xmrig | c1b016ab17b62cb2bb64cf462853a1f3cb3a53206714f06dd6e1dc9f22def01d

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
Size

2.3MB
MD5

00bd07546d0f5634f9028ba57e0696b3
SHA1

4b72270af7c4b500cf157e3f4d48acc7a408e806
SHA256

c1b016ab17b62cb2bb64cf462853a1f3cb3a53206714f06dd6e1dc9f22def01d
SHA512

687b46346b56b4c207c9f6ce20c23cb469ac5f6ee11f418128527704f02888dd03687c32f00668f28289df28ef6a6a110d6938f1cfb51fa0a946d4fc61ed61cd
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqL:NAB8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 31 IoCs

miner

resource	yara_rule
behavioral2/memory/4440-252-0x00007FF7CB010000-0x00007FF7CB402000-memory.dmp	xmrig
behavioral2/memory/716-258-0x00007FF7862D0000-0x00007FF7866C2000-memory.dmp	xmrig
behavioral2/memory/5068-257-0x00007FF799100000-0x00007FF7994F2000-memory.dmp	xmrig
behavioral2/memory/3948-308-0x00007FF796460000-0x00007FF796852000-memory.dmp	xmrig
behavioral2/memory/3180-332-0x00007FF7DD250000-0x00007FF7DD642000-memory.dmp	xmrig
behavioral2/memory/4416-335-0x00007FF7E5610000-0x00007FF7E5A02000-memory.dmp	xmrig
behavioral2/memory/916-331-0x00007FF7D9290000-0x00007FF7D9682000-memory.dmp	xmrig
behavioral2/memory/1008-256-0x00007FF61E970000-0x00007FF61ED62000-memory.dmp	xmrig
behavioral2/memory/720-255-0x00007FF6F43A0000-0x00007FF6F4792000-memory.dmp	xmrig
behavioral2/memory/5064-254-0x00007FF6FD170000-0x00007FF6FD562000-memory.dmp	xmrig
behavioral2/memory/2492-253-0x00007FF68C550000-0x00007FF68C942000-memory.dmp	xmrig
behavioral2/memory/1044-251-0x00007FF60E150000-0x00007FF60E542000-memory.dmp	xmrig
behavioral2/memory/2348-232-0x00007FF6CAB00000-0x00007FF6CAEF2000-memory.dmp	xmrig
behavioral2/memory/4144-185-0x00007FF6CD520000-0x00007FF6CD912000-memory.dmp	xmrig
behavioral2/memory/388-182-0x00007FF7A9FA0000-0x00007FF7AA392000-memory.dmp	xmrig
behavioral2/memory/1080-3869-0x00007FF6EB4E0000-0x00007FF6EB8D2000-memory.dmp	xmrig
behavioral2/memory/4440-3873-0x00007FF7CB010000-0x00007FF7CB402000-memory.dmp	xmrig
behavioral2/memory/1768-3878-0x00007FF6B8270000-0x00007FF6B8662000-memory.dmp	xmrig
behavioral2/memory/5068-3931-0x00007FF799100000-0x00007FF7994F2000-memory.dmp	xmrig
behavioral2/memory/720-3948-0x00007FF6F43A0000-0x00007FF6F4792000-memory.dmp	xmrig
behavioral2/memory/2116-3942-0x00007FF7A8360000-0x00007FF7A8752000-memory.dmp	xmrig
behavioral2/memory/5064-3937-0x00007FF6FD170000-0x00007FF6FD562000-memory.dmp	xmrig
behavioral2/memory/1044-3934-0x00007FF60E150000-0x00007FF60E542000-memory.dmp	xmrig
behavioral2/memory/2492-3963-0x00007FF68C550000-0x00007FF68C942000-memory.dmp	xmrig
behavioral2/memory/4144-3914-0x00007FF6CD520000-0x00007FF6CD912000-memory.dmp	xmrig
behavioral2/memory/388-3910-0x00007FF7A9FA0000-0x00007FF7AA392000-memory.dmp	xmrig
behavioral2/memory/916-3907-0x00007FF7D9290000-0x00007FF7D9682000-memory.dmp	xmrig
behavioral2/memory/3180-3906-0x00007FF7DD250000-0x00007FF7DD642000-memory.dmp	xmrig
behavioral2/memory/1008-3985-0x00007FF61E970000-0x00007FF61ED62000-memory.dmp	xmrig
behavioral2/memory/4416-4007-0x00007FF7E5610000-0x00007FF7E5A02000-memory.dmp	xmrig
behavioral2/memory/2348-3966-0x00007FF6CAB00000-0x00007FF6CAEF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1736	uJbKUdW.exe
716	YDbftrH.exe
4788	LqVPnDu.exe
1080	PuPmUOy.exe
1768	FFnDyMQ.exe
2016	lanEVBD.exe
2116	rOpVXeM.exe
3948	KhkztBw.exe
916	MOLkYuL.exe
388	UvGvjtc.exe
4144	XHDWvqP.exe
2348	FOoBIts.exe
1044	SYzQJuG.exe
3180	ZcFgwtn.exe
4440	yzygEcr.exe
2492	RiSefQf.exe
5064	ROSqzqT.exe
720	GAZeFIy.exe
1008	bamTcZc.exe
4416	FgIYhEj.exe
5068	AJxOYJT.exe
3944	nnRlbJd.exe
3564	UpAZYyk.exe
3016	rrKKYNe.exe
992	xkiTJeq.exe
4152	OzAhTri.exe
224	wVKpvWx.exe
3644	gBUmowh.exe
3252	rOOeIKr.exe
3040	HrhzFmy.exe
4040	VJlombO.exe
2840	GmGCEfm.exe
1064	qYyQuuE.exe
2232	EANpTPZ.exe
4748	jurytLS.exe
4988	YeruQtC.exe
2328	qMfWLDC.exe
3552	fZvXzaX.exe
4460	ueqHEBt.exe
2404	mGTRBeE.exe
4404	YMehgvU.exe
3256	HfaEOgM.exe
4756	WiaEhpu.exe
2800	cqsulKI.exe
2236	axBIboF.exe
3520	AZnJAvZ.exe
2180	exrcTiC.exe
3124	ZswmkZG.exe
4400	xfsHbKb.exe
1696	lqLDYXj.exe
1032	duLfiSw.exe
3692	VVnBirl.exe
4656	gBUTnXa.exe
2972	FAujCIq.exe
3012	WqGqVoz.exe
4928	kVgGRJw.exe
3192	pURAEAI.exe
3092	sSObDqj.exe
4280	UMmMoyc.exe
3632	epXejHx.exe
1048	jmFvKUI.exe
1544	kjTUoUb.exe
4424	jDuKmiR.exe
2200	JDaNUwa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3728-0-0x00007FF770B40000-0x00007FF770F32000-memory.dmp	upx
behavioral2/files/0x000a000000023b7f-6.dat	upx
behavioral2/files/0x000d000000023b73-7.dat	upx
behavioral2/files/0x000a000000023b84-32.dat	upx
behavioral2/files/0x000a000000023b87-56.dat	upx
behavioral2/files/0x000a000000023b8d-86.dat	upx
behavioral2/files/0x000a000000023b94-119.dat	upx
behavioral2/files/0x000a000000023b93-195.dat	upx
behavioral2/memory/4440-252-0x00007FF7CB010000-0x00007FF7CB402000-memory.dmp	upx
behavioral2/memory/716-258-0x00007FF7862D0000-0x00007FF7866C2000-memory.dmp	upx
behavioral2/memory/5068-257-0x00007FF799100000-0x00007FF7994F2000-memory.dmp	upx
behavioral2/memory/3948-308-0x00007FF796460000-0x00007FF796852000-memory.dmp	upx
behavioral2/memory/3180-332-0x00007FF7DD250000-0x00007FF7DD642000-memory.dmp	upx
behavioral2/memory/4416-335-0x00007FF7E5610000-0x00007FF7E5A02000-memory.dmp	upx
behavioral2/memory/916-331-0x00007FF7D9290000-0x00007FF7D9682000-memory.dmp	upx
behavioral2/memory/1008-256-0x00007FF61E970000-0x00007FF61ED62000-memory.dmp	upx
behavioral2/memory/720-255-0x00007FF6F43A0000-0x00007FF6F4792000-memory.dmp	upx
behavioral2/memory/5064-254-0x00007FF6FD170000-0x00007FF6FD562000-memory.dmp	upx
behavioral2/memory/2492-253-0x00007FF68C550000-0x00007FF68C942000-memory.dmp	upx
behavioral2/memory/1044-251-0x00007FF60E150000-0x00007FF60E542000-memory.dmp	upx
behavioral2/memory/2348-232-0x00007FF6CAB00000-0x00007FF6CAEF2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-190.dat	upx
behavioral2/files/0x000a000000023b98-188.dat	upx
behavioral2/memory/4144-185-0x00007FF6CD520000-0x00007FF6CD912000-memory.dmp	upx
behavioral2/memory/388-182-0x00007FF7A9FA0000-0x00007FF7AA392000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-173.dat	upx
behavioral2/files/0x000a000000023b8f-170.dat	upx
behavioral2/files/0x000a000000023b8e-168.dat	upx
behavioral2/files/0x000a000000023b9e-167.dat	upx
behavioral2/files/0x000a000000023b9d-165.dat	upx
behavioral2/files/0x000a000000023b9c-160.dat	upx
behavioral2/files/0x000a000000023b89-159.dat	upx
behavioral2/files/0x000a000000023b9b-158.dat	upx
behavioral2/files/0x000a000000023b9a-157.dat	upx
behavioral2/files/0x000a000000023b92-149.dat	upx
behavioral2/files/0x000a000000023b99-146.dat	upx
behavioral2/files/0x000a000000023b91-143.dat	upx
behavioral2/files/0x000a000000023ba1-181.dat	upx
behavioral2/files/0x000a000000023ba0-179.dat	upx
behavioral2/files/0x000a000000023b95-131.dat	upx
behavioral2/files/0x000a000000023b97-128.dat	upx
behavioral2/files/0x000a000000023b96-127.dat	upx
behavioral2/files/0x000a000000023b88-115.dat	upx
behavioral2/files/0x000a000000023b8c-151.dat	upx
behavioral2/files/0x000a000000023b8b-102.dat	upx
behavioral2/memory/2116-138-0x00007FF7A8360000-0x00007FF7A8752000-memory.dmp	upx
behavioral2/memory/2016-98-0x00007FF7F0290000-0x00007FF7F0682000-memory.dmp	upx
behavioral2/files/0x000a000000023b85-92.dat	upx
behavioral2/files/0x000a000000023b8a-122.dat	upx
behavioral2/files/0x000a000000023b83-81.dat	upx
behavioral2/files/0x000a000000023b86-74.dat	upx
behavioral2/files/0x000a000000023b90-101.dat	upx
behavioral2/files/0x000a000000023b81-68.dat	upx
behavioral2/files/0x000a000000023b82-78.dat	upx
behavioral2/memory/1768-66-0x00007FF6B8270000-0x00007FF6B8662000-memory.dmp	upx
behavioral2/memory/1080-46-0x00007FF6EB4E0000-0x00007FF6EB8D2000-memory.dmp	upx
behavioral2/files/0x000b000000023b7b-45.dat	upx
behavioral2/files/0x000a000000023b80-40.dat	upx
behavioral2/memory/4788-33-0x00007FF686A30000-0x00007FF686E22000-memory.dmp	upx
behavioral2/memory/1736-18-0x00007FF6C7B60000-0x00007FF6C7F52000-memory.dmp	upx
behavioral2/memory/1080-3869-0x00007FF6EB4E0000-0x00007FF6EB8D2000-memory.dmp	upx
behavioral2/memory/4440-3873-0x00007FF7CB010000-0x00007FF7CB402000-memory.dmp	upx
behavioral2/memory/1768-3878-0x00007FF6B8270000-0x00007FF6B8662000-memory.dmp	upx
behavioral2/memory/5068-3931-0x00007FF799100000-0x00007FF7994F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rNnWvrM.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\goPxIbp.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\HzYyOjC.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\FpJkqeq.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\nQUnSOI.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\JiSGSCI.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\cJovXJx.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\vqsgQmM.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\ZIvMCaO.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\AypBRsY.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\TwbMBXA.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\frXhgvD.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\vLUbowP.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\lpoNlWY.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\ULuwgjn.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\cvKYeAs.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\CjOSkgG.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\uhDDpju.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\MehSDAe.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\VLQBqhh.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\PdCOjlY.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\YuqCzow.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\nzbXxqX.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\eRAnvDM.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\DsgrCNE.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\AdYavIj.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\AdHSbEG.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\GfbEVLl.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\PbDrItM.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\KZKGrhO.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\OstpiHg.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\BWdTOdE.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\bbiMfZp.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\gmYwudD.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\GBGMHcn.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\igFXJul.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\zAaVZly.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\wIEUvrv.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\DEcWZvs.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\dDaGemd.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\gIOgWbp.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\kgvAcJt.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\PnJEdzi.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\ehcBztQ.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\BXhbCzA.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\NoJRRqh.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\aogqYxh.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\XOPHkQJ.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\ONkSSyt.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\wZvvtAF.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\JZiDnuF.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\EniRgHp.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\DIrJDLF.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\yKxzCpE.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\XfyIBHT.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\GPDdPvj.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\hZxhXAb.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\hWMLxgy.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\PpIdAOm.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\PJqSgcM.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\pZZsfts.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\GgZbhXk.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\dCdpKcQ.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
File created	C:\Windows\System\ZAymuWy.exe	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1788	powershell.exe
1788	powershell.exe
1788	powershell.exe
1788	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeLockMemoryPrivilege	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 1788	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	85
PID 3728 wrote to memory of 1788	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	85
PID 3728 wrote to memory of 1736	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	86
PID 3728 wrote to memory of 1736	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	86
PID 3728 wrote to memory of 716	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	87
PID 3728 wrote to memory of 716	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	87
PID 3728 wrote to memory of 4788	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	88
PID 3728 wrote to memory of 4788	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	88
PID 3728 wrote to memory of 3948	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	89
PID 3728 wrote to memory of 3948	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	89
PID 3728 wrote to memory of 1080	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	90
PID 3728 wrote to memory of 1080	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	90
PID 3728 wrote to memory of 1768	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	91
PID 3728 wrote to memory of 1768	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	91
PID 3728 wrote to memory of 2016	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	92
PID 3728 wrote to memory of 2016	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	92
PID 3728 wrote to memory of 2116	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	93
PID 3728 wrote to memory of 2116	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	93
PID 3728 wrote to memory of 916	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	94
PID 3728 wrote to memory of 916	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	94
PID 3728 wrote to memory of 4440	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	95
PID 3728 wrote to memory of 4440	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	95
PID 3728 wrote to memory of 388	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	96
PID 3728 wrote to memory of 388	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	96
PID 3728 wrote to memory of 4144	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	97
PID 3728 wrote to memory of 4144	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	97
PID 3728 wrote to memory of 2348	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	98
PID 3728 wrote to memory of 2348	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	98
PID 3728 wrote to memory of 1044	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	99
PID 3728 wrote to memory of 1044	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	99
PID 3728 wrote to memory of 3180	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	100
PID 3728 wrote to memory of 3180	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	100
PID 3728 wrote to memory of 2492	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	101
PID 3728 wrote to memory of 2492	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	101
PID 3728 wrote to memory of 5064	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	102
PID 3728 wrote to memory of 5064	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	102
PID 3728 wrote to memory of 720	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	103
PID 3728 wrote to memory of 720	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	103
PID 3728 wrote to memory of 1008	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	104
PID 3728 wrote to memory of 1008	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	104
PID 3728 wrote to memory of 4416	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	105
PID 3728 wrote to memory of 4416	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	105
PID 3728 wrote to memory of 5068	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	106
PID 3728 wrote to memory of 5068	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	106
PID 3728 wrote to memory of 3944	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	107
PID 3728 wrote to memory of 3944	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	107
PID 3728 wrote to memory of 3564	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	108
PID 3728 wrote to memory of 3564	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	108
PID 3728 wrote to memory of 3016	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	109
PID 3728 wrote to memory of 3016	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	109
PID 3728 wrote to memory of 992	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	110
PID 3728 wrote to memory of 992	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	110
PID 3728 wrote to memory of 4152	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	111
PID 3728 wrote to memory of 4152	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	111
PID 3728 wrote to memory of 224	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	112
PID 3728 wrote to memory of 224	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	112
PID 3728 wrote to memory of 3644	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	113
PID 3728 wrote to memory of 3644	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	113
PID 3728 wrote to memory of 3252	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	114
PID 3728 wrote to memory of 3252	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	114
PID 3728 wrote to memory of 3040	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	115
PID 3728 wrote to memory of 3040	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	115
PID 3728 wrote to memory of 4040	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	116
PID 3728 wrote to memory of 4040	3728	00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00bd07546d0f5634f9028ba57e0696b3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\System\uJbKUdW.exe
  C:\Windows\System\uJbKUdW.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\YDbftrH.exe
  C:\Windows\System\YDbftrH.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\LqVPnDu.exe
  C:\Windows\System\LqVPnDu.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\KhkztBw.exe
  C:\Windows\System\KhkztBw.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\PuPmUOy.exe
  C:\Windows\System\PuPmUOy.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\FFnDyMQ.exe
  C:\Windows\System\FFnDyMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\lanEVBD.exe
  C:\Windows\System\lanEVBD.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\rOpVXeM.exe
  C:\Windows\System\rOpVXeM.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\MOLkYuL.exe
  C:\Windows\System\MOLkYuL.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\yzygEcr.exe
  C:\Windows\System\yzygEcr.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\UvGvjtc.exe
  C:\Windows\System\UvGvjtc.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\XHDWvqP.exe
  C:\Windows\System\XHDWvqP.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\FOoBIts.exe
  C:\Windows\System\FOoBIts.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\SYzQJuG.exe
  C:\Windows\System\SYzQJuG.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\ZcFgwtn.exe
  C:\Windows\System\ZcFgwtn.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\RiSefQf.exe
  C:\Windows\System\RiSefQf.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\ROSqzqT.exe
  C:\Windows\System\ROSqzqT.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\GAZeFIy.exe
  C:\Windows\System\GAZeFIy.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\bamTcZc.exe
  C:\Windows\System\bamTcZc.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\FgIYhEj.exe
  C:\Windows\System\FgIYhEj.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\AJxOYJT.exe
  C:\Windows\System\AJxOYJT.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\nnRlbJd.exe
  C:\Windows\System\nnRlbJd.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\UpAZYyk.exe
  C:\Windows\System\UpAZYyk.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\rrKKYNe.exe
  C:\Windows\System\rrKKYNe.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\xkiTJeq.exe
  C:\Windows\System\xkiTJeq.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\OzAhTri.exe
  C:\Windows\System\OzAhTri.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\wVKpvWx.exe
  C:\Windows\System\wVKpvWx.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\gBUmowh.exe
  C:\Windows\System\gBUmowh.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\rOOeIKr.exe
  C:\Windows\System\rOOeIKr.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\HrhzFmy.exe
  C:\Windows\System\HrhzFmy.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\VJlombO.exe
  C:\Windows\System\VJlombO.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\GmGCEfm.exe
  C:\Windows\System\GmGCEfm.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\qYyQuuE.exe
  C:\Windows\System\qYyQuuE.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\EANpTPZ.exe
  C:\Windows\System\EANpTPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\jurytLS.exe
  C:\Windows\System\jurytLS.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\YeruQtC.exe
  C:\Windows\System\YeruQtC.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\qMfWLDC.exe
  C:\Windows\System\qMfWLDC.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\exrcTiC.exe
  C:\Windows\System\exrcTiC.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\fZvXzaX.exe
  C:\Windows\System\fZvXzaX.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\ueqHEBt.exe
  C:\Windows\System\ueqHEBt.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\mGTRBeE.exe
  C:\Windows\System\mGTRBeE.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\ZswmkZG.exe
  C:\Windows\System\ZswmkZG.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\YMehgvU.exe
  C:\Windows\System\YMehgvU.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\HfaEOgM.exe
  C:\Windows\System\HfaEOgM.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\WiaEhpu.exe
  C:\Windows\System\WiaEhpu.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\cqsulKI.exe
  C:\Windows\System\cqsulKI.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\axBIboF.exe
  C:\Windows\System\axBIboF.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\AZnJAvZ.exe
  C:\Windows\System\AZnJAvZ.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\sSObDqj.exe
  C:\Windows\System\sSObDqj.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\UMmMoyc.exe
  C:\Windows\System\UMmMoyc.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\epXejHx.exe
  C:\Windows\System\epXejHx.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\jmFvKUI.exe
  C:\Windows\System\jmFvKUI.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\kjTUoUb.exe
  C:\Windows\System\kjTUoUb.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\jDuKmiR.exe
  C:\Windows\System\jDuKmiR.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\JDaNUwa.exe
  C:\Windows\System\JDaNUwa.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\QKXwReb.exe
  C:\Windows\System\QKXwReb.exe
  2⤵
  PID:4272
- C:\Windows\System\rFesqCF.exe
  C:\Windows\System\rFesqCF.exe
  2⤵
  PID:4408
- C:\Windows\System\xfsHbKb.exe
  C:\Windows\System\xfsHbKb.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\lqLDYXj.exe
  C:\Windows\System\lqLDYXj.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\duLfiSw.exe
  C:\Windows\System\duLfiSw.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\VVnBirl.exe
  C:\Windows\System\VVnBirl.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\gBUTnXa.exe
  C:\Windows\System\gBUTnXa.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\FAujCIq.exe
  C:\Windows\System\FAujCIq.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\WqGqVoz.exe
  C:\Windows\System\WqGqVoz.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\kVgGRJw.exe
  C:\Windows\System\kVgGRJw.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\pURAEAI.exe
  C:\Windows\System\pURAEAI.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\gBndCLu.exe
  C:\Windows\System\gBndCLu.exe
  2⤵
  PID:3492
- C:\Windows\System\peSNPcW.exe
  C:\Windows\System\peSNPcW.exe
  2⤵
  PID:4768
- C:\Windows\System\FUNyESb.exe
  C:\Windows\System\FUNyESb.exe
  2⤵
  PID:452
- C:\Windows\System\pvXSdkO.exe
  C:\Windows\System\pvXSdkO.exe
  2⤵
  PID:1364
- C:\Windows\System\CNGYsII.exe
  C:\Windows\System\CNGYsII.exe
  2⤵
  PID:2844
- C:\Windows\System\HLEExap.exe
  C:\Windows\System\HLEExap.exe
  2⤵
  PID:4628
- C:\Windows\System\OtQHnzO.exe
  C:\Windows\System\OtQHnzO.exe
  2⤵
  PID:4008
- C:\Windows\System\mxOZgYr.exe
  C:\Windows\System\mxOZgYr.exe
  2⤵
  PID:4892
- C:\Windows\System\rgUKqxU.exe
  C:\Windows\System\rgUKqxU.exe
  2⤵
  PID:5276
- C:\Windows\System\MMYRorf.exe
  C:\Windows\System\MMYRorf.exe
  2⤵
  PID:5308
- C:\Windows\System\TJvsQNW.exe
  C:\Windows\System\TJvsQNW.exe
  2⤵
  PID:5340
- C:\Windows\System\gYaUKJp.exe
  C:\Windows\System\gYaUKJp.exe
  2⤵
  PID:5364
- C:\Windows\System\nILGHfz.exe
  C:\Windows\System\nILGHfz.exe
  2⤵
  PID:5388
- C:\Windows\System\dQQocCo.exe
  C:\Windows\System\dQQocCo.exe
  2⤵
  PID:5428
- C:\Windows\System\qqEfhWc.exe
  C:\Windows\System\qqEfhWc.exe
  2⤵
  PID:5448
- C:\Windows\System\hRDxvmV.exe
  C:\Windows\System\hRDxvmV.exe
  2⤵
  PID:5464
- C:\Windows\System\sOxoYot.exe
  C:\Windows\System\sOxoYot.exe
  2⤵
  PID:5948
- C:\Windows\System\dWUYexz.exe
  C:\Windows\System\dWUYexz.exe
  2⤵
  PID:5976
- C:\Windows\System\SqdCoYM.exe
  C:\Windows\System\SqdCoYM.exe
  2⤵
  PID:5992
- C:\Windows\System\KpeRYEG.exe
  C:\Windows\System\KpeRYEG.exe
  2⤵
  PID:6016
- C:\Windows\System\JoRbxCk.exe
  C:\Windows\System\JoRbxCk.exe
  2⤵
  PID:6036
- C:\Windows\System\ZFdCZSA.exe
  C:\Windows\System\ZFdCZSA.exe
  2⤵
  PID:6068
- C:\Windows\System\qDNIyvm.exe
  C:\Windows\System\qDNIyvm.exe
  2⤵
  PID:6084
- C:\Windows\System\ECRsFUp.exe
  C:\Windows\System\ECRsFUp.exe
  2⤵
  PID:6108
- C:\Windows\System\ibhGowH.exe
  C:\Windows\System\ibhGowH.exe
  2⤵
  PID:6124
- C:\Windows\System\hOvOOPJ.exe
  C:\Windows\System\hOvOOPJ.exe
  2⤵
  PID:312
- C:\Windows\System\qGEzRiH.exe
  C:\Windows\System\qGEzRiH.exe
  2⤵
  PID:4432
- C:\Windows\System\VMyWEet.exe
  C:\Windows\System\VMyWEet.exe
  2⤵
  PID:5212
- C:\Windows\System\uNsrikJ.exe
  C:\Windows\System\uNsrikJ.exe
  2⤵
  PID:3076
- C:\Windows\System\ijzxkJw.exe
  C:\Windows\System\ijzxkJw.exe
  2⤵
  PID:3560
- C:\Windows\System\whTQMrz.exe
  C:\Windows\System\whTQMrz.exe
  2⤵
  PID:1828
- C:\Windows\System\rqAwfzg.exe
  C:\Windows\System\rqAwfzg.exe
  2⤵
  PID:4244
- C:\Windows\System\xvddJWk.exe
  C:\Windows\System\xvddJWk.exe
  2⤵
  PID:2260
- C:\Windows\System\zIcErSp.exe
  C:\Windows\System\zIcErSp.exe
  2⤵
  PID:2808
- C:\Windows\System\GuUFsoj.exe
  C:\Windows\System\GuUFsoj.exe
  2⤵
  PID:1716
- C:\Windows\System\ppafDQx.exe
  C:\Windows\System\ppafDQx.exe
  2⤵
  PID:5252
- C:\Windows\System\yztJgVa.exe
  C:\Windows\System\yztJgVa.exe
  2⤵
  PID:5316
- C:\Windows\System\SeDfrsL.exe
  C:\Windows\System\SeDfrsL.exe
  2⤵
  PID:5356
- C:\Windows\System\tTiurTH.exe
  C:\Windows\System\tTiurTH.exe
  2⤵
  PID:5424
- C:\Windows\System\gVAaEHG.exe
  C:\Windows\System\gVAaEHG.exe
  2⤵
  PID:5472
- C:\Windows\System\JlQybZv.exe
  C:\Windows\System\JlQybZv.exe
  2⤵
  PID:3160
- C:\Windows\System\mHZccRD.exe
  C:\Windows\System\mHZccRD.exe
  2⤵
  PID:5580
- C:\Windows\System\NQWpvAS.exe
  C:\Windows\System\NQWpvAS.exe
  2⤵
  PID:5620
- C:\Windows\System\ThpMEph.exe
  C:\Windows\System\ThpMEph.exe
  2⤵
  PID:5856
- C:\Windows\System\YGXaSYW.exe
  C:\Windows\System\YGXaSYW.exe
  2⤵
  PID:1680
- C:\Windows\System\jDZmkiB.exe
  C:\Windows\System\jDZmkiB.exe
  2⤵
  PID:3488
- C:\Windows\System\cGMMtsZ.exe
  C:\Windows\System\cGMMtsZ.exe
  2⤵
  PID:636
- C:\Windows\System\MDFkgHd.exe
  C:\Windows\System\MDFkgHd.exe
  2⤵
  PID:2004
- C:\Windows\System\wkvtJdQ.exe
  C:\Windows\System\wkvtJdQ.exe
  2⤵
  PID:3956
- C:\Windows\System\umVwQcx.exe
  C:\Windows\System\umVwQcx.exe
  2⤵
  PID:1948
- C:\Windows\System\sdLrfVs.exe
  C:\Windows\System\sdLrfVs.exe
  2⤵
  PID:4308
- C:\Windows\System\RvnFfwk.exe
  C:\Windows\System\RvnFfwk.exe
  2⤵
  PID:4868
- C:\Windows\System\DeJizgm.exe
  C:\Windows\System\DeJizgm.exe
  2⤵
  PID:2104
- C:\Windows\System\WWDVhJn.exe
  C:\Windows\System\WWDVhJn.exe
  2⤵
  PID:4360
- C:\Windows\System\eXbfWTg.exe
  C:\Windows\System\eXbfWTg.exe
  2⤵
  PID:4192
- C:\Windows\System\uCLlAlq.exe
  C:\Windows\System\uCLlAlq.exe
  2⤵
  PID:864
- C:\Windows\System\FotzbOt.exe
  C:\Windows\System\FotzbOt.exe
  2⤵
  PID:3668
- C:\Windows\System\wTslXsn.exe
  C:\Windows\System\wTslXsn.exe
  2⤵
  PID:4832
- C:\Windows\System\WHyPVPT.exe
  C:\Windows\System\WHyPVPT.exe
  2⤵
  PID:5264
- C:\Windows\System\nZbYMPc.exe
  C:\Windows\System\nZbYMPc.exe
  2⤵
  PID:5696
- C:\Windows\System\RMNGKwu.exe
  C:\Windows\System\RMNGKwu.exe
  2⤵
  PID:5964
- C:\Windows\System\pHezELF.exe
  C:\Windows\System\pHezELF.exe
  2⤵
  PID:6024
- C:\Windows\System\dMxardI.exe
  C:\Windows\System\dMxardI.exe
  2⤵
  PID:2788
- C:\Windows\System\AsWjyLF.exe
  C:\Windows\System\AsWjyLF.exe
  2⤵
  PID:3664
- C:\Windows\System\jUKlHqj.exe
  C:\Windows\System\jUKlHqj.exe
  2⤵
  PID:6132
- C:\Windows\System\vBbSbvn.exe
  C:\Windows\System\vBbSbvn.exe
  2⤵
  PID:6080
- C:\Windows\System\jeVIoZr.exe
  C:\Windows\System\jeVIoZr.exe
  2⤵
  PID:1560
- C:\Windows\System\HhOEGfG.exe
  C:\Windows\System\HhOEGfG.exe
  2⤵
  PID:4176
- C:\Windows\System\bfCtEzW.exe
  C:\Windows\System\bfCtEzW.exe
  2⤵
  PID:5240
- C:\Windows\System\YteRycF.exe
  C:\Windows\System\YteRycF.exe
  2⤵
  PID:5352
- C:\Windows\System\KORWUsr.exe
  C:\Windows\System\KORWUsr.exe
  2⤵
  PID:5456
- C:\Windows\System\PeBMAOX.exe
  C:\Windows\System\PeBMAOX.exe
  2⤵
  PID:6000
- C:\Windows\System\fZhyBoD.exe
  C:\Windows\System\fZhyBoD.exe
  2⤵
  PID:5288
- C:\Windows\System\hfJbJxY.exe
  C:\Windows\System\hfJbJxY.exe
  2⤵
  PID:2824
- C:\Windows\System\HRzGZjY.exe
  C:\Windows\System\HRzGZjY.exe
  2⤵
  PID:3296
- C:\Windows\System\xvFNgBZ.exe
  C:\Windows\System\xvFNgBZ.exe
  2⤵
  PID:3408
- C:\Windows\System\EiovLBx.exe
  C:\Windows\System\EiovLBx.exe
  2⤵
  PID:4368
- C:\Windows\System\KyRUUXg.exe
  C:\Windows\System\KyRUUXg.exe
  2⤵
  PID:4940
- C:\Windows\System\aoKnwuD.exe
  C:\Windows\System\aoKnwuD.exe
  2⤵
  PID:4620
- C:\Windows\System\NGUVNKY.exe
  C:\Windows\System\NGUVNKY.exe
  2⤵
  PID:5844
- C:\Windows\System\OjaLvtm.exe
  C:\Windows\System\OjaLvtm.exe
  2⤵
  PID:1040
- C:\Windows\System\EDlRNTd.exe
  C:\Windows\System\EDlRNTd.exe
  2⤵
  PID:6092
- C:\Windows\System\tcYIqHC.exe
  C:\Windows\System\tcYIqHC.exe
  2⤵
  PID:4556
- C:\Windows\System\XCfwpIO.exe
  C:\Windows\System\XCfwpIO.exe
  2⤵
  PID:2020
- C:\Windows\System\RTDhrev.exe
  C:\Windows\System\RTDhrev.exe
  2⤵
  PID:5488
- C:\Windows\System\freVSBf.exe
  C:\Windows\System\freVSBf.exe
  2⤵
  PID:3404
- C:\Windows\System\eRgtVqM.exe
  C:\Windows\System\eRgtVqM.exe
  2⤵
  PID:6168
- C:\Windows\System\wRQBVIQ.exe
  C:\Windows\System\wRQBVIQ.exe
  2⤵
  PID:6196
- C:\Windows\System\dxWdnFZ.exe
  C:\Windows\System\dxWdnFZ.exe
  2⤵
  PID:6216
- C:\Windows\System\OyqGJOP.exe
  C:\Windows\System\OyqGJOP.exe
  2⤵
  PID:6236
- C:\Windows\System\nSomFVn.exe
  C:\Windows\System\nSomFVn.exe
  2⤵
  PID:6256
- C:\Windows\System\tPDMAXq.exe
  C:\Windows\System\tPDMAXq.exe
  2⤵
  PID:6284
- C:\Windows\System\KDCNzvi.exe
  C:\Windows\System\KDCNzvi.exe
  2⤵
  PID:6312
- C:\Windows\System\vNaZbdC.exe
  C:\Windows\System\vNaZbdC.exe
  2⤵
  PID:6340
- C:\Windows\System\dFIryek.exe
  C:\Windows\System\dFIryek.exe
  2⤵
  PID:6360
- C:\Windows\System\WCefzeb.exe
  C:\Windows\System\WCefzeb.exe
  2⤵
  PID:6380
- C:\Windows\System\gASZIok.exe
  C:\Windows\System\gASZIok.exe
  2⤵
  PID:6408
- C:\Windows\System\sZmxPIn.exe
  C:\Windows\System\sZmxPIn.exe
  2⤵
  PID:6428
- C:\Windows\System\TBsdrMg.exe
  C:\Windows\System\TBsdrMg.exe
  2⤵
  PID:6456
- C:\Windows\System\zDatJaO.exe
  C:\Windows\System\zDatJaO.exe
  2⤵
  PID:6476
- C:\Windows\System\ksiLmQY.exe
  C:\Windows\System\ksiLmQY.exe
  2⤵
  PID:6500
- C:\Windows\System\YKilyaO.exe
  C:\Windows\System\YKilyaO.exe
  2⤵
  PID:6520
- C:\Windows\System\zkprCMT.exe
  C:\Windows\System\zkprCMT.exe
  2⤵
  PID:6548
- C:\Windows\System\gbZjUOy.exe
  C:\Windows\System\gbZjUOy.exe
  2⤵
  PID:6568
- C:\Windows\System\srviZib.exe
  C:\Windows\System\srviZib.exe
  2⤵
  PID:6596
- C:\Windows\System\BOIgEor.exe
  C:\Windows\System\BOIgEor.exe
  2⤵
  PID:6616
- C:\Windows\System\BmLTteW.exe
  C:\Windows\System\BmLTteW.exe
  2⤵
  PID:6636
- C:\Windows\System\moSLUdV.exe
  C:\Windows\System\moSLUdV.exe
  2⤵
  PID:6664
- C:\Windows\System\laYnjwJ.exe
  C:\Windows\System\laYnjwJ.exe
  2⤵
  PID:6684
- C:\Windows\System\yicAAVi.exe
  C:\Windows\System\yicAAVi.exe
  2⤵
  PID:6704
- C:\Windows\System\gKmchOK.exe
  C:\Windows\System\gKmchOK.exe
  2⤵
  PID:6728
- C:\Windows\System\wqKZvCL.exe
  C:\Windows\System\wqKZvCL.exe
  2⤵
  PID:6752
- C:\Windows\System\qcVRNir.exe
  C:\Windows\System\qcVRNir.exe
  2⤵
  PID:6776
- C:\Windows\System\dQGgQEt.exe
  C:\Windows\System\dQGgQEt.exe
  2⤵
  PID:6796
- C:\Windows\System\mPNjJJW.exe
  C:\Windows\System\mPNjJJW.exe
  2⤵
  PID:6820
- C:\Windows\System\mhgIqiE.exe
  C:\Windows\System\mhgIqiE.exe
  2⤵
  PID:6844
- C:\Windows\System\VMVGwZI.exe
  C:\Windows\System\VMVGwZI.exe
  2⤵
  PID:6864
- C:\Windows\System\pmVUTQf.exe
  C:\Windows\System\pmVUTQf.exe
  2⤵
  PID:6884
- C:\Windows\System\EwExzWh.exe
  C:\Windows\System\EwExzWh.exe
  2⤵
  PID:6912
- C:\Windows\System\whplYSy.exe
  C:\Windows\System\whplYSy.exe
  2⤵
  PID:6936
- C:\Windows\System\WbSxeEr.exe
  C:\Windows\System\WbSxeEr.exe
  2⤵
  PID:6964
- C:\Windows\System\meKDVQE.exe
  C:\Windows\System\meKDVQE.exe
  2⤵
  PID:6984
- C:\Windows\System\HSvfKlB.exe
  C:\Windows\System\HSvfKlB.exe
  2⤵
  PID:7008
- C:\Windows\System\NwGQnAc.exe
  C:\Windows\System\NwGQnAc.exe
  2⤵
  PID:7036
- C:\Windows\System\VIgokBB.exe
  C:\Windows\System\VIgokBB.exe
  2⤵
  PID:7052
- C:\Windows\System\JFAiTpX.exe
  C:\Windows\System\JFAiTpX.exe
  2⤵
  PID:7076
- C:\Windows\System\ylmpaim.exe
  C:\Windows\System\ylmpaim.exe
  2⤵
  PID:7108
- C:\Windows\System\cmFkzZP.exe
  C:\Windows\System\cmFkzZP.exe
  2⤵
  PID:7128
- C:\Windows\System\KbkOXrd.exe
  C:\Windows\System\KbkOXrd.exe
  2⤵
  PID:7160
- C:\Windows\System\orZHnsV.exe
  C:\Windows\System\orZHnsV.exe
  2⤵
  PID:5100
- C:\Windows\System\bWczMyU.exe
  C:\Windows\System\bWczMyU.exe
  2⤵
  PID:3360
- C:\Windows\System\RUumwwo.exe
  C:\Windows\System\RUumwwo.exe
  2⤵
  PID:5380
- C:\Windows\System\qrpRwXz.exe
  C:\Windows\System\qrpRwXz.exe
  2⤵
  PID:4980
- C:\Windows\System\rEuDqJt.exe
  C:\Windows\System\rEuDqJt.exe
  2⤵
  PID:3264
- C:\Windows\System\GRCIZtP.exe
  C:\Windows\System\GRCIZtP.exe
  2⤵
  PID:6116
- C:\Windows\System\eltsHzT.exe
  C:\Windows\System\eltsHzT.exe
  2⤵
  PID:6244
- C:\Windows\System\hDYxCCm.exe
  C:\Windows\System\hDYxCCm.exe
  2⤵
  PID:3892
- C:\Windows\System\RJilnww.exe
  C:\Windows\System\RJilnww.exe
  2⤵
  PID:6296
- C:\Windows\System\PWGNEwK.exe
  C:\Windows\System\PWGNEwK.exe
  2⤵
  PID:5556
- C:\Windows\System\VAEFDlA.exe
  C:\Windows\System\VAEFDlA.exe
  2⤵
  PID:6164
- C:\Windows\System\BzaMdQN.exe
  C:\Windows\System\BzaMdQN.exe
  2⤵
  PID:6532
- C:\Windows\System\oNvOIzN.exe
  C:\Windows\System\oNvOIzN.exe
  2⤵
  PID:6652
- C:\Windows\System\aZcXhfl.exe
  C:\Windows\System\aZcXhfl.exe
  2⤵
  PID:6332
- C:\Windows\System\uIePChk.exe
  C:\Windows\System\uIePChk.exe
  2⤵
  PID:6696
- C:\Windows\System\wZNcpZL.exe
  C:\Windows\System\wZNcpZL.exe
  2⤵
  PID:6816
- C:\Windows\System\mjBhFKZ.exe
  C:\Windows\System\mjBhFKZ.exe
  2⤵
  PID:6396
- C:\Windows\System\lKNAwwI.exe
  C:\Windows\System\lKNAwwI.exe
  2⤵
  PID:6184
- C:\Windows\System\QRDjcdk.exe
  C:\Windows\System\QRDjcdk.exe
  2⤵
  PID:6224
- C:\Windows\System\QgcLyMY.exe
  C:\Windows\System\QgcLyMY.exe
  2⤵
  PID:6644
- C:\Windows\System\fBGMieZ.exe
  C:\Windows\System\fBGMieZ.exe
  2⤵
  PID:6720
- C:\Windows\System\GpQRhgc.exe
  C:\Windows\System\GpQRhgc.exe
  2⤵
  PID:6764
- C:\Windows\System\MgJcZjz.exe
  C:\Windows\System\MgJcZjz.exe
  2⤵
  PID:7156
- C:\Windows\System\MkZSVoH.exe
  C:\Windows\System\MkZSVoH.exe
  2⤵
  PID:5336
- C:\Windows\System\pFSqyis.exe
  C:\Windows\System\pFSqyis.exe
  2⤵
  PID:7180
- C:\Windows\System\pPKakCb.exe
  C:\Windows\System\pPKakCb.exe
  2⤵
  PID:7200
- C:\Windows\System\FWYbpYR.exe
  C:\Windows\System\FWYbpYR.exe
  2⤵
  PID:7228
- C:\Windows\System\KThriSq.exe
  C:\Windows\System\KThriSq.exe
  2⤵
  PID:7252
- C:\Windows\System\SHPjRIL.exe
  C:\Windows\System\SHPjRIL.exe
  2⤵
  PID:7272
- C:\Windows\System\FPlGORT.exe
  C:\Windows\System\FPlGORT.exe
  2⤵
  PID:7300
- C:\Windows\System\zlmRijv.exe
  C:\Windows\System\zlmRijv.exe
  2⤵
  PID:7320
- C:\Windows\System\ISwceBz.exe
  C:\Windows\System\ISwceBz.exe
  2⤵
  PID:7340
- C:\Windows\System\VwTiwXH.exe
  C:\Windows\System\VwTiwXH.exe
  2⤵
  PID:7368
- C:\Windows\System\KhdTyeF.exe
  C:\Windows\System\KhdTyeF.exe
  2⤵
  PID:7392
- C:\Windows\System\lcKrXdh.exe
  C:\Windows\System\lcKrXdh.exe
  2⤵
  PID:7420
- C:\Windows\System\hEItGZX.exe
  C:\Windows\System\hEItGZX.exe
  2⤵
  PID:7440
- C:\Windows\System\XzyYMec.exe
  C:\Windows\System\XzyYMec.exe
  2⤵
  PID:7460
- C:\Windows\System\QvdHWGi.exe
  C:\Windows\System\QvdHWGi.exe
  2⤵
  PID:7484
- C:\Windows\System\FmRGmpa.exe
  C:\Windows\System\FmRGmpa.exe
  2⤵
  PID:7508
- C:\Windows\System\UZlreNa.exe
  C:\Windows\System\UZlreNa.exe
  2⤵
  PID:7536
- C:\Windows\System\SbjAFvu.exe
  C:\Windows\System\SbjAFvu.exe
  2⤵
  PID:7552
- C:\Windows\System\KJnjGub.exe
  C:\Windows\System\KJnjGub.exe
  2⤵
  PID:7576
- C:\Windows\System\rgrpSWq.exe
  C:\Windows\System\rgrpSWq.exe
  2⤵
  PID:7604
- C:\Windows\System\ZQOYJti.exe
  C:\Windows\System\ZQOYJti.exe
  2⤵
  PID:7620
- C:\Windows\System\PxKYHmb.exe
  C:\Windows\System\PxKYHmb.exe
  2⤵
  PID:7644
- C:\Windows\System\bghsGGE.exe
  C:\Windows\System\bghsGGE.exe
  2⤵
  PID:7664
- C:\Windows\System\SGKgWUM.exe
  C:\Windows\System\SGKgWUM.exe
  2⤵
  PID:7688
- C:\Windows\System\dMqCFRa.exe
  C:\Windows\System\dMqCFRa.exe
  2⤵
  PID:7712
- C:\Windows\System\qtCoEBC.exe
  C:\Windows\System\qtCoEBC.exe
  2⤵
  PID:7740
- C:\Windows\System\gahaDXk.exe
  C:\Windows\System\gahaDXk.exe
  2⤵
  PID:7768
- C:\Windows\System\mKZLZVX.exe
  C:\Windows\System\mKZLZVX.exe
  2⤵
  PID:7788
- C:\Windows\System\yYlxVek.exe
  C:\Windows\System\yYlxVek.exe
  2⤵
  PID:7816
- C:\Windows\System\JAxFolE.exe
  C:\Windows\System\JAxFolE.exe
  2⤵
  PID:7836
- C:\Windows\System\RsKPeZI.exe
  C:\Windows\System\RsKPeZI.exe
  2⤵
  PID:7856
- C:\Windows\System\cdtqrSB.exe
  C:\Windows\System\cdtqrSB.exe
  2⤵
  PID:7884
- C:\Windows\System\QSoxgdW.exe
  C:\Windows\System\QSoxgdW.exe
  2⤵
  PID:7908
- C:\Windows\System\rkbVMUf.exe
  C:\Windows\System\rkbVMUf.exe
  2⤵
  PID:7928
- C:\Windows\System\xtSkvKA.exe
  C:\Windows\System\xtSkvKA.exe
  2⤵
  PID:7944
- C:\Windows\System\yNlEHSz.exe
  C:\Windows\System\yNlEHSz.exe
  2⤵
  PID:7968
- C:\Windows\System\UZDmXCq.exe
  C:\Windows\System\UZDmXCq.exe
  2⤵
  PID:7996
- C:\Windows\System\aPAzsOM.exe
  C:\Windows\System\aPAzsOM.exe
  2⤵
  PID:8024
- C:\Windows\System\JVAzSHa.exe
  C:\Windows\System\JVAzSHa.exe
  2⤵
  PID:8040
- C:\Windows\System\pEGCfag.exe
  C:\Windows\System\pEGCfag.exe
  2⤵
  PID:8064
- C:\Windows\System\XYIlfqm.exe
  C:\Windows\System\XYIlfqm.exe
  2⤵
  PID:8092
- C:\Windows\System\owicVNS.exe
  C:\Windows\System\owicVNS.exe
  2⤵
  PID:8116
- C:\Windows\System\caMPeqZ.exe
  C:\Windows\System\caMPeqZ.exe
  2⤵
  PID:8140
- C:\Windows\System\OvOoeZs.exe
  C:\Windows\System\OvOoeZs.exe
  2⤵
  PID:8164
- C:\Windows\System\waxUOUd.exe
  C:\Windows\System\waxUOUd.exe
  2⤵
  PID:8188
- C:\Windows\System\GDPLyhi.exe
  C:\Windows\System\GDPLyhi.exe
  2⤵
  PID:6180
- C:\Windows\System\dgoKEwU.exe
  C:\Windows\System\dgoKEwU.exe
  2⤵
  PID:6292
- C:\Windows\System\BMcqxnI.exe
  C:\Windows\System\BMcqxnI.exe
  2⤵
  PID:6932
- C:\Windows\System\HBUlLWS.exe
  C:\Windows\System\HBUlLWS.exe
  2⤵
  PID:6556
- C:\Windows\System\AigGizW.exe
  C:\Windows\System\AigGizW.exe
  2⤵
  PID:6328
- C:\Windows\System\dbSSKPI.exe
  C:\Windows\System\dbSSKPI.exe
  2⤵
  PID:7068
- C:\Windows\System\MwHtHqI.exe
  C:\Windows\System\MwHtHqI.exe
  2⤵
  PID:7120
- C:\Windows\System\laAxrDf.exe
  C:\Windows\System\laAxrDf.exe
  2⤵
  PID:2380
- C:\Windows\System\jhIJOVC.exe
  C:\Windows\System\jhIJOVC.exe
  2⤵
  PID:5220
- C:\Windows\System\AELjStg.exe
  C:\Windows\System\AELjStg.exe
  2⤵
  PID:6908
- C:\Windows\System\BCjrmiE.exe
  C:\Windows\System\BCjrmiE.exe
  2⤵
  PID:7348
- C:\Windows\System\ZfeSyHx.exe
  C:\Windows\System\ZfeSyHx.exe
  2⤵
  PID:7400
- C:\Windows\System\ntiEBdX.exe
  C:\Windows\System\ntiEBdX.exe
  2⤵
  PID:7472
- C:\Windows\System\qBExhPy.exe
  C:\Windows\System\qBExhPy.exe
  2⤵
  PID:2144
- C:\Windows\System\UMQNAiH.exe
  C:\Windows\System\UMQNAiH.exe
  2⤵
  PID:7564
- C:\Windows\System\uvuhaZE.exe
  C:\Windows\System\uvuhaZE.exe
  2⤵
  PID:7660
- C:\Windows\System\fVLWxHU.exe
  C:\Windows\System\fVLWxHU.exe
  2⤵
  PID:7172
- C:\Windows\System\EEfFakG.exe
  C:\Windows\System\EEfFakG.exe
  2⤵
  PID:7756
- C:\Windows\System\ekMUzQb.exe
  C:\Windows\System\ekMUzQb.exe
  2⤵
  PID:7236
- C:\Windows\System\BIuxzuG.exe
  C:\Windows\System\BIuxzuG.exe
  2⤵
  PID:7312
- C:\Windows\System\MbBhoqy.exe
  C:\Windows\System\MbBhoqy.exe
  2⤵
  PID:7876
- C:\Windows\System\ksiQGfH.exe
  C:\Windows\System\ksiQGfH.exe
  2⤵
  PID:7952
- C:\Windows\System\EKNQEmC.exe
  C:\Windows\System\EKNQEmC.exe
  2⤵
  PID:8196
- C:\Windows\System\sWIZttg.exe
  C:\Windows\System\sWIZttg.exe
  2⤵
  PID:8224
- C:\Windows\System\xNzSyeh.exe
  C:\Windows\System\xNzSyeh.exe
  2⤵
  PID:8248
- C:\Windows\System\gdipXhM.exe
  C:\Windows\System\gdipXhM.exe
  2⤵
  PID:8268
- C:\Windows\System\gqEQgLv.exe
  C:\Windows\System\gqEQgLv.exe
  2⤵
  PID:8292
- C:\Windows\System\eUBjTwC.exe
  C:\Windows\System\eUBjTwC.exe
  2⤵
  PID:8316
- C:\Windows\System\pCNCqqM.exe
  C:\Windows\System\pCNCqqM.exe
  2⤵
  PID:8344
- C:\Windows\System\VZJzgcS.exe
  C:\Windows\System\VZJzgcS.exe
  2⤵
  PID:8368
- C:\Windows\System\FMuoisS.exe
  C:\Windows\System\FMuoisS.exe
  2⤵
  PID:8388
- C:\Windows\System\VeVWySB.exe
  C:\Windows\System\VeVWySB.exe
  2⤵
  PID:8412
- C:\Windows\System\DANJldP.exe
  C:\Windows\System\DANJldP.exe
  2⤵
  PID:8436
- C:\Windows\System\UQQaEpC.exe
  C:\Windows\System\UQQaEpC.exe
  2⤵
  PID:8460
- C:\Windows\System\LlWvbyX.exe
  C:\Windows\System\LlWvbyX.exe
  2⤵
  PID:8484
- C:\Windows\System\WAlemqi.exe
  C:\Windows\System\WAlemqi.exe
  2⤵
  PID:8512
- C:\Windows\System\XPzXrCz.exe
  C:\Windows\System\XPzXrCz.exe
  2⤵
  PID:8540
- C:\Windows\System\kNIlSsr.exe
  C:\Windows\System\kNIlSsr.exe
  2⤵
  PID:8564
- C:\Windows\System\EwZGpDa.exe
  C:\Windows\System\EwZGpDa.exe
  2⤵
  PID:8588
- C:\Windows\System\AdUAkHV.exe
  C:\Windows\System\AdUAkHV.exe
  2⤵
  PID:8612
- C:\Windows\System\FBamppg.exe
  C:\Windows\System\FBamppg.exe
  2⤵
  PID:8640
- C:\Windows\System\NNffxat.exe
  C:\Windows\System\NNffxat.exe
  2⤵
  PID:8664
- C:\Windows\System\lXcVYtu.exe
  C:\Windows\System\lXcVYtu.exe
  2⤵
  PID:8688
- C:\Windows\System\CcwBsDi.exe
  C:\Windows\System\CcwBsDi.exe
  2⤵
  PID:8712
- C:\Windows\System\jFTzFal.exe
  C:\Windows\System\jFTzFal.exe
  2⤵
  PID:8740
- C:\Windows\System\wJTGzEq.exe
  C:\Windows\System\wJTGzEq.exe
  2⤵
  PID:8760
- C:\Windows\System\hyeFGoc.exe
  C:\Windows\System\hyeFGoc.exe
  2⤵
  PID:8780
- C:\Windows\System\aTUZsoT.exe
  C:\Windows\System\aTUZsoT.exe
  2⤵
  PID:8800
- C:\Windows\System\GVznlMJ.exe
  C:\Windows\System\GVznlMJ.exe
  2⤵
  PID:8824
- C:\Windows\System\tyblFFp.exe
  C:\Windows\System\tyblFFp.exe
  2⤵
  PID:8852
- C:\Windows\System\wJzxNVk.exe
  C:\Windows\System\wJzxNVk.exe
  2⤵
  PID:8872
- C:\Windows\System\gComRYM.exe
  C:\Windows\System\gComRYM.exe
  2⤵
  PID:8892
- C:\Windows\System\LtEuklN.exe
  C:\Windows\System\LtEuklN.exe
  2⤵
  PID:8928
- C:\Windows\System\Jhbbbpi.exe
  C:\Windows\System\Jhbbbpi.exe
  2⤵
  PID:8948
- C:\Windows\System\nRwXctD.exe
  C:\Windows\System\nRwXctD.exe
  2⤵
  PID:8968
- C:\Windows\System\iGufQEE.exe
  C:\Windows\System\iGufQEE.exe
  2⤵
  PID:8992
- C:\Windows\System\EWTFZNW.exe
  C:\Windows\System\EWTFZNW.exe
  2⤵
  PID:9020
- C:\Windows\System\EjhakeE.exe
  C:\Windows\System\EjhakeE.exe
  2⤵
  PID:9052
- C:\Windows\System\AHVivpa.exe
  C:\Windows\System\AHVivpa.exe
  2⤵
  PID:9072
- C:\Windows\System\BgeGCZX.exe
  C:\Windows\System\BgeGCZX.exe
  2⤵
  PID:9096
- C:\Windows\System\svYsLex.exe
  C:\Windows\System\svYsLex.exe
  2⤵
  PID:9128
- C:\Windows\System\KiHenUy.exe
  C:\Windows\System\KiHenUy.exe
  2⤵
  PID:9148
- C:\Windows\System\aQaZSvv.exe
  C:\Windows\System\aQaZSvv.exe
  2⤵
  PID:9176
- C:\Windows\System\iEVHtFS.exe
  C:\Windows\System\iEVHtFS.exe
  2⤵
  PID:9196
- C:\Windows\System\CXzRUzj.exe
  C:\Windows\System\CXzRUzj.exe
  2⤵
  PID:7528
- C:\Windows\System\etOEQOM.exe
  C:\Windows\System\etOEQOM.exe
  2⤵
  PID:8032
- C:\Windows\System\aXYBGVE.exe
  C:\Windows\System\aXYBGVE.exe
  2⤵
  PID:8132
- C:\Windows\System\zwbyfpp.exe
  C:\Windows\System\zwbyfpp.exe
  2⤵
  PID:7700
- C:\Windows\System\mlZbLba.exe
  C:\Windows\System\mlZbLba.exe
  2⤵
  PID:6264
- C:\Windows\System\MxhoAJX.exe
  C:\Windows\System\MxhoAJX.exe
  2⤵
  PID:7748
- C:\Windows\System\HXLYUYT.exe
  C:\Windows\System\HXLYUYT.exe
  2⤵
  PID:6948
- C:\Windows\System\fAmxTsL.exe
  C:\Windows\System\fAmxTsL.exe
  2⤵
  PID:7864
- C:\Windows\System\IhHtAGf.exe
  C:\Windows\System\IhHtAGf.exe
  2⤵
  PID:7192
- C:\Windows\System\OSdidre.exe
  C:\Windows\System\OSdidre.exe
  2⤵
  PID:7436
- C:\Windows\System\oFdIKeD.exe
  C:\Windows\System\oFdIKeD.exe
  2⤵
  PID:8232
- C:\Windows\System\iaqKPUm.exe
  C:\Windows\System\iaqKPUm.exe
  2⤵
  PID:8276
- C:\Windows\System\DmbnjgU.exe
  C:\Windows\System\DmbnjgU.exe
  2⤵
  PID:8324
- C:\Windows\System\kxiQhpU.exe
  C:\Windows\System\kxiQhpU.exe
  2⤵
  PID:7612
- C:\Windows\System\TMqbqAh.exe
  C:\Windows\System\TMqbqAh.exe
  2⤵
  PID:7640
- C:\Windows\System\IuUywkh.exe
  C:\Windows\System\IuUywkh.exe
  2⤵
  PID:8180
- C:\Windows\System\VlydcVX.exe
  C:\Windows\System\VlydcVX.exe
  2⤵
  PID:6560
- C:\Windows\System\SGPgIsu.exe
  C:\Windows\System\SGPgIsu.exe
  2⤵
  PID:8532
- C:\Windows\System\RBZqdoe.exe
  C:\Windows\System\RBZqdoe.exe
  2⤵
  PID:8580
- C:\Windows\System\PsKkXrJ.exe
  C:\Windows\System\PsKkXrJ.exe
  2⤵
  PID:7796
- C:\Windows\System\WjhgeHv.exe
  C:\Windows\System\WjhgeHv.exe
  2⤵
  PID:7244
- C:\Windows\System\IGsYQdg.exe
  C:\Windows\System\IGsYQdg.exe
  2⤵
  PID:8752
- C:\Windows\System\qendbVV.exe
  C:\Windows\System\qendbVV.exe
  2⤵
  PID:7332
- C:\Windows\System\qkzySOQ.exe
  C:\Windows\System\qkzySOQ.exe
  2⤵
  PID:8868
- C:\Windows\System\udQHurz.exe
  C:\Windows\System\udQHurz.exe
  2⤵
  PID:7732
- C:\Windows\System\KgMzZZP.exe
  C:\Windows\System\KgMzZZP.exe
  2⤵
  PID:8988
- C:\Windows\System\DbABpSr.exe
  C:\Windows\System\DbABpSr.exe
  2⤵
  PID:9240
- C:\Windows\System\wsQlvqR.exe
  C:\Windows\System\wsQlvqR.exe
  2⤵
  PID:9268
- C:\Windows\System\szDCBKk.exe
  C:\Windows\System\szDCBKk.exe
  2⤵
  PID:9288
- C:\Windows\System\SSOsEHf.exe
  C:\Windows\System\SSOsEHf.exe
  2⤵
  PID:9304
- C:\Windows\System\hvetDcy.exe
  C:\Windows\System\hvetDcy.exe
  2⤵
  PID:9328
- C:\Windows\System\gLLvIrp.exe
  C:\Windows\System\gLLvIrp.exe
  2⤵
  PID:9352
- C:\Windows\System\UfePdjC.exe
  C:\Windows\System\UfePdjC.exe
  2⤵
  PID:9372
- C:\Windows\System\zVMKugN.exe
  C:\Windows\System\zVMKugN.exe
  2⤵
  PID:9400
- C:\Windows\System\aJCdcZT.exe
  C:\Windows\System\aJCdcZT.exe
  2⤵
  PID:9420
- C:\Windows\System\ozjmyLR.exe
  C:\Windows\System\ozjmyLR.exe
  2⤵
  PID:9448
- C:\Windows\System\KuuWSqO.exe
  C:\Windows\System\KuuWSqO.exe
  2⤵
  PID:9468
- C:\Windows\System\sFIERqn.exe
  C:\Windows\System\sFIERqn.exe
  2⤵
  PID:9492
- C:\Windows\System\YGuDZNQ.exe
  C:\Windows\System\YGuDZNQ.exe
  2⤵
  PID:9516
- C:\Windows\System\qZmgcpC.exe
  C:\Windows\System\qZmgcpC.exe
  2⤵
  PID:9536
- C:\Windows\System\QBkuujh.exe
  C:\Windows\System\QBkuujh.exe
  2⤵
  PID:9560
- C:\Windows\System\qwJicCk.exe
  C:\Windows\System\qwJicCk.exe
  2⤵
  PID:9584
- C:\Windows\System\RErbcsk.exe
  C:\Windows\System\RErbcsk.exe
  2⤵
  PID:9600
- C:\Windows\System\IGNSWXt.exe
  C:\Windows\System\IGNSWXt.exe
  2⤵
  PID:9616
- C:\Windows\System\HfoGAIT.exe
  C:\Windows\System\HfoGAIT.exe
  2⤵
  PID:9644
- C:\Windows\System\xVgTjPx.exe
  C:\Windows\System\xVgTjPx.exe
  2⤵
  PID:9668
- C:\Windows\System\wUrTgJD.exe
  C:\Windows\System\wUrTgJD.exe
  2⤵
  PID:9688
- C:\Windows\System\dogjwrH.exe
  C:\Windows\System\dogjwrH.exe
  2⤵
  PID:9716
- C:\Windows\System\NgcDxem.exe
  C:\Windows\System\NgcDxem.exe
  2⤵
  PID:9736
- C:\Windows\System\UbViSZx.exe
  C:\Windows\System\UbViSZx.exe
  2⤵
  PID:9760
- C:\Windows\System\BDUSPmA.exe
  C:\Windows\System\BDUSPmA.exe
  2⤵
  PID:9784
- C:\Windows\System\UnjBhKv.exe
  C:\Windows\System\UnjBhKv.exe
  2⤵
  PID:9808
- C:\Windows\System\ncCbKuk.exe
  C:\Windows\System\ncCbKuk.exe
  2⤵
  PID:6420
- C:\Windows\System\uFCwlbs.exe
  C:\Windows\System\uFCwlbs.exe
  2⤵
  PID:6748
- C:\Windows\System\SowWeAl.exe
  C:\Windows\System\SowWeAl.exe
  2⤵
  PID:7936
- C:\Windows\System\vxxQxex.exe
  C:\Windows\System\vxxQxex.exe
  2⤵
  PID:9344
- C:\Windows\System\bmThdXo.exe
  C:\Windows\System\bmThdXo.exe
  2⤵
  PID:6860
- C:\Windows\System\qkToKMA.exe
  C:\Windows\System\qkToKMA.exe
  2⤵
  PID:6528
- C:\Windows\System\PSaEFnY.exe
  C:\Windows\System\PSaEFnY.exe
  2⤵
  PID:9752
- C:\Windows\System\wmaoACd.exe
  C:\Windows\System\wmaoACd.exe
  2⤵
  PID:7028
- C:\Windows\System\mJmoPMi.exe
  C:\Windows\System\mJmoPMi.exe
  2⤵
  PID:8556
- C:\Windows\System\FskWgRQ.exe
  C:\Windows\System\FskWgRQ.exe
  2⤵
  PID:9860
- C:\Windows\System\OkSCflX.exe
  C:\Windows\System\OkSCflX.exe
  2⤵
  PID:8628
- C:\Windows\System\ngZiSXt.exe
  C:\Windows\System\ngZiSXt.exe
  2⤵
  PID:8724
- C:\Windows\System\ULxEecI.exe
  C:\Windows\System\ULxEecI.exe
  2⤵
  PID:9984
- C:\Windows\System\XkTVlWO.exe
  C:\Windows\System\XkTVlWO.exe
  2⤵
  PID:8964
- C:\Windows\System\EzHGSyp.exe
  C:\Windows\System\EzHGSyp.exe
  2⤵
  PID:9264
- C:\Windows\System\sQtBWjR.exe
  C:\Windows\System\sQtBWjR.exe
  2⤵
  PID:9112
- C:\Windows\System\LbboVcY.exe
  C:\Windows\System\LbboVcY.exe
  2⤵
  PID:9416
- C:\Windows\System\AcmwkqN.exe
  C:\Windows\System\AcmwkqN.exe
  2⤵
  PID:9204
- C:\Windows\System\MkmrTmc.exe
  C:\Windows\System\MkmrTmc.exe
  2⤵
  PID:9660
- C:\Windows\System\ZBMhXMO.exe
  C:\Windows\System\ZBMhXMO.exe
  2⤵
  PID:6252
- C:\Windows\System\dKogoRs.exe
  C:\Windows\System\dKogoRs.exe
  2⤵
  PID:10252
- C:\Windows\System\ujEltOO.exe
  C:\Windows\System\ujEltOO.exe
  2⤵
  PID:10272
- C:\Windows\System\FoCEoIP.exe
  C:\Windows\System\FoCEoIP.exe
  2⤵
  PID:10296
- C:\Windows\System\QqcUKoP.exe
  C:\Windows\System\QqcUKoP.exe
  2⤵
  PID:10320
- C:\Windows\System\mZPWCZi.exe
  C:\Windows\System\mZPWCZi.exe
  2⤵
  PID:10344
- C:\Windows\System\PpFEJST.exe
  C:\Windows\System\PpFEJST.exe
  2⤵
  PID:10368
- C:\Windows\System\xgfJIil.exe
  C:\Windows\System\xgfJIil.exe
  2⤵
  PID:10396
- C:\Windows\System\gLWOOvY.exe
  C:\Windows\System\gLWOOvY.exe
  2⤵
  PID:10420
- C:\Windows\System\QdYmpfC.exe
  C:\Windows\System\QdYmpfC.exe
  2⤵
  PID:10448
- C:\Windows\System\XObLHJl.exe
  C:\Windows\System\XObLHJl.exe
  2⤵
  PID:10488
- C:\Windows\System\FCshaHS.exe
  C:\Windows\System\FCshaHS.exe
  2⤵
  PID:10524
- C:\Windows\System\rBUabSD.exe
  C:\Windows\System\rBUabSD.exe
  2⤵
  PID:10540
- C:\Windows\System\vZsOmxh.exe
  C:\Windows\System\vZsOmxh.exe
  2⤵
  PID:10564
- C:\Windows\System\xxhtofI.exe
  C:\Windows\System\xxhtofI.exe
  2⤵
  PID:10584
- C:\Windows\System\Dkgukwr.exe
  C:\Windows\System\Dkgukwr.exe
  2⤵
  PID:10612
- C:\Windows\System\GNXDcSG.exe
  C:\Windows\System\GNXDcSG.exe
  2⤵
  PID:10636
- C:\Windows\System\cVQqyOW.exe
  C:\Windows\System\cVQqyOW.exe
  2⤵
  PID:10660
- C:\Windows\System\nDloMSY.exe
  C:\Windows\System\nDloMSY.exe
  2⤵
  PID:10680
- C:\Windows\System\TZDcFjf.exe
  C:\Windows\System\TZDcFjf.exe
  2⤵
  PID:10708
- C:\Windows\System\QrqInGZ.exe
  C:\Windows\System\QrqInGZ.exe
  2⤵
  PID:10728
- C:\Windows\System\eSVqZOj.exe
  C:\Windows\System\eSVqZOj.exe
  2⤵
  PID:10752
- C:\Windows\System\bvCvpeY.exe
  C:\Windows\System\bvCvpeY.exe
  2⤵
  PID:10780
- C:\Windows\System\EwbWQlL.exe
  C:\Windows\System\EwbWQlL.exe
  2⤵
  PID:10800
- C:\Windows\System\SnlYbpv.exe
  C:\Windows\System\SnlYbpv.exe
  2⤵
  PID:10828
- C:\Windows\System\WFtDkHt.exe
  C:\Windows\System\WFtDkHt.exe
  2⤵
  PID:10848
- C:\Windows\System\aEkZhgu.exe
  C:\Windows\System\aEkZhgu.exe
  2⤵
  PID:10868
- C:\Windows\System\mKIBYEo.exe
  C:\Windows\System\mKIBYEo.exe
  2⤵
  PID:10892
- C:\Windows\System\jfrMwhF.exe
  C:\Windows\System\jfrMwhF.exe
  2⤵
  PID:10924
- C:\Windows\System\JfSYuPT.exe
  C:\Windows\System\JfSYuPT.exe
  2⤵
  PID:10948
- C:\Windows\System\EOeVXOE.exe
  C:\Windows\System\EOeVXOE.exe
  2⤵
  PID:10968
- C:\Windows\System\zOUICLE.exe
  C:\Windows\System\zOUICLE.exe
  2⤵
  PID:10992
- C:\Windows\System\wvpMZAu.exe
  C:\Windows\System\wvpMZAu.exe
  2⤵
  PID:11020
- C:\Windows\System\MiMPWYe.exe
  C:\Windows\System\MiMPWYe.exe
  2⤵
  PID:11040
- C:\Windows\System\KyoxUjh.exe
  C:\Windows\System\KyoxUjh.exe
  2⤵
  PID:11068
- C:\Windows\System\LahXQma.exe
  C:\Windows\System\LahXQma.exe
  2⤵
  PID:11088
- C:\Windows\System\rwTtfqF.exe
  C:\Windows\System\rwTtfqF.exe
  2⤵
  PID:11116
- C:\Windows\System\mcVVvCu.exe
  C:\Windows\System\mcVVvCu.exe
  2⤵
  PID:11136
- C:\Windows\System\nOCDWJv.exe
  C:\Windows\System\nOCDWJv.exe
  2⤵
  PID:11164
- C:\Windows\System\RkMBLtU.exe
  C:\Windows\System\RkMBLtU.exe
  2⤵
  PID:11188
- C:\Windows\System\rogeheh.exe
  C:\Windows\System\rogeheh.exe
  2⤵
  PID:11208
- C:\Windows\System\gnfBYLH.exe
  C:\Windows\System\gnfBYLH.exe
  2⤵
  PID:11228
- C:\Windows\System\WvbzMiC.exe
  C:\Windows\System\WvbzMiC.exe
  2⤵
  PID:11256
- C:\Windows\System\skKYreE.exe
  C:\Windows\System\skKYreE.exe
  2⤵
  PID:8384
- C:\Windows\System\GEIVBbq.exe
  C:\Windows\System\GEIVBbq.exe
  2⤵
  PID:6996
- C:\Windows\System\xyQDgQO.exe
  C:\Windows\System\xyQDgQO.exe
  2⤵
  PID:9976
- C:\Windows\System\TycuboH.exe
  C:\Windows\System\TycuboH.exe
  2⤵
  PID:6904
- C:\Windows\System\VFvdJjW.exe
  C:\Windows\System\VFvdJjW.exe
  2⤵
  PID:9224
- C:\Windows\System\PbQJris.exe
  C:\Windows\System\PbQJris.exe
  2⤵
  PID:8940
- C:\Windows\System\sqSasfL.exe
  C:\Windows\System\sqSasfL.exe
  2⤵
  PID:9296
- C:\Windows\System\LEEFmgf.exe
  C:\Windows\System\LEEFmgf.exe
  2⤵
  PID:9368
- C:\Windows\System\jyGvDni.exe
  C:\Windows\System\jyGvDni.exe
  2⤵
  PID:7784
- C:\Windows\System\UwUoUtK.exe
  C:\Windows\System\UwUoUtK.exe
  2⤵
  PID:10156
- C:\Windows\System\cdkUUvl.exe
  C:\Windows\System\cdkUUvl.exe
  2⤵
  PID:9500
- C:\Windows\System\FxLLnht.exe
  C:\Windows\System\FxLLnht.exe
  2⤵
  PID:8792
- C:\Windows\System\sKbWJkq.exe
  C:\Windows\System\sKbWJkq.exe
  2⤵
  PID:9256
- C:\Windows\System\nXlAvmu.exe
  C:\Windows\System\nXlAvmu.exe
  2⤵
  PID:9632
- C:\Windows\System\jgKpCkJ.exe
  C:\Windows\System\jgKpCkJ.exe
  2⤵
  PID:9748
- C:\Windows\System\DTdSHWW.exe
  C:\Windows\System\DTdSHWW.exe
  2⤵
  PID:9792
- C:\Windows\System\SIgBVyK.exe
  C:\Windows\System\SIgBVyK.exe
  2⤵
  PID:9816
- C:\Windows\System\iFkGcXx.exe
  C:\Windows\System\iFkGcXx.exe
  2⤵
  PID:10336
- C:\Windows\System\LABMDJc.exe
  C:\Windows\System\LABMDJc.exe
  2⤵
  PID:9884
- C:\Windows\System\BDFGAJk.exe
  C:\Windows\System\BDFGAJk.exe
  2⤵
  PID:10496
- C:\Windows\System\kQeWKZr.exe
  C:\Windows\System\kQeWKZr.exe
  2⤵
  PID:10576
- C:\Windows\System\mtPxBiC.exe
  C:\Windows\System\mtPxBiC.exe
  2⤵
  PID:10648
- C:\Windows\System\cDrvATl.exe
  C:\Windows\System\cDrvATl.exe
  2⤵
  PID:7684
- C:\Windows\System\GWOrWeQ.exe
  C:\Windows\System\GWOrWeQ.exe
  2⤵
  PID:10716
- C:\Windows\System\fNhUpdz.exe
  C:\Windows\System\fNhUpdz.exe
  2⤵
  PID:10748
- C:\Windows\System\bqjHJSp.exe
  C:\Windows\System\bqjHJSp.exe
  2⤵
  PID:10864
- C:\Windows\System\NIopvCD.exe
  C:\Windows\System\NIopvCD.exe
  2⤵
  PID:8332
- C:\Windows\System\AyHKLdx.exe
  C:\Windows\System\AyHKLdx.exe
  2⤵
  PID:9836
- C:\Windows\System\yuomHRX.exe
  C:\Windows\System\yuomHRX.exe
  2⤵
  PID:8700
- C:\Windows\System\QCMTyWG.exe
  C:\Windows\System\QCMTyWG.exe
  2⤵
  PID:11076
- C:\Windows\System\oToAtDt.exe
  C:\Windows\System\oToAtDt.exe
  2⤵
  PID:9436
- C:\Windows\System\eFLGIWh.exe
  C:\Windows\System\eFLGIWh.exe
  2⤵
  PID:11180
- C:\Windows\System\WEOiagO.exe
  C:\Windows\System\WEOiagO.exe
  2⤵
  PID:11248
- C:\Windows\System\LLvVOUa.exe
  C:\Windows\System\LLvVOUa.exe
  2⤵
  PID:10364
- C:\Windows\System\bCAwnLO.exe
  C:\Windows\System\bCAwnLO.exe
  2⤵
  PID:11268
- C:\Windows\System\gAbYPGh.exe
  C:\Windows\System\gAbYPGh.exe
  2⤵
  PID:11292
- C:\Windows\System\wgODmIb.exe
  C:\Windows\System\wgODmIb.exe
  2⤵
  PID:11316
- C:\Windows\System\uMKLXoC.exe
  C:\Windows\System\uMKLXoC.exe
  2⤵
  PID:11336
- C:\Windows\System\TReeQkI.exe
  C:\Windows\System\TReeQkI.exe
  2⤵
  PID:11356
- C:\Windows\System\ETDGUsY.exe
  C:\Windows\System\ETDGUsY.exe
  2⤵
  PID:11380
- C:\Windows\System\IXLAETX.exe
  C:\Windows\System\IXLAETX.exe
  2⤵
  PID:11404
- C:\Windows\System\cUxYJJJ.exe
  C:\Windows\System\cUxYJJJ.exe
  2⤵
  PID:11424
- C:\Windows\System\jwbZjfX.exe
  C:\Windows\System\jwbZjfX.exe
  2⤵
  PID:11440
- C:\Windows\System\yewbcjC.exe
  C:\Windows\System\yewbcjC.exe
  2⤵
  PID:11464
- C:\Windows\System\infWfCX.exe
  C:\Windows\System\infWfCX.exe
  2⤵
  PID:11488
- C:\Windows\System\AVzwbQD.exe
  C:\Windows\System\AVzwbQD.exe
  2⤵
  PID:11508
- C:\Windows\System\OxLdGGk.exe
  C:\Windows\System\OxLdGGk.exe
  2⤵
  PID:11528
- C:\Windows\System\kdsDypp.exe
  C:\Windows\System\kdsDypp.exe
  2⤵
  PID:11556
- C:\Windows\System\MPwbHcJ.exe
  C:\Windows\System\MPwbHcJ.exe
  2⤵
  PID:11580
- C:\Windows\System\gIOgWbp.exe
  C:\Windows\System\gIOgWbp.exe
  2⤵
  PID:11608
- C:\Windows\System\PDCqEAO.exe
  C:\Windows\System\PDCqEAO.exe
  2⤵
  PID:11636
- C:\Windows\System\WTyDsQt.exe
  C:\Windows\System\WTyDsQt.exe
  2⤵
  PID:11660
- C:\Windows\System\VuJNkmO.exe
  C:\Windows\System\VuJNkmO.exe
  2⤵
  PID:11684
- C:\Windows\System\wfvMXUg.exe
  C:\Windows\System\wfvMXUg.exe
  2⤵
  PID:11708
- C:\Windows\System\xIKpuzH.exe
  C:\Windows\System\xIKpuzH.exe
  2⤵
  PID:11740
- C:\Windows\System\FPvTahs.exe
  C:\Windows\System\FPvTahs.exe
  2⤵
  PID:11760
- C:\Windows\System\dsRMLug.exe
  C:\Windows\System\dsRMLug.exe
  2⤵
  PID:11780
- C:\Windows\System\fmcJMIk.exe
  C:\Windows\System\fmcJMIk.exe
  2⤵
  PID:11800
- C:\Windows\System\YISXIeI.exe
  C:\Windows\System\YISXIeI.exe
  2⤵
  PID:11816
- C:\Windows\System\KnLDYOV.exe
  C:\Windows\System\KnLDYOV.exe
  2⤵
  PID:11832
- C:\Windows\System\OMaGXrr.exe
  C:\Windows\System\OMaGXrr.exe
  2⤵
  PID:11852
- C:\Windows\System\IvIAfSa.exe
  C:\Windows\System\IvIAfSa.exe
  2⤵
  PID:11868
- C:\Windows\System\luzMmfw.exe
  C:\Windows\System\luzMmfw.exe
  2⤵
  PID:11888
- C:\Windows\System\UFBYLoS.exe
  C:\Windows\System\UFBYLoS.exe
  2⤵
  PID:11904
- C:\Windows\System\MDPcLJs.exe
  C:\Windows\System\MDPcLJs.exe
  2⤵
  PID:11932
- C:\Windows\System\FCOHHSZ.exe
  C:\Windows\System\FCOHHSZ.exe
  2⤵
  PID:11952
- C:\Windows\System\bTuroSh.exe
  C:\Windows\System\bTuroSh.exe
  2⤵
  PID:11980
- C:\Windows\System\eYvWAfu.exe
  C:\Windows\System\eYvWAfu.exe
  2⤵
  PID:12004
- C:\Windows\System\HprkeUl.exe
  C:\Windows\System\HprkeUl.exe
  2⤵
  PID:12028
- C:\Windows\System\PPgpXNy.exe
  C:\Windows\System\PPgpXNy.exe
  2⤵
  PID:12052
- C:\Windows\System\pbXNSiJ.exe
  C:\Windows\System\pbXNSiJ.exe
  2⤵
  PID:12076
- C:\Windows\System\reuuHoE.exe
  C:\Windows\System\reuuHoE.exe
  2⤵
  PID:12096
- C:\Windows\System\FHbkoCM.exe
  C:\Windows\System\FHbkoCM.exe
  2⤵
  PID:12128
- C:\Windows\System\RvsxlMc.exe
  C:\Windows\System\RvsxlMc.exe
  2⤵
  PID:12152
- C:\Windows\System\dxuzOPH.exe
  C:\Windows\System\dxuzOPH.exe
  2⤵
  PID:12172
- C:\Windows\System\GkcLebr.exe
  C:\Windows\System\GkcLebr.exe
  2⤵
  PID:12196
- C:\Windows\System\dXjaNEz.exe
  C:\Windows\System\dXjaNEz.exe
  2⤵
  PID:12228
- C:\Windows\System\CYZqOBd.exe
  C:\Windows\System\CYZqOBd.exe
  2⤵
  PID:12248
- C:\Windows\System\Tecwyiy.exe
  C:\Windows\System\Tecwyiy.exe
  2⤵
  PID:12280
- C:\Windows\System\LDbOGjk.exe
  C:\Windows\System\LDbOGjk.exe
  2⤵
  PID:9952
- C:\Windows\System\KOzdQoi.exe
  C:\Windows\System\KOzdQoi.exe
  2⤵
  PID:8004
- C:\Windows\System\dihVhKp.exe
  C:\Windows\System\dihVhKp.exe
  2⤵
  PID:10532
- C:\Windows\System\znCkLKu.exe
  C:\Windows\System\znCkLKu.exe
  2⤵
  PID:10556
- C:\Windows\System\bXaZjPT.exe
  C:\Windows\System\bXaZjPT.exe
  2⤵
  PID:7892
- C:\Windows\System\YrqAvgZ.exe
  C:\Windows\System\YrqAvgZ.exe
  2⤵
  PID:8912
- C:\Windows\System\ufhoYLh.exe
  C:\Windows\System\ufhoYLh.exe
  2⤵
  PID:8492
- C:\Windows\System\ghFpTEb.exe
  C:\Windows\System\ghFpTEb.exe
  2⤵
  PID:8352
- C:\Windows\System\NgJNUGE.exe
  C:\Windows\System\NgJNUGE.exe
  2⤵
  PID:7832
- C:\Windows\System\VhKnOpc.exe
  C:\Windows\System\VhKnOpc.exe
  2⤵
  PID:9412
- C:\Windows\System\wjRgvTr.exe
  C:\Windows\System\wjRgvTr.exe
  2⤵
  PID:7428
- C:\Windows\System\SkaLwHi.exe
  C:\Windows\System\SkaLwHi.exe
  2⤵
  PID:8468
- C:\Windows\System\NMOeMzg.exe
  C:\Windows\System\NMOeMzg.exe
  2⤵
  PID:10428
- C:\Windows\System\CaaXwZI.exe
  C:\Windows\System\CaaXwZI.exe
  2⤵
  PID:11372
- C:\Windows\System\LYOGKLq.exe
  C:\Windows\System\LYOGKLq.exe
  2⤵
  PID:10572
- C:\Windows\System\aZSEtuQ.exe
  C:\Windows\System\aZSEtuQ.exe
  2⤵
  PID:10624
- C:\Windows\System\RvDMtQM.exe
  C:\Windows\System\RvDMtQM.exe
  2⤵
  PID:10808
- C:\Windows\System\sXFVZQW.exe
  C:\Windows\System\sXFVZQW.exe
  2⤵
  PID:10268
- C:\Windows\System\sJdWIsB.exe
  C:\Windows\System\sJdWIsB.exe
  2⤵
  PID:11588
- C:\Windows\System\iCYCqmh.exe
  C:\Windows\System\iCYCqmh.exe
  2⤵
  PID:9936
- C:\Windows\System\XwEpOVO.exe
  C:\Windows\System\XwEpOVO.exe
  2⤵
  PID:12312
- C:\Windows\System\nDrbFlY.exe
  C:\Windows\System\nDrbFlY.exe
  2⤵
  PID:12336
- C:\Windows\System\FVhnHmo.exe
  C:\Windows\System\FVhnHmo.exe
  2⤵
  PID:12356
- C:\Windows\System\XyyASMK.exe
  C:\Windows\System\XyyASMK.exe
  2⤵
  PID:12380
- C:\Windows\System\oXNHiCK.exe
  C:\Windows\System\oXNHiCK.exe
  2⤵
  PID:12404
- C:\Windows\System\GmqBOlv.exe
  C:\Windows\System\GmqBOlv.exe
  2⤵
  PID:12428
- C:\Windows\System\Ctyvbqo.exe
  C:\Windows\System\Ctyvbqo.exe
  2⤵
  PID:12456
- C:\Windows\System\cwtsZRB.exe
  C:\Windows\System\cwtsZRB.exe
  2⤵
  PID:12480
- C:\Windows\System\CwpFOav.exe
  C:\Windows\System\CwpFOav.exe
  2⤵
  PID:12504
- C:\Windows\System\nikeDgJ.exe
  C:\Windows\System\nikeDgJ.exe
  2⤵
  PID:12532
- C:\Windows\System\kqpsowB.exe
  C:\Windows\System\kqpsowB.exe
  2⤵
  PID:12556
- C:\Windows\System\mNSpfXf.exe
  C:\Windows\System\mNSpfXf.exe
  2⤵
  PID:12584
- C:\Windows\System\QlQSImG.exe
  C:\Windows\System\QlQSImG.exe
  2⤵
  PID:12612
- C:\Windows\System\ilqiRIq.exe
  C:\Windows\System\ilqiRIq.exe
  2⤵
  PID:12632
- C:\Windows\System\mqGpnTB.exe
  C:\Windows\System\mqGpnTB.exe
  2⤵
  PID:12648
- C:\Windows\System\ghOgirI.exe
  C:\Windows\System\ghOgirI.exe
  2⤵
  PID:12664
- C:\Windows\System\RdsnFVC.exe
  C:\Windows\System\RdsnFVC.exe
  2⤵
  PID:12680
- C:\Windows\System\ikLdHmT.exe
  C:\Windows\System\ikLdHmT.exe
  2⤵
  PID:12700
- C:\Windows\System\YPRDzgz.exe
  C:\Windows\System\YPRDzgz.exe
  2⤵
  PID:12716
- C:\Windows\System\IqDewxl.exe
  C:\Windows\System\IqDewxl.exe
  2⤵
  PID:12732
- C:\Windows\System\EiKxBoF.exe
  C:\Windows\System\EiKxBoF.exe
  2⤵
  PID:12748
- C:\Windows\System\QAvDxGq.exe
  C:\Windows\System\QAvDxGq.exe
  2⤵
  PID:12768
- C:\Windows\System\sdHyboc.exe
  C:\Windows\System\sdHyboc.exe
  2⤵
  PID:12800
- C:\Windows\System\tanFuOE.exe
  C:\Windows\System\tanFuOE.exe
  2⤵
  PID:12820
- C:\Windows\System\SNxaNVQ.exe
  C:\Windows\System\SNxaNVQ.exe
  2⤵
  PID:12840
- C:\Windows\System\WuULYRk.exe
  C:\Windows\System\WuULYRk.exe
  2⤵
  PID:12876
- C:\Windows\System\IxVanrV.exe
  C:\Windows\System\IxVanrV.exe
  2⤵
  PID:12896
- C:\Windows\System\fGWZHFh.exe
  C:\Windows\System\fGWZHFh.exe
  2⤵
  PID:12920
- C:\Windows\System\YOHAfez.exe
  C:\Windows\System\YOHAfez.exe
  2⤵
  PID:12948
- C:\Windows\System\FaleOWU.exe
  C:\Windows\System\FaleOWU.exe
  2⤵
  PID:12972
- C:\Windows\System\VYLrFIg.exe
  C:\Windows\System\VYLrFIg.exe
  2⤵
  PID:12996
- C:\Windows\System\secqFCz.exe
  C:\Windows\System\secqFCz.exe
  2⤵
  PID:13024
- C:\Windows\System\KCJPBBR.exe
  C:\Windows\System\KCJPBBR.exe
  2⤵
  PID:13044
- C:\Windows\System\MEzuPsi.exe
  C:\Windows\System\MEzuPsi.exe
  2⤵
  PID:13068
- C:\Windows\System\pijZsaR.exe
  C:\Windows\System\pijZsaR.exe
  2⤵
  PID:13092
- C:\Windows\System\oMyejAH.exe
  C:\Windows\System\oMyejAH.exe
  2⤵
  PID:13116
- C:\Windows\System\aPcnxoe.exe
  C:\Windows\System\aPcnxoe.exe
  2⤵
  PID:13144
- C:\Windows\System\AYTvscO.exe
  C:\Windows\System\AYTvscO.exe
  2⤵
  PID:13164
- C:\Windows\System\wKPEYJi.exe
  C:\Windows\System\wKPEYJi.exe
  2⤵
  PID:13192
- C:\Windows\System\VuUWVry.exe
  C:\Windows\System\VuUWVry.exe
  2⤵
  PID:13212
- C:\Windows\System\VXHUkEk.exe
  C:\Windows\System\VXHUkEk.exe
  2⤵
  PID:13232
- C:\Windows\System\uXQWdAR.exe
  C:\Windows\System\uXQWdAR.exe
  2⤵
  PID:13260
- C:\Windows\System\oVxkNof.exe
  C:\Windows\System\oVxkNof.exe
  2⤵
  PID:13284
- C:\Windows\System\cxkUlmz.exe
  C:\Windows\System\cxkUlmz.exe
  2⤵
  PID:10700
- C:\Windows\System\pzVGDsA.exe
  C:\Windows\System\pzVGDsA.exe
  2⤵
  PID:11732
- C:\Windows\System\IQMjVNn.exe
  C:\Windows\System\IQMjVNn.exe
  2⤵
  PID:11032
- C:\Windows\System\WvhxqPJ.exe
  C:\Windows\System\WvhxqPJ.exe
  2⤵
  PID:11808
- C:\Windows\System\FRgPMVf.exe
  C:\Windows\System\FRgPMVf.exe
  2⤵
  PID:11112
- C:\Windows\System\bLVydES.exe
  C:\Windows\System\bLVydES.exe
  2⤵
  PID:11976
- C:\Windows\System\nsCmlAU.exe
  C:\Windows\System\nsCmlAU.exe
  2⤵
  PID:10204
- C:\Windows\System\ybkDQCi.exe
  C:\Windows\System\ybkDQCi.exe
  2⤵
  PID:12068
- C:\Windows\System\sRGutJL.exe
  C:\Windows\System\sRGutJL.exe
  2⤵
  PID:8584
- C:\Windows\System\LFKvRLI.exe
  C:\Windows\System\LFKvRLI.exe
  2⤵
  PID:13012
- C:\Windows\System\jtwiETG.exe
  C:\Windows\System\jtwiETG.exe
  2⤵
  PID:8336
- C:\Windows\System\mgojEvY.exe
  C:\Windows\System\mgojEvY.exe
  2⤵
  PID:10260
- C:\Windows\System\FXnRGgg.exe
  C:\Windows\System\FXnRGgg.exe
  2⤵
  PID:12500
- C:\Windows\System\kzubomq.exe
  C:\Windows\System\kzubomq.exe
  2⤵
  PID:12944
- C:\Windows\System\PdqQdrJ.exe
  C:\Windows\System\PdqQdrJ.exe
  2⤵
  PID:13040
- C:\Windows\System\WNfLfxz.exe
  C:\Windows\System\WNfLfxz.exe
  2⤵
  PID:10192
- C:\Windows\System\MtFDIlr.exe
  C:\Windows\System\MtFDIlr.exe
  2⤵
  PID:12660
- C:\Windows\System\TIsKsbY.exe
  C:\Windows\System\TIsKsbY.exe
  2⤵
  PID:12024
- C:\Windows\System\pCbMQda.exe
  C:\Windows\System\pCbMQda.exe
  2⤵
  PID:12164
- C:\Windows\System\qDpSqEl.exe
  C:\Windows\System\qDpSqEl.exe
  2⤵
  PID:10760
- C:\Windows\System\LjXAOEF.exe
  C:\Windows\System\LjXAOEF.exe
  2⤵
  PID:4964
- C:\Windows\System\IfwtqiX.exe
  C:\Windows\System\IfwtqiX.exe
  2⤵
  PID:13204
- C:\Windows\System\rbHiSgk.exe
  C:\Windows\System\rbHiSgk.exe
  2⤵
  PID:13008
- C:\Windows\System\HCdjyyv.exe
  C:\Windows\System\HCdjyyv.exe
  2⤵
  PID:11516
- C:\Windows\System\JYfOFEe.exe
  C:\Windows\System\JYfOFEe.exe
  2⤵
  PID:12760
- C:\Windows\System\xCdCSNn.exe
  C:\Windows\System\xCdCSNn.exe
  2⤵
  PID:9440
- C:\Windows\System\mrIjykT.exe
  C:\Windows\System\mrIjykT.exe
  2⤵
  PID:6140
- C:\Windows\System\wvghOIP.exe
  C:\Windows\System\wvghOIP.exe
  2⤵
  PID:3844
- C:\Windows\System\kxKUHZJ.exe
  C:\Windows\System\kxKUHZJ.exe
  2⤵
  PID:12808
- C:\Windows\System\VzqYKmx.exe
  C:\Windows\System\VzqYKmx.exe
  2⤵
  PID:10744
- C:\Windows\System\UdNTKVl.exe
  C:\Windows\System\UdNTKVl.exe
  2⤵
  PID:8308
- C:\Windows\System\keNRWJV.exe
  C:\Windows\System\keNRWJV.exe
  2⤵
  PID:13276
- C:\Windows\System\pfdfjXU.exe
  C:\Windows\System\pfdfjXU.exe
  2⤵
  PID:13156
- C:\Windows\System\tMDhvQf.exe
  C:\Windows\System\tMDhvQf.exe
  2⤵
  PID:12992
- C:\Windows\System\XzpYIvs.exe
  C:\Windows\System\XzpYIvs.exe
  2⤵
  PID:12728
- C:\Windows\System\SUdNcMF.exe
  C:\Windows\System\SUdNcMF.exe
  2⤵
  PID:4896
- C:\Windows\System\zCNtTIR.exe
  C:\Windows\System\zCNtTIR.exe
  2⤵
  PID:12904
- C:\Windows\System\oszMEZD.exe
  C:\Windows\System\oszMEZD.exe
  2⤵
  PID:6372
- C:\Windows\System\biworgx.exe
  C:\Windows\System\biworgx.exe
  2⤵
  PID:11676
- C:\Windows\System\IrwHIYl.exe
  C:\Windows\System\IrwHIYl.exe
  2⤵
  PID:3208
- C:\Windows\System\REUqZzT.exe
  C:\Windows\System\REUqZzT.exe
  2⤵
  PID:12064
- C:\Windows\System\wEFJpUm.exe
  C:\Windows\System\wEFJpUm.exe
  2⤵
  PID:11552
- C:\Windows\System\xNypXoN.exe
  C:\Windows\System\xNypXoN.exe
  2⤵
  PID:11880
- C:\Windows\System\cuEfcgr.exe
  C:\Windows\System\cuEfcgr.exe
  2⤵
  PID:10416
- C:\Windows\System\QwcuZEh.exe
  C:\Windows\System\QwcuZEh.exe
  2⤵
  PID:12708
- C:\Windows\System\SpZhakK.exe
  C:\Windows\System\SpZhakK.exe
  2⤵
  PID:7960
- C:\Windows\System\CDDVFBu.exe
  C:\Windows\System\CDDVFBu.exe
  2⤵
  PID:12140
- C:\Windows\System\aTcBtHi.exe
  C:\Windows\System\aTcBtHi.exe
  2⤵
  PID:7284
- C:\Windows\System\EzdWmUQ.exe
  C:\Windows\System\EzdWmUQ.exe
  2⤵
  PID:12524
- C:\Windows\System\hpVBFOP.exe
  C:\Windows\System\hpVBFOP.exe
  2⤵
  PID:11060
- C:\Windows\System\WaolKWg.exe
  C:\Windows\System\WaolKWg.exe
  2⤵
  PID:12492
- C:\Windows\System\kVzNrNN.exe
  C:\Windows\System\kVzNrNN.exe
  2⤵
  PID:1704
- C:\Windows\System\OHgumof.exe
  C:\Windows\System\OHgumof.exe
  2⤵
  PID:13436
- C:\Windows\System\pWaIgzr.exe
  C:\Windows\System\pWaIgzr.exe
  2⤵
  PID:13460
- C:\Windows\System\QYydrBM.exe
  C:\Windows\System\QYydrBM.exe
  2⤵
  PID:13964
- C:\Windows\System\sHPCWfT.exe
  C:\Windows\System\sHPCWfT.exe
  2⤵
  PID:14244
- C:\Windows\System\ObSpkrm.exe
  C:\Windows\System\ObSpkrm.exe
  2⤵
  PID:13420
- C:\Windows\System\EJtIyUL.exe
  C:\Windows\System\EJtIyUL.exe
  2⤵
  PID:13476
- C:\Windows\System\YTBUjIL.exe
  C:\Windows\System\YTBUjIL.exe
  2⤵
  PID:13348
- C:\Windows\System\lODCpbI.exe
  C:\Windows\System\lODCpbI.exe
  2⤵
  PID:13384
- C:\Windows\System\IwswuuL.exe
  C:\Windows\System\IwswuuL.exe
  2⤵
  PID:13496
- C:\Windows\System\XHcYRFa.exe
  C:\Windows\System\XHcYRFa.exe
  2⤵
  PID:13560
- C:\Windows\System\BrQwfOB.exe
  C:\Windows\System\BrQwfOB.exe
  2⤵
  PID:13836
- C:\Windows\System\ArhsWcu.exe
  C:\Windows\System\ArhsWcu.exe
  2⤵
  PID:13872
- C:\Windows\System\gQIKpan.exe
  C:\Windows\System\gQIKpan.exe
  2⤵
  PID:13936
- C:\Windows\System\iwSzJzQ.exe
  C:\Windows\System\iwSzJzQ.exe
  2⤵
  PID:14092
- C:\Windows\System\fbimRRm.exe
  C:\Windows\System\fbimRRm.exe
  2⤵
  PID:14224
- C:\Windows\System\FSEQMTB.exe
  C:\Windows\System\FSEQMTB.exe
  2⤵
  PID:14308
- C:\Windows\System\zEzuUKy.exe
  C:\Windows\System\zEzuUKy.exe
  2⤵
  PID:3104
- C:\Windows\System\WhnBUiI.exe
  C:\Windows\System\WhnBUiI.exe
  2⤵
  PID:13332
- C:\Windows\System\qGBflKb.exe
  C:\Windows\System\qGBflKb.exe
  2⤵
  PID:11344
- C:\Windows\System\LNpJqPW.exe
  C:\Windows\System\LNpJqPW.exe
  2⤵
  PID:12240
- C:\Windows\System\EHlzSjX.exe
  C:\Windows\System\EHlzSjX.exe
  2⤵
  PID:14252
- C:\Windows\System\BaaZDLJ.exe
  C:\Windows\System\BaaZDLJ.exe
  2⤵
  PID:11504
- C:\Windows\System\TrMszld.exe
  C:\Windows\System\TrMszld.exe
  2⤵
  PID:13280
- C:\Windows\System\QiTpdpI.exe
  C:\Windows\System\QiTpdpI.exe
  2⤵
  PID:13724
- C:\Windows\System\lMWhigi.exe
  C:\Windows\System\lMWhigi.exe
  2⤵
  PID:12260
- C:\Windows\System\wpPZhqy.exe
  C:\Windows\System\wpPZhqy.exe
  2⤵
  PID:11648
- C:\Windows\System\jEOtGIN.exe
  C:\Windows\System\jEOtGIN.exe
  2⤵
  PID:13484
- C:\Windows\System\HlrRkAX.exe
  C:\Windows\System\HlrRkAX.exe
  2⤵
  PID:13652
- C:\Windows\System\pUXeyay.exe
  C:\Windows\System\pUXeyay.exe
  2⤵
  PID:13492
- C:\Windows\System\NCiigbP.exe
  C:\Windows\System\NCiigbP.exe
  2⤵
  PID:13680
- C:\Windows\System\GugQBga.exe
  C:\Windows\System\GugQBga.exe
  2⤵
  PID:4292
- C:\Windows\System\fkpCIKY.exe
  C:\Windows\System\fkpCIKY.exe
  2⤵
  PID:620
- C:\Windows\System\lNhnPec.exe
  C:\Windows\System\lNhnPec.exe
  2⤵
  PID:4856
- C:\Windows\System\hlZiXqW.exe
  C:\Windows\System\hlZiXqW.exe
  2⤵
  PID:10284
- C:\Windows\System\qbHGiDY.exe
  C:\Windows\System\qbHGiDY.exe
  2⤵
  PID:13400
- C:\Windows\System\TyUTeZa.exe
  C:\Windows\System\TyUTeZa.exe
  2⤵
  PID:13852
- C:\Windows\System\lHmeBFl.exe
  C:\Windows\System\lHmeBFl.exe
  2⤵
  PID:1148
- C:\Windows\System\RCzZPGx.exe
  C:\Windows\System\RCzZPGx.exe
  2⤵
  PID:3748
- C:\Windows\System\YpEgMCq.exe
  C:\Windows\System\YpEgMCq.exe
  2⤵
  PID:744
- C:\Windows\System\xxKqTIY.exe
  C:\Windows\System\xxKqTIY.exe
  2⤵
  PID:5616
- C:\Windows\System\ggaLBCp.exe
  C:\Windows\System\ggaLBCp.exe
  2⤵
  PID:14032
- C:\Windows\System\aMxEYBU.exe
  C:\Windows\System\aMxEYBU.exe
  2⤵
  PID:13304
- C:\Windows\System\UChbLqV.exe
  C:\Windows\System\UChbLqV.exe
  2⤵
  PID:13692
- C:\Windows\System\WlwBwBO.exe
  C:\Windows\System\WlwBwBO.exe
  2⤵
  PID:13712
- C:\Windows\System\Bvaxncl.exe
  C:\Windows\System\Bvaxncl.exe
  2⤵
  PID:13804
- C:\Windows\System\vDxwtSi.exe
  C:\Windows\System\vDxwtSi.exe
  2⤵
  PID:7808
- C:\Windows\System\RlxyFFL.exe
  C:\Windows\System\RlxyFFL.exe
  2⤵
  PID:13828
- C:\Windows\System\urlheZt.exe
  C:\Windows\System\urlheZt.exe
  2⤵
  PID:14132
- C:\Windows\System\SEgzuXO.exe
  C:\Windows\System\SEgzuXO.exe
  2⤵
  PID:14184
- C:\Windows\System\QCbQzGM.exe
  C:\Windows\System\QCbQzGM.exe
  2⤵
  PID:14072
- C:\Windows\System\EEtzGhL.exe
  C:\Windows\System\EEtzGhL.exe
  2⤵
  PID:14212
- C:\Windows\System\lBylXbi.exe
  C:\Windows\System\lBylXbi.exe
  2⤵
  PID:60
- C:\Windows\System\YJWdRFa.exe
  C:\Windows\System\YJWdRFa.exe
  2⤵
  PID:14152
- C:\Windows\System\KshRvQo.exe
  C:\Windows\System\KshRvQo.exe
  2⤵
  PID:3328
- C:\Windows\System\gLTgXfb.exe
  C:\Windows\System\gLTgXfb.exe
  2⤵
  PID:3672
- C:\Windows\System\VDnDTNE.exe
  C:\Windows\System\VDnDTNE.exe
  2⤵
  PID:14220
- C:\Windows\System\tRAJlwl.exe
  C:\Windows\System\tRAJlwl.exe
  2⤵
  PID:12980
- C:\Windows\System\dInFVJY.exe
  C:\Windows\System\dInFVJY.exe
  2⤵
  PID:1540
- C:\Windows\System\clRduzg.exe
  C:\Windows\System\clRduzg.exe
  2⤵
  PID:4632
- C:\Windows\System\iqdPAaB.exe
  C:\Windows\System\iqdPAaB.exe
  2⤵
  PID:14324
- C:\Windows\System\tFkGESd.exe
  C:\Windows\System\tFkGESd.exe
  2⤵
  PID:1052
- C:\Windows\System\tWRXfjN.exe
  C:\Windows\System\tWRXfjN.exe
  2⤵
  PID:1784
- C:\Windows\System\cDvLieZ.exe
  C:\Windows\System\cDvLieZ.exe
  2⤵
  PID:9428
- C:\Windows\System\zPwoDWo.exe
  C:\Windows\System\zPwoDWo.exe
  2⤵
  PID:216
- C:\Windows\System\sIDXkxw.exe
  C:\Windows\System\sIDXkxw.exe
  2⤵
  PID:508
- C:\Windows\System\kWBEDEi.exe
  C:\Windows\System\kWBEDEi.exe
  2⤵
  PID:6004
- C:\Windows\System\IwundjJ.exe
  C:\Windows\System\IwundjJ.exe
  2⤵
  PID:3616
- C:\Windows\System\gwPZTKq.exe
  C:\Windows\System\gwPZTKq.exe
  2⤵
  PID:10504
- C:\Windows\System\FYNjBSg.exe
  C:\Windows\System\FYNjBSg.exe
  2⤵
  PID:4468
- C:\Windows\System\xvETxxR.exe
  C:\Windows\System\xvETxxR.exe
  2⤵
  PID:14008
- C:\Windows\System\CVNOayd.exe
  C:\Windows\System\CVNOayd.exe
  2⤵
  PID:14176
- C:\Windows\System\LpMAfyX.exe
  C:\Windows\System\LpMAfyX.exe
  2⤵
  PID:5036
- C:\Windows\System\JEMSLtW.exe
  C:\Windows\System\JEMSLtW.exe
  2⤵
  PID:2900
- C:\Windows\System\aHkMfTb.exe
  C:\Windows\System\aHkMfTb.exe
  2⤵
  PID:4120
- C:\Windows\System\qqzakSJ.exe
  C:\Windows\System\qqzakSJ.exe
  2⤵
  PID:14200
- C:\Windows\System\dEWXqgk.exe
  C:\Windows\System\dEWXqgk.exe
  2⤵
  PID:4372
- C:\Windows\System\bEGXVfn.exe
  C:\Windows\System\bEGXVfn.exe
  2⤵
  PID:14316
- C:\Windows\System\WRHNXcy.exe
  C:\Windows\System\WRHNXcy.exe
  2⤵
  PID:13980
- C:\Windows\System\SeUmqRU.exe
  C:\Windows\System\SeUmqRU.exe
  2⤵
  PID:3140
- C:\Windows\System\nWTuqWk.exe
  C:\Windows\System\nWTuqWk.exe
  2⤵
  PID:14280
- C:\Windows\System\FmgPUWV.exe
  C:\Windows\System\FmgPUWV.exe
  2⤵
  PID:5820
- C:\Windows\System\iKuIfJK.exe
  C:\Windows\System\iKuIfJK.exe
  2⤵
  PID:5676
- C:\Windows\System\AyGUavE.exe
  C:\Windows\System\AyGUavE.exe
  2⤵
  PID:1772
- C:\Windows\System\COOMPnu.exe
  C:\Windows\System\COOMPnu.exe
  2⤵
  PID:4888
- C:\Windows\System\StLMrvR.exe
  C:\Windows\System\StLMrvR.exe
  2⤵
  PID:5692
- C:\Windows\System\bjEHnxL.exe
  C:\Windows\System\bjEHnxL.exe
  2⤵
  PID:2860
- C:\Windows\System\HbekMJc.exe
  C:\Windows\System\HbekMJc.exe
  2⤵
  PID:13744
- C:\Windows\System\ytwFsvj.exe
  C:\Windows\System\ytwFsvj.exe
  2⤵
  PID:4820
- C:\Windows\System\vGVpMMr.exe
  C:\Windows\System\vGVpMMr.exe
  2⤵
  PID:1500
- C:\Windows\System\wuFDGVD.exe
  C:\Windows\System\wuFDGVD.exe
  2⤵
  PID:2136
- C:\Windows\System\qptgfuz.exe
  C:\Windows\System\qptgfuz.exe
  2⤵
  PID:4188
- C:\Windows\System\trEqQhx.exe
  C:\Windows\System\trEqQhx.exe
  2⤵
  PID:868
- C:\Windows\System\sSzzVIj.exe
  C:\Windows\System\sSzzVIj.exe
  2⤵
  PID:14096
- C:\Windows\System\YUzFyEW.exe
  C:\Windows\System\YUzFyEW.exe
  2⤵
  PID:12836
- C:\Windows\System\YYbwzkS.exe
  C:\Windows\System\YYbwzkS.exe
  2⤵
  PID:548
- C:\Windows\System\rdyNfrM.exe
  C:\Windows\System\rdyNfrM.exe
  2⤵
  PID:2516
- C:\Windows\System\OsglFTn.exe
  C:\Windows\System\OsglFTn.exe
  2⤵
  PID:13344
- C:\Windows\System\zOEvogY.exe
  C:\Windows\System\zOEvogY.exe
  2⤵
  PID:4956
- C:\Windows\System\WKOvdXq.exe
  C:\Windows\System\WKOvdXq.exe
  2⤵
  PID:13984
- C:\Windows\System\swlQpJv.exe
  C:\Windows\System\swlQpJv.exe
  2⤵
  PID:14048
- C:\Windows\System\ypySOeO.exe
  C:\Windows\System\ypySOeO.exe
  2⤵
  PID:3032
- C:\Windows\System\hYYMyID.exe
  C:\Windows\System\hYYMyID.exe
  2⤵
  PID:5136
- C:\Windows\System\YTuBzmF.exe
  C:\Windows\System\YTuBzmF.exe
  2⤵
  PID:5416
- C:\Windows\System\bOnlbGI.exe
  C:\Windows\System\bOnlbGI.exe
  2⤵
  PID:5256
- C:\Windows\System\pYsdIwj.exe
  C:\Windows\System\pYsdIwj.exe
  2⤵
  PID:5184
- C:\Windows\System\NrSMvzk.exe
  C:\Windows\System\NrSMvzk.exe
  2⤵
  PID:5160
- C:\Windows\System\jHvGatx.exe
  C:\Windows\System\jHvGatx.exe
  2⤵
  PID:392
- C:\Windows\System\rUXVZjV.exe
  C:\Windows\System\rUXVZjV.exe
  2⤵
  PID:2228
- C:\Windows\System\DKraCeQ.exe
  C:\Windows\System\DKraCeQ.exe
  2⤵
  PID:14108
- C:\Windows\System\lrkJfPK.exe
  C:\Windows\System\lrkJfPK.exe
  2⤵
  PID:5324
- C:\Windows\System\aPAwsOa.exe
  C:\Windows\System\aPAwsOa.exe
  2⤵
  PID:4492
- C:\Windows\System\niXRpuc.exe
  C:\Windows\System\niXRpuc.exe
  2⤵
  PID:5640
- C:\Windows\System\iuJWhor.exe
  C:\Windows\System\iuJWhor.exe
  2⤵
  PID:2196
- C:\Windows\System\iaShxCK.exe
  C:\Windows\System\iaShxCK.exe
  2⤵
  PID:5208
- C:\Windows\System\qTTJwfZ.exe
  C:\Windows\System\qTTJwfZ.exe
  2⤵
  PID:14288
- C:\Windows\System\CaLWgEA.exe
  C:\Windows\System\CaLWgEA.exe
  2⤵
  PID:5600
- C:\Windows\System\YyiPuQY.exe
  C:\Windows\System\YyiPuQY.exe
  2⤵
  PID:5560
- C:\Windows\System\fWXvcCy.exe
  C:\Windows\System\fWXvcCy.exe
  2⤵
  PID:5348
- C:\Windows\System\fjDPAwh.exe
  C:\Windows\System\fjDPAwh.exe
  2⤵
  PID:1860
- C:\Windows\System\WNJUDCI.exe
  C:\Windows\System\WNJUDCI.exe
  2⤵
  PID:3444
- C:\Windows\System\yMtuSFi.exe
  C:\Windows\System\yMtuSFi.exe
  2⤵
  PID:5188
- C:\Windows\System\CdAYztQ.exe
  C:\Windows\System\CdAYztQ.exe
  2⤵
  PID:4736
- C:\Windows\System\aYNDAOl.exe
  C:\Windows\System\aYNDAOl.exe
  2⤵
  PID:5216
- C:\Windows\System\EiUckMI.exe
  C:\Windows\System\EiUckMI.exe
  2⤵
  PID:14188
- C:\Windows\System\sDoGYAG.exe
  C:\Windows\System\sDoGYAG.exe
  2⤵
  PID:384
- C:\Windows\System\qDmewDO.exe
  C:\Windows\System\qDmewDO.exe
  2⤵
  PID:5728
- C:\Windows\System\NTLSUTt.exe
  C:\Windows\System\NTLSUTt.exe
  2⤵
  PID:2324
- C:\Windows\System\VfmMIov.exe
  C:\Windows\System\VfmMIov.exe
  2⤵
  PID:5152
- C:\Windows\System\yPSSCVY.exe
  C:\Windows\System\yPSSCVY.exe
  2⤵
  PID:5908
- C:\Windows\System\GiBKPnl.exe
  C:\Windows\System\GiBKPnl.exe
  2⤵
  PID:5720
- C:\Windows\System\GNnPrrb.exe
  C:\Windows\System\GNnPrrb.exe
  2⤵
  PID:3924
- C:\Windows\System\OBoDvgo.exe
  C:\Windows\System\OBoDvgo.exe
  2⤵
  PID:5724
- C:\Windows\System\cBTygci.exe
  C:\Windows\System\cBTygci.exe
  2⤵
  PID:3988
- C:\Windows\System\IlincaX.exe
  C:\Windows\System\IlincaX.exe
  2⤵
  PID:14320
- C:\Windows\System\HHiuNdL.exe
  C:\Windows\System\HHiuNdL.exe
  2⤵
  PID:5096
- C:\Windows\System\PllZwUD.exe
  C:\Windows\System\PllZwUD.exe
  2⤵
  PID:5516
- C:\Windows\System\AcirCRi.exe
  C:\Windows\System\AcirCRi.exe
  2⤵
  PID:5332
- C:\Windows\System\NDMjWSk.exe
  C:\Windows\System\NDMjWSk.exe
  2⤵
  PID:5512
- C:\Windows\System\qVZvoDg.exe
  C:\Windows\System\qVZvoDg.exe
  2⤵
  PID:1152
- C:\Windows\System\zjTtnMX.exe
  C:\Windows\System\zjTtnMX.exe
  2⤵
  PID:8
- C:\Windows\System\klDpKYE.exe
  C:\Windows\System\klDpKYE.exe
  2⤵
  PID:5164
- C:\Windows\System\rUmZMDv.exe
  C:\Windows\System\rUmZMDv.exe
  2⤵
  PID:4268
- C:\Windows\System\IoRzIAM.exe
  C:\Windows\System\IoRzIAM.exe
  2⤵
  PID:5632
- C:\Windows\System\fARzXuH.exe
  C:\Windows\System\fARzXuH.exe
  2⤵
  PID:3220
- C:\Windows\System\kSYhViz.exe
  C:\Windows\System\kSYhViz.exe
  2⤵
  PID:6064
- C:\Windows\System\vVEHRab.exe
  C:\Windows\System\vVEHRab.exe
  2⤵
  PID:2124
- C:\Windows\System\DIpLLdD.exe
  C:\Windows\System\DIpLLdD.exe
  2⤵
  PID:4060
- C:\Windows\System\QogyDyK.exe
  C:\Windows\System\QogyDyK.exe
  2⤵
  PID:2504
- C:\Windows\System\vFTENZU.exe
  C:\Windows\System\vFTENZU.exe
  2⤵
  PID:6204
- C:\Windows\System\xcbHbUn.exe
  C:\Windows\System\xcbHbUn.exe
  2⤵
  PID:1624
- C:\Windows\System\RBdlczW.exe
  C:\Windows\System\RBdlczW.exe
  2⤵
  PID:5440
- C:\Windows\System\hXXUSAe.exe
  C:\Windows\System\hXXUSAe.exe
  2⤵
  PID:2464
- C:\Windows\System\gQwysXq.exe
  C:\Windows\System\gQwysXq.exe
  2⤵
  PID:6592
- C:\Windows\System\RWNVkjm.exe
  C:\Windows\System\RWNVkjm.exe
  2⤵
  PID:6440
- C:\Windows\System\uBrTvCB.exe
  C:\Windows\System\uBrTvCB.exe
  2⤵
  PID:6392
- C:\Windows\System\xyAofSz.exe
  C:\Windows\System\xyAofSz.exe
  2⤵
  PID:6368
- C:\Windows\System\SvYPKKA.exe
  C:\Windows\System\SvYPKKA.exe
  2⤵
  PID:6872
- C:\Windows\System\CmQffmE.exe
  C:\Windows\System\CmQffmE.exe
  2⤵
  PID:3108
- C:\Windows\System\nFAFBXD.exe
  C:\Windows\System\nFAFBXD.exe
  2⤵
  PID:6576
- C:\Windows\System\PdboyXs.exe
  C:\Windows\System\PdboyXs.exe
  2⤵
  PID:5700
- C:\Windows\System\kGkHDcy.exe
  C:\Windows\System\kGkHDcy.exe
  2⤵
  PID:6896
- C:\Windows\System\KsZVdhQ.exe
  C:\Windows\System\KsZVdhQ.exe
  2⤵
  PID:13648
- C:\Windows\System\hEjSccZ.exe
  C:\Windows\System\hEjSccZ.exe
  2⤵
  PID:14376
- C:\Windows\System\kGUIPVq.exe
  C:\Windows\System\kGUIPVq.exe
  2⤵
  PID:14408
- C:\Windows\System\gGMRDpT.exe
  C:\Windows\System\gGMRDpT.exe
  2⤵
  PID:14436
- C:\Windows\System\HRdlefF.exe
  C:\Windows\System\HRdlefF.exe
  2⤵
  PID:14484
- C:\Windows\System\WJYejxr.exe
  C:\Windows\System\WJYejxr.exe
  2⤵
  PID:14516
- C:\Windows\System\OLpEXCZ.exe
  C:\Windows\System\OLpEXCZ.exe
  2⤵
  PID:14576
- C:\Windows\System\OXLUIhw.exe
  C:\Windows\System\OXLUIhw.exe
  2⤵
  PID:14596
- C:\Windows\System\DAwKurA.exe
  C:\Windows\System\DAwKurA.exe
  2⤵
  PID:14636
- C:\Windows\System\OnZstHA.exe
  C:\Windows\System\OnZstHA.exe
  2⤵
  PID:14660
- C:\Windows\System\HChrGIr.exe
  C:\Windows\System\HChrGIr.exe
  2⤵
  PID:14772
- C:\Windows\System\uwShtIk.exe
  C:\Windows\System\uwShtIk.exe
  2⤵
  PID:14860
- C:\Windows\System\UJVitOO.exe
  C:\Windows\System\UJVitOO.exe
  2⤵
  PID:14880
- C:\Windows\System\kJPLMAK.exe
  C:\Windows\System\kJPLMAK.exe
  2⤵
  PID:14916
- C:\Windows\System\oTYBXWg.exe
  C:\Windows\System\oTYBXWg.exe
  2⤵
  PID:14940
- C:\Windows\System\gCcmmrr.exe
  C:\Windows\System\gCcmmrr.exe
  2⤵
  PID:14956
- C:\Windows\System\XkzoASf.exe
  C:\Windows\System\XkzoASf.exe
  2⤵
  PID:14976
- C:\Windows\System\PjLoXbP.exe
  C:\Windows\System\PjLoXbP.exe
  2⤵
  PID:15000
- C:\Windows\System\JyxTTbU.exe
  C:\Windows\System\JyxTTbU.exe
  2⤵
  PID:15028
- C:\Windows\System\tJIjDAl.exe
  C:\Windows\System\tJIjDAl.exe
  2⤵
  PID:15068
- C:\Windows\System\LfAHCsL.exe
  C:\Windows\System\LfAHCsL.exe
  2⤵
  PID:15100
- C:\Windows\System\pDTxqRM.exe
  C:\Windows\System\pDTxqRM.exe
  2⤵
  PID:15124
- C:\Windows\System\myPzwzs.exe
  C:\Windows\System\myPzwzs.exe
  2⤵
  PID:15152
- C:\Windows\System\oDXKTQp.exe
  C:\Windows\System\oDXKTQp.exe
  2⤵
  PID:15176
- C:\Windows\System\KRJPadb.exe
  C:\Windows\System\KRJPadb.exe
  2⤵
  PID:15200
- C:\Windows\System\QDyXkDZ.exe
  C:\Windows\System\QDyXkDZ.exe
  2⤵
  PID:15240
- C:\Windows\System\VMJEYjL.exe
  C:\Windows\System\VMJEYjL.exe
  2⤵
  PID:15264
- C:\Windows\System\wGpdJPI.exe
  C:\Windows\System\wGpdJPI.exe
  2⤵
  PID:15288
- C:\Windows\System\dDGRyrD.exe
  C:\Windows\System\dDGRyrD.exe
  2⤵
  PID:15312
- C:\Windows\System\SrPVgdi.exe
  C:\Windows\System\SrPVgdi.exe
  2⤵
  PID:3476
- C:\Windows\System\ZgaMkET.exe
  C:\Windows\System\ZgaMkET.exe
  2⤵
  PID:14444
- C:\Windows\System\onZXHVG.exe
  C:\Windows\System\onZXHVG.exe
  2⤵
  PID:14428
- C:\Windows\System\ziLUPXC.exe
  C:\Windows\System\ziLUPXC.exe
  2⤵
  PID:14544
- C:\Windows\System\ixdPYqp.exe
  C:\Windows\System\ixdPYqp.exe
  2⤵
  PID:14480
- C:\Windows\System\yUJAgeV.exe
  C:\Windows\System\yUJAgeV.exe
  2⤵
  PID:14592
- C:\Windows\System\NhbAlkJ.exe
  C:\Windows\System\NhbAlkJ.exe
  2⤵
  PID:14672
- C:\Windows\System\tzSxCym.exe
  C:\Windows\System\tzSxCym.exe
  2⤵
  PID:14668
- C:\Windows\System\ssNBFog.exe
  C:\Windows\System\ssNBFog.exe
  2⤵
  PID:14680
- C:\Windows\System\ssdCoZJ.exe
  C:\Windows\System\ssdCoZJ.exe
  2⤵
  PID:1384
- C:\Windows\System\RGJKtrh.exe
  C:\Windows\System\RGJKtrh.exe
  2⤵
  PID:14700
- C:\Windows\System\QZYELlP.exe
  C:\Windows\System\QZYELlP.exe
  2⤵
  PID:14760
- C:\Windows\System\dZjYXTv.exe
  C:\Windows\System\dZjYXTv.exe
  2⤵
  PID:3620
- C:\Windows\System\aXyijfR.exe
  C:\Windows\System\aXyijfR.exe
  2⤵
  PID:7572
- C:\Windows\System\NRMfCcB.exe
  C:\Windows\System\NRMfCcB.exe
  2⤵
  PID:7592
- C:\Windows\System\cHOWYga.exe
  C:\Windows\System\cHOWYga.exe
  2⤵
  PID:14896
- C:\Windows\System\czQRkOO.exe
  C:\Windows\System\czQRkOO.exe
  2⤵
  PID:14912
- C:\Windows\System\vHvSwkv.exe
  C:\Windows\System\vHvSwkv.exe
  2⤵
  PID:14928
- C:\Windows\System\jmmXYfQ.exe
  C:\Windows\System\jmmXYfQ.exe
  2⤵
  PID:15116
- C:\Windows\System\BrHVaPu.exe
  C:\Windows\System\BrHVaPu.exe
  2⤵
  PID:15184
- C:\Windows\System\DBcfqyr.exe
  C:\Windows\System\DBcfqyr.exe
  2⤵
  PID:5836
- C:\Windows\System\PvdBWrJ.exe
  C:\Windows\System\PvdBWrJ.exe
  2⤵
  PID:15252
- C:\Windows\System\IbKhtOw.exe
  C:\Windows\System\IbKhtOw.exe
  2⤵
  PID:6952
- C:\Windows\System\nbuFuXR.exe
  C:\Windows\System\nbuFuXR.exe
  2⤵
  PID:15328
- C:\Windows\System\JeVXnlD.exe
  C:\Windows\System\JeVXnlD.exe
  2⤵
  PID:7448
- C:\Windows\System\sMRCcxR.exe
  C:\Windows\System\sMRCcxR.exe
  2⤵
  PID:7032
- C:\Windows\System\GhzvyBn.exe
  C:\Windows\System\GhzvyBn.exe
  2⤵
  PID:14352
- C:\Windows\System\wrjaKOE.exe
  C:\Windows\System\wrjaKOE.exe
  2⤵
  PID:8184
- C:\Windows\System\vMRWUaT.exe
  C:\Windows\System\vMRWUaT.exe
  2⤵
  PID:14468
- C:\Windows\System\dWdrHMe.exe
  C:\Windows\System\dWdrHMe.exe
  2⤵
  PID:7524
- C:\Windows\System\ndONVnO.exe
  C:\Windows\System\ndONVnO.exe
  2⤵
  PID:14400
- C:\Windows\System\YWBTRtt.exe
  C:\Windows\System\YWBTRtt.exe
  2⤵
  PID:14452
- C:\Windows\System\hCBgKeG.exe
  C:\Windows\System\hCBgKeG.exe
  2⤵
  PID:6836
- C:\Windows\System\TaUYLkc.exe
  C:\Windows\System\TaUYLkc.exe
  2⤵
  PID:6956
- C:\Windows\System\EPHDbFz.exe
  C:\Windows\System\EPHDbFz.exe
  2⤵
  PID:7364
- C:\Windows\System\IpScrNw.exe
  C:\Windows\System\IpScrNw.exe
  2⤵
  PID:8356
- C:\Windows\System\TOhvNCf.exe
  C:\Windows\System\TOhvNCf.exe
  2⤵
  PID:9960
- C:\Windows\System\hhDSFna.exe
  C:\Windows\System\hhDSFna.exe
  2⤵
  PID:14804
- C:\Windows\System\rXCSKOh.exe
  C:\Windows\System\rXCSKOh.exe
  2⤵
  PID:14256
- C:\Windows\System\xRJjlxa.exe
  C:\Windows\System\xRJjlxa.exe
  2⤵
  PID:8796
- C:\Windows\System\bRaGfuY.exe
  C:\Windows\System\bRaGfuY.exe
  2⤵
  PID:14756
- C:\Windows\System\zYMqdHK.exe
  C:\Windows\System\zYMqdHK.exe
  2⤵
  PID:13392
- C:\Windows\System\BQBycih.exe
  C:\Windows\System\BQBycih.exe
  2⤵
  PID:6352
- C:\Windows\System\DbVVavk.exe
  C:\Windows\System\DbVVavk.exe
  2⤵
  PID:8848
- C:\Windows\System\nsenDxm.exe
  C:\Windows\System\nsenDxm.exe
  2⤵
  PID:7060
- C:\Windows\System\XIUQKms.exe
  C:\Windows\System\XIUQKms.exe
  2⤵
  PID:7248
- C:\Windows\System\KJykdHa.exe
  C:\Windows\System\KJykdHa.exe
  2⤵
  PID:8376
- C:\Windows\System\slYsADd.exe
  C:\Windows\System\slYsADd.exe
  2⤵
  PID:7212
- C:\Windows\System\PKMYRch.exe
  C:\Windows\System\PKMYRch.exe
  2⤵
  PID:7504
- C:\Windows\System\LrPCdpe.exe
  C:\Windows\System\LrPCdpe.exe
  2⤵
  PID:8636
- C:\Windows\System\syKcaAB.exe
  C:\Windows\System\syKcaAB.exe
  2⤵
  PID:6900
- C:\Windows\System\oIcqoLC.exe
  C:\Windows\System\oIcqoLC.exe
  2⤵
  PID:8280
- C:\Windows\System\jkWnPLt.exe
  C:\Windows\System\jkWnPLt.exe
  2⤵
  PID:7356
- C:\Windows\System\SaNdVbQ.exe
  C:\Windows\System\SaNdVbQ.exe
  2⤵
  PID:8920
- C:\Windows\System\dvdNZPl.exe
  C:\Windows\System\dvdNZPl.exe
  2⤵
  PID:15196
- C:\Windows\System\LRosNKW.exe
  C:\Windows\System\LRosNKW.exe
  2⤵
  PID:15300
- C:\Windows\System\JMRWeFx.exe
  C:\Windows\System\JMRWeFx.exe
  2⤵
  PID:8696
- C:\Windows\System\szVEGEb.exe
  C:\Windows\System\szVEGEb.exe
  2⤵
  PID:7920
- C:\Windows\System\wuhgsgi.exe
  C:\Windows\System\wuhgsgi.exe
  2⤵
  PID:8152
- C:\Windows\System\RRpBXFb.exe
  C:\Windows\System\RRpBXFb.exe
  2⤵
  PID:14016
- C:\Windows\System\ZVOiujg.exe
  C:\Windows\System\ZVOiujg.exe
  2⤵
  PID:14388
- C:\Windows\System\DYoxsKs.exe
  C:\Windows\System\DYoxsKs.exe
  2⤵
  PID:7088
- C:\Windows\System\XMHeNIf.exe
  C:\Windows\System\XMHeNIf.exe
  2⤵
  PID:6992
- C:\Windows\System\yswLyOM.exe
  C:\Windows\System\yswLyOM.exe
  2⤵
  PID:6740
- C:\Windows\System\HmCTEdz.exe
  C:\Windows\System\HmCTEdz.exe
  2⤵
  PID:14604
- C:\Windows\System\clXlkPm.exe
  C:\Windows\System\clXlkPm.exe
  2⤵
  PID:8244
- C:\Windows\System\gJUnnDs.exe
  C:\Windows\System\gJUnnDs.exe
  2⤵
  PID:7776
- C:\Windows\System\eHqOiQX.exe
  C:\Windows\System\eHqOiQX.exe
  2⤵
  PID:13620
- C:\Windows\System\duUQzBG.exe
  C:\Windows\System\duUQzBG.exe
  2⤵
  PID:10020
- C:\Windows\System\SCDUknx.exe
  C:\Windows\System\SCDUknx.exe
  2⤵
  PID:8148
- C:\Windows\System\dXTAGjA.exe
  C:\Windows\System\dXTAGjA.exe
  2⤵
  PID:8060
- C:\Windows\System\aZaEDDr.exe
  C:\Windows\System\aZaEDDr.exe
  2⤵
  PID:7548
- C:\Windows\System\LyZSvaG.exe
  C:\Windows\System\LyZSvaG.exe
  2⤵
  PID:9248
- C:\Windows\System\ADEDxwQ.exe
  C:\Windows\System\ADEDxwQ.exe
  2⤵
  PID:5396
- C:\Windows\System\AsklzNY.exe
  C:\Windows\System\AsklzNY.exe
  2⤵
  PID:10104
- C:\Windows\System\RsUAOeh.exe
  C:\Windows\System\RsUAOeh.exe
  2⤵
  PID:14740
- C:\Windows\System\KPeJYFn.exe
  C:\Windows\System\KPeJYFn.exe
  2⤵
  PID:14788
- C:\Windows\System\BDNUhfk.exe
  C:\Windows\System\BDNUhfk.exe
  2⤵
  PID:7000
- C:\Windows\System\hffmiYb.exe
  C:\Windows\System\hffmiYb.exe
  2⤵
  PID:8704
- C:\Windows\System\onjkcpI.exe
  C:\Windows\System\onjkcpI.exe
  2⤵
  PID:7188
- C:\Windows\System\NrleEtL.exe
  C:\Windows\System\NrleEtL.exe
  2⤵
  PID:15168
- C:\Windows\System\cnanMTx.exe
  C:\Windows\System\cnanMTx.exe
  2⤵
  PID:9896
- C:\Windows\System\KIrEqjO.exe
  C:\Windows\System\KIrEqjO.exe
  2⤵
  PID:6468
- C:\Windows\System\xwbFIHI.exe
  C:\Windows\System\xwbFIHI.exe
  2⤵
  PID:9964
- C:\Windows\System\ljDViZj.exe
  C:\Windows\System\ljDViZj.exe
  2⤵
  PID:9912
- C:\Windows\System\UYMtTmz.exe
  C:\Windows\System\UYMtTmz.exe
  2⤵
  PID:9840
- C:\Windows\System\fAjDUYC.exe
  C:\Windows\System\fAjDUYC.exe
  2⤵
  PID:9880
- C:\Windows\System\FYKfiHI.exe
  C:\Windows\System\FYKfiHI.exe
  2⤵
  PID:14348
- C:\Windows\System\ZYpTMeX.exe
  C:\Windows\System\ZYpTMeX.exe
  2⤵
  PID:14012
- C:\Windows\System\LuyWfNF.exe
  C:\Windows\System\LuyWfNF.exe
  2⤵
  PID:10044
- C:\Windows\System\EUwBGtI.exe
  C:\Windows\System\EUwBGtI.exe
  2⤵
  PID:14356
- C:\Windows\System\lFKcXMi.exe
  C:\Windows\System\lFKcXMi.exe
  2⤵
  PID:9124
- C:\Windows\System\WXqmnPZ.exe
  C:\Windows\System\WXqmnPZ.exe
  2⤵
  PID:8900
- C:\Windows\System\vMeCvhG.exe
  C:\Windows\System\vMeCvhG.exe
  2⤵
  PID:8400
- C:\Windows\System\nIeUzjH.exe
  C:\Windows\System\nIeUzjH.exe
  2⤵
  PID:8548
- C:\Windows\System\VrkUeqo.exe
  C:\Windows\System\VrkUeqo.exe
  2⤵
  PID:10112
- C:\Windows\System\GacKnSu.exe
  C:\Windows\System\GacKnSu.exe
  2⤵
  PID:9008
- C:\Windows\System\wBJZPdN.exe
  C:\Windows\System\wBJZPdN.exe
  2⤵
  PID:5060
- C:\Windows\System\ymgjlTV.exe
  C:\Windows\System\ymgjlTV.exe
  2⤵
  PID:12104
- C:\Windows\System\ufOWQFK.exe
  C:\Windows\System\ufOWQFK.exe
  2⤵
  PID:7412
- C:\Windows\System\TskCEbX.exe
  C:\Windows\System\TskCEbX.exe
  2⤵
  PID:8684
- C:\Windows\System\odswYcH.exe
  C:\Windows\System\odswYcH.exe
  2⤵
  PID:9524
- C:\Windows\System\HalVTOy.exe
  C:\Windows\System\HalVTOy.exe
  2⤵
  PID:10196
- C:\Windows\System\jfBOGVy.exe
  C:\Windows\System\jfBOGVy.exe
  2⤵
  PID:7220
- C:\Windows\System\oTHCpBy.exe
  C:\Windows\System\oTHCpBy.exe
  2⤵
  PID:9656
- C:\Windows\System\ZjPwzbO.exe
  C:\Windows\System\ZjPwzbO.exe
  2⤵
  PID:6804
- C:\Windows\System\USZPqsl.exe
  C:\Windows\System\USZPqsl.exe
  2⤵
  PID:14876
- C:\Windows\System\LQlOKXr.exe
  C:\Windows\System\LQlOKXr.exe
  2⤵
  PID:7988
- C:\Windows\System\BcrpjGO.exe
  C:\Windows\System\BcrpjGO.exe
  2⤵
  PID:8420
- C:\Windows\System\moGwznm.exe
  C:\Windows\System\moGwznm.exe
  2⤵
  PID:10500
- C:\Windows\System\qAMPMty.exe
  C:\Windows\System\qAMPMty.exe
  2⤵
  PID:8380
- C:\Windows\System\uswTuZG.exe
  C:\Windows\System\uswTuZG.exe
  2⤵
  PID:11096
- C:\Windows\System\NWVeCnI.exe
  C:\Windows\System\NWVeCnI.exe
  2⤵
  PID:10904
- C:\Windows\System\uPPgbmy.exe
  C:\Windows\System\uPPgbmy.exe
  2⤵
  PID:10920
- C:\Windows\System\XeZalWx.exe
  C:\Windows\System\XeZalWx.exe
  2⤵
  PID:8524
- C:\Windows\System\eutctVK.exe
  C:\Windows\System\eutctVK.exe
  2⤵
  PID:14204
- C:\Windows\System\cELDrJc.exe
  C:\Windows\System\cELDrJc.exe
  2⤵
  PID:8260
- C:\Windows\System\xvzhATn.exe
  C:\Windows\System\xvzhATn.exe
  2⤵
  PID:9832
- C:\Windows\System\YcEHOob.exe
  C:\Windows\System\YcEHOob.exe
  2⤵
  PID:13820
- C:\Windows\System\WSbijne.exe
  C:\Windows\System\WSbijne.exe
  2⤵
  PID:7136
- C:\Windows\System\gfRrGrC.exe
  C:\Windows\System\gfRrGrC.exe
  2⤵
  PID:9212
- C:\Windows\System\qvSiMWI.exe
  C:\Windows\System\qvSiMWI.exe
  2⤵
  PID:9780
- C:\Windows\System\SZuOOhD.exe
  C:\Windows\System\SZuOOhD.exe
  2⤵
  PID:9992
- C:\Windows\System\efLSpMl.exe
  C:\Windows\System\efLSpMl.exe
  2⤵
  PID:9628
- C:\Windows\System\BciTIpH.exe
  C:\Windows\System\BciTIpH.exe
  2⤵
  PID:8788
- C:\Windows\System\dceawSD.exe
  C:\Windows\System\dceawSD.exe
  2⤵
  PID:11124
- C:\Windows\System\xcknnqq.exe
  C:\Windows\System\xcknnqq.exe
  2⤵
  PID:8288
- C:\Windows\System\XzAizKt.exe
  C:\Windows\System\XzAizKt.exe
  2⤵
  PID:14232
- C:\Windows\System\ZxssWYX.exe
  C:\Windows\System\ZxssWYX.exe
  2⤵
  PID:9480
- C:\Windows\System\efjGtkL.exe
  C:\Windows\System\efjGtkL.exe
  2⤵
  PID:8680
- C:\Windows\System\ByrKpcd.exe
  C:\Windows\System\ByrKpcd.exe
  2⤵
  PID:11108
- C:\Windows\System\amqyFir.exe
  C:\Windows\System\amqyFir.exe
  2⤵
  PID:11184
- C:\Windows\System\VjBgaOm.exe
  C:\Windows\System\VjBgaOm.exe
  2⤵
  PID:10704
- C:\Windows\System\aeQfBpH.exe
  C:\Windows\System\aeQfBpH.exe
  2⤵
  PID:10332
- C:\Windows\System\SkYeITZ.exe
  C:\Windows\System\SkYeITZ.exe
  2⤵
  PID:15112
- C:\Windows\System\VPmEpHE.exe
  C:\Windows\System\VPmEpHE.exe
  2⤵
  PID:7084
- C:\Windows\System\iETfMbO.exe
  C:\Windows\System\iETfMbO.exe
  2⤵
  PID:9608
- C:\Windows\System\UoJeiFa.exe
  C:\Windows\System\UoJeiFa.exe
  2⤵
  PID:9324
- C:\Windows\System\xazfTjl.exe
  C:\Windows\System\xazfTjl.exe
  2⤵
  PID:9868
- C:\Windows\System\RMvQXao.exe
  C:\Windows\System\RMvQXao.exe
  2⤵
  PID:10880
- C:\Windows\System\OTTjWzT.exe
  C:\Windows\System\OTTjWzT.exe
  2⤵
  PID:7984
- C:\Windows\System\jZpnOzx.exe
  C:\Windows\System\jZpnOzx.exe
  2⤵
  PID:14588
- C:\Windows\System\jXtPJEl.exe
  C:\Windows\System\jXtPJEl.exe
  2⤵
  PID:11064
- C:\Windows\System\NUlpnWj.exe
  C:\Windows\System\NUlpnWj.exe
  2⤵
  PID:9980
- C:\Windows\System\gexYzQZ.exe
  C:\Windows\System\gexYzQZ.exe
  2⤵
  PID:7600
- C:\Windows\System\UadtCAJ.exe
  C:\Windows\System\UadtCAJ.exe
  2⤵
  PID:8660
- C:\Windows\System\DyoxBYV.exe
  C:\Windows\System\DyoxBYV.exe
  2⤵
  PID:11620
- C:\Windows\System\dvFYcTy.exe
  C:\Windows\System\dvFYcTy.exe
  2⤵
  PID:14868
- C:\Windows\System\htGonPV.exe
  C:\Windows\System\htGonPV.exe
  2⤵
  PID:10236
- C:\Windows\System\kOLxUDz.exe
  C:\Windows\System\kOLxUDz.exe
  2⤵
  PID:7656
- C:\Windows\System\nctYaRb.exe
  C:\Windows\System\nctYaRb.exe
  2⤵
  PID:11280
- C:\Windows\System\qpxGrVg.exe
  C:\Windows\System\qpxGrVg.exe
  2⤵
  PID:12852
- C:\Windows\System\SgCyQmX.exe
  C:\Windows\System\SgCyQmX.exe
  2⤵
  PID:10008
- C:\Windows\System\cqTJpMx.exe
  C:\Windows\System\cqTJpMx.exe
  2⤵
  PID:10152
- C:\Windows\System\gjMwqzX.exe
  C:\Windows\System\gjMwqzX.exe
  2⤵
  PID:10120
- C:\Windows\System\KmEqmzc.exe
  C:\Windows\System\KmEqmzc.exe
  2⤵
  PID:10216
- C:\Windows\System\HODYvup.exe
  C:\Windows\System\HODYvup.exe
  2⤵
  PID:13308
- C:\Windows\System\ISydgMn.exe
  C:\Windows\System\ISydgMn.exe
  2⤵
  PID:11388
- C:\Windows\System\UJcHhUE.exe
  C:\Windows\System\UJcHhUE.exe
  2⤵
  PID:10144
- C:\Windows\System\cAadkRQ.exe
  C:\Windows\System\cAadkRQ.exe
  2⤵
  PID:12848
- C:\Windows\System\wbxTxVN.exe
  C:\Windows\System\wbxTxVN.exe
  2⤵
  PID:8652
- C:\Windows\System\naYtRTu.exe
  C:\Windows\System\naYtRTu.exe
  2⤵
  PID:13020
- C:\Windows\System\WdtwjeA.exe
  C:\Windows\System\WdtwjeA.exe
  2⤵
  PID:12136
- C:\Windows\System\xwHkKRo.exe
  C:\Windows\System\xwHkKRo.exe
  2⤵
  PID:9184
- C:\Windows\System\WCfRIzy.exe
  C:\Windows\System\WCfRIzy.exe
  2⤵
  PID:13176
- C:\Windows\System\JqGYPym.exe
  C:\Windows\System\JqGYPym.exe
  2⤵
  PID:12236
- C:\Windows\System\QeVjOzW.exe
  C:\Windows\System\QeVjOzW.exe
  2⤵
  PID:10816
- C:\Windows\System\QtFPvys.exe
  C:\Windows\System\QtFPvys.exe
  2⤵
  PID:10824
- C:\Windows\System\hWmxJrg.exe
  C:\Windows\System\hWmxJrg.exe
  2⤵
  PID:9164
- C:\Windows\System\vBsRvCh.exe
  C:\Windows\System\vBsRvCh.exe
  2⤵
  PID:8084
- C:\Windows\System\qIkZBgD.exe
  C:\Windows\System\qIkZBgD.exe
  2⤵
  PID:8608
- C:\Windows\System\YbGWpfq.exe
  C:\Windows\System\YbGWpfq.exe
  2⤵
  PID:10392
- C:\Windows\System\fgBwjBr.exe
  C:\Windows\System\fgBwjBr.exe
  2⤵
  PID:5880
- C:\Windows\System\UgVeFPG.exe
  C:\Windows\System\UgVeFPG.exe
  2⤵
  PID:10304
- C:\Windows\System\HxbWqzx.exe
  C:\Windows\System\HxbWqzx.exe
  2⤵
  PID:10772
- C:\Windows\System\qUxDFBI.exe
  C:\Windows\System\qUxDFBI.exe
  2⤵
  PID:5596
- C:\Windows\System\sspMjZq.exe
  C:\Windows\System\sspMjZq.exe
  2⤵
  PID:12628
- C:\Windows\System\tocdvXO.exe
  C:\Windows\System\tocdvXO.exe
  2⤵
  PID:11680
- C:\Windows\System\TnEJpuz.exe
  C:\Windows\System\TnEJpuz.exe
  2⤵
  PID:10908
- C:\Windows\System\hWDVprm.exe
  C:\Windows\System\hWDVprm.exe
  2⤵
  PID:11004
- C:\Windows\System\gtENIOJ.exe
  C:\Windows\System\gtENIOJ.exe
  2⤵
  PID:10860
- C:\Windows\System\uIGOXdv.exe
  C:\Windows\System\uIGOXdv.exe
  2⤵
  PID:13432
- C:\Windows\System\gGpTxyE.exe
  C:\Windows\System\gGpTxyE.exe
  2⤵
  PID:12060
- C:\Windows\System\hcCaCan.exe
  C:\Windows\System\hcCaCan.exe
  2⤵
  PID:11668
- C:\Windows\System\UkQoxWU.exe
  C:\Windows\System\UkQoxWU.exe
  2⤵
  PID:9800
- C:\Windows\System\sABGJfC.exe
  C:\Windows\System\sABGJfC.exe
  2⤵
  PID:12160
- C:\Windows\System\UcyyNgT.exe
  C:\Windows\System\UcyyNgT.exe
  2⤵
  PID:8924
- C:\Windows\System\AOrPRXO.exe
  C:\Windows\System\AOrPRXO.exe
  2⤵
  PID:12308
- C:\Windows\System\QnrlmJT.exe
  C:\Windows\System\QnrlmJT.exe
  2⤵
  PID:10312
- C:\Windows\System\BohnJUf.exe
  C:\Windows\System\BohnJUf.exe
  2⤵
  PID:11100
- C:\Windows\System\EDKkEUd.exe
  C:\Windows\System\EDKkEUd.exe
  2⤵
  PID:6280
- C:\Windows\System\qXEWNJc.exe
  C:\Windows\System\qXEWNJc.exe
  2⤵
  PID:10656
- C:\Windows\System\rNHRiwC.exe
  C:\Windows\System\rNHRiwC.exe
  2⤵
  PID:14460
- C:\Windows\System\VnNFUOw.exe
  C:\Windows\System\VnNFUOw.exe
  2⤵
  PID:12452
- C:\Windows\System\lrCJwGr.exe
  C:\Windows\System\lrCJwGr.exe
  2⤵
  PID:4720
- C:\Windows\System\LwgwzZj.exe
  C:\Windows\System\LwgwzZj.exe
  2⤵
  PID:7388
- C:\Windows\System\fjBmrwT.exe
  C:\Windows\System\fjBmrwT.exe
  2⤵
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y50knzcv.eyw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AJxOYJT.exe

Filesize
2.3MB

MD5
fa0ff7c3e7faf492c2bebfe2fcbf540a

SHA1
d4ea0b0a5312432093052f3eb3d49c749071802a

SHA256
f782c93ae026986aa721b8a4cbcbb5a6099114839e526365c0eeac20f6743372

SHA512
a2a5c51fb336e086c768415b565f7cb6a7e95bca59ea38a8fe3e0222b947e17619f0e62699f685cd405ab1ba704975a53c0ba2f63132555552155338da33b6f8

Download Submit
C:\Windows\System\EANpTPZ.exe

Filesize
2.3MB

MD5
782acb5682cc103b7c2ac2322d3ef7f1

SHA1
7c91c9c8cfe0da1fbac4dfdcb8bee86c239a504e

SHA256
b8ec84bd77bb266a37868b86e41c50d6bc8cdec5bf9a396ab8b35f05635ce241

SHA512
0a47138ebaef333511e15e70f11c80608efa29af89ab7bdf48ac75fa0731dde60d824d46a2d53d1fcdf7d8ea184736b2fc03f6d8f730b8b6bc1032eb1bb3a202

Download Submit
C:\Windows\System\FFnDyMQ.exe

Filesize
2.3MB

MD5
04ae10f8a99d3ec54b853287afc5e219

SHA1
9929907222d4722b10cbfefaba7ab6b1708586f5

SHA256
22b6298d18b896a2d4604bb02932df46915e9168c1e08a6f451f57873caf2255

SHA512
a5fabccec0266fedae4307a0369321ad09c00313dfe14fd9a2e1bf24b0715c24fa6346f5dca20ca93f8ca3941d1455204d2b83a8fb3fc8b5e6c914ae62d77a9d

Download Submit
C:\Windows\System\FOoBIts.exe

Filesize
2.3MB

MD5
c09c83c807f02ced2e33ce408c8623d7

SHA1
50c6b51c03cb70fcebfcf3b63f23de804975d791

SHA256
b3cba3ca18aebf979d2ce5437b5fc8f691e54c79fc250f38faff3367ee7ef975

SHA512
1b865bd9c33540043bbb39842071a00a3c16b655383aa06de3351998246247472e33ffd133acef0460a6ff3a2d4ce61224242041629c45e286925668d38cc828

Download Submit
C:\Windows\System\FgIYhEj.exe

Filesize
2.3MB

MD5
5759a1d1639d8ef8fa027288b8ec66a9

SHA1
725c200f863b8c061fb08e44e14c6ea61c115d8e

SHA256
df78fd1e71ba526cb656c77cace0da43148455850a82d328d73493626d401d0d

SHA512
2ff8ef73306251e00cb5eefd69e05a84c2c39c3a6316ac84931adc01112429dc577b40216fbac3d2f2a38df0c82de61a9362255d1c1ac750fc81b8c616d053cc

Download Submit
C:\Windows\System\GAZeFIy.exe

Filesize
2.3MB

MD5
be3ed1b16f6377781bf0084c7fc3da79

SHA1
24ef89aee7f2d115c9b9d143811e0ca85e7511fe

SHA256
399309dc5859ddb485cda33e8b8353c0b7a6caf1f69371dc159363ff9302c332

SHA512
1ff820f46b69ea408b1d97e419c086e237ae9e4bbdb739cd40a8a00317ed6d94e7e532afe205be7bd8a975c2331591b1855883b394e5fa9959582caf4e1bd238

Download Submit
C:\Windows\System\GmGCEfm.exe

Filesize
2.3MB

MD5
56f5818154db4a0c31f2f5d1a81cc0e7

SHA1
5cc49401c0492ec2f754611fbcbbf6e281b09f18

SHA256
df21cd25f5d2be8521eaf50625c4e15809d156929ad12c764ffb9460563c61c5

SHA512
33ed5925d4562ac446be23c566f17d2d32a838ea72f6d5db0fef3a55177ecee26c68c2a794b2fe8e2d00d4bfa9ac6c2a88b4151a3c7e9dd43afd50fda04c88f1

Download Submit
C:\Windows\System\HrhzFmy.exe

Filesize
2.3MB

MD5
4923b9195977f20a41424047b8a91792

SHA1
e7921b78fd1a3ea3017972f6c801d3b996d83b17

SHA256
438fa4d26a4bb716686ff4607034e587260d3a2f40dd8b89c74bb4c5948fdafd

SHA512
8fed923911115933cbd261dca23474dddb74a02c6d720a9c84e864c8d14f23fbbaf3fe8df8c717562e383f0438430db8d08cb148a9dde6a03286b154fb906b48

Download Submit
C:\Windows\System\KhkztBw.exe

Filesize
2.3MB

MD5
b3da10ba67a2278ac8e97f0751a72f5b

SHA1
9c42b27b366e26de3345cc142b0c75f41f5eb428

SHA256
ab31542cc70e0e95c87939ba72c03a8d5053280a9f03c8d65ba5a55936abde35

SHA512
e162d54244d241ad0d215757ffb73fdd548e874a61dac3058f807d37aa34770fe8fab7af2ad5f5c99f8ae55de374e45ba150a4ef4ee6c03782364eabc9cd0efb

Download Submit
C:\Windows\System\LqVPnDu.exe

Filesize
2.3MB

MD5
63e86ff3d66d96179b5c01feff131687

SHA1
35ff4553e5a21124934a4cee81974df9b07f6137

SHA256
d2911a6f3b8b0fcbf0c9e52fce88aa5b72ff1d91a70af3e8149e3fc8c3a06776

SHA512
509c55c3b554d594766e0155787468bfb567a16fee799abe2210bed844736d1b10924f02ba4b526b9371fa93c7a59c7f5b6da15467cdefbe339cb581a3213639

Download Submit
C:\Windows\System\MOLkYuL.exe

Filesize
2.3MB

MD5
0d55d035900d928be3b7d96da60bb8c1

SHA1
e009bf1f467b4dfc83dfc08177d296488c7f06a3

SHA256
2edaa5695e31270bf6d576e40285567041f447bc47fb863bd23aa0bf6855f9c3

SHA512
a1358f1b136f62282014d44f1fe8635e9d635817789c36978077423daadd3008c5f04f90a7f424f8b4ee9ce7a5220b050e106043ca27067850e0de912ce6361a

Download Submit
C:\Windows\System\OzAhTri.exe

Filesize
2.3MB

MD5
1318425192f33895aaa5987aaff82e64

SHA1
99c84d22d00ad036591fe3d13fa911fe4b69ca4d

SHA256
e274556060d58f8f9d0ebc3e8796a4b13fefd7bfb2b1be13e8d7a39cd4867887

SHA512
8d887ff2e48b81570a277f1323d015848a129279bf32fef5be9dc9c69982db935d171d0c914df1b789355d702559735718c668d1bd31b649e419693de0bdc059

Download Submit
C:\Windows\System\PuPmUOy.exe

Filesize
2.3MB

MD5
5132c2e1e841e06516c2628461b6738d

SHA1
36d57c19c0792344bc4e0e90f030a48b66a643a8

SHA256
a5394b89b362ca9c7078d56b66e58e6ae66a8649a98ede41ead5f2c2546cab82

SHA512
5ad3f0763cfd5710f3060cc3d52933316e862c35ce2537f0ac9a566e94f43366fa1558994abe2e0d751077740966f2bd0fa2d22d9c0d8f9b5286ca464dc82f54

Download Submit
C:\Windows\System\QtKCbDv.exe

Filesize
8B

MD5
ce98e4fb0d1b3e55b413072afff0d9b0

SHA1
ea92124ca4b7f582ca9bded1d03be27e59b4ea59

SHA256
ff9bed5abd6e63c0617526102c0f954cef8653d22647e6d0cc15dd6455af1a78

SHA512
b03d5e8e2563e87b69e649ee452bd2c1714db6cee8c57a2d9c80350a9bfea4a14df4deeed12085a7535561f33b8025c13820b94443ecdbd732b098776b2234a9

Download Submit
C:\Windows\System\ROSqzqT.exe

Filesize
2.3MB

MD5
9da6920c5bdc9e2d3298ea5d4fd13e95

SHA1
368a22cf87f35d182a60025aef28407a71a8dd87

SHA256
69e57a783469bbf7298ef8ec6c983ca0fd986c53e25e042667f8c58078ad7ec7

SHA512
00de47beae945f2665b9d6a5aa71adba76d5745b6c8f8db33e41fdfd765905885f1cbd286724391e4cda90dc20cdab382118a558e7f952fbe667fb08baefabd0

Download Submit
C:\Windows\System\RiSefQf.exe

Filesize
2.3MB

MD5
d43fc4ef6bd068b20185fe26e5236638

SHA1
58e3510b0aea83fc8f8114ed59792cfeb809570c

SHA256
61b70d0de26f4f1ab35b9be7a94f535718c7a704629fcb3eb9c4ef62e17a0b9b

SHA512
64ee7ae23ba1fcfca7811646bb278b7c1b9d68dc76cce8a31f56002f0a544428a04d2925f1a7935dd55e806878b7fc35af45c80f172312415a9f02e372e0ec96

Download Submit
C:\Windows\System\SYzQJuG.exe

Filesize
2.3MB

MD5
e039dd115f9090d30c078a80025133b2

SHA1
722acff179510c376c43df1b32814cf071e98ea4

SHA256
35a18e977d8d6541e2c4313dc718e86bd976504cb080ac0388f2a22a3b8cda77

SHA512
a5faeeb6a61d8c8af5899c892aa61867ffd14c1d616b09c80729fb9ccda088302a78e505d8aebc6d309c8014ca377111819dcce33eaecdf4542795eac048b4b1

Download Submit
C:\Windows\System\UpAZYyk.exe

Filesize
2.3MB

MD5
29d1ee870d88954ef34aa9a3e88a63a8

SHA1
dbd83ed7b52b52a847d0ccac562345bcbb39b3c7

SHA256
5da046469740779681d722dfdff64f0a5ced45a5c7a330c8eb80da61ae3f0f8c

SHA512
354910d029f97415c884e53f19c67ed96591100cdea3ec7c313fa555696f55cc55d0088113a82cfc76cbe58f1393b864266256324c8a33b25787d69902a0258d

Download Submit
C:\Windows\System\UvGvjtc.exe

Filesize
2.3MB

MD5
d5cd1578a30b984b330e7424a959f37c

SHA1
a927d8fb70e20e6e55bfcb7f1d4352c24197d5cc

SHA256
5238eb66ef7c40fb97a40c14a9f557a713e1b1fcd9381bca4b40d8d82ddec6d9

SHA512
fdd0068f13d15ed6d8bf369ce94c83a6ca24369b8fa75dad410ed379009482dbf9b78ad78434c918829d38f5281a07af8bd6c064d781ed7acce587aabc86922b

Download Submit
C:\Windows\System\VJlombO.exe

Filesize
2.3MB

MD5
7a2db49a66ab32522afa3c0e4cff38ef

SHA1
28b12ed65e553f8463c8c52cda1c831225c41070

SHA256
2f54c93da5e749f90744f9b8e9df7eab33bee917401e6cd4628c69354e9badf6

SHA512
47c787114da1684a5731516447ec92faec84504868b5e90f07285a06d72a2ab8cf7877171c201de355a0fff4302defcad5ccb5e7887325394c70df88057d9be8

Download Submit
C:\Windows\System\XHDWvqP.exe

Filesize
2.3MB

MD5
f2dad812ef3361e93c9fea639240eb1a

SHA1
a9e4d9b96d5770c1942eb9a997fc811bc5455b78

SHA256
1f0cd7f55b945b2d84748394c9b2222e872a7f56191303021deb992827d8fa3c

SHA512
3a75f95c333b1314bdeaddc48f0fbbf0524a16483e69435587e7d96809c797318830acebaf292095bd7455b4bccf9068129310a05fcb27fd63efb34b7c3227c9

Download Submit
C:\Windows\System\YDbftrH.exe

Filesize
2.3MB

MD5
442614e11854c9afe98689616bd9e972

SHA1
9e42ba9ded59d6f12cdd658a40f7a44fff3dbf65

SHA256
72ded2a7b21870009b1df7b45f051daa78ed3b8e6c5a7b6dcfdeb4510bdc1eac

SHA512
67fba303a9326558b8ffc977cce8a166cf7f81ec59c08cb4938bf82472450b53fe4911a29a335f6b455a4e6dce312a6eac295cb6cda9c2d216f3800432152ab0

Download Submit
C:\Windows\System\YeruQtC.exe

Filesize
2.3MB

MD5
f781089dbacd2f8784eba25f327a18a6

SHA1
ed4137920d4491ed7ccc27781ccbda5862293d79

SHA256
c1b7e92bad8186a0e003766d9ec84747a0454bcf6496c944fb485c8db043cda5

SHA512
222e73faca5bf7477d2f96b76d1a540e53ee82796bd70e0f6049cef18bef740ffc37d401035e501ea551864872f6701405e61437e8d94efe799afd56ceed541d

Download Submit
C:\Windows\System\ZcFgwtn.exe

Filesize
2.3MB

MD5
1273361b4820a5a3c3f41b04af5a270a

SHA1
6dcd24e0d637bd1bac270bc6d539995faff4493a

SHA256
e688663679383b76feb9f29986d16eea856328ee4fb1cc36a6025bdd9635bce4

SHA512
4c179d2c5c27f2b686e165b9af4b4e2812a39c760d2762a02ae1a33418fa51785f64fea91fcbc9264ec97d668006870ba43c1a90464e1c25a3e41b41ce6ab64d

Download Submit
C:\Windows\System\bamTcZc.exe

Filesize
2.3MB

MD5
31e48f3ef3cc5137a8ee679c3292fd50

SHA1
937462331bf05ebca097452b1bbe4fc3a80244a8

SHA256
86e6d01f9f58371c8429725c8695a7d9aed0afb540139442507e7ab1298c21a5

SHA512
9fbac90e350417bd31e431e07f16b06a36026ddc9438b2f7a2ebeaa2c7a3d26813b35fd9c32134935dbe528d2b27df8692e11df6691b30071dde6ca70eb07770

Download Submit
C:\Windows\System\fZvXzaX.exe

Filesize
2.3MB

MD5
7fab323ea7b8d27090525fdb46483679

SHA1
3081ab03847c8a370a88113457dace65534313c5

SHA256
9b513c4185c1dd020adf1b79da81208d2ed89a4a2840245cfaff75190ed240de

SHA512
b6e0d914a0c79feb6275d8333d90497f3eb640ee66fd2095e3fb641e18bb53e8feae92b75984114a57cb9a27741de46df9a0dd1bb0ade277599715ff1ddb398e

Download Submit
C:\Windows\System\gBUmowh.exe

Filesize
2.3MB

MD5
1b55a4d5df96410a7fa82497af82545d

SHA1
275ab4ae2d5d3d4fc4d9132c9b82e51a1fb00948

SHA256
77df900f7b2e5c0f3ea6fa2207c64a4150eeb65dbd4a57330f9bba145d3aac9f

SHA512
84a0dde0b401fcf28916b83a9c0fa9ffd9c0c111d2d9b935940386eae5531fd5220ebbabb4e550913142ab92bdecef2f61ef35ed94c5ecf1808327abb19a3a43

Download Submit
C:\Windows\System\jurytLS.exe

Filesize
2.3MB

MD5
c4659de66029f1408667ab16aff68828

SHA1
9f3297ccb185cbcb56f605dc8854e3df23c4501a

SHA256
a5516025f310e56370d4735972b1cba91a9402a376657b2819fe8499a15f86ee

SHA512
4ce334a687ec40d8b8a5ff32240b19f97c614c058bc05dde6b8f18a0b19836d4323867aaaa0c60cf219a044ba686272af298633b03b9a9460fcb4f20124ddd45

Download Submit
C:\Windows\System\kkiXUEK.exe

Filesize
18B

MD5
b0ce6cfd7adfa2a2ac8258485a5cb279

SHA1
7b40a580431de17fbac688fb86de9bd5a156cd21

SHA256
bd650a2baf71609d723ebd75e0c6c938067406e57d5e80cec86bd9162ab5b10c

SHA512
107fc307e13b0ac2fdfd2a988662ef1274a95d78ff717c971632ef49ca9c9ef1a3e2bfaf20cde619c9ddc0ce2412de1ca0af65582b8a143eef4fd273e3c869f6

Download Submit
C:\Windows\System\lanEVBD.exe

Filesize
2.3MB

MD5
dbd07ad50f3407c3a0b42a3ae7279310

SHA1
7605827355ba665983dc78f562503640d4a3eac0

SHA256
8689c1145621b77041b873ceaaf601ee7306895f8b4bb5386eba16c865e7b295

SHA512
5bc5d9067b4c6f7592928c958a2bc2cfb5d5ca5d240d784c633bb1b8e06a57b848cf2453edd2939f9ea9bf400358a3323e5d6b9561088aefa692f40851067828

Download Submit
C:\Windows\System\nnRlbJd.exe

Filesize
2.3MB

MD5
ed32407535965b953cb261ac2b853894

SHA1
396886fede7eae90aff71fbab55e9447565bfbb5

SHA256
3179985d171aa919b86e8a3b243aa871c8eda4487b8dee8cdd81efc400849515

SHA512
74bee5968e2d5a296460d734c201da5396fbd80a12633cca2411566a4d0863232936348379c817e57a648815c5e58430c23a1606c3bd418b4ea1dd35794ef0c6

Download Submit
C:\Windows\System\qMfWLDC.exe

Filesize
2.3MB

MD5
3f922b2f432af3d1588ba843329dd44b

SHA1
fd86832071ee8307dc5b33ff64e68f34584b64b7

SHA256
820e49195ba09ce2583a330ae531170a26c4d1a47dc39f6c6cbaf945d3df96ba

SHA512
8c3b8b5c6eef3b9c662323381ba6923e98679c47c12248376dbfb15ba3ae23c0b393fef4de3a7ffdbfe9b47baff0352f3426f37f809c6067b723b05eec061b9e

Download Submit
C:\Windows\System\qYyQuuE.exe

Filesize
2.3MB

MD5
0f91bf46435bee0b472f0e0e7ba56e19

SHA1
478ec8b9f991ab042bdb39af6fe87e3c3dee919f

SHA256
09bce57b0013ffa0211728833d4cf4182ef694ef47cba335fec6f73d11438516

SHA512
3ae79d9834c8cfb6f268d00323652968bdd98493c4993a3847e5dff6d7439312f297c7a051c73c2fd93650f6a3c990969878010791182dd9925f5802e67e7c60

Download Submit
C:\Windows\System\rOOeIKr.exe

Filesize
2.3MB

MD5
c314696e8739d54a13e252580bd0a26c

SHA1
24ef5780430acc271fe863e01ebcb9ecc8c5c1ae

SHA256
8495fdb9df8bb68b0f103b2e5c81b4b0a9995861410b3d9e0692f0c86908e02f

SHA512
47464d7db53868cfb5dee8e2f89ff36bbb604e3a37445ad77ef57c61b0a5ae3f96892d18aee00ad88467b03adc4a436fef63e246f2be98e16a6875d5c44fc7ef

Download Submit
C:\Windows\System\rOpVXeM.exe

Filesize
2.3MB

MD5
1dfac66be138f3bb961076b2cda5b3b9

SHA1
cf09ef00546836429f273c779b4f4e93ce720d38

SHA256
a6ed4ccd8c1ff047676dc69d83f949fbd1b8c602de2b14c30fc27993cd87f088

SHA512
045cd975a46f94b1dbbbe08a441d4001d5012c4f616a320a0fdddba222d04934907df295cbb7eaa461c0eacb05f258253f1c48268a48b72aa1c1fc6925c03b7e

Download Submit
C:\Windows\System\rrKKYNe.exe

Filesize
2.3MB

MD5
69b75625aa70c5ef96a05b8ceacce341

SHA1
9e11297427d96af3dc2faa209ca940bc612d153e

SHA256
60eac3c91a4f485b745531ed4e980dd3a9d06f27491fbb920b7b381cbcfea851

SHA512
46ef2afd4217ab0a751b7aa02051cd766ddea8bf2ce49ab7e7cbb4074f782c0a195eb0b1b06d276ba9f88fc1b64f03e6d4e843c808827ca1b2fabc4e5b6bba2f

Download Submit
C:\Windows\System\uJbKUdW.exe

Filesize
2.3MB

MD5
069be45ef3e2f58a98b05527f4d63ae1

SHA1
7b834a0e0064277830666f59bf926eeb14615b82

SHA256
902b2598fee07afbb45708a48ba4d874d5fd7b0e29fc8d85e4e0ff75579820e7

SHA512
52a13dfc81b0acc5611d939c9040419d1b841f14d2f1015add21a738d41b70b551ec0f776e868ad438101c5bc37015f0bedec3cb4bc8ae0d9dd083b0a6de6964

Download Submit
C:\Windows\System\wVKpvWx.exe

Filesize
2.3MB

MD5
72a3c3a88ef2681b22bcbc72a3f329f7

SHA1
b4ba246045c7156de36617ae9c633ff7fe1c22a8

SHA256
031fca9e514ca53d4cc3b123e997be2994d6b7615308c2d59fb30c1c0d43a7f4

SHA512
d8f4f2acb3bd20ea543f46f75545d376e194016ce62d8b0cf3e972018b9f166056563ea68a62b5b914ead240940393f68e04b458a8c25ec1654986ebd451ecf1

Download Submit
C:\Windows\System\xkiTJeq.exe

Filesize
2.3MB

MD5
f7b52cde7f216880a0d483714b99694e

SHA1
5801515d31d04d8a2f0bbe37e3aadf9c29ac4e71

SHA256
3863d415ce7445a9bebafd1c7978785ae28acef00b0763a4646198f2a8bec1bd

SHA512
ef6bdd99f461a27cfa81fbe0661b16aa4763ba3954335e59d38ebf4406139e5f28851fc3b41a2a4a5e1fa15be936af35381ab782e0b998e5d00ab1cb7104d67a

Download Submit
C:\Windows\System\yzygEcr.exe

Filesize
2.3MB

MD5
536953ad8eca41a10b5bc234d9a55e8f

SHA1
15c8cae987e650d99d67909ea0160c6d933ad5dd

SHA256
5ae2ae1cbfb8ba09314b09202ca6a0d0172e4d9e7cc1cb23e77134880b1d4425

SHA512
400bbe563b7044dd8e5b1211d7f85414d82d590b74a16f8ef02549808ccd6b2ce73d05623a461e6944d3e3161803aabee3674c0e111768c462676fab0da1870e

Download Submit
memory/388-182-0x00007FF7A9FA0000-0x00007FF7AA392000-memory.dmp

Filesize
3.9MB

Download
memory/388-3910-0x00007FF7A9FA0000-0x00007FF7AA392000-memory.dmp

Filesize
3.9MB

Download
memory/716-258-0x00007FF7862D0000-0x00007FF7866C2000-memory.dmp

Filesize
3.9MB

Download
memory/720-255-0x00007FF6F43A0000-0x00007FF6F4792000-memory.dmp

Filesize
3.9MB

Download
memory/720-3948-0x00007FF6F43A0000-0x00007FF6F4792000-memory.dmp

Filesize
3.9MB

Download
memory/916-331-0x00007FF7D9290000-0x00007FF7D9682000-memory.dmp

Filesize
3.9MB

Download
memory/916-3907-0x00007FF7D9290000-0x00007FF7D9682000-memory.dmp

Filesize
3.9MB

Download
memory/1008-3985-0x00007FF61E970000-0x00007FF61ED62000-memory.dmp

Filesize
3.9MB

Download
memory/1008-256-0x00007FF61E970000-0x00007FF61ED62000-memory.dmp

Filesize
3.9MB

Download
memory/1044-251-0x00007FF60E150000-0x00007FF60E542000-memory.dmp

Filesize
3.9MB

Download
memory/1044-3934-0x00007FF60E150000-0x00007FF60E542000-memory.dmp

Filesize
3.9MB

Download
memory/1080-3869-0x00007FF6EB4E0000-0x00007FF6EB8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1080-46-0x00007FF6EB4E0000-0x00007FF6EB8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-18-0x00007FF6C7B60000-0x00007FF6C7F52000-memory.dmp

Filesize
3.9MB

Download
memory/1768-66-0x00007FF6B8270000-0x00007FF6B8662000-memory.dmp

Filesize
3.9MB

Download
memory/1768-3878-0x00007FF6B8270000-0x00007FF6B8662000-memory.dmp

Filesize
3.9MB

Download
memory/1788-48-0x000001C3B4D50000-0x000001C3B4D60000-memory.dmp

Filesize
64KB

Download
memory/1788-300-0x00007FFF756B0000-0x00007FFF76171000-memory.dmp

Filesize
10.8MB

Download
memory/1788-246-0x000001C3B69F0000-0x000001C3B6A12000-memory.dmp

Filesize
136KB

Download
memory/1788-62-0x000001C3B4D50000-0x000001C3B4D60000-memory.dmp

Filesize
64KB

Download
memory/2016-98-0x00007FF7F0290000-0x00007FF7F0682000-memory.dmp

Filesize
3.9MB

Download
memory/2116-138-0x00007FF7A8360000-0x00007FF7A8752000-memory.dmp

Filesize
3.9MB

Download
memory/2116-3942-0x00007FF7A8360000-0x00007FF7A8752000-memory.dmp

Filesize
3.9MB

Download
memory/2348-3966-0x00007FF6CAB00000-0x00007FF6CAEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-232-0x00007FF6CAB00000-0x00007FF6CAEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-253-0x00007FF68C550000-0x00007FF68C942000-memory.dmp

Filesize
3.9MB

Download
memory/2492-3963-0x00007FF68C550000-0x00007FF68C942000-memory.dmp

Filesize
3.9MB

Download
memory/3180-332-0x00007FF7DD250000-0x00007FF7DD642000-memory.dmp

Filesize
3.9MB

Download
memory/3180-3906-0x00007FF7DD250000-0x00007FF7DD642000-memory.dmp

Filesize
3.9MB

Download
memory/3728-0-0x00007FF770B40000-0x00007FF770F32000-memory.dmp

Filesize
3.9MB

Download
memory/3728-1-0x000001FF35960000-0x000001FF35970000-memory.dmp

Filesize
64KB

Download
memory/3948-308-0x00007FF796460000-0x00007FF796852000-memory.dmp

Filesize
3.9MB

Download
memory/4144-185-0x00007FF6CD520000-0x00007FF6CD912000-memory.dmp

Filesize
3.9MB

Download
memory/4144-3914-0x00007FF6CD520000-0x00007FF6CD912000-memory.dmp

Filesize
3.9MB

Download
memory/4416-335-0x00007FF7E5610000-0x00007FF7E5A02000-memory.dmp

Filesize
3.9MB

Download
memory/4416-4007-0x00007FF7E5610000-0x00007FF7E5A02000-memory.dmp

Filesize
3.9MB

Download
memory/4440-3873-0x00007FF7CB010000-0x00007FF7CB402000-memory.dmp

Filesize
3.9MB

Download
memory/4440-252-0x00007FF7CB010000-0x00007FF7CB402000-memory.dmp

Filesize
3.9MB

Download
memory/4788-33-0x00007FF686A30000-0x00007FF686E22000-memory.dmp

Filesize
3.9MB

Download
memory/5064-3937-0x00007FF6FD170000-0x00007FF6FD562000-memory.dmp

Filesize
3.9MB

Download
memory/5064-254-0x00007FF6FD170000-0x00007FF6FD562000-memory.dmp

Filesize
3.9MB

Download
memory/5068-3931-0x00007FF799100000-0x00007FF7994F2000-memory.dmp

Filesize
3.9MB

Download
memory/5068-257-0x00007FF799100000-0x00007FF7994F2000-memory.dmp

Filesize
3.9MB

Download