xmrig | bf0eec6dc38b376a9b3b959b133630c92b0e806c65a08577a1de5d0b11be1a94

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
Size

2.8MB
MD5

03e90fe7bcb073d66e1cefc7f5da8dd4
SHA1

cedc8abfac389c44be8604289b065a08351b5bcb
SHA256

bf0eec6dc38b376a9b3b959b133630c92b0e806c65a08577a1de5d0b11be1a94
SHA512

7cc46219807b9a6a223944382a3eb0342040d49123789c5f5643a5aad098237f74ffa63388a581155277f0f9035e00f6d8aeca7e2f83e14f3ad902f595ea01e5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5O1xsRH:NAB5

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/1516-18-0x00007FF6059C0000-0x00007FF605DB2000-memory.dmp	xmrig
behavioral2/memory/4852-136-0x00007FF6253D0000-0x00007FF6257C2000-memory.dmp	xmrig
behavioral2/memory/2444-184-0x00007FF644570000-0x00007FF644962000-memory.dmp	xmrig
behavioral2/memory/1452-209-0x00007FF6FF390000-0x00007FF6FF782000-memory.dmp	xmrig
behavioral2/memory/2932-213-0x00007FF60D130000-0x00007FF60D522000-memory.dmp	xmrig
behavioral2/memory/4804-212-0x00007FF6ED500000-0x00007FF6ED8F2000-memory.dmp	xmrig
behavioral2/memory/4120-211-0x00007FF77C460000-0x00007FF77C852000-memory.dmp	xmrig
behavioral2/memory/1776-210-0x00007FF7FEEF0000-0x00007FF7FF2E2000-memory.dmp	xmrig
behavioral2/memory/2376-208-0x00007FF6A1F60000-0x00007FF6A2352000-memory.dmp	xmrig
behavioral2/memory/2248-207-0x00007FF6405B0000-0x00007FF6409A2000-memory.dmp	xmrig
behavioral2/memory/1284-206-0x00007FF656110000-0x00007FF656502000-memory.dmp	xmrig
behavioral2/memory/4732-205-0x00007FF63B000000-0x00007FF63B3F2000-memory.dmp	xmrig
behavioral2/memory/4720-203-0x00007FF6FBDA0000-0x00007FF6FC192000-memory.dmp	xmrig
behavioral2/memory/1984-190-0x00007FF729B90000-0x00007FF729F82000-memory.dmp	xmrig
behavioral2/memory/2856-183-0x00007FF6ADE60000-0x00007FF6AE252000-memory.dmp	xmrig
behavioral2/memory/1572-175-0x00007FF710F10000-0x00007FF711302000-memory.dmp	xmrig
behavioral2/memory/1164-158-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp	xmrig
behavioral2/memory/3832-116-0x00007FF783B60000-0x00007FF783F52000-memory.dmp	xmrig
behavioral2/memory/2392-114-0x00007FF7426D0000-0x00007FF742AC2000-memory.dmp	xmrig
behavioral2/memory/2424-82-0x00007FF724840000-0x00007FF724C32000-memory.dmp	xmrig
behavioral2/memory/1076-71-0x00007FF62D100000-0x00007FF62D4F2000-memory.dmp	xmrig
behavioral2/memory/4120-2906-0x00007FF77C460000-0x00007FF77C852000-memory.dmp	xmrig
behavioral2/memory/3832-2936-0x00007FF783B60000-0x00007FF783F52000-memory.dmp	xmrig
behavioral2/memory/2424-2939-0x00007FF724840000-0x00007FF724C32000-memory.dmp	xmrig
behavioral2/memory/1164-2957-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp	xmrig
behavioral2/memory/2376-2994-0x00007FF6A1F60000-0x00007FF6A2352000-memory.dmp	xmrig
behavioral2/memory/1776-2991-0x00007FF7FEEF0000-0x00007FF7FF2E2000-memory.dmp	xmrig
behavioral2/memory/1452-2988-0x00007FF6FF390000-0x00007FF6FF782000-memory.dmp	xmrig
behavioral2/memory/2248-2978-0x00007FF6405B0000-0x00007FF6409A2000-memory.dmp	xmrig
behavioral2/memory/4804-2973-0x00007FF6ED500000-0x00007FF6ED8F2000-memory.dmp	xmrig
behavioral2/memory/1284-2966-0x00007FF656110000-0x00007FF656502000-memory.dmp	xmrig
behavioral2/memory/2856-2969-0x00007FF6ADE60000-0x00007FF6AE252000-memory.dmp	xmrig
behavioral2/memory/4732-2964-0x00007FF63B000000-0x00007FF63B3F2000-memory.dmp	xmrig
behavioral2/memory/4720-2958-0x00007FF6FBDA0000-0x00007FF6FC192000-memory.dmp	xmrig
behavioral2/memory/2444-2951-0x00007FF644570000-0x00007FF644962000-memory.dmp	xmrig
behavioral2/memory/2932-2949-0x00007FF60D130000-0x00007FF60D522000-memory.dmp	xmrig
behavioral2/memory/1984-2946-0x00007FF729B90000-0x00007FF729F82000-memory.dmp	xmrig
behavioral2/memory/4852-2944-0x00007FF6253D0000-0x00007FF6257C2000-memory.dmp	xmrig
behavioral2/memory/1572-2955-0x00007FF710F10000-0x00007FF711302000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1516	UUxHJhU.exe
1076	tsNDlky.exe
4120	wseYpWZ.exe
2424	vsKkMDh.exe
2392	DLlNzpy.exe
3832	JRZXygO.exe
4852	fCeYKCR.exe
1164	poHMIRX.exe
1572	XUHNprs.exe
2856	TXAsszq.exe
2444	htVwElV.exe
1984	TtNpLcZ.exe
4720	FVgombD.exe
4732	OwEBISu.exe
1284	NDLGmQD.exe
4804	NWznoVB.exe
2248	dZSyAuS.exe
2932	UUcytbF.exe
2376	HeeKIdM.exe
1452	ELOjAYy.exe
1776	wGwiImc.exe
4460	KzuzxwT.exe
4360	YgCyQxh.exe
2208	oBMSDWm.exe
3872	jJxVwZy.exe
3136	nMSNxAm.exe
412	tACLivF.exe
4688	eJCDwgX.exe
1484	aIjUOdU.exe
3400	qOIiSUX.exe
1684	rnpUfTh.exe
4752	PeBFFDS.exe
4256	ADWIEHM.exe
868	dXyroRg.exe
208	fEeOJYK.exe
4592	FvDwkIa.exe
3536	xZFEgZa.exe
3976	aVKZFbr.exe
1900	LypDJfZ.exe
2012	xWyTcrq.exe
1492	tRVLxDg.exe
3488	QklLTpW.exe
4996	hdNmoQa.exe
408	gLOSAoj.exe
468	qdRnYOj.exe
4504	CdeBHEh.exe
1064	RBhOQZC.exe
4520	BzFTfbL.exe
4276	nphIXmC.exe
2692	wRKKEOc.exe
864	QBdgeCy.exe
4948	OqWiRoW.exe
5044	pzxieOQ.exe
4232	RxxGgpk.exe
3732	yMPFjUY.exe
3196	XBcpYOO.exe
2884	NYDxuYG.exe
1268	uRnZRIs.exe
2584	ZYsMrEe.exe
3580	aFusmaC.exe
556	ynsHewq.exe
4612	vvwyRMV.exe
216	sNwEcMl.exe
1556	amLOaFO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4792-0-0x00007FF7F1440000-0x00007FF7F1832000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-8.dat	upx
behavioral2/memory/1516-18-0x00007FF6059C0000-0x00007FF605DB2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-39.dat	upx
behavioral2/files/0x000a000000023ba2-51.dat	upx
behavioral2/files/0x000a000000023ba1-46.dat	upx
behavioral2/files/0x000a000000023ba7-68.dat	upx
behavioral2/memory/4852-136-0x00007FF6253D0000-0x00007FF6257C2000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-151.dat	upx
behavioral2/files/0x000a000000023bb9-169.dat	upx
behavioral2/memory/2444-184-0x00007FF644570000-0x00007FF644962000-memory.dmp	upx
behavioral2/memory/1452-209-0x00007FF6FF390000-0x00007FF6FF782000-memory.dmp	upx
behavioral2/memory/2932-213-0x00007FF60D130000-0x00007FF60D522000-memory.dmp	upx
behavioral2/memory/4804-212-0x00007FF6ED500000-0x00007FF6ED8F2000-memory.dmp	upx
behavioral2/memory/4120-211-0x00007FF77C460000-0x00007FF77C852000-memory.dmp	upx
behavioral2/memory/1776-210-0x00007FF7FEEF0000-0x00007FF7FF2E2000-memory.dmp	upx
behavioral2/memory/2376-208-0x00007FF6A1F60000-0x00007FF6A2352000-memory.dmp	upx
behavioral2/memory/2248-207-0x00007FF6405B0000-0x00007FF6409A2000-memory.dmp	upx
behavioral2/memory/1284-206-0x00007FF656110000-0x00007FF656502000-memory.dmp	upx
behavioral2/memory/4732-205-0x00007FF63B000000-0x00007FF63B3F2000-memory.dmp	upx
behavioral2/memory/4720-203-0x00007FF6FBDA0000-0x00007FF6FC192000-memory.dmp	upx
behavioral2/memory/1984-190-0x00007FF729B90000-0x00007FF729F82000-memory.dmp	upx
behavioral2/memory/2856-183-0x00007FF6ADE60000-0x00007FF6AE252000-memory.dmp	upx
behavioral2/files/0x000b000000023b97-179.dat	upx
behavioral2/memory/1572-175-0x00007FF710F10000-0x00007FF711302000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-173.dat	upx
behavioral2/files/0x000a000000023bb4-171.dat	upx
behavioral2/files/0x000a000000023bb3-167.dat	upx
behavioral2/files/0x000a000000023bad-165.dat	upx
behavioral2/files/0x000a000000023bb8-163.dat	upx
behavioral2/files/0x000a000000023bb7-162.dat	upx
behavioral2/files/0x000a000000023baf-160.dat	upx
behavioral2/memory/1164-158-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-154.dat	upx
behavioral2/files/0x000a000000023bab-147.dat	upx
behavioral2/files/0x000a000000023bb2-145.dat	upx
behavioral2/files/0x000a000000023bb6-143.dat	upx
behavioral2/files/0x000a000000023bb1-141.dat	upx
behavioral2/files/0x000a000000023bb5-140.dat	upx
behavioral2/files/0x000a000000023bb0-130.dat	upx
behavioral2/files/0x000a000000023ba4-121.dat	upx
behavioral2/files/0x000a000000023ba9-119.dat	upx
behavioral2/memory/3832-116-0x00007FF783B60000-0x00007FF783F52000-memory.dmp	upx
behavioral2/memory/2392-114-0x00007FF7426D0000-0x00007FF742AC2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-103.dat	upx
behavioral2/files/0x000a000000023ba3-100.dat	upx
behavioral2/files/0x000a000000023ba6-93.dat	upx
behavioral2/files/0x000a000000023baa-90.dat	upx
behavioral2/files/0x000a000000023ba5-85.dat	upx
behavioral2/memory/2424-82-0x00007FF724840000-0x00007FF724C32000-memory.dmp	upx
behavioral2/memory/1076-71-0x00007FF62D100000-0x00007FF62D4F2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-65.dat	upx
behavioral2/files/0x000a000000023b9f-59.dat	upx
behavioral2/files/0x000a000000023b9d-41.dat	upx
behavioral2/files/0x000a000000023b9e-36.dat	upx
behavioral2/files/0x000a000000023b9a-15.dat	upx
behavioral2/files/0x000b000000023b96-6.dat	upx
behavioral2/memory/4120-2906-0x00007FF77C460000-0x00007FF77C852000-memory.dmp	upx
behavioral2/memory/3832-2936-0x00007FF783B60000-0x00007FF783F52000-memory.dmp	upx
behavioral2/memory/2424-2939-0x00007FF724840000-0x00007FF724C32000-memory.dmp	upx
behavioral2/memory/1164-2957-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp	upx
behavioral2/memory/2376-2994-0x00007FF6A1F60000-0x00007FF6A2352000-memory.dmp	upx
behavioral2/memory/1776-2991-0x00007FF7FEEF0000-0x00007FF7FF2E2000-memory.dmp	upx
behavioral2/memory/1452-2988-0x00007FF6FF390000-0x00007FF6FF782000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iIkuTla.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\ezWGETw.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\VOmAjvi.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\TSzALeB.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\qAnnMzm.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\XCBFWsv.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\zJGNWHV.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\Injjagi.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\JMlVuwq.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\SYbMjQN.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\dTEaFiQ.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\lCVwMTq.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\TiENRCA.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\fgXiDCI.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\SSbLDAj.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\fMQNfjZ.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\JVIyImj.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\jrAjkVB.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\yrIUDld.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\bWjnWjw.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\uaobxZb.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\yLlhYJF.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\qfLygWU.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\aKpBBHf.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\rNXuEmE.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\upxTaYn.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\hnfPiqp.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\vpdxBiv.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\VMxBcVu.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\rZiVgQL.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\EsKXllX.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\zTFJgXF.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\RCmouTo.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\QgPqEtE.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\znQIugr.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\eipQWrl.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\VjVdLWK.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\YpydkJv.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\NHrQhUg.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\EEWxyfH.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\IXBIssx.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\gaPDllR.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\hvQmFLI.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\OWsZjQy.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\NWubPwy.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\EKKeLyQ.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\eAsidsR.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\IicyMiR.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\LPFgwEQ.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\zlOITfl.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\beVphMm.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\fzxnFcD.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\IsTPWSL.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\unlTnMz.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\CVMMksf.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\UomJspv.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\liQOMZl.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\YUqzoqr.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\Fbzsfnq.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\MYvtIXP.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\CNXMznA.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\efdJFnP.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\jaeUrDX.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\VSieidu.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1944	powershell.exe
1944	powershell.exe
1944	powershell.exe
1944	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
Token: SeDebugPrivilege	1944	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 1944	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	85
PID 4792 wrote to memory of 1944	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	85
PID 4792 wrote to memory of 1516	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	86
PID 4792 wrote to memory of 1516	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	86
PID 4792 wrote to memory of 1076	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	87
PID 4792 wrote to memory of 1076	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	87
PID 4792 wrote to memory of 4120	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	88
PID 4792 wrote to memory of 4120	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	88
PID 4792 wrote to memory of 2424	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	89
PID 4792 wrote to memory of 2424	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	89
PID 4792 wrote to memory of 2392	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	90
PID 4792 wrote to memory of 2392	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	90
PID 4792 wrote to memory of 3832	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	91
PID 4792 wrote to memory of 3832	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	91
PID 4792 wrote to memory of 4852	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	92
PID 4792 wrote to memory of 4852	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	92
PID 4792 wrote to memory of 1164	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	93
PID 4792 wrote to memory of 1164	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	93
PID 4792 wrote to memory of 1572	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	94
PID 4792 wrote to memory of 1572	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	94
PID 4792 wrote to memory of 2856	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	95
PID 4792 wrote to memory of 2856	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	95
PID 4792 wrote to memory of 4732	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	96
PID 4792 wrote to memory of 4732	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	96
PID 4792 wrote to memory of 4804	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	97
PID 4792 wrote to memory of 4804	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	97
PID 4792 wrote to memory of 2444	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	98
PID 4792 wrote to memory of 2444	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	98
PID 4792 wrote to memory of 1984	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	99
PID 4792 wrote to memory of 1984	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	99
PID 4792 wrote to memory of 4720	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	100
PID 4792 wrote to memory of 4720	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	100
PID 4792 wrote to memory of 1284	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	101
PID 4792 wrote to memory of 1284	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	101
PID 4792 wrote to memory of 2248	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	102
PID 4792 wrote to memory of 2248	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	102
PID 4792 wrote to memory of 2932	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	103
PID 4792 wrote to memory of 2932	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	103
PID 4792 wrote to memory of 2376	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	104
PID 4792 wrote to memory of 2376	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	104
PID 4792 wrote to memory of 1452	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	105
PID 4792 wrote to memory of 1452	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	105
PID 4792 wrote to memory of 1776	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	106
PID 4792 wrote to memory of 1776	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	106
PID 4792 wrote to memory of 4460	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	107
PID 4792 wrote to memory of 4460	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	107
PID 4792 wrote to memory of 4360	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	108
PID 4792 wrote to memory of 4360	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	108
PID 4792 wrote to memory of 2208	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	109
PID 4792 wrote to memory of 2208	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	109
PID 4792 wrote to memory of 3872	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	110
PID 4792 wrote to memory of 3872	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	110
PID 4792 wrote to memory of 3136	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	111
PID 4792 wrote to memory of 3136	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	111
PID 4792 wrote to memory of 412	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	112
PID 4792 wrote to memory of 412	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	112
PID 4792 wrote to memory of 4688	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	113
PID 4792 wrote to memory of 4688	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	113
PID 4792 wrote to memory of 1484	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	114
PID 4792 wrote to memory of 1484	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	114
PID 4792 wrote to memory of 3400	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	115
PID 4792 wrote to memory of 3400	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	115
PID 4792 wrote to memory of 1684	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	116
PID 4792 wrote to memory of 1684	4792	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System\UUxHJhU.exe
  C:\Windows\System\UUxHJhU.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\tsNDlky.exe
  C:\Windows\System\tsNDlky.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\wseYpWZ.exe
  C:\Windows\System\wseYpWZ.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\vsKkMDh.exe
  C:\Windows\System\vsKkMDh.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\DLlNzpy.exe
  C:\Windows\System\DLlNzpy.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\JRZXygO.exe
  C:\Windows\System\JRZXygO.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\fCeYKCR.exe
  C:\Windows\System\fCeYKCR.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\poHMIRX.exe
  C:\Windows\System\poHMIRX.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\XUHNprs.exe
  C:\Windows\System\XUHNprs.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\TXAsszq.exe
  C:\Windows\System\TXAsszq.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\OwEBISu.exe
  C:\Windows\System\OwEBISu.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\NWznoVB.exe
  C:\Windows\System\NWznoVB.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\htVwElV.exe
  C:\Windows\System\htVwElV.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\TtNpLcZ.exe
  C:\Windows\System\TtNpLcZ.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\FVgombD.exe
  C:\Windows\System\FVgombD.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\NDLGmQD.exe
  C:\Windows\System\NDLGmQD.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\dZSyAuS.exe
  C:\Windows\System\dZSyAuS.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\UUcytbF.exe
  C:\Windows\System\UUcytbF.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\HeeKIdM.exe
  C:\Windows\System\HeeKIdM.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\ELOjAYy.exe
  C:\Windows\System\ELOjAYy.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\wGwiImc.exe
  C:\Windows\System\wGwiImc.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\KzuzxwT.exe
  C:\Windows\System\KzuzxwT.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\YgCyQxh.exe
  C:\Windows\System\YgCyQxh.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\oBMSDWm.exe
  C:\Windows\System\oBMSDWm.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\jJxVwZy.exe
  C:\Windows\System\jJxVwZy.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\nMSNxAm.exe
  C:\Windows\System\nMSNxAm.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\tACLivF.exe
  C:\Windows\System\tACLivF.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\eJCDwgX.exe
  C:\Windows\System\eJCDwgX.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\aIjUOdU.exe
  C:\Windows\System\aIjUOdU.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\qOIiSUX.exe
  C:\Windows\System\qOIiSUX.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\rnpUfTh.exe
  C:\Windows\System\rnpUfTh.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\PeBFFDS.exe
  C:\Windows\System\PeBFFDS.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\ADWIEHM.exe
  C:\Windows\System\ADWIEHM.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\dXyroRg.exe
  C:\Windows\System\dXyroRg.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\fEeOJYK.exe
  C:\Windows\System\fEeOJYK.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\FvDwkIa.exe
  C:\Windows\System\FvDwkIa.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\xZFEgZa.exe
  C:\Windows\System\xZFEgZa.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\aVKZFbr.exe
  C:\Windows\System\aVKZFbr.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\LypDJfZ.exe
  C:\Windows\System\LypDJfZ.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\xWyTcrq.exe
  C:\Windows\System\xWyTcrq.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\tRVLxDg.exe
  C:\Windows\System\tRVLxDg.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\QklLTpW.exe
  C:\Windows\System\QklLTpW.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\hdNmoQa.exe
  C:\Windows\System\hdNmoQa.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\gLOSAoj.exe
  C:\Windows\System\gLOSAoj.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\qdRnYOj.exe
  C:\Windows\System\qdRnYOj.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\CdeBHEh.exe
  C:\Windows\System\CdeBHEh.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\RBhOQZC.exe
  C:\Windows\System\RBhOQZC.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\BzFTfbL.exe
  C:\Windows\System\BzFTfbL.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\nphIXmC.exe
  C:\Windows\System\nphIXmC.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\wRKKEOc.exe
  C:\Windows\System\wRKKEOc.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\QBdgeCy.exe
  C:\Windows\System\QBdgeCy.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\OqWiRoW.exe
  C:\Windows\System\OqWiRoW.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\pzxieOQ.exe
  C:\Windows\System\pzxieOQ.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\RxxGgpk.exe
  C:\Windows\System\RxxGgpk.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\yMPFjUY.exe
  C:\Windows\System\yMPFjUY.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\XBcpYOO.exe
  C:\Windows\System\XBcpYOO.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\NYDxuYG.exe
  C:\Windows\System\NYDxuYG.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\ZYsMrEe.exe
  C:\Windows\System\ZYsMrEe.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\uRnZRIs.exe
  C:\Windows\System\uRnZRIs.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\aFusmaC.exe
  C:\Windows\System\aFusmaC.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\ynsHewq.exe
  C:\Windows\System\ynsHewq.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\vvwyRMV.exe
  C:\Windows\System\vvwyRMV.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\sNwEcMl.exe
  C:\Windows\System\sNwEcMl.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\amLOaFO.exe
  C:\Windows\System\amLOaFO.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\UyYFcan.exe
  C:\Windows\System\UyYFcan.exe
  2⤵
  PID:1488
- C:\Windows\System\hsHsdUh.exe
  C:\Windows\System\hsHsdUh.exe
  2⤵
  PID:2020
- C:\Windows\System\DICMYnh.exe
  C:\Windows\System\DICMYnh.exe
  2⤵
  PID:4152
- C:\Windows\System\dAaFVKr.exe
  C:\Windows\System\dAaFVKr.exe
  2⤵
  PID:1856
- C:\Windows\System\KKoCfev.exe
  C:\Windows\System\KKoCfev.exe
  2⤵
  PID:4400
- C:\Windows\System\xrTeUTu.exe
  C:\Windows\System\xrTeUTu.exe
  2⤵
  PID:1272
- C:\Windows\System\yWDifKB.exe
  C:\Windows\System\yWDifKB.exe
  2⤵
  PID:2152
- C:\Windows\System\zLTQloW.exe
  C:\Windows\System\zLTQloW.exe
  2⤵
  PID:1908
- C:\Windows\System\kzZGyhp.exe
  C:\Windows\System\kzZGyhp.exe
  2⤵
  PID:2924
- C:\Windows\System\usnXGRa.exe
  C:\Windows\System\usnXGRa.exe
  2⤵
  PID:2428
- C:\Windows\System\TzdDyvX.exe
  C:\Windows\System\TzdDyvX.exe
  2⤵
  PID:2780
- C:\Windows\System\zlOITfl.exe
  C:\Windows\System\zlOITfl.exe
  2⤵
  PID:3376
- C:\Windows\System\GulLilr.exe
  C:\Windows\System\GulLilr.exe
  2⤵
  PID:4916
- C:\Windows\System\fTJWmFC.exe
  C:\Windows\System\fTJWmFC.exe
  2⤵
  PID:3620
- C:\Windows\System\TQpWrPn.exe
  C:\Windows\System\TQpWrPn.exe
  2⤵
  PID:2712
- C:\Windows\System\iubYLRF.exe
  C:\Windows\System\iubYLRF.exe
  2⤵
  PID:1884
- C:\Windows\System\YpPVYht.exe
  C:\Windows\System\YpPVYht.exe
  2⤵
  PID:4128
- C:\Windows\System\maWtzmz.exe
  C:\Windows\System\maWtzmz.exe
  2⤵
  PID:640
- C:\Windows\System\xvBRsPd.exe
  C:\Windows\System\xvBRsPd.exe
  2⤵
  PID:3672
- C:\Windows\System\ubCXHgv.exe
  C:\Windows\System\ubCXHgv.exe
  2⤵
  PID:2928
- C:\Windows\System\PDTorVr.exe
  C:\Windows\System\PDTorVr.exe
  2⤵
  PID:5052
- C:\Windows\System\UzzrQGM.exe
  C:\Windows\System\UzzrQGM.exe
  2⤵
  PID:4292
- C:\Windows\System\OiuVvlr.exe
  C:\Windows\System\OiuVvlr.exe
  2⤵
  PID:5100
- C:\Windows\System\maxZzYo.exe
  C:\Windows\System\maxZzYo.exe
  2⤵
  PID:3940
- C:\Windows\System\bYqwqHk.exe
  C:\Windows\System\bYqwqHk.exe
  2⤵
  PID:1620
- C:\Windows\System\DoQmDKr.exe
  C:\Windows\System\DoQmDKr.exe
  2⤵
  PID:1172
- C:\Windows\System\QntsQIz.exe
  C:\Windows\System\QntsQIz.exe
  2⤵
  PID:4584
- C:\Windows\System\YXMzEaR.exe
  C:\Windows\System\YXMzEaR.exe
  2⤵
  PID:4080
- C:\Windows\System\DAfpTQA.exe
  C:\Windows\System\DAfpTQA.exe
  2⤵
  PID:3856
- C:\Windows\System\JvUmOQK.exe
  C:\Windows\System\JvUmOQK.exe
  2⤵
  PID:5140
- C:\Windows\System\fNhAYGy.exe
  C:\Windows\System\fNhAYGy.exe
  2⤵
  PID:5168
- C:\Windows\System\IXFcslX.exe
  C:\Windows\System\IXFcslX.exe
  2⤵
  PID:5188
- C:\Windows\System\uHDmfqe.exe
  C:\Windows\System\uHDmfqe.exe
  2⤵
  PID:5212
- C:\Windows\System\pKvSflQ.exe
  C:\Windows\System\pKvSflQ.exe
  2⤵
  PID:5236
- C:\Windows\System\SbiacFL.exe
  C:\Windows\System\SbiacFL.exe
  2⤵
  PID:5264
- C:\Windows\System\ZxWNAqQ.exe
  C:\Windows\System\ZxWNAqQ.exe
  2⤵
  PID:5296
- C:\Windows\System\qZlVTUi.exe
  C:\Windows\System\qZlVTUi.exe
  2⤵
  PID:5324
- C:\Windows\System\YRuoKFu.exe
  C:\Windows\System\YRuoKFu.exe
  2⤵
  PID:5340
- C:\Windows\System\iOGbrtD.exe
  C:\Windows\System\iOGbrtD.exe
  2⤵
  PID:5364
- C:\Windows\System\nDCVJFa.exe
  C:\Windows\System\nDCVJFa.exe
  2⤵
  PID:5388
- C:\Windows\System\KoTucyW.exe
  C:\Windows\System\KoTucyW.exe
  2⤵
  PID:5408
- C:\Windows\System\QymZAtF.exe
  C:\Windows\System\QymZAtF.exe
  2⤵
  PID:5432
- C:\Windows\System\XOUUQLu.exe
  C:\Windows\System\XOUUQLu.exe
  2⤵
  PID:5460
- C:\Windows\System\yChmcvV.exe
  C:\Windows\System\yChmcvV.exe
  2⤵
  PID:5488
- C:\Windows\System\tBZYiat.exe
  C:\Windows\System\tBZYiat.exe
  2⤵
  PID:5516
- C:\Windows\System\eLmZntA.exe
  C:\Windows\System\eLmZntA.exe
  2⤵
  PID:5536
- C:\Windows\System\FGhZcMi.exe
  C:\Windows\System\FGhZcMi.exe
  2⤵
  PID:5560
- C:\Windows\System\IkaQvFr.exe
  C:\Windows\System\IkaQvFr.exe
  2⤵
  PID:5584
- C:\Windows\System\TjYsusF.exe
  C:\Windows\System\TjYsusF.exe
  2⤵
  PID:5608
- C:\Windows\System\RGvGONH.exe
  C:\Windows\System\RGvGONH.exe
  2⤵
  PID:5632
- C:\Windows\System\VRvIiwZ.exe
  C:\Windows\System\VRvIiwZ.exe
  2⤵
  PID:5656
- C:\Windows\System\CTdmTTC.exe
  C:\Windows\System\CTdmTTC.exe
  2⤵
  PID:5684
- C:\Windows\System\WZmsrKW.exe
  C:\Windows\System\WZmsrKW.exe
  2⤵
  PID:5708
- C:\Windows\System\VHYjxmJ.exe
  C:\Windows\System\VHYjxmJ.exe
  2⤵
  PID:5740
- C:\Windows\System\YHDfXon.exe
  C:\Windows\System\YHDfXon.exe
  2⤵
  PID:5764
- C:\Windows\System\ptJxYPp.exe
  C:\Windows\System\ptJxYPp.exe
  2⤵
  PID:5788
- C:\Windows\System\BvJLeqO.exe
  C:\Windows\System\BvJLeqO.exe
  2⤵
  PID:5816
- C:\Windows\System\DZeJcZx.exe
  C:\Windows\System\DZeJcZx.exe
  2⤵
  PID:5844
- C:\Windows\System\ONgFVWM.exe
  C:\Windows\System\ONgFVWM.exe
  2⤵
  PID:5868
- C:\Windows\System\vjJbKJl.exe
  C:\Windows\System\vjJbKJl.exe
  2⤵
  PID:5888
- C:\Windows\System\uqodbDT.exe
  C:\Windows\System\uqodbDT.exe
  2⤵
  PID:5912
- C:\Windows\System\CsIsKRG.exe
  C:\Windows\System\CsIsKRG.exe
  2⤵
  PID:5936
- C:\Windows\System\LhSkUum.exe
  C:\Windows\System\LhSkUum.exe
  2⤵
  PID:5964
- C:\Windows\System\sYhEQGl.exe
  C:\Windows\System\sYhEQGl.exe
  2⤵
  PID:5984
- C:\Windows\System\FsIwNIU.exe
  C:\Windows\System\FsIwNIU.exe
  2⤵
  PID:6004
- C:\Windows\System\cRzVgIZ.exe
  C:\Windows\System\cRzVgIZ.exe
  2⤵
  PID:6028
- C:\Windows\System\laNNvkb.exe
  C:\Windows\System\laNNvkb.exe
  2⤵
  PID:6064
- C:\Windows\System\fvjWkzN.exe
  C:\Windows\System\fvjWkzN.exe
  2⤵
  PID:6084
- C:\Windows\System\IvmqkfG.exe
  C:\Windows\System\IvmqkfG.exe
  2⤵
  PID:6108
- C:\Windows\System\xEqiQdS.exe
  C:\Windows\System\xEqiQdS.exe
  2⤵
  PID:6132
- C:\Windows\System\yBkISEo.exe
  C:\Windows\System\yBkISEo.exe
  2⤵
  PID:4288
- C:\Windows\System\oPaMmGu.exe
  C:\Windows\System\oPaMmGu.exe
  2⤵
  PID:1256
- C:\Windows\System\NCIMpas.exe
  C:\Windows\System\NCIMpas.exe
  2⤵
  PID:5248
- C:\Windows\System\bDShgvj.exe
  C:\Windows\System\bDShgvj.exe
  2⤵
  PID:3164
- C:\Windows\System\aFqkEwW.exe
  C:\Windows\System\aFqkEwW.exe
  2⤵
  PID:5220
- C:\Windows\System\KjtXDEo.exe
  C:\Windows\System\KjtXDEo.exe
  2⤵
  PID:5376
- C:\Windows\System\oKotdYB.exe
  C:\Windows\System\oKotdYB.exe
  2⤵
  PID:5448
- C:\Windows\System\TRqkXgS.exe
  C:\Windows\System\TRqkXgS.exe
  2⤵
  PID:5348
- C:\Windows\System\CMsWqpO.exe
  C:\Windows\System\CMsWqpO.exe
  2⤵
  PID:5580
- C:\Windows\System\CYKlZFp.exe
  C:\Windows\System\CYKlZFp.exe
  2⤵
  PID:5624
- C:\Windows\System\mcRwGSj.exe
  C:\Windows\System\mcRwGSj.exe
  2⤵
  PID:5508
- C:\Windows\System\FtnjBtW.exe
  C:\Windows\System\FtnjBtW.exe
  2⤵
  PID:5556
- C:\Windows\System\NJLrAtc.exe
  C:\Windows\System\NJLrAtc.exe
  2⤵
  PID:5784
- C:\Windows\System\oygfZpU.exe
  C:\Windows\System\oygfZpU.exe
  2⤵
  PID:5856
- C:\Windows\System\dRZddrQ.exe
  C:\Windows\System\dRZddrQ.exe
  2⤵
  PID:5932
- C:\Windows\System\COsYcGn.exe
  C:\Windows\System\COsYcGn.exe
  2⤵
  PID:5676
- C:\Windows\System\tNvZTGn.exe
  C:\Windows\System\tNvZTGn.exe
  2⤵
  PID:6036
- C:\Windows\System\jhdendI.exe
  C:\Windows\System\jhdendI.exe
  2⤵
  PID:5908
- C:\Windows\System\DywQbOu.exe
  C:\Windows\System\DywQbOu.exe
  2⤵
  PID:5972
- C:\Windows\System\FrUDOIQ.exe
  C:\Windows\System\FrUDOIQ.exe
  2⤵
  PID:6020
- C:\Windows\System\AQzwewh.exe
  C:\Windows\System\AQzwewh.exe
  2⤵
  PID:3960
- C:\Windows\System\ZlDzqma.exe
  C:\Windows\System\ZlDzqma.exe
  2⤵
  PID:6092
- C:\Windows\System\uCXYQaO.exe
  C:\Windows\System\uCXYQaO.exe
  2⤵
  PID:5312
- C:\Windows\System\jUIKNao.exe
  C:\Windows\System\jUIKNao.exe
  2⤵
  PID:6172
- C:\Windows\System\HihYESd.exe
  C:\Windows\System\HihYESd.exe
  2⤵
  PID:6192
- C:\Windows\System\IKbhsrk.exe
  C:\Windows\System\IKbhsrk.exe
  2⤵
  PID:6216
- C:\Windows\System\EGONzDz.exe
  C:\Windows\System\EGONzDz.exe
  2⤵
  PID:6240
- C:\Windows\System\DdPQehU.exe
  C:\Windows\System\DdPQehU.exe
  2⤵
  PID:6264
- C:\Windows\System\DTUFspR.exe
  C:\Windows\System\DTUFspR.exe
  2⤵
  PID:6288
- C:\Windows\System\hGareVC.exe
  C:\Windows\System\hGareVC.exe
  2⤵
  PID:6312
- C:\Windows\System\JalEuzf.exe
  C:\Windows\System\JalEuzf.exe
  2⤵
  PID:6328
- C:\Windows\System\yIoEBKh.exe
  C:\Windows\System\yIoEBKh.exe
  2⤵
  PID:6360
- C:\Windows\System\epADjnH.exe
  C:\Windows\System\epADjnH.exe
  2⤵
  PID:6380
- C:\Windows\System\qyVOKfT.exe
  C:\Windows\System\qyVOKfT.exe
  2⤵
  PID:6404
- C:\Windows\System\TDyOgPb.exe
  C:\Windows\System\TDyOgPb.exe
  2⤵
  PID:6428
- C:\Windows\System\WqCSYFJ.exe
  C:\Windows\System\WqCSYFJ.exe
  2⤵
  PID:6452
- C:\Windows\System\AQqMIhb.exe
  C:\Windows\System\AQqMIhb.exe
  2⤵
  PID:6480
- C:\Windows\System\JYqDtAW.exe
  C:\Windows\System\JYqDtAW.exe
  2⤵
  PID:6520
- C:\Windows\System\bHbrxNX.exe
  C:\Windows\System\bHbrxNX.exe
  2⤵
  PID:6540
- C:\Windows\System\GVEJVwe.exe
  C:\Windows\System\GVEJVwe.exe
  2⤵
  PID:6568
- C:\Windows\System\lUucOxA.exe
  C:\Windows\System\lUucOxA.exe
  2⤵
  PID:6588
- C:\Windows\System\huTQTHV.exe
  C:\Windows\System\huTQTHV.exe
  2⤵
  PID:6612
- C:\Windows\System\cQxvvDH.exe
  C:\Windows\System\cQxvvDH.exe
  2⤵
  PID:6636
- C:\Windows\System\bEAuAYi.exe
  C:\Windows\System\bEAuAYi.exe
  2⤵
  PID:6664
- C:\Windows\System\oKMzaGQ.exe
  C:\Windows\System\oKMzaGQ.exe
  2⤵
  PID:6688
- C:\Windows\System\KsezQiD.exe
  C:\Windows\System\KsezQiD.exe
  2⤵
  PID:6716
- C:\Windows\System\IwJsLrd.exe
  C:\Windows\System\IwJsLrd.exe
  2⤵
  PID:6740
- C:\Windows\System\tMUklps.exe
  C:\Windows\System\tMUklps.exe
  2⤵
  PID:6764
- C:\Windows\System\HBhNgWl.exe
  C:\Windows\System\HBhNgWl.exe
  2⤵
  PID:6788
- C:\Windows\System\NOkHQJV.exe
  C:\Windows\System\NOkHQJV.exe
  2⤵
  PID:6816
- C:\Windows\System\hpDlkfl.exe
  C:\Windows\System\hpDlkfl.exe
  2⤵
  PID:6844
- C:\Windows\System\OsAgAwt.exe
  C:\Windows\System\OsAgAwt.exe
  2⤵
  PID:6864
- C:\Windows\System\baboBli.exe
  C:\Windows\System\baboBli.exe
  2⤵
  PID:6892
- C:\Windows\System\tsoleVQ.exe
  C:\Windows\System\tsoleVQ.exe
  2⤵
  PID:6920
- C:\Windows\System\cCTaJlN.exe
  C:\Windows\System\cCTaJlN.exe
  2⤵
  PID:6936
- C:\Windows\System\hRJLKct.exe
  C:\Windows\System\hRJLKct.exe
  2⤵
  PID:6960
- C:\Windows\System\xcuRnhR.exe
  C:\Windows\System\xcuRnhR.exe
  2⤵
  PID:6984
- C:\Windows\System\dYBpulx.exe
  C:\Windows\System\dYBpulx.exe
  2⤵
  PID:7008
- C:\Windows\System\JRpDxMN.exe
  C:\Windows\System\JRpDxMN.exe
  2⤵
  PID:7032
- C:\Windows\System\dQbHHQV.exe
  C:\Windows\System\dQbHHQV.exe
  2⤵
  PID:7056
- C:\Windows\System\MibGGdJ.exe
  C:\Windows\System\MibGGdJ.exe
  2⤵
  PID:7080
- C:\Windows\System\xeGINxy.exe
  C:\Windows\System\xeGINxy.exe
  2⤵
  PID:7100
- C:\Windows\System\EuflRLx.exe
  C:\Windows\System\EuflRLx.exe
  2⤵
  PID:7124
- C:\Windows\System\tFTbGkA.exe
  C:\Windows\System\tFTbGkA.exe
  2⤵
  PID:7156
- C:\Windows\System\CNzKXXW.exe
  C:\Windows\System\CNzKXXW.exe
  2⤵
  PID:5800
- C:\Windows\System\mYtGzMk.exe
  C:\Windows\System\mYtGzMk.exe
  2⤵
  PID:5232
- C:\Windows\System\LVIuDnP.exe
  C:\Windows\System\LVIuDnP.exe
  2⤵
  PID:5776
- C:\Windows\System\mwnVvpx.exe
  C:\Windows\System\mwnVvpx.exe
  2⤵
  PID:5528
- C:\Windows\System\XMCceIZ.exe
  C:\Windows\System\XMCceIZ.exe
  2⤵
  PID:5928
- C:\Windows\System\UJiiOlD.exe
  C:\Windows\System\UJiiOlD.exe
  2⤵
  PID:5652
- C:\Windows\System\ROSmXTg.exe
  C:\Windows\System\ROSmXTg.exe
  2⤵
  PID:5736
- C:\Windows\System\nLcrzUi.exe
  C:\Windows\System\nLcrzUi.exe
  2⤵
  PID:6184
- C:\Windows\System\QLPdnEU.exe
  C:\Windows\System\QLPdnEU.exe
  2⤵
  PID:6248
- C:\Windows\System\JXMoTdF.exe
  C:\Windows\System\JXMoTdF.exe
  2⤵
  PID:6296
- C:\Windows\System\xzRVigR.exe
  C:\Windows\System\xzRVigR.exe
  2⤵
  PID:6336
- C:\Windows\System\yGvTjLW.exe
  C:\Windows\System\yGvTjLW.exe
  2⤵
  PID:4848
- C:\Windows\System\sNYzsLw.exe
  C:\Windows\System\sNYzsLw.exe
  2⤵
  PID:6580
- C:\Windows\System\OFTNQLr.exe
  C:\Windows\System\OFTNQLr.exe
  2⤵
  PID:6676
- C:\Windows\System\QZOMYlu.exe
  C:\Windows\System\QZOMYlu.exe
  2⤵
  PID:6424
- C:\Windows\System\ARbSfHb.exe
  C:\Windows\System\ARbSfHb.exe
  2⤵
  PID:6856
- C:\Windows\System\zLpuKVn.exe
  C:\Windows\System\zLpuKVn.exe
  2⤵
  PID:6888
- C:\Windows\System\LJUBbWp.exe
  C:\Windows\System\LJUBbWp.exe
  2⤵
  PID:6444
- C:\Windows\System\nzbhvAL.exe
  C:\Windows\System\nzbhvAL.exe
  2⤵
  PID:6932
- C:\Windows\System\ezIisGL.exe
  C:\Windows\System\ezIisGL.exe
  2⤵
  PID:6980
- C:\Windows\System\juRqQIJ.exe
  C:\Windows\System\juRqQIJ.exe
  2⤵
  PID:7040
- C:\Windows\System\GqXNWLW.exe
  C:\Windows\System\GqXNWLW.exe
  2⤵
  PID:7108
- C:\Windows\System\PFpvmMg.exe
  C:\Windows\System\PFpvmMg.exe
  2⤵
  PID:6772
- C:\Windows\System\uxZvlld.exe
  C:\Windows\System\uxZvlld.exe
  2⤵
  PID:6584
- C:\Windows\System\MDHpBsw.exe
  C:\Windows\System\MDHpBsw.exe
  2⤵
  PID:5532
- C:\Windows\System\hrRdgRj.exe
  C:\Windows\System\hrRdgRj.exe
  2⤵
  PID:6512
- C:\Windows\System\DphQyKP.exe
  C:\Windows\System\DphQyKP.exe
  2⤵
  PID:368
- C:\Windows\System\jziouAd.exe
  C:\Windows\System\jziouAd.exe
  2⤵
  PID:6836
- C:\Windows\System\VySLHSk.exe
  C:\Windows\System\VySLHSk.exe
  2⤵
  PID:6912
- C:\Windows\System\qfLWzaa.exe
  C:\Windows\System\qfLWzaa.exe
  2⤵
  PID:7188
- C:\Windows\System\KxwKIBJ.exe
  C:\Windows\System\KxwKIBJ.exe
  2⤵
  PID:7208
- C:\Windows\System\ZvbFqEz.exe
  C:\Windows\System\ZvbFqEz.exe
  2⤵
  PID:7232
- C:\Windows\System\yczcxEX.exe
  C:\Windows\System\yczcxEX.exe
  2⤵
  PID:7260
- C:\Windows\System\cSPtDph.exe
  C:\Windows\System\cSPtDph.exe
  2⤵
  PID:7284
- C:\Windows\System\QCzvHas.exe
  C:\Windows\System\QCzvHas.exe
  2⤵
  PID:7308
- C:\Windows\System\SkVyhgp.exe
  C:\Windows\System\SkVyhgp.exe
  2⤵
  PID:7336
- C:\Windows\System\qgMbMnN.exe
  C:\Windows\System\qgMbMnN.exe
  2⤵
  PID:7360
- C:\Windows\System\PmjYBLu.exe
  C:\Windows\System\PmjYBLu.exe
  2⤵
  PID:7384
- C:\Windows\System\GzsJrMX.exe
  C:\Windows\System\GzsJrMX.exe
  2⤵
  PID:7404
- C:\Windows\System\eTfaBVf.exe
  C:\Windows\System\eTfaBVf.exe
  2⤵
  PID:7428
- C:\Windows\System\uUocOnG.exe
  C:\Windows\System\uUocOnG.exe
  2⤵
  PID:7452
- C:\Windows\System\UGuiWZU.exe
  C:\Windows\System\UGuiWZU.exe
  2⤵
  PID:7476
- C:\Windows\System\MtnkuAo.exe
  C:\Windows\System\MtnkuAo.exe
  2⤵
  PID:7504
- C:\Windows\System\QwwbfCf.exe
  C:\Windows\System\QwwbfCf.exe
  2⤵
  PID:7532
- C:\Windows\System\ZAlRGrJ.exe
  C:\Windows\System\ZAlRGrJ.exe
  2⤵
  PID:7556
- C:\Windows\System\WFHMrgW.exe
  C:\Windows\System\WFHMrgW.exe
  2⤵
  PID:7576
- C:\Windows\System\xgYeIvW.exe
  C:\Windows\System\xgYeIvW.exe
  2⤵
  PID:7600
- C:\Windows\System\uBdKSVb.exe
  C:\Windows\System\uBdKSVb.exe
  2⤵
  PID:7616
- C:\Windows\System\OXXsIeG.exe
  C:\Windows\System\OXXsIeG.exe
  2⤵
  PID:7632
- C:\Windows\System\LVfMRle.exe
  C:\Windows\System\LVfMRle.exe
  2⤵
  PID:7652
- C:\Windows\System\qGHncxz.exe
  C:\Windows\System\qGHncxz.exe
  2⤵
  PID:7672
- C:\Windows\System\EhmLdMu.exe
  C:\Windows\System\EhmLdMu.exe
  2⤵
  PID:7700
- C:\Windows\System\PZCBCfk.exe
  C:\Windows\System\PZCBCfk.exe
  2⤵
  PID:7736
- C:\Windows\System\alNVnLO.exe
  C:\Windows\System\alNVnLO.exe
  2⤵
  PID:7756
- C:\Windows\System\skdmPPQ.exe
  C:\Windows\System\skdmPPQ.exe
  2⤵
  PID:7780
- C:\Windows\System\ExLaMgU.exe
  C:\Windows\System\ExLaMgU.exe
  2⤵
  PID:7808
- C:\Windows\System\wLySnZb.exe
  C:\Windows\System\wLySnZb.exe
  2⤵
  PID:7832
- C:\Windows\System\kJoEIFy.exe
  C:\Windows\System\kJoEIFy.exe
  2⤵
  PID:7852
- C:\Windows\System\eOjGyVF.exe
  C:\Windows\System\eOjGyVF.exe
  2⤵
  PID:7876
- C:\Windows\System\IUNVrLv.exe
  C:\Windows\System\IUNVrLv.exe
  2⤵
  PID:7900
- C:\Windows\System\uHMBGVd.exe
  C:\Windows\System\uHMBGVd.exe
  2⤵
  PID:7928
- C:\Windows\System\zhebAZW.exe
  C:\Windows\System\zhebAZW.exe
  2⤵
  PID:7956
- C:\Windows\System\OaYaNXm.exe
  C:\Windows\System\OaYaNXm.exe
  2⤵
  PID:7976
- C:\Windows\System\NSUMuJB.exe
  C:\Windows\System\NSUMuJB.exe
  2⤵
  PID:8000
- C:\Windows\System\esThCEr.exe
  C:\Windows\System\esThCEr.exe
  2⤵
  PID:8024
- C:\Windows\System\Dkzzwme.exe
  C:\Windows\System\Dkzzwme.exe
  2⤵
  PID:8048
- C:\Windows\System\sgBJPbB.exe
  C:\Windows\System\sgBJPbB.exe
  2⤵
  PID:8068
- C:\Windows\System\fScwqPR.exe
  C:\Windows\System\fScwqPR.exe
  2⤵
  PID:8096
- C:\Windows\System\zocakIC.exe
  C:\Windows\System\zocakIC.exe
  2⤵
  PID:8116
- C:\Windows\System\DjAlfRk.exe
  C:\Windows\System\DjAlfRk.exe
  2⤵
  PID:8140
- C:\Windows\System\nRHdOmh.exe
  C:\Windows\System\nRHdOmh.exe
  2⤵
  PID:8160
- C:\Windows\System\LIYzIlQ.exe
  C:\Windows\System\LIYzIlQ.exe
  2⤵
  PID:8184
- C:\Windows\System\blsSqyu.exe
  C:\Windows\System\blsSqyu.exe
  2⤵
  PID:5468
- C:\Windows\System\xMFalgq.exe
  C:\Windows\System\xMFalgq.exe
  2⤵
  PID:6128
- C:\Windows\System\bmNdsQy.exe
  C:\Windows\System\bmNdsQy.exe
  2⤵
  PID:7076
- C:\Windows\System\eBLOKtw.exe
  C:\Windows\System\eBLOKtw.exe
  2⤵
  PID:6532
- C:\Windows\System\gvnFZIZ.exe
  C:\Windows\System\gvnFZIZ.exe
  2⤵
  PID:6420
- C:\Windows\System\tkiLeUu.exe
  C:\Windows\System\tkiLeUu.exe
  2⤵
  PID:4524
- C:\Windows\System\SyGWPnt.exe
  C:\Windows\System\SyGWPnt.exe
  2⤵
  PID:6672
- C:\Windows\System\KnHUgep.exe
  C:\Windows\System\KnHUgep.exe
  2⤵
  PID:5760
- C:\Windows\System\SBEbuyW.exe
  C:\Windows\System\SBEbuyW.exe
  2⤵
  PID:7248
- C:\Windows\System\gCKYYvz.exe
  C:\Windows\System\gCKYYvz.exe
  2⤵
  PID:7316
- C:\Windows\System\QVEKEbv.exe
  C:\Windows\System\QVEKEbv.exe
  2⤵
  PID:7352
- C:\Windows\System\YwGzPbu.exe
  C:\Windows\System\YwGzPbu.exe
  2⤵
  PID:7420
- C:\Windows\System\QKBuSkC.exe
  C:\Windows\System\QKBuSkC.exe
  2⤵
  PID:7116
- C:\Windows\System\MatKslW.exe
  C:\Windows\System\MatKslW.exe
  2⤵
  PID:7748
- C:\Windows\System\HaDoTRs.exe
  C:\Windows\System\HaDoTRs.exe
  2⤵
  PID:7824
- C:\Windows\System\tpsQMfe.exe
  C:\Windows\System\tpsQMfe.exe
  2⤵
  PID:7884
- C:\Windows\System\RrOnlsO.exe
  C:\Windows\System\RrOnlsO.exe
  2⤵
  PID:7436
- C:\Windows\System\dxWrAOr.exe
  C:\Windows\System\dxWrAOr.exe
  2⤵
  PID:7472
- C:\Windows\System\tDKInOT.exe
  C:\Windows\System\tDKInOT.exe
  2⤵
  PID:2532
- C:\Windows\System\NmEqVjw.exe
  C:\Windows\System\NmEqVjw.exe
  2⤵
  PID:6824
- C:\Windows\System\quuPrGN.exe
  C:\Windows\System\quuPrGN.exe
  2⤵
  PID:7588
- C:\Windows\System\qLRFhtF.exe
  C:\Windows\System\qLRFhtF.exe
  2⤵
  PID:8112
- C:\Windows\System\liiiXXI.exe
  C:\Windows\System\liiiXXI.exe
  2⤵
  PID:7240
- C:\Windows\System\HmjzRDA.exe
  C:\Windows\System\HmjzRDA.exe
  2⤵
  PID:6472
- C:\Windows\System\ujndpNN.exe
  C:\Windows\System\ujndpNN.exe
  2⤵
  PID:7796
- C:\Windows\System\AkUzVHY.exe
  C:\Windows\System\AkUzVHY.exe
  2⤵
  PID:7380
- C:\Windows\System\mwBobOY.exe
  C:\Windows\System\mwBobOY.exe
  2⤵
  PID:7120
- C:\Windows\System\UrcAqQz.exe
  C:\Windows\System\UrcAqQz.exe
  2⤵
  PID:8216
- C:\Windows\System\ClUskZc.exe
  C:\Windows\System\ClUskZc.exe
  2⤵
  PID:8244
- C:\Windows\System\CQmOfnR.exe
  C:\Windows\System\CQmOfnR.exe
  2⤵
  PID:8268
- C:\Windows\System\YgZmWuN.exe
  C:\Windows\System\YgZmWuN.exe
  2⤵
  PID:8292
- C:\Windows\System\WIvMTYv.exe
  C:\Windows\System\WIvMTYv.exe
  2⤵
  PID:8320
- C:\Windows\System\rxXhMTz.exe
  C:\Windows\System\rxXhMTz.exe
  2⤵
  PID:8340
- C:\Windows\System\CUNDDOA.exe
  C:\Windows\System\CUNDDOA.exe
  2⤵
  PID:8356
- C:\Windows\System\NtCxzLx.exe
  C:\Windows\System\NtCxzLx.exe
  2⤵
  PID:8372
- C:\Windows\System\mFXAxkh.exe
  C:\Windows\System\mFXAxkh.exe
  2⤵
  PID:8392
- C:\Windows\System\ghAVXcW.exe
  C:\Windows\System\ghAVXcW.exe
  2⤵
  PID:8424
- C:\Windows\System\qxZDjDE.exe
  C:\Windows\System\qxZDjDE.exe
  2⤵
  PID:8456
- C:\Windows\System\vnmLZrP.exe
  C:\Windows\System\vnmLZrP.exe
  2⤵
  PID:8480
- C:\Windows\System\OFXoCnk.exe
  C:\Windows\System\OFXoCnk.exe
  2⤵
  PID:8512
- C:\Windows\System\dRXIZPf.exe
  C:\Windows\System\dRXIZPf.exe
  2⤵
  PID:8540
- C:\Windows\System\wFloRGl.exe
  C:\Windows\System\wFloRGl.exe
  2⤵
  PID:8568
- C:\Windows\System\OXUvmVR.exe
  C:\Windows\System\OXUvmVR.exe
  2⤵
  PID:8588
- C:\Windows\System\rkmMyDE.exe
  C:\Windows\System\rkmMyDE.exe
  2⤵
  PID:8616
- C:\Windows\System\FiNxmIk.exe
  C:\Windows\System\FiNxmIk.exe
  2⤵
  PID:8640
- C:\Windows\System\oSPNOiv.exe
  C:\Windows\System\oSPNOiv.exe
  2⤵
  PID:8664
- C:\Windows\System\mILkgoB.exe
  C:\Windows\System\mILkgoB.exe
  2⤵
  PID:8692
- C:\Windows\System\rlqynKy.exe
  C:\Windows\System\rlqynKy.exe
  2⤵
  PID:8712
- C:\Windows\System\ulMwiYZ.exe
  C:\Windows\System\ulMwiYZ.exe
  2⤵
  PID:8740
- C:\Windows\System\hMLKOUs.exe
  C:\Windows\System\hMLKOUs.exe
  2⤵
  PID:8764
- C:\Windows\System\iCziagA.exe
  C:\Windows\System\iCziagA.exe
  2⤵
  PID:8788
- C:\Windows\System\GmjtSuT.exe
  C:\Windows\System\GmjtSuT.exe
  2⤵
  PID:8812
- C:\Windows\System\qyYCpNS.exe
  C:\Windows\System\qyYCpNS.exe
  2⤵
  PID:8840
- C:\Windows\System\ajymhDp.exe
  C:\Windows\System\ajymhDp.exe
  2⤵
  PID:8864
- C:\Windows\System\fDHyqfk.exe
  C:\Windows\System\fDHyqfk.exe
  2⤵
  PID:8888
- C:\Windows\System\eaDyoDe.exe
  C:\Windows\System\eaDyoDe.exe
  2⤵
  PID:8908
- C:\Windows\System\qKwdDPX.exe
  C:\Windows\System\qKwdDPX.exe
  2⤵
  PID:8932
- C:\Windows\System\SBzuCTW.exe
  C:\Windows\System\SBzuCTW.exe
  2⤵
  PID:8952
- C:\Windows\System\FWnAFUz.exe
  C:\Windows\System\FWnAFUz.exe
  2⤵
  PID:8972
- C:\Windows\System\iCQBpsR.exe
  C:\Windows\System\iCQBpsR.exe
  2⤵
  PID:8996
- C:\Windows\System\YmubWTU.exe
  C:\Windows\System\YmubWTU.exe
  2⤵
  PID:9020
- C:\Windows\System\VZfRNJV.exe
  C:\Windows\System\VZfRNJV.exe
  2⤵
  PID:9044
- C:\Windows\System\MxnbcAb.exe
  C:\Windows\System\MxnbcAb.exe
  2⤵
  PID:9068
- C:\Windows\System\DREnThC.exe
  C:\Windows\System\DREnThC.exe
  2⤵
  PID:9092
- C:\Windows\System\RjyHAYG.exe
  C:\Windows\System\RjyHAYG.exe
  2⤵
  PID:9120
- C:\Windows\System\rOSmnjh.exe
  C:\Windows\System\rOSmnjh.exe
  2⤵
  PID:9144
- C:\Windows\System\uMzvMFy.exe
  C:\Windows\System\uMzvMFy.exe
  2⤵
  PID:9168
- C:\Windows\System\AlxUsTa.exe
  C:\Windows\System\AlxUsTa.exe
  2⤵
  PID:9196
- C:\Windows\System\OabDlZw.exe
  C:\Windows\System\OabDlZw.exe
  2⤵
  PID:9212
- C:\Windows\System\fKLReyA.exe
  C:\Windows\System\fKLReyA.exe
  2⤵
  PID:8044
- C:\Windows\System\qNCiKdt.exe
  C:\Windows\System\qNCiKdt.exe
  2⤵
  PID:7648
- C:\Windows\System\VCQDWbu.exe
  C:\Windows\System\VCQDWbu.exe
  2⤵
  PID:7896
- C:\Windows\System\hawxVUk.exe
  C:\Windows\System\hawxVUk.exe
  2⤵
  PID:7468
- C:\Windows\System\LaYtMXS.exe
  C:\Windows\System\LaYtMXS.exe
  2⤵
  PID:7792
- C:\Windows\System\kOJrXra.exe
  C:\Windows\System\kOJrXra.exe
  2⤵
  PID:6880
- C:\Windows\System\NQYciIH.exe
  C:\Windows\System\NQYciIH.exe
  2⤵
  PID:6708
- C:\Windows\System\TIxORIU.exe
  C:\Windows\System\TIxORIU.exe
  2⤵
  PID:8252
- C:\Windows\System\ynfJNGg.exe
  C:\Windows\System\ynfJNGg.exe
  2⤵
  PID:7176
- C:\Windows\System\ElcHJzx.exe
  C:\Windows\System\ElcHJzx.exe
  2⤵
  PID:2836
- C:\Windows\System\pJAXJlV.exe
  C:\Windows\System\pJAXJlV.exe
  2⤵
  PID:7328
- C:\Windows\System\FEqBTxr.exe
  C:\Windows\System\FEqBTxr.exe
  2⤵
  PID:8472
- C:\Windows\System\PRSEULj.exe
  C:\Windows\System\PRSEULj.exe
  2⤵
  PID:6872
- C:\Windows\System\kiUBlUl.exe
  C:\Windows\System\kiUBlUl.exe
  2⤵
  PID:8732
- C:\Windows\System\dDucVyY.exe
  C:\Windows\System\dDucVyY.exe
  2⤵
  PID:6548
- C:\Windows\System\VPiSCuu.exe
  C:\Windows\System\VPiSCuu.exe
  2⤵
  PID:6780
- C:\Windows\System\uwwcppE.exe
  C:\Windows\System\uwwcppE.exe
  2⤵
  PID:8820
- C:\Windows\System\vxPhegF.exe
  C:\Windows\System\vxPhegF.exe
  2⤵
  PID:5544
- C:\Windows\System\BgkNXYM.exe
  C:\Windows\System\BgkNXYM.exe
  2⤵
  PID:8336
- C:\Windows\System\GJpMUxL.exe
  C:\Windows\System\GJpMUxL.exe
  2⤵
  PID:9232
- C:\Windows\System\mQYQaUE.exe
  C:\Windows\System\mQYQaUE.exe
  2⤵
  PID:9256
- C:\Windows\System\vCsKeky.exe
  C:\Windows\System\vCsKeky.exe
  2⤵
  PID:9280
- C:\Windows\System\JTxpOyq.exe
  C:\Windows\System\JTxpOyq.exe
  2⤵
  PID:9308
- C:\Windows\System\RMEkFzl.exe
  C:\Windows\System\RMEkFzl.exe
  2⤵
  PID:9336
- C:\Windows\System\RBVUfVo.exe
  C:\Windows\System\RBVUfVo.exe
  2⤵
  PID:9360
- C:\Windows\System\Ivhtpkr.exe
  C:\Windows\System\Ivhtpkr.exe
  2⤵
  PID:9384
- C:\Windows\System\StwWYwK.exe
  C:\Windows\System\StwWYwK.exe
  2⤵
  PID:9412
- C:\Windows\System\zhLfApL.exe
  C:\Windows\System\zhLfApL.exe
  2⤵
  PID:9788
- C:\Windows\System\JzLnTPN.exe
  C:\Windows\System\JzLnTPN.exe
  2⤵
  PID:9812
- C:\Windows\System\epLfzDE.exe
  C:\Windows\System\epLfzDE.exe
  2⤵
  PID:9844
- C:\Windows\System\TRxTQdA.exe
  C:\Windows\System\TRxTQdA.exe
  2⤵
  PID:9884
- C:\Windows\System\uHDHEJd.exe
  C:\Windows\System\uHDHEJd.exe
  2⤵
  PID:9908
- C:\Windows\System\vBBmOsl.exe
  C:\Windows\System\vBBmOsl.exe
  2⤵
  PID:9940
- C:\Windows\System\sSqPWym.exe
  C:\Windows\System\sSqPWym.exe
  2⤵
  PID:9968
- C:\Windows\System\Whzzszh.exe
  C:\Windows\System\Whzzszh.exe
  2⤵
  PID:10000
- C:\Windows\System\EeAgJaS.exe
  C:\Windows\System\EeAgJaS.exe
  2⤵
  PID:10036
- C:\Windows\System\eASSJqM.exe
  C:\Windows\System\eASSJqM.exe
  2⤵
  PID:10064
- C:\Windows\System\DkLLzmF.exe
  C:\Windows\System\DkLLzmF.exe
  2⤵
  PID:10092
- C:\Windows\System\NExHXCM.exe
  C:\Windows\System\NExHXCM.exe
  2⤵
  PID:10140
- C:\Windows\System\REOgWmQ.exe
  C:\Windows\System\REOgWmQ.exe
  2⤵
  PID:10160
- C:\Windows\System\imOyYTb.exe
  C:\Windows\System\imOyYTb.exe
  2⤵
  PID:10188
- C:\Windows\System\zxvNiJW.exe
  C:\Windows\System\zxvNiJW.exe
  2⤵
  PID:10212
- C:\Windows\System\CZGWxlD.exe
  C:\Windows\System\CZGWxlD.exe
  2⤵
  PID:8436
- C:\Windows\System\JHWHTTy.exe
  C:\Windows\System\JHWHTTy.exe
  2⤵
  PID:9064
- C:\Windows\System\IVlWATQ.exe
  C:\Windows\System\IVlWATQ.exe
  2⤵
  PID:8060
- C:\Windows\System\DGrLwRG.exe
  C:\Windows\System\DGrLwRG.exe
  2⤵
  PID:9100
- C:\Windows\System\RxEbSUr.exe
  C:\Windows\System\RxEbSUr.exe
  2⤵
  PID:2336
- C:\Windows\System\AikHNsE.exe
  C:\Windows\System\AikHNsE.exe
  2⤵
  PID:7664
- C:\Windows\System\sdEixib.exe
  C:\Windows\System\sdEixib.exe
  2⤵
  PID:8652
- C:\Windows\System\lvOoXOj.exe
  C:\Windows\System\lvOoXOj.exe
  2⤵
  PID:7944
- C:\Windows\System\yerIZfl.exe
  C:\Windows\System\yerIZfl.exe
  2⤵
  PID:8308
- C:\Windows\System\uwCpHjK.exe
  C:\Windows\System\uwCpHjK.exe
  2⤵
  PID:8876
- C:\Windows\System\PHPoXEj.exe
  C:\Windows\System\PHPoXEj.exe
  2⤵
  PID:8388
- C:\Windows\System\HzXxAnf.exe
  C:\Windows\System\HzXxAnf.exe
  2⤵
  PID:9252
- C:\Windows\System\ofvWnQn.exe
  C:\Windows\System\ofvWnQn.exe
  2⤵
  PID:2188
- C:\Windows\System\YKXuFTj.exe
  C:\Windows\System\YKXuFTj.exe
  2⤵
  PID:9112
- C:\Windows\System\YGjSWcl.exe
  C:\Windows\System\YGjSWcl.exe
  2⤵
  PID:8584
- C:\Windows\System\HnmYLyx.exe
  C:\Windows\System\HnmYLyx.exe
  2⤵
  PID:9508
- C:\Windows\System\TmuHVGr.exe
  C:\Windows\System\TmuHVGr.exe
  2⤵
  PID:7968
- C:\Windows\System\QNxVLVp.exe
  C:\Windows\System\QNxVLVp.exe
  2⤵
  PID:8440
- C:\Windows\System\YuVxKdt.exe
  C:\Windows\System\YuVxKdt.exe
  2⤵
  PID:9656
- C:\Windows\System\BeuxHpJ.exe
  C:\Windows\System\BeuxHpJ.exe
  2⤵
  PID:9680
- C:\Windows\System\wzTcHYC.exe
  C:\Windows\System\wzTcHYC.exe
  2⤵
  PID:8960
- C:\Windows\System\bjRGmtP.exe
  C:\Windows\System\bjRGmtP.exe
  2⤵
  PID:9004
- C:\Windows\System\ysqwMRJ.exe
  C:\Windows\System\ysqwMRJ.exe
  2⤵
  PID:9776
- C:\Windows\System\QewSxmu.exe
  C:\Windows\System\QewSxmu.exe
  2⤵
  PID:7996
- C:\Windows\System\XgGOkJm.exe
  C:\Windows\System\XgGOkJm.exe
  2⤵
  PID:6200
- C:\Windows\System\RUpoKwF.exe
  C:\Windows\System\RUpoKwF.exe
  2⤵
  PID:2664
- C:\Windows\System\BTgwlqC.exe
  C:\Windows\System\BTgwlqC.exe
  2⤵
  PID:9492
- C:\Windows\System\JCQaBhE.exe
  C:\Windows\System\JCQaBhE.exe
  2⤵
  PID:9516
- C:\Windows\System\AAZORQN.exe
  C:\Windows\System\AAZORQN.exe
  2⤵
  PID:10072
- C:\Windows\System\YPkAzLI.exe
  C:\Windows\System\YPkAzLI.exe
  2⤵
  PID:9556
- C:\Windows\System\ADOMbgS.exe
  C:\Windows\System\ADOMbgS.exe
  2⤵
  PID:10256
- C:\Windows\System\zZQZPPj.exe
  C:\Windows\System\zZQZPPj.exe
  2⤵
  PID:10276
- C:\Windows\System\QlRdsek.exe
  C:\Windows\System\QlRdsek.exe
  2⤵
  PID:10304
- C:\Windows\System\SjIwOMo.exe
  C:\Windows\System\SjIwOMo.exe
  2⤵
  PID:10336
- C:\Windows\System\fuuoJPN.exe
  C:\Windows\System\fuuoJPN.exe
  2⤵
  PID:10352
- C:\Windows\System\HDTuqcL.exe
  C:\Windows\System\HDTuqcL.exe
  2⤵
  PID:10372
- C:\Windows\System\AFmbNUQ.exe
  C:\Windows\System\AFmbNUQ.exe
  2⤵
  PID:10400
- C:\Windows\System\iahMilh.exe
  C:\Windows\System\iahMilh.exe
  2⤵
  PID:10428
- C:\Windows\System\nHZhYrq.exe
  C:\Windows\System\nHZhYrq.exe
  2⤵
  PID:10452
- C:\Windows\System\WNjrqlm.exe
  C:\Windows\System\WNjrqlm.exe
  2⤵
  PID:10480
- C:\Windows\System\wGKLTHb.exe
  C:\Windows\System\wGKLTHb.exe
  2⤵
  PID:10500
- C:\Windows\System\qfLygWU.exe
  C:\Windows\System\qfLygWU.exe
  2⤵
  PID:10532
- C:\Windows\System\aqMLcMa.exe
  C:\Windows\System\aqMLcMa.exe
  2⤵
  PID:10572
- C:\Windows\System\NLgEHMA.exe
  C:\Windows\System\NLgEHMA.exe
  2⤵
  PID:10596
- C:\Windows\System\fmecHJf.exe
  C:\Windows\System\fmecHJf.exe
  2⤵
  PID:10620
- C:\Windows\System\VNyzJkW.exe
  C:\Windows\System\VNyzJkW.exe
  2⤵
  PID:10644
- C:\Windows\System\UyCnhYd.exe
  C:\Windows\System\UyCnhYd.exe
  2⤵
  PID:10668
- C:\Windows\System\ysIfImW.exe
  C:\Windows\System\ysIfImW.exe
  2⤵
  PID:10692
- C:\Windows\System\GVuVaGE.exe
  C:\Windows\System\GVuVaGE.exe
  2⤵
  PID:10724
- C:\Windows\System\EhBNvcm.exe
  C:\Windows\System\EhBNvcm.exe
  2⤵
  PID:10744
- C:\Windows\System\HsoZrXL.exe
  C:\Windows\System\HsoZrXL.exe
  2⤵
  PID:10772
- C:\Windows\System\jFwBstz.exe
  C:\Windows\System\jFwBstz.exe
  2⤵
  PID:10796
- C:\Windows\System\CVrUTnI.exe
  C:\Windows\System\CVrUTnI.exe
  2⤵
  PID:10820
- C:\Windows\System\VaQgUBN.exe
  C:\Windows\System\VaQgUBN.exe
  2⤵
  PID:10836
- C:\Windows\System\QpylDuW.exe
  C:\Windows\System\QpylDuW.exe
  2⤵
  PID:10852
- C:\Windows\System\ncuWjRu.exe
  C:\Windows\System\ncuWjRu.exe
  2⤵
  PID:10868
- C:\Windows\System\rxLPUEp.exe
  C:\Windows\System\rxLPUEp.exe
  2⤵
  PID:10884
- C:\Windows\System\HrhBPHF.exe
  C:\Windows\System\HrhBPHF.exe
  2⤵
  PID:10900
- C:\Windows\System\HzuHWtN.exe
  C:\Windows\System\HzuHWtN.exe
  2⤵
  PID:10928
- C:\Windows\System\ftGctVV.exe
  C:\Windows\System\ftGctVV.exe
  2⤵
  PID:10952
- C:\Windows\System\RhPpUMs.exe
  C:\Windows\System\RhPpUMs.exe
  2⤵
  PID:10980
- C:\Windows\System\zwiNbLS.exe
  C:\Windows\System\zwiNbLS.exe
  2⤵
  PID:11000
- C:\Windows\System\EeOjraG.exe
  C:\Windows\System\EeOjraG.exe
  2⤵
  PID:11024
- C:\Windows\System\JcbhAOB.exe
  C:\Windows\System\JcbhAOB.exe
  2⤵
  PID:11048
- C:\Windows\System\yUYHeaf.exe
  C:\Windows\System\yUYHeaf.exe
  2⤵
  PID:11072
- C:\Windows\System\gNyympC.exe
  C:\Windows\System\gNyympC.exe
  2⤵
  PID:11108
- C:\Windows\System\JvxxSNE.exe
  C:\Windows\System\JvxxSNE.exe
  2⤵
  PID:11136
- C:\Windows\System\AiNhEcM.exe
  C:\Windows\System\AiNhEcM.exe
  2⤵
  PID:11164
- C:\Windows\System\aOcMOeo.exe
  C:\Windows\System\aOcMOeo.exe
  2⤵
  PID:11192
- C:\Windows\System\UEOSlLU.exe
  C:\Windows\System\UEOSlLU.exe
  2⤵
  PID:11212
- C:\Windows\System\LCbPeSo.exe
  C:\Windows\System\LCbPeSo.exe
  2⤵
  PID:11236
- C:\Windows\System\iwcKpdv.exe
  C:\Windows\System\iwcKpdv.exe
  2⤵
  PID:11256
- C:\Windows\System\rWXjEkM.exe
  C:\Windows\System\rWXjEkM.exe
  2⤵
  PID:7292
- C:\Windows\System\qydyEVJ.exe
  C:\Windows\System\qydyEVJ.exe
  2⤵
  PID:8636
- C:\Windows\System\SDeJRdd.exe
  C:\Windows\System\SDeJRdd.exe
  2⤵
  PID:7396
- C:\Windows\System\ltfxKza.exe
  C:\Windows\System\ltfxKza.exe
  2⤵
  PID:9228
- C:\Windows\System\nmKojYe.exe
  C:\Windows\System\nmKojYe.exe
  2⤵
  PID:6436
- C:\Windows\System\FskUzFz.exe
  C:\Windows\System\FskUzFz.exe
  2⤵
  PID:9740
- C:\Windows\System\fTZMSYI.exe
  C:\Windows\System\fTZMSYI.exe
  2⤵
  PID:9356
- C:\Windows\System\QyFPKjV.exe
  C:\Windows\System\QyFPKjV.exe
  2⤵
  PID:8468
- C:\Windows\System\ECAoEAf.exe
  C:\Windows\System\ECAoEAf.exe
  2⤵
  PID:9852
- C:\Windows\System\nDtLoTE.exe
  C:\Windows\System\nDtLoTE.exe
  2⤵
  PID:9164
- C:\Windows\System\GQUnwgK.exe
  C:\Windows\System\GQUnwgK.exe
  2⤵
  PID:8088
- C:\Windows\System\IrSvvZz.exe
  C:\Windows\System\IrSvvZz.exe
  2⤵
  PID:10100
- C:\Windows\System\ijMXqBe.exe
  C:\Windows\System\ijMXqBe.exe
  2⤵
  PID:3156
- C:\Windows\System\ipSlHhU.exe
  C:\Windows\System\ipSlHhU.exe
  2⤵
  PID:9568
- C:\Windows\System\ctxoEOl.exe
  C:\Windows\System\ctxoEOl.exe
  2⤵
  PID:10132
- C:\Windows\System\AQqvkbc.exe
  C:\Windows\System\AQqvkbc.exe
  2⤵
  PID:10168
- C:\Windows\System\WhpuzZW.exe
  C:\Windows\System\WhpuzZW.exe
  2⤵
  PID:9036
- C:\Windows\System\UYgTFBR.exe
  C:\Windows\System\UYgTFBR.exe
  2⤵
  PID:9668
- C:\Windows\System\shcHdGL.exe
  C:\Windows\System\shcHdGL.exe
  2⤵
  PID:10392
- C:\Windows\System\unoxstd.exe
  C:\Windows\System\unoxstd.exe
  2⤵
  PID:10436
- C:\Windows\System\prVksZY.exe
  C:\Windows\System\prVksZY.exe
  2⤵
  PID:7448
- C:\Windows\System\zUuAeJM.exe
  C:\Windows\System\zUuAeJM.exe
  2⤵
  PID:9584
- C:\Windows\System\aynDUrP.exe
  C:\Windows\System\aynDUrP.exe
  2⤵
  PID:10652
- C:\Windows\System\NbcqZEf.exe
  C:\Windows\System\NbcqZEf.exe
  2⤵
  PID:9700
- C:\Windows\System\bYDFVHi.exe
  C:\Windows\System\bYDFVHi.exe
  2⤵
  PID:8992
- C:\Windows\System\bXiIRAv.exe
  C:\Windows\System\bXiIRAv.exe
  2⤵
  PID:10808
- C:\Windows\System\VJUOdbp.exe
  C:\Windows\System\VJUOdbp.exe
  2⤵
  PID:10876
- C:\Windows\System\SpkoONo.exe
  C:\Windows\System\SpkoONo.exe
  2⤵
  PID:10940
- C:\Windows\System\EpmexOG.exe
  C:\Windows\System\EpmexOG.exe
  2⤵
  PID:10184
- C:\Windows\System\ZLTgewt.exe
  C:\Windows\System\ZLTgewt.exe
  2⤵
  PID:7952
- C:\Windows\System\IvmqsDT.exe
  C:\Windows\System\IvmqsDT.exe
  2⤵
  PID:10368
- C:\Windows\System\srLsRmJ.exe
  C:\Windows\System\srLsRmJ.exe
  2⤵
  PID:10464
- C:\Windows\System\HLyjsvZ.exe
  C:\Windows\System\HLyjsvZ.exe
  2⤵
  PID:10496
- C:\Windows\System\SxXmXls.exe
  C:\Windows\System\SxXmXls.exe
  2⤵
  PID:9400
- C:\Windows\System\MdqRiFQ.exe
  C:\Windows\System\MdqRiFQ.exe
  2⤵
  PID:8580
- C:\Windows\System\DspMylR.exe
  C:\Windows\System\DspMylR.exe
  2⤵
  PID:10628
- C:\Windows\System\MWWypnQ.exe
  C:\Windows\System\MWWypnQ.exe
  2⤵
  PID:10732
- C:\Windows\System\cTIseYp.exe
  C:\Windows\System\cTIseYp.exe
  2⤵
  PID:11296
- C:\Windows\System\HDgDFRO.exe
  C:\Windows\System\HDgDFRO.exe
  2⤵
  PID:11320
- C:\Windows\System\SminPLn.exe
  C:\Windows\System\SminPLn.exe
  2⤵
  PID:12088
- C:\Windows\System\TlJVXNK.exe
  C:\Windows\System\TlJVXNK.exe
  2⤵
  PID:12116
- C:\Windows\System\ZUovUZo.exe
  C:\Windows\System\ZUovUZo.exe
  2⤵
  PID:12160
- C:\Windows\System\KmcygPf.exe
  C:\Windows\System\KmcygPf.exe
  2⤵
  PID:12176
- C:\Windows\System\wIXwMZo.exe
  C:\Windows\System\wIXwMZo.exe
  2⤵
  PID:12200
- C:\Windows\System\DEDkGTF.exe
  C:\Windows\System\DEDkGTF.exe
  2⤵
  PID:12224
- C:\Windows\System\jbhQNtC.exe
  C:\Windows\System\jbhQNtC.exe
  2⤵
  PID:12240
- C:\Windows\System\cwDFzSG.exe
  C:\Windows\System\cwDFzSG.exe
  2⤵
  PID:12260
- C:\Windows\System\ozKDJDi.exe
  C:\Windows\System\ozKDJDi.exe
  2⤵
  PID:12276
- C:\Windows\System\YYdEznQ.exe
  C:\Windows\System\YYdEznQ.exe
  2⤵
  PID:10804
- C:\Windows\System\erkKPhj.exe
  C:\Windows\System\erkKPhj.exe
  2⤵
  PID:10252
- C:\Windows\System\hZSbvcv.exe
  C:\Windows\System\hZSbvcv.exe
  2⤵
  PID:10328
- C:\Windows\System\QhCRqxI.exe
  C:\Windows\System\QhCRqxI.exe
  2⤵
  PID:10416
- C:\Windows\System\bBZaxGS.exe
  C:\Windows\System\bBZaxGS.exe
  2⤵
  PID:10560
- C:\Windows\System\UOqhEXF.exe
  C:\Windows\System\UOqhEXF.exe
  2⤵
  PID:11152
- C:\Windows\System\mxjJdPU.exe
  C:\Windows\System\mxjJdPU.exe
  2⤵
  PID:10756
- C:\Windows\System\qFaPqGl.exe
  C:\Windows\System\qFaPqGl.exe
  2⤵
  PID:11328
- C:\Windows\System\ZzWpctz.exe
  C:\Windows\System\ZzWpctz.exe
  2⤵
  PID:9628
- C:\Windows\System\PyjSXMo.exe
  C:\Windows\System\PyjSXMo.exe
  2⤵
  PID:10364
- C:\Windows\System\gnBzhPm.exe
  C:\Windows\System\gnBzhPm.exe
  2⤵
  PID:9896
- C:\Windows\System\htUTKQg.exe
  C:\Windows\System\htUTKQg.exe
  2⤵
  PID:11184
- C:\Windows\System\aZAcaMv.exe
  C:\Windows\System\aZAcaMv.exe
  2⤵
  PID:11244
- C:\Windows\System\mYgPtic.exe
  C:\Windows\System\mYgPtic.exe
  2⤵
  PID:8020
- C:\Windows\System\ywnMupV.exe
  C:\Windows\System\ywnMupV.exe
  2⤵
  PID:11280
- C:\Windows\System\wCVhijw.exe
  C:\Windows\System\wCVhijw.exe
  2⤵
  PID:9140
- C:\Windows\System\EVBGsAq.exe
  C:\Windows\System\EVBGsAq.exe
  2⤵
  PID:9332
- C:\Windows\System\anZoQhC.exe
  C:\Windows\System\anZoQhC.exe
  2⤵
  PID:5180
- C:\Windows\System\DNEgrhk.exe
  C:\Windows\System\DNEgrhk.exe
  2⤵
  PID:2492
- C:\Windows\System\bGhTvlZ.exe
  C:\Windows\System\bGhTvlZ.exe
  2⤵
  PID:8832
- C:\Windows\System\dfnaKci.exe
  C:\Windows\System\dfnaKci.exe
  2⤵
  PID:8776
- C:\Windows\System\BXXBSAE.exe
  C:\Windows\System\BXXBSAE.exe
  2⤵
  PID:4300
- C:\Windows\System\SrLejqG.exe
  C:\Windows\System\SrLejqG.exe
  2⤵
  PID:10916
- C:\Windows\System\zXSZVly.exe
  C:\Windows\System\zXSZVly.exe
  2⤵
  PID:10992
- C:\Windows\System\IGcKGsG.exe
  C:\Windows\System\IGcKGsG.exe
  2⤵
  PID:9428
- C:\Windows\System\aEGekqW.exe
  C:\Windows\System\aEGekqW.exe
  2⤵
  PID:11060
- C:\Windows\System\zfVbaWn.exe
  C:\Windows\System\zfVbaWn.exe
  2⤵
  PID:11308
- C:\Windows\System\zIDHeoo.exe
  C:\Windows\System\zIDHeoo.exe
  2⤵
  PID:11356
- C:\Windows\System\iUsgxSo.exe
  C:\Windows\System\iUsgxSo.exe
  2⤵
  PID:11492
- C:\Windows\System\OlqykJJ.exe
  C:\Windows\System\OlqykJJ.exe
  2⤵
  PID:12052
- C:\Windows\System\jeNEuhg.exe
  C:\Windows\System\jeNEuhg.exe
  2⤵
  PID:12124
- C:\Windows\System\mIyMgPU.exe
  C:\Windows\System\mIyMgPU.exe
  2⤵
  PID:12232
- C:\Windows\System\NGJbADp.exe
  C:\Windows\System\NGJbADp.exe
  2⤵
  PID:11660
- C:\Windows\System\jRXDCYd.exe
  C:\Windows\System\jRXDCYd.exe
  2⤵
  PID:11776
- C:\Windows\System\mqzoKtt.exe
  C:\Windows\System\mqzoKtt.exe
  2⤵
  PID:11576
- C:\Windows\System\fetkqqB.exe
  C:\Windows\System\fetkqqB.exe
  2⤵
  PID:12208
- C:\Windows\System\YTkYbgA.exe
  C:\Windows\System\YTkYbgA.exe
  2⤵
  PID:11368
- C:\Windows\System\JjLEYga.exe
  C:\Windows\System\JjLEYga.exe
  2⤵
  PID:10080
- C:\Windows\System\cyRMWEe.exe
  C:\Windows\System\cyRMWEe.exe
  2⤵
  PID:10972
- C:\Windows\System\dKGKvsP.exe
  C:\Windows\System\dKGKvsP.exe
  2⤵
  PID:10520
- C:\Windows\System\DDSJxvi.exe
  C:\Windows\System\DDSJxvi.exe
  2⤵
  PID:10688
- C:\Windows\System\YGRsluC.exe
  C:\Windows\System\YGRsluC.exe
  2⤵
  PID:8408
- C:\Windows\System\RKSbijV.exe
  C:\Windows\System\RKSbijV.exe
  2⤵
  PID:4680
- C:\Windows\System\hyZObYM.exe
  C:\Windows\System\hyZObYM.exe
  2⤵
  PID:11884
- C:\Windows\System\HrZPhrh.exe
  C:\Windows\System\HrZPhrh.exe
  2⤵
  PID:11208
- C:\Windows\System\zugTeWa.exe
  C:\Windows\System\zugTeWa.exe
  2⤵
  PID:12296
- C:\Windows\System\pGtjjob.exe
  C:\Windows\System\pGtjjob.exe
  2⤵
  PID:12312
- C:\Windows\System\zmVHcOt.exe
  C:\Windows\System\zmVHcOt.exe
  2⤵
  PID:12328
- C:\Windows\System\CQaCwpf.exe
  C:\Windows\System\CQaCwpf.exe
  2⤵
  PID:12348
- C:\Windows\System\bmcpbFf.exe
  C:\Windows\System\bmcpbFf.exe
  2⤵
  PID:12364
- C:\Windows\System\AFoarNk.exe
  C:\Windows\System\AFoarNk.exe
  2⤵
  PID:12392
- C:\Windows\System\dVbHgMF.exe
  C:\Windows\System\dVbHgMF.exe
  2⤵
  PID:12416
- C:\Windows\System\ebBfupL.exe
  C:\Windows\System\ebBfupL.exe
  2⤵
  PID:12444
- C:\Windows\System\VjVobEx.exe
  C:\Windows\System\VjVobEx.exe
  2⤵
  PID:12460
- C:\Windows\System\azXAPwF.exe
  C:\Windows\System\azXAPwF.exe
  2⤵
  PID:12488
- C:\Windows\System\warfqQU.exe
  C:\Windows\System\warfqQU.exe
  2⤵
  PID:12516
- C:\Windows\System\oNOFWaf.exe
  C:\Windows\System\oNOFWaf.exe
  2⤵
  PID:12536
- C:\Windows\System\jDzXqrB.exe
  C:\Windows\System\jDzXqrB.exe
  2⤵
  PID:12556
- C:\Windows\System\kavekTP.exe
  C:\Windows\System\kavekTP.exe
  2⤵
  PID:12584
- C:\Windows\System\xvOgiOp.exe
  C:\Windows\System\xvOgiOp.exe
  2⤵
  PID:12608
- C:\Windows\System\KAzvlUv.exe
  C:\Windows\System\KAzvlUv.exe
  2⤵
  PID:12632
- C:\Windows\System\HepHaUU.exe
  C:\Windows\System\HepHaUU.exe
  2⤵
  PID:12664
- C:\Windows\System\pTeyYDs.exe
  C:\Windows\System\pTeyYDs.exe
  2⤵
  PID:12684
- C:\Windows\System\EcAuOFN.exe
  C:\Windows\System\EcAuOFN.exe
  2⤵
  PID:12712
- C:\Windows\System\dnQZzzH.exe
  C:\Windows\System\dnQZzzH.exe
  2⤵
  PID:12736
- C:\Windows\System\aEJwJpc.exe
  C:\Windows\System\aEJwJpc.exe
  2⤵
  PID:12760
- C:\Windows\System\msodsbG.exe
  C:\Windows\System\msodsbG.exe
  2⤵
  PID:12780
- C:\Windows\System\pwcnEgO.exe
  C:\Windows\System\pwcnEgO.exe
  2⤵
  PID:12804
- C:\Windows\System\nmKxGoA.exe
  C:\Windows\System\nmKxGoA.exe
  2⤵
  PID:12824
- C:\Windows\System\GxkcELV.exe
  C:\Windows\System\GxkcELV.exe
  2⤵
  PID:12840
- C:\Windows\System\wANLtZS.exe
  C:\Windows\System\wANLtZS.exe
  2⤵
  PID:12864
- C:\Windows\System\RjwLUqZ.exe
  C:\Windows\System\RjwLUqZ.exe
  2⤵
  PID:12884
- C:\Windows\System\hyGAcpt.exe
  C:\Windows\System\hyGAcpt.exe
  2⤵
  PID:12912
- C:\Windows\System\bvVqWNL.exe
  C:\Windows\System\bvVqWNL.exe
  2⤵
  PID:12936
- C:\Windows\System\FpgHAYd.exe
  C:\Windows\System\FpgHAYd.exe
  2⤵
  PID:12964
- C:\Windows\System\KcfKrNY.exe
  C:\Windows\System\KcfKrNY.exe
  2⤵
  PID:12992
- C:\Windows\System\YZmHGtW.exe
  C:\Windows\System\YZmHGtW.exe
  2⤵
  PID:13012
- C:\Windows\System\fZtXJAx.exe
  C:\Windows\System\fZtXJAx.exe
  2⤵
  PID:13036
- C:\Windows\System\xsMeMVc.exe
  C:\Windows\System\xsMeMVc.exe
  2⤵
  PID:13056
- C:\Windows\System\xGNYcZi.exe
  C:\Windows\System\xGNYcZi.exe
  2⤵
  PID:13080
- C:\Windows\System\cENnbUX.exe
  C:\Windows\System\cENnbUX.exe
  2⤵
  PID:13104
- C:\Windows\System\XxXiWab.exe
  C:\Windows\System\XxXiWab.exe
  2⤵
  PID:13124
- C:\Windows\System\BuYpxZb.exe
  C:\Windows\System\BuYpxZb.exe
  2⤵
  PID:13156
- C:\Windows\System\lyPRqYL.exe
  C:\Windows\System\lyPRqYL.exe
  2⤵
  PID:10312
- C:\Windows\System\whcGPzS.exe
  C:\Windows\System\whcGPzS.exe
  2⤵
  PID:13292
- C:\Windows\System\RaNloTc.exe
  C:\Windows\System\RaNloTc.exe
  2⤵
  PID:12952
- C:\Windows\System\uFYeBRQ.exe
  C:\Windows\System\uFYeBRQ.exe
  2⤵
  PID:13272
- C:\Windows\System\xYjOOGN.exe
  C:\Windows\System\xYjOOGN.exe
  2⤵
  PID:11040
- C:\Windows\System\cyhBdVu.exe
  C:\Windows\System\cyhBdVu.exe
  2⤵
  PID:10060
- C:\Windows\System\znzMOGj.exe
  C:\Windows\System\znzMOGj.exe
  2⤵
  PID:12340
- C:\Windows\System\ciGaCIq.exe
  C:\Windows\System\ciGaCIq.exe
  2⤵
  PID:12480
- C:\Windows\System\nmIAdqv.exe
  C:\Windows\System\nmIAdqv.exe
  2⤵
  PID:7280
- C:\Windows\System\qxDlhLJ.exe
  C:\Windows\System\qxDlhLJ.exe
  2⤵
  PID:9800
- C:\Windows\System\XmrKsTC.exe
  C:\Windows\System\XmrKsTC.exe
  2⤵
  PID:10516
- C:\Windows\System\JqwIMKb.exe
  C:\Windows\System\JqwIMKb.exe
  2⤵
  PID:12284
- C:\Windows\System\cuTEkeU.exe
  C:\Windows\System\cuTEkeU.exe
  2⤵
  PID:11648
- C:\Windows\System\WtXkMth.exe
  C:\Windows\System\WtXkMth.exe
  2⤵
  PID:13296
- C:\Windows\System\tlEumeH.exe
  C:\Windows\System\tlEumeH.exe
  2⤵
  PID:8860
- C:\Windows\System\vumkQAL.exe
  C:\Windows\System\vumkQAL.exe
  2⤵
  PID:2816
- C:\Windows\System\ZmULiGQ.exe
  C:\Windows\System\ZmULiGQ.exe
  2⤵
  PID:6152
- C:\Windows\System\cbFjTOv.exe
  C:\Windows\System\cbFjTOv.exe
  2⤵
  PID:11144
- C:\Windows\System\SyJsiTU.exe
  C:\Windows\System\SyJsiTU.exe
  2⤵
  PID:11528
- C:\Windows\System\ZDxHpTg.exe
  C:\Windows\System\ZDxHpTg.exe
  2⤵
  PID:13044
- C:\Windows\System\hFJYvqu.exe
  C:\Windows\System\hFJYvqu.exe
  2⤵
  PID:13304
- C:\Windows\System\LXBypnL.exe
  C:\Windows\System\LXBypnL.exe
  2⤵
  PID:13052
- C:\Windows\System\BMkYlvU.exe
  C:\Windows\System\BMkYlvU.exe
  2⤵
  PID:12524
- C:\Windows\System\KzwOSma.exe
  C:\Windows\System\KzwOSma.exe
  2⤵
  PID:13212
- C:\Windows\System\hCpRzBB.exe
  C:\Windows\System\hCpRzBB.exe
  2⤵
  PID:10752
- C:\Windows\System\dkyyZrh.exe
  C:\Windows\System\dkyyZrh.exe
  2⤵
  PID:12752
- C:\Windows\System\awXdJrF.exe
  C:\Windows\System\awXdJrF.exe
  2⤵
  PID:3804
- C:\Windows\System\aYuEARv.exe
  C:\Windows\System\aYuEARv.exe
  2⤵
  PID:12308
- C:\Windows\System\CqsnRPG.exe
  C:\Windows\System\CqsnRPG.exe
  2⤵
  PID:11736
- C:\Windows\System\GbaZNjU.exe
  C:\Windows\System\GbaZNjU.exe
  2⤵
  PID:11840
- C:\Windows\System\GMmXsju.exe
  C:\Windows\System\GMmXsju.exe
  2⤵
  PID:11500
- C:\Windows\System\jcUmwom.exe
  C:\Windows\System\jcUmwom.exe
  2⤵
  PID:12372
- C:\Windows\System\nTafQvZ.exe
  C:\Windows\System\nTafQvZ.exe
  2⤵
  PID:11856
- C:\Windows\System\aaFpaHZ.exe
  C:\Windows\System\aaFpaHZ.exe
  2⤵
  PID:12112
- C:\Windows\System\ZcvLAjV.exe
  C:\Windows\System\ZcvLAjV.exe
  2⤵
  PID:13120
- C:\Windows\System\siufvAq.exe
  C:\Windows\System\siufvAq.exe
  2⤵
  PID:12432
- C:\Windows\System\DezVUWC.exe
  C:\Windows\System\DezVUWC.exe
  2⤵
  PID:12876
- C:\Windows\System\htFAQFe.exe
  C:\Windows\System\htFAQFe.exe
  2⤵
  PID:9264
- C:\Windows\System\VhsHnBb.exe
  C:\Windows\System\VhsHnBb.exe
  2⤵
  PID:3296
- C:\Windows\System\lrmFGVj.exe
  C:\Windows\System\lrmFGVj.exe
  2⤵
  PID:12576
- C:\Windows\System\akYvGGY.exe
  C:\Windows\System\akYvGGY.exe
  2⤵
  PID:2000
- C:\Windows\System\bVsKaLM.exe
  C:\Windows\System\bVsKaLM.exe
  2⤵
  PID:1464
- C:\Windows\System\EBTGfrT.exe
  C:\Windows\System\EBTGfrT.exe
  2⤵
  PID:3528
- C:\Windows\System\HxrYisi.exe
  C:\Windows\System\HxrYisi.exe
  2⤵
  PID:3640
- C:\Windows\System\lYKydBg.exe
  C:\Windows\System\lYKydBg.exe
  2⤵
  PID:3484
- C:\Windows\System\wbSMSSK.exe
  C:\Windows\System\wbSMSSK.exe
  2⤵
  PID:2960
- C:\Windows\System\ccpxltq.exe
  C:\Windows\System\ccpxltq.exe
  2⤵
  PID:4864
- C:\Windows\System\TDVOSrl.exe
  C:\Windows\System\TDVOSrl.exe
  2⤵
  PID:2364
- C:\Windows\System\ntJEtDa.exe
  C:\Windows\System\ntJEtDa.exe
  2⤵
  PID:13096
- C:\Windows\System\JMlzeYN.exe
  C:\Windows\System\JMlzeYN.exe
  2⤵
  PID:732
- C:\Windows\System\lGArpdX.exe
  C:\Windows\System\lGArpdX.exe
  2⤵
  PID:3652
- C:\Windows\System\FpMFstz.exe
  C:\Windows\System\FpMFstz.exe
  2⤵
  PID:2704
- C:\Windows\System\ivKsiRy.exe
  C:\Windows\System\ivKsiRy.exe
  2⤵
  PID:812
- C:\Windows\System\lpCmrvi.exe
  C:\Windows\System\lpCmrvi.exe
  2⤵
  PID:4788
- C:\Windows\System\RNCIZNN.exe
  C:\Windows\System\RNCIZNN.exe
  2⤵
  PID:900
- C:\Windows\System\wRxFwdp.exe
  C:\Windows\System\wRxFwdp.exe
  2⤵
  PID:4040
- C:\Windows\System\CeWgrVj.exe
  C:\Windows\System\CeWgrVj.exe
  2⤵
  PID:3572
- C:\Windows\System\mxkZtyx.exe
  C:\Windows\System\mxkZtyx.exe
  2⤵
  PID:3428
- C:\Windows\System\LRNwSWv.exe
  C:\Windows\System\LRNwSWv.exe
  2⤵
  PID:3304
- C:\Windows\System\GOixLwl.exe
  C:\Windows\System\GOixLwl.exe
  2⤵
  PID:4972
- C:\Windows\System\nPlxknA.exe
  C:\Windows\System\nPlxknA.exe
  2⤵
  PID:2760
- C:\Windows\System\auFCpxD.exe
  C:\Windows\System\auFCpxD.exe
  2⤵
  PID:2872
- C:\Windows\System\IgNCzDr.exe
  C:\Windows\System\IgNCzDr.exe
  2⤵
  PID:1140
- C:\Windows\System\xmXQlOH.exe
  C:\Windows\System\xmXQlOH.exe
  2⤵
  PID:1632
- C:\Windows\System\MlHoFSb.exe
  C:\Windows\System\MlHoFSb.exe
  2⤵
  PID:2944
- C:\Windows\System\pBaDoFI.exe
  C:\Windows\System\pBaDoFI.exe
  2⤵
  PID:1232
- C:\Windows\System\nEkNoQz.exe
  C:\Windows\System\nEkNoQz.exe
  2⤵
  PID:860
- C:\Windows\System\ktdfFMW.exe
  C:\Windows\System\ktdfFMW.exe
  2⤵
  PID:4580
- C:\Windows\System\duIJxap.exe
  C:\Windows\System\duIJxap.exe
  2⤵
  PID:5128
- C:\Windows\System\PSQOhBP.exe
  C:\Windows\System\PSQOhBP.exe
  2⤵
  PID:5320
- C:\Windows\System\OUbVgaW.exe
  C:\Windows\System\OUbVgaW.exe
  2⤵
  PID:116
- C:\Windows\System\YLruRYF.exe
  C:\Windows\System\YLruRYF.exe
  2⤵
  PID:5036
- C:\Windows\System\PrfWEPD.exe
  C:\Windows\System\PrfWEPD.exe
  2⤵
  PID:4236
- C:\Windows\System\bdSsAKw.exe
  C:\Windows\System\bdSsAKw.exe
  2⤵
  PID:4552
- C:\Windows\System\Jiyganl.exe
  C:\Windows\System\Jiyganl.exe
  2⤵
  PID:12620
- C:\Windows\System\IytfaKr.exe
  C:\Windows\System\IytfaKr.exe
  2⤵
  PID:4004
- C:\Windows\System\InirntN.exe
  C:\Windows\System\InirntN.exe
  2⤵
  PID:4228
- C:\Windows\System\Osykzfl.exe
  C:\Windows\System\Osykzfl.exe
  2⤵
  PID:2988
- C:\Windows\System\VhClYqa.exe
  C:\Windows\System\VhClYqa.exe
  2⤵
  PID:2224
- C:\Windows\System\FjwNgSX.exe
  C:\Windows\System\FjwNgSX.exe
  2⤵
  PID:4444
- C:\Windows\System\BkQegjY.exe
  C:\Windows\System\BkQegjY.exe
  2⤵
  PID:5064
- C:\Windows\System\dwKhApu.exe
  C:\Windows\System\dwKhApu.exe
  2⤵
  PID:4548
- C:\Windows\System\GugAtxP.exe
  C:\Windows\System\GugAtxP.exe
  2⤵
  PID:2100
- C:\Windows\System\NQrfHdD.exe
  C:\Windows\System\NQrfHdD.exe
  2⤵
  PID:5316
- C:\Windows\System\tpQyons.exe
  C:\Windows\System\tpQyons.exe
  2⤵
  PID:4188
- C:\Windows\System\IhGsVhw.exe
  C:\Windows\System\IhGsVhw.exe
  2⤵
  PID:13364
- C:\Windows\System\ytNuQgj.exe
  C:\Windows\System\ytNuQgj.exe
  2⤵
  PID:13392
- C:\Windows\System\MGEhcyg.exe
  C:\Windows\System\MGEhcyg.exe
  2⤵
  PID:13528
- C:\Windows\System\MVxfpsm.exe
  C:\Windows\System\MVxfpsm.exe
  2⤵
  PID:13728
- C:\Windows\System\aOITYlR.exe
  C:\Windows\System\aOITYlR.exe
  2⤵
  PID:13772
- C:\Windows\System\EekDzWI.exe
  C:\Windows\System\EekDzWI.exe
  2⤵
  PID:13824
- C:\Windows\System\csmhvML.exe
  C:\Windows\System\csmhvML.exe
  2⤵
  PID:13872
- C:\Windows\System\GkrXdBa.exe
  C:\Windows\System\GkrXdBa.exe
  2⤵
  PID:13904
- C:\Windows\System\hcwtGRG.exe
  C:\Windows\System\hcwtGRG.exe
  2⤵
  PID:13948
- C:\Windows\System\xnYNPVG.exe
  C:\Windows\System\xnYNPVG.exe
  2⤵
  PID:13996
- C:\Windows\System\velypER.exe
  C:\Windows\System\velypER.exe
  2⤵
  PID:14032
- C:\Windows\System\ILWjEnZ.exe
  C:\Windows\System\ILWjEnZ.exe
  2⤵
  PID:14072
- C:\Windows\System\bXiiZXF.exe
  C:\Windows\System\bXiiZXF.exe
  2⤵
  PID:14108
- C:\Windows\System\PcGBcuO.exe
  C:\Windows\System\PcGBcuO.exe
  2⤵
  PID:14148
- C:\Windows\System\EhuXwDN.exe
  C:\Windows\System\EhuXwDN.exe
  2⤵
  PID:14184
- C:\Windows\System\vknXocP.exe
  C:\Windows\System\vknXocP.exe
  2⤵
  PID:14224
- C:\Windows\System\NZfGjQx.exe
  C:\Windows\System\NZfGjQx.exe
  2⤵
  PID:14260
- C:\Windows\System\bDuSLDg.exe
  C:\Windows\System\bDuSLDg.exe
  2⤵
  PID:14300
- C:\Windows\System\fWEncnS.exe
  C:\Windows\System\fWEncnS.exe
  2⤵
  PID:5456
- C:\Windows\System\lZOsxyM.exe
  C:\Windows\System\lZOsxyM.exe
  2⤵
  PID:13348
- C:\Windows\System\bYlJGIe.exe
  C:\Windows\System\bYlJGIe.exe
  2⤵
  PID:13416
- C:\Windows\System\KTcACHo.exe
  C:\Windows\System\KTcACHo.exe
  2⤵
  PID:13456
- C:\Windows\System\oigOOal.exe
  C:\Windows\System\oigOOal.exe
  2⤵
  PID:13448
- C:\Windows\System\wNWOPCD.exe
  C:\Windows\System\wNWOPCD.exe
  2⤵
  PID:13520
- C:\Windows\System\eiVrgqb.exe
  C:\Windows\System\eiVrgqb.exe
  2⤵
  PID:13584
- C:\Windows\System\gcQqerr.exe
  C:\Windows\System\gcQqerr.exe
  2⤵
  PID:13624
- C:\Windows\System\CebqGZu.exe
  C:\Windows\System\CebqGZu.exe
  2⤵
  PID:13696
- C:\Windows\System\LFdpBnJ.exe
  C:\Windows\System\LFdpBnJ.exe
  2⤵
  PID:5512
- C:\Windows\System\cBqqvuc.exe
  C:\Windows\System\cBqqvuc.exe
  2⤵
  PID:5716
- C:\Windows\System\PwiPNTK.exe
  C:\Windows\System\PwiPNTK.exe
  2⤵
  PID:5620
- C:\Windows\System\vwkirlG.exe
  C:\Windows\System\vwkirlG.exe
  2⤵
  PID:5828
- C:\Windows\System\SXhzCNw.exe
  C:\Windows\System\SXhzCNw.exe
  2⤵
  PID:13976
- C:\Windows\System\SmYMpdJ.exe
  C:\Windows\System\SmYMpdJ.exe
  2⤵
  PID:5808
- C:\Windows\System\EoDRSRG.exe
  C:\Windows\System\EoDRSRG.exe
  2⤵
  PID:14048
- C:\Windows\System\JSbtrwD.exe
  C:\Windows\System\JSbtrwD.exe
  2⤵
  PID:14092
- C:\Windows\System\aHZLbPs.exe
  C:\Windows\System\aHZLbPs.exe
  2⤵
  PID:3700
- C:\Windows\System\gpBxIbX.exe
  C:\Windows\System\gpBxIbX.exe
  2⤵
  PID:3480
- C:\Windows\System\HWnUZlZ.exe
  C:\Windows\System\HWnUZlZ.exe
  2⤵
  PID:14192
- C:\Windows\System\PJJYIVm.exe
  C:\Windows\System\PJJYIVm.exe
  2⤵
  PID:5504
- C:\Windows\System\uGIZIuI.exe
  C:\Windows\System\uGIZIuI.exe
  2⤵
  PID:14272
- C:\Windows\System\pyelYrR.exe
  C:\Windows\System\pyelYrR.exe
  2⤵
  PID:6156
- C:\Windows\System\xgACKba.exe
  C:\Windows\System\xgACKba.exe
  2⤵
  PID:5832
- C:\Windows\System\xPSapBu.exe
  C:\Windows\System\xPSapBu.exe
  2⤵
  PID:13344
- C:\Windows\System\NimCFuR.exe
  C:\Windows\System\NimCFuR.exe
  2⤵
  PID:13408
- C:\Windows\System\DkwKlos.exe
  C:\Windows\System\DkwKlos.exe
  2⤵
  PID:6496
- C:\Windows\System\QywwooW.exe
  C:\Windows\System\QywwooW.exe
  2⤵
  PID:6308
- C:\Windows\System\AYtZeLR.exe
  C:\Windows\System\AYtZeLR.exe
  2⤵
  PID:13480
- C:\Windows\System\nhjUyzX.exe
  C:\Windows\System\nhjUyzX.exe
  2⤵
  PID:6416
- C:\Windows\System\dcXpZzX.exe
  C:\Windows\System\dcXpZzX.exe
  2⤵
  PID:13580
- C:\Windows\System\wfYOQTz.exe
  C:\Windows\System\wfYOQTz.exe
  2⤵
  PID:6832
- C:\Windows\System\MaASajo.exe
  C:\Windows\System\MaASajo.exe
  2⤵
  PID:13564
- C:\Windows\System\zvIScLT.exe
  C:\Windows\System\zvIScLT.exe
  2⤵
  PID:13644
- C:\Windows\System\oeGbOxr.exe
  C:\Windows\System\oeGbOxr.exe
  2⤵
  PID:5500
- C:\Windows\System\RsLWkPg.exe
  C:\Windows\System\RsLWkPg.exe
  2⤵
  PID:13756
- C:\Windows\System\PSaKRJe.exe
  C:\Windows\System\PSaKRJe.exe
  2⤵
  PID:13784
- C:\Windows\System\ePpMpCu.exe
  C:\Windows\System\ePpMpCu.exe
  2⤵
  PID:6852
- C:\Windows\System\cKwUCIn.exe
  C:\Windows\System\cKwUCIn.exe
  2⤵
  PID:6996
- C:\Windows\System\DcuDBpW.exe
  C:\Windows\System\DcuDBpW.exe
  2⤵
  PID:13888
- C:\Windows\System\JKidtNQ.exe
  C:\Windows\System\JKidtNQ.exe
  2⤵
  PID:13896
- C:\Windows\System\YjXJwlG.exe
  C:\Windows\System\YjXJwlG.exe
  2⤵
  PID:6352
- C:\Windows\System\PMLTkIW.exe
  C:\Windows\System\PMLTkIW.exe
  2⤵
  PID:6952
- C:\Windows\System\CuvEicN.exe
  C:\Windows\System\CuvEicN.exe
  2⤵
  PID:808
- C:\Windows\System\HgEiymr.exe
  C:\Windows\System\HgEiymr.exe
  2⤵
  PID:6016
- C:\Windows\System\GkdYqIP.exe
  C:\Windows\System\GkdYqIP.exe
  2⤵
  PID:5404
- C:\Windows\System\OlfVCku.exe
  C:\Windows\System\OlfVCku.exe
  2⤵
  PID:6212
- C:\Windows\System\ZbbSRhS.exe
  C:\Windows\System\ZbbSRhS.exe
  2⤵
  PID:12184
- C:\Windows\System\dVOGNXs.exe
  C:\Windows\System\dVOGNXs.exe
  2⤵
  PID:7244
- C:\Windows\System\lnNZwex.exe
  C:\Windows\System\lnNZwex.exe
  2⤵
  PID:7724
- C:\Windows\System\VPayFJo.exe
  C:\Windows\System\VPayFJo.exe
  2⤵
  PID:5980
- C:\Windows\System\lEcuDCL.exe
  C:\Windows\System\lEcuDCL.exe
  2⤵
  PID:6116
- C:\Windows\System\ewUQPXT.exe
  C:\Windows\System\ewUQPXT.exe
  2⤵
  PID:13424
- C:\Windows\System\hMSvGfJ.exe
  C:\Windows\System\hMSvGfJ.exe
  2⤵
  PID:7804
- C:\Windows\System\YffPLqW.exe
  C:\Windows\System\YffPLqW.exe
  2⤵
  PID:7148
- C:\Windows\System\tvNQUJg.exe
  C:\Windows\System\tvNQUJg.exe
  2⤵
  PID:12800
- C:\Windows\System\ZyCgycf.exe
  C:\Windows\System\ZyCgycf.exe
  2⤵
  PID:7184
- C:\Windows\System\LIXoVZV.exe
  C:\Windows\System\LIXoVZV.exe
  2⤵
  PID:13616
- C:\Windows\System\ftPZvtC.exe
  C:\Windows\System\ftPZvtC.exe
  2⤵
  PID:8300
- C:\Windows\System\BOYTUfS.exe
  C:\Windows\System\BOYTUfS.exe
  2⤵
  PID:6468
- C:\Windows\System\aDxstQO.exe
  C:\Windows\System\aDxstQO.exe
  2⤵
  PID:6748
- C:\Windows\System\geTKIoC.exe
  C:\Windows\System\geTKIoC.exe
  2⤵
  PID:13672
- C:\Windows\System\fReVhrr.exe
  C:\Windows\System\fReVhrr.exe
  2⤵
  PID:13792
- C:\Windows\System\RpFOsdL.exe
  C:\Windows\System\RpFOsdL.exe
  2⤵
  PID:8172
- C:\Windows\System\mzVYcNS.exe
  C:\Windows\System\mzVYcNS.exe
  2⤵
  PID:8260
- C:\Windows\System\keEMrQj.exe
  C:\Windows\System\keEMrQj.exe
  2⤵
  PID:8928
- C:\Windows\System\KlIoVIs.exe
  C:\Windows\System\KlIoVIs.exe
  2⤵
  PID:8968
- C:\Windows\System\ZhdQpUM.exe
  C:\Windows\System\ZhdQpUM.exe
  2⤵
  PID:7048
- C:\Windows\System\sKSILNT.exe
  C:\Windows\System\sKSILNT.exe
  2⤵
  PID:9156
- C:\Windows\System\RqvKnpO.exe
  C:\Windows\System\RqvKnpO.exe
  2⤵
  PID:5836
- C:\Windows\System\AaManNK.exe
  C:\Windows\System\AaManNK.exe
  2⤵
  PID:14008
- C:\Windows\System\ztZZtAf.exe
  C:\Windows\System\ztZZtAf.exe
  2⤵
  PID:8896
- C:\Windows\System\tWWIvak.exe
  C:\Windows\System\tWWIvak.exe
  2⤵
  PID:7788
- C:\Windows\System\lSByQlG.exe
  C:\Windows\System\lSByQlG.exe
  2⤵
  PID:7092
- C:\Windows\System\pwQtZNC.exe
  C:\Windows\System\pwQtZNC.exe
  2⤵
  PID:14080
- C:\Windows\System\ZukLkVl.exe
  C:\Windows\System\ZukLkVl.exe
  2⤵
  PID:14132
- C:\Windows\System\DWhNEBX.exe
  C:\Windows\System\DWhNEBX.exe
  2⤵
  PID:5292
- C:\Windows\System\GzbbCHn.exe
  C:\Windows\System\GzbbCHn.exe
  2⤵
  PID:4872
- C:\Windows\System\owcNybP.exe
  C:\Windows\System\owcNybP.exe
  2⤵
  PID:6808
- C:\Windows\System\cqRVAEi.exe
  C:\Windows\System\cqRVAEi.exe
  2⤵
  PID:8204
- C:\Windows\System\orAutjG.exe
  C:\Windows\System\orAutjG.exe
  2⤵
  PID:8012
- C:\Windows\System\RVnUcTV.exe
  C:\Windows\System\RVnUcTV.exe
  2⤵
  PID:7596
- C:\Windows\System\VjGBjeO.exe
  C:\Windows\System\VjGBjeO.exe
  2⤵
  PID:9648
- C:\Windows\System\NwEepaS.exe
  C:\Windows\System\NwEepaS.exe
  2⤵
  PID:9244
- C:\Windows\System\sxrccHT.exe
  C:\Windows\System\sxrccHT.exe
  2⤵
  PID:8444
- C:\Windows\System\FGAoxoV.exe
  C:\Windows\System\FGAoxoV.exe
  2⤵
  PID:9372
- C:\Windows\System\RhwuvaL.exe
  C:\Windows\System\RhwuvaL.exe
  2⤵
  PID:9184
- C:\Windows\System\WEnkNNW.exe
  C:\Windows\System\WEnkNNW.exe
  2⤵
  PID:9484
- C:\Windows\System\bqoyEuZ.exe
  C:\Windows\System\bqoyEuZ.exe
  2⤵
  PID:10032
- C:\Windows\System\fNPYePi.exe
  C:\Windows\System\fNPYePi.exe
  2⤵
  PID:10128
- C:\Windows\System\naxXwWz.exe
  C:\Windows\System\naxXwWz.exe
  2⤵
  PID:8948
- C:\Windows\System\nOpiMAu.exe
  C:\Windows\System\nOpiMAu.exe
  2⤵
  PID:9132
- C:\Windows\System\PUBdtqY.exe
  C:\Windows\System\PUBdtqY.exe
  2⤵
  PID:6724
- C:\Windows\System\bQJrJZJ.exe
  C:\Windows\System\bQJrJZJ.exe
  2⤵
  PID:9720
- C:\Windows\System\ejOuvSG.exe
  C:\Windows\System\ejOuvSG.exe
  2⤵
  PID:8364
- C:\Windows\System\FAjrREK.exe
  C:\Windows\System\FAjrREK.exe
  2⤵
  PID:9552
- C:\Windows\System\kNXThNo.exe
  C:\Windows\System\kNXThNo.exe
  2⤵
  PID:7324
- C:\Windows\System\HxLScGF.exe
  C:\Windows\System\HxLScGF.exe
  2⤵
  PID:5524
- C:\Windows\System\BAzSYcN.exe
  C:\Windows\System\BAzSYcN.exe
  2⤵
  PID:8920
- C:\Windows\System\wyUIACd.exe
  C:\Windows\System\wyUIACd.exe
  2⤵
  PID:7516
- C:\Windows\System\WyfCOgt.exe
  C:\Windows\System\WyfCOgt.exe
  2⤵
  PID:7624
- C:\Windows\System\CEPySni.exe
  C:\Windows\System\CEPySni.exe
  2⤵
  PID:10740
- C:\Windows\System\jHNmolU.exe
  C:\Windows\System\jHNmolU.exe
  2⤵
  PID:9824
- C:\Windows\System\LOEiaoV.exe
  C:\Windows\System\LOEiaoV.exe
  2⤵
  PID:7400
- C:\Windows\System\UPVOQAT.exe
  C:\Windows\System\UPVOQAT.exe
  2⤵
  PID:8200
- C:\Windows\System\tvfvXbw.exe
  C:\Windows\System\tvfvXbw.exe
  2⤵
  PID:5428
- C:\Windows\System\AyioTdB.exe
  C:\Windows\System\AyioTdB.exe
  2⤵
  PID:11056
- C:\Windows\System\KKUFkNE.exe
  C:\Windows\System\KKUFkNE.exe
  2⤵
  PID:9136
- C:\Windows\System\UvPRKcu.exe
  C:\Windows\System\UvPRKcu.exe
  2⤵
  PID:11148
- C:\Windows\System\cFhdppW.exe
  C:\Windows\System\cFhdppW.exe
  2⤵
  PID:7628
- C:\Windows\System\kTPzjid.exe
  C:\Windows\System\kTPzjid.exe
  2⤵
  PID:9224
- C:\Windows\System\ogRjiPn.exe
  C:\Windows\System\ogRjiPn.exe
  2⤵
  PID:8132
- C:\Windows\System\OYZrmVH.exe
  C:\Windows\System\OYZrmVH.exe
  2⤵
  PID:14040
- C:\Windows\System\JWpxvjZ.exe
  C:\Windows\System\JWpxvjZ.exe
  2⤵
  PID:9008
- C:\Windows\System\EPFrUXy.exe
  C:\Windows\System\EPFrUXy.exe
  2⤵
  PID:9396
- C:\Windows\System\vVNygsi.exe
  C:\Windows\System\vVNygsi.exe
  2⤵
  PID:11224
- C:\Windows\System\xSWpTdd.exe
  C:\Windows\System\xSWpTdd.exe
  2⤵
  PID:7544
- C:\Windows\System\ZYnIkmf.exe
  C:\Windows\System\ZYnIkmf.exe
  2⤵
  PID:1036
- C:\Windows\System\wvysdHn.exe
  C:\Windows\System\wvysdHn.exe
  2⤵
  PID:9904
- C:\Windows\System\vktxNUb.exe
  C:\Windows\System\vktxNUb.exe
  2⤵
  PID:9572
- C:\Windows\System\fRYKeOt.exe
  C:\Windows\System\fRYKeOt.exe
  2⤵
  PID:7972
- C:\Windows\System\NqwbXqy.exe
  C:\Windows\System\NqwbXqy.exe
  2⤵
  PID:9528
- C:\Windows\System\vLxsQQD.exe
  C:\Windows\System\vLxsQQD.exe
  2⤵
  PID:7196
- C:\Windows\System\OcnZfCC.exe
  C:\Windows\System\OcnZfCC.exe
  2⤵
  PID:11516
- C:\Windows\System\bMvrjgU.exe
  C:\Windows\System\bMvrjgU.exe
  2⤵
  PID:8264
- C:\Windows\System\efclWND.exe
  C:\Windows\System\efclWND.exe
  2⤵
  PID:9708
- C:\Windows\System\fqlffSL.exe
  C:\Windows\System\fqlffSL.exe
  2⤵
  PID:5852
- C:\Windows\System\dwEZcWc.exe
  C:\Windows\System\dwEZcWc.exe
  2⤵
  PID:7828
- C:\Windows\System\wEmOuNu.exe
  C:\Windows\System\wEmOuNu.exe
  2⤵
  PID:11344
- C:\Windows\System\FQlLTZI.exe
  C:\Windows\System\FQlLTZI.exe
  2⤵
  PID:7464
- C:\Windows\System\ZRbIWGF.exe
  C:\Windows\System\ZRbIWGF.exe
  2⤵
  PID:11388
- C:\Windows\System\IbIvWUm.exe
  C:\Windows\System\IbIvWUm.exe
  2⤵
  PID:7860
- C:\Windows\System\yBiJUrG.exe
  C:\Windows\System\yBiJUrG.exe
  2⤵
  PID:11560
- C:\Windows\System\ZLpzNmD.exe
  C:\Windows\System\ZLpzNmD.exe
  2⤵
  PID:11948
- C:\Windows\System\oPvXfQV.exe
  C:\Windows\System\oPvXfQV.exe
  2⤵
  PID:11716
- C:\Windows\System\RICLQpQ.exe
  C:\Windows\System\RICLQpQ.exe
  2⤵
  PID:9620
- C:\Windows\System\IyVSzWh.exe
  C:\Windows\System\IyVSzWh.exe
  2⤵
  PID:11748
- C:\Windows\System\NpFVzPE.exe
  C:\Windows\System\NpFVzPE.exe
  2⤵
  PID:11756
- C:\Windows\System\qTzltGC.exe
  C:\Windows\System\qTzltGC.exe
  2⤵
  PID:12064
- C:\Windows\System\aEvUlsU.exe
  C:\Windows\System\aEvUlsU.exe
  2⤵
  PID:9672
- C:\Windows\System\RCpLKSl.exe
  C:\Windows\System\RCpLKSl.exe
  2⤵
  PID:11836
- C:\Windows\System\WOCspea.exe
  C:\Windows\System\WOCspea.exe
  2⤵
  PID:12144
- C:\Windows\System\dEokkMq.exe
  C:\Windows\System\dEokkMq.exe
  2⤵
  PID:7344
- C:\Windows\System\KOTTRqw.exe
  C:\Windows\System\KOTTRqw.exe
  2⤵
  PID:9712
- C:\Windows\System\vUJjFjB.exe
  C:\Windows\System\vUJjFjB.exe
  2⤵
  PID:10292
- C:\Windows\System\ChIYZuI.exe
  C:\Windows\System\ChIYZuI.exe
  2⤵
  PID:10324
- C:\Windows\System\ztrixzw.exe
  C:\Windows\System\ztrixzw.exe
  2⤵
  PID:6012
- C:\Windows\System\fNZMgFD.exe
  C:\Windows\System\fNZMgFD.exe
  2⤵
  PID:9392
- C:\Windows\System\TpgWncq.exe
  C:\Windows\System\TpgWncq.exe
  2⤵
  PID:9288
- C:\Windows\System\hONHxlo.exe
  C:\Windows\System\hONHxlo.exe
  2⤵
  PID:8084
- C:\Windows\System\eGUCfUv.exe
  C:\Windows\System\eGUCfUv.exe
  2⤵
  PID:6528
- C:\Windows\System\cDBEcWU.exe
  C:\Windows\System\cDBEcWU.exe
  2⤵
  PID:11016
- C:\Windows\System\dhfzBVU.exe
  C:\Windows\System\dhfzBVU.exe
  2⤵
  PID:9932
- C:\Windows\System\PLUlEAr.exe
  C:\Windows\System\PLUlEAr.exe
  2⤵
  PID:10860
- C:\Windows\System\nDktGTB.exe
  C:\Windows\System\nDktGTB.exe
  2⤵
  PID:7548
- C:\Windows\System\jmWIxyi.exe
  C:\Windows\System\jmWIxyi.exe
  2⤵
  PID:11268
- C:\Windows\System\VVlkxok.exe
  C:\Windows\System\VVlkxok.exe
  2⤵
  PID:11888
- C:\Windows\System\njhHexm.exe
  C:\Windows\System\njhHexm.exe
  2⤵
  PID:8228
- C:\Windows\System\tXgFRoP.exe
  C:\Windows\System\tXgFRoP.exe
  2⤵
  PID:10224
- C:\Windows\System\MypXRKv.exe
  C:\Windows\System\MypXRKv.exe
  2⤵
  PID:6344
- C:\Windows\System\VQGdOrP.exe
  C:\Windows\System\VQGdOrP.exe
  2⤵
  PID:11428
- C:\Windows\System\WMicGhw.exe
  C:\Windows\System\WMicGhw.exe
  2⤵
  PID:10360
- C:\Windows\System\XqpGkNC.exe
  C:\Windows\System\XqpGkNC.exe
  2⤵
  PID:11332
- C:\Windows\System\bkbyySe.exe
  C:\Windows\System\bkbyySe.exe
  2⤵
  PID:8784
- C:\Windows\System\EzmQvLQ.exe
  C:\Windows\System\EzmQvLQ.exe
  2⤵
  PID:11976
- C:\Windows\System\TollEcJ.exe
  C:\Windows\System\TollEcJ.exe
  2⤵
  PID:13716
- C:\Windows\System\ceaiBmq.exe
  C:\Windows\System\ceaiBmq.exe
  2⤵
  PID:3208
- C:\Windows\System\BqaTQHZ.exe
  C:\Windows\System\BqaTQHZ.exe
  2⤵
  PID:11340
- C:\Windows\System\EGFXEgy.exe
  C:\Windows\System\EGFXEgy.exe
  2⤵
  PID:10948
- C:\Windows\System\EQzwFBz.exe
  C:\Windows\System\EQzwFBz.exe
  2⤵
  PID:12896
- C:\Windows\System\JxyWQHj.exe
  C:\Windows\System\JxyWQHj.exe
  2⤵
  PID:8940
- C:\Windows\System\SJauYrK.exe
  C:\Windows\System\SJauYrK.exe
  2⤵
  PID:5644
- C:\Windows\System\fcMGdKf.exe
  C:\Windows\System\fcMGdKf.exe
  2⤵
  PID:12568
- C:\Windows\System\eebKOzU.exe
  C:\Windows\System\eebKOzU.exe
  2⤵
  PID:9040
- C:\Windows\System\HNKsFbA.exe
  C:\Windows\System\HNKsFbA.exe
  2⤵
  PID:11088
- C:\Windows\System\lPOHUdN.exe
  C:\Windows\System\lPOHUdN.exe
  2⤵
  PID:7112
- C:\Windows\System\jGtcaEN.exe
  C:\Windows\System\jGtcaEN.exe
  2⤵
  PID:13224
- C:\Windows\System\bfHhqoC.exe
  C:\Windows\System\bfHhqoC.exe
  2⤵
  PID:8720
- C:\Windows\System\wTJrMqQ.exe
  C:\Windows\System\wTJrMqQ.exe
  2⤵
  PID:9832
- C:\Windows\System\FqziIYQ.exe
  C:\Windows\System\FqziIYQ.exe
  2⤵
  PID:9900
- C:\Windows\System\XumBLCE.exe
  C:\Windows\System\XumBLCE.exe
  2⤵
  PID:8824
- C:\Windows\System\gEQRkjg.exe
  C:\Windows\System\gEQRkjg.exe
  2⤵
  PID:9324
- C:\Windows\System\zlhLOnl.exe
  C:\Windows\System\zlhLOnl.exe
  2⤵
  PID:13268
- C:\Windows\System\zvBtWrX.exe
  C:\Windows\System\zvBtWrX.exe
  2⤵
  PID:13288
- C:\Windows\System\uPwmUmJ.exe
  C:\Windows\System\uPwmUmJ.exe
  2⤵
  PID:7640
- C:\Windows\System\YCBqpPQ.exe
  C:\Windows\System\YCBqpPQ.exe
  2⤵
  PID:10112
- C:\Windows\System\HgglCyz.exe
  C:\Windows\System\HgglCyz.exe
  2⤵
  PID:10636
- C:\Windows\System\EJXzHbJ.exe
  C:\Windows\System\EJXzHbJ.exe
  2⤵
  PID:12580
- C:\Windows\System\VKlVtZz.exe
  C:\Windows\System\VKlVtZz.exe
  2⤵
  PID:12908
- C:\Windows\System\IgyFGbw.exe
  C:\Windows\System\IgyFGbw.exe
  2⤵
  PID:9784
- C:\Windows\System\NVeXCIQ.exe
  C:\Windows\System\NVeXCIQ.exe
  2⤵
  PID:13228
- C:\Windows\System\jtyqEzJ.exe
  C:\Windows\System\jtyqEzJ.exe
  2⤵
  PID:9188
- C:\Windows\System\vNYVJzc.exe
  C:\Windows\System\vNYVJzc.exe
  2⤵
  PID:4352
- C:\Windows\System\BYiFeeB.exe
  C:\Windows\System\BYiFeeB.exe
  2⤵
  PID:12528
- C:\Windows\System\xkDMpSu.exe
  C:\Windows\System\xkDMpSu.exe
  2⤵
  PID:13000
- C:\Windows\System\yZjkdZI.exe
  C:\Windows\System\yZjkdZI.exe
  2⤵
  PID:11468
- C:\Windows\System\LJZBtej.exe
  C:\Windows\System\LJZBtej.exe
  2⤵
  PID:9540
- C:\Windows\System\aQYlNFg.exe
  C:\Windows\System\aQYlNFg.exe
  2⤵
  PID:11476
- C:\Windows\System\KKVDfWp.exe
  C:\Windows\System\KKVDfWp.exe
  2⤵
  PID:12892
- C:\Windows\System\oEJzEma.exe
  C:\Windows\System\oEJzEma.exe
  2⤵
  PID:12044
- C:\Windows\System\vqCSkjW.exe
  C:\Windows\System\vqCSkjW.exe
  2⤵
  PID:7716
- C:\Windows\System\vVwnSBH.exe
  C:\Windows\System\vVwnSBH.exe
  2⤵
  PID:13192
- C:\Windows\System\vVnJAxl.exe
  C:\Windows\System\vVnJAxl.exe
  2⤵
  PID:12788
- C:\Windows\System\MxbuEtm.exe
  C:\Windows\System\MxbuEtm.exe
  2⤵
  PID:13180
- C:\Windows\System\hYAvMGQ.exe
  C:\Windows\System\hYAvMGQ.exe
  2⤵
  PID:11032
- C:\Windows\System\VRjZpLr.exe
  C:\Windows\System\VRjZpLr.exe
  2⤵
  PID:11364
- C:\Windows\System\TKKyhpj.exe
  C:\Windows\System\TKKyhpj.exe
  2⤵
  PID:11372
- C:\Windows\System\yzbMHsz.exe
  C:\Windows\System\yzbMHsz.exe
  2⤵
  PID:11636
- C:\Windows\System\agssURW.exe
  C:\Windows\System\agssURW.exe
  2⤵
  PID:11436
- C:\Windows\System\FXUDilE.exe
  C:\Windows\System\FXUDilE.exe
  2⤵
  PID:9520
- C:\Windows\System\gfmfBhC.exe
  C:\Windows\System\gfmfBhC.exe
  2⤵
  PID:9996
- C:\Windows\System\JVUmAlW.exe
  C:\Windows\System\JVUmAlW.exe
  2⤵
  PID:11780
- C:\Windows\System\soEQoGB.exe
  C:\Windows\System\soEQoGB.exe
  2⤵
  PID:11656
- C:\Windows\System\IGQrqrH.exe
  C:\Windows\System\IGQrqrH.exe
  2⤵
  PID:13436
- C:\Windows\System\uwEdbTI.exe
  C:\Windows\System\uwEdbTI.exe
  2⤵
  PID:11968
- C:\Windows\System\hmyvXiu.exe
  C:\Windows\System\hmyvXiu.exe
  2⤵
  PID:12068
- C:\Windows\System\EwThcpr.exe
  C:\Windows\System\EwThcpr.exe
  2⤵
  PID:8560
- C:\Windows\System\imXVCRO.exe
  C:\Windows\System\imXVCRO.exe
  2⤵
  PID:12128
- C:\Windows\System\fZwcWVz.exe
  C:\Windows\System\fZwcWVz.exe
  2⤵
  PID:11860
- C:\Windows\System\atRXpdR.exe
  C:\Windows\System\atRXpdR.exe
  2⤵
  PID:9640
- C:\Windows\System\QobtFqu.exe
  C:\Windows\System\QobtFqu.exe
  2⤵
  PID:11908
- C:\Windows\System\HylENmm.exe
  C:\Windows\System\HylENmm.exe
  2⤵
  PID:6476
- C:\Windows\System\OdhqQCY.exe
  C:\Windows\System\OdhqQCY.exe
  2⤵
  PID:8036
- C:\Windows\System\xeamKmR.exe
  C:\Windows\System\xeamKmR.exe
  2⤵
  PID:12076
- C:\Windows\System\TiXQhUt.exe
  C:\Windows\System\TiXQhUt.exe
  2⤵
  PID:10556
- C:\Windows\System\elQGLok.exe
  C:\Windows\System\elQGLok.exe
  2⤵
  PID:8288
- C:\Windows\System\QrUWOsy.exe
  C:\Windows\System\QrUWOsy.exe
  2⤵
  PID:9976
- C:\Windows\System\WOLJbQF.exe
  C:\Windows\System\WOLJbQF.exe
  2⤵
  PID:11440
- C:\Windows\System\nCtJsxt.exe
  C:\Windows\System\nCtJsxt.exe
  2⤵
  PID:11688
- C:\Windows\System\XNNxqQY.exe
  C:\Windows\System\XNNxqQY.exe
  2⤵
  PID:8488
- C:\Windows\System\UqxuPCA.exe
  C:\Windows\System\UqxuPCA.exe
  2⤵
  PID:6776
- C:\Windows\System\KzHvdyC.exe
  C:\Windows\System\KzHvdyC.exe
  2⤵
  PID:9084
- C:\Windows\System\furMDCg.exe
  C:\Windows\System\furMDCg.exe
  2⤵
  PID:10552
- C:\Windows\System\VYdnoDv.exe
  C:\Windows\System\VYdnoDv.exe
  2⤵
  PID:13692
- C:\Windows\System\qPHJDis.exe
  C:\Windows\System\qPHJDis.exe
  2⤵
  PID:8504
- C:\Windows\System\FtoEeLL.exe
  C:\Windows\System\FtoEeLL.exe
  2⤵
  PID:10136
- C:\Windows\System\sStWVUR.exe
  C:\Windows\System\sStWVUR.exe
  2⤵
  PID:12380
- C:\Windows\System\cmiDiDF.exe
  C:\Windows\System\cmiDiDF.exe
  2⤵
  PID:13020
- C:\Windows\System\RawXmkZ.exe
  C:\Windows\System\RawXmkZ.exe
  2⤵
  PID:10988
- C:\Windows\System\VXGRJvA.exe
  C:\Windows\System\VXGRJvA.exe
  2⤵
  PID:13300
- C:\Windows\System\wZSKfVy.exe
  C:\Windows\System\wZSKfVy.exe
  2⤵
  PID:12376
- C:\Windows\System\nhVyWFN.exe
  C:\Windows\System\nhVyWFN.exe
  2⤵
  PID:13176
- C:\Windows\System\zGytfXx.exe
  C:\Windows\System\zGytfXx.exe
  2⤵
  PID:5184
- C:\Windows\System\raSrahJ.exe
  C:\Windows\System\raSrahJ.exe
  2⤵
  PID:9536
- C:\Windows\System\HLKXvrI.exe
  C:\Windows\System\HLKXvrI.exe
  2⤵
  PID:12292
- C:\Windows\System\sfrnfaE.exe
  C:\Windows\System\sfrnfaE.exe
  2⤵
  PID:14256
- C:\Windows\System\rAqZUvw.exe
  C:\Windows\System\rAqZUvw.exe
  2⤵
  PID:13700
- C:\Windows\System\hMYHwxo.exe
  C:\Windows\System\hMYHwxo.exe
  2⤵
  PID:10912
- C:\Windows\System\cekBYXJ.exe
  C:\Windows\System\cekBYXJ.exe
  2⤵
  PID:11532
- C:\Windows\System\OQYavjU.exe
  C:\Windows\System\OQYavjU.exe
  2⤵
  PID:6080
- C:\Windows\System\zxAuvhx.exe
  C:\Windows\System\zxAuvhx.exe
  2⤵
  PID:14308
- C:\Windows\System\qCYeOtn.exe
  C:\Windows\System\qCYeOtn.exe
  2⤵
  PID:9380
- C:\Windows\System\KKxNKQL.exe
  C:\Windows\System\KKxNKQL.exe
  2⤵
  PID:11424
- C:\Windows\System\iQaWcLg.exe
  C:\Windows\System\iQaWcLg.exe
  2⤵
  PID:11768
- C:\Windows\System\mavGAaG.exe
  C:\Windows\System\mavGAaG.exe
  2⤵
  PID:11720
- C:\Windows\System\zgHyFYI.exe
  C:\Windows\System\zgHyFYI.exe
  2⤵
  PID:11944
- C:\Windows\System\rVIcUmq.exe
  C:\Windows\System\rVIcUmq.exe
  2⤵
  PID:1792
- C:\Windows\System\SCVWdbg.exe
  C:\Windows\System\SCVWdbg.exe
  2⤵
  PID:9560
- C:\Windows\System\IExJLrB.exe
  C:\Windows\System\IExJLrB.exe
  2⤵
  PID:2072
- C:\Windows\System\pizVnvV.exe
  C:\Windows\System\pizVnvV.exe
  2⤵
  PID:3576
- C:\Windows\System\JTMnqoY.exe
  C:\Windows\System\JTMnqoY.exe
  2⤵
  PID:11844
- C:\Windows\System\jwYDrRE.exe
  C:\Windows\System\jwYDrRE.exe
  2⤵
  PID:4912
- C:\Windows\System\ezOaaIn.exe
  C:\Windows\System\ezOaaIn.exe
  2⤵
  PID:12196
- C:\Windows\System\GykavGy.exe
  C:\Windows\System\GykavGy.exe
  2⤵
  PID:9696
- C:\Windows\System\XNASMiV.exe
  C:\Windows\System\XNASMiV.exe
  2⤵
  PID:7988
- C:\Windows\System\LkyrNeg.exe
  C:\Windows\System\LkyrNeg.exe
  2⤵
  PID:1860
- C:\Windows\System\ojdmgRs.exe
  C:\Windows\System\ojdmgRs.exe
  2⤵
  PID:13688
- C:\Windows\System\ujxNufD.exe
  C:\Windows\System\ujxNufD.exe
  2⤵
  PID:4068
- C:\Windows\System\fTOfeyF.exe
  C:\Windows\System\fTOfeyF.exe
  2⤵
  PID:64
- C:\Windows\System\uTUHsaQ.exe
  C:\Windows\System\uTUHsaQ.exe
  2⤵
  PID:464
- C:\Windows\System\olAPbKA.exe
  C:\Windows\System\olAPbKA.exe
  2⤵
  PID:7984
- C:\Windows\System\xWnUIWv.exe
  C:\Windows\System\xWnUIWv.exe
  2⤵
  PID:12700
- C:\Windows\System\BEDbtlf.exe
  C:\Windows\System\BEDbtlf.exe
  2⤵
  PID:13152
- C:\Windows\System\qCTQgIF.exe
  C:\Windows\System\qCTQgIF.exe
  2⤵
  PID:12972
- C:\Windows\System\BYKxvxK.exe
  C:\Windows\System\BYKxvxK.exe
  2⤵
  PID:12628
- C:\Windows\System\Tlfdfbh.exe
  C:\Windows\System\Tlfdfbh.exe
  2⤵
  PID:12424
- C:\Windows\System\HgbngLS.exe
  C:\Windows\System\HgbngLS.exe
  2⤵
  PID:9296
- C:\Windows\System\sdjbiaJ.exe
  C:\Windows\System\sdjbiaJ.exe
  2⤵
  PID:13076
- C:\Windows\System\klOiPAy.exe
  C:\Windows\System\klOiPAy.exe
  2⤵
  PID:11460
- C:\Windows\System\YQGVXji.exe
  C:\Windows\System\YQGVXji.exe
  2⤵
  PID:13144
- C:\Windows\System\qKoPZbU.exe
  C:\Windows\System\qKoPZbU.exe
  2⤵
  PID:11248
- C:\Windows\System\rKmLMlm.exe
  C:\Windows\System\rKmLMlm.exe
  2⤵
  PID:968
- C:\Windows\System\LiAfEdP.exe
  C:\Windows\System\LiAfEdP.exe
  2⤵
  PID:11524
- C:\Windows\System\ecUeruW.exe
  C:\Windows\System\ecUeruW.exe
  2⤵
  PID:2776
- C:\Windows\System\SARhRYp.exe
  C:\Windows\System\SARhRYp.exe
  2⤵
  PID:4800
- C:\Windows\System\PAHRCKy.exe
  C:\Windows\System\PAHRCKy.exe
  2⤵
  PID:11852
- C:\Windows\System\NxBPHkn.exe
  C:\Windows\System\NxBPHkn.exe
  2⤵
  PID:1912
- C:\Windows\System\ALvPCHE.exe
  C:\Windows\System\ALvPCHE.exe
  2⤵
  PID:7864
- C:\Windows\System\YsFYqKD.exe
  C:\Windows\System\YsFYqKD.exe
  2⤵
  PID:10488
- C:\Windows\System\VUFNcrJ.exe
  C:\Windows\System\VUFNcrJ.exe
  2⤵
  PID:8900
- C:\Windows\System\BtwbvUx.exe
  C:\Windows\System\BtwbvUx.exe
  2⤵
  PID:7936
- C:\Windows\System\BfMApzn.exe
  C:\Windows\System\BfMApzn.exe
  2⤵
  PID:1336
- C:\Windows\System\hXPglnT.exe
  C:\Windows\System\hXPglnT.exe
  2⤵
  PID:12956
- C:\Windows\System\sdheBVp.exe
  C:\Windows\System\sdheBVp.exe
  2⤵
  PID:7848
- C:\Windows\System\lLwEhud.exe
  C:\Windows\System\lLwEhud.exe
  2⤵
  PID:11472
- C:\Windows\System\EmjFKwA.exe
  C:\Windows\System\EmjFKwA.exe
  2⤵
  PID:11520
- C:\Windows\System\yllGrdV.exe
  C:\Windows\System\yllGrdV.exe
  2⤵
  PID:9488
- C:\Windows\System\Alftggk.exe
  C:\Windows\System\Alftggk.exe
  2⤵
  PID:4248
- C:\Windows\System\YlRwJHZ.exe
  C:\Windows\System\YlRwJHZ.exe
  2⤵
  PID:2716
- C:\Windows\System\RTYfjQc.exe
  C:\Windows\System\RTYfjQc.exe
  2⤵
  PID:12388
- C:\Windows\System\fKstlqc.exe
  C:\Windows\System\fKstlqc.exe
  2⤵
  PID:11084
- C:\Windows\System\qmmuEIt.exe
  C:\Windows\System\qmmuEIt.exe
  2⤵
  PID:12468
- C:\Windows\System\NwRFsYL.exe
  C:\Windows\System\NwRFsYL.exe
  2⤵
  PID:9548
- C:\Windows\System\DxhCDIV.exe
  C:\Windows\System\DxhCDIV.exe
  2⤵
  PID:3412
- C:\Windows\System\JysJfzO.exe
  C:\Windows\System\JysJfzO.exe
  2⤵
  PID:3608
- C:\Windows\System\JZmjhJY.exe
  C:\Windows\System\JZmjhJY.exe
  2⤵
  PID:1920
- C:\Windows\System\fZRTYSd.exe
  C:\Windows\System\fZRTYSd.exe
  2⤵
  PID:4564
- C:\Windows\System\BePldsd.exe
  C:\Windows\System\BePldsd.exe
  2⤵
  PID:12856
- C:\Windows\System\aulYTIG.exe
  C:\Windows\System\aulYTIG.exe
  2⤵
  PID:11880
- C:\Windows\System\ISnSYDM.exe
  C:\Windows\System\ISnSYDM.exe
  2⤵
  PID:10380
- C:\Windows\System\Stmuqnw.exe
  C:\Windows\System\Stmuqnw.exe
  2⤵
  PID:1236
- C:\Windows\System\dWRIJjn.exe
  C:\Windows\System\dWRIJjn.exe
  2⤵
  PID:13612
- C:\Windows\System\LUeCOig.exe
  C:\Windows\System\LUeCOig.exe
  2⤵
  PID:10616
- C:\Windows\System\dcWWVXQ.exe
  C:\Windows\System\dcWWVXQ.exe
  2⤵
  PID:2608
- C:\Windows\System\vKtzmRX.exe
  C:\Windows\System\vKtzmRX.exe
  2⤵
  PID:5272
- C:\Windows\System\soYInkX.exe
  C:\Windows\System\soYInkX.exe
  2⤵
  PID:14596
- C:\Windows\System\ZQvhZOt.exe
  C:\Windows\System\ZQvhZOt.exe
  2⤵
  PID:14696
- C:\Windows\System\mHlCphu.exe
  C:\Windows\System\mHlCphu.exe
  2⤵
  PID:14980
- C:\Windows\System\AwECxBX.exe
  C:\Windows\System\AwECxBX.exe
  2⤵
  PID:15112
- C:\Windows\System\mPxpJob.exe
  C:\Windows\System\mPxpJob.exe
  2⤵
  PID:13812
- C:\Windows\System\JJjhjtA.exe
  C:\Windows\System\JJjhjtA.exe
  2⤵
  PID:15248
- C:\Windows\System\EzjBziC.exe
  C:\Windows\System\EzjBziC.exe
  2⤵
  PID:15292
- C:\Windows\System\PhxKHUc.exe
  C:\Windows\System\PhxKHUc.exe
  2⤵
  PID:14420
- C:\Windows\System\hJYIjKE.exe
  C:\Windows\System\hJYIjKE.exe
  2⤵
  PID:14560
- C:\Windows\System\LNxJFXG.exe
  C:\Windows\System\LNxJFXG.exe
  2⤵
  PID:14868
- C:\Windows\System\EBJmtlb.exe
  C:\Windows\System\EBJmtlb.exe
  2⤵
  PID:14948
- C:\Windows\System\ezynNqF.exe
  C:\Windows\System\ezynNqF.exe
  2⤵
  PID:14968
- C:\Windows\System\ZDbADAz.exe
  C:\Windows\System\ZDbADAz.exe
  2⤵
  PID:14992
- C:\Windows\System\QMMRAjO.exe
  C:\Windows\System\QMMRAjO.exe
  2⤵
  PID:15044
- C:\Windows\System\WxaDZyd.exe
  C:\Windows\System\WxaDZyd.exe
  2⤵
  PID:15068
- C:\Windows\System\OySIiCq.exe
  C:\Windows\System\OySIiCq.exe
  2⤵
  PID:15064
- C:\Windows\System\uQavAgr.exe
  C:\Windows\System\uQavAgr.exe
  2⤵
  PID:14248
- C:\Windows\System\eXLwCtE.exe
  C:\Windows\System\eXLwCtE.exe
  2⤵
  PID:15144
- C:\Windows\System\jEzcqZu.exe
  C:\Windows\System\jEzcqZu.exe
  2⤵
  PID:15216
- C:\Windows\System\DStQirZ.exe
  C:\Windows\System\DStQirZ.exe
  2⤵
  PID:7644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n2bzea41.5gy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ADWIEHM.exe

Filesize
2.8MB

MD5
111228b1a06992c59ebe334468f3fc06

SHA1
12e8e0608b980788c7f34ea6836c3e353edbd822

SHA256
4d30f1107a772d705332c6ec0458f36174ddbdfd1762b64f11eede4cc1ed212f

SHA512
4e953f4f1ff5c34962c39d92409231d0a8fe4bf1c98fed112c0e55c02748379156f99da95a8fe8b7abf3f2fbf6f89009559717de3b29719be371346e8e2cf79b

Download Submit
C:\Windows\System\DLlNzpy.exe

Filesize
2.8MB

MD5
de0c152e9332886513b0075edf8a2d0a

SHA1
19486463d72e4ea864b3e0490e9773be88c8249a

SHA256
b6269db5684ef382eea2da2487a35859d4d259ba9d60f8150d484345d2409d20

SHA512
99961f7fa0f9e926dc965e0a23947e399e67f87c9a9c689afbdc9012fdc3045d4f14879710bff59e73f5af7a731d6dcee54fe5bf49d77068e3ee46912ff04762

Download Submit
C:\Windows\System\ELOjAYy.exe

Filesize
2.8MB

MD5
11a1847f9664784acd08423e47c15eb1

SHA1
5edac8f6286cfaaf7f323052f767bb8f7260d7d7

SHA256
8134d43f9c92c4444b9a9a61d19f15023cdc6527e1ffea278b8e6eeb62a1eb61

SHA512
e4007d6f53b21968385c5421c92170a135ec42fa35503e6acc9808909395a7750785ec43575c33e668871894572c369756b700e0293fc933233f1331ba65675c

Download Submit
C:\Windows\System\FVgombD.exe

Filesize
2.8MB

MD5
7da595180df1bca5c8578a1d6eb96355

SHA1
641d6ea694817a6e86a34325fef75e35f3ea34fa

SHA256
8df30f880e0461563d78b403778dee75c551820613eab8f8d50b01a3863db7a6

SHA512
a1a6fc7c5ebc164ff4c6c9799a1182bb25f7f94ae6a40a38e4b73e0f34dc7a0d92d169544e5ed07e665c284d44e8d401100dfdc3261dc6cc251c4b257bb84ca1

Download Submit
C:\Windows\System\HeeKIdM.exe

Filesize
2.8MB

MD5
1bde0f650689b23abb54fbcb9f023855

SHA1
9a256edf87538a57c93267596d3b119f64799388

SHA256
eeae0374d9689b39ac20dd412b57ab60af40bdfa5871079d045f7502f87e1d62

SHA512
a82f4f57b05e21cd4d0599fbd4339d78d4a69c349ae579978ac22b546df28b03ba737e549e40360c57761b494cc4beece3078f38b393a473f8505149e2e7f6ca

Download Submit
C:\Windows\System\JRZXygO.exe

Filesize
2.8MB

MD5
4cbddbbb297a8f858a448e15e916e9df

SHA1
a745b980a4f5486a2d8c20969520666bf353ea9e

SHA256
a4cb77ef79701ef956a4c9a4dc0e0622f58d6d971d618fb49bc6cf173fdad2dc

SHA512
ed08fe4420d251236fd2400d6207af4288e6ff1f6090398a0a398bb0db0d3eec05708b0bbb20028f6ced734830e5bb6ddc9cf1f9a2a550c09e458b0cfca4d17a

Download Submit
C:\Windows\System\KzuzxwT.exe

Filesize
2.8MB

MD5
7156fb4c865caf5042145366547ace23

SHA1
9b2d5df2df1667d50e82be2c28edbba712e4a9bd

SHA256
40887b129a21cf86d0bccaa3b4b472f58310381e3bd289b0bb8254959be1ac55

SHA512
87a6f05cb6c0613c32ad0ed548355393337c752240b4e82ebe82321557948107de41d03d0e30395fced3a20fdf3f4f440d925392ba2a9711016269429bb32f4e

Download Submit
C:\Windows\System\NDLGmQD.exe

Filesize
2.8MB

MD5
2c82656ce1402a5fdc837ea96fed7b7b

SHA1
bb1a1b22da05ae534cedbf24a8b5658949dd566d

SHA256
f34ab17e45f1579ba4b963d673c06ea8d84943649efdec1ea087b79aa9986e7c

SHA512
b6c96547c965942e8a6dc97bc9066fd8c751d74f8120fe140914ece6257f7be6f0a516880b9daa4fab31c54282dc7f67e43571f01a35af40ee4417c71cc6cb70

Download Submit
C:\Windows\System\NWznoVB.exe

Filesize
2.8MB

MD5
40f6ff83037e2523ec786e0f6503d31d

SHA1
51153820a8663b7645317c9ec0915f56df836243

SHA256
6fc43cb681c3fb68acd9697ce670c3853635b461b13d5ee841225625db710500

SHA512
ebf632f376401db02df91e40663ac9bf2c75effb0e89ef6073409f5155eea5205f927246472b08c2ec0df57fb65b4f1d72ccf14b8e79cde59c1168bd6cce5b91

Download Submit
C:\Windows\System\OwEBISu.exe

Filesize
2.8MB

MD5
1599a1d41837119394d8b933305f7598

SHA1
b8791072e3a8804783ec90a0bec792db5610373c

SHA256
c4a33ee22b6c6daa19b9bbda6a17ab9295b94315df22273f338b3b5f761d4cbb

SHA512
7920ca11d31224f02500f0df57b5c5b6a4d877a6d4a7249a63af54eff532b57b03c3f3db42fe94bd9d00a1bfaeb08b1a6dcd032e5b9aae8987cac742320b05bd

Download Submit
C:\Windows\System\PeBFFDS.exe

Filesize
2.8MB

MD5
93fcafd84c2c6c36ba1f1298d273c55e

SHA1
4b25e43ff9ea8ba250012d56da51bc0401b1e158

SHA256
900c3241b14659fb388977f489fc33ba3e06a65967f3ec65a399922341e79a30

SHA512
23337a274999f19cbda142f4e02bcb201215b7f81c000cc64b8197d7c13c57ea86a6cd77ee862b46596a8e4da0f6c4ca356b56d4160eecd2c2ade66bd48e09e4

Download Submit
C:\Windows\System\TXAsszq.exe

Filesize
2.8MB

MD5
8639d43be51156c8c7e0d44367c5113e

SHA1
ac35033e045a85c9e5ce6f798daee54f3d865aeb

SHA256
f2658d5dc8106f6219936624ce3564496feb5dc595fddcf9adbda4f70ffb354c

SHA512
37a57338412c622b35eab79a0422d71f554d16fc8ec64749fe5ffd04a1464254746b9aab4d441b1b777a3234c419de2d9a28a43be4f1bd9044498aa1ad4376c6

Download Submit
C:\Windows\System\TtNpLcZ.exe

Filesize
2.8MB

MD5
8194d7ccc1997f90d701ce2531414aa2

SHA1
5fe06a6fc06065b224f6722ba1da42e435c222b5

SHA256
a2c7b999c6230218aa5b4653a08454695a3e104b9dda674d8b3e93c727c8cc4e

SHA512
1002f06b7ceeca2e381eefd9b10da6e0ae0db7f9900ebec2a4ff4ad99d697f6c50fd7f77b7cdcbeea33ab69f19314e261549388432c99a431a303c21d7a52968

Download Submit
C:\Windows\System\UUcytbF.exe

Filesize
2.8MB

MD5
755f39cda38f1117a2448c7161467245

SHA1
bf94bad06fe2cd14e0b82cee182f0a78fc066bfb

SHA256
ea134d987bd974532465b8c9019533007526ebf267dd7dd80a43c1aea31d42da

SHA512
5702054a9c98f7fefc800270584d8a618a20e0907b64f9e32937d42f1612ba7edb19a346ee4c3f6204db63910a417240320289236064a07d334abb45974d5e59

Download Submit
C:\Windows\System\UUxHJhU.exe

Filesize
2.8MB

MD5
cd2d9ba7ce8408f2528f9308363ad4e1

SHA1
06470879e3dc55957ecb1272566484db0f7d49cc

SHA256
2525f759b4dd2db5a772b918862811b48b6b146688cbe2bae627e65b5c9bb8d7

SHA512
b5c3d7ec0c991e37bf23b60d9ee89c123c59b81b7b93edbfe6a3ab00428de79cf9926a136c9874d2a97ad47abad9e2cd818a6c0168c97647526c41d332cc778a

Download Submit
C:\Windows\System\XUHNprs.exe

Filesize
2.8MB

MD5
ebcccfd7fbe24a45a2c7036bae52137e

SHA1
fda7e0dd6f2bfacf1a915da0e4762a96ff4cdd04

SHA256
738b1b7d775e7cda5e5429a98519ef0c196817b1c7c125c3c4d1987e249c2f24

SHA512
4c9ea34052b4905a01b52cb59dea88dc0ecace2004001296fd6915ad9dfa1b5ee13041fa65c666183bf2b0fbfa5360415954201d2f81b2677a2334fdf7cfe851

Download Submit
C:\Windows\System\YgCyQxh.exe

Filesize
2.8MB

MD5
d18ebbd626d857ad041616a934d655ea

SHA1
1cbd687fa3903ea1eec27559affad0aa90766e66

SHA256
61be6e147ea4869d73dbbd401d107c31e5ddaa8f239152a6357474fd24b23d1b

SHA512
a93596f1b5f7314a6cf80c1c1c5b9e8ed367c174b66c11bdaffff4401849bcc2ed4151fde68e32d7033d13be80d29c8c07e070cb81179ab731b59c20fb1a7dd7

Download Submit
C:\Windows\System\aIjUOdU.exe

Filesize
2.8MB

MD5
1e775026214a68d1538d3875b566e53c

SHA1
5f5c07d774402d2c1b3b6a0120eee18223bba002

SHA256
bd6595aff50e5e30bab40ab0dd9491b481db4f6a0b546c7eec270f09b2862f0a

SHA512
7d1242506de3011b2e843af98512f15e6d79081dd3fc22ed80bad0e25c426f070312fff55c20140354be5a813f045e8e27e60dba5cc1291b344c7036abff6720

Download Submit
C:\Windows\System\btnbcXO.exe

Filesize
8B

MD5
2f610ed4fd34c7b93dede1793521baba

SHA1
5daae5f3b2625b6a326bfb1be39046cb371fc4a6

SHA256
d587df361f44238ccf5a60428309780a9b6bde224606e4679c94364299985684

SHA512
367244af67370594aa8df8799be42b55afcd8abd950bf66980b9cb155b499d06ebcadc359f153586f1736d1a5dd7bea12b69a39d93e67441419399282c1888bb

Download Submit
C:\Windows\System\dXyroRg.exe

Filesize
2.8MB

MD5
12b65e7283b542a8a4d11e63f526110f

SHA1
647b92f10d00b4d7f508f53d1579704f7b4b1ce4

SHA256
df94e07dedbd3ea143b2a72cd0061386aec9112a8e99ba20f5bbfa76afeaa087

SHA512
2d45b75fc0d169e0df6ff78dff5ccd60eafa9ed7cd4f4de2e1bee36f8d366a4c1dcf03725ccf83e56cda77903e78c82e214ccc97072afe40549d51d2000d9fce

Download Submit
C:\Windows\System\dZSyAuS.exe

Filesize
2.8MB

MD5
be0a4a4310415d9ddacd4948581ddbf1

SHA1
178cbfaafaab6e2f5e37eff4631df736544f7491

SHA256
5f2e8bb3165ff276b32a082a9cba3fd8eee45418b40615ee394fbc9de45f4c5b

SHA512
e908b69363477ef44c68e1b141c2bd3156bde3c3855fdb4817feec1489bf1825154783a8ed8dec8c351c754302010bf1f93bec7870b98824bfaaee14bd747728

Download Submit
C:\Windows\System\eJCDwgX.exe

Filesize
2.8MB

MD5
42d9511040865ee83092e1240889485d

SHA1
61095b521038ce1efd1318862991f060ce73829d

SHA256
6285e406c492fe171a013938c65e4727fcc22cb4a9d6be921b19dca73e82fe95

SHA512
05c8851af76ef37621023f4e1471033f70d8ac2b472f8e24ee3556cd4c57bb76796dd9fb5cafd60860106c461f84f743687c2a5016e7566ce6f36216c75f4926

Download Submit
C:\Windows\System\fCeYKCR.exe

Filesize
2.8MB

MD5
024470b4187850321e89aeabf5f1f446

SHA1
f7a5a082457b6f71353a4f59d7b130c95b26c20c

SHA256
8d17da29efebecf806ef75fc1c277d34dbcf075fe095cd348c003da0e5cbac52

SHA512
4704b768b21b95b4c2a9fa68fc9caa67320e049cddf2d71905b8dcc6bdbd7cad793d386397d45609ba217f7189a81c6d140f49e1a1f3ee9d9a3aa085c67289ff

Download Submit
C:\Windows\System\fEeOJYK.exe

Filesize
2.8MB

MD5
d5c41a2e158ec45137e4d041dc76e732

SHA1
d1998750c396ef1bf2fbcf28d8dceadeb01fdb28

SHA256
eef96e64c58b29a5efb591b6751d907efaa0c592337814c63c89a68dc114cad0

SHA512
640dcea1c940ad00f8b071e13b343e0f91e92958250c366a554031aa4c9cfc7eb57478b870a1bcb7caa58e4f9d1c0478e2e27018f4d5b2acd5e4a0d9dfec0745

Download Submit
C:\Windows\System\htVwElV.exe

Filesize
2.8MB

MD5
93400a2d1b1307f4e0b89d75b4490933

SHA1
d880bdb19bf12155f2753fae6bad57179049d1b9

SHA256
429c8e03ee8d92f044ba68550537fdfe2598f2b516d16249733673ca8cb20003

SHA512
978679e41ec589a8cd5391bdb5602e5db90e146a4082edc8d9a7fed125a019e46696fc6cd87bfa88d38a111644fd4b634419bd5c9409b97ed2a8e9654fe07ee1

Download Submit
C:\Windows\System\jJxVwZy.exe

Filesize
2.8MB

MD5
4962856633245dc3e0726855af00d9b7

SHA1
e99e5be602f7e6cc41cfee5e1c9ae3e30697e580

SHA256
266c8f7f3fdc7ff38196c3e8f7915bc3cea9f80a10ee1dca22ca5d5fd9404832

SHA512
57467ee5300fa3cea972b8c6d5afd3fd9c5bc8bb1db75a4933ccd6ff024802f75d15859b0c70d4081dc27f329f8a76f3950dc9f4b91e84fc5635ed6b2318b8a1

Download Submit
C:\Windows\System\nMSNxAm.exe

Filesize
2.8MB

MD5
3a1d89f8c8d644cf4b5f7d202988fada

SHA1
03c25f4bb99fb77f855476bea9d66806f45b587d

SHA256
5866ad66fda13cffd68f9f55f6f7efbd1a6a3d1f985d9aaedede85c7bee7f9c9

SHA512
838d7ba1f177ff396634816498c10a21639d6993d8294c05bb8844afd701f8a497f7013286d54b5da1fe20b6c50bbace89538b105dfaa82e52e23e48bddd1ead

Download Submit
C:\Windows\System\oBMSDWm.exe

Filesize
2.8MB

MD5
ff6696283bffb0bd8b3b73cc70bb9176

SHA1
05e7c6fbd819a4a7f79a066e641bae450d363b4a

SHA256
ee0f6d6385736af46c55d216ee2dd4c38901f60ddc68ab1199ac47df6449513e

SHA512
609fbf1d342f0882428602a2dd38865797d959fad289bd2e1139ee1825959656284e990b697c6819339bf719273522ffca642d535ad167228a2e386e2ec2ab2a

Download Submit
C:\Windows\System\poHMIRX.exe

Filesize
2.8MB

MD5
73dace20cc63200ee740abe22005c325

SHA1
7bcf7adba15b7fc34606b767370496979077bfb6

SHA256
48c534ed247eae64b8907dab3cfa20e2640fdac09e56f378ddc6d8bbb26d8975

SHA512
5b1fe03b87c88a78f33b44cf14f4b063a2538392abbf229014472d92587dd15813d851e9d2bc773b6023e399101aa0d6fbca6a886f86acf1c8c4bcb9ec243787

Download Submit
C:\Windows\System\qOIiSUX.exe

Filesize
2.8MB

MD5
2898c919802211c4bbf601515b1ae68d

SHA1
2082e4b835a50a6b219c1f8e61932557d113fa48

SHA256
7f10645b9b2457bdd0b42480f1f6513e8cb711db9586c0058aea3e72feb14e90

SHA512
fdaea8ade0521e3ab98693bf9382a5530faebae9cfac8aea28d9f422b47e8b406071bf64a96b3fe554132956dd17b4ae455da1ebf410c20a05408fc1e463aa91

Download Submit
C:\Windows\System\rnpUfTh.exe

Filesize
2.8MB

MD5
51736ad62541e32273f20f9d8f2be4ba

SHA1
85758de772721e999a009b0d4e733b800a3b2b1c

SHA256
3c5150965060ce42c10d5b612f877a0072e68e71712835569f4a57cdba04c6dd

SHA512
ff7d145d10c2468adb1b9a2ba9ec453aaf260a43b67a3910b96de6305913667675241a503bab03c0d28a445a95c1647c53236fae3f2d44dfd53240ec43a71597

Download Submit
C:\Windows\System\tACLivF.exe

Filesize
2.8MB

MD5
40c3821abf9527c9db97b06e76f97b4a

SHA1
0db34c76503c2f2660caad9595dbbebf964de775

SHA256
efd829b7344932eaafe39b6ca05693b73d74d9cb3f72ce340c1a93f66e118db9

SHA512
a725bcf64024417fa4027189fadccc687eea6aeb09f7caf70be6143e9700c027a7338bf0056057cee622e877c6c571dff59a9bd0b80c2643e03709b061092d0b

Download Submit
C:\Windows\System\tsNDlky.exe

Filesize
2.8MB

MD5
fd003d477e80db58ab07b47df0e275a9

SHA1
1d517f43c79caf1a590807bbdf9ab24d97398bea

SHA256
faac82124bdc364b8e86ef49e1640081ab12169721e5c226b5a5a5ed0501ca6e

SHA512
c653bc6aecc56b9d9ec3bc1bd951279ea3009d60eea632324b611be3abca820c59f33c2884d5e628d33a0085f920a929c63b04c04d7aa1b10eb398ca400b3f6b

Download Submit
C:\Windows\System\vbdmhjD.exe

Filesize
18B

MD5
bb03964bb6999f8b59a80d882e7357fc

SHA1
dad034dc7f0131858f69e6358b06741426882979

SHA256
aafca8c5a26ca0a4f2343a68b34cbab73ab7ce8111d1499b75478b370965e892

SHA512
30a183dbbd5795ca8cc218d9efd2598cd95794b3e4640491c47059add19a9447791634cafdcff0b93cee0ce61b3582de4f2649241eb02c5150703db59892bf7d

Download Submit
C:\Windows\System\vsKkMDh.exe

Filesize
2.8MB

MD5
a2962dee9c282573662617ce8af624a6

SHA1
0dee091c3f0e29a22f093fe910c568ddaa7a45a7

SHA256
b36e646a3abadcde60aa926c987f6015f2e1a30241b44aa10bc349a6b8d7c5a1

SHA512
94174e5b1867ff965dad2db55ecbaae00bea58b7491cb9b75bb8ce72988b6eb8b05ff450493389261101a77cc836b12d35e1641002d7b752605ee8ebe56653f5

Download Submit
C:\Windows\System\wGwiImc.exe

Filesize
2.8MB

MD5
eac0b010b606fd78bf121f867424698d

SHA1
6fbb80dd996b615af8101d4be5b2a8df0020a94b

SHA256
0fee7990db1c6879b1564a6d7439721e05213568785da0c444b26a094fa9a41a

SHA512
1d92f3c2a8a34946ccebaba1787167177538584143abfd9037d86627dad4286375e0dd72445cdbd102144f85c146cf3ce8495f3bbfa5d2e18d5a9e053978d8cf

Download Submit
C:\Windows\System\wseYpWZ.exe

Filesize
2.8MB

MD5
503a5422ee0f4e7f40c0cd2825223628

SHA1
ae646e17a83217029e6d17aacffa0f6ca3ffc453

SHA256
808b11bf5d9885f6ce2db58fcb16dca52332d3c4f9d9a8a930d2ad6c16988668

SHA512
df555ba320524610a094f7282a69b9b20ffe1ad44c083bdf196d1735b443c1b78f02610574ecb4ed9dbcc89c88f517e091354656436cd8dffb1de9b210e412f2

Download Submit
memory/1076-71-0x00007FF62D100000-0x00007FF62D4F2000-memory.dmp

Filesize
3.9MB

Download
memory/1164-2957-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp

Filesize
3.9MB

Download
memory/1164-158-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp

Filesize
3.9MB

Download
memory/1284-2966-0x00007FF656110000-0x00007FF656502000-memory.dmp

Filesize
3.9MB

Download
memory/1284-206-0x00007FF656110000-0x00007FF656502000-memory.dmp

Filesize
3.9MB

Download
memory/1452-2988-0x00007FF6FF390000-0x00007FF6FF782000-memory.dmp

Filesize
3.9MB

Download
memory/1452-209-0x00007FF6FF390000-0x00007FF6FF782000-memory.dmp

Filesize
3.9MB

Download
memory/1516-18-0x00007FF6059C0000-0x00007FF605DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1572-2955-0x00007FF710F10000-0x00007FF711302000-memory.dmp

Filesize
3.9MB

Download
memory/1572-175-0x00007FF710F10000-0x00007FF711302000-memory.dmp

Filesize
3.9MB

Download
memory/1776-2991-0x00007FF7FEEF0000-0x00007FF7FF2E2000-memory.dmp

Filesize
3.9MB

Download
memory/1776-210-0x00007FF7FEEF0000-0x00007FF7FF2E2000-memory.dmp

Filesize
3.9MB

Download
memory/1944-56-0x00007FFAD5290000-0x00007FFAD5D51000-memory.dmp

Filesize
10.8MB

Download
memory/1944-115-0x000001B56A580000-0x000001B56A590000-memory.dmp

Filesize
64KB

Download
memory/1944-200-0x000001B56A970000-0x000001B56A992000-memory.dmp

Filesize
136KB

Download
memory/1944-1866-0x00007FFAD5290000-0x00007FFAD5D51000-memory.dmp

Filesize
10.8MB

Download
memory/1984-190-0x00007FF729B90000-0x00007FF729F82000-memory.dmp

Filesize
3.9MB

Download
memory/1984-2946-0x00007FF729B90000-0x00007FF729F82000-memory.dmp

Filesize
3.9MB

Download
memory/2248-207-0x00007FF6405B0000-0x00007FF6409A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-2978-0x00007FF6405B0000-0x00007FF6409A2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-208-0x00007FF6A1F60000-0x00007FF6A2352000-memory.dmp

Filesize
3.9MB

Download
memory/2376-2994-0x00007FF6A1F60000-0x00007FF6A2352000-memory.dmp

Filesize
3.9MB

Download
memory/2392-114-0x00007FF7426D0000-0x00007FF742AC2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-82-0x00007FF724840000-0x00007FF724C32000-memory.dmp

Filesize
3.9MB

Download
memory/2424-2939-0x00007FF724840000-0x00007FF724C32000-memory.dmp

Filesize
3.9MB

Download
memory/2444-2951-0x00007FF644570000-0x00007FF644962000-memory.dmp

Filesize
3.9MB

Download
memory/2444-184-0x00007FF644570000-0x00007FF644962000-memory.dmp

Filesize
3.9MB

Download
memory/2856-2969-0x00007FF6ADE60000-0x00007FF6AE252000-memory.dmp

Filesize
3.9MB

Download
memory/2856-183-0x00007FF6ADE60000-0x00007FF6AE252000-memory.dmp

Filesize
3.9MB

Download
memory/2932-213-0x00007FF60D130000-0x00007FF60D522000-memory.dmp

Filesize
3.9MB

Download
memory/2932-2949-0x00007FF60D130000-0x00007FF60D522000-memory.dmp

Filesize
3.9MB

Download
memory/3832-2936-0x00007FF783B60000-0x00007FF783F52000-memory.dmp

Filesize
3.9MB

Download
memory/3832-116-0x00007FF783B60000-0x00007FF783F52000-memory.dmp

Filesize
3.9MB

Download
memory/4120-2906-0x00007FF77C460000-0x00007FF77C852000-memory.dmp

Filesize
3.9MB

Download
memory/4120-211-0x00007FF77C460000-0x00007FF77C852000-memory.dmp

Filesize
3.9MB

Download
memory/4720-203-0x00007FF6FBDA0000-0x00007FF6FC192000-memory.dmp

Filesize
3.9MB

Download
memory/4720-2958-0x00007FF6FBDA0000-0x00007FF6FC192000-memory.dmp

Filesize
3.9MB

Download
memory/4732-205-0x00007FF63B000000-0x00007FF63B3F2000-memory.dmp

Filesize
3.9MB

Download
memory/4732-2964-0x00007FF63B000000-0x00007FF63B3F2000-memory.dmp

Filesize
3.9MB

Download
memory/4792-1-0x000002891E150000-0x000002891E160000-memory.dmp

Filesize
64KB

Download
memory/4792-0-0x00007FF7F1440000-0x00007FF7F1832000-memory.dmp

Filesize
3.9MB

Download
memory/4804-2973-0x00007FF6ED500000-0x00007FF6ED8F2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-212-0x00007FF6ED500000-0x00007FF6ED8F2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-2944-0x00007FF6253D0000-0x00007FF6257C2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-136-0x00007FF6253D0000-0x00007FF6257C2000-memory.dmp

Filesize
3.9MB

Download