2⤵
  PID:7588
- C:\Windows\System\QUJqHGO.exe
  C:\Windows\System\QUJqHGO.exe
  2⤵
  PID:7768
- C:\Windows\System\jKtpCIj.exe
  C:\Windows\System\jKtpCIj.exe
  2⤵
  PID:7844
- C:\Windows\System\OgllwQd.exe
  C:\Windows\System\OgllwQd.exe
  2⤵
  PID:7876
- C:\Windows\System\eFdeAiy.exe
  C:\Windows\System\eFdeAiy.exe
  2⤵
  PID:7948
- C:\Windows\System\RPnZbUJ.exe
  C:\Windows\System\RPnZbUJ.exe
  2⤵
  PID:8000
- C:\Windows\System\FiutcJG.exe
  C:\Windows\System\FiutcJG.exe
  2⤵
  PID:8104
- C:\Windows\System\hdvXMzn.exe
  C:\Windows\System\hdvXMzn.exe
  2⤵
  PID:8128
- C:\Windows\System\zMIoEkT.exe
  C:\Windows\System\zMIoEkT.exe
  2⤵
  PID:6560
- C:\Windows\System\XibCmIF.exe
  C:\Windows\System\XibCmIF.exe
  2⤵
  PID:3276
- C:\Windows\System\jPWdLch.exe
  C:\Windows\System\jPWdLch.exe
  2⤵
  PID:7264
- C:\Windows\System\USlMJMz.exe
  C:\Windows\System\USlMJMz.exe
  2⤵
  PID:7304
- C:\Windows\System\MlQzLbi.exe
  C:\Windows\System\MlQzLbi.exe
  2⤵
  PID:7324
- C:\Windows\System\iVvxyAm.exe
  C:\Windows\System\iVvxyAm.exe
  2⤵
  PID:7468
- C:\Windows\System\QgXnzNK.exe
  C:\Windows\System\QgXnzNK.exe
  2⤵
  PID:7740
- C:\Windows\System\GGBBRfj.exe
  C:\Windows\System\GGBBRfj.exe
  2⤵
  PID:7796
- C:\Windows\System\aoNnNyM.exe
  C:\Windows\System\aoNnNyM.exe
  2⤵
  PID:8020
- C:\Windows\System\XWFoNdm.exe
  C:\Windows\System\XWFoNdm.exe
  2⤵
  PID:7184
- C:\Windows\System\wbMWiVT.exe
  C:\Windows\System\wbMWiVT.exe
  2⤵
  PID:7276
- C:\Windows\System\zrmPGyr.exe
  C:\Windows\System\zrmPGyr.exe
  2⤵
  PID:7576
- C:\Windows\System\LVqkYfe.exe
  C:\Windows\System\LVqkYfe.exe
  2⤵
  PID:8084
- C:\Windows\System\MQLfbfN.exe
  C:\Windows\System\MQLfbfN.exe
  2⤵
  PID:7240
- C:\Windows\System\BqPkDKe.exe
  C:\Windows\System\BqPkDKe.exe
  2⤵
  PID:8200
- C:\Windows\System\hnhnrJc.exe
  C:\Windows\System\hnhnrJc.exe
  2⤵
  PID:8224
- C:\Windows\System\ZlOZTQB.exe
  C:\Windows\System\ZlOZTQB.exe
  2⤵
  PID:8244
- C:\Windows\System\UeveuIG.exe
  C:\Windows\System\UeveuIG.exe
  2⤵
  PID:8268
- C:\Windows\System\mgctUZG.exe
  C:\Windows\System\mgctUZG.exe
  2⤵
  PID:8288
- C:\Windows\System\ypkMveT.exe
  C:\Windows\System\ypkMveT.exe
  2⤵
  PID:8364
- C:\Windows\System\wolcfTe.exe
  C:\Windows\System\wolcfTe.exe
  2⤵
  PID:8384
- C:\Windows\System\MKQtjmQ.exe
  C:\Windows\System\MKQtjmQ.exe
  2⤵
  PID:8408
- C:\Windows\System\pusCrKP.exe
  C:\Windows\System\pusCrKP.exe
  2⤵
  PID:8436
- C:\Windows\System\MBVVfRL.exe
  C:\Windows\System\MBVVfRL.exe
  2⤵
  PID:8452
- C:\Windows\System\VTFPJRc.exe
  C:\Windows\System\VTFPJRc.exe
  2⤵
  PID:8476
- C:\Windows\System\bUkkhuE.exe
  C:\Windows\System\bUkkhuE.exe
  2⤵
  PID:8496
- C:\Windows\System\lHCzVXg.exe
  C:\Windows\System\lHCzVXg.exe
  2⤵
  PID:8512
- C:\Windows\System\bgUFWdH.exe
  C:\Windows\System\bgUFWdH.exe
  2⤵
  PID:8536
- C:\Windows\System\wCtqBvB.exe
  C:\Windows\System\wCtqBvB.exe
  2⤵
  PID:8560
- C:\Windows\System\UEfipuS.exe
  C:\Windows\System\UEfipuS.exe
  2⤵
  PID:8576
- C:\Windows\System\IXzIcWC.exe
  C:\Windows\System\IXzIcWC.exe
  2⤵
  PID:8600
- C:\Windows\System\hKsnNTL.exe
  C:\Windows\System\hKsnNTL.exe
  2⤵
  PID:8664
- C:\Windows\System\AFLpJbf.exe
  C:\Windows\System\AFLpJbf.exe
  2⤵
  PID:8708
- C:\Windows\System\viZJSpA.exe
  C:\Windows\System\viZJSpA.exe
  2⤵
  PID:8744
- C:\Windows\System\nuAkQXP.exe
  C:\Windows\System\nuAkQXP.exe
  2⤵
  PID:8768
- C:\Windows\System\txUtFoL.exe
  C:\Windows\System\txUtFoL.exe
  2⤵
  PID:8812
- C:\Windows\System\VrlKnuN.exe
  C:\Windows\System\VrlKnuN.exe
  2⤵
  PID:8840
- C:\Windows\System\NJRWMQN.exe
  C:\Windows\System\NJRWMQN.exe
  2⤵
  PID:8860
- C:\Windows\System\LfEMUFB.exe
  C:\Windows\System\LfEMUFB.exe
  2⤵
  PID:8888
- C:\Windows\System\qGQuyZJ.exe
  C:\Windows\System\qGQuyZJ.exe
  2⤵
  PID:8928
- C:\Windows\System\MexsSkC.exe
  C:\Windows\System\MexsSkC.exe
  2⤵
  PID:8944
- C:\Windows\System\MfSOyjq.exe
  C:\Windows\System\MfSOyjq.exe
  2⤵
  PID:8968
- C:\Windows\System\cLOzPBK.exe
  C:\Windows\System\cLOzPBK.exe
  2⤵
  PID:8988
- C:\Windows\System\PuVwxzl.exe
  C:\Windows\System\PuVwxzl.exe
  2⤵
  PID:9024
- C:\Windows\System\eNeRwUW.exe
  C:\Windows\System\eNeRwUW.exe
  2⤵
  PID:9044
- C:\Windows\System\LoOHsCk.exe
  C:\Windows\System\LoOHsCk.exe
  2⤵
  PID:9080
- C:\Windows\System\ixhMbaJ.exe
  C:\Windows\System\ixhMbaJ.exe
  2⤵
  PID:9120
- C:\Windows\System\BEEsazf.exe
  C:\Windows\System\BEEsazf.exe
  2⤵
  PID:9144
- C:\Windows\System\RCPClzz.exe
  C:\Windows\System\RCPClzz.exe
  2⤵
  PID:9168
- C:\Windows\System\hZSGRkK.exe
  C:\Windows\System\hZSGRkK.exe
  2⤵
  PID:9196
- C:\Windows\System\DHqhFYA.exe
  C:\Windows\System\DHqhFYA.exe
  2⤵
  PID:9212
- C:\Windows\System\NfVmHPR.exe
  C:\Windows\System\NfVmHPR.exe
  2⤵
  PID:8284
- C:\Windows\System\LooDkNs.exe
  C:\Windows\System\LooDkNs.exe
  2⤵
  PID:8240
- C:\Windows\System\RsTEtCw.exe
  C:\Windows\System\RsTEtCw.exe
  2⤵
  PID:8312
- C:\Windows\System\pTYCwdN.exe
  C:\Windows\System\pTYCwdN.exe
  2⤵
  PID:8392
- C:\Windows\System\EEPxCMF.exe
  C:\Windows\System\EEPxCMF.exe
  2⤵
  PID:1488
- C:\Windows\System\BfKGutP.exe
  C:\Windows\System\BfKGutP.exe
  2⤵
  PID:8520
- C:\Windows\System\vhKvVOx.exe
  C:\Windows\System\vhKvVOx.exe
  2⤵
  PID:8556
- C:\Windows\System\VdfwNQl.exe
  C:\Windows\System\VdfwNQl.exe
  2⤵
  PID:8628
- C:\Windows\System\jnoMYjK.exe
  C:\Windows\System\jnoMYjK.exe
  2⤵
  PID:8752
- C:\Windows\System\WzeGnrC.exe
  C:\Windows\System\WzeGnrC.exe
  2⤵
  PID:8784
- C:\Windows\System\OarUcAf.exe
  C:\Windows\System\OarUcAf.exe
  2⤵
  PID:8836
- C:\Windows\System\QShquMZ.exe
  C:\Windows\System\QShquMZ.exe
  2⤵
  PID:8900
- C:\Windows\System\dYeuAga.exe
  C:\Windows\System\dYeuAga.exe
  2⤵
  PID:9036
- C:\Windows\System\htgZOdK.exe
  C:\Windows\System\htgZOdK.exe
  2⤵
  PID:9112
- C:\Windows\System\ACYsDhd.exe
  C:\Windows\System\ACYsDhd.exe
  2⤵
  PID:9176
- C:\Windows\System\WNqValP.exe
  C:\Windows\System\WNqValP.exe
  2⤵
  PID:9208
- C:\Windows\System\PIBOljp.exe
  C:\Windows\System\PIBOljp.exe
  2⤵
  PID:8460
- C:\Windows\System\lgiYHmh.exe
  C:\Windows\System\lgiYHmh.exe
  2⤵
  PID:8380
- C:\Windows\System\HRAstOp.exe
  C:\Windows\System\HRAstOp.exe
  2⤵
  PID:8488
- C:\Windows\System\ruYKCDH.exe
  C:\Windows\System\ruYKCDH.exe
  2⤵
  PID:8716
- C:\Windows\System\gwiKpBg.exe
  C:\Windows\System\gwiKpBg.exe
  2⤵
  PID:8788
- C:\Windows\System\FJOHbVt.exe
  C:\Windows\System\FJOHbVt.exe
  2⤵
  PID:8880
- C:\Windows\System\TqwZfSn.exe
  C:\Windows\System\TqwZfSn.exe
  2⤵
  PID:9016
- C:\Windows\System\FODahBL.exe
  C:\Windows\System\FODahBL.exe
  2⤵
  PID:9192
- C:\Windows\System\QqSyrrb.exe
  C:\Windows\System\QqSyrrb.exe
  2⤵
  PID:8264
- C:\Windows\System\TiKzOVv.exe
  C:\Windows\System\TiKzOVv.exe
  2⤵
  PID:8940
- C:\Windows\System\MvfiPRT.exe
  C:\Windows\System\MvfiPRT.exe
  2⤵
  PID:9104
- C:\Windows\System\dycJmXU.exe
  C:\Windows\System\dycJmXU.exe
  2⤵
  PID:9204
- C:\Windows\System\wZTORnW.exe
  C:\Windows\System\wZTORnW.exe
  2⤵
  PID:9236
- C:\Windows\System\jvbsWZF.exe
  C:\Windows\System\jvbsWZF.exe
  2⤵
  PID:9276
- C:\Windows\System\xhkbKVm.exe
  C:\Windows\System\xhkbKVm.exe
  2⤵
  PID:9300
- C:\Windows\System\SYCjYSm.exe
  C:\Windows\System\SYCjYSm.exe
  2⤵
  PID:9328
- C:\Windows\System\ODCWJrY.exe
  C:\Windows\System\ODCWJrY.exe
  2⤵
  PID:9348
- C:\Windows\System\PgveGip.exe
  C:\Windows\System\PgveGip.exe
  2⤵
  PID:9372
- C:\Windows\System\mNTWUaq.exe
  C:\Windows\System\mNTWUaq.exe
  2⤵
  PID:9396
- C:\Windows\System\tmACpIA.exe
  C:\Windows\System\tmACpIA.exe
  2⤵
  PID:9412
- C:\Windows\System\QvCbxNo.exe
  C:\Windows\System\QvCbxNo.exe
  2⤵
  PID:9432
- C:\Windows\System\LheIqbJ.exe
  C:\Windows\System\LheIqbJ.exe
  2⤵
  PID:9492
- C:\Windows\System\dqiTWsx.exe
  C:\Windows\System\dqiTWsx.exe
  2⤵
  PID:9528
- C:\Windows\System\sSrizYv.exe
  C:\Windows\System\sSrizYv.exe
  2⤵
  PID:9544
- C:\Windows\System\rVoiSiy.exe
  C:\Windows\System\rVoiSiy.exe
  2⤵
  PID:9580
- C:\Windows\System\prEthEZ.exe
  C:\Windows\System\prEthEZ.exe
  2⤵
  PID:9604
- C:\Windows\System\ZxdbLBH.exe
  C:\Windows\System\ZxdbLBH.exe
  2⤵
  PID:9632
- C:\Windows\System\HBULMkN.exe
  C:\Windows\System\HBULMkN.exe
  2⤵
  PID:9656
- C:\Windows\System\SIirntH.exe
  C:\Windows\System\SIirntH.exe
  2⤵
  PID:9676
- C:\Windows\System\QWGDpZD.exe
  C:\Windows\System\QWGDpZD.exe
  2⤵
  PID:9700
- C:\Windows\System\NtgaAaY.exe
  C:\Windows\System\NtgaAaY.exe
  2⤵
  PID:9720
- C:\Windows\System\BymrfyD.exe
  C:\Windows\System\BymrfyD.exe
  2⤵
  PID:9776
- C:\Windows\System\ZvKCafN.exe
  C:\Windows\System\ZvKCafN.exe
  2⤵
  PID:9800
- C:\Windows\System\ADQwTHi.exe
  C:\Windows\System\ADQwTHi.exe
  2⤵
  PID:9824
- C:\Windows\System\vJyZiHZ.exe
  C:\Windows\System\vJyZiHZ.exe
  2⤵
  PID:9840
- C:\Windows\System\vmyoLtM.exe
  C:\Windows\System\vmyoLtM.exe
  2⤵
  PID:9876
- C:\Windows\System\chbxaiZ.exe
  C:\Windows\System\chbxaiZ.exe
  2⤵
  PID:9896
- C:\Windows\System\fWkHUih.exe
  C:\Windows\System\fWkHUih.exe
  2⤵
  PID:9920
- C:\Windows\System\eYVMrWZ.exe
  C:\Windows\System\eYVMrWZ.exe
  2⤵
  PID:9936
- C:\Windows\System\zPBrZVv.exe
  C:\Windows\System\zPBrZVv.exe
  2⤵
  PID:9964
- C:\Windows\System\vqGNmOj.exe
  C:\Windows\System\vqGNmOj.exe
  2⤵
  PID:9988
- C:\Windows\System\fUCTnSj.exe
  C:\Windows\System\fUCTnSj.exe
  2⤵
  PID:10036
- C:\Windows\System\jhspJnO.exe
  C:\Windows\System\jhspJnO.exe
  2⤵
  PID:10072
- C:\Windows\System\OxFgQEi.exe
  C:\Windows\System\OxFgQEi.exe
  2⤵
  PID:10108
- C:\Windows\System\BxGcaqW.exe
  C:\Windows\System\BxGcaqW.exe
  2⤵
  PID:10136
- C:\Windows\System\gcrSGpI.exe
  C:\Windows\System\gcrSGpI.exe
  2⤵
  PID:10152
- C:\Windows\System\CjCFvWL.exe
  C:\Windows\System\CjCFvWL.exe
  2⤵
  PID:10172
- C:\Windows\System\iJqJhUj.exe
  C:\Windows\System\iJqJhUj.exe
  2⤵
  PID:10192
- C:\Windows\System\uBSoSoa.exe
  C:\Windows\System\uBSoSoa.exe
  2⤵
  PID:10224
- C:\Windows\System\UdbjyCA.exe
  C:\Windows\System\UdbjyCA.exe
  2⤵
  PID:8156
- C:\Windows\System\pwCypDD.exe
  C:\Windows\System\pwCypDD.exe
  2⤵
  PID:9232
- C:\Windows\System\cTJMSpE.exe
  C:\Windows\System\cTJMSpE.exe
  2⤵
  PID:9336
- C:\Windows\System\ALZptbR.exe
  C:\Windows\System\ALZptbR.exe
  2⤵
  PID:9424
- C:\Windows\System\nrtJYGn.exe
  C:\Windows\System\nrtJYGn.exe
  2⤵
  PID:2480
- C:\Windows\System\cnggBlV.exe
  C:\Windows\System\cnggBlV.exe
  2⤵
  PID:9500
- C:\Windows\System\aoMkEya.exe
  C:\Windows\System\aoMkEya.exe
  2⤵
  PID:9600
- C:\Windows\System\dhoGvxb.exe
  C:\Windows\System\dhoGvxb.exe
  2⤵
  PID:9672
- C:\Windows\System\gHLZcDi.exe
  C:\Windows\System\gHLZcDi.exe
  2⤵
  PID:9716
- C:\Windows\System\TFXAiJD.exe
  C:\Windows\System\TFXAiJD.exe
  2⤵
  PID:9768
- C:\Windows\System\TwtFKLH.exe
  C:\Windows\System\TwtFKLH.exe
  2⤵
  PID:9832
- C:\Windows\System\EKIrcXu.exe
  C:\Windows\System\EKIrcXu.exe
  2⤵
  PID:9932
- C:\Windows\System\fiXTVNC.exe
  C:\Windows\System\fiXTVNC.exe
  2⤵
  PID:9944
- C:\Windows\System\KUugnZc.exe
  C:\Windows\System\KUugnZc.exe
  2⤵
  PID:10008
- C:\Windows\System\IgGyBPh.exe
  C:\Windows\System\IgGyBPh.exe
  2⤵
  PID:10104
- C:\Windows\System\zAxOEpH.exe
  C:\Windows\System\zAxOEpH.exe
  2⤵
  PID:10184
- C:\Windows\System\KwjrHco.exe
  C:\Windows\System\KwjrHco.exe
  2⤵
  PID:10212
- C:\Windows\System\WiYXZHh.exe
  C:\Windows\System\WiYXZHh.exe
  2⤵
  PID:9404
- C:\Windows\System\dOyfNZr.exe
  C:\Windows\System\dOyfNZr.exe
  2⤵
  PID:9456
- C:\Windows\System\FyTPRoi.exe
  C:\Windows\System\FyTPRoi.exe
  2⤵
  PID:9388
- C:\Windows\System\QLfwyCz.exe
  C:\Windows\System\QLfwyCz.exe
  2⤵
  PID:9596
- C:\Windows\System\AYXirzk.exe
  C:\Windows\System\AYXirzk.exe
  2⤵
  PID:9792
- C:\Windows\System\paRzBul.exe
  C:\Windows\System\paRzBul.exe
  2⤵
  PID:9888
- C:\Windows\System\eDUIqsi.exe
  C:\Windows\System\eDUIqsi.exe
  2⤵
  PID:10060
- C:\Windows\System\IwYNzfY.exe
  C:\Windows\System\IwYNzfY.exe
  2⤵
  PID:2044
- C:\Windows\System\rmXyNOH.exe
  C:\Windows\System\rmXyNOH.exe
  2⤵
  PID:9748
- C:\Windows\System\ddvdwZR.exe
  C:\Windows\System\ddvdwZR.exe
  2⤵
  PID:10092
- C:\Windows\System\wWgerUO.exe
  C:\Windows\System\wWgerUO.exe
  2⤵
  PID:9316
- C:\Windows\System\gtvsJEz.exe
  C:\Windows\System\gtvsJEz.exe
  2⤵
  PID:10024
- C:\Windows\System\aibCiTf.exe
  C:\Windows\System\aibCiTf.exe
  2⤵
  PID:10276
- C:\Windows\System\EpYDkJH.exe
  C:\Windows\System\EpYDkJH.exe
  2⤵
  PID:10304
- C:\Windows\System\nQREVtJ.exe
  C:\Windows\System\nQREVtJ.exe
  2⤵
  PID:10324
- C:\Windows\System\iaqUMZX.exe
  C:\Windows\System\iaqUMZX.exe
  2⤵
  PID:10340
- C:\Windows\System\UwWRSIq.exe
  C:\Windows\System\UwWRSIq.exe
  2⤵
  PID:10368
- C:\Windows\System\CTOZSWR.exe
  C:\Windows\System\CTOZSWR.exe
  2⤵
  PID:10420
- C:\Windows\System\EByNQjv.exe
  C:\Windows\System\EByNQjv.exe
  2⤵
  PID:10440
- C:\Windows\System\gfnNkzw.exe
  C:\Windows\System\gfnNkzw.exe
  2⤵
  PID:10468
- C:\Windows\System\oxpddli.exe
  C:\Windows\System\oxpddli.exe
  2⤵
  PID:10492
- C:\Windows\System\mVROkrp.exe
  C:\Windows\System\mVROkrp.exe
  2⤵
  PID:10508
- C:\Windows\System\bvZpwap.exe
  C:\Windows\System\bvZpwap.exe
  2⤵
  PID:10532
- C:\Windows\System\rGsAkxV.exe
  C:\Windows\System\rGsAkxV.exe
  2⤵
  PID:10552
- C:\Windows\System\MGbaBeh.exe
  C:\Windows\System\MGbaBeh.exe
  2⤵
  PID:10592
- C:\Windows\System\fbwmJHP.exe
  C:\Windows\System\fbwmJHP.exe
  2⤵
  PID:10636
- C:\Windows\System\fKcsKBs.exe
  C:\Windows\System\fKcsKBs.exe
  2⤵
  PID:10660
- C:\Windows\System\iHxqLJI.exe
  C:\Windows\System\iHxqLJI.exe
  2⤵
  PID:10692
- C:\Windows\System\rbRWNLT.exe
  C:\Windows\System\rbRWNLT.exe
  2⤵
  PID:10716
- C:\Windows\System\PuvyXUF.exe
  C:\Windows\System\PuvyXUF.exe
  2⤵
  PID:10752
- C:\Windows\System\hKqGTqL.exe
  C:\Windows\System\hKqGTqL.exe
  2⤵
  PID:10780
- C:\Windows\System\bZpFCzW.exe
  C:\Windows\System\bZpFCzW.exe
  2⤵
  PID:10804
- C:\Windows\System\QeOlYNi.exe
  C:\Windows\System\QeOlYNi.exe
  2⤵
  PID:10840
- C:\Windows\System\dbRrwlS.exe
  C:\Windows\System\dbRrwlS.exe
  2⤵
  PID:10860
- C:\Windows\System\MBuxyoD.exe
  C:\Windows\System\MBuxyoD.exe
  2⤵
  PID:10888
- C:\Windows\System\QCnrLWT.exe
  C:\Windows\System\QCnrLWT.exe
  2⤵
  PID:10912
- C:\Windows\System\pXOSXOY.exe
  C:\Windows\System\pXOSXOY.exe
  2⤵
  PID:10928
- C:\Windows\System\gPTcfAR.exe
  C:\Windows\System\gPTcfAR.exe
  2⤵
  PID:10992
- C:\Windows\System\TYEIRUf.exe
  C:\Windows\System\TYEIRUf.exe
  2⤵
  PID:11008
- C:\Windows\System\gCDURMI.exe
  C:\Windows\System\gCDURMI.exe
  2⤵
  PID:11104
- C:\Windows\System\NKlfGid.exe
  C:\Windows\System\NKlfGid.exe
  2⤵
  PID:11136
- C:\Windows\System\jGvMoCb.exe
  C:\Windows\System\jGvMoCb.exe
  2⤵
  PID:11156
- C:\Windows\System\fvncToK.exe
  C:\Windows\System\fvncToK.exe
  2⤵
  PID:11192
- C:\Windows\System\CbLqQNH.exe
  C:\Windows\System\CbLqQNH.exe
  2⤵
  PID:11220
- C:\Windows\System\brHQzQP.exe
  C:\Windows\System\brHQzQP.exe
  2⤵
  PID:11240
- C:\Windows\System\MLRTCXH.exe
  C:\Windows\System\MLRTCXH.exe
  2⤵
  PID:11256
- C:\Windows\System\DdQFgWT.exe
  C:\Windows\System\DdQFgWT.exe
  2⤵
  PID:10312
- C:\Windows\System\lAMGkuZ.exe
  C:\Windows\System\lAMGkuZ.exe
  2⤵
  PID:10352
- C:\Windows\System\fblFpSc.exe
  C:\Windows\System\fblFpSc.exe
  2⤵
  PID:10428
- C:\Windows\System\XGbVipq.exe
  C:\Windows\System\XGbVipq.exe
  2⤵
  PID:10464
- C:\Windows\System\zbIeAMf.exe
  C:\Windows\System\zbIeAMf.exe
  2⤵
  PID:10568
- C:\Windows\System\HPkJyht.exe
  C:\Windows\System\HPkJyht.exe
  2⤵
  PID:10620
- C:\Windows\System\NEEEHNr.exe
  C:\Windows\System\NEEEHNr.exe
  2⤵
  PID:10652
- C:\Windows\System\VrRUkCc.exe
  C:\Windows\System\VrRUkCc.exe
  2⤵
  PID:10736
- C:\Windows\System\EZSIxQs.exe
  C:\Windows\System\EZSIxQs.exe
  2⤵
  PID:10732
- C:\Windows\System\OlHfYIh.exe
  C:\Windows\System\OlHfYIh.exe
  2⤵
  PID:10868
- C:\Windows\System\VgvRwVJ.exe
  C:\Windows\System\VgvRwVJ.exe
  2⤵
  PID:10948
- C:\Windows\System\PIrLteN.exe
  C:\Windows\System\PIrLteN.exe
  2⤵
  PID:11032
- C:\Windows\System\SVWMJUM.exe
  C:\Windows\System\SVWMJUM.exe
  2⤵
  PID:11044
- C:\Windows\System\ibCXhmk.exe
  C:\Windows\System\ibCXhmk.exe
  2⤵
  PID:11164
- C:\Windows\System\odiEBWX.exe
  C:\Windows\System\odiEBWX.exe
  2⤵
  PID:11080
- C:\Windows\System\FqGElQm.exe
  C:\Windows\System\FqGElQm.exe
  2⤵
  PID:11152
- C:\Windows\System\DbQWSMh.exe
  C:\Windows\System\DbQWSMh.exe
  2⤵
  PID:11208
- C:\Windows\System\cXpqdve.exe
  C:\Windows\System\cXpqdve.exe
  2⤵
  PID:10248
- C:\Windows\System\pivTNhP.exe
  C:\Windows\System\pivTNhP.exe
  2⤵
  PID:10484
- C:\Windows\System\lQKENjb.exe
  C:\Windows\System\lQKENjb.exe
  2⤵
  PID:10548
- C:\Windows\System\gbLuVCe.exe
  C:\Windows\System\gbLuVCe.exe
  2⤵
  PID:10764
- C:\Windows\System\pZUvZyc.exe
  C:\Windows\System\pZUvZyc.exe
  2⤵
  PID:10884
- C:\Windows\System\ZQJdvVB.exe
  C:\Windows\System\ZQJdvVB.exe
  2⤵
  PID:11036
- C:\Windows\System\cmPdduo.exe
  C:\Windows\System\cmPdduo.exe
  2⤵
  PID:11064
- C:\Windows\System\BqvpMMo.exe
  C:\Windows\System\BqvpMMo.exe
  2⤵
  PID:11088
- C:\Windows\System\RFcejlQ.exe
  C:\Windows\System\RFcejlQ.exe
  2⤵
  PID:10528
- C:\Windows\System\oJLkaUd.exe
  C:\Windows\System\oJLkaUd.exe
  2⤵
  PID:10624
- C:\Windows\System\bhPkpnK.exe
  C:\Windows\System\bhPkpnK.exe
  2⤵
  PID:11232
- C:\Windows\System\gkhKGHT.exe
  C:\Windows\System\gkhKGHT.exe
  2⤵
  PID:10336
- C:\Windows\System\PcbltZz.exe
  C:\Windows\System\PcbltZz.exe
  2⤵
  PID:11268
- C:\Windows\System\LRLxcJb.exe
  C:\Windows\System\LRLxcJb.exe
  2⤵
  PID:11300
- C:\Windows\System\axhHdWq.exe
  C:\Windows\System\axhHdWq.exe
  2⤵
  PID:11324
- C:\Windows\System\VfWcJnt.exe
  C:\Windows\System\VfWcJnt.exe
  2⤵
  PID:11348
- C:\Windows\System\ujAAFnB.exe
  C:\Windows\System\ujAAFnB.exe
  2⤵
  PID:11380
- C:\Windows\System\MItAFgP.exe
  C:\Windows\System\MItAFgP.exe
  2⤵
  PID:11400
- C:\Windows\System\gDRjBcd.exe
  C:\Windows\System\gDRjBcd.exe
  2⤵
  PID:11424
- C:\Windows\System\OSiAUsg.exe
  C:\Windows\System\OSiAUsg.exe
  2⤵
  PID:11444
- C:\Windows\System\bNQcqJR.exe
  C:\Windows\System\bNQcqJR.exe
  2⤵
  PID:11476
- C:\Windows\System\fvROjjP.exe
  C:\Windows\System\fvROjjP.exe
  2⤵
  PID:11508
- C:\Windows\System\uRijvwr.exe
  C:\Windows\System\uRijvwr.exe
  2⤵
  PID:11536
- C:\Windows\System\UAkgBbk.exe
  C:\Windows\System\UAkgBbk.exe
  2⤵
  PID:11560
- C:\Windows\System\BoTSlCg.exe
  C:\Windows\System\BoTSlCg.exe
  2⤵
  PID:11584
- C:\Windows\System\unIREBa.exe
  C:\Windows\System\unIREBa.exe
  2⤵
  PID:11604
- C:\Windows\System\EKgoaip.exe
  C:\Windows\System\EKgoaip.exe
  2⤵
  PID:11668
- C:\Windows\System\qduPtgC.exe
  C:\Windows\System\qduPtgC.exe
  2⤵
  PID:11684
- C:\Windows\System\TEkqlgD.exe
  C:\Windows\System\TEkqlgD.exe
  2⤵
  PID:11716
- C:\Windows\System\lOcelES.exe
  C:\Windows\System\lOcelES.exe
  2⤵
  PID:11744
- C:\Windows\System\fDlXTjc.exe
  C:\Windows\System\fDlXTjc.exe
  2⤵
  PID:11768
- C:\Windows\System\hHnSlEk.exe
  C:\Windows\System\hHnSlEk.exe
  2⤵
  PID:11784
- C:\Windows\System\QJICvEu.exe
  C:\Windows\System\QJICvEu.exe
  2⤵
  PID:11812
- C:\Windows\System\QHlyqYA.exe
  C:\Windows\System\QHlyqYA.exe
  2⤵
  PID:11848
- C:\Windows\System\SGutslo.exe
  C:\Windows\System\SGutslo.exe
  2⤵
  PID:11872
- C:\Windows\System\ylkTDVe.exe
  C:\Windows\System\ylkTDVe.exe
  2⤵
  PID:11900
- C:\Windows\System\USNUyZe.exe
  C:\Windows\System\USNUyZe.exe
  2⤵
  PID:11928
- C:\Windows\System\UEInuhn.exe
  C:\Windows\System\UEInuhn.exe
  2⤵
  PID:11944
- C:\Windows\System\YYlTpEK.exe
  C:\Windows\System\YYlTpEK.exe
  2⤵
  PID:11968
- C:\Windows\System\MldDegI.exe
  C:\Windows\System\MldDegI.exe
  2⤵
  PID:11984
- C:\Windows\System\FmhNKaE.exe
  C:\Windows\System\FmhNKaE.exe
  2⤵
  PID:12036
- C:\Windows\System\WgnLYwV.exe
  C:\Windows\System\WgnLYwV.exe
  2⤵
  PID:12084
- C:\Windows\System\JyCrGIQ.exe
  C:\Windows\System\JyCrGIQ.exe
  2⤵
  PID:12108
- C:\Windows\System\XVkJAMQ.exe
  C:\Windows\System\XVkJAMQ.exe
  2⤵
  PID:12132
- C:\Windows\System\DxzjinH.exe
  C:\Windows\System\DxzjinH.exe
  2⤵
  PID:12152
- C:\Windows\System\dtKHOye.exe
  C:\Windows\System\dtKHOye.exe
  2⤵
  PID:12172
- C:\Windows\System\tmgGDDZ.exe
  C:\Windows\System\tmgGDDZ.exe
  2⤵
  PID:12196
- C:\Windows\System\droSMoX.exe
  C:\Windows\System\droSMoX.exe
  2⤵
  PID:12216
- C:\Windows\System\UGegLfF.exe
  C:\Windows\System\UGegLfF.exe
  2⤵
  PID:12248
- C:\Windows\System\pnvaWXe.exe
  C:\Windows\System\pnvaWXe.exe
  2⤵
  PID:12280
- C:\Windows\System\TeXdVRI.exe
  C:\Windows\System\TeXdVRI.exe
  2⤵
  PID:11320
- C:\Windows\System\gHGTgjK.exe
  C:\Windows\System\gHGTgjK.exe
  2⤵
  PID:11440
- C:\Windows\System\OHmuQqo.exe
  C:\Windows\System\OHmuQqo.exe
  2⤵
  PID:11492
- C:\Windows\System\eqdqcsm.exe
  C:\Windows\System\eqdqcsm.exe
  2⤵
  PID:11524
- C:\Windows\System\PmSepJL.exe
  C:\Windows\System\PmSepJL.exe
  2⤵
  PID:11576
- C:\Windows\System\XvaMpPt.exe
  C:\Windows\System\XvaMpPt.exe
  2⤵
  PID:11620
- C:\Windows\System\NeUASOd.exe
  C:\Windows\System\NeUASOd.exe
  2⤵
  PID:11704
- C:\Windows\System\LkOnrYU.exe
  C:\Windows\System\LkOnrYU.exe
  2⤵
  PID:11776
- C:\Windows\System\ovPBTta.exe
  C:\Windows\System\ovPBTta.exe
  2⤵
  PID:11884
- C:\Windows\System\mrETKMP.exe
  C:\Windows\System\mrETKMP.exe
  2⤵
  PID:11980
- C:\Windows\System\NckEhmA.exe
  C:\Windows\System\NckEhmA.exe
  2⤵
  PID:12000
- C:\Windows\System\TnUfuXa.exe
  C:\Windows\System\TnUfuXa.exe
  2⤵
  PID:12052
- C:\Windows\System\kABTens.exe
  C:\Windows\System\kABTens.exe
  2⤵
  PID:12164
- C:\Windows\System\wbUhKvu.exe
  C:\Windows\System\wbUhKvu.exe
  2⤵
  PID:12208
- C:\Windows\System\iAkUNqg.exe
  C:\Windows\System\iAkUNqg.exe
  2⤵
  PID:2456
- C:\Windows\System\SzHBCGC.exe
  C:\Windows\System\SzHBCGC.exe
  2⤵
  PID:12256
- C:\Windows\System\Vhgnten.exe
  C:\Windows\System\Vhgnten.exe
  2⤵
  PID:872
- C:\Windows\System\OVnGjWU.exe
  C:\Windows\System\OVnGjWU.exe
  2⤵
  PID:11432
- C:\Windows\System\UvsSAbl.exe
  C:\Windows\System\UvsSAbl.exe
  2⤵
  PID:11520
- C:\Windows\System\XiEMBnV.exe
  C:\Windows\System\XiEMBnV.exe
  2⤵
  PID:11920
- C:\Windows\System\GTpAOsl.exe
  C:\Windows\System\GTpAOsl.exe
  2⤵
  PID:11960
- C:\Windows\System\IUluJym.exe
  C:\Windows\System\IUluJym.exe
  2⤵
  PID:12092
- C:\Windows\System\fESatjs.exe
  C:\Windows\System\fESatjs.exe
  2⤵
  PID:2604
- C:\Windows\System\UJymYtx.exe
  C:\Windows\System\UJymYtx.exe
  2⤵
  PID:11316
- C:\Windows\System\JMdnRJe.exe
  C:\Windows\System\JMdnRJe.exe
  2⤵
  PID:11804
- C:\Windows\System\tVCMFAy.exe
  C:\Windows\System\tVCMFAy.exe
  2⤵
  PID:12028
- C:\Windows\System\FODPJMA.exe
  C:\Windows\System\FODPJMA.exe
  2⤵
  PID:2704
- C:\Windows\System\lytSEnO.exe
  C:\Windows\System\lytSEnO.exe
  2⤵
  PID:12224
- C:\Windows\System\aRuZvVj.exe
  C:\Windows\System\aRuZvVj.exe
  2⤵
  PID:12308
- C:\Windows\System\jwNkDgh.exe
  C:\Windows\System\jwNkDgh.exe
  2⤵
  PID:12328
- C:\Windows\System\zRyIwOH.exe
  C:\Windows\System\zRyIwOH.exe
  2⤵
  PID:12352
- C:\Windows\System\ekvJAKC.exe
  C:\Windows\System\ekvJAKC.exe
  2⤵
  PID:12408
- C:\Windows\System\uFmRrbw.exe
  C:\Windows\System\uFmRrbw.exe
  2⤵
  PID:12428
- C:\Windows\System\SEmkUma.exe
  C:\Windows\System\SEmkUma.exe
  2⤵
  PID:12452
- C:\Windows\System\RLcEtVb.exe
  C:\Windows\System\RLcEtVb.exe
  2⤵
  PID:12472
- C:\Windows\System\jSETUNj.exe
  C:\Windows\System\jSETUNj.exe
  2⤵
  PID:12500
- C:\Windows\System\ywryiws.exe
  C:\Windows\System\ywryiws.exe
  2⤵
  PID:12552
- C:\Windows\System\xvlCgEW.exe
  C:\Windows\System\xvlCgEW.exe
  2⤵
  PID:12568
- C:\Windows\System\IPObBHb.exe
  C:\Windows\System\IPObBHb.exe
  2⤵
  PID:12588
- C:\Windows\System\TtZmfif.exe
  C:\Windows\System\TtZmfif.exe
  2⤵
  PID:12628
- C:\Windows\System\BPHFVFK.exe
  C:\Windows\System\BPHFVFK.exe
  2⤵
  PID:12656
- C:\Windows\System\DUkyEsK.exe
  C:\Windows\System\DUkyEsK.exe
  2⤵
  PID:12680
- C:\Windows\System\TujDzgQ.exe
  C:\Windows\System\TujDzgQ.exe
  2⤵
  PID:12720
- C:\Windows\System\tgIwndw.exe
  C:\Windows\System\tgIwndw.exe
  2⤵
  PID:12740
- C:\Windows\System\OjVRslt.exe
  C:\Windows\System\OjVRslt.exe
  2⤵
  PID:12764
- C:\Windows\System\PHOBDjJ.exe
  C:\Windows\System\PHOBDjJ.exe
  2⤵
  PID:12780
- C:\Windows\System\MLUdjxi.exe
  C:\Windows\System\MLUdjxi.exe
  2⤵
  PID:12824
- C:\Windows\System\yzkIWCF.exe
  C:\Windows\System\yzkIWCF.exe
  2⤵
  PID:12852
- C:\Windows\System\BfsaPpV.exe
  C:\Windows\System\BfsaPpV.exe
  2⤵
  PID:12872
- C:\Windows\System\zhZhAcK.exe
  C:\Windows\System\zhZhAcK.exe
  2⤵
  PID:12900
- C:\Windows\System\LWcySNO.exe
  C:\Windows\System\LWcySNO.exe
  2⤵
  PID:12932
- C:\Windows\System\MzcfrxB.exe
  C:\Windows\System\MzcfrxB.exe
  2⤵
  PID:12952
- C:\Windows\System\LILXEvP.exe
  C:\Windows\System\LILXEvP.exe
  2⤵
  PID:12976
- C:\Windows\System\qXzZyDU.exe
  C:\Windows\System\qXzZyDU.exe
  2⤵
  PID:12992
- C:\Windows\System\zEatKkc.exe
  C:\Windows\System\zEatKkc.exe
  2⤵
  PID:13012
- C:\Windows\System\RlLkDMg.exe
  C:\Windows\System\RlLkDMg.exe
  2⤵
  PID:13032
- C:\Windows\System\jsbZnqM.exe
  C:\Windows\System\jsbZnqM.exe
  2⤵
  PID:13068
- C:\Windows\System\OisYSCc.exe
  C:\Windows\System\OisYSCc.exe
  2⤵
  PID:13124
- C:\Windows\System\OfmKszF.exe
  C:\Windows\System\OfmKszF.exe
  2⤵
  PID:13156
- C:\Windows\System\fRPoEoa.exe
  C:\Windows\System\fRPoEoa.exe
  2⤵
  PID:13176
- C:\Windows\System\YknyhlY.exe
  C:\Windows\System\YknyhlY.exe
  2⤵
  PID:13200
- C:\Windows\System\jbRlItb.exe
  C:\Windows\System\jbRlItb.exe
  2⤵
  PID:13244
- C:\Windows\System\HdqBaYw.exe
  C:\Windows\System\HdqBaYw.exe
  2⤵
  PID:13264
- C:\Windows\System\LBGJLRQ.exe
  C:\Windows\System\LBGJLRQ.exe
  2⤵
  PID:12748
- C:\Windows\System\ZiNGvAV.exe
  C:\Windows\System\ZiNGvAV.exe
  2⤵
  PID:12772
- C:\Windows\System\ZUlCzxD.exe
  C:\Windows\System\ZUlCzxD.exe
  2⤵
  PID:12848
- C:\Windows\System\hoIkUgH.exe
  C:\Windows\System\hoIkUgH.exe
  2⤵
  PID:12920
- C:\Windows\System\AIyCtmY.exe
  C:\Windows\System\AIyCtmY.exe
  2⤵
  PID:12960
- C:\Windows\System\zgLhBZm.exe
  C:\Windows\System\zgLhBZm.exe
  2⤵
  PID:13304
- C:\Windows\System\xBmrIcK.exe
  C:\Windows\System\xBmrIcK.exe
  2⤵
  PID:12624
- C:\Windows\System\whZMwLY.exe
  C:\Windows\System\whZMwLY.exe
  2⤵
  PID:13252
- C:\Windows\System\yFSqTSS.exe
  C:\Windows\System\yFSqTSS.exe
  2⤵
  PID:13272
- C:\Windows\System\fInsXyv.exe
  C:\Windows\System\fInsXyv.exe
  2⤵
  PID:13276
- C:\Windows\System\LIzavsQ.exe
  C:\Windows\System\LIzavsQ.exe
  2⤵
  PID:12292
- C:\Windows\System\zKSJoJx.exe
  C:\Windows\System\zKSJoJx.exe
  2⤵
  PID:12348
- C:\Windows\System\QjgvlJm.exe
  C:\Windows\System\QjgvlJm.exe
  2⤵
  PID:12400
- C:\Windows\System\GROgZMx.exe
  C:\Windows\System\GROgZMx.exe
  2⤵
  PID:12424
- C:\Windows\System\zCxafVG.exe
  C:\Windows\System\zCxafVG.exe
  2⤵
  PID:12464
- C:\Windows\System\giCaTJH.exe
  C:\Windows\System\giCaTJH.exe
  2⤵
  PID:12496
- C:\Windows\System\zGQaVCj.exe
  C:\Windows\System\zGQaVCj.exe
  2⤵
  PID:12580
- C:\Windows\System\NmRJtXN.exe
  C:\Windows\System\NmRJtXN.exe
  2⤵
  PID:12608
- C:\Windows\System\fjCcvsh.exe
  C:\Windows\System\fjCcvsh.exe
  2⤵
  PID:12948
- C:\Windows\System\PoZroAi.exe
  C:\Windows\System\PoZroAi.exe
  2⤵
  PID:12068
- C:\Windows\System\UcTIrFj.exe
  C:\Windows\System\UcTIrFj.exe
  2⤵
  PID:12668
- C:\Windows\System\WdlSbek.exe
  C:\Windows\System\WdlSbek.exe
  2⤵
  PID:12440
- C:\Windows\System\yfwjPlG.exe
  C:\Windows\System\yfwjPlG.exe
  2⤵
  PID:12560
- C:\Windows\System\fhaafcs.exe
  C:\Windows\System\fhaafcs.exe
  2⤵
  PID:12672
- C:\Windows\System\kUwbFdf.exe
  C:\Windows\System\kUwbFdf.exe
  2⤵
  PID:12712
- C:\Windows\System\LjKvviW.exe
  C:\Windows\System\LjKvviW.exe
  2⤵
  PID:12888
- C:\Windows\System\AjroDmH.exe
  C:\Windows\System\AjroDmH.exe
  2⤵
  PID:12884
- C:\Windows\System\ExNQWyR.exe
  C:\Windows\System\ExNQWyR.exe
  2⤵
  PID:3984
- C:\Windows\System\ZfAsPHt.exe
  C:\Windows\System\ZfAsPHt.exe
  2⤵
  PID:13024
- C:\Windows\System\GCklvDN.exe
  C:\Windows\System\GCklvDN.exe
  2⤵
  PID:13060
- C:\Windows\System\ZhBQdAl.exe
  C:\Windows\System\ZhBQdAl.exe
  2⤵
  PID:13132
- C:\Windows\System\zIfiPQN.exe
  C:\Windows\System\zIfiPQN.exe
  2⤵
  PID:13192
- C:\Windows\System\TVBoktE.exe
  C:\Windows\System\TVBoktE.exe
  2⤵
  PID:13168
- C:\Windows\System\ErZKiAw.exe
  C:\Windows\System\ErZKiAw.exe
  2⤵
  PID:1124
- C:\Windows\System\guIQFeH.exe
  C:\Windows\System\guIQFeH.exe
  2⤵
  PID:13088
- C:\Windows\System\rLTBYHH.exe
  C:\Windows\System\rLTBYHH.exe
  2⤵
  PID:3368
- C:\Windows\System\wIILQEH.exe
  C:\Windows\System\wIILQEH.exe
  2⤵
  PID:3160
- C:\Windows\System\qzDKAiL.exe
  C:\Windows\System\qzDKAiL.exe
  2⤵
  PID:5364
- C:\Windows\System\FZCReIN.exe
  C:\Windows\System\FZCReIN.exe
  2⤵
  PID:2376
- C:\Windows\System\JgVyPCz.exe
  C:\Windows\System\JgVyPCz.exe
  2⤵
  PID:2136
- C:\Windows\System\gWRduvE.exe
  C:\Windows\System\gWRduvE.exe
  2⤵
  PID:4468
- C:\Windows\System\pomwBJG.exe
  C:\Windows\System\pomwBJG.exe
  2⤵
  PID:12320
- C:\Windows\System\HdHwdAs.exe
  C:\Windows\System\HdHwdAs.exe
  2⤵
  PID:3756
- C:\Windows\System\MKeGbcB.exe
  C:\Windows\System\MKeGbcB.exe
  2⤵
  PID:4492
- C:\Windows\System\YEjHLqJ.exe
  C:\Windows\System\YEjHLqJ.exe
  2⤵
  PID:12620
- C:\Windows\System\MyvGwOV.exe
  C:\Windows\System\MyvGwOV.exe
  2⤵
  PID:4996
- C:\Windows\System\hvcMJFq.exe
  C:\Windows\System\hvcMJFq.exe
  2⤵
  PID:12840
- C:\Windows\System\DdCMPVL.exe
  C:\Windows\System\DdCMPVL.exe
  2⤵
  PID:13152
- C:\Windows\System\MGZHSTk.exe
  C:\Windows\System\MGZHSTk.exe
  2⤵
  PID:12792
- C:\Windows\System\TZazPoT.exe
  C:\Windows\System\TZazPoT.exe
  2⤵
  PID:4456
- C:\Windows\System\DvswRFG.exe
  C:\Windows\System\DvswRFG.exe
  2⤵
  PID:11936
- C:\Windows\System\XotqdxF.exe
  C:\Windows\System\XotqdxF.exe
  2⤵
  PID:4736
- C:\Windows\System\sWldIgw.exe
  C:\Windows\System\sWldIgw.exe
  2⤵
  PID:5440
- C:\Windows\System\JcXikXM.exe
  C:\Windows\System\JcXikXM.exe
  2⤵
  PID:2228
- C:\Windows\System\FsJMMTs.exe
  C:\Windows\System\FsJMMTs.exe
  2⤵
  PID:4840
- C:\Windows\System\xkMYcQD.exe
  C:\Windows\System\xkMYcQD.exe
  2⤵
  PID:12368
- C:\Windows\System\mZGlahD.exe
  C:\Windows\System\mZGlahD.exe
  2⤵
  PID:4532
- C:\Windows\System\ZRjimFp.exe
  C:\Windows\System\ZRjimFp.exe
  2⤵
  PID:4884
- C:\Windows\System\bEEnexK.exe
  C:\Windows\System\bEEnexK.exe
  2⤵
  PID:3964
- C:\Windows\System\VXOIRgu.exe
  C:\Windows\System\VXOIRgu.exe
  2⤵
  PID:5152
- C:\Windows\System\uHQpqKD.exe
  C:\Windows\System\uHQpqKD.exe
  2⤵
  PID:4552
- C:\Windows\System\pvbcJfE.exe
  C:\Windows\System\pvbcJfE.exe
  2⤵
  PID:3380
- C:\Windows\System\hiPNOec.exe
  C:\Windows\System\hiPNOec.exe
  2⤵
  PID:4876
- C:\Windows\System\fkWkTjj.exe
  C:\Windows\System\fkWkTjj.exe
  2⤵
  PID:2688
- C:\Windows\System\gJCXgXf.exe
  C:\Windows\System\gJCXgXf.exe
  2⤵
  PID:12548
- C:\Windows\System\UcWdWcD.exe
  C:\Windows\System\UcWdWcD.exe
  2⤵
  PID:1100
- C:\Windows\System\EFStSYO.exe
  C:\Windows\System\EFStSYO.exe
  2⤵
  PID:1940
- C:\Windows\System\oEawZGS.exe
  C:\Windows\System\oEawZGS.exe
  2⤵
  PID:3728
- C:\Windows\System\jsVGVSg.exe
  C:\Windows\System\jsVGVSg.exe
  2⤵
  PID:12892
- C:\Windows\System\DYgSNCH.exe
  C:\Windows\System\DYgSNCH.exe
  2⤵
  PID:4700
- C:\Windows\System\CVjRgtr.exe
  C:\Windows\System\CVjRgtr.exe
  2⤵
  PID:2944
- C:\Windows\System\xtGNlZq.exe
  C:\Windows\System\xtGNlZq.exe
  2⤵
  PID:4672
- C:\Windows\System\QsqzrBw.exe
  C:\Windows\System\QsqzrBw.exe
  2⤵
  PID:5672
- C:\Windows\System\sJWmfFQ.exe
  C:\Windows\System\sJWmfFQ.exe
  2⤵
  PID:5844
- C:\Windows\System\MIurNGz.exe
  C:\Windows\System\MIurNGz.exe
  2⤵
  PID:5956
- C:\Windows\System\kwFBDWD.exe
  C:\Windows\System\kwFBDWD.exe
  2⤵
  PID:6036
- C:\Windows\System\kbTpEgv.exe
  C:\Windows\System\kbTpEgv.exe
  2⤵
  PID:4652
- C:\Windows\System\CstAPZY.exe
  C:\Windows\System\CstAPZY.exe
  2⤵
  PID:3624
- C:\Windows\System\VHkTkFy.exe
  C:\Windows\System\VHkTkFy.exe
  2⤵
  PID:3764
- C:\Windows\System\WHiCJme.exe
  C:\Windows\System\WHiCJme.exe
  2⤵
  PID:4988
- C:\Windows\System\XhCRZhQ.exe
  C:\Windows\System\XhCRZhQ.exe
  2⤵
  PID:5636
- C:\Windows\System\vGNzByp.exe
  C:\Windows\System\vGNzByp.exe
  2⤵
  PID:5764
- C:\Windows\System\wZIPBQb.exe
  C:\Windows\System\wZIPBQb.exe
  2⤵
  PID:5200
- C:\Windows\System\lpsRSAc.exe
  C:\Windows\System\lpsRSAc.exe
  2⤵
  PID:4336
- C:\Windows\System\MBIFVbX.exe
  C:\Windows\System\MBIFVbX.exe
  2⤵
  PID:5944
- C:\Windows\System\vCNQkJm.exe
  C:\Windows\System\vCNQkJm.exe
  2⤵
  PID:6164
- C:\Windows\System\XlehtPV.exe
  C:\Windows\System\XlehtPV.exe
  2⤵
  PID:6172
- C:\Windows\System\VcCFoQD.exe
  C:\Windows\System\VcCFoQD.exe
  2⤵
  PID:6228
- C:\Windows\System\ITkkYtk.exe
  C:\Windows\System\ITkkYtk.exe
  2⤵
  PID:6300
- C:\Windows\System\bElfBzN.exe
  C:\Windows\System\bElfBzN.exe
  2⤵
  PID:6344
- C:\Windows\System\BboNRGK.exe
  C:\Windows\System\BboNRGK.exe
  2⤵
  PID:6396
- C:\Windows\System\heLoHIT.exe
  C:\Windows\System\heLoHIT.exe
  2⤵
  PID:6460
- C:\Windows\System\GCJNRda.exe
  C:\Windows\System\GCJNRda.exe
  2⤵
  PID:6540
- C:\Windows\System\dWxUZLO.exe
  C:\Windows\System\dWxUZLO.exe
  2⤵
  PID:6624
- C:\Windows\System\HXYqOdq.exe
  C:\Windows\System\HXYqOdq.exe
  2⤵
  PID:6696
- C:\Windows\System\WwXGDLH.exe
  C:\Windows\System\WwXGDLH.exe
  2⤵
  PID:6756
- C:\Windows\System\KTEtAWJ.exe
  C:\Windows\System\KTEtAWJ.exe
  2⤵
  PID:6848
- C:\Windows\System\aonxNzq.exe
  C:\Windows\System\aonxNzq.exe
  2⤵
  PID:6860
- C:\Windows\System\SxckRnO.exe
  C:\Windows\System\SxckRnO.exe
  2⤵
  PID:4276
- C:\Windows\System\ASuVGvC.exe
  C:\Windows\System\ASuVGvC.exe
  2⤵
  PID:3988
- C:\Windows\System\lMwhkHT.exe
  C:\Windows\System\lMwhkHT.exe
  2⤵
  PID:3960
- C:\Windows\System\NanjQJt.exe
  C:\Windows\System\NanjQJt.exe
  2⤵
  PID:2232
- C:\Windows\System\fqGvqrX.exe
  C:\Windows\System\fqGvqrX.exe
  2⤵
  PID:7044
- C:\Windows\System\zLmltQk.exe
  C:\Windows\System\zLmltQk.exe
  2⤵
  PID:3432
- C:\Windows\System\NEekCET.exe
  C:\Windows\System\NEekCET.exe
  2⤵
  PID:12384
- C:\Windows\System\sxNUnFV.exe
  C:\Windows\System\sxNUnFV.exe
  2⤵
  PID:2776
- C:\Windows\System\WjPricb.exe
  C:\Windows\System\WjPricb.exe
  2⤵
  PID:7164
- C:\Windows\System\dcyHcxZ.exe
  C:\Windows\System\dcyHcxZ.exe
  2⤵
  PID:5752
- C:\Windows\System\VmSsCyQ.exe
  C:\Windows\System\VmSsCyQ.exe
  2⤵
  PID:6232
- C:\Windows\System\YPdCjmV.exe
  C:\Windows\System\YPdCjmV.exe
  2⤵
  PID:6364
- C:\Windows\System\ggZbjBR.exe
  C:\Windows\System\ggZbjBR.exe
  2⤵
  PID:6508
- C:\Windows\System\KuReFbt.exe
  C:\Windows\System\KuReFbt.exe
  2⤵
  PID:6580
- C:\Windows\System\BTLgrxw.exe
  C:\Windows\System\BTLgrxw.exe
  2⤵
  PID:6764
- C:\Windows\System\veDRIkF.exe
  C:\Windows\System\veDRIkF.exe
  2⤵
  PID:6884
- C:\Windows\System\uqKJDNj.exe
  C:\Windows\System\uqKJDNj.exe
  2⤵
  PID:6908
- C:\Windows\System\JVtUttj.exe
  C:\Windows\System\JVtUttj.exe
  2⤵
  PID:7140
- C:\Windows\System\DmrzRKG.exe
  C:\Windows\System\DmrzRKG.exe
  2⤵
  PID:6252
- C:\Windows\System\xOUKFMw.exe
  C:\Windows\System\xOUKFMw.exe
  2⤵
  PID:6716
- C:\Windows\System\XdbHweX.exe
  C:\Windows\System\XdbHweX.exe
  2⤵
  PID:6984
- C:\Windows\System\hsBxdlw.exe
  C:\Windows\System\hsBxdlw.exe
  2⤵
  PID:6048
- C:\Windows\System\xuDNxdu.exe
  C:\Windows\System\xuDNxdu.exe
  2⤵
  PID:3336
- C:\Windows\System\kEbZJBn.exe
  C:\Windows\System\kEbZJBn.exe
  2⤵
  PID:7100
- C:\Windows\System\rZVGfIf.exe
  C:\Windows\System\rZVGfIf.exe
  2⤵
  PID:7212
- C:\Windows\System\IJhFZGZ.exe
  C:\Windows\System\IJhFZGZ.exe
  2⤵
  PID:7256
- C:\Windows\System\GPWEDRq.exe
  C:\Windows\System\GPWEDRq.exe
  2⤵
  PID:7336
- C:\Windows\System\zzKrUDl.exe
  C:\Windows\System\zzKrUDl.exe
  2⤵
  PID:7392
- C:\Windows\System\amMVIlT.exe
  C:\Windows\System\amMVIlT.exe
  2⤵
  PID:7444
- C:\Windows\System\SotwRRa.exe
  C:\Windows\System\SotwRRa.exe
  2⤵
  PID:7528
- C:\Windows\System\VfNeCFB.exe
  C:\Windows\System\VfNeCFB.exe
  2⤵
  PID:7600
- C:\Windows\System\shPYgQC.exe
  C:\Windows\System\shPYgQC.exe
  2⤵
  PID:7624
- C:\Windows\System\SHtxQdt.exe
  C:\Windows\System\SHtxQdt.exe
  2⤵
  PID:7688
- C:\Windows\System\EdvSEln.exe
  C:\Windows\System\EdvSEln.exe
  2⤵
  PID:768
- C:\Windows\System\MnrHLGv.exe
  C:\Windows\System\MnrHLGv.exe
  2⤵
  PID:5360
- C:\Windows\System\BoJkRba.exe
  C:\Windows\System\BoJkRba.exe
  2⤵
  PID:7808
- C:\Windows\System\WBrvuSW.exe
  C:\Windows\System\WBrvuSW.exe
  2⤵
  PID:12728
- C:\Windows\System\FZRlqdl.exe
  C:\Windows\System\FZRlqdl.exe
  2⤵
  PID:13120
- C:\Windows\System\ArplfhR.exe
  C:\Windows\System\ArplfhR.exe
  2⤵
  PID:7984
- C:\Windows\System\yEKRBza.exe
  C:\Windows\System\yEKRBza.exe
  2⤵
  PID:8012
- C:\Windows\System\tuPAZxP.exe
  C:\Windows\System\tuPAZxP.exe
  2⤵
  PID:6072
- C:\Windows\System\SCQgysg.exe
  C:\Windows\System\SCQgysg.exe
  2⤵
  PID:8096
- C:\Windows\System\oCiLmmU.exe
  C:\Windows\System\oCiLmmU.exe
  2⤵
  PID:5444
- C:\Windows\System\mZfELAF.exe
  C:\Windows\System\mZfELAF.exe
  2⤵
  PID:8168
- C:\Windows\System\uNbpndg.exe
  C:\Windows\System\uNbpndg.exe
  2⤵
  PID:864
- C:\Windows\System\CrbfcHQ.exe
  C:\Windows\System\CrbfcHQ.exe
  2⤵
  PID:2256
- C:\Windows\System\xCYvxQJ.exe
  C:\Windows\System\xCYvxQJ.exe
  2⤵
  PID:3208
- C:\Windows\System\ULetNjH.exe
  C:\Windows\System\ULetNjH.exe
  2⤵
  PID:4980
- C:\Windows\System\jLpUVww.exe
  C:\Windows\System\jLpUVww.exe
  2⤵
  PID:5856
- C:\Windows\System\GQiqfgh.exe
  C:\Windows\System\GQiqfgh.exe
  2⤵
  PID:1536
- C:\Windows\System\PMxLcdO.exe
  C:\Windows\System\PMxLcdO.exe
  2⤵
  PID:5516
- C:\Windows\System\JUceFMP.exe
  C:\Windows\System\JUceFMP.exe
  2⤵
  PID:7572
- C:\Windows\System\iiTZPgq.exe
  C:\Windows\System\iiTZPgq.exe
  2⤵
  PID:7644
- C:\Windows\System\nKgbFMO.exe
  C:\Windows\System\nKgbFMO.exe
  2⤵
  PID:7788
- C:\Windows\System\CzvSzcK.exe
  C:\Windows\System\CzvSzcK.exe
  2⤵
  PID:7856
- C:\Windows\System\pBbsILy.exe
  C:\Windows\System\pBbsILy.exe
  2⤵
  PID:6200
- C:\Windows\System\bajpOzZ.exe
  C:\Windows\System\bajpOzZ.exe
  2⤵
  PID:8016
- C:\Windows\System\dQWahTb.exe
  C:\Windows\System\dQWahTb.exe
  2⤵
  PID:6504
- C:\Windows\System\MTTJCzS.exe
  C:\Windows\System\MTTJCzS.exe
  2⤵
  PID:6844
- C:\Windows\System\ANnjFfs.exe
  C:\Windows\System\ANnjFfs.exe
  2⤵
  PID:6768
- C:\Windows\System\blHwIXE.exe
  C:\Windows\System\blHwIXE.exe
  2⤵
  PID:6904
- C:\Windows\System\RzFybea.exe
  C:\Windows\System\RzFybea.exe
  2⤵
  PID:13064
- C:\Windows\System\oFrhcsD.exe
  C:\Windows\System\oFrhcsD.exe
  2⤵
  PID:4308
- C:\Windows\System\biIwFky.exe
  C:\Windows\System\biIwFky.exe
  2⤵
  PID:8332
- C:\Windows\System\QbRwVcg.exe
  C:\Windows\System\QbRwVcg.exe
  2⤵
  PID:8336
- C:\Windows\System\jkMuaRG.exe
  C:\Windows\System\jkMuaRG.exe
  2⤵
  PID:8352
- C:\Windows\System\jRgWHmy.exe
  C:\Windows\System\jRgWHmy.exe
  2⤵
  PID:3492
- C:\Windows\System\lKJCAQq.exe
  C:\Windows\System\lKJCAQq.exe
  2⤵
  PID:8396
- C:\Windows\System\cWOeLZL.exe
  C:\Windows\System\cWOeLZL.exe
  2⤵
  PID:4052
- C:\Windows\System\tYSbuCN.exe
  C:\Windows\System\tYSbuCN.exe
  2⤵
  PID:8492
- C:\Windows\System\AVPtWTb.exe
  C:\Windows\System\AVPtWTb.exe
  2⤵
  PID:6516
- C:\Windows\System\dDzlBzy.exe
  C:\Windows\System\dDzlBzy.exe
  2⤵
  PID:6692
- C:\Windows\System\yTxtipa.exe
  C:\Windows\System\yTxtipa.exe
  2⤵
  PID:6976
- C:\Windows\System\kzFuuQW.exe
  C:\Windows\System\kzFuuQW.exe
  2⤵
  PID:6948
- C:\Windows\System\UnhsbNW.exe
  C:\Windows\System\UnhsbNW.exe
  2⤵
  PID:8804
- C:\Windows\System\tGKRYla.exe
  C:\Windows\System\tGKRYla.exe
  2⤵
  PID:6828
- C:\Windows\System\twKsycq.exe
  C:\Windows\System\twKsycq.exe
  2⤵
  PID:6920
- C:\Windows\System\HONSmMn.exe
  C:\Windows\System\HONSmMn.exe
  2⤵
  PID:7180
- C:\Windows\System\IMJeeJS.exe
  C:\Windows\System\IMJeeJS.exe
  2⤵
  PID:8976
- C:\Windows\System\ymLsOiY.exe
  C:\Windows\System\ymLsOiY.exe
  2⤵
  PID:9012
- C:\Windows\System\lMGdItI.exe
  C:\Windows\System\lMGdItI.exe
  2⤵
  PID:7452
- C:\Windows\System\NBKbuUu.exe
  C:\Windows\System\NBKbuUu.exe
  2⤵
  PID:7616
- C:\Windows\System\SUuRWQR.exe
  C:\Windows\System\SUuRWQR.exe
  2⤵
  PID:7720
- C:\Windows\System\BSvOFJa.exe
  C:\Windows\System\BSvOFJa.exe
  2⤵
  PID:7804
- C:\Windows\System\MnQPpMl.exe
  C:\Windows\System\MnQPpMl.exe
  2⤵
  PID:8056
- C:\Windows\System\hmYksHc.exe
  C:\Windows\System\hmYksHc.exe
  2⤵
  PID:4872
- C:\Windows\System\nsgRISL.exe
  C:\Windows\System\nsgRISL.exe
  2⤵
  PID:2700
- C:\Windows\System\SYMIYoK.exe
  C:\Windows\System\SYMIYoK.exe
  2⤵
  PID:8404
- C:\Windows\System\zVAzAbA.exe
  C:\Windows\System\zVAzAbA.exe
  2⤵
  PID:4684
- C:\Windows\System\FivPJni.exe
  C:\Windows\System\FivPJni.exe
  2⤵
  PID:4560
- C:\Windows\System\iNZyfds.exe
  C:\Windows\System\iNZyfds.exe
  2⤵
  PID:4292
- C:\Windows\System\bNzYtgG.exe
  C:\Windows\System\bNzYtgG.exe
  2⤵
  PID:8592
- C:\Windows\System\mLFWmaU.exe
  C:\Windows\System\mLFWmaU.exe
  2⤵
  PID:5860
- C:\Windows\System\hiJIJMM.exe
  C:\Windows\System\hiJIJMM.exe
  2⤵
  PID:5696
- C:\Windows\System\MxrZoYE.exe
  C:\Windows\System\MxrZoYE.exe
  2⤵
  PID:8936
- C:\Windows\System\avRUaSv.exe
  C:\Windows\System\avRUaSv.exe
  2⤵
  PID:9008
- C:\Windows\System\IMxINLy.exe
  C:\Windows\System\IMxINLy.exe
  2⤵
  PID:9052
- C:\Windows\System\ehDuAmH.exe
  C:\Windows\System\ehDuAmH.exe
  2⤵
  PID:8196
- C:\Windows\System\vzXgzRe.exe
  C:\Windows\System\vzXgzRe.exe
  2⤵
  PID:5804
- C:\Windows\System\nBHRsEY.exe
  C:\Windows\System\nBHRsEY.exe
  2⤵
  PID:1372
- C:\Windows\System\QhXDJRK.exe
  C:\Windows\System\QhXDJRK.exe
  2⤵
  PID:412
- C:\Windows\System\SnVRnRX.exe
  C:\Windows\System\SnVRnRX.exe
  2⤵
  PID:8792
- C:\Windows\System\OLkQHvp.exe
  C:\Windows\System\OLkQHvp.exe
  2⤵
  PID:9096
- C:\Windows\System\SIWVDYC.exe
  C:\Windows\System\SIWVDYC.exe
  2⤵
  PID:7552
- C:\Windows\System\rTSPkUM.exe
  C:\Windows\System\rTSPkUM.exe
  2⤵
  PID:3200
- C:\Windows\System\DdnTuMG.exe
  C:\Windows\System\DdnTuMG.exe
  2⤵
  PID:7652
- C:\Windows\System\UojRiQQ.exe
  C:\Windows\System\UojRiQQ.exe
  2⤵
  PID:6196
- C:\Windows\System\bnSKyAg.exe
  C:\Windows\System\bnSKyAg.exe
  2⤵
  PID:8800
- C:\Windows\System\HTaZqzI.exe
  C:\Windows\System\HTaZqzI.exe
  2⤵
  PID:9020
- C:\Windows\System\mmCvDph.exe
  C:\Windows\System\mmCvDph.exe
  2⤵
  PID:9248
- C:\Windows\System\eLVGWBX.exe
  C:\Windows\System\eLVGWBX.exe
  2⤵
  PID:9312
- C:\Windows\System\kwSxpWM.exe
  C:\Windows\System\kwSxpWM.exe
  2⤵
  PID:9392
- C:\Windows\System\DsYbQMt.exe
  C:\Windows\System\DsYbQMt.exe
  2⤵
  PID:9708
- C:\Windows\System\pWAEMlG.exe
  C:\Windows\System\pWAEMlG.exe
  2⤵
  PID:10048
- C:\Windows\System\TtrcqUg.exe
  C:\Windows\System\TtrcqUg.exe
  2⤵
  PID:10100
- C:\Windows\System\sJnIMPL.exe
  C:\Windows\System\sJnIMPL.exe
  2⤵
  PID:10200
- C:\Windows\System\cQsOWKc.exe
  C:\Windows\System\cQsOWKc.exe
  2⤵
  PID:8448
- C:\Windows\System\SWcwbkA.exe
  C:\Windows\System\SWcwbkA.exe
  2⤵
  PID:1728
- C:\Windows\System\EmqaacK.exe
  C:\Windows\System\EmqaacK.exe
  2⤵
  PID:5560
- C:\Windows\System\ibNmUMk.exe
  C:\Windows\System\ibNmUMk.exe
  2⤵
  PID:2640
- C:\Windows\System\xSDkFgk.exe
  C:\Windows\System\xSDkFgk.exe
  2⤵
  PID:3004
- C:\Windows\System\TxkhbRt.exe
  C:\Windows\System\TxkhbRt.exe
  2⤵
  PID:4624
- C:\Windows\System\TKrJtQr.exe
  C:\Windows\System\TKrJtQr.exe
  2⤵
  PID:1380
- C:\Windows\System\QCPAjEI.exe
  C:\Windows\System\QCPAjEI.exe
  2⤵
  PID:4220
- C:\Windows\System\abygWDA.exe
  C:\Windows\System\abygWDA.exe
  2⤵
  PID:4740
- C:\Windows\System\lYsJJkw.exe
  C:\Windows\System\lYsJJkw.exe
  2⤵
  PID:3188
- C:\Windows\System\cTqxtNH.exe
  C:\Windows\System\cTqxtNH.exe
  2⤵
  PID:876
- C:\Windows\System\PkhtWbg.exe
  C:\Windows\System\PkhtWbg.exe
  2⤵
  PID:8120
- C:\Windows\System\KqEWfZd.exe
  C:\Windows\System\KqEWfZd.exe
  2⤵
  PID:3524
- C:\Windows\System\pnnIuJZ.exe
  C:\Windows\System\pnnIuJZ.exe
  2⤵
  PID:3748
- C:\Windows\System\qpveAih.exe
  C:\Windows\System\qpveAih.exe
  2⤵
  PID:8064
- C:\Windows\System\SoQtBMq.exe
  C:\Windows\System\SoQtBMq.exe
  2⤵
  PID:9576
- C:\Windows\System\kXOSoFk.exe
  C:\Windows\System\kXOSoFk.exe
  2⤵
  PID:5192
- C:\Windows\System\UHPQdcB.exe
  C:\Windows\System\UHPQdcB.exe
  2⤵
  PID:8348
- C:\Windows\System\GPUyXkV.exe
  C:\Windows\System\GPUyXkV.exe
  2⤵
  PID:6428
- C:\Windows\System\hstskTh.exe
  C:\Windows\System\hstskTh.exe
  2⤵
  PID:7928
- C:\Windows\System\qdNSgmE.exe
  C:\Windows\System\qdNSgmE.exe
  2⤵
  PID:8732
- C:\Windows\System\mZIiEdJ.exe
  C:\Windows\System\mZIiEdJ.exe
  2⤵
  PID:8004
- C:\Windows\System\aqLTbVY.exe
  C:\Windows\System\aqLTbVY.exe
  2⤵
  PID:8132
- C:\Windows\System\WAELVRt.exe
  C:\Windows\System\WAELVRt.exe
  2⤵
  PID:7252
- C:\Windows\System\kYXaOxw.exe
  C:\Windows\System\kYXaOxw.exe
  2⤵
  PID:8424
- C:\Windows\System\wPKCySs.exe
  C:\Windows\System\wPKCySs.exe
  2⤵
  PID:7156
- C:\Windows\System\WeWKdzl.exe
  C:\Windows\System\WeWKdzl.exe
  2⤵
  PID:6656
- C:\Windows\System\zbTQBLl.exe
  C:\Windows\System\zbTQBLl.exe
  2⤵
  PID:6532
- C:\Windows\System\RYrBsZY.exe
  C:\Windows\System\RYrBsZY.exe
  2⤵
  PID:6784
- C:\Windows\System\zyKITYe.exe
  C:\Windows\System\zyKITYe.exe
  2⤵
  PID:7480
- C:\Windows\System\iAHmpXS.exe
  C:\Windows\System\iAHmpXS.exe
  2⤵
  PID:7320
- C:\Windows\System\esQMLnB.exe
  C:\Windows\System\esQMLnB.exe
  2⤵
  PID:3060
- C:\Windows\System\XohdWrz.exe
  C:\Windows\System\XohdWrz.exe
  2⤵
  PID:8328
- C:\Windows\System\PfJTyux.exe
  C:\Windows\System\PfJTyux.exe
  2⤵
  PID:6308
- C:\Windows\System\gFIPsmS.exe
  C:\Windows\System\gFIPsmS.exe
  2⤵
  PID:1368
- C:\Windows\System\OrsdsEb.exe
  C:\Windows\System\OrsdsEb.exe
  2⤵
  PID:6668
- C:\Windows\System\PWpgSaU.exe
  C:\Windows\System\PWpgSaU.exe
  2⤵
  PID:7284
- C:\Windows\System\IsIaZdo.exe
  C:\Windows\System\IsIaZdo.exe
  2⤵
  PID:6452
- C:\Windows\System\DBKfKlW.exe
  C:\Windows\System\DBKfKlW.exe
  2⤵
  PID:1072
- C:\Windows\System\TlmFhgv.exe
  C:\Windows\System\TlmFhgv.exe
  2⤵
  PID:10044
- C:\Windows\System\gHVpoOP.exe
  C:\Windows\System\gHVpoOP.exe
  2⤵
  PID:7592
- C:\Windows\System\tirKwTC.exe
  C:\Windows\System\tirKwTC.exe
  2⤵
  PID:2972
- C:\Windows\System\NneaQWw.exe
  C:\Windows\System\NneaQWw.exe
  2⤵
  PID:8276
- C:\Windows\System\jNymVWB.exe
  C:\Windows\System\jNymVWB.exe
  2⤵
  PID:1604
- C:\Windows\System\fCDygQA.exe
  C:\Windows\System\fCDygQA.exe
  2⤵
  PID:5296
- C:\Windows\System\QaXvcBg.exe
  C:\Windows\System\QaXvcBg.exe
  2⤵
  PID:7772
- C:\Windows\System\qyQDBhV.exe
  C:\Windows\System\qyQDBhV.exe
  2⤵
  PID:2504
- C:\Windows\System\qwvuFKj.exe
  C:\Windows\System\qwvuFKj.exe
  2⤵
  PID:10180
- C:\Windows\System\BWjEEqJ.exe
  C:\Windows\System\BWjEEqJ.exe
  2⤵
  PID:4640
- C:\Windows\System\sHzDpNK.exe
  C:\Windows\System\sHzDpNK.exe
  2⤵
  PID:10272
- C:\Windows\System\XmuQJDi.exe
  C:\Windows\System\XmuQJDi.exe
  2⤵
  PID:3540
- C:\Windows\System\pTiiyLX.exe
  C:\Windows\System\pTiiyLX.exe
  2⤵
  PID:3348
- C:\Windows\System\CKKqavs.exe
  C:\Windows\System\CKKqavs.exe
  2⤵
  PID:1760
- C:\Windows\System\GESwrTi.exe
  C:\Windows\System\GESwrTi.exe
  2⤵
  PID:8504
- C:\Windows\System\WMVeqqI.exe
  C:\Windows\System\WMVeqqI.exe
  2⤵
  PID:4548
- C:\Windows\System\scXYsUU.exe
  C:\Windows\System\scXYsUU.exe
  2⤵
  PID:2396
- C:\Windows\System\SqcFifZ.exe
  C:\Windows\System\SqcFifZ.exe
  2⤵
  PID:8660
- C:\Windows\System\jCiWHjW.exe
  C:\Windows\System\jCiWHjW.exe
  2⤵
  PID:8980
- C:\Windows\System\NRbqToj.exe
  C:\Windows\System\NRbqToj.exe
  2⤵
  PID:9072
- C:\Windows\System\XUChqIN.exe
  C:\Windows\System\XUChqIN.exe
  2⤵
  PID:2272
- C:\Windows\System\nAYihRp.exe
  C:\Windows\System\nAYihRp.exe
  2⤵
  PID:3304
- C:\Windows\System\bRmXdFO.exe
  C:\Windows\System\bRmXdFO.exe
  2⤵
  PID:4384
- C:\Windows\System\TBDlyqV.exe
  C:\Windows\System\TBDlyqV.exe
  2⤵
  PID:8960
- C:\Windows\System\nQBgOLT.exe
  C:\Windows\System\nQBgOLT.exe
  2⤵
  PID:5908
- C:\Windows\System\FFtQGfY.exe
  C:\Windows\System\FFtQGfY.exe
  2⤵
  PID:2476
- C:\Windows\System\yrGBBAC.exe
  C:\Windows\System\yrGBBAC.exe
  2⤵
  PID:7820
- C:\Windows\System\gacaKvv.exe
  C:\Windows\System\gacaKvv.exe
  2⤵
  PID:2192
- C:\Windows\System\mlreYAL.exe
  C:\Windows\System\mlreYAL.exe
  2⤵
  PID:5228
- C:\Windows\System\MFMzLFW.exe
  C:\Windows\System\MFMzLFW.exe
  2⤵
  PID:8508
- C:\Windows\System\kjZdyUw.exe
  C:\Windows\System\kjZdyUw.exe
  2⤵
  PID:9324
- C:\Windows\System\eDJfDmi.exe
  C:\Windows\System\eDJfDmi.exe
  2⤵
  PID:10812
- C:\Windows\System\glwQpFZ.exe
  C:\Windows\System\glwQpFZ.exe
  2⤵
  PID:9520
- C:\Windows\System\saQBFKi.exe
  C:\Windows\System\saQBFKi.exe
  2⤵
  PID:9560
- C:\Windows\System\tIpvRPO.exe
  C:\Windows\System\tIpvRPO.exe
  2⤵
  PID:9504
- C:\Windows\System\jecyjrU.exe
  C:\Windows\System\jecyjrU.exe
  2⤵
  PID:10944
- C:\Windows\System\xOubfgf.exe
  C:\Windows\System\xOubfgf.exe
  2⤵
  PID:10988
- C:\Windows\System\eIJscDi.exe
  C:\Windows\System\eIJscDi.exe
  2⤵
  PID:1204
- C:\Windows\System\yyUHHcY.exe
  C:\Windows\System\yyUHHcY.exe
  2⤵
  PID:3584
- C:\Windows\System\lfThAuD.exe
  C:\Windows\System\lfThAuD.exe
  2⤵
  PID:9908
- C:\Windows\System\DhZjaju.exe
  C:\Windows\System\DhZjaju.exe
  2⤵
  PID:10052
- C:\Windows\System\SnCPujD.exe
  C:\Windows\System\SnCPujD.exe
  2⤵
  PID:4132
- C:\Windows\System\cECkfup.exe
  C:\Windows\System\cECkfup.exe
  2⤵
  PID:10292
- C:\Windows\System\HVAJYDp.exe
  C:\Windows\System\HVAJYDp.exe
  2⤵
  PID:9728
- C:\Windows\System\fuvoHph.exe
  C:\Windows\System\fuvoHph.exe
  2⤵
  PID:4968
- C:\Windows\System\LdSPNQi.exe
  C:\Windows\System\LdSPNQi.exe
  2⤵
  PID:9260
- C:\Windows\System\ToWLDpy.exe
  C:\Windows\System\ToWLDpy.exe
  2⤵
  PID:632
- C:\Windows\System\mGGNGpe.exe
  C:\Windows\System\mGGNGpe.exe
  2⤵
  PID:7924
- C:\Windows\System\LTMwXdp.exe
  C:\Windows\System\LTMwXdp.exe
  2⤵
  PID:5100
- C:\Windows\System\HlHdKEk.exe
  C:\Windows\System\HlHdKEk.exe
  2⤵
  PID:10220
- C:\Windows\System\pjlEMcU.exe
  C:\Windows\System\pjlEMcU.exe
  2⤵
  PID:10436
- C:\Windows\System\PDXzBEu.exe
  C:\Windows\System\PDXzBEu.exe
  2⤵
  PID:524
- C:\Windows\System\nwLtgaU.exe
  C:\Windows\System\nwLtgaU.exe
  2⤵
  PID:3516
- C:\Windows\System\ZOmXuew.exe
  C:\Windows\System\ZOmXuew.exe
  2⤵
  PID:4404
- C:\Windows\System\gDSVZHc.exe
  C:\Windows\System\gDSVZHc.exe
  2⤵
  PID:3520
- C:\Windows\System\Criaeyo.exe
  C:\Windows\System\Criaeyo.exe
  2⤵
  PID:2868
- C:\Windows\System\jUeqMEH.exe
  C:\Windows\System\jUeqMEH.exe
  2⤵
  PID:9556
- C:\Windows\System\FWNbYxY.exe
  C:\Windows\System\FWNbYxY.exe
  2⤵
  PID:9740
- C:\Windows\System\RmjBfUh.exe
  C:\Windows\System\RmjBfUh.exe
  2⤵
  PID:6260
- C:\Windows\System\rfpWJQC.exe
  C:\Windows\System\rfpWJQC.exe
  2⤵
  PID:8180
- C:\Windows\System\tPnfMLR.exe
  C:\Windows\System\tPnfMLR.exe
  2⤵
  PID:10448
- C:\Windows\System\AiMwQiQ.exe
  C:\Windows\System\AiMwQiQ.exe
  2⤵
  PID:7836
- C:\Windows\System\ziqfjWc.exe
  C:\Windows\System\ziqfjWc.exe
  2⤵
  PID:8652
- C:\Windows\System\JAkDrlY.exe
  C:\Windows\System\JAkDrlY.exe
  2⤵
  PID:10524
- C:\Windows\System\YnyZDlD.exe
  C:\Windows\System\YnyZDlD.exe
  2⤵
  PID:2932
- C:\Windows\System\JQdkQkM.exe
  C:\Windows\System\JQdkQkM.exe
  2⤵
  PID:2956
- C:\Windows\System\WJrEKiY.exe
  C:\Windows\System\WJrEKiY.exe
  2⤵
  PID:1200
- C:\Windows\System\qOrgTee.exe
  C:\Windows\System\qOrgTee.exe
  2⤵
  PID:6392
- C:\Windows\System\SjPwYgB.exe
  C:\Windows\System\SjPwYgB.exe
  2⤵
  PID:11124
- C:\Windows\System\XTCjClt.exe
  C:\Windows\System\XTCjClt.exe
  2⤵
  PID:8924
- C:\Windows\System\PvblxWq.exe
  C:\Windows\System\PvblxWq.exe
  2⤵
  PID:11276
- C:\Windows\System\RzfqvVr.exe
  C:\Windows\System\RzfqvVr.exe
  2⤵
  PID:9616
- C:\Windows\System\aeNGQjN.exe
  C:\Windows\System\aeNGQjN.exe
  2⤵
  PID:10236
- C:\Windows\System\sLiZohx.exe
  C:\Windows\System\sLiZohx.exe
  2⤵
  PID:8208
- C:\Windows\System\mlThvuP.exe
  C:\Windows\System\mlThvuP.exe
  2⤵
  PID:11356
- C:\Windows\System\ralRuNw.exe
  C:\Windows\System\ralRuNw.exe
  2⤵
  PID:11464
- C:\Windows\System\WTasWFS.exe
  C:\Windows\System\WTasWFS.exe
  2⤵
  PID:10244
- C:\Windows\System\SocgqfY.exe
  C:\Windows\System\SocgqfY.exe
  2⤵
  PID:11656
- C:\Windows\System\EqgphXQ.exe
  C:\Windows\System\EqgphXQ.exe
  2⤵
  PID:8124
- C:\Windows\System\AKNuDwT.exe
  C:\Windows\System\AKNuDwT.exe
  2⤵
  PID:11692
- C:\Windows\System\eKKUcrb.exe
  C:\Windows\System\eKKUcrb.exe
  2⤵
  PID:11724
- C:\Windows\System\HsWPmBs.exe
  C:\Windows\System\HsWPmBs.exe
  2⤵
  PID:8736
- C:\Windows\System\RxMRLte.exe
  C:\Windows\System\RxMRLte.exe
  2⤵
  PID:3580
- C:\Windows\System\XCPLVSt.exe
  C:\Windows\System\XCPLVSt.exe
  2⤵
  PID:5300
- C:\Windows\System\MpCrYwd.exe
  C:\Windows\System\MpCrYwd.exe
  2⤵
  PID:5320
- C:\Windows\System\wJasgZJ.exe
  C:\Windows\System\wJasgZJ.exe
  2⤵
  PID:3908
- C:\Windows\System\XAsXIjX.exe
  C:\Windows\System\XAsXIjX.exe
  2⤵
  PID:5380
- C:\Windows\System\HicQlFy.exe
  C:\Windows\System\HicQlFy.exe
  2⤵
  PID:2744
- C:\Windows\System\TxcLOOf.exe
  C:\Windows\System\TxcLOOf.exe
  2⤵
  PID:8528
- C:\Windows\System\UfljyuV.exe
  C:\Windows\System\UfljyuV.exe
  2⤵
  PID:9224
- C:\Windows\System\SzdYBUA.exe
  C:\Windows\System\SzdYBUA.exe
  2⤵
  PID:12004
- C:\Windows\System\meaPvEy.exe
  C:\Windows\System\meaPvEy.exe
  2⤵
  PID:12048
- C:\Windows\System\YSUCRuV.exe
  C:\Windows\System\YSUCRuV.exe
  2⤵
  PID:9356
- C:\Windows\System\QJcpEPr.exe
  C:\Windows\System\QJcpEPr.exe
  2⤵
  PID:5536
- C:\Windows\System\kIGWayd.exe
  C:\Windows\System\kIGWayd.exe
  2⤵
  PID:9552
- C:\Windows\System\PDQZnEq.exe
  C:\Windows\System\PDQZnEq.exe
  2⤵
  PID:2412
- C:\Windows\System\aGTcJNJ.exe
  C:\Windows\System\aGTcJNJ.exe
  2⤵
  PID:1152
- C:\Windows\System\AkCnBnF.exe
  C:\Windows\System\AkCnBnF.exe
  2⤵
  PID:11016
- C:\Windows\System\mtjkoSv.exe
  C:\Windows\System\mtjkoSv.exe
  2⤵
  PID:12264
- C:\Windows\System\RcFMJIn.exe
  C:\Windows\System\RcFMJIn.exe
  2⤵
  PID:5708
- C:\Windows\System\qEbBAXI.exe
  C:\Windows\System\qEbBAXI.exe
  2⤵
  PID:9764
- C:\Windows\System\CgDRzIv.exe
  C:\Windows\System\CgDRzIv.exe
  2⤵
  PID:5732
- C:\Windows\System\JpObIAy.exe
  C:\Windows\System\JpObIAy.exe
  2⤵
  PID:10020
- C:\Windows\System\FjxTCxZ.exe
  C:\Windows\System\FjxTCxZ.exe
  2⤵
  PID:11340
- C:\Windows\System\lcbhxfi.exe
  C:\Windows\System\lcbhxfi.exe
  2⤵
  PID:9408
- C:\Windows\System\TQFqIwE.exe
  C:\Windows\System\TQFqIwE.exe
  2⤵
  PID:5832
- C:\Windows\System\xLGXsMl.exe
  C:\Windows\System\xLGXsMl.exe
  2⤵
  PID:4708
- C:\Windows\System\GToBCYb.exe
  C:\Windows\System\GToBCYb.exe
  2⤵
  PID:11636
- C:\Windows\System\skAAfGz.exe
  C:\Windows\System\skAAfGz.exe
  2⤵
  PID:9856
- C:\Windows\System\BzYysBQ.exe
  C:\Windows\System\BzYysBQ.exe
  2⤵
  PID:5904
- C:\Windows\System\OjcePmI.exe
  C:\Windows\System\OjcePmI.exe
  2⤵
  PID:10064
- C:\Windows\System\mBrbHtL.exe
  C:\Windows\System\mBrbHtL.exe
  2⤵
  PID:11840
- C:\Windows\System\dNxRVMY.exe
  C:\Windows\System\dNxRVMY.exe
  2⤵
  PID:5988
- C:\Windows\System\cZbufyO.exe
  C:\Windows\System\cZbufyO.exe
  2⤵
  PID:2516
- C:\Windows\System\wtGixyA.exe
  C:\Windows\System\wtGixyA.exe
  2⤵
  PID:5124
- C:\Windows\System\iBAsZGY.exe
  C:\Windows\System\iBAsZGY.exe
  2⤵
  PID:1424
- C:\Windows\System\CdbTQyU.exe
  C:\Windows\System\CdbTQyU.exe
  2⤵
  PID:12180
- C:\Windows\System\mbzxzak.exe
  C:\Windows\System\mbzxzak.exe
  2⤵
  PID:6056
- C:\Windows\System\oQhEgoc.exe
  C:\Windows\System\oQhEgoc.exe
  2⤵
  PID:11072
- C:\Windows\System\HDiBnYF.exe
  C:\Windows\System\HDiBnYF.exe
  2⤵
  PID:12272
- C:\Windows\System\RymXcml.exe
  C:\Windows\System\RymXcml.exe
  2⤵
  PID:648
- C:\Windows\System\GYtXHhO.exe
  C:\Windows\System\GYtXHhO.exe
  2⤵
  PID:6640
- C:\Windows\System\bvDynas.exe
  C:\Windows\System\bvDynas.exe
  2⤵
  PID:10712
- C:\Windows\System\VJkyqkY.exe
  C:\Windows\System\VJkyqkY.exe
  2⤵
  PID:7432
- C:\Windows\System\bzWeOAl.exe
  C:\Windows\System\bzWeOAl.exe
  2⤵
  PID:5172
- C:\Windows\System\KMszMdT.exe
  C:\Windows\System\KMszMdT.exe
  2⤵
  PID:8808
- C:\Windows\System\MzjskVq.exe
  C:\Windows\System\MzjskVq.exe
  2⤵
  PID:3228
- C:\Windows\System\TwNOjtl.exe
  C:\Windows\System\TwNOjtl.exe
  2⤵
  PID:11076
- C:\Windows\System\RHUIBef.exe
  C:\Windows\System\RHUIBef.exe
  2⤵
  PID:9796
- C:\Windows\System\RYVRcva.exe
  C:\Windows\System\RYVRcva.exe
  2⤵
  PID:6368
- C:\Windows\System\XZsYXhl.exe
  C:\Windows\System\XZsYXhl.exe
  2⤵
  PID:12128
- C:\Windows\System\lRpDIAm.exe
  C:\Windows\System\lRpDIAm.exe
  2⤵
  PID:12240
- C:\Windows\System\ctPzARP.exe
  C:\Windows\System\ctPzARP.exe
  2⤵
  PID:6132
- C:\Windows\System\TuzonvW.exe
  C:\Windows\System\TuzonvW.exe
  2⤵
  PID:2356
- C:\Windows\System\CIKDzZr.exe
  C:\Windows\System\CIKDzZr.exe
  2⤵
  PID:4668
- C:\Windows\System\RCEQvQZ.exe
  C:\Windows\System\RCEQvQZ.exe
  2⤵
  PID:11436
- C:\Windows\System\uOMUHpS.exe
  C:\Windows\System\uOMUHpS.exe
  2⤵
  PID:8308
- C:\Windows\System\DstIZbO.exe
  C:\Windows\System\DstIZbO.exe
  2⤵
  PID:11312
- C:\Windows\System\YqwWPil.exe
  C:\Windows\System\YqwWPil.exe
  2⤵
  PID:11364
- C:\Windows\System\eCasdps.exe
  C:\Windows\System\eCasdps.exe
  2⤵
  PID:11452
- C:\Windows\System\nvtQSEH.exe
  C:\Windows\System\nvtQSEH.exe
  2⤵
  PID:9892
- C:\Windows\System\OLfZAef.exe
  C:\Windows\System\OLfZAef.exe
  2⤵
  PID:10260
- C:\Windows\System\JFeITNn.exe
  C:\Windows\System\JFeITNn.exe
  2⤵
  PID:12380
- C:\Windows\System\aqDZECW.exe
  C:\Windows\System\aqDZECW.exe
  2⤵
  PID:10300
- C:\Windows\System\BTOsDnK.exe
  C:\Windows\System\BTOsDnK.exe
  2⤵
  PID:11700
- C:\Windows\System\crIOvSp.exe
  C:\Windows\System\crIOvSp.exe
  2⤵
  PID:11740
- C:\Windows\System\ECQuRLe.exe
  C:\Windows\System\ECQuRLe.exe
  2⤵
  PID:5540
- C:\Windows\System\oQUiAhE.exe
  C:\Windows\System\oQUiAhE.exe
  2⤵
  PID:1324
- C:\Windows\System\keZCKWS.exe
  C:\Windows\System\keZCKWS.exe
  2⤵
  PID:12528
- C:\Windows\System\RcqtHKN.exe
  C:\Windows\System\RcqtHKN.exe
  2⤵
  PID:11860
- C:\Windows\System\iHNUKnF.exe
  C:\Windows\System\iHNUKnF.exe
  2⤵
  PID:8360
- C:\Windows\System\hqTfjsv.exe
  C:\Windows\System\hqTfjsv.exe
  2⤵
  PID:9288
- C:\Windows\System\LNwCVqn.exe
  C:\Windows\System\LNwCVqn.exe
  2⤵
  PID:5512
- C:\Windows\System\ShRDfWA.exe
  C:\Windows\System\ShRDfWA.exe
  2⤵
  PID:12072
- C:\Windows\System\fRprEBN.exe
  C:\Windows\System\fRprEBN.exe
  2⤵
  PID:5640
- C:\Windows\System\jmUmJHf.exe
  C:\Windows\System\jmUmJHf.exe
  2⤵
  PID:12644
- C:\Windows\System\BMBMvdk.exe
  C:\Windows\System\BMBMvdk.exe
  2⤵
  PID:9476
- C:\Windows\System\kIBxjMg.exe
  C:\Windows\System\kIBxjMg.exe
  2⤵
  PID:12688
- C:\Windows\System\mGzYKeo.exe
  C:\Windows\System\mGzYKeo.exe
  2⤵
  PID:12708
- C:\Windows\System\LoVOuWJ.exe
  C:\Windows\System\LoVOuWJ.exe
  2⤵
  PID:11292
- C:\Windows\System\vyQSDGB.exe
  C:\Windows\System\vyQSDGB.exe
  2⤵
  PID:9972
- C:\Windows\System\zfzaFqK.exe
  C:\Windows\System\zfzaFqK.exe
  2⤵
  PID:5820
- C:\Windows\System\EEjUWGY.exe
  C:\Windows\System\EEjUWGY.exe
  2⤵
  PID:12796
- C:\Windows\System\RPDcwbw.exe
  C:\Windows\System\RPDcwbw.exe
  2⤵
  PID:11572
- C:\Windows\System\mWvFXZG.exe
  C:\Windows\System\mWvFXZG.exe
  2⤵
  PID:5900
- C:\Windows\System\KZfQZyQ.exe
  C:\Windows\System\KZfQZyQ.exe
  2⤵
  PID:5836
- C:\Windows\System\TkXhWSx.exe
  C:\Windows\System\TkXhWSx.exe
  2⤵
  PID:2324
- C:\Windows\System\OpgVspf.exe
  C:\Windows\System\OpgVspf.exe
  2⤵
  PID:3660
- C:\Windows\System\oIXBWqG.exe
  C:\Windows\System\oIXBWqG.exe
  2⤵
  PID:11916
- C:\Windows\System\jlHpnir.exe
  C:\Windows\System\jlHpnir.exe
  2⤵
  PID:11896
- C:\Windows\System\KxwBvDQ.exe
  C:\Windows\System\KxwBvDQ.exe
  2⤵
  PID:13056
- C:\Windows\System\QxTWxUu.exe
  C:\Windows\System\QxTWxUu.exe
  2⤵
  PID:8032
- C:\Windows\System\fddiQEe.exe
  C:\Windows\System\fddiQEe.exe
  2⤵
  PID:9540
- C:\Windows\System\DjdouSZ.exe
  C:\Windows\System\DjdouSZ.exe
  2⤵
  PID:6440
- C:\Windows\System\wumZXBg.exe
  C:\Windows\System\wumZXBg.exe
  2⤵
  PID:11184
- C:\Windows\System\fSpXLZk.exe
  C:\Windows\System\fSpXLZk.exe
  2⤵
  PID:10412
- C:\Windows\System\MtMMxQi.exe
  C:\Windows\System\MtMMxQi.exe
  2⤵
  PID:6988
- C:\Windows\System\TOebQFd.exe
  C:\Windows\System\TOebQFd.exe
  2⤵
  PID:6316
- C:\Windows\System\WNdvgQA.exe
  C:\Windows\System\WNdvgQA.exe
  2⤵
  PID:13292
- C:\Windows\System\kTMrKPI.exe
  C:\Windows\System\kTMrKPI.exe
  2⤵
  PID:12316
- C:\Windows\System\rCOeBNO.exe
  C:\Windows\System\rCOeBNO.exe
  2⤵
  PID:1960
- C:\Windows\System\oFVpHfk.exe
  C:\Windows\System\oFVpHfk.exe
  2⤵
  PID:7500
- C:\Windows\System\fVAAbTi.exe
  C:\Windows\System\fVAAbTi.exe
  2⤵
  PID:11660
- C:\Windows\System\BKoTWXV.exe
  C:\Windows\System\BKoTWXV.exe
  2⤵
  PID:3804
- C:\Windows\System\gOfPmPO.exe
  C:\Windows\System\gOfPmPO.exe
  2⤵
  PID:7700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5plau053.amu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AiOVaur.exe

Filesize
2.1MB

MD5
4c4c1e79319b2a3ff135cdd69c2b2749

SHA1
edbc179165a58bde3950278059453c5068005495

SHA256
66f5731a8ab535d951e36a0d01b786e7b0a71518afc44f3f112bbc658dd4b341

SHA512
d5b50f32d726de6f0d117e72ebe365bac933e73e2a7eb6030d798a2cf95db85f997dae4f0c62d120bbf831a751fb7c1b085adfaacabf24c5fe9dccc4098a35ea

Download Submit
C:\Windows\System\AmZfiVr.exe

Filesize
2.1MB

MD5
411e03661044fbfdca990ed015686c01

SHA1
833329311e8565156526bd91fb2b3a3de819430d

SHA256
4edcdd20f8828f11d11558c38f093e8150f4055a4377bc0d800279374e23a733

SHA512
c7468aac98ef3a017c829ab3c45b24c525d5aa6de6971aedd14a914dcb33ee495bed29aab1ff50446d439e50694cbeefdfa77a31cc6c626d577f6bc0623f4f27

Download Submit
C:\Windows\System\AoHUSQL.exe

Filesize
2.1MB

MD5
f3d1df31489e948c1b696914933668cd

SHA1
8625108ec24242f3c3815f7c9f3cc516ad8d1afd

SHA256
930b7ee96f4b57c3f68e75a1a1556683aee32420b981bba40190d5895c7a1363

SHA512
313301a16633d059639855ca1bb96fa15e41dbb067dc992a1c1cdf428c7dd8b4f27f595cd54829e76ff48f5b5ae5f1459c3aa80e2f930073d4d16b7a284edc3e

Download Submit
C:\Windows\System\BlhRcQx.exe

Filesize
2.1MB

MD5
157eaa56bdab6ad9c2ef68e988bb3328

SHA1
baca2e7a4962ec31b778d3c16ea667feb9163161

SHA256
f884eec9478146565405c5b4b81607635a14deae8c1e5b547abd4ff347fc6581

SHA512
8c343eaa821432ea7eb243ba03af196565a4034dbd592b16cf15bddc347fb22e36ea99eb9f8cc69bd0396f6573c70095460379a9da1eaf6c8709d96245540432

Download Submit
C:\Windows\System\CcFzciI.exe

Filesize
2.1MB

MD5
66c0becf48a06f6f8390d19f908eb0b7

SHA1
529dd537a31883fc836901f82bb0964e6da2d0d6

SHA256
077fab3cfe8bf6b7e4151aeb9da4462b73151b89c8799ac916a7162f0604eec8

SHA512
9a5770bb4abb6c72ede4bfaa1e5599f3647a407f1f5357e6787b01c52222e5abd8d077b77ba9e5c37bf8d91bf75189d7f99662d1fe67b49c7ec15e131e1b4581

Download Submit
C:\Windows\System\FHMouYj.exe

Filesize
2.1MB

MD5
94844b2d1dcb4a1b6b644776354bfb97

SHA1
8c5dadd2de31b02c33b3defc525b860b4821c5a5

SHA256
c2ccbf4c7c73300a2b80ff16a68f316497daf4f2bf4f1f2603d825d4012038a6

SHA512
46117137b211e013783d2dbf4ad91bcd84325109ecc6823302aecae55c6d15df7ec02129776bdfb565d5a71fbca9d767cbb0267bc2a4f0c636af62a7190f8dc3

Download Submit
C:\Windows\System\IDTpCay.exe

Filesize
2.1MB

MD5
98c6e1afb46ab5fbdd821687c7355205

SHA1
8bf6eb2b975d888919942eabd4f6f614faae94e7

SHA256
760f2d684dccaa51900a3ef8d4ffbec9f02968caa6ef54975e2505f5ab76a0d8

SHA512
1bd6aaec72dfafb229982facba2b3667427b8fd04e089185533181e51d3d1d68cecbc48eb7905f9b7cd0240b9bd85a26d4c4f0ded998f270606b9c9a03d7c097

Download Submit
C:\Windows\System\JDeWYyl.exe

Filesize
2.1MB

MD5
61dce80b4c5622a331e48d5c4d9e5e8f

SHA1
07eb35d2aab5e8fe70e3d0a6c5df1a785b55db3d

SHA256
0e6b3efaec509b4d83ab7527f884cd496ca841fc7a70520db0f690e7f77aecb3

SHA512
10c0ff0c402f3bdde54bb5e1a42e2b811d7f3e7bf8894fe9e3b714f90f7ff136dd0961a58b4858928af9b7880719670b1f8a72deee6d908126952f5ec561f7df

Download Submit
C:\Windows\System\JInxgPb.exe

Filesize
2.1MB

MD5
0d59195cc36d72e8f04f5922610bcbf4

SHA1
ce2b2153ecee8a6298e26942e8c4ab00c3a272ec

SHA256
bfaf16e2da3b4a935b8fbee9fa87976d4224fc56299d4bb0acc4d164ec90dd75

SHA512
7280118c484ba6439a2f72f9d4ecb83bab077a5c5aa857391a3bd0b129394db010f3c0c27c6d39b1b90a86af2b31e10e37bbc1ee7c1b1df1b645ffdbdff0cba2

Download Submit
C:\Windows\System\LWDmKEP.exe

Filesize
2.1MB

MD5
8821d4bf4c73a0ae90dd77c167444fc0

SHA1
1dbb3a1ce846d238a8a04ec069735b68e0447609

SHA256
d27096005da52149c8690c8c8abf11c7480a5f49785c11e6a6092775a0507f8f

SHA512
5c2d75e7c75cf7065067ae6c0c6f2ec35f3ef071de98e5c4c5f8cb3588fe1b87728eedbcf4a17616efdf4b84eadfd3b7642bfd54f510e76f835aeaa7f2c16197

Download Submit
C:\Windows\System\MMeIuji.exe

Filesize
2.1MB

MD5
c6a9f3730285623c1438ee8463cebd6c

SHA1
92bf445389a4dc16b86e303d7f2fef00b3096542

SHA256
595451aef0160d7e249ada2844dd1b9d6f28c6df26bd0f11bfcbb47feeabbaa6

SHA512
b0307f9f860a667a78db1c2c7fb033e393778ab357e35deb7f3e58a746745a8a5be7bccdcc0a0939cdbd605fea7b603b48d815a450863292d7516ee836896f26

Download Submit
C:\Windows\System\NEaYOsI.exe

Filesize
2.1MB

MD5
a5103cd56c72cf6434c2d88372f3b1d6

SHA1
f5745dd042d811428e74ebc4e650ce24cb854a0e

SHA256
ee568d7f670f38ebd63d5c09afc50622ea07b95a4e104e66c29bcba85da78d07

SHA512
d18371cb1fa11e10150f5dfff45164951c58397ed14dbcf8079ed3eaf46fe551fb98db6a37439f49ebe5ed9bf4bd5988724fff7c966262d3bdc4f56785dbe7b4

Download Submit
C:\Windows\System\Nadjonz.exe

Filesize
2.1MB

MD5
aa57d9fc3a9e989fad2cc5a21af79cc6

SHA1
cd808575089d8e9cc8ce62c42671b6acd197a122

SHA256
db04b62287f5129b5da7b6a75f34f40a1fb0dd87f2ea0c10d2757ce39592ffb8

SHA512
69747610caf936e699f6b5c3a8ac670a641a9fa51beb12152f7fcf0138d16bfa73f696f34ae9d15c82e3518764f7f4942f83d25fcbd8e01413699acf46dfd3d0

Download Submit
C:\Windows\System\TVGIWcQ.exe

Filesize
2.1MB

MD5
b9e7e7085e5294c648bee9d51d01a0c9

SHA1
07e290d1cc79fb13b38f313c42a4546b82acc84f

SHA256
11cbd08be42c89cfbd2c422758e59ce5b1ab22d1a293bd8d68f58c937a141051

SHA512
a79cdb1e47905c7e8236abaf20a9284578af7f8e263380b4a90b8138f63c2e8e117c158dc814581216e335510b25041d3d01de24d18da28063b33f828da0ecca

Download Submit
C:\Windows\System\VacuZAZ.exe

Filesize
2.1MB

MD5
fc152fdb8fa9ea1f9406909065557c21

SHA1
6273d0c661971be3bd131e1fb9c137cd0fdcf9a6

SHA256
95f98592406555ac0090df0a74b4494dff2fc9cce2d1f5c2e4e6977a4ec21204

SHA512
a15aa78191a92e2a8839e0e2948197e4ee93672ab268dbec7f1a26d9b0207c44077144ed3549bfcd8f46093a2a0418de176197c8638d50205532e4ef4f69894f

Download Submit
C:\Windows\System\YLEENsM.exe

Filesize
2.1MB

MD5
df11ad303016251937a46eb92ead51ec

SHA1
9a75bb3c10b074c697434369bbcffbcf41e84ad3

SHA256
614c37b28089003158d18e5613fb90c15aa1e0ba4b4c33b120925dc8555b8285

SHA512
a49553f17b0fd6e0d7ae780678d63f931f6a60230a77da89d51ce3520c3d304ab82c454dc5a2bb40f725c7a36d01a1f886989789c74f2243944093acda62bf34

Download Submit
C:\Windows\System\YPbHxJH.exe

Filesize
2.1MB

MD5
55cf2d5b48e11a3cafdc64f4aa587e91

SHA1
c49e5b3512eaabb2e0e69b6ad270ad16961dbf31

SHA256
573d2d758a28b9caab91a03b78937ed4e3ab9591fa01598afed01519a0248431

SHA512
ebefdd60c60714771ae2cf05a0ffc6de0b8174956f3ca54bdd8b19a0852b242f10daab0b08cb47d3edaa16b083b138094d2261726dea5316c34cc1c6faba27b5

Download Submit
C:\Windows\System\YZtbxKW.exe

Filesize
2.1MB

MD5
1b4d1896ec54be31958c6032489bb1e7

SHA1
9d77300e8e7d736af8c5cc0cf1bca942b531ae9b

SHA256
ee649bc6067f4e3ba50b5f9cc5e4a6f65d936c9469aaa2660425ec744a092426

SHA512
4e4377c40ccef68e83193b131d5f20c2a7ce75cfb5441304be64f260c721afa93a39f172b22a47cc32506b6e987c7bab3b40da68d2317a1f0775c48e8356511e

Download Submit
C:\Windows\System\awTGEnq.exe

Filesize
2.1MB

MD5
a1b567cc0fcea9f9c6dd110654840fd2

SHA1
3cf21d100db5247aa7f941f59263626847eabe69

SHA256
c7d53254e0e18e356ac377a11191dc3f276d4f5bfcc9a3b53dfc04fd663e8408

SHA512
1d107cc2f8582cd0f2db9e0a6d937cf0dfbb383e801552eee8c21055d2dfd8799d24f13efdf063b619e1f9f70a5d4b6ade7ac772296cbfb5fca5a06b97ba48b3

Download Submit
C:\Windows\System\bslHoUK.exe

Filesize
2.1MB

MD5
1c46521b980c4eac26a01411dc8999cb

SHA1
35d6174e59f7319499a39524b260b59b316907ba

SHA256
e6149301ba79645160e6b1399d33557e925e38be1f9098ac7aad29f13423625c

SHA512
11867088b1b03047faef88fe041dce316673d291c4a3893f73b74ebe279aeced9ca5f670ab627767d2befa36677c11c812cafad2bb89d03f9b774f39ad891708

Download Submit
C:\Windows\System\bxGwceo.exe

Filesize
2.1MB

MD5
c99d9d4308a9eb1bc8494ca1f3006398

SHA1
fb8291ceb7cfb62c521a5b24f33ef674fd9561ee

SHA256
0569f2b1c52204df1170033571c4f8ad2d2a1d8848a71e4efd0532788449d94d

SHA512
cc8d7f8907305b9c78137d948fee5dad8fdb0c4a50a270680c11fdc578c230ac00eb9d7102ce4ff6d76e3b698f7b514fee746425e2644a4b50b3625c1bddcf5e

Download Submit
C:\Windows\System\eoAAhJl.exe

Filesize
2.1MB

MD5
bc6e267d080d08d2f189c7c66258970b

SHA1
6f05be3377dbdaac66fe864858559257d697cb31

SHA256
def561981bd164cbd6d30a4f38c02a660a9ffcfc25d13fc3e6178c060deabd60

SHA512
d4addb508302957df94b1ad76591c013b6773f4bdd7c1b7939ca4d938a9321a7c197a46e90a2e00decef5b89b37ed77dda5bc2939b2ac00f6bbfb2f477aff57e

Download Submit
C:\Windows\System\gYhONtC.exe

Filesize
2.1MB

MD5
9a59fd4483185d0a0ad12fe7a95f24e3

SHA1
ee6668c084fb4779c24f37b9288cc3c88e0687b2

SHA256
16701af0815d9ba7ff0baeaf573fdfbd00e25811a1907ee691762f1c82acbb53

SHA512
8488c7ebcb4846dca4de6c939c5e6557d2735c10c47a4d0db7d129b65461ca2c6d51d6761efc7680023f747ab6507e9fd2c2e613eb1fca85c5fc1e60b6de70f0

Download Submit
C:\Windows\System\hSBVtwK.exe

Filesize
2.1MB

MD5
2e6c9ccdc4c4ad3e23a99b70b60f56e5

SHA1
2e0578d3301a5bb9a99f569f1e8516a73fd2b168

SHA256
a31f927cf62a61d75487c8b346f064987430a6e1f62f7f9b21f2df62ab2393bd

SHA512
0510b2849098bcbc35439af27a7427cff0aa65ba54570b981febf2c8acc6c9deb604d9caf0e0594bfd45684114a64578fdcdaccc4e4479345d5a484f0ea26ebb

Download Submit
C:\Windows\System\iqVNnDP.exe

Filesize
2.1MB

MD5
f349b50e0ce2f748a9b64e4fdcbf105c

SHA1
79a69c54bc2cda99c341e2fa54e8a0a427bfc1af

SHA256
c2a3960e5853d71d6069dd31b93038c773eb4c9dc07a51e7ec9445d14e9a752a

SHA512
1c2129a131115f425945cab78fd384f44e60038d12e94d559cf950d33d0aa4fa83bcc347b5dbbda53d806ea22da0666b1e907c5bdfaaeaea958aab82ddb3c92d

Download Submit
C:\Windows\System\jMWQfEF.exe

Filesize
2.1MB

MD5
56c68cb65fe3e318133e965e181f7d6f

SHA1
75e3612a2c6bedaea8b4dc070a41f37611a2e456

SHA256
20e62690f409abaa3d0633834a9fd71526f7903fb6b51580a5a31f87544899b5

SHA512
b542b7d9750b4bcdff5bfeafe9d07f92e85a696e48cdec8ceaee56669bc6a9e8e80c2b4be69446f6e7697f41e78b1f1e4f80b8e3320e3fb736f316fdb31dfc92

Download Submit
C:\Windows\System\jjGIpKX.exe

Filesize
2.1MB

MD5
0b8ec0c1cbfef90b5e6a9597342a2f20

SHA1
4b38ff9fb0ce2f2bcf40a46c8046c66ad7e537d9

SHA256
65ce38a67235a102f874bd38ae4f8a5a8939d0b8bec14adde0304e129704c524

SHA512
64bbee9c6c8f51b5ac93602e3041f143a3149aa2f1c3ab3eb3282702c14c7d6c8b2a55e1ba68e4c6d1e562604e5a6994003735b1113c3065764279074123758f

Download Submit
C:\Windows\System\krrFAZe.exe

Filesize
2.1MB

MD5
13bec92dbfde88e7c03f6e250106d871

SHA1
028c9c1b70a8dd7eaa26d0fcc13719010725accb

SHA256
7c7dae247499c4ecc5fb66a738b856fa9bedfd753c761cebb1251c623de72fb9

SHA512
9f2ee5ded008bb29d15deeba25c2f371e640fb8713320d118726cc2c43c49a893ba05f5116340f20dfdda3ca7f664397cdf97f4387e3d7616de38360503f26d9

Download Submit
C:\Windows\System\oJmYYME.exe

Filesize
2.1MB

MD5
9abbfebaede845c5ae7dfa006114175b

SHA1
b89215c3d9341089f517d54f93488f55d8f0dc48

SHA256
d80a0ec0fb07129854ea3e26dc3275be4701a8e124c09945f6dff67d9b02b31e

SHA512
31d7ad736979dc023f8eeaf2bdc812a72cd2de99192ac38acdc8e0705f68bd2a7b6a7fee5b4ffd8027b89df4364e85940f6554e144a000781c72a630d0bc43f0

Download Submit
C:\Windows\System\qElXzdA.exe

Filesize
2.1MB

MD5
5579f846a2e21f69bfacec026fc37955

SHA1
55cc26cf7b52979aebe1881616c1d02dbbaff6b0

SHA256
1457719d8f63dbb7d3f54b038ad8eee6a44b352e8043d25a5b1dcb0349b1fe2f

SHA512
b13b2318f5634e7ac0156065d90d82d71a4fc5e3e1bf859eda8eff344a195e48688226b61afb59c2d1828448ccb18c4302204ffd5253b03c982dfd8d5fb94d5a

Download Submit
C:\Windows\System\rZVRQdz.exe

Filesize
2.1MB

MD5
64363839445fc72a78a7a29413adbc85

SHA1
bf9fb9ffc94aa48a0d593badfe3f919be8710ee3

SHA256
a8ec2fbe79bfd7eaa6c5530713011ca29b2a06255a183799c911925816aa6a16

SHA512
311dc22fc35b27520ca0f3b31273d7d5f23f25ffd89dd75a70e3ca36263153582ee5f93b29ccd8447062d8998f4fd686460da5b98fc8b1965bb5ddac128125d6

Download Submit
C:\Windows\System\uOnZJCR.exe

Filesize
2.1MB

MD5
5b70753efe48161e087376b6c2911edc

SHA1
965e1bbcf24ef1850e2696afb2cac84563ae0876

SHA256
1208a4df9b8e315ba5d6185109dfcd21d15a52ceec0795fbac2ccc0044d36207

SHA512
995ffbaf99a846736328d28193acfe7554e138ddb8d6276202eee2e5fa5a09f8e848c9e6b94f4ac8aea182ca61cf10794e15c8631bb7c443356a07d054cbf45b

Download Submit
C:\Windows\System\uSKizOg.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\vGTjKCp.exe

Filesize
2.1MB

MD5
dc30c57e98d42c98c851f0d7f2967970

SHA1
ad09d9889185938ac5eeb112335f8231e1a3cd90

SHA256
b5a3fc78b1e29a0c81b693dc433d33531fa375db3a6f19c7b6d599a431da5e6a

SHA512
ec6886f8c48ba4b33ddc31843bf83fb766b8f722e242e6336394e82476694146a61200fdfc0d409ce1005593601a07ee3b222306876ed089a846811c756e3b81

Download Submit
memory/744-339-0x0000021378920000-0x00000213790C6000-memory.dmp

Filesize
7.6MB

Download
memory/744-72-0x0000021375C40000-0x0000021375C50000-memory.dmp

Filesize
64KB

Download
memory/744-97-0x0000021377DF0000-0x0000021377E12000-memory.dmp

Filesize
136KB

Download
memory/744-2671-0x00007FFD8FE60000-0x00007FFD90921000-memory.dmp

Filesize
10.8MB

Download
memory/744-65-0x00007FFD8FE60000-0x00007FFD90921000-memory.dmp

Filesize
10.8MB

Download
memory/744-73-0x0000021375C40000-0x0000021375C50000-memory.dmp

Filesize
64KB

Download
memory/996-1470-0x00007FF6F5570000-0x00007FF6F5962000-memory.dmp

Filesize
3.9MB

Download
memory/996-0-0x00007FF6F5570000-0x00007FF6F5962000-memory.dmp

Filesize
3.9MB

Download
memory/996-1-0x000002130DD00000-0x000002130DD10000-memory.dmp

Filesize
64KB

Download
memory/1060-2682-0x00007FF69DAD0000-0x00007FF69DEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1060-79-0x00007FF69DAD0000-0x00007FF69DEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1428-2567-0x00007FF686CC0000-0x00007FF6870B2000-memory.dmp

Filesize
3.9MB

Download
memory/1428-130-0x00007FF686CC0000-0x00007FF6870B2000-memory.dmp

Filesize
3.9MB

Download
memory/1428-2898-0x00007FF686CC0000-0x00007FF6870B2000-memory.dmp

Filesize
3.9MB

Download
memory/1512-2677-0x00007FF62DF50000-0x00007FF62E342000-memory.dmp

Filesize
3.9MB

Download
memory/1512-84-0x00007FF62DF50000-0x00007FF62E342000-memory.dmp

Filesize
3.9MB

Download
memory/1700-80-0x00007FF75D830000-0x00007FF75DC22000-memory.dmp

Filesize
3.9MB

Download
memory/1700-2681-0x00007FF75D830000-0x00007FF75DC22000-memory.dmp

Filesize
3.9MB

Download
memory/1736-2551-0x00007FF721150000-0x00007FF721542000-memory.dmp

Filesize
3.9MB

Download
memory/1736-2903-0x00007FF721150000-0x00007FF721542000-memory.dmp

Filesize
3.9MB

Download
memory/1736-125-0x00007FF721150000-0x00007FF721542000-memory.dmp

Filesize
3.9MB

Download
memory/1856-3147-0x00007FF72D060000-0x00007FF72D452000-memory.dmp

Filesize
3.9MB

Download
memory/1856-131-0x00007FF72D060000-0x00007FF72D452000-memory.dmp

Filesize
3.9MB

Download
memory/1856-2568-0x00007FF72D060000-0x00007FF72D452000-memory.dmp

Filesize
3.9MB

Download
memory/2484-122-0x00007FF77A6D0000-0x00007FF77AAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-2892-0x00007FF77A6D0000-0x00007FF77AAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-77-0x00007FF7137F0000-0x00007FF713BE2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-2667-0x00007FF7137F0000-0x00007FF713BE2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-104-0x00007FF6C4510000-0x00007FF6C4902000-memory.dmp

Filesize
3.9MB

Download
memory/2800-2880-0x00007FF6C4510000-0x00007FF6C4902000-memory.dmp

Filesize
3.9MB

Download
memory/2920-83-0x00007FF7D65C0000-0x00007FF7D69B2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-2659-0x00007FF7D65C0000-0x00007FF7D69B2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-2907-0x00007FF685AE0000-0x00007FF685ED2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-338-0x00007FF685AE0000-0x00007FF685ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4016-2888-0x00007FF76D900000-0x00007FF76DCF2000-memory.dmp

Filesize
3.9MB

Download
memory/4016-123-0x00007FF76D900000-0x00007FF76DCF2000-memory.dmp

Filesize
3.9MB

Download
memory/4168-85-0x00007FF7D9A60000-0x00007FF7D9E52000-memory.dmp

Filesize
3.9MB

Download
memory/4168-2169-0x00007FF7D9A60000-0x00007FF7D9E52000-memory.dmp

Filesize
3.9MB

Download
memory/4168-2872-0x00007FF7D9A60000-0x00007FF7D9E52000-memory.dmp

Filesize
3.9MB

Download
memory/4228-2640-0x00007FF78A460000-0x00007FF78A852000-memory.dmp

Filesize
3.9MB

Download
memory/4228-27-0x00007FF78A460000-0x00007FF78A852000-memory.dmp

Filesize
3.9MB

Download
memory/4348-1941-0x00007FF6F4BF0000-0x00007FF6F4FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-2652-0x00007FF6F4BF0000-0x00007FF6F4FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-39-0x00007FF6F4BF0000-0x00007FF6F4FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4416-2648-0x00007FF71A740000-0x00007FF71AB32000-memory.dmp

Filesize
3.9MB

Download
memory/4416-71-0x00007FF71A740000-0x00007FF71AB32000-memory.dmp

Filesize
3.9MB

Download
memory/4500-2684-0x00007FF67D160000-0x00007FF67D552000-memory.dmp

Filesize
3.9MB

Download
memory/4500-78-0x00007FF67D160000-0x00007FF67D552000-memory.dmp

Filesize
3.9MB

Download
memory/4788-2679-0x00007FF727510000-0x00007FF727902000-memory.dmp

Filesize
3.9MB

Download
memory/4788-81-0x00007FF727510000-0x00007FF727902000-memory.dmp

Filesize
3.9MB

Download
memory/4812-2631-0x00007FF6595E0000-0x00007FF6599D2000-memory.dmp

Filesize
3.9MB

Download
memory/4812-12-0x00007FF6595E0000-0x00007FF6599D2000-memory.dmp

Filesize
3.9MB

Download
memory/4888-2657-0x00007FF7790C0000-0x00007FF7794B2000-memory.dmp

Filesize
3.9MB

Download
memory/4888-28-0x00007FF7790C0000-0x00007FF7794B2000-memory.dmp

Filesize
3.9MB

Download
memory/5088-2870-0x00007FF61BF80000-0x00007FF61C372000-memory.dmp

Filesize
3.9MB

Download
memory/5088-82-0x00007FF61BF80000-0x00007FF61C372000-memory.dmp

Filesize
3.9MB

Download
memory/5088-2166-0x00007FF61BF80000-0x00007FF61C372000-memory.dmp

Filesize
3.9MB

Download