xmrig | db19b759b2f45be311b9f6afe0649a17032b33d991237cbb741f129958dc4aa2

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
Size

1.9MB
MD5

04f0eb27320d9bc03d998daff60220f7
SHA1

b2f716f8324c8e0554d95f7454e11feed429e642
SHA256

db19b759b2f45be311b9f6afe0649a17032b33d991237cbb741f129958dc4aa2
SHA512

2715d54ea4a1877c2b916dad1284a1e8156594b4855e4b92cd4eb34aab54051cebd124343e17ec08eee8dacfb49f684e44fdd45d127739f9c94aa6bda6307a6d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl2B:NABn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/3396-205-0x00007FF75CC00000-0x00007FF75CFF2000-memory.dmp	xmrig
behavioral2/memory/4840-366-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp	xmrig
behavioral2/memory/4804-365-0x00007FF627750000-0x00007FF627B42000-memory.dmp	xmrig
behavioral2/memory/2296-364-0x00007FF652160000-0x00007FF652552000-memory.dmp	xmrig
behavioral2/memory/3632-362-0x00007FF7AFE50000-0x00007FF7B0242000-memory.dmp	xmrig
behavioral2/memory/600-359-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp	xmrig
behavioral2/memory/3784-339-0x00007FF62DAF0000-0x00007FF62DEE2000-memory.dmp	xmrig
behavioral2/memory/5116-250-0x00007FF61BB90000-0x00007FF61BF82000-memory.dmp	xmrig
behavioral2/memory/1928-234-0x00007FF7C4FA0000-0x00007FF7C5392000-memory.dmp	xmrig
behavioral2/memory/3832-232-0x00007FF698F10000-0x00007FF699302000-memory.dmp	xmrig
behavioral2/memory/4632-231-0x00007FF70F460000-0x00007FF70F852000-memory.dmp	xmrig
behavioral2/memory/3760-223-0x00007FF6E6820000-0x00007FF6E6C12000-memory.dmp	xmrig
behavioral2/memory/5008-209-0x00007FF6742E0000-0x00007FF6746D2000-memory.dmp	xmrig
behavioral2/memory/4972-193-0x00007FF7C53E0000-0x00007FF7C57D2000-memory.dmp	xmrig
behavioral2/memory/2740-183-0x00007FF6F6770000-0x00007FF6F6B62000-memory.dmp	xmrig
behavioral2/memory/3332-160-0x00007FF6FA7B0000-0x00007FF6FABA2000-memory.dmp	xmrig
behavioral2/memory/3552-143-0x00007FF733480000-0x00007FF733872000-memory.dmp	xmrig
behavioral2/memory/1812-106-0x00007FF796510000-0x00007FF796902000-memory.dmp	xmrig
behavioral2/memory/228-81-0x00007FF6A6E10000-0x00007FF6A7202000-memory.dmp	xmrig
behavioral2/memory/4036-60-0x00007FF6B7020000-0x00007FF6B7412000-memory.dmp	xmrig
behavioral2/memory/2088-52-0x00007FF714820000-0x00007FF714C12000-memory.dmp	xmrig
behavioral2/memory/4036-4839-0x00007FF6B7020000-0x00007FF6B7412000-memory.dmp	xmrig
behavioral2/memory/228-4876-0x00007FF6A6E10000-0x00007FF6A7202000-memory.dmp	xmrig
behavioral2/memory/3332-4894-0x00007FF6FA7B0000-0x00007FF6FABA2000-memory.dmp	xmrig
behavioral2/memory/1928-4938-0x00007FF7C4FA0000-0x00007FF7C5392000-memory.dmp	xmrig
behavioral2/memory/3760-4924-0x00007FF6E6820000-0x00007FF6E6C12000-memory.dmp	xmrig
behavioral2/memory/2740-4905-0x00007FF6F6770000-0x00007FF6F6B62000-memory.dmp	xmrig
behavioral2/memory/3396-4951-0x00007FF75CC00000-0x00007FF75CFF2000-memory.dmp	xmrig
behavioral2/memory/4632-4947-0x00007FF70F460000-0x00007FF70F852000-memory.dmp	xmrig
behavioral2/memory/3552-4935-0x00007FF733480000-0x00007FF733872000-memory.dmp	xmrig
behavioral2/memory/5008-4960-0x00007FF6742E0000-0x00007FF6746D2000-memory.dmp	xmrig
behavioral2/memory/600-4995-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp	xmrig
behavioral2/memory/4840-4991-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp	xmrig
behavioral2/memory/4804-4989-0x00007FF627750000-0x00007FF627B42000-memory.dmp	xmrig
behavioral2/memory/3832-4981-0x00007FF698F10000-0x00007FF699302000-memory.dmp	xmrig
behavioral2/memory/4972-4974-0x00007FF7C53E0000-0x00007FF7C57D2000-memory.dmp	xmrig
behavioral2/memory/5116-4969-0x00007FF61BB90000-0x00007FF61BF82000-memory.dmp	xmrig
behavioral2/memory/3784-4957-0x00007FF62DAF0000-0x00007FF62DEE2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3632	wCFyVmS.exe
2088	zurjPas.exe
4036	NYpKTWR.exe
228	IQTEDwC.exe
1812	ktBOryN.exe
3552	mIiYLUx.exe
3332	JPMnpiR.exe
2740	tcFEpMS.exe
4972	hppMVzT.exe
2296	SZEPToi.exe
3396	KhQRYNF.exe
5008	EKkgFWW.exe
3760	kYstnEU.exe
4804	hCPwfLC.exe
4632	jlAMtZM.exe
3832	qKuCfdo.exe
1928	HRwfNnk.exe
5116	zbSeEsd.exe
4840	RPXhpLD.exe
3784	cKxuMvR.exe
600	ycNoAlu.exe
916	eFgvZKk.exe
1332	yeDMqCE.exe
2152	zDErLmH.exe
2284	UEaUflp.exe
4244	NjgthHb.exe
4040	BOkhTQn.exe
4868	DDwJFLE.exe
4552	kJUxIKA.exe
988	UUvqNgF.exe
4224	IkSUYXJ.exe
452	bUvmwpN.exe
4428	JRrBnFs.exe
4152	aJFTwoJ.exe
4524	HPmatsb.exe
3540	CAmbVGP.exe
1948	pRxtDqC.exe
4512	pyxOUxk.exe
2692	tFCIUwm.exe
4004	ahZjmWY.exe
3456	qutavkU.exe
2764	BGgjzGJ.exe
4508	UylAtnz.exe
1076	XVrObzP.exe
2132	GBkpvOF.exe
428	nKZJqVZ.exe
3256	ufxTqam.exe
4092	sgLJDEO.exe
4976	KBtkuyS.exe
2736	kisgEBU.exe
624	yLdBghx.exe
1088	lEoUhGX.exe
4356	HTKCBvk.exe
664	cUqWFne.exe
3600	fBCwGco.exe
2776	uhvqqfT.exe
2316	QkRfAUy.exe
2644	vjcnhuM.exe
5112	GpKCkxP.exe
3224	lZxLyXm.exe
4460	VuRtqHP.exe
4652	fZuUyza.exe
1824	FDqFIwn.exe
4904	dsJcZXn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/348-0-0x00007FF7637B0000-0x00007FF763BA2000-memory.dmp	upx
behavioral2/files/0x000b000000023bac-5.dat	upx
behavioral2/files/0x000a000000023bb2-17.dat	upx
behavioral2/files/0x0031000000023bb8-48.dat	upx
behavioral2/files/0x000a000000023bba-72.dat	upx
behavioral2/files/0x0032000000023bb6-121.dat	upx
behavioral2/files/0x000a000000023bc9-146.dat	upx
behavioral2/files/0x000a000000023bca-169.dat	upx
behavioral2/memory/3396-205-0x00007FF75CC00000-0x00007FF75CFF2000-memory.dmp	upx
behavioral2/memory/4840-366-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp	upx
behavioral2/memory/4804-365-0x00007FF627750000-0x00007FF627B42000-memory.dmp	upx
behavioral2/memory/2296-364-0x00007FF652160000-0x00007FF652552000-memory.dmp	upx
behavioral2/memory/3632-362-0x00007FF7AFE50000-0x00007FF7B0242000-memory.dmp	upx
behavioral2/memory/600-359-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp	upx
behavioral2/memory/3784-339-0x00007FF62DAF0000-0x00007FF62DEE2000-memory.dmp	upx
behavioral2/memory/5116-250-0x00007FF61BB90000-0x00007FF61BF82000-memory.dmp	upx
behavioral2/memory/1928-234-0x00007FF7C4FA0000-0x00007FF7C5392000-memory.dmp	upx
behavioral2/memory/3832-232-0x00007FF698F10000-0x00007FF699302000-memory.dmp	upx
behavioral2/memory/4632-231-0x00007FF70F460000-0x00007FF70F852000-memory.dmp	upx
behavioral2/memory/3760-223-0x00007FF6E6820000-0x00007FF6E6C12000-memory.dmp	upx
behavioral2/memory/5008-209-0x00007FF6742E0000-0x00007FF6746D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd1-199.dat	upx
behavioral2/files/0x000a000000023bd0-194.dat	upx
behavioral2/memory/4972-193-0x00007FF7C53E0000-0x00007FF7C57D2000-memory.dmp	upx
behavioral2/memory/2740-183-0x00007FF6F6770000-0x00007FF6F6B62000-memory.dmp	upx
behavioral2/files/0x000a000000023bc7-181.dat	upx
behavioral2/files/0x000a000000023bc6-179.dat	upx
behavioral2/files/0x000a000000023bc4-175.dat	upx
behavioral2/files/0x000a000000023bc3-172.dat	upx
behavioral2/files/0x000a000000023bcf-171.dat	upx
behavioral2/files/0x000b000000023bad-168.dat	upx
behavioral2/files/0x000a000000023bc1-161.dat	upx
behavioral2/memory/3332-160-0x00007FF6FA7B0000-0x00007FF6FABA2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-159.dat	upx
behavioral2/files/0x000a000000023bcc-158.dat	upx
behavioral2/files/0x000a000000023bc5-156.dat	upx
behavioral2/files/0x000a000000023bcb-155.dat	upx
behavioral2/files/0x000a000000023bbe-149.dat	upx
behavioral2/files/0x000a000000023bce-167.dat	upx
behavioral2/memory/3552-143-0x00007FF733480000-0x00007FF733872000-memory.dmp	upx
behavioral2/files/0x000a000000023bc8-139.dat	upx
behavioral2/files/0x000a000000023bbc-132.dat	upx
behavioral2/files/0x000a000000023bc0-129.dat	upx
behavioral2/files/0x000a000000023bc2-122.dat	upx
behavioral2/files/0x000a000000023bbd-110.dat	upx
behavioral2/memory/1812-106-0x00007FF796510000-0x00007FF796902000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-101.dat	upx
behavioral2/files/0x000a000000023bbb-92.dat	upx
behavioral2/files/0x0032000000023bb7-86.dat	upx
behavioral2/files/0x000a000000023bb4-70.dat	upx
behavioral2/files/0x000a000000023bb9-64.dat	upx
behavioral2/memory/228-81-0x00007FF6A6E10000-0x00007FF6A7202000-memory.dmp	upx
behavioral2/memory/4036-60-0x00007FF6B7020000-0x00007FF6B7412000-memory.dmp	upx
behavioral2/files/0x000a000000023bb5-55.dat	upx
behavioral2/memory/2088-52-0x00007FF714820000-0x00007FF714C12000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-38.dat	upx
behavioral2/files/0x000a000000023bb3-24.dat	upx
behavioral2/files/0x000a000000023bb0-19.dat	upx
behavioral2/memory/4036-4839-0x00007FF6B7020000-0x00007FF6B7412000-memory.dmp	upx
behavioral2/memory/228-4876-0x00007FF6A6E10000-0x00007FF6A7202000-memory.dmp	upx
behavioral2/memory/3332-4894-0x00007FF6FA7B0000-0x00007FF6FABA2000-memory.dmp	upx
behavioral2/memory/1928-4938-0x00007FF7C4FA0000-0x00007FF7C5392000-memory.dmp	upx
behavioral2/memory/3760-4924-0x00007FF6E6820000-0x00007FF6E6C12000-memory.dmp	upx
behavioral2/memory/2740-4905-0x00007FF6F6770000-0x00007FF6F6B62000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JcnhbsG.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\VirjHmC.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\txsRExi.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\EDzgIGR.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\oNtOCYP.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\cfCQzzM.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\zyCPcnx.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\axMAEpB.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\bLYzVMv.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\ZYZJXgV.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\WkoNsIR.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\XwHgYmq.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\OsPatVR.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\jnQRsBK.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\UkSIjnN.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\TwOpLnc.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\ZwDFaqY.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\PPKxLnb.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\WtvGyyG.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\rkoiSLY.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\KObrQqh.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\NfiWiGo.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\pjNNsDC.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\bVWYBVj.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\WWkEETz.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\HCtzegk.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\XsZzfZT.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\dfcPlzQ.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\bHAbDxC.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\fUOmozl.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\ERknZXU.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\OUsRYVA.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\pxvOxTU.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\tAOREFU.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\dESkcWa.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\QpnhaBI.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\KZxoVMC.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\sCRwOBE.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\iIrUdxd.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\bdfhWWs.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\Cxlwgrm.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\gKkgnlL.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\udDXwkR.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\AyhrkLF.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\mKvfFDh.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\GLkErSa.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\DNxsSTq.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\NZcEuDJ.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\EVocvVI.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\msokHQi.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\ueGWcBT.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\WmQCjKh.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\wefLSOo.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\lSKnvAq.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\OQFovpB.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\NsOYCVa.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\GwXnxCx.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\CznbaLW.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\DloXDyD.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\nnwSyRh.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\VBDOnXG.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\UuFaauu.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\nFKqqCJ.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\kJKLoGL.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
520	powershell.exe
520	powershell.exe
520	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
Token: SeDebugPrivilege	520	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 520	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	84
PID 348 wrote to memory of 520	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	84
PID 348 wrote to memory of 3632	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	85
PID 348 wrote to memory of 3632	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	85
PID 348 wrote to memory of 2088	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	86
PID 348 wrote to memory of 2088	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	86
PID 348 wrote to memory of 4036	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	87
PID 348 wrote to memory of 4036	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	87
PID 348 wrote to memory of 228	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	88
PID 348 wrote to memory of 228	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	88
PID 348 wrote to memory of 1812	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	89
PID 348 wrote to memory of 1812	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	89
PID 348 wrote to memory of 3552	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	90
PID 348 wrote to memory of 3552	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	90
PID 348 wrote to memory of 3332	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	91
PID 348 wrote to memory of 3332	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	91
PID 348 wrote to memory of 2740	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	92
PID 348 wrote to memory of 2740	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	92
PID 348 wrote to memory of 4972	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	93
PID 348 wrote to memory of 4972	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	93
PID 348 wrote to memory of 2296	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	94
PID 348 wrote to memory of 2296	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	94
PID 348 wrote to memory of 3396	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	95
PID 348 wrote to memory of 3396	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	95
PID 348 wrote to memory of 5008	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	96
PID 348 wrote to memory of 5008	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	96
PID 348 wrote to memory of 3760	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	97
PID 348 wrote to memory of 3760	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	97
PID 348 wrote to memory of 4804	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	98
PID 348 wrote to memory of 4804	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	98
PID 348 wrote to memory of 4632	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	99
PID 348 wrote to memory of 4632	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	99
PID 348 wrote to memory of 3832	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	100
PID 348 wrote to memory of 3832	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	100
PID 348 wrote to memory of 1928	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	101
PID 348 wrote to memory of 1928	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	101
PID 348 wrote to memory of 5116	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	102
PID 348 wrote to memory of 5116	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	102
PID 348 wrote to memory of 4840	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	103
PID 348 wrote to memory of 4840	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	103
PID 348 wrote to memory of 3784	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	104
PID 348 wrote to memory of 3784	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	104
PID 348 wrote to memory of 600	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	105
PID 348 wrote to memory of 600	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	105
PID 348 wrote to memory of 916	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	106
PID 348 wrote to memory of 916	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	106
PID 348 wrote to memory of 1332	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	107
PID 348 wrote to memory of 1332	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	107
PID 348 wrote to memory of 2152	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	108
PID 348 wrote to memory of 2152	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	108
PID 348 wrote to memory of 2284	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	109
PID 348 wrote to memory of 2284	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	109
PID 348 wrote to memory of 4244	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	110
PID 348 wrote to memory of 4244	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	110
PID 348 wrote to memory of 4040	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	111
PID 348 wrote to memory of 4040	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	111
PID 348 wrote to memory of 4868	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	112
PID 348 wrote to memory of 4868	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	112
PID 348 wrote to memory of 4552	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	113
PID 348 wrote to memory of 4552	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	113
PID 348 wrote to memory of 988	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	114
PID 348 wrote to memory of 988	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	114
PID 348 wrote to memory of 4224	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	115
PID 348 wrote to memory of 4224	348	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:520
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "520" "2404" "2352" "2408" "0" "0" "2432" "0" "0" "0" "0" "0"
    3⤵
    PID:3772
- C:\Windows\System\wCFyVmS.exe
  C:\Windows\System\wCFyVmS.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\zurjPas.exe
  C:\Windows\System\zurjPas.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\NYpKTWR.exe
  C:\Windows\System\NYpKTWR.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\IQTEDwC.exe
  C:\Windows\System\IQTEDwC.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\ktBOryN.exe
  C:\Windows\System\ktBOryN.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\mIiYLUx.exe
  C:\Windows\System\mIiYLUx.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\JPMnpiR.exe
  C:\Windows\System\JPMnpiR.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\tcFEpMS.exe
  C:\Windows\System\tcFEpMS.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\hppMVzT.exe
  C:\Windows\System\hppMVzT.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\SZEPToi.exe
  C:\Windows\System\SZEPToi.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\KhQRYNF.exe
  C:\Windows\System\KhQRYNF.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\EKkgFWW.exe
  C:\Windows\System\EKkgFWW.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\kYstnEU.exe
  C:\Windows\System\kYstnEU.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\hCPwfLC.exe
  C:\Windows\System\hCPwfLC.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\jlAMtZM.exe
  C:\Windows\System\jlAMtZM.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\qKuCfdo.exe
  C:\Windows\System\qKuCfdo.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\HRwfNnk.exe
  C:\Windows\System\HRwfNnk.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\zbSeEsd.exe
  C:\Windows\System\zbSeEsd.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\RPXhpLD.exe
  C:\Windows\System\RPXhpLD.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\cKxuMvR.exe
  C:\Windows\System\cKxuMvR.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\ycNoAlu.exe
  C:\Windows\System\ycNoAlu.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\eFgvZKk.exe
  C:\Windows\System\eFgvZKk.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\yeDMqCE.exe
  C:\Windows\System\yeDMqCE.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\zDErLmH.exe
  C:\Windows\System\zDErLmH.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\UEaUflp.exe
  C:\Windows\System\UEaUflp.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\NjgthHb.exe
  C:\Windows\System\NjgthHb.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\BOkhTQn.exe
  C:\Windows\System\BOkhTQn.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\DDwJFLE.exe
  C:\Windows\System\DDwJFLE.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\kJUxIKA.exe
  C:\Windows\System\kJUxIKA.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\UUvqNgF.exe
  C:\Windows\System\UUvqNgF.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\IkSUYXJ.exe
  C:\Windows\System\IkSUYXJ.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\bUvmwpN.exe
  C:\Windows\System\bUvmwpN.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\JRrBnFs.exe
  C:\Windows\System\JRrBnFs.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\aJFTwoJ.exe
  C:\Windows\System\aJFTwoJ.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\HPmatsb.exe
  C:\Windows\System\HPmatsb.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\CAmbVGP.exe
  C:\Windows\System\CAmbVGP.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\pRxtDqC.exe
  C:\Windows\System\pRxtDqC.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\pyxOUxk.exe
  C:\Windows\System\pyxOUxk.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\tFCIUwm.exe
  C:\Windows\System\tFCIUwm.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\ahZjmWY.exe
  C:\Windows\System\ahZjmWY.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\qutavkU.exe
  C:\Windows\System\qutavkU.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\BGgjzGJ.exe
  C:\Windows\System\BGgjzGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\UylAtnz.exe
  C:\Windows\System\UylAtnz.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\XVrObzP.exe
  C:\Windows\System\XVrObzP.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\GBkpvOF.exe
  C:\Windows\System\GBkpvOF.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\nKZJqVZ.exe
  C:\Windows\System\nKZJqVZ.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\ufxTqam.exe
  C:\Windows\System\ufxTqam.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\sgLJDEO.exe
  C:\Windows\System\sgLJDEO.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\KBtkuyS.exe
  C:\Windows\System\KBtkuyS.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\kisgEBU.exe
  C:\Windows\System\kisgEBU.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\yLdBghx.exe
  C:\Windows\System\yLdBghx.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\lEoUhGX.exe
  C:\Windows\System\lEoUhGX.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\HTKCBvk.exe
  C:\Windows\System\HTKCBvk.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\cUqWFne.exe
  C:\Windows\System\cUqWFne.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\fBCwGco.exe
  C:\Windows\System\fBCwGco.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\uhvqqfT.exe
  C:\Windows\System\uhvqqfT.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\QkRfAUy.exe
  C:\Windows\System\QkRfAUy.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\vjcnhuM.exe
  C:\Windows\System\vjcnhuM.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\GpKCkxP.exe
  C:\Windows\System\GpKCkxP.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\lZxLyXm.exe
  C:\Windows\System\lZxLyXm.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\VuRtqHP.exe
  C:\Windows\System\VuRtqHP.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\fZuUyza.exe
  C:\Windows\System\fZuUyza.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\FDqFIwn.exe
  C:\Windows\System\FDqFIwn.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\dsJcZXn.exe
  C:\Windows\System\dsJcZXn.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\fyjgTNo.exe
  C:\Windows\System\fyjgTNo.exe
  2⤵
  PID:1196
- C:\Windows\System\SRfKYFt.exe
  C:\Windows\System\SRfKYFt.exe
  2⤵
  PID:2972
- C:\Windows\System\aCRlDKs.exe
  C:\Windows\System\aCRlDKs.exe
  2⤵
  PID:1032
- C:\Windows\System\vfLrdip.exe
  C:\Windows\System\vfLrdip.exe
  2⤵
  PID:4468
- C:\Windows\System\clxONPE.exe
  C:\Windows\System\clxONPE.exe
  2⤵
  PID:8
- C:\Windows\System\vTWnMHo.exe
  C:\Windows\System\vTWnMHo.exe
  2⤵
  PID:2304
- C:\Windows\System\GhddlxE.exe
  C:\Windows\System\GhddlxE.exe
  2⤵
  PID:1352
- C:\Windows\System\XqgoLal.exe
  C:\Windows\System\XqgoLal.exe
  2⤵
  PID:3752
- C:\Windows\System\yCzelWH.exe
  C:\Windows\System\yCzelWH.exe
  2⤵
  PID:1420
- C:\Windows\System\btzvrzf.exe
  C:\Windows\System\btzvrzf.exe
  2⤵
  PID:3584
- C:\Windows\System\vPMWZcm.exe
  C:\Windows\System\vPMWZcm.exe
  2⤵
  PID:4452
- C:\Windows\System\XyaDzkR.exe
  C:\Windows\System\XyaDzkR.exe
  2⤵
  PID:1756
- C:\Windows\System\PezpRvg.exe
  C:\Windows\System\PezpRvg.exe
  2⤵
  PID:1708
- C:\Windows\System\ABmTaeV.exe
  C:\Windows\System\ABmTaeV.exe
  2⤵
  PID:4476
- C:\Windows\System\IWeVsuL.exe
  C:\Windows\System\IWeVsuL.exe
  2⤵
  PID:4368
- C:\Windows\System\WbudjAE.exe
  C:\Windows\System\WbudjAE.exe
  2⤵
  PID:3780
- C:\Windows\System\MsRmqIY.exe
  C:\Windows\System\MsRmqIY.exe
  2⤵
  PID:4516
- C:\Windows\System\SYNcpgE.exe
  C:\Windows\System\SYNcpgE.exe
  2⤵
  PID:2432
- C:\Windows\System\IdAanVn.exe
  C:\Windows\System\IdAanVn.exe
  2⤵
  PID:5148
- C:\Windows\System\XbKEjhN.exe
  C:\Windows\System\XbKEjhN.exe
  2⤵
  PID:5168
- C:\Windows\System\MAKnJFo.exe
  C:\Windows\System\MAKnJFo.exe
  2⤵
  PID:5188
- C:\Windows\System\SceDhQc.exe
  C:\Windows\System\SceDhQc.exe
  2⤵
  PID:5208
- C:\Windows\System\nUnZmkr.exe
  C:\Windows\System\nUnZmkr.exe
  2⤵
  PID:5224
- C:\Windows\System\MrRLxUa.exe
  C:\Windows\System\MrRLxUa.exe
  2⤵
  PID:5240
- C:\Windows\System\FKLBsvM.exe
  C:\Windows\System\FKLBsvM.exe
  2⤵
  PID:5256
- C:\Windows\System\mamWLPj.exe
  C:\Windows\System\mamWLPj.exe
  2⤵
  PID:5276
- C:\Windows\System\bDXzVFH.exe
  C:\Windows\System\bDXzVFH.exe
  2⤵
  PID:5292
- C:\Windows\System\qrBSnga.exe
  C:\Windows\System\qrBSnga.exe
  2⤵
  PID:5396
- C:\Windows\System\OpqVVyr.exe
  C:\Windows\System\OpqVVyr.exe
  2⤵
  PID:5416
- C:\Windows\System\fARypyA.exe
  C:\Windows\System\fARypyA.exe
  2⤵
  PID:5440
- C:\Windows\System\sxfeXiW.exe
  C:\Windows\System\sxfeXiW.exe
  2⤵
  PID:5456
- C:\Windows\System\pRlQnIj.exe
  C:\Windows\System\pRlQnIj.exe
  2⤵
  PID:5628
- C:\Windows\System\kFMXOel.exe
  C:\Windows\System\kFMXOel.exe
  2⤵
  PID:5668
- C:\Windows\System\liwsPKm.exe
  C:\Windows\System\liwsPKm.exe
  2⤵
  PID:5688
- C:\Windows\System\MfSUfHu.exe
  C:\Windows\System\MfSUfHu.exe
  2⤵
  PID:5712
- C:\Windows\System\ZAxTECt.exe
  C:\Windows\System\ZAxTECt.exe
  2⤵
  PID:5732
- C:\Windows\System\ZMiRtrM.exe
  C:\Windows\System\ZMiRtrM.exe
  2⤵
  PID:5748
- C:\Windows\System\jiIZWKZ.exe
  C:\Windows\System\jiIZWKZ.exe
  2⤵
  PID:5772
- C:\Windows\System\kBTOyyf.exe
  C:\Windows\System\kBTOyyf.exe
  2⤵
  PID:5792
- C:\Windows\System\ZxuFdzT.exe
  C:\Windows\System\ZxuFdzT.exe
  2⤵
  PID:5812
- C:\Windows\System\hqIrOzt.exe
  C:\Windows\System\hqIrOzt.exe
  2⤵
  PID:5832
- C:\Windows\System\FhoAbtY.exe
  C:\Windows\System\FhoAbtY.exe
  2⤵
  PID:5852
- C:\Windows\System\TwrlyPK.exe
  C:\Windows\System\TwrlyPK.exe
  2⤵
  PID:5872
- C:\Windows\System\HYRkENj.exe
  C:\Windows\System\HYRkENj.exe
  2⤵
  PID:5908
- C:\Windows\System\vFTcagB.exe
  C:\Windows\System\vFTcagB.exe
  2⤵
  PID:5928
- C:\Windows\System\IkBmAEx.exe
  C:\Windows\System\IkBmAEx.exe
  2⤵
  PID:6064
- C:\Windows\System\vtWJHhU.exe
  C:\Windows\System\vtWJHhU.exe
  2⤵
  PID:6132
- C:\Windows\System\zkoISYo.exe
  C:\Windows\System\zkoISYo.exe
  2⤵
  PID:1660
- C:\Windows\System\jREgoUq.exe
  C:\Windows\System\jREgoUq.exe
  2⤵
  PID:2388
- C:\Windows\System\TEKNcTw.exe
  C:\Windows\System\TEKNcTw.exe
  2⤵
  PID:1100
- C:\Windows\System\pmaZAip.exe
  C:\Windows\System\pmaZAip.exe
  2⤵
  PID:1952
- C:\Windows\System\JVbjJCW.exe
  C:\Windows\System\JVbjJCW.exe
  2⤵
  PID:2484
- C:\Windows\System\xXBdaQk.exe
  C:\Windows\System\xXBdaQk.exe
  2⤵
  PID:4028
- C:\Windows\System\JniDuHq.exe
  C:\Windows\System\JniDuHq.exe
  2⤵
  PID:2660
- C:\Windows\System\tyWolhQ.exe
  C:\Windows\System\tyWolhQ.exe
  2⤵
  PID:2456
- C:\Windows\System\QSkAaYa.exe
  C:\Windows\System\QSkAaYa.exe
  2⤵
  PID:3016
- C:\Windows\System\vAOusSP.exe
  C:\Windows\System\vAOusSP.exe
  2⤵
  PID:5432
- C:\Windows\System\zBUsKST.exe
  C:\Windows\System\zBUsKST.exe
  2⤵
  PID:5544
- C:\Windows\System\CCnYpGm.exe
  C:\Windows\System\CCnYpGm.exe
  2⤵
  PID:5568
- C:\Windows\System\dsTTHHx.exe
  C:\Windows\System\dsTTHHx.exe
  2⤵
  PID:5592
- C:\Windows\System\EkGjNRn.exe
  C:\Windows\System\EkGjNRn.exe
  2⤵
  PID:5620
- C:\Windows\System\vzNMAUu.exe
  C:\Windows\System\vzNMAUu.exe
  2⤵
  PID:5696
- C:\Windows\System\ccdYgFw.exe
  C:\Windows\System\ccdYgFw.exe
  2⤵
  PID:5756
- C:\Windows\System\yFcPonL.exe
  C:\Windows\System\yFcPonL.exe
  2⤵
  PID:5804
- C:\Windows\System\CPCojTw.exe
  C:\Windows\System\CPCojTw.exe
  2⤵
  PID:5840
- C:\Windows\System\vgOBlZJ.exe
  C:\Windows\System\vgOBlZJ.exe
  2⤵
  PID:5896
- C:\Windows\System\NUsJzHb.exe
  C:\Windows\System\NUsJzHb.exe
  2⤵
  PID:5936
- C:\Windows\System\xzQwdTG.exe
  C:\Windows\System\xzQwdTG.exe
  2⤵
  PID:6012
- C:\Windows\System\GTwavZh.exe
  C:\Windows\System\GTwavZh.exe
  2⤵
  PID:6044
- C:\Windows\System\gnnkviY.exe
  C:\Windows\System\gnnkviY.exe
  2⤵
  PID:5036
- C:\Windows\System\TQCquvi.exe
  C:\Windows\System\TQCquvi.exe
  2⤵
  PID:1916
- C:\Windows\System\CfpkFxZ.exe
  C:\Windows\System\CfpkFxZ.exe
  2⤵
  PID:6120
- C:\Windows\System\LlSujJZ.exe
  C:\Windows\System\LlSujJZ.exe
  2⤵
  PID:4864
- C:\Windows\System\akoYjXI.exe
  C:\Windows\System\akoYjXI.exe
  2⤵
  PID:2248
- C:\Windows\System\xcivdJn.exe
  C:\Windows\System\xcivdJn.exe
  2⤵
  PID:2624
- C:\Windows\System\pLMIeGa.exe
  C:\Windows\System\pLMIeGa.exe
  2⤵
  PID:1140
- C:\Windows\System\IEIJXop.exe
  C:\Windows\System\IEIJXop.exe
  2⤵
  PID:5140
- C:\Windows\System\CWmXatf.exe
  C:\Windows\System\CWmXatf.exe
  2⤵
  PID:2020
- C:\Windows\System\lstcKmh.exe
  C:\Windows\System\lstcKmh.exe
  2⤵
  PID:4996
- C:\Windows\System\DatcKFf.exe
  C:\Windows\System\DatcKFf.exe
  2⤵
  PID:1264
- C:\Windows\System\KhCQJAz.exe
  C:\Windows\System\KhCQJAz.exe
  2⤵
  PID:2556
- C:\Windows\System\RwzfGEE.exe
  C:\Windows\System\RwzfGEE.exe
  2⤵
  PID:3828
- C:\Windows\System\PCzwlUX.exe
  C:\Windows\System\PCzwlUX.exe
  2⤵
  PID:3328
- C:\Windows\System\jErEMyv.exe
  C:\Windows\System\jErEMyv.exe
  2⤵
  PID:3764
- C:\Windows\System\JMzPaHP.exe
  C:\Windows\System\JMzPaHP.exe
  2⤵
  PID:3228
- C:\Windows\System\mPdmAMM.exe
  C:\Windows\System\mPdmAMM.exe
  2⤵
  PID:2852
- C:\Windows\System\XzbQjQg.exe
  C:\Windows\System\XzbQjQg.exe
  2⤵
  PID:3292
- C:\Windows\System\fChreIp.exe
  C:\Windows\System\fChreIp.exe
  2⤵
  PID:1280
- C:\Windows\System\JMdXeNC.exe
  C:\Windows\System\JMdXeNC.exe
  2⤵
  PID:5100
- C:\Windows\System\BnGkLMU.exe
  C:\Windows\System\BnGkLMU.exe
  2⤵
  PID:4296
- C:\Windows\System\pLxpNTo.exe
  C:\Windows\System\pLxpNTo.exe
  2⤵
  PID:5516
- C:\Windows\System\UYixLEn.exe
  C:\Windows\System\UYixLEn.exe
  2⤵
  PID:5724
- C:\Windows\System\bVKiWSX.exe
  C:\Windows\System\bVKiWSX.exe
  2⤵
  PID:5824
- C:\Windows\System\hpsBVnZ.exe
  C:\Windows\System\hpsBVnZ.exe
  2⤵
  PID:4212
- C:\Windows\System\LKIjgUH.exe
  C:\Windows\System\LKIjgUH.exe
  2⤵
  PID:5800
- C:\Windows\System\JRNTuEB.exe
  C:\Windows\System\JRNTuEB.exe
  2⤵
  PID:5888
- C:\Windows\System\yfpsGCh.exe
  C:\Windows\System\yfpsGCh.exe
  2⤵
  PID:1312
- C:\Windows\System\OGqFukf.exe
  C:\Windows\System\OGqFukf.exe
  2⤵
  PID:4328
- C:\Windows\System\HhABdqi.exe
  C:\Windows\System\HhABdqi.exe
  2⤵
  PID:5196
- C:\Windows\System\bZglsxW.exe
  C:\Windows\System\bZglsxW.exe
  2⤵
  PID:4104
- C:\Windows\System\pqytzme.exe
  C:\Windows\System\pqytzme.exe
  2⤵
  PID:4464
- C:\Windows\System\EzrbWnZ.exe
  C:\Windows\System\EzrbWnZ.exe
  2⤵
  PID:4164
- C:\Windows\System\SPhpCDu.exe
  C:\Windows\System\SPhpCDu.exe
  2⤵
  PID:1600
- C:\Windows\System\hozbpRX.exe
  C:\Windows\System\hozbpRX.exe
  2⤵
  PID:6156
- C:\Windows\System\YHLjnNk.exe
  C:\Windows\System\YHLjnNk.exe
  2⤵
  PID:6180
- C:\Windows\System\rYSUaev.exe
  C:\Windows\System\rYSUaev.exe
  2⤵
  PID:6196
- C:\Windows\System\sZWCJsV.exe
  C:\Windows\System\sZWCJsV.exe
  2⤵
  PID:6224
- C:\Windows\System\jMXLuiF.exe
  C:\Windows\System\jMXLuiF.exe
  2⤵
  PID:6244
- C:\Windows\System\EsjWuHz.exe
  C:\Windows\System\EsjWuHz.exe
  2⤵
  PID:6264
- C:\Windows\System\ontOnSw.exe
  C:\Windows\System\ontOnSw.exe
  2⤵
  PID:6284
- C:\Windows\System\fMwONTl.exe
  C:\Windows\System\fMwONTl.exe
  2⤵
  PID:6304
- C:\Windows\System\HnQIqhi.exe
  C:\Windows\System\HnQIqhi.exe
  2⤵
  PID:6328
- C:\Windows\System\cufyjGw.exe
  C:\Windows\System\cufyjGw.exe
  2⤵
  PID:6344
- C:\Windows\System\AuXaqOI.exe
  C:\Windows\System\AuXaqOI.exe
  2⤵
  PID:6368
- C:\Windows\System\uxhsfkJ.exe
  C:\Windows\System\uxhsfkJ.exe
  2⤵
  PID:6392
- C:\Windows\System\QnuQvUk.exe
  C:\Windows\System\QnuQvUk.exe
  2⤵
  PID:6408
- C:\Windows\System\gKPQDKN.exe
  C:\Windows\System\gKPQDKN.exe
  2⤵
  PID:6436
- C:\Windows\System\kPgLOxx.exe
  C:\Windows\System\kPgLOxx.exe
  2⤵
  PID:6452
- C:\Windows\System\wQHyZVv.exe
  C:\Windows\System\wQHyZVv.exe
  2⤵
  PID:6480
- C:\Windows\System\IjPqdqZ.exe
  C:\Windows\System\IjPqdqZ.exe
  2⤵
  PID:6500
- C:\Windows\System\RupslTu.exe
  C:\Windows\System\RupslTu.exe
  2⤵
  PID:6524
- C:\Windows\System\leeOawP.exe
  C:\Windows\System\leeOawP.exe
  2⤵
  PID:6544
- C:\Windows\System\EuPCuMe.exe
  C:\Windows\System\EuPCuMe.exe
  2⤵
  PID:6568
- C:\Windows\System\JggVuPD.exe
  C:\Windows\System\JggVuPD.exe
  2⤵
  PID:6588
- C:\Windows\System\upxFExM.exe
  C:\Windows\System\upxFExM.exe
  2⤵
  PID:6612
- C:\Windows\System\LXoKANR.exe
  C:\Windows\System\LXoKANR.exe
  2⤵
  PID:6632
- C:\Windows\System\YHweacT.exe
  C:\Windows\System\YHweacT.exe
  2⤵
  PID:6660
- C:\Windows\System\xpGJmvL.exe
  C:\Windows\System\xpGJmvL.exe
  2⤵
  PID:6680
- C:\Windows\System\stKpAhL.exe
  C:\Windows\System\stKpAhL.exe
  2⤵
  PID:6700
- C:\Windows\System\dJocqbT.exe
  C:\Windows\System\dJocqbT.exe
  2⤵
  PID:6724
- C:\Windows\System\lQqtWxr.exe
  C:\Windows\System\lQqtWxr.exe
  2⤵
  PID:6752
- C:\Windows\System\bIueqMX.exe
  C:\Windows\System\bIueqMX.exe
  2⤵
  PID:6780
- C:\Windows\System\eNxSJpp.exe
  C:\Windows\System\eNxSJpp.exe
  2⤵
  PID:6796
- C:\Windows\System\xYMffwc.exe
  C:\Windows\System\xYMffwc.exe
  2⤵
  PID:6820
- C:\Windows\System\fokAYPy.exe
  C:\Windows\System\fokAYPy.exe
  2⤵
  PID:6840
- C:\Windows\System\fkJMOiO.exe
  C:\Windows\System\fkJMOiO.exe
  2⤵
  PID:6860
- C:\Windows\System\LdNNnXi.exe
  C:\Windows\System\LdNNnXi.exe
  2⤵
  PID:6880
- C:\Windows\System\vyfBade.exe
  C:\Windows\System\vyfBade.exe
  2⤵
  PID:6900
- C:\Windows\System\xxfEcGg.exe
  C:\Windows\System\xxfEcGg.exe
  2⤵
  PID:6924
- C:\Windows\System\DpjCfeu.exe
  C:\Windows\System\DpjCfeu.exe
  2⤵
  PID:6944
- C:\Windows\System\PhwCXen.exe
  C:\Windows\System\PhwCXen.exe
  2⤵
  PID:6968
- C:\Windows\System\ULKyoaY.exe
  C:\Windows\System\ULKyoaY.exe
  2⤵
  PID:6988
- C:\Windows\System\dwBBBWJ.exe
  C:\Windows\System\dwBBBWJ.exe
  2⤵
  PID:7008
- C:\Windows\System\GlSkBeM.exe
  C:\Windows\System\GlSkBeM.exe
  2⤵
  PID:7036
- C:\Windows\System\fzkzWjw.exe
  C:\Windows\System\fzkzWjw.exe
  2⤵
  PID:7052
- C:\Windows\System\XbLCPWF.exe
  C:\Windows\System\XbLCPWF.exe
  2⤵
  PID:7076
- C:\Windows\System\ROKKSxQ.exe
  C:\Windows\System\ROKKSxQ.exe
  2⤵
  PID:7096
- C:\Windows\System\SzRbGOo.exe
  C:\Windows\System\SzRbGOo.exe
  2⤵
  PID:7116
- C:\Windows\System\XiaiXxS.exe
  C:\Windows\System\XiaiXxS.exe
  2⤵
  PID:3868
- C:\Windows\System\KcdiAgy.exe
  C:\Windows\System\KcdiAgy.exe
  2⤵
  PID:5616
- C:\Windows\System\fIwtKcw.exe
  C:\Windows\System\fIwtKcw.exe
  2⤵
  PID:764
- C:\Windows\System\TNjbXcc.exe
  C:\Windows\System\TNjbXcc.exe
  2⤵
  PID:3220
- C:\Windows\System\BIMgSBj.exe
  C:\Windows\System\BIMgSBj.exe
  2⤵
  PID:1736
- C:\Windows\System\GEiWAri.exe
  C:\Windows\System\GEiWAri.exe
  2⤵
  PID:5608
- C:\Windows\System\KyWbKWu.exe
  C:\Windows\System\KyWbKWu.exe
  2⤵
  PID:3188
- C:\Windows\System\xrgbEUG.exe
  C:\Windows\System\xrgbEUG.exe
  2⤵
  PID:3008
- C:\Windows\System\pnMqvIU.exe
  C:\Windows\System\pnMqvIU.exe
  2⤵
  PID:6148
- C:\Windows\System\PfEikHR.exe
  C:\Windows\System\PfEikHR.exe
  2⤵
  PID:6604
- C:\Windows\System\uVWSCxW.exe
  C:\Windows\System\uVWSCxW.exe
  2⤵
  PID:6712
- C:\Windows\System\mBUxMFr.exe
  C:\Windows\System\mBUxMFr.exe
  2⤵
  PID:6260
- C:\Windows\System\cqrrUEr.exe
  C:\Windows\System\cqrrUEr.exe
  2⤵
  PID:6312
- C:\Windows\System\ptnWFMV.exe
  C:\Windows\System\ptnWFMV.exe
  2⤵
  PID:6364
- C:\Windows\System\YzVbSTO.exe
  C:\Windows\System\YzVbSTO.exe
  2⤵
  PID:6404
- C:\Windows\System\ZqcRufd.exe
  C:\Windows\System\ZqcRufd.exe
  2⤵
  PID:6124
- C:\Windows\System\cjtFtai.exe
  C:\Windows\System\cjtFtai.exe
  2⤵
  PID:212
- C:\Windows\System\McHTzyQ.exe
  C:\Windows\System\McHTzyQ.exe
  2⤵
  PID:6192
- C:\Windows\System\oenvYXv.exe
  C:\Windows\System\oenvYXv.exe
  2⤵
  PID:7072
- C:\Windows\System\PaCKEMs.exe
  C:\Windows\System\PaCKEMs.exe
  2⤵
  PID:6352
- C:\Windows\System\iBaUdXr.exe
  C:\Windows\System\iBaUdXr.exe
  2⤵
  PID:6444
- C:\Windows\System\yJrxyYT.exe
  C:\Windows\System\yJrxyYT.exe
  2⤵
  PID:6464
- C:\Windows\System\vdNnFjt.exe
  C:\Windows\System\vdNnFjt.exe
  2⤵
  PID:6856
- C:\Windows\System\jYmhOOq.exe
  C:\Windows\System\jYmhOOq.exe
  2⤵
  PID:6964
- C:\Windows\System\EHrlMrp.exe
  C:\Windows\System\EHrlMrp.exe
  2⤵
  PID:7188
- C:\Windows\System\PPlHwAi.exe
  C:\Windows\System\PPlHwAi.exe
  2⤵
  PID:7212
- C:\Windows\System\nEqcFAB.exe
  C:\Windows\System\nEqcFAB.exe
  2⤵
  PID:7228
- C:\Windows\System\RBfTRsd.exe
  C:\Windows\System\RBfTRsd.exe
  2⤵
  PID:7252
- C:\Windows\System\JYjqFeF.exe
  C:\Windows\System\JYjqFeF.exe
  2⤵
  PID:7272
- C:\Windows\System\mbbfRrZ.exe
  C:\Windows\System\mbbfRrZ.exe
  2⤵
  PID:7296
- C:\Windows\System\QWSUfHG.exe
  C:\Windows\System\QWSUfHG.exe
  2⤵
  PID:7320
- C:\Windows\System\LvaIeao.exe
  C:\Windows\System\LvaIeao.exe
  2⤵
  PID:7344
- C:\Windows\System\ZQHAbZm.exe
  C:\Windows\System\ZQHAbZm.exe
  2⤵
  PID:7364
- C:\Windows\System\gZCIeKb.exe
  C:\Windows\System\gZCIeKb.exe
  2⤵
  PID:7392
- C:\Windows\System\pnYOXgE.exe
  C:\Windows\System\pnYOXgE.exe
  2⤵
  PID:7412
- C:\Windows\System\hfdEgdd.exe
  C:\Windows\System\hfdEgdd.exe
  2⤵
  PID:7428
- C:\Windows\System\DIvsgXE.exe
  C:\Windows\System\DIvsgXE.exe
  2⤵
  PID:7452
- C:\Windows\System\teyQHYD.exe
  C:\Windows\System\teyQHYD.exe
  2⤵
  PID:7472
- C:\Windows\System\PIlEuAe.exe
  C:\Windows\System\PIlEuAe.exe
  2⤵
  PID:7496
- C:\Windows\System\ddfqySc.exe
  C:\Windows\System\ddfqySc.exe
  2⤵
  PID:7516
- C:\Windows\System\MhzgPpF.exe
  C:\Windows\System\MhzgPpF.exe
  2⤵
  PID:7532
- C:\Windows\System\DXkWtRX.exe
  C:\Windows\System\DXkWtRX.exe
  2⤵
  PID:7556
- C:\Windows\System\HesixHC.exe
  C:\Windows\System\HesixHC.exe
  2⤵
  PID:7576
- C:\Windows\System\lEPbsZw.exe
  C:\Windows\System\lEPbsZw.exe
  2⤵
  PID:7600
- C:\Windows\System\JVeBGNE.exe
  C:\Windows\System\JVeBGNE.exe
  2⤵
  PID:7624
- C:\Windows\System\YdkHGRt.exe
  C:\Windows\System\YdkHGRt.exe
  2⤵
  PID:7644
- C:\Windows\System\CvywRsD.exe
  C:\Windows\System\CvywRsD.exe
  2⤵
  PID:7668
- C:\Windows\System\VbAjITN.exe
  C:\Windows\System\VbAjITN.exe
  2⤵
  PID:7684
- C:\Windows\System\ralTKxT.exe
  C:\Windows\System\ralTKxT.exe
  2⤵
  PID:7708
- C:\Windows\System\xXOslFa.exe
  C:\Windows\System\xXOslFa.exe
  2⤵
  PID:7740
- C:\Windows\System\SFvhorB.exe
  C:\Windows\System\SFvhorB.exe
  2⤵
  PID:7760
- C:\Windows\System\igjoenX.exe
  C:\Windows\System\igjoenX.exe
  2⤵
  PID:7780
- C:\Windows\System\vRCxgIu.exe
  C:\Windows\System\vRCxgIu.exe
  2⤵
  PID:7796
- C:\Windows\System\NnpOJTw.exe
  C:\Windows\System\NnpOJTw.exe
  2⤵
  PID:7820
- C:\Windows\System\PYXRjRq.exe
  C:\Windows\System\PYXRjRq.exe
  2⤵
  PID:7840
- C:\Windows\System\EdmzqKU.exe
  C:\Windows\System\EdmzqKU.exe
  2⤵
  PID:7860
- C:\Windows\System\PdvXwcR.exe
  C:\Windows\System\PdvXwcR.exe
  2⤵
  PID:7884
- C:\Windows\System\iGPCbnf.exe
  C:\Windows\System\iGPCbnf.exe
  2⤵
  PID:7904
- C:\Windows\System\JJORRwg.exe
  C:\Windows\System\JJORRwg.exe
  2⤵
  PID:7928
- C:\Windows\System\fnqPItJ.exe
  C:\Windows\System\fnqPItJ.exe
  2⤵
  PID:7944
- C:\Windows\System\PZSMsNh.exe
  C:\Windows\System\PZSMsNh.exe
  2⤵
  PID:7968
- C:\Windows\System\uFyZnRa.exe
  C:\Windows\System\uFyZnRa.exe
  2⤵
  PID:7996
- C:\Windows\System\sdKoPKB.exe
  C:\Windows\System\sdKoPKB.exe
  2⤵
  PID:8020
- C:\Windows\System\IPfXSZn.exe
  C:\Windows\System\IPfXSZn.exe
  2⤵
  PID:8044
- C:\Windows\System\akYJDhV.exe
  C:\Windows\System\akYJDhV.exe
  2⤵
  PID:8072
- C:\Windows\System\ZeJlpzn.exe
  C:\Windows\System\ZeJlpzn.exe
  2⤵
  PID:8088
- C:\Windows\System\DpKNHOy.exe
  C:\Windows\System\DpKNHOy.exe
  2⤵
  PID:8116
- C:\Windows\System\tmwIHmt.exe
  C:\Windows\System\tmwIHmt.exe
  2⤵
  PID:8136
- C:\Windows\System\FdLLXtC.exe
  C:\Windows\System\FdLLXtC.exe
  2⤵
  PID:8160
- C:\Windows\System\doPcIWR.exe
  C:\Windows\System\doPcIWR.exe
  2⤵
  PID:8180
- C:\Windows\System\oQyZSys.exe
  C:\Windows\System\oQyZSys.exe
  2⤵
  PID:6984
- C:\Windows\System\nXHqDiM.exe
  C:\Windows\System\nXHqDiM.exe
  2⤵
  PID:2524
- C:\Windows\System\gZOnsLW.exe
  C:\Windows\System\gZOnsLW.exe
  2⤵
  PID:7044
- C:\Windows\System\AekiUDk.exe
  C:\Windows\System\AekiUDk.exe
  2⤵
  PID:6812
- C:\Windows\System\tpcSqFr.exe
  C:\Windows\System\tpcSqFr.exe
  2⤵
  PID:5848
- C:\Windows\System\tvCIuTK.exe
  C:\Windows\System\tvCIuTK.exe
  2⤵
  PID:6836
- C:\Windows\System\JWOcjmM.exe
  C:\Windows\System\JWOcjmM.exe
  2⤵
  PID:7084
- C:\Windows\System\iHPfXFL.exe
  C:\Windows\System\iHPfXFL.exe
  2⤵
  PID:7244
- C:\Windows\System\DUpVTZD.exe
  C:\Windows\System\DUpVTZD.exe
  2⤵
  PID:7468
- C:\Windows\System\mtdXtUD.exe
  C:\Windows\System\mtdXtUD.exe
  2⤵
  PID:7504
- C:\Windows\System\IkWSeDh.exe
  C:\Windows\System\IkWSeDh.exe
  2⤵
  PID:6788
- C:\Windows\System\MXzOGxF.exe
  C:\Windows\System\MXzOGxF.exe
  2⤵
  PID:7584
- C:\Windows\System\GuGrrjT.exe
  C:\Windows\System\GuGrrjT.exe
  2⤵
  PID:5884
- C:\Windows\System\uYogeEq.exe
  C:\Windows\System\uYogeEq.exe
  2⤵
  PID:392
- C:\Windows\System\sdPwtXo.exe
  C:\Windows\System\sdPwtXo.exe
  2⤵
  PID:7620
- C:\Windows\System\raLSEXA.exe
  C:\Windows\System\raLSEXA.exe
  2⤵
  PID:7640
- C:\Windows\System\cQqEAqx.exe
  C:\Windows\System\cQqEAqx.exe
  2⤵
  PID:7656
- C:\Windows\System\yqaJDCu.exe
  C:\Windows\System\yqaJDCu.exe
  2⤵
  PID:6772
- C:\Windows\System\dkIvPZk.exe
  C:\Windows\System\dkIvPZk.exe
  2⤵
  PID:7816
- C:\Windows\System\PcvHCUH.exe
  C:\Windows\System\PcvHCUH.exe
  2⤵
  PID:7984
- C:\Windows\System\PNAImgL.exe
  C:\Windows\System\PNAImgL.exe
  2⤵
  PID:7184
- C:\Windows\System\MLEXALQ.exe
  C:\Windows\System\MLEXALQ.exe
  2⤵
  PID:8040
- C:\Windows\System\BLkJIyM.exe
  C:\Windows\System\BLkJIyM.exe
  2⤵
  PID:8080
- C:\Windows\System\uSBUzAW.exe
  C:\Windows\System\uSBUzAW.exe
  2⤵
  PID:8208
- C:\Windows\System\wjKoRfY.exe
  C:\Windows\System\wjKoRfY.exe
  2⤵
  PID:8228
- C:\Windows\System\BvXhLTj.exe
  C:\Windows\System\BvXhLTj.exe
  2⤵
  PID:8252
- C:\Windows\System\jBGjvdU.exe
  C:\Windows\System\jBGjvdU.exe
  2⤵
  PID:8272
- C:\Windows\System\bnwYFTP.exe
  C:\Windows\System\bnwYFTP.exe
  2⤵
  PID:8292
- C:\Windows\System\zfqtySg.exe
  C:\Windows\System\zfqtySg.exe
  2⤵
  PID:8316
- C:\Windows\System\ouBiWWa.exe
  C:\Windows\System\ouBiWWa.exe
  2⤵
  PID:8336
- C:\Windows\System\VcnKoTN.exe
  C:\Windows\System\VcnKoTN.exe
  2⤵
  PID:8352
- C:\Windows\System\WypiKAg.exe
  C:\Windows\System\WypiKAg.exe
  2⤵
  PID:8372
- C:\Windows\System\MqNaKoe.exe
  C:\Windows\System\MqNaKoe.exe
  2⤵
  PID:8388
- C:\Windows\System\oPOgQoX.exe
  C:\Windows\System\oPOgQoX.exe
  2⤵
  PID:8412
- C:\Windows\System\pEYvRXj.exe
  C:\Windows\System\pEYvRXj.exe
  2⤵
  PID:8436
- C:\Windows\System\OlQgsEX.exe
  C:\Windows\System\OlQgsEX.exe
  2⤵
  PID:8456
- C:\Windows\System\uftYGlC.exe
  C:\Windows\System\uftYGlC.exe
  2⤵
  PID:8480
- C:\Windows\System\rKhuObK.exe
  C:\Windows\System\rKhuObK.exe
  2⤵
  PID:8500
- C:\Windows\System\XlXzTQt.exe
  C:\Windows\System\XlXzTQt.exe
  2⤵
  PID:8528
- C:\Windows\System\mJziylv.exe
  C:\Windows\System\mJziylv.exe
  2⤵
  PID:8548
- C:\Windows\System\qyhAMRk.exe
  C:\Windows\System\qyhAMRk.exe
  2⤵
  PID:8572
- C:\Windows\System\CebGRiv.exe
  C:\Windows\System\CebGRiv.exe
  2⤵
  PID:8592
- C:\Windows\System\aCsnzKt.exe
  C:\Windows\System\aCsnzKt.exe
  2⤵
  PID:8612
- C:\Windows\System\luZjRib.exe
  C:\Windows\System\luZjRib.exe
  2⤵
  PID:8632
- C:\Windows\System\ScScqCf.exe
  C:\Windows\System\ScScqCf.exe
  2⤵
  PID:8656
- C:\Windows\System\uGYVLSF.exe
  C:\Windows\System\uGYVLSF.exe
  2⤵
  PID:8676
- C:\Windows\System\vbioLwk.exe
  C:\Windows\System\vbioLwk.exe
  2⤵
  PID:8696
- C:\Windows\System\BramIKH.exe
  C:\Windows\System\BramIKH.exe
  2⤵
  PID:8716
- C:\Windows\System\WfuuilR.exe
  C:\Windows\System\WfuuilR.exe
  2⤵
  PID:8736
- C:\Windows\System\dtibitl.exe
  C:\Windows\System\dtibitl.exe
  2⤵
  PID:8760
- C:\Windows\System\FEcDcIQ.exe
  C:\Windows\System\FEcDcIQ.exe
  2⤵
  PID:8784
- C:\Windows\System\fmhNhHl.exe
  C:\Windows\System\fmhNhHl.exe
  2⤵
  PID:8804
- C:\Windows\System\RuXWQOR.exe
  C:\Windows\System\RuXWQOR.exe
  2⤵
  PID:8820
- C:\Windows\System\ZkVDDdu.exe
  C:\Windows\System\ZkVDDdu.exe
  2⤵
  PID:8848
- C:\Windows\System\cBdoAGj.exe
  C:\Windows\System\cBdoAGj.exe
  2⤵
  PID:8864
- C:\Windows\System\HTvAHlb.exe
  C:\Windows\System\HTvAHlb.exe
  2⤵
  PID:8884
- C:\Windows\System\FoKOMNn.exe
  C:\Windows\System\FoKOMNn.exe
  2⤵
  PID:8912
- C:\Windows\System\KvuKocG.exe
  C:\Windows\System\KvuKocG.exe
  2⤵
  PID:8928
- C:\Windows\System\sYEJniK.exe
  C:\Windows\System\sYEJniK.exe
  2⤵
  PID:8952
- C:\Windows\System\wIyGcBy.exe
  C:\Windows\System\wIyGcBy.exe
  2⤵
  PID:8972
- C:\Windows\System\KYtitwg.exe
  C:\Windows\System\KYtitwg.exe
  2⤵
  PID:8996
- C:\Windows\System\RDcUgNK.exe
  C:\Windows\System\RDcUgNK.exe
  2⤵
  PID:9020
- C:\Windows\System\xwHAvwc.exe
  C:\Windows\System\xwHAvwc.exe
  2⤵
  PID:9048
- C:\Windows\System\ZDIejjc.exe
  C:\Windows\System\ZDIejjc.exe
  2⤵
  PID:9068
- C:\Windows\System\syYnivv.exe
  C:\Windows\System\syYnivv.exe
  2⤵
  PID:9088
- C:\Windows\System\krmUUMZ.exe
  C:\Windows\System\krmUUMZ.exe
  2⤵
  PID:9112
- C:\Windows\System\BumYkHA.exe
  C:\Windows\System\BumYkHA.exe
  2⤵
  PID:9136
- C:\Windows\System\dKJXleK.exe
  C:\Windows\System\dKJXleK.exe
  2⤵
  PID:9156
- C:\Windows\System\guEJAdj.exe
  C:\Windows\System\guEJAdj.exe
  2⤵
  PID:9172
- C:\Windows\System\OxaWbGe.exe
  C:\Windows\System\OxaWbGe.exe
  2⤵
  PID:9192
- C:\Windows\System\CHBPBHr.exe
  C:\Windows\System\CHBPBHr.exe
  2⤵
  PID:8132
- C:\Windows\System\YsFcsQi.exe
  C:\Windows\System\YsFcsQi.exe
  2⤵
  PID:7568
- C:\Windows\System\bIjrvkQ.exe
  C:\Windows\System\bIjrvkQ.exe
  2⤵
  PID:6236
- C:\Windows\System\MmSbmwI.exe
  C:\Windows\System\MmSbmwI.exe
  2⤵
  PID:6028
- C:\Windows\System\BHOujVS.exe
  C:\Windows\System\BHOujVS.exe
  2⤵
  PID:7004
- C:\Windows\System\kMEiHba.exe
  C:\Windows\System\kMEiHba.exe
  2⤵
  PID:7852
- C:\Windows\System\PzSBzlO.exe
  C:\Windows\System\PzSBzlO.exe
  2⤵
  PID:7524
- C:\Windows\System\jcwmwZE.exe
  C:\Windows\System\jcwmwZE.exe
  2⤵
  PID:2440
- C:\Windows\System\RlMRjDT.exe
  C:\Windows\System\RlMRjDT.exe
  2⤵
  PID:6460
- C:\Windows\System\KyRnvbh.exe
  C:\Windows\System\KyRnvbh.exe
  2⤵
  PID:5512
- C:\Windows\System\SGieXeu.exe
  C:\Windows\System\SGieXeu.exe
  2⤵
  PID:7220
- C:\Windows\System\hlTPScR.exe
  C:\Windows\System\hlTPScR.exe
  2⤵
  PID:7284
- C:\Windows\System\jVheJDH.exe
  C:\Windows\System\jVheJDH.exe
  2⤵
  PID:6388
- C:\Windows\System\ODpdiTO.exe
  C:\Windows\System\ODpdiTO.exe
  2⤵
  PID:7248
- C:\Windows\System\awgzGXQ.exe
  C:\Windows\System\awgzGXQ.exe
  2⤵
  PID:8064
- C:\Windows\System\ZLYXqUQ.exe
  C:\Windows\System\ZLYXqUQ.exe
  2⤵
  PID:7408
- C:\Windows\System\NzBGwVi.exe
  C:\Windows\System\NzBGwVi.exe
  2⤵
  PID:7460
- C:\Windows\System\YxlCAiF.exe
  C:\Windows\System\YxlCAiF.exe
  2⤵
  PID:8236
- C:\Windows\System\ivlAUVD.exe
  C:\Windows\System\ivlAUVD.exe
  2⤵
  PID:8364
- C:\Windows\System\ncMZBjA.exe
  C:\Windows\System\ncMZBjA.exe
  2⤵
  PID:8408
- C:\Windows\System\zdQnzKj.exe
  C:\Windows\System\zdQnzKj.exe
  2⤵
  PID:8188
- C:\Windows\System\mKTCtSh.exe
  C:\Windows\System\mKTCtSh.exe
  2⤵
  PID:8524
- C:\Windows\System\wgJFnQu.exe
  C:\Windows\System\wgJFnQu.exe
  2⤵
  PID:8560
- C:\Windows\System\UMYNEHP.exe
  C:\Windows\System\UMYNEHP.exe
  2⤵
  PID:9232
- C:\Windows\System\uNHqapg.exe
  C:\Windows\System\uNHqapg.exe
  2⤵
  PID:9256
- C:\Windows\System\lkncytd.exe
  C:\Windows\System\lkncytd.exe
  2⤵
  PID:9280
- C:\Windows\System\SHlUOCE.exe
  C:\Windows\System\SHlUOCE.exe
  2⤵
  PID:9296
- C:\Windows\System\PPlBfdB.exe
  C:\Windows\System\PPlBfdB.exe
  2⤵
  PID:9320
- C:\Windows\System\vXHqjdN.exe
  C:\Windows\System\vXHqjdN.exe
  2⤵
  PID:9344
- C:\Windows\System\xgVlsLZ.exe
  C:\Windows\System\xgVlsLZ.exe
  2⤵
  PID:9360
- C:\Windows\System\kkvAkum.exe
  C:\Windows\System\kkvAkum.exe
  2⤵
  PID:9384
- C:\Windows\System\WAbNvXM.exe
  C:\Windows\System\WAbNvXM.exe
  2⤵
  PID:9408
- C:\Windows\System\UTsUVnX.exe
  C:\Windows\System\UTsUVnX.exe
  2⤵
  PID:9424
- C:\Windows\System\BIEdeOq.exe
  C:\Windows\System\BIEdeOq.exe
  2⤵
  PID:9448
- C:\Windows\System\jIOQKau.exe
  C:\Windows\System\jIOQKau.exe
  2⤵
  PID:9472
- C:\Windows\System\jnWoeEr.exe
  C:\Windows\System\jnWoeEr.exe
  2⤵
  PID:9488
- C:\Windows\System\OtxYAts.exe
  C:\Windows\System\OtxYAts.exe
  2⤵
  PID:9508
- C:\Windows\System\tboFTZy.exe
  C:\Windows\System\tboFTZy.exe
  2⤵
  PID:9536
- C:\Windows\System\FfONmwL.exe
  C:\Windows\System\FfONmwL.exe
  2⤵
  PID:9556
- C:\Windows\System\oYUZDNj.exe
  C:\Windows\System\oYUZDNj.exe
  2⤵
  PID:9576
- C:\Windows\System\CeDkHbV.exe
  C:\Windows\System\CeDkHbV.exe
  2⤵
  PID:9600
- C:\Windows\System\mKWoqvq.exe
  C:\Windows\System\mKWoqvq.exe
  2⤵
  PID:9620
- C:\Windows\System\nZPfFGZ.exe
  C:\Windows\System\nZPfFGZ.exe
  2⤵
  PID:9640
- C:\Windows\System\OPXkILt.exe
  C:\Windows\System\OPXkILt.exe
  2⤵
  PID:9664
- C:\Windows\System\wSUIYhI.exe
  C:\Windows\System\wSUIYhI.exe
  2⤵
  PID:9688
- C:\Windows\System\UrLaHSN.exe
  C:\Windows\System\UrLaHSN.exe
  2⤵
  PID:9712
- C:\Windows\System\gVYCYvy.exe
  C:\Windows\System\gVYCYvy.exe
  2⤵
  PID:9732
- C:\Windows\System\dsibxCd.exe
  C:\Windows\System\dsibxCd.exe
  2⤵
  PID:9756
- C:\Windows\System\LuQmpKB.exe
  C:\Windows\System\LuQmpKB.exe
  2⤵
  PID:9776
- C:\Windows\System\pDPkneO.exe
  C:\Windows\System\pDPkneO.exe
  2⤵
  PID:9800
- C:\Windows\System\TFYEYRu.exe
  C:\Windows\System\TFYEYRu.exe
  2⤵
  PID:9820
- C:\Windows\System\whtbXRK.exe
  C:\Windows\System\whtbXRK.exe
  2⤵
  PID:9844
- C:\Windows\System\TMzoDff.exe
  C:\Windows\System\TMzoDff.exe
  2⤵
  PID:9872
- C:\Windows\System\jcMhNWQ.exe
  C:\Windows\System\jcMhNWQ.exe
  2⤵
  PID:9896
- C:\Windows\System\dkkyFBn.exe
  C:\Windows\System\dkkyFBn.exe
  2⤵
  PID:9916
- C:\Windows\System\aCCxvpD.exe
  C:\Windows\System\aCCxvpD.exe
  2⤵
  PID:9940
- C:\Windows\System\wjnkvKk.exe
  C:\Windows\System\wjnkvKk.exe
  2⤵
  PID:9964
- C:\Windows\System\zBvMulA.exe
  C:\Windows\System\zBvMulA.exe
  2⤵
  PID:9980
- C:\Windows\System\RHBuFNz.exe
  C:\Windows\System\RHBuFNz.exe
  2⤵
  PID:10008
- C:\Windows\System\wNysqcE.exe
  C:\Windows\System\wNysqcE.exe
  2⤵
  PID:10024
- C:\Windows\System\YechcJj.exe
  C:\Windows\System\YechcJj.exe
  2⤵
  PID:10048
- C:\Windows\System\OLCmQwS.exe
  C:\Windows\System\OLCmQwS.exe
  2⤵
  PID:10072
- C:\Windows\System\qtjaDTu.exe
  C:\Windows\System\qtjaDTu.exe
  2⤵
  PID:10088
- C:\Windows\System\UKptIai.exe
  C:\Windows\System\UKptIai.exe
  2⤵
  PID:10116
- C:\Windows\System\bRpwnPh.exe
  C:\Windows\System\bRpwnPh.exe
  2⤵
  PID:10132
- C:\Windows\System\QAlpmnR.exe
  C:\Windows\System\QAlpmnR.exe
  2⤵
  PID:10152
- C:\Windows\System\VsIpwQK.exe
  C:\Windows\System\VsIpwQK.exe
  2⤵
  PID:10172
- C:\Windows\System\MnMhFQs.exe
  C:\Windows\System\MnMhFQs.exe
  2⤵
  PID:10192
- C:\Windows\System\lONfrAX.exe
  C:\Windows\System\lONfrAX.exe
  2⤵
  PID:10212
- C:\Windows\System\cdCslsI.exe
  C:\Windows\System\cdCslsI.exe
  2⤵
  PID:10236
- C:\Windows\System\ghihpfk.exe
  C:\Windows\System\ghihpfk.exe
  2⤵
  PID:6172
- C:\Windows\System\uozpmrj.exe
  C:\Windows\System\uozpmrj.exe
  2⤵
  PID:6240
- C:\Windows\System\ifBFuex.exe
  C:\Windows\System\ifBFuex.exe
  2⤵
  PID:7776
- C:\Windows\System\uRRQRwr.exe
  C:\Windows\System\uRRQRwr.exe
  2⤵
  PID:8712
- C:\Windows\System\KwQLFcQ.exe
  C:\Windows\System\KwQLFcQ.exe
  2⤵
  PID:6872
- C:\Windows\System\HhMEfVy.exe
  C:\Windows\System\HhMEfVy.exe
  2⤵
  PID:8856
- C:\Windows\System\wlkZSCX.exe
  C:\Windows\System\wlkZSCX.exe
  2⤵
  PID:8988
- C:\Windows\System\ojTxsqL.exe
  C:\Windows\System\ojTxsqL.exe
  2⤵
  PID:9060
- C:\Windows\System\JbMDqZL.exe
  C:\Windows\System\JbMDqZL.exe
  2⤵
  PID:9100
- C:\Windows\System\sfrqgRB.exe
  C:\Windows\System\sfrqgRB.exe
  2⤵
  PID:9144
- C:\Windows\System\xxzQKfD.exe
  C:\Windows\System\xxzQKfD.exe
  2⤵
  PID:8244
- C:\Windows\System\nXFHueb.exe
  C:\Windows\System\nXFHueb.exe
  2⤵
  PID:8264
- C:\Windows\System\JKrcqnO.exe
  C:\Windows\System\JKrcqnO.exe
  2⤵
  PID:7920
- C:\Windows\System\JnuzpOM.exe
  C:\Windows\System\JnuzpOM.exe
  2⤵
  PID:7952
- C:\Windows\System\plsGKpO.exe
  C:\Windows\System\plsGKpO.exe
  2⤵
  PID:10248
- C:\Windows\System\cLLSiNv.exe
  C:\Windows\System\cLLSiNv.exe
  2⤵
  PID:10268
- C:\Windows\System\pfoECQD.exe
  C:\Windows\System\pfoECQD.exe
  2⤵
  PID:10296
- C:\Windows\System\yVCLyGZ.exe
  C:\Windows\System\yVCLyGZ.exe
  2⤵
  PID:10316
- C:\Windows\System\PrwlGLS.exe
  C:\Windows\System\PrwlGLS.exe
  2⤵
  PID:10336
- C:\Windows\System\WiMGdoz.exe
  C:\Windows\System\WiMGdoz.exe
  2⤵
  PID:10360
- C:\Windows\System\TrHPZxm.exe
  C:\Windows\System\TrHPZxm.exe
  2⤵
  PID:10380
- C:\Windows\System\FrdgUty.exe
  C:\Windows\System\FrdgUty.exe
  2⤵
  PID:10396
- C:\Windows\System\GoRtVVE.exe
  C:\Windows\System\GoRtVVE.exe
  2⤵
  PID:10420
- C:\Windows\System\oQzPiEj.exe
  C:\Windows\System\oQzPiEj.exe
  2⤵
  PID:10444
- C:\Windows\System\WLRiUWo.exe
  C:\Windows\System\WLRiUWo.exe
  2⤵
  PID:10464
- C:\Windows\System\zUHAska.exe
  C:\Windows\System\zUHAska.exe
  2⤵
  PID:10488
- C:\Windows\System\QmaeQpN.exe
  C:\Windows\System\QmaeQpN.exe
  2⤵
  PID:10508
- C:\Windows\System\FhQZxbK.exe
  C:\Windows\System\FhQZxbK.exe
  2⤵
  PID:10532
- C:\Windows\System\lkvVgZo.exe
  C:\Windows\System\lkvVgZo.exe
  2⤵
  PID:10556
- C:\Windows\System\cFKLGJq.exe
  C:\Windows\System\cFKLGJq.exe
  2⤵
  PID:10576
- C:\Windows\System\knlsYBn.exe
  C:\Windows\System\knlsYBn.exe
  2⤵
  PID:10600
- C:\Windows\System\QRYwuAk.exe
  C:\Windows\System\QRYwuAk.exe
  2⤵
  PID:10620
- C:\Windows\System\joKULOh.exe
  C:\Windows\System\joKULOh.exe
  2⤵
  PID:10644
- C:\Windows\System\gNKqCGC.exe
  C:\Windows\System\gNKqCGC.exe
  2⤵
  PID:10664
- C:\Windows\System\drJTFeQ.exe
  C:\Windows\System\drJTFeQ.exe
  2⤵
  PID:10688
- C:\Windows\System\NFcxYdf.exe
  C:\Windows\System\NFcxYdf.exe
  2⤵
  PID:10704
- C:\Windows\System\GyCZbox.exe
  C:\Windows\System\GyCZbox.exe
  2⤵
  PID:10720
- C:\Windows\System\StxvLkz.exe
  C:\Windows\System\StxvLkz.exe
  2⤵
  PID:10736
- C:\Windows\System\RQKhgzU.exe
  C:\Windows\System\RQKhgzU.exe
  2⤵
  PID:10760
- C:\Windows\System\YRSxgsY.exe
  C:\Windows\System\YRSxgsY.exe
  2⤵
  PID:10784
- C:\Windows\System\TJLfhvV.exe
  C:\Windows\System\TJLfhvV.exe
  2⤵
  PID:10804
- C:\Windows\System\mHKifYM.exe
  C:\Windows\System\mHKifYM.exe
  2⤵
  PID:10824
- C:\Windows\System\DopZsWJ.exe
  C:\Windows\System\DopZsWJ.exe
  2⤵
  PID:10844
- C:\Windows\System\JTyjCwp.exe
  C:\Windows\System\JTyjCwp.exe
  2⤵
  PID:10872
- C:\Windows\System\vKRmUGy.exe
  C:\Windows\System\vKRmUGy.exe
  2⤵
  PID:10900
- C:\Windows\System\KMuVsaK.exe
  C:\Windows\System\KMuVsaK.exe
  2⤵
  PID:10916
- C:\Windows\System\XzIsyaM.exe
  C:\Windows\System\XzIsyaM.exe
  2⤵
  PID:10936
- C:\Windows\System\BOaWgyd.exe
  C:\Windows\System\BOaWgyd.exe
  2⤵
  PID:10956
- C:\Windows\System\TxvrvlO.exe
  C:\Windows\System\TxvrvlO.exe
  2⤵
  PID:10984
- C:\Windows\System\dxTBDet.exe
  C:\Windows\System\dxTBDet.exe
  2⤵
  PID:11004
- C:\Windows\System\aIAdGrk.exe
  C:\Windows\System\aIAdGrk.exe
  2⤵
  PID:11028
- C:\Windows\System\myhipwE.exe
  C:\Windows\System\myhipwE.exe
  2⤵
  PID:11048
- C:\Windows\System\EGEUYJz.exe
  C:\Windows\System\EGEUYJz.exe
  2⤵
  PID:11068
- C:\Windows\System\QMHVKQC.exe
  C:\Windows\System\QMHVKQC.exe
  2⤵
  PID:11096
- C:\Windows\System\ddxqPna.exe
  C:\Windows\System\ddxqPna.exe
  2⤵
  PID:11116
- C:\Windows\System\OuooFEp.exe
  C:\Windows\System\OuooFEp.exe
  2⤵
  PID:11136
- C:\Windows\System\YsoeEBg.exe
  C:\Windows\System\YsoeEBg.exe
  2⤵
  PID:11156
- C:\Windows\System\kyqgNYs.exe
  C:\Windows\System\kyqgNYs.exe
  2⤵
  PID:11180
- C:\Windows\System\TVFokDy.exe
  C:\Windows\System\TVFokDy.exe
  2⤵
  PID:11204
- C:\Windows\System\ZIlLzLt.exe
  C:\Windows\System\ZIlLzLt.exe
  2⤵
  PID:11224
- C:\Windows\System\sSfDbas.exe
  C:\Windows\System\sSfDbas.exe
  2⤵
  PID:11244
- C:\Windows\System\Jtyxhqq.exe
  C:\Windows\System\Jtyxhqq.exe
  2⤵
  PID:6300
- C:\Windows\System\CcCYLUR.exe
  C:\Windows\System\CcCYLUR.exe
  2⤵
  PID:7316
- C:\Windows\System\LXUxBMd.exe
  C:\Windows\System\LXUxBMd.exe
  2⤵
  PID:7336
- C:\Windows\System\EELDFMo.exe
  C:\Windows\System\EELDFMo.exe
  2⤵
  PID:7204
- C:\Windows\System\SehUjyO.exe
  C:\Windows\System\SehUjyO.exe
  2⤵
  PID:6708
- C:\Windows\System\mWIXHny.exe
  C:\Windows\System\mWIXHny.exe
  2⤵
  PID:7924
- C:\Windows\System\UXpxvmN.exe
  C:\Windows\System\UXpxvmN.exe
  2⤵
  PID:10244
- C:\Windows\System\rAdQLvf.exe
  C:\Windows\System\rAdQLvf.exe
  2⤵
  PID:7404
- C:\Windows\System\ifSaZOV.exe
  C:\Windows\System\ifSaZOV.exe
  2⤵
  PID:8516
- C:\Windows\System\tHmAYPj.exe
  C:\Windows\System\tHmAYPj.exe
  2⤵
  PID:10480
- C:\Windows\System\njeDzIY.exe
  C:\Windows\System\njeDzIY.exe
  2⤵
  PID:9328
- C:\Windows\System\YIwuhfh.exe
  C:\Windows\System\YIwuhfh.exe
  2⤵
  PID:9420
- C:\Windows\System\cqoCCkm.exe
  C:\Windows\System\cqoCCkm.exe
  2⤵
  PID:11476
- C:\Windows\System\IwuNycS.exe
  C:\Windows\System\IwuNycS.exe
  2⤵
  PID:11500
- C:\Windows\System\AJXgrLj.exe
  C:\Windows\System\AJXgrLj.exe
  2⤵
  PID:11520
- C:\Windows\System\yAfJXfy.exe
  C:\Windows\System\yAfJXfy.exe
  2⤵
  PID:11540
- C:\Windows\System\CyUbrln.exe
  C:\Windows\System\CyUbrln.exe
  2⤵
  PID:11564
- C:\Windows\System\YrXmFYO.exe
  C:\Windows\System\YrXmFYO.exe
  2⤵
  PID:11584
- C:\Windows\System\iZMEVnP.exe
  C:\Windows\System\iZMEVnP.exe
  2⤵
  PID:11608
- C:\Windows\System\BCgFCkj.exe
  C:\Windows\System\BCgFCkj.exe
  2⤵
  PID:11624
- C:\Windows\System\eyOGDpk.exe
  C:\Windows\System\eyOGDpk.exe
  2⤵
  PID:11648
- C:\Windows\System\vSVFrPW.exe
  C:\Windows\System\vSVFrPW.exe
  2⤵
  PID:11668
- C:\Windows\System\sfXsnvC.exe
  C:\Windows\System\sfXsnvC.exe
  2⤵
  PID:11692
- C:\Windows\System\MPARAtc.exe
  C:\Windows\System\MPARAtc.exe
  2⤵
  PID:11712
- C:\Windows\System\PNidHtV.exe
  C:\Windows\System\PNidHtV.exe
  2⤵
  PID:11732
- C:\Windows\System\QlNguSo.exe
  C:\Windows\System\QlNguSo.exe
  2⤵
  PID:11760
- C:\Windows\System\qNhEutH.exe
  C:\Windows\System\qNhEutH.exe
  2⤵
  PID:11784
- C:\Windows\System\LfgSuVp.exe
  C:\Windows\System\LfgSuVp.exe
  2⤵
  PID:11804
- C:\Windows\System\yMejoqu.exe
  C:\Windows\System\yMejoqu.exe
  2⤵
  PID:11824
- C:\Windows\System\gKdGWtp.exe
  C:\Windows\System\gKdGWtp.exe
  2⤵
  PID:11844
- C:\Windows\System\rePQACj.exe
  C:\Windows\System\rePQACj.exe
  2⤵
  PID:11864
- C:\Windows\System\hUhFqBL.exe
  C:\Windows\System\hUhFqBL.exe
  2⤵
  PID:11884
- C:\Windows\System\oknsfhL.exe
  C:\Windows\System\oknsfhL.exe
  2⤵
  PID:11908
- C:\Windows\System\oMwdgqf.exe
  C:\Windows\System\oMwdgqf.exe
  2⤵
  PID:11932
- C:\Windows\System\TQZWaBx.exe
  C:\Windows\System\TQZWaBx.exe
  2⤵
  PID:11952
- C:\Windows\System\aKvFxqP.exe
  C:\Windows\System\aKvFxqP.exe
  2⤵
  PID:11972
- C:\Windows\System\RWbPtgO.exe
  C:\Windows\System\RWbPtgO.exe
  2⤵
  PID:11988
- C:\Windows\System\DUcYRLK.exe
  C:\Windows\System\DUcYRLK.exe
  2⤵
  PID:12004
- C:\Windows\System\yedCRgL.exe
  C:\Windows\System\yedCRgL.exe
  2⤵
  PID:12024
- C:\Windows\System\uqFGdfm.exe
  C:\Windows\System\uqFGdfm.exe
  2⤵
  PID:12048
- C:\Windows\System\iBvhYok.exe
  C:\Windows\System\iBvhYok.exe
  2⤵
  PID:12064
- C:\Windows\System\gwfevOF.exe
  C:\Windows\System\gwfevOF.exe
  2⤵
  PID:12088
- C:\Windows\System\sxdGqFa.exe
  C:\Windows\System\sxdGqFa.exe
  2⤵
  PID:12112
- C:\Windows\System\BnFPcaG.exe
  C:\Windows\System\BnFPcaG.exe
  2⤵
  PID:12132
- C:\Windows\System\VuQfIwr.exe
  C:\Windows\System\VuQfIwr.exe
  2⤵
  PID:12148
- C:\Windows\System\mbmDdUc.exe
  C:\Windows\System\mbmDdUc.exe
  2⤵
  PID:12168
- C:\Windows\System\vprjlbI.exe
  C:\Windows\System\vprjlbI.exe
  2⤵
  PID:12196
- C:\Windows\System\lJgMzQi.exe
  C:\Windows\System\lJgMzQi.exe
  2⤵
  PID:12212
- C:\Windows\System\vBuajaM.exe
  C:\Windows\System\vBuajaM.exe
  2⤵
  PID:12240
- C:\Windows\System\xZJUFGG.exe
  C:\Windows\System\xZJUFGG.exe
  2⤵
  PID:12256
- C:\Windows\System\zQxdgOU.exe
  C:\Windows\System\zQxdgOU.exe
  2⤵
  PID:12276
- C:\Windows\System\tjzTiYf.exe
  C:\Windows\System\tjzTiYf.exe
  2⤵
  PID:8332
- C:\Windows\System\JnbCuIw.exe
  C:\Windows\System\JnbCuIw.exe
  2⤵
  PID:10284
- C:\Windows\System\tRmAqjp.exe
  C:\Windows\System\tRmAqjp.exe
  2⤵
  PID:8036
- C:\Windows\System\rPlYUUZ.exe
  C:\Windows\System\rPlYUUZ.exe
  2⤵
  PID:10372
- C:\Windows\System\shefPVk.exe
  C:\Windows\System\shefPVk.exe
  2⤵
  PID:10412
- C:\Windows\System\YkAVDjr.exe
  C:\Windows\System\YkAVDjr.exe
  2⤵
  PID:9252
- C:\Windows\System\bPxTqGq.exe
  C:\Windows\System\bPxTqGq.exe
  2⤵
  PID:10528
- C:\Windows\System\mBOscFC.exe
  C:\Windows\System\mBOscFC.exe
  2⤵
  PID:10592
- C:\Windows\System\VglrLio.exe
  C:\Windows\System\VglrLio.exe
  2⤵
  PID:9392
- C:\Windows\System\FhSXNjV.exe
  C:\Windows\System\FhSXNjV.exe
  2⤵
  PID:10684
- C:\Windows\System\LleJiFt.exe
  C:\Windows\System\LleJiFt.exe
  2⤵
  PID:10768
- C:\Windows\System\wSzxkNe.exe
  C:\Windows\System\wSzxkNe.exe
  2⤵
  PID:10796
- C:\Windows\System\NzpubgA.exe
  C:\Windows\System\NzpubgA.exe
  2⤵
  PID:10812
- C:\Windows\System\NZRUfUi.exe
  C:\Windows\System\NZRUfUi.exe
  2⤵
  PID:9616
- C:\Windows\System\YtyZHJn.exe
  C:\Windows\System\YtyZHJn.exe
  2⤵
  PID:10968
- C:\Windows\System\ZjnAWvN.exe
  C:\Windows\System\ZjnAWvN.exe
  2⤵
  PID:10992
- C:\Windows\System\IAEDXkG.exe
  C:\Windows\System\IAEDXkG.exe
  2⤵
  PID:11064
- C:\Windows\System\EspeAHa.exe
  C:\Windows\System\EspeAHa.exe
  2⤵
  PID:9796
- C:\Windows\System\nWCLWgi.exe
  C:\Windows\System\nWCLWgi.exe
  2⤵
  PID:9740
- C:\Windows\System\TATnMqZ.exe
  C:\Windows\System\TATnMqZ.exe
  2⤵
  PID:8384
- C:\Windows\System\SExiYyC.exe
  C:\Windows\System\SExiYyC.exe
  2⤵
  PID:9864
- C:\Windows\System\LtcjNeX.exe
  C:\Windows\System\LtcjNeX.exe
  2⤵
  PID:12312
- C:\Windows\System\FByvtxg.exe
  C:\Windows\System\FByvtxg.exe
  2⤵
  PID:12336
- C:\Windows\System\VBmTARj.exe
  C:\Windows\System\VBmTARj.exe
  2⤵
  PID:12356
- C:\Windows\System\iKmPJLK.exe
  C:\Windows\System\iKmPJLK.exe
  2⤵
  PID:12376
- C:\Windows\System\yLInjAc.exe
  C:\Windows\System\yLInjAc.exe
  2⤵
  PID:12400
- C:\Windows\System\ffhoowQ.exe
  C:\Windows\System\ffhoowQ.exe
  2⤵
  PID:12428
- C:\Windows\System\qtDmrNX.exe
  C:\Windows\System\qtDmrNX.exe
  2⤵
  PID:12444
- C:\Windows\System\cmFphLK.exe
  C:\Windows\System\cmFphLK.exe
  2⤵
  PID:12476
- C:\Windows\System\DjcVbiw.exe
  C:\Windows\System\DjcVbiw.exe
  2⤵
  PID:12492
- C:\Windows\System\tVJSUhW.exe
  C:\Windows\System\tVJSUhW.exe
  2⤵
  PID:12512
- C:\Windows\System\bHxQusx.exe
  C:\Windows\System\bHxQusx.exe
  2⤵
  PID:12532
- C:\Windows\System\hbJTsud.exe
  C:\Windows\System\hbJTsud.exe
  2⤵
  PID:12580
- C:\Windows\System\HtFtcWT.exe
  C:\Windows\System\HtFtcWT.exe
  2⤵
  PID:12600
- C:\Windows\System\XubTWDZ.exe
  C:\Windows\System\XubTWDZ.exe
  2⤵
  PID:12628
- C:\Windows\System\MrQKmoZ.exe
  C:\Windows\System\MrQKmoZ.exe
  2⤵
  PID:12648
- C:\Windows\System\chvcCWL.exe
  C:\Windows\System\chvcCWL.exe
  2⤵
  PID:12672
- C:\Windows\System\oTUIrLj.exe
  C:\Windows\System\oTUIrLj.exe
  2⤵
  PID:12704
- C:\Windows\System\ntAfHQY.exe
  C:\Windows\System\ntAfHQY.exe
  2⤵
  PID:12732
- C:\Windows\System\ALMHzkZ.exe
  C:\Windows\System\ALMHzkZ.exe
  2⤵
  PID:12764
- C:\Windows\System\YorMmbk.exe
  C:\Windows\System\YorMmbk.exe
  2⤵
  PID:12792
- C:\Windows\System\uysqcFe.exe
  C:\Windows\System\uysqcFe.exe
  2⤵
  PID:12812
- C:\Windows\System\UrIxcxE.exe
  C:\Windows\System\UrIxcxE.exe
  2⤵
  PID:12840
- C:\Windows\System\LuIYePU.exe
  C:\Windows\System\LuIYePU.exe
  2⤵
  PID:12860
- C:\Windows\System\LLLdPGK.exe
  C:\Windows\System\LLLdPGK.exe
  2⤵
  PID:12884
- C:\Windows\System\EgIQqAX.exe
  C:\Windows\System\EgIQqAX.exe
  2⤵
  PID:12908
- C:\Windows\System\OFBSAsw.exe
  C:\Windows\System\OFBSAsw.exe
  2⤵
  PID:12932
- C:\Windows\System\ZcimAOM.exe
  C:\Windows\System\ZcimAOM.exe
  2⤵
  PID:12956
- C:\Windows\System\PxppipH.exe
  C:\Windows\System\PxppipH.exe
  2⤵
  PID:12988
- C:\Windows\System\XNvjELq.exe
  C:\Windows\System\XNvjELq.exe
  2⤵
  PID:13012
- C:\Windows\System\VOHXeoP.exe
  C:\Windows\System\VOHXeoP.exe
  2⤵
  PID:13040
- C:\Windows\System\cbsgXEB.exe
  C:\Windows\System\cbsgXEB.exe
  2⤵
  PID:13072
- C:\Windows\System\nZigOgT.exe
  C:\Windows\System\nZigOgT.exe
  2⤵
  PID:13100
- C:\Windows\System\FiFUnvD.exe
  C:\Windows\System\FiFUnvD.exe
  2⤵
  PID:13132
- C:\Windows\System\wAHwlTm.exe
  C:\Windows\System\wAHwlTm.exe
  2⤵
  PID:13164
- C:\Windows\System\kZRNGCO.exe
  C:\Windows\System\kZRNGCO.exe
  2⤵
  PID:13200
- C:\Windows\System\fRlpVUC.exe
  C:\Windows\System\fRlpVUC.exe
  2⤵
  PID:13220
- C:\Windows\System\OTWjJUb.exe
  C:\Windows\System\OTWjJUb.exe
  2⤵
  PID:13248
- C:\Windows\System\lsvMPmd.exe
  C:\Windows\System\lsvMPmd.exe
  2⤵
  PID:13268
- C:\Windows\System\qPPXbzl.exe
  C:\Windows\System\qPPXbzl.exe
  2⤵
  PID:13288
- C:\Windows\System\UQanbAu.exe
  C:\Windows\System\UQanbAu.exe
  2⤵
  PID:9892
- C:\Windows\System\jWARHxM.exe
  C:\Windows\System\jWARHxM.exe
  2⤵
  PID:8308
- C:\Windows\System\WRkGwwW.exe
  C:\Windows\System\WRkGwwW.exe
  2⤵
  PID:12308
- C:\Windows\System\rYtOHjn.exe
  C:\Windows\System\rYtOHjn.exe
  2⤵
  PID:10388
- C:\Windows\System\yHWePRP.exe
  C:\Windows\System\yHWePRP.exe
  2⤵
  PID:7680
- C:\Windows\System\IIKQArP.exe
  C:\Windows\System\IIKQArP.exe
  2⤵
  PID:11724
- C:\Windows\System\AipelzN.exe
  C:\Windows\System\AipelzN.exe
  2⤵
  PID:10184
- C:\Windows\System\ZbIxRZW.exe
  C:\Windows\System\ZbIxRZW.exe
  2⤵
  PID:8652
- C:\Windows\System\PqXlAjE.exe
  C:\Windows\System\PqXlAjE.exe
  2⤵
  PID:11408
- C:\Windows\System\aQtqqUX.exe
  C:\Windows\System\aQtqqUX.exe
  2⤵
  PID:8428
- C:\Windows\System\WDebEzL.exe
  C:\Windows\System\WDebEzL.exe
  2⤵
  PID:11376
- C:\Windows\System\uXTWGIl.exe
  C:\Windows\System\uXTWGIl.exe
  2⤵
  PID:12668
- C:\Windows\System\tLEXjne.exe
  C:\Windows\System\tLEXjne.exe
  2⤵
  PID:11512
- C:\Windows\System\zIKUFYG.exe
  C:\Windows\System\zIKUFYG.exe
  2⤵
  PID:11536
- C:\Windows\System\jsojDWt.exe
  C:\Windows\System\jsojDWt.exe
  2⤵
  PID:10700
- C:\Windows\System\LUVLgER.exe
  C:\Windows\System\LUVLgER.exe
  2⤵
  PID:12828
- C:\Windows\System\zfjooyK.exe
  C:\Windows\System\zfjooyK.exe
  2⤵
  PID:12688
- C:\Windows\System\XbcNmQK.exe
  C:\Windows\System\XbcNmQK.exe
  2⤵
  PID:13172
- C:\Windows\System\eYDyIhI.exe
  C:\Windows\System\eYDyIhI.exe
  2⤵
  PID:12616
- C:\Windows\System\JvbSiFx.exe
  C:\Windows\System\JvbSiFx.exe
  2⤵
  PID:13256
- C:\Windows\System\AcrqOEJ.exe
  C:\Windows\System\AcrqOEJ.exe
  2⤵
  PID:9376
- C:\Windows\System\GfwpDbW.exe
  C:\Windows\System\GfwpDbW.exe
  2⤵
  PID:9076
- C:\Windows\System\CTiknah.exe
  C:\Windows\System\CTiknah.exe
  2⤵
  PID:9592
- C:\Windows\System\UyBUFLC.exe
  C:\Windows\System\UyBUFLC.exe
  2⤵
  PID:10308
- C:\Windows\System\XXLWaTr.exe
  C:\Windows\System\XXLWaTr.exe
  2⤵
  PID:10912
- C:\Windows\System\sbXbGIG.exe
  C:\Windows\System\sbXbGIG.exe
  2⤵
  PID:11036
- C:\Windows\System\VPbVeNp.exe
  C:\Windows\System\VPbVeNp.exe
  2⤵
  PID:11684
- C:\Windows\System\dczSWPx.exe
  C:\Windows\System\dczSWPx.exe
  2⤵
  PID:8584
- C:\Windows\System\XgkHXXp.exe
  C:\Windows\System\XgkHXXp.exe
  2⤵
  PID:12408
- C:\Windows\System\DfXwaAi.exe
  C:\Windows\System\DfXwaAi.exe
  2⤵
  PID:11576
- C:\Windows\System\DZeclCx.exe
  C:\Windows\System\DZeclCx.exe
  2⤵
  PID:12164
- C:\Windows\System\vUuiDWJ.exe
  C:\Windows\System\vUuiDWJ.exe
  2⤵
  PID:9840
- C:\Windows\System\eONWzEm.exe
  C:\Windows\System\eONWzEm.exe
  2⤵
  PID:11900
- C:\Windows\System\NoeagTU.exe
  C:\Windows\System\NoeagTU.exe
  2⤵
  PID:10608
- C:\Windows\System\VQcSokf.exe
  C:\Windows\System\VQcSokf.exe
  2⤵
  PID:12332
- C:\Windows\System\fuoYMGo.exe
  C:\Windows\System\fuoYMGo.exe
  2⤵
  PID:11744
- C:\Windows\System\IRcHZNq.exe
  C:\Windows\System\IRcHZNq.exe
  2⤵
  PID:12452
- C:\Windows\System\QoNQENK.exe
  C:\Windows\System\QoNQENK.exe
  2⤵
  PID:13120
- C:\Windows\System\SrbUGVM.exe
  C:\Windows\System\SrbUGVM.exe
  2⤵
  PID:7484
- C:\Windows\System\tgOFQfs.exe
  C:\Windows\System\tgOFQfs.exe
  2⤵
  PID:2076
- C:\Windows\System\CVTZgOy.exe
  C:\Windows\System\CVTZgOy.exe
  2⤵
  PID:11304
- C:\Windows\System\trgiTbY.exe
  C:\Windows\System\trgiTbY.exe
  2⤵
  PID:7464
- C:\Windows\System\adHJWgE.exe
  C:\Windows\System\adHJWgE.exe
  2⤵
  PID:8732
- C:\Windows\System\nCAwRuR.exe
  C:\Windows\System\nCAwRuR.exe
  2⤵
  PID:9340
- C:\Windows\System\VriKgbu.exe
  C:\Windows\System\VriKgbu.exe
  2⤵
  PID:12900
- C:\Windows\System\pyIaPQM.exe
  C:\Windows\System\pyIaPQM.exe
  2⤵
  PID:11548
- C:\Windows\System\JYwWUSu.exe
  C:\Windows\System\JYwWUSu.exe
  2⤵
  PID:12568
- C:\Windows\System\xyfLFRq.exe
  C:\Windows\System\xyfLFRq.exe
  2⤵
  PID:12108
- C:\Windows\System\noWXzit.exe
  C:\Windows\System\noWXzit.exe
  2⤵
  PID:11128
- C:\Windows\System\LfhdfvH.exe
  C:\Windows\System\LfhdfvH.exe
  2⤵
  PID:10756
- C:\Windows\System\EDIUxCb.exe
  C:\Windows\System\EDIUxCb.exe
  2⤵
  PID:11968
- C:\Windows\System\IWSkCMA.exe
  C:\Windows\System\IWSkCMA.exe
  2⤵
  PID:12832
- C:\Windows\System\iYBvBUt.exe
  C:\Windows\System\iYBvBUt.exe
  2⤵
  PID:11852
- C:\Windows\System\BuaDESN.exe
  C:\Windows\System\BuaDESN.exe
  2⤵
  PID:12760
- C:\Windows\System\dgHFrMN.exe
  C:\Windows\System\dgHFrMN.exe
  2⤵
  PID:10344
- C:\Windows\System\IyZDbxv.exe
  C:\Windows\System\IyZDbxv.exe
  2⤵
  PID:11820
- C:\Windows\System\fXsobdd.exe
  C:\Windows\System\fXsobdd.exe
  2⤵
  PID:3436
- C:\Windows\System\wrXWfYC.exe
  C:\Windows\System\wrXWfYC.exe
  2⤵
  PID:10696
- C:\Windows\System\sxXEOef.exe
  C:\Windows\System\sxXEOef.exe
  2⤵
  PID:4216
- C:\Windows\System\ZIOZoSP.exe
  C:\Windows\System\ZIOZoSP.exe
  2⤵
  PID:13244
- C:\Windows\System\kJBlzlN.exe
  C:\Windows\System\kJBlzlN.exe
  2⤵
  PID:11604
- C:\Windows\System\UfRWuTW.exe
  C:\Windows\System\UfRWuTW.exe
  2⤵
  PID:9572
- C:\Windows\System\UbElcRv.exe
  C:\Windows\System\UbElcRv.exe
  2⤵
  PID:12204
- C:\Windows\System\GiGzTXL.exe
  C:\Windows\System\GiGzTXL.exe
  2⤵
  PID:3380
- C:\Windows\System\HZyogvA.exe
  C:\Windows\System\HZyogvA.exe
  2⤵
  PID:5860
- C:\Windows\System\nSlqIew.exe
  C:\Windows\System\nSlqIew.exe
  2⤵
  PID:372
- C:\Windows\System\MnwmycE.exe
  C:\Windows\System\MnwmycE.exe
  2⤵
  PID:10460
- C:\Windows\System\SeEKZJd.exe
  C:\Windows\System\SeEKZJd.exe
  2⤵
  PID:11436
- C:\Windows\System\tQgKFBd.exe
  C:\Windows\System\tQgKFBd.exe
  2⤵
  PID:13060
- C:\Windows\System\eRaaOan.exe
  C:\Windows\System\eRaaOan.exe
  2⤵
  PID:13236
- C:\Windows\System\NXDVXNh.exe
  C:\Windows\System\NXDVXNh.exe
  2⤵
  PID:9524
- C:\Windows\System\tUAZDIg.exe
  C:\Windows\System\tUAZDIg.exe
  2⤵
  PID:12220
- C:\Windows\System\brUiunB.exe
  C:\Windows\System\brUiunB.exe
  2⤵
  PID:4836
- C:\Windows\System\OpQYtbR.exe
  C:\Windows\System\OpQYtbR.exe
  2⤵
  PID:12184
- C:\Windows\System\xjXwjjd.exe
  C:\Windows\System\xjXwjjd.exe
  2⤵
  PID:4844
- C:\Windows\System\jVyjNFo.exe
  C:\Windows\System\jVyjNFo.exe
  2⤵
  PID:11768
- C:\Windows\System\nekqxDa.exe
  C:\Windows\System\nekqxDa.exe
  2⤵
  PID:3360
- C:\Windows\System\KmNeJdI.exe
  C:\Windows\System\KmNeJdI.exe
  2⤵
  PID:12756
- C:\Windows\System\CUUoWjz.exe
  C:\Windows\System\CUUoWjz.exe
  2⤵
  PID:3416
- C:\Windows\System\rBszeit.exe
  C:\Windows\System\rBszeit.exe
  2⤵
  PID:10716
- C:\Windows\System\xHrJFwO.exe
  C:\Windows\System\xHrJFwO.exe
  2⤵
  PID:8148
- C:\Windows\System\tfHbBRu.exe
  C:\Windows\System\tfHbBRu.exe
  2⤵
  PID:8508
- C:\Windows\System\jyrMigS.exe
  C:\Windows\System\jyrMigS.exe
  2⤵
  PID:2376
- C:\Windows\System\SHOiegZ.exe
  C:\Windows\System\SHOiegZ.exe
  2⤵
  PID:10732
- C:\Windows\System\XIkdSoW.exe
  C:\Windows\System\XIkdSoW.exe
  2⤵
  PID:2184
- C:\Windows\System\OoWQfLF.exe
  C:\Windows\System\OoWQfLF.exe
  2⤵
  PID:4768
- C:\Windows\System\ZmkJZoZ.exe
  C:\Windows\System\ZmkJZoZ.exe
  2⤵
  PID:4980
- C:\Windows\System\gmtaVEs.exe
  C:\Windows\System\gmtaVEs.exe
  2⤵
  PID:5520
- C:\Windows\System\UXGpPMG.exe
  C:\Windows\System\UXGpPMG.exe
  2⤵
  PID:7104
- C:\Windows\System\jGmRPcJ.exe
  C:\Windows\System\jGmRPcJ.exe
  2⤵
  PID:1968
- C:\Windows\System\fXGDwLF.exe
  C:\Windows\System\fXGDwLF.exe
  2⤵
  PID:3768
- C:\Windows\System\cHtdBWA.exe
  C:\Windows\System\cHtdBWA.exe
  2⤵
  PID:4896
- C:\Windows\System\IPVavqS.exe
  C:\Windows\System\IPVavqS.exe
  2⤵
  PID:2960
- C:\Windows\System\vAyJIia.exe
  C:\Windows\System\vAyJIia.exe
  2⤵
  PID:13328
- C:\Windows\System\foFqCaN.exe
  C:\Windows\System\foFqCaN.exe
  2⤵
  PID:13444
- C:\Windows\System\GWgvxVA.exe
  C:\Windows\System\GWgvxVA.exe
  2⤵
  PID:13500
- C:\Windows\System\MmKKYye.exe
  C:\Windows\System\MmKKYye.exe
  2⤵
  PID:13516
- C:\Windows\System\agSRXGP.exe
  C:\Windows\System\agSRXGP.exe
  2⤵
  PID:13540
- C:\Windows\System\aOngylh.exe
  C:\Windows\System\aOngylh.exe
  2⤵
  PID:13576
- C:\Windows\System\LSbkMDf.exe
  C:\Windows\System\LSbkMDf.exe
  2⤵
  PID:13600
- C:\Windows\System\GlBDiis.exe
  C:\Windows\System\GlBDiis.exe
  2⤵
  PID:13632
- C:\Windows\System\nDdtPVF.exe
  C:\Windows\System\nDdtPVF.exe
  2⤵
  PID:13660
- C:\Windows\System\PnAaHUs.exe
  C:\Windows\System\PnAaHUs.exe
  2⤵
  PID:13684
- C:\Windows\System\YPJdreZ.exe
  C:\Windows\System\YPJdreZ.exe
  2⤵
  PID:13712
- C:\Windows\System\zuGPcUM.exe
  C:\Windows\System\zuGPcUM.exe
  2⤵
  PID:13736
- C:\Windows\System\HaKVMwk.exe
  C:\Windows\System\HaKVMwk.exe
  2⤵
  PID:13764
- C:\Windows\System\vLPBbWt.exe
  C:\Windows\System\vLPBbWt.exe
  2⤵
  PID:13784
- C:\Windows\System\EfixcUR.exe
  C:\Windows\System\EfixcUR.exe
  2⤵
  PID:13812
- C:\Windows\System\CfXJQmt.exe
  C:\Windows\System\CfXJQmt.exe
  2⤵
  PID:13852
- C:\Windows\System\IvBxCCw.exe
  C:\Windows\System\IvBxCCw.exe
  2⤵
  PID:13872
- C:\Windows\System\ejlXqLP.exe
  C:\Windows\System\ejlXqLP.exe
  2⤵
  PID:13916
- C:\Windows\System\NPrbXke.exe
  C:\Windows\System\NPrbXke.exe
  2⤵
  PID:13940
- C:\Windows\System\JTZovDr.exe
  C:\Windows\System\JTZovDr.exe
  2⤵
  PID:13968
- C:\Windows\System\GpcGRUi.exe
  C:\Windows\System\GpcGRUi.exe
  2⤵
  PID:14008
- C:\Windows\System\IrfNXEI.exe
  C:\Windows\System\IrfNXEI.exe
  2⤵
  PID:14044
- C:\Windows\System\SEjmOIz.exe
  C:\Windows\System\SEjmOIz.exe
  2⤵
  PID:14080
- C:\Windows\System\oCekwlE.exe
  C:\Windows\System\oCekwlE.exe
  2⤵
  PID:14124
- C:\Windows\System\QFdmoRX.exe
  C:\Windows\System\QFdmoRX.exe
  2⤵
  PID:14148
- C:\Windows\System\PIOmghM.exe
  C:\Windows\System\PIOmghM.exe
  2⤵
  PID:14172
- C:\Windows\System\SVxtZdG.exe
  C:\Windows\System\SVxtZdG.exe
  2⤵
  PID:14224
- C:\Windows\System\yDmQzvr.exe
  C:\Windows\System\yDmQzvr.exe
  2⤵
  PID:14284
- C:\Windows\System\bhCMVNQ.exe
  C:\Windows\System\bhCMVNQ.exe
  2⤵
  PID:14312
- C:\Windows\System\uxEYjzR.exe
  C:\Windows\System\uxEYjzR.exe
  2⤵
  PID:11836
- C:\Windows\System\bzrhRfa.exe
  C:\Windows\System\bzrhRfa.exe
  2⤵
  PID:1216
- C:\Windows\System\LaSDeSd.exe
  C:\Windows\System\LaSDeSd.exe
  2⤵
  PID:4408
- C:\Windows\System\GoVaVlZ.exe
  C:\Windows\System\GoVaVlZ.exe
  2⤵
  PID:12348
- C:\Windows\System\IejkqWV.exe
  C:\Windows\System\IejkqWV.exe
  2⤵
  PID:4240
- C:\Windows\System\AvPVAhK.exe
  C:\Windows\System\AvPVAhK.exe
  2⤵
  PID:1692
- C:\Windows\System\GATsfPg.exe
  C:\Windows\System\GATsfPg.exe
  2⤵
  PID:1632
- C:\Windows\System\ORoiTRQ.exe
  C:\Windows\System\ORoiTRQ.exe
  2⤵
  PID:13460
- C:\Windows\System\vujpkQo.exe
  C:\Windows\System\vujpkQo.exe
  2⤵
  PID:4724
- C:\Windows\System\OIsXpOp.exe
  C:\Windows\System\OIsXpOp.exe
  2⤵
  PID:13512
- C:\Windows\System\bVDRAMi.exe
  C:\Windows\System\bVDRAMi.exe
  2⤵
  PID:4792
- C:\Windows\System\CbocVcJ.exe
  C:\Windows\System\CbocVcJ.exe
  2⤵
  PID:14064
- C:\Windows\System\okzRndx.exe
  C:\Windows\System\okzRndx.exe
  2⤵
  PID:14028
- C:\Windows\System\NXMLZqy.exe
  C:\Windows\System\NXMLZqy.exe
  2⤵
  PID:436
- C:\Windows\System\cuDCXfj.exe
  C:\Windows\System\cuDCXfj.exe
  2⤵
  PID:14164
- C:\Windows\System\HoVqoGh.exe
  C:\Windows\System\HoVqoGh.exe
  2⤵
  PID:14244
- C:\Windows\System\HdohAHs.exe
  C:\Windows\System\HdohAHs.exe
  2⤵
  PID:14268
- C:\Windows\System\nrbtEMb.exe
  C:\Windows\System\nrbtEMb.exe
  2⤵
  PID:14332
- C:\Windows\System\VaxHQFv.exe
  C:\Windows\System\VaxHQFv.exe
  2⤵
  PID:332
- C:\Windows\System\IxhqqRd.exe
  C:\Windows\System\IxhqqRd.exe
  2⤵
  PID:5092
- C:\Windows\System\FRDSKJU.exe
  C:\Windows\System\FRDSKJU.exe
  2⤵
  PID:1588
- C:\Windows\System\lzcKyUb.exe
  C:\Windows\System\lzcKyUb.exe
  2⤵
  PID:5136
- C:\Windows\System\ZnBmbjw.exe
  C:\Windows\System\ZnBmbjw.exe
  2⤵
  PID:1164
- C:\Windows\System\UVruabw.exe
  C:\Windows\System\UVruabw.exe
  2⤵
  PID:5144
- C:\Windows\System\UlpSVen.exe
  C:\Windows\System\UlpSVen.exe
  2⤵
  PID:13416
- C:\Windows\System\qmXYujx.exe
  C:\Windows\System\qmXYujx.exe
  2⤵
  PID:14088
- C:\Windows\System\YTabnpI.exe
  C:\Windows\System\YTabnpI.exe
  2⤵
  PID:5320
- C:\Windows\System\DJQLUiM.exe
  C:\Windows\System\DJQLUiM.exe
  2⤵
  PID:5480
- C:\Windows\System\ARXauAo.exe
  C:\Windows\System\ARXauAo.exe
  2⤵
  PID:5488
- C:\Windows\System\wRxZVyH.exe
  C:\Windows\System\wRxZVyH.exe
  2⤵
  PID:14104
- C:\Windows\System\OAfvkoC.exe
  C:\Windows\System\OAfvkoC.exe
  2⤵
  PID:208
- C:\Windows\System\bkqTHiH.exe
  C:\Windows\System\bkqTHiH.exe
  2⤵
  PID:5500
- C:\Windows\System\VbxfCJQ.exe
  C:\Windows\System\VbxfCJQ.exe
  2⤵
  PID:14260
- C:\Windows\System\SgfmMmA.exe
  C:\Windows\System\SgfmMmA.exe
  2⤵
  PID:14156
- C:\Windows\System\YfZcyJU.exe
  C:\Windows\System\YfZcyJU.exe
  2⤵
  PID:1720
- C:\Windows\System\GvGYWBF.exe
  C:\Windows\System\GvGYWBF.exe
  2⤵
  PID:2976
- C:\Windows\System\peWXjib.exe
  C:\Windows\System\peWXjib.exe
  2⤵
  PID:5660
- C:\Windows\System\jTHKQGi.exe
  C:\Windows\System\jTHKQGi.exe
  2⤵
  PID:5304
- C:\Windows\System\iTEjeZi.exe
  C:\Windows\System\iTEjeZi.exe
  2⤵
  PID:3276
- C:\Windows\System\pvELJyv.exe
  C:\Windows\System\pvELJyv.exe
  2⤵
  PID:5524
- C:\Windows\System\mhrmaTh.exe
  C:\Windows\System\mhrmaTh.exe
  2⤵
  PID:2192
- C:\Windows\System\AHpHPSv.exe
  C:\Windows\System\AHpHPSv.exe
  2⤵
  PID:5980
- C:\Windows\System\deDONgn.exe
  C:\Windows\System\deDONgn.exe
  2⤵
  PID:5892
- C:\Windows\System\ptcimQC.exe
  C:\Windows\System\ptcimQC.exe
  2⤵
  PID:14376
- C:\Windows\System\PgPKFLx.exe
  C:\Windows\System\PgPKFLx.exe
  2⤵
  PID:14412
- C:\Windows\System\ZNVLXOq.exe
  C:\Windows\System\ZNVLXOq.exe
  2⤵
  PID:14444
- C:\Windows\System\XElIYbZ.exe
  C:\Windows\System\XElIYbZ.exe
  2⤵
  PID:14512
- C:\Windows\System\VUZLDYF.exe
  C:\Windows\System\VUZLDYF.exe
  2⤵
  PID:14528
- C:\Windows\System\SDpogWl.exe
  C:\Windows\System\SDpogWl.exe
  2⤵
  PID:14544
- C:\Windows\System\HKfMcAb.exe
  C:\Windows\System\HKfMcAb.exe
  2⤵
  PID:14564
- C:\Windows\System\qKwiNwE.exe
  C:\Windows\System\qKwiNwE.exe
  2⤵
  PID:14596
- C:\Windows\System\GrLqWkv.exe
  C:\Windows\System\GrLqWkv.exe
  2⤵
  PID:14636
- C:\Windows\System\xUkkdbE.exe
  C:\Windows\System\xUkkdbE.exe
  2⤵
  PID:14664
- C:\Windows\System\AwnGlse.exe
  C:\Windows\System\AwnGlse.exe
  2⤵
  PID:14688
- C:\Windows\System\eCmmsQi.exe
  C:\Windows\System\eCmmsQi.exe
  2⤵
  PID:14712
- C:\Windows\System\hcwdPsn.exe
  C:\Windows\System\hcwdPsn.exe
  2⤵
  PID:14736
- C:\Windows\System\DuTJgMC.exe
  C:\Windows\System\DuTJgMC.exe
  2⤵
  PID:14768
- C:\Windows\System\NoKGBcn.exe
  C:\Windows\System\NoKGBcn.exe
  2⤵
  PID:14824
- C:\Windows\System\dQFXFBI.exe
  C:\Windows\System\dQFXFBI.exe
  2⤵
  PID:14840
- C:\Windows\System\nTYFJeZ.exe
  C:\Windows\System\nTYFJeZ.exe
  2⤵
  PID:14864
- C:\Windows\System\TcsvIjC.exe
  C:\Windows\System\TcsvIjC.exe
  2⤵
  PID:14908
- C:\Windows\System\avqWwQe.exe
  C:\Windows\System\avqWwQe.exe
  2⤵
  PID:15064
- C:\Windows\System\OaDTKMw.exe
  C:\Windows\System\OaDTKMw.exe
  2⤵
  PID:15092
- C:\Windows\System\XNtkYGc.exe
  C:\Windows\System\XNtkYGc.exe
  2⤵
  PID:15256
- C:\Windows\System\IGsMbjh.exe
  C:\Windows\System\IGsMbjh.exe
  2⤵
  PID:1572
- C:\Windows\System\hGUXuvE.exe
  C:\Windows\System\hGUXuvE.exe
  2⤵
  PID:5548
- C:\Windows\System\jkgzWws.exe
  C:\Windows\System\jkgzWws.exe
  2⤵
  PID:13432
- C:\Windows\System\qRraIsl.exe
  C:\Windows\System\qRraIsl.exe
  2⤵
  PID:5972
- C:\Windows\System\Kyjesbv.exe
  C:\Windows\System\Kyjesbv.exe
  2⤵
  PID:14764
- C:\Windows\System\SPppmqF.exe
  C:\Windows\System\SPppmqF.exe
  2⤵
  PID:4348
- C:\Windows\System\lFglbAk.exe
  C:\Windows\System\lFglbAk.exe
  2⤵
  PID:14968
- C:\Windows\System\KmcYMfL.exe
  C:\Windows\System\KmcYMfL.exe
  2⤵
  PID:14900
- C:\Windows\System\JTDfuft.exe
  C:\Windows\System\JTDfuft.exe
  2⤵
  PID:15072
- C:\Windows\System\oNgjDYb.exe
  C:\Windows\System\oNgjDYb.exe
  2⤵
  PID:15196
- C:\Windows\System\DwTxtjv.exe
  C:\Windows\System\DwTxtjv.exe
  2⤵
  PID:15296
- C:\Windows\System\XWCJOFn.exe
  C:\Windows\System\XWCJOFn.exe
  2⤵
  PID:15320
- C:\Windows\System\YBEvLCw.exe
  C:\Windows\System\YBEvLCw.exe
  2⤵
  PID:5588
- C:\Windows\System\eQyUblT.exe
  C:\Windows\System\eQyUblT.exe
  2⤵
  PID:14628
- C:\Windows\System\QsPadTJ.exe
  C:\Windows\System\QsPadTJ.exe
  2⤵
  PID:6056
- C:\Windows\System\TAnTyZj.exe
  C:\Windows\System\TAnTyZj.exe
  2⤵
  PID:1556
- C:\Windows\System\KJQRUdq.exe
  C:\Windows\System\KJQRUdq.exe
  2⤵
  PID:13588
- C:\Windows\System\BneIguA.exe
  C:\Windows\System\BneIguA.exe
  2⤵
  PID:1576
- C:\Windows\System\pAMtCts.exe
  C:\Windows\System\pAMtCts.exe
  2⤵
  PID:5300
- C:\Windows\System\NlBUcoe.exe
  C:\Windows\System\NlBUcoe.exe
  2⤵
  PID:5684
- C:\Windows\System\NzxdBfy.exe
  C:\Windows\System\NzxdBfy.exe
  2⤵
  PID:5580
- C:\Windows\System\XIeciIo.exe
  C:\Windows\System\XIeciIo.exe
  2⤵
  PID:14744
- C:\Windows\System\IqOnXZV.exe
  C:\Windows\System\IqOnXZV.exe
  2⤵
  PID:768
- C:\Windows\System\eyprDwX.exe
  C:\Windows\System\eyprDwX.exe
  2⤵
  PID:14976
- C:\Windows\System\iAUGMEY.exe
  C:\Windows\System\iAUGMEY.exe
  2⤵
  PID:14892
- C:\Windows\System\jcDBPtw.exe
  C:\Windows\System\jcDBPtw.exe
  2⤵
  PID:5156
- C:\Windows\System\DFvJerK.exe
  C:\Windows\System\DFvJerK.exe
  2⤵
  PID:15128
- C:\Windows\System\whoHBGc.exe
  C:\Windows\System\whoHBGc.exe
  2⤵
  PID:15016
- C:\Windows\System\bXpnkeo.exe
  C:\Windows\System\bXpnkeo.exe
  2⤵
  PID:14920
- C:\Windows\System\JKbroXI.exe
  C:\Windows\System\JKbroXI.exe
  2⤵
  PID:5200
- C:\Windows\System\QacbyiV.exe
  C:\Windows\System\QacbyiV.exe
  2⤵
  PID:15204
- C:\Windows\System\jqStdsg.exe
  C:\Windows\System\jqStdsg.exe
  2⤵
  PID:15292
- C:\Windows\System\ZsczkhN.exe
  C:\Windows\System\ZsczkhN.exe
  2⤵
  PID:15104
- C:\Windows\System\mPcJMnj.exe
  C:\Windows\System\mPcJMnj.exe
  2⤵
  PID:15280
- C:\Windows\System\mXGAizF.exe
  C:\Windows\System\mXGAizF.exe
  2⤵
  PID:5176
- C:\Windows\System\WGFOJHh.exe
  C:\Windows\System\WGFOJHh.exe
  2⤵
  PID:4136
- C:\Windows\System\iVzvqHp.exe
  C:\Windows\System\iVzvqHp.exe
  2⤵
  PID:13824
- C:\Windows\System\qvxaQzD.exe
  C:\Windows\System\qvxaQzD.exe
  2⤵
  PID:14584
- C:\Windows\System\JYgnygi.exe
  C:\Windows\System\JYgnygi.exe
  2⤵
  PID:4372
- C:\Windows\System\YWAzFVa.exe
  C:\Windows\System\YWAzFVa.exe
  2⤵
  PID:4932
- C:\Windows\System\GkIdVdo.exe
  C:\Windows\System\GkIdVdo.exe
  2⤵
  PID:12396
- C:\Windows\System\LruRuNl.exe
  C:\Windows\System\LruRuNl.exe
  2⤵
  PID:13316
- C:\Windows\System\QmTvVcV.exe
  C:\Windows\System\QmTvVcV.exe
  2⤵
  PID:6168
- C:\Windows\System\CjYefvM.exe
  C:\Windows\System\CjYefvM.exe
  2⤵
  PID:5316
- C:\Windows\System\WicTUBP.exe
  C:\Windows\System\WicTUBP.exe
  2⤵
  PID:5220
- C:\Windows\System\oJKqQhD.exe
  C:\Windows\System\oJKqQhD.exe
  2⤵
  PID:6116
- C:\Windows\System\TpYjvSU.exe
  C:\Windows\System\TpYjvSU.exe
  2⤵
  PID:7164
- C:\Windows\System\mMnzbUD.exe
  C:\Windows\System\mMnzbUD.exe
  2⤵
  PID:13480
- C:\Windows\System\IGfnBdt.exe
  C:\Windows\System\IGfnBdt.exe
  2⤵
  PID:4808
- C:\Windows\System\NYNtxWz.exe
  C:\Windows\System\NYNtxWz.exe
  2⤵
  PID:3736
- C:\Windows\System\YnevnqW.exe
  C:\Windows\System\YnevnqW.exe
  2⤵
  PID:15324
- C:\Windows\System\AocIfLo.exe
  C:\Windows\System\AocIfLo.exe
  2⤵
  PID:5472
- C:\Windows\System\xLfTOzt.exe
  C:\Windows\System\xLfTOzt.exe
  2⤵
  PID:5988
- C:\Windows\System\RHaJbam.exe
  C:\Windows\System\RHaJbam.exe
  2⤵
  PID:6516
- C:\Windows\System\FYfUhDF.exe
  C:\Windows\System\FYfUhDF.exe
  2⤵
  PID:14696
- C:\Windows\System\JnOllyF.exe
  C:\Windows\System\JnOllyF.exe
  2⤵
  PID:5920
- C:\Windows\System\dVUxZSF.exe
  C:\Windows\System\dVUxZSF.exe
  2⤵
  PID:5532
- C:\Windows\System\Xchbxgu.exe
  C:\Windows\System\Xchbxgu.exe
  2⤵
  PID:14800
- C:\Windows\System\IdAHNtS.exe
  C:\Windows\System\IdAHNtS.exe
  2⤵
  PID:14648
- C:\Windows\System\QBLfYKa.exe
  C:\Windows\System\QBLfYKa.exe
  2⤵
  PID:15252
- C:\Windows\System\VkSQlrg.exe
  C:\Windows\System\VkSQlrg.exe
  2⤵
  PID:13428
- C:\Windows\System\gRfzQjV.exe
  C:\Windows\System\gRfzQjV.exe
  2⤵
  PID:14880
- C:\Windows\System\KCXCCZB.exe
  C:\Windows\System\KCXCCZB.exe
  2⤵
  PID:6744
- C:\Windows\System\UBRMhZp.exe
  C:\Windows\System\UBRMhZp.exe
  2⤵
  PID:6220
- C:\Windows\System\xdYiNpx.exe
  C:\Windows\System\xdYiNpx.exe
  2⤵
  PID:14932
- C:\Windows\System\zoLFubH.exe
  C:\Windows\System\zoLFubH.exe
  2⤵
  PID:14996
- C:\Windows\System\DDPTtDj.exe
  C:\Windows\System\DDPTtDj.exe
  2⤵
  PID:15228
- C:\Windows\System\pRRjsKk.exe
  C:\Windows\System\pRRjsKk.exe
  2⤵
  PID:6688
- C:\Windows\System\hXlNVKY.exe
  C:\Windows\System\hXlNVKY.exe
  2⤵
  PID:15344
- C:\Windows\System\MVvAcme.exe
  C:\Windows\System\MVvAcme.exe
  2⤵
  PID:2808
- C:\Windows\System\QtaBDzw.exe
  C:\Windows\System\QtaBDzw.exe
  2⤵
  PID:6764
- C:\Windows\System\XjtVQgi.exe
  C:\Windows\System\XjtVQgi.exe
  2⤵
  PID:14340
- C:\Windows\System\frgWKYH.exe
  C:\Windows\System\frgWKYH.exe
  2⤵
  PID:8108
- C:\Windows\System\LuAyCrx.exe
  C:\Windows\System\LuAyCrx.exe
  2⤵
  PID:5916
- C:\Windows\System\iuQmYLi.exe
  C:\Windows\System\iuQmYLi.exe
  2⤵
  PID:14660
- C:\Windows\System\xCnNXwV.exe
  C:\Windows\System\xCnNXwV.exe
  2⤵
  PID:7152
- C:\Windows\System\dLdnlQq.exe
  C:\Windows\System\dLdnlQq.exe
  2⤵
  PID:6732
- C:\Windows\System\aADtWCm.exe
  C:\Windows\System\aADtWCm.exe
  2⤵
  PID:15012
- C:\Windows\System\DmiLohu.exe
  C:\Windows\System\DmiLohu.exe
  2⤵
  PID:15040
- C:\Windows\System\cXaeITj.exe
  C:\Windows\System\cXaeITj.exe
  2⤵
  PID:15136
- C:\Windows\System\QavOUij.exe
  C:\Windows\System\QavOUij.exe
  2⤵
  PID:11024
- C:\Windows\System\BcuOMGD.exe
  C:\Windows\System\BcuOMGD.exe
  2⤵
  PID:1912
- C:\Windows\System\ToROhlo.exe
  C:\Windows\System\ToROhlo.exe
  2⤵
  PID:7756
- C:\Windows\System\AkmisMf.exe
  C:\Windows\System\AkmisMf.exe
  2⤵
  PID:15352
- C:\Windows\System\xirEwZd.exe
  C:\Windows\System\xirEwZd.exe
  2⤵
  PID:4616
- C:\Windows\System\rHnuZuc.exe
  C:\Windows\System\rHnuZuc.exe
  2⤵
  PID:7124
- C:\Windows\System\IoRZNvP.exe
  C:\Windows\System\IoRZNvP.exe
  2⤵
  PID:4416
- C:\Windows\System\SIufKUz.exe
  C:\Windows\System\SIufKUz.exe
  2⤵
  PID:7032
- C:\Windows\System\PVXwnEK.exe
  C:\Windows\System\PVXwnEK.exe
  2⤵
  PID:7480
- C:\Windows\System\mqHdJoD.exe
  C:\Windows\System\mqHdJoD.exe
  2⤵
  PID:5764
- C:\Windows\System\RYQEnCR.exe
  C:\Windows\System\RYQEnCR.exe
  2⤵
  PID:8156
- C:\Windows\System\GFfayZJ.exe
  C:\Windows\System\GFfayZJ.exe
  2⤵
  PID:7200
- C:\Windows\System\fzoiUtj.exe
  C:\Windows\System\fzoiUtj.exe
  2⤵
  PID:7488
- C:\Windows\System\PHCPkNb.exe
  C:\Windows\System\PHCPkNb.exe
  2⤵
  PID:7208
- C:\Windows\System\QJOcbtQ.exe
  C:\Windows\System\QJOcbtQ.exe
  2⤵
  PID:8280
- C:\Windows\System\MBCgZBz.exe
  C:\Windows\System\MBCgZBz.exe
  2⤵
  PID:14192
- C:\Windows\System\vVIszJt.exe
  C:\Windows\System\vVIszJt.exe
  2⤵
  PID:11560
- C:\Windows\System\FfVVcos.exe
  C:\Windows\System\FfVVcos.exe
  2⤵
  PID:7956
- C:\Windows\System\CJJrpRO.exe
  C:\Windows\System\CJJrpRO.exe
  2⤵
  PID:1504
- C:\Windows\System\zKHkIhf.exe
  C:\Windows\System\zKHkIhf.exe
  2⤵
  PID:6920
- C:\Windows\System\buIVDxf.exe
  C:\Windows\System\buIVDxf.exe
  2⤵
  PID:6532
- C:\Windows\System\TlhVBBA.exe
  C:\Windows\System\TlhVBBA.exe
  2⤵
  PID:2756
- C:\Windows\System\InsVTNu.exe
  C:\Windows\System\InsVTNu.exe
  2⤵
  PID:10232
- C:\Windows\System\AubPgei.exe
  C:\Windows\System\AubPgei.exe
  2⤵
  PID:6960
- C:\Windows\System\TTdxrzX.exe
  C:\Windows\System\TTdxrzX.exe
  2⤵
  PID:5536
- C:\Windows\System\UdYyFMz.exe
  C:\Windows\System\UdYyFMz.exe
  2⤵
  PID:7700
- C:\Windows\System\USGBCjo.exe
  C:\Windows\System\USGBCjo.exe
  2⤵
  PID:7988
- C:\Windows\System\shCXavm.exe
  C:\Windows\System\shCXavm.exe
  2⤵
  PID:10148
- C:\Windows\System\UsmzxGA.exe
  C:\Windows\System\UsmzxGA.exe
  2⤵
  PID:5556
- C:\Windows\System\cofHndT.exe
  C:\Windows\System\cofHndT.exe
  2⤵
  PID:9032
- C:\Windows\System\YHbrOmW.exe
  C:\Windows\System\YHbrOmW.exe
  2⤵
  PID:6400
- C:\Windows\System\XZKhSMD.exe
  C:\Windows\System\XZKhSMD.exe
  2⤵
  PID:15288
- C:\Windows\System\znyQEyB.exe
  C:\Windows\System\znyQEyB.exe
  2⤵
  PID:6740
- C:\Windows\System\xcimGxw.exe
  C:\Windows\System\xcimGxw.exe
  2⤵
  PID:14588
- C:\Windows\System\lutRNES.exe
  C:\Windows\System\lutRNES.exe
  2⤵
  PID:748
- C:\Windows\System\pcglHJo.exe
  C:\Windows\System\pcglHJo.exe
  2⤵
  PID:1244
- C:\Windows\System\XbrJGjk.exe
  C:\Windows\System\XbrJGjk.exe
  2⤵
  PID:9120
- C:\Windows\System\zwpwzik.exe
  C:\Windows\System\zwpwzik.exe
  2⤵
  PID:14572
- C:\Windows\System\uwCTfnL.exe
  C:\Windows\System\uwCTfnL.exe
  2⤵
  PID:6656
- C:\Windows\System\QEXzEEO.exe
  C:\Windows\System\QEXzEEO.exe
  2⤵
  PID:7492
- C:\Windows\System\CKrHeqB.exe
  C:\Windows\System\CKrHeqB.exe
  2⤵
  PID:6048
- C:\Windows\System\MAgkKKW.exe
  C:\Windows\System\MAgkKKW.exe
  2⤵
  PID:10472
- C:\Windows\System\aJymbOn.exe
  C:\Windows\System\aJymbOn.exe
  2⤵
  PID:9584
- C:\Windows\System\eDnDalJ.exe
  C:\Windows\System\eDnDalJ.exe
  2⤵
  PID:14700
- C:\Windows\System\FQJtObe.exe
  C:\Windows\System\FQJtObe.exe
  2⤵
  PID:14592
- C:\Windows\System\GykowXj.exe
  C:\Windows\System\GykowXj.exe
  2⤵
  PID:8368
- C:\Windows\System\FxLspQH.exe
  C:\Windows\System\FxLspQH.exe
  2⤵
  PID:10516
- C:\Windows\System\fUufdGW.exe
  C:\Windows\System\fUufdGW.exe
  2⤵
  PID:8060
- C:\Windows\System\qpjlmcQ.exe
  C:\Windows\System\qpjlmcQ.exe
  2⤵
  PID:9308
- C:\Windows\System\njFiOYM.exe
  C:\Windows\System\njFiOYM.exe
  2⤵
  PID:7156
- C:\Windows\System\tSrdoCp.exe
  C:\Windows\System\tSrdoCp.exe
  2⤵
  PID:5080
- C:\Windows\System\hewRlDH.exe
  C:\Windows\System\hewRlDH.exe
  2⤵
  PID:9720
- C:\Windows\System\jikdUJP.exe
  C:\Windows\System\jikdUJP.exe
  2⤵
  PID:14504
- C:\Windows\System\drXMtYm.exe
  C:\Windows\System\drXMtYm.exe
  2⤵
  PID:5656
- C:\Windows\System\CZVIsOx.exe
  C:\Windows\System\CZVIsOx.exe
  2⤵
  PID:8400
- C:\Windows\System\elSPulA.exe
  C:\Windows\System\elSPulA.exe
  2⤵
  PID:4388
- C:\Windows\System\KbqGdCz.exe
  C:\Windows\System\KbqGdCz.exe
  2⤵
  PID:1072
- C:\Windows\System\DdAKqMo.exe
  C:\Windows\System\DdAKqMo.exe
  2⤵
  PID:10060
- C:\Windows\System\nPvOmZh.exe
  C:\Windows\System\nPvOmZh.exe
  2⤵
  PID:8672
- C:\Windows\System\DzzEfUV.exe
  C:\Windows\System\DzzEfUV.exe
  2⤵
  PID:7304
- C:\Windows\System\oOwrffO.exe
  C:\Windows\System\oOwrffO.exe
  2⤵
  PID:9480
- C:\Windows\System\GAPoKZd.exe
  C:\Windows\System\GAPoKZd.exe
  2⤵
  PID:7636
- C:\Windows\System\UJXXtMc.exe
  C:\Windows\System\UJXXtMc.exe
  2⤵
  PID:8580
- C:\Windows\System\dxWtuRg.exe
  C:\Windows\System\dxWtuRg.exe
  2⤵
  PID:7268
- C:\Windows\System\oUqFbsA.exe
  C:\Windows\System\oUqFbsA.exe
  2⤵
  PID:8836
- C:\Windows\System\FJxAJRQ.exe
  C:\Windows\System\FJxAJRQ.exe
  2⤵
  PID:9400
- C:\Windows\System\cWaByel.exe
  C:\Windows\System\cWaByel.exe
  2⤵
  PID:11084
- C:\Windows\System\YnRDvjB.exe
  C:\Windows\System\YnRDvjB.exe
  2⤵
  PID:10496
- C:\Windows\System\atVrLRK.exe
  C:\Windows\System\atVrLRK.exe
  2⤵
  PID:9316
- C:\Windows\System\XkATnaM.exe
  C:\Windows\System\XkATnaM.exe
  2⤵
  PID:9936
- C:\Windows\System\ETwQNXH.exe
  C:\Windows\System\ETwQNXH.exe
  2⤵
  PID:9884
- C:\Windows\System\seiaOGo.exe
  C:\Windows\System\seiaOGo.exe
  2⤵
  PID:9752
- C:\Windows\System\XdhgdWh.exe
  C:\Windows\System\XdhgdWh.exe
  2⤵
  PID:8640
- C:\Windows\System\bbLYblH.exe
  C:\Windows\System\bbLYblH.exe
  2⤵
  PID:10820
- C:\Windows\System\cAflosA.exe
  C:\Windows\System\cAflosA.exe
  2⤵
  PID:11012
- C:\Windows\System\ZMlnmIe.exe
  C:\Windows\System\ZMlnmIe.exe
  2⤵
  PID:11340
- C:\Windows\System\nkSZPbi.exe
  C:\Windows\System\nkSZPbi.exe
  2⤵
  PID:8496
- C:\Windows\System\OpekLwV.exe
  C:\Windows\System\OpekLwV.exe
  2⤵
  PID:9164
- C:\Windows\System\ByBvWxR.exe
  C:\Windows\System\ByBvWxR.exe
  2⤵
  PID:8032
- C:\Windows\System\nDAdqHS.exe
  C:\Windows\System\nDAdqHS.exe
  2⤵
  PID:7724
- C:\Windows\System\SltRkVD.exe
  C:\Windows\System\SltRkVD.exe
  2⤵
  PID:9520
- C:\Windows\System\loQrobU.exe
  C:\Windows\System\loQrobU.exe
  2⤵
  PID:10376
- C:\Windows\System\QOEZWui.exe
  C:\Windows\System\QOEZWui.exe
  2⤵
  PID:7180
- C:\Windows\System\bkEgZMV.exe
  C:\Windows\System\bkEgZMV.exe
  2⤵
  PID:11252
- C:\Windows\System\BJbJcBS.exe
  C:\Windows\System\BJbJcBS.exe
  2⤵
  PID:7172
- C:\Windows\System\pdtmHGK.exe
  C:\Windows\System\pdtmHGK.exe
  2⤵
  PID:9612
- C:\Windows\System\NujgToO.exe
  C:\Windows\System\NujgToO.exe
  2⤵
  PID:10748
- C:\Windows\System\IdrVayD.exe
  C:\Windows\System\IdrVayD.exe
  2⤵
  PID:12820
- C:\Windows\System\nYXjvyR.exe
  C:\Windows\System\nYXjvyR.exe
  2⤵
  PID:12968
- C:\Windows\System\ZBOxGQG.exe
  C:\Windows\System\ZBOxGQG.exe
  2⤵
  PID:9220
- C:\Windows\System\JUfzBDZ.exe
  C:\Windows\System\JUfzBDZ.exe
  2⤵
  PID:12984
- C:\Windows\System\QUvZSNh.exe
  C:\Windows\System\QUvZSNh.exe
  2⤵
  PID:8800
- C:\Windows\System\kimOIPR.exe
  C:\Windows\System\kimOIPR.exe
  2⤵
  PID:11440
- C:\Windows\System\ZhNXyIk.exe
  C:\Windows\System\ZhNXyIk.exe
  2⤵
  PID:7900
- C:\Windows\System\elxwkmV.exe
  C:\Windows\System\elxwkmV.exe
  2⤵
  PID:11740
- C:\Windows\System\mbzfJJj.exe
  C:\Windows\System\mbzfJJj.exe
  2⤵
  PID:10632
- C:\Windows\System\ZrYxWHH.exe
  C:\Windows\System\ZrYxWHH.exe
  2⤵
  PID:12700
- C:\Windows\System\bMFBOHa.exe
  C:\Windows\System\bMFBOHa.exe
  2⤵
  PID:7964
- C:\Windows\System\euiUkmS.exe
  C:\Windows\System\euiUkmS.exe
  2⤵
  PID:11424
- C:\Windows\System\VSVDVxE.exe
  C:\Windows\System\VSVDVxE.exe
  2⤵
  PID:9276
- C:\Windows\System\GihoNGH.exe
  C:\Windows\System\GihoNGH.exe
  2⤵
  PID:11360
- C:\Windows\System\InsVAcg.exe
  C:\Windows\System\InsVAcg.exe
  2⤵
  PID:9676
- C:\Windows\System\IXgiTPN.exe
  C:\Windows\System\IXgiTPN.exe
  2⤵
  PID:8488
- C:\Windows\System\IdOtUVt.exe
  C:\Windows\System\IdOtUVt.exe
  2⤵
  PID:11552
- C:\Windows\System\bWHLeVy.exe
  C:\Windows\System\bWHLeVy.exe
  2⤵
  PID:7912
- C:\Windows\System\Jxcnhfs.exe
  C:\Windows\System\Jxcnhfs.exe
  2⤵
  PID:13240
- C:\Windows\System\ORvLbKk.exe
  C:\Windows\System\ORvLbKk.exe
  2⤵
  PID:11492
- C:\Windows\System\yhWGFSC.exe
  C:\Windows\System\yhWGFSC.exe
  2⤵
  PID:11172
- C:\Windows\System\DFzSsLJ.exe
  C:\Windows\System\DFzSsLJ.exe
  2⤵
  PID:3132
- C:\Windows\System\fvSbDub.exe
  C:\Windows\System\fvSbDub.exe
  2⤵
  PID:8688
- C:\Windows\System\tHyXdFS.exe
  C:\Windows\System\tHyXdFS.exe
  2⤵
  PID:12548
- C:\Windows\System\YYFdXwG.exe
  C:\Windows\System\YYFdXwG.exe
  2⤵
  PID:9096
- C:\Windows\System\PncOKuZ.exe
  C:\Windows\System\PncOKuZ.exe
  2⤵
  PID:8128
- C:\Windows\System\RIsgGYX.exe
  C:\Windows\System\RIsgGYX.exe
  2⤵
  PID:11316
- C:\Windows\System\uvAQgZP.exe
  C:\Windows\System\uvAQgZP.exe
  2⤵
  PID:10832
- C:\Windows\System\qNADEfX.exe
  C:\Windows\System\qNADEfX.exe
  2⤵
  PID:5956
- C:\Windows\System\KsjJBWR.exe
  C:\Windows\System\KsjJBWR.exe
  2⤵
  PID:10200
- C:\Windows\System\XVkMCvR.exe
  C:\Windows\System\XVkMCvR.exe
  2⤵
  PID:10084
- C:\Windows\System\tNmzSfi.exe
  C:\Windows\System\tNmzSfi.exe
  2⤵
  PID:10188
- C:\Windows\System\fmgfFQa.exe
  C:\Windows\System\fmgfFQa.exe
  2⤵
  PID:13308
- C:\Windows\System\RDrEfNJ.exe
  C:\Windows\System\RDrEfNJ.exe
  2⤵
  PID:10044
- C:\Windows\System\YhJRyli.exe
  C:\Windows\System\YhJRyli.exe
  2⤵
  PID:10676
- C:\Windows\System\wYpgFlR.exe
  C:\Windows\System\wYpgFlR.exe
  2⤵
  PID:11044
- C:\Windows\System\lEVLdiy.exe
  C:\Windows\System\lEVLdiy.exe
  2⤵
  PID:9128
- C:\Windows\System\FdwxbMv.exe
  C:\Windows\System\FdwxbMv.exe
  2⤵
  PID:10140
- C:\Windows\System\APaKFzi.exe
  C:\Windows\System\APaKFzi.exe
  2⤵
  PID:12032
- C:\Windows\System\ygOMhXc.exe
  C:\Windows\System\ygOMhXc.exe
  2⤵
  PID:11372
- C:\Windows\System\ZUoOBxi.exe
  C:\Windows\System\ZUoOBxi.exe
  2⤵
  PID:12472
- C:\Windows\System\yeMZNdL.exe
  C:\Windows\System\yeMZNdL.exe
  2⤵
  PID:12972
- C:\Windows\System\KbVYtnQ.exe
  C:\Windows\System\KbVYtnQ.exe
  2⤵
  PID:13188
- C:\Windows\System\GhsHYYJ.exe
  C:\Windows\System\GhsHYYJ.exe
  2⤵
  PID:13128
- C:\Windows\System\wYrPKKl.exe
  C:\Windows\System\wYrPKKl.exe
  2⤵
  PID:13080
- C:\Windows\System\DYXfqaf.exe
  C:\Windows\System\DYXfqaf.exe
  2⤵
  PID:11164
- C:\Windows\System\PMWOaJr.exe
  C:\Windows\System\PMWOaJr.exe
  2⤵
  PID:13036
- C:\Windows\System\OmbgRuy.exe
  C:\Windows\System\OmbgRuy.exe
  2⤵
  PID:12192
- C:\Windows\System\UWkmtie.exe
  C:\Windows\System\UWkmtie.exe
  2⤵
  PID:11640
- C:\Windows\System\KxmgthK.exe
  C:\Windows\System\KxmgthK.exe
  2⤵
  PID:12528
- C:\Windows\System\JWYXiTY.exe
  C:\Windows\System\JWYXiTY.exe
  2⤵
  PID:8828
- C:\Windows\System\ifyGjRT.exe
  C:\Windows\System\ifyGjRT.exe
  2⤵
  PID:7108
- C:\Windows\System\CACmVWN.exe
  C:\Windows\System\CACmVWN.exe
  2⤵
  PID:9568
- C:\Windows\System\oeYeJQr.exe
  C:\Windows\System\oeYeJQr.exe
  2⤵
  PID:9484
- C:\Windows\System\hMJHzhT.exe
  C:\Windows\System\hMJHzhT.exe
  2⤵
  PID:10792
- C:\Windows\System\wKkvvDL.exe
  C:\Windows\System\wKkvvDL.exe
  2⤵
  PID:4708
- C:\Windows\System\qqhnbag.exe
  C:\Windows\System\qqhnbag.exe
  2⤵
  PID:12232
- C:\Windows\System\uJhglAO.exe
  C:\Windows\System\uJhglAO.exe
  2⤵
  PID:12180
- C:\Windows\System\AfJAEOO.exe
  C:\Windows\System\AfJAEOO.exe
  2⤵
  PID:10660
- C:\Windows\System\QzQHnmA.exe
  C:\Windows\System\QzQHnmA.exe
  2⤵
  PID:12120
- C:\Windows\System\HOkblYm.exe
  C:\Windows\System\HOkblYm.exe
  2⤵
  PID:12920
- C:\Windows\System\ywLKGHn.exe
  C:\Windows\System\ywLKGHn.exe
  2⤵
  PID:11964
- C:\Windows\System\FQKXQkl.exe
  C:\Windows\System\FQKXQkl.exe
  2⤵
  PID:12484
- C:\Windows\System\nXLAaGT.exe
  C:\Windows\System\nXLAaGT.exe
  2⤵
  PID:9436
- C:\Windows\System\QbnKZON.exe
  C:\Windows\System\QbnKZON.exe
  2⤵
  PID:11596
- C:\Windows\System\tUvrnPP.exe
  C:\Windows\System\tUvrnPP.exe
  2⤵
  PID:15188
- C:\Windows\System\gVCFmtf.exe
  C:\Windows\System\gVCFmtf.exe
  2⤵
  PID:10888
- C:\Windows\System\lQKPVUC.exe
  C:\Windows\System\lQKPVUC.exe
  2⤵
  PID:11232
- C:\Windows\System\LjOQeQO.exe
  C:\Windows\System\LjOQeQO.exe
  2⤵
  PID:12544
- C:\Windows\System\OGLauOm.exe
  C:\Windows\System\OGLauOm.exe
  2⤵
  PID:10564
- C:\Windows\System\PrQuEqu.exe
  C:\Windows\System\PrQuEqu.exe
  2⤵
  PID:10264
- C:\Windows\System\Xihfrli.exe
  C:\Windows\System\Xihfrli.exe
  2⤵
  PID:10304
- C:\Windows\System\rqndQTT.exe
  C:\Windows\System\rqndQTT.exe
  2⤵
  PID:13156
- C:\Windows\System\YLCEJHP.exe
  C:\Windows\System\YLCEJHP.exe
  2⤵
  PID:13592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ge5kmxou.4er.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BOkhTQn.exe

Filesize
1.9MB

MD5
38c1280f971ce9c235728d6a4070a319

SHA1
1fa99a5fb92f7cebcf47a55dc7b046d41325766a

SHA256
3fdfb408103db730e19a4384179cea04f75244f7e468eb5d87269e0fff1a5f55

SHA512
179ec021abc358b5755bef117b1ad2c81aa4fedb75e9a73bf117e4ee3f4c9a6a61c1169c3c7f940901c0d8fcc2324bb6d05cffb26141df550288bfe0d76efe28

Download Submit
C:\Windows\System\CAmbVGP.exe

Filesize
1.9MB

MD5
06b7753995318d50ca46d1df5fd47946

SHA1
3b0f32b097888a74ff8caa8e324a8056f7e297bd

SHA256
b5942b02c880836abab48287482bba35f763657882ee008a5df94aa48cdc7aff

SHA512
6a0488ac85fac0a100640dbdbb58e446f6cb84cc600929ba01c0d1c2f057276f7121cbad401c6f427e582eef6d8979c3c79fe3a4c0b910caf38061ff51feb931

Download Submit
C:\Windows\System\DDwJFLE.exe

Filesize
1.9MB

MD5
7f67fe59fcca7baa7aaca4c418ea0098

SHA1
94184596abf38ff11f9aab0ea8d4eb1864c62b9e

SHA256
9a3580b9721a104f95e505eca30c9ed1fff3972dcadf4477d81e0d387574571e

SHA512
9bbe8f29457fab98362bbf718b6380e8567e9cfd494906677001bd8821fd4e4c8f76c20e00283b4e7f9ba83be706f154ba231c964b22b6a4e038b03cd9225147

Download Submit
C:\Windows\System\EKkgFWW.exe

Filesize
1.9MB

MD5
fd6e704e338804ebee34054901a10d0f

SHA1
06d20abb260c0456218238eb0e7a8b383c97ba0b

SHA256
89f1d14d1a21682f6c89483efb708c63f778e7b512f6a10d7debbacedc33d4f1

SHA512
879f5d4b623d495a891544ccc7d985b4890331e881e6583534f30e5427de9671326810dab2b5bc7b87853335d2fec031553d1cc45a741c6ab70bdda6ac705f7f

Download Submit
C:\Windows\System\HPmatsb.exe

Filesize
1.9MB

MD5
d8b458b75abfd18e5322b0946d2bea8c

SHA1
e84c12c31d6b75d5e83e2d1cf2435b09a2b3bbc6

SHA256
bbaa680fd9f4cd93af6f1eafdb50513dd4c0db036f056d79b515aab543c8f8a3

SHA512
5851a472ad25040fd5e9baec6e3f01dc18dee4fac7be592229779ec351430a5a33fecb8cdcc1fff235c35c77d409165f32ccbe2526fc28367a50e0da37e3881d

Download Submit
C:\Windows\System\HRwfNnk.exe

Filesize
1.9MB

MD5
f37e2e14c57d37f7d19b83faca7b344b

SHA1
e79943e0e91befa79a42445100af1de0ab910f5c

SHA256
8db22d3c454a55b5951eda22da7d74988a0516ce816e9aae366a1de4962f3899

SHA512
e42a22495ea6a427cdd621f36945d07a29dd6259a2f91095e4e17731e9b6f79c81ce36df112be6cb4c2dcb040d9164d4d0cd152e9a1b478dbb2547bdd6e29125

Download Submit
C:\Windows\System\IQTEDwC.exe

Filesize
1.9MB

MD5
4260ecc72a8bcc57f3f25415726a6bd3

SHA1
cab14c49fc8a60becee386b778b0be830d82f164

SHA256
adefbd5bd03942e1b552ac81be60b4bb4a05af458913c00cf23c915556da6e3f

SHA512
90ad17fde72f81d85828400a14298128f23ff1429b72f7720e7e74b36fee4566daa4ff7918b9649f7154dee955d163d149b8e2f1404a65288823c64d126f4ca9

Download Submit
C:\Windows\System\IkSUYXJ.exe

Filesize
1.9MB

MD5
e3148f7ca53165abd53b38fe87d0a6f2

SHA1
e4c43edac58cfbfa207b9265ce5f4050bd36f40d

SHA256
ea422a88c43d3386bdcb7bbac076a46b1c2846a454ab506aba65f421beb2d2c7

SHA512
6aea3d4cabc83593a898f20e7d17542000177f929a5e53b987ffc942318b8ae387e3b2a572c024f1b31099eee249941223855dab0a0da704fd5bfc6b6234c0a3

Download Submit
C:\Windows\System\JPMnpiR.exe

Filesize
1.9MB

MD5
7e9da9777a25fcbd5919c10a997ba2b7

SHA1
7bd98c3d401a2c7383f9a87a0f54fe0a32ebae76

SHA256
48b920e5a657d1203758b4f80f2fdd101e934935fafb5720c34dc876b03b4aef

SHA512
d89e6c5ac16723b8a82309dde77f61eb6f14b554b7aec1f0a1da171b641aa0bd126f74c101f2df486891cd71f698399cb257a450e3c9af189b6def6a5796d71c

Download Submit
C:\Windows\System\JRrBnFs.exe

Filesize
1.9MB

MD5
90ac61cf45dbbe992b6017fb214227d2

SHA1
1e229645440406061dcf24914afd64b40393db42

SHA256
e71c6aaa755b1651afa53d8600b7af4c8a96d8f08d50ccedeac897327728935e

SHA512
f66b06a1c602d6571faec8d2f3be8d97c22e7dbbf92e25960264a1a73cba768583419ba2ae8a95969f1af52e48372a16116a31126b7e2fbdfc31f6e503f66fa9

Download Submit
C:\Windows\System\KhQRYNF.exe

Filesize
1.9MB

MD5
179a52f25cb9e796183425bdf15eb63c

SHA1
8f8414463d7101c208da5e3389f606e383a59f76

SHA256
70ca878ba9fba5d6a1a9650391029a0d796aefa34814c2f7071c11a8a0633e8c

SHA512
cb2296f586ba7aa386d8c7fac925a61929000e141f91a450fc296cdcf9bd6a23151fdb647066b0a006f91c161cf574a3d185a30af52333621f5ea41152753fd6

Download Submit
C:\Windows\System\NYpKTWR.exe

Filesize
1.9MB

MD5
17ad6e9c9a97c404556453148a6bf847

SHA1
06f345a89efc9c226933e5ee1a0af22b909a4d00

SHA256
10082961b144d2d429c6526d5d81cfaa90e66af31ef553a5cca7b5ede223ef3b

SHA512
ffaa2db2b5a67517da04dcf755657968cea1a4f4de177fa1a2dfe87bdde2b64aea157d1bf00a0bba5815c6249037c16fb0703783ab05b1fc82eb3c814e59d5c6

Download Submit
C:\Windows\System\NjgthHb.exe

Filesize
1.9MB

MD5
e01f22a88c2f9e20953f0f906ea3a334

SHA1
d1f52ae132c38c8ebad10131b7dc743d222fbea2

SHA256
3eeae1a298322524ffe51da2d259b4dedd589a8004f890b958389a84eee27d1a

SHA512
3392ac97542be73579846a2b6708f8d25e3e29cf4beb7db28eb328ab391b24a018ce8c86a391e7751bf64976ec8d3062029bb59b94b822a98e54ff83a46215b6

Download Submit
C:\Windows\System\QcwqyiB.exe

Filesize
8B

MD5
0a4d9fd0cc8fe1472d155d5d981ff235

SHA1
137003f778b74f1b96494293112b43e4307e765e

SHA256
4707e767d70e4899759ce8aba6535007a27f8c132e3f3e05b8b8ae03c23dd080

SHA512
ad9c5b802b25d2a28cbec3d4cc246b638fad901bd44704bb559f8a0cf5c0d25f339a2e2fe9f4b8bbba249477fc11b0b14c51d97cfa76d081fb255f90811dd5c7

Download Submit
C:\Windows\System\RPXhpLD.exe

Filesize
1.9MB

MD5
edc3a09eceb68bc711ba75bd60991c37

SHA1
4207b01dd08219e5f816cb98e46615a13a7621b5

SHA256
33e7b92e69b38eb29b7471c560a2732c9d43de6fcdc0c73e2863e88e0f667233

SHA512
785ebab08b4400b901432d195f492dbc6f3cb1936050ac33eeac64c49749bf4ec08a0ceb7dd658900e580707174bd0a4eabb51570de0f00bf78e5f2edfe25c85

Download Submit
C:\Windows\System\SZEPToi.exe

Filesize
1.9MB

MD5
b63ec93fbff01200ebbb391b122d6a72

SHA1
4620b28a06f5fab01e109c5c178a58a32b9e7c71

SHA256
25b5242ed4a3f1bf7618a3484278a4bc545ec13a61d0bdfd12f876d21af60664

SHA512
490c30653735ea2e218864bac4a55f796661f9807e2b18c92aa6cc86b67a1a55d37e4948be2016561bb977f631b3bb8b891413ff2b17b3dff02894cb8f1a318a

Download Submit
C:\Windows\System\UEaUflp.exe

Filesize
1.9MB

MD5
709071cb9a56675ce741b1ecb0b744bf

SHA1
924d4d1940fdbd5e8bc89b01e354f94a65dca415

SHA256
1e120c1db44a505aa76ebdc128b7227e7ab5de753ab8ad61d10e63551665beac

SHA512
412969b842ad5b751178b10c1e0408a9a7ad3a323c6913e7499ad9651a80d21b161e9b25bc4416209dbbc6b8ec62fb18b908aef4e34d109cb4ea01820b0460a0

Download Submit
C:\Windows\System\UUvqNgF.exe

Filesize
1.9MB

MD5
cfac058afa3c0bb4447ede6481f5fa90

SHA1
2ab0fc3b5f0cb7640ca7efe2fbda0eceb0b7d9b5

SHA256
ef176dba70a33f77559ad6278394171e668677f11b4fd2a2b122588413230813

SHA512
62463dd68f82c3ed3ce8d684340f26f6822088679e1ca51a6db6e8bd8d7505780cb4b1e7d4d5a7d128e5647c026297aedb480fc20a57d7650544f16759edc468

Download Submit
C:\Windows\System\aJFTwoJ.exe

Filesize
1.9MB

MD5
427aa40063fd2d832a61779ef5204b0c

SHA1
4621ba0c3c3ae1281992df3d5ad94fe0df40afda

SHA256
a4e3f365e244a6dad3e693620e03b46ab56dee2b2d33d4d1cfc75155aad952e9

SHA512
eabc5b944585bad91012f326dd2755107f8dcbf88f499a0053ce6476215b5693f88780cd191fd98eb204fa72de10a773d04a70c43ff09c22297807fef4db86e1

Download Submit
C:\Windows\System\bUvmwpN.exe

Filesize
1.9MB

MD5
d7cd62b91ece65fd68414c1e07c5bc93

SHA1
2a15edf45202ade0203b3672eb9a75cd943ee210

SHA256
d3c4403981d9d42b1bd370c774ce624fd4bc844c97304c137f4abec0d04ffb19

SHA512
f78b71038a7c7629e4b838e66c3dc95564f9103dd0d13c5b106b8affb5188d987d4c037dda05c379a9fbd0de341e6e6f4665a65fc57a51c6ed57f01c4ae5d9cb

Download Submit
C:\Windows\System\cKxuMvR.exe

Filesize
1.9MB

MD5
6cf9d4e44d1b98dc6c24247c24099c7a

SHA1
ae1028523b9017a38850b9cb74750c813a4c3c02

SHA256
a9ec8befc16aed5525ebebe074a82858da92a058560bb472942ed23f107b59b9

SHA512
b262caed3c4ccd9790dc495ae9be8f307103cafed791a7a43f8ae05dfa778178a1be76731be2806b76ec35df946ab7ffc186a7f6cf7b8ff2a98567abf7913b1d

Download Submit
C:\Windows\System\eFgvZKk.exe

Filesize
1.9MB

MD5
32001efb5cc95bd547954391c006aa09

SHA1
ff58edfab6a80c222c418c4d0265f5a6516627d2

SHA256
927d0c1cdc8f914cc39c47c0ed52278fc2b66a1b16983650d3feb165fd0332ae

SHA512
78d6237d3fd0a3c06c27e9e39f2ca403ed6c48dd76d68c564077a2326579f459cc99a1babb30db04e5b463db4ccbcab4de833912fae7df880e0757fc6d910323

Download Submit
C:\Windows\System\hCPwfLC.exe

Filesize
1.9MB

MD5
207f76b4dfc175d74423596261ad459f

SHA1
8542b4fe1aa270e4a647cc920d970b073a4f5816

SHA256
ab3aa49025ffd06009d25a466418b164b87ef50217df2539c7aa49b1bcc92bab

SHA512
9d142110545cdfde0358ae64b3090988511bd80d480470f7fd3414b955abdfe15f67f038cb1ea68b646c425836746d69eb3ff7c3f7bccb1e8413121c0bd61def

Download Submit
C:\Windows\System\hppMVzT.exe

Filesize
1.9MB

MD5
b89909d2850e99b7ad40801667549247

SHA1
a296b880cf6984ca2cb72d35b8c790442a55ef3d

SHA256
77dde3f7b8fa42548549f8297497c32514b8e51c6b8b63facd81ef22e68cb069

SHA512
0610efc97e5d6fc2b0e4792d5f1b77035c4a2c8b1bdd05352be6ca5c3abc81c8c5390cc583f3ed49682df42af6ea293b9e99827f3b96826a3676d763e5296924

Download Submit
C:\Windows\System\jlAMtZM.exe

Filesize
1.9MB

MD5
ff0d2e5aad931471e93034bda9efb8fe

SHA1
fdcf5ce27780af6f529cf79337ba35201ea10c9c

SHA256
0de4a132836fc8d34e56d3db31667061235ecb0b52916d2d13151ac5be8aa922

SHA512
60cec02cd22e30f5a08bdb54cabb3e256bcb177f436780e2bb7ac9be2733847914c287704b81c04cb30e77cb7eb1171ad910597553b79f0a280923bb3ccbaf0d

Download Submit
C:\Windows\System\kJUxIKA.exe

Filesize
1.9MB

MD5
a68fd22a8cc8897d9932ea9c6bd1ce92

SHA1
4fb5047923051ffdae78a7ff7dcbfdd5eb6f107b

SHA256
02e731ff3434674269f46a61bd03f8bbdd08a471a57871226cdd42db6a1a6011

SHA512
2b63a99cc73df4f179a9f0ae7c56950b9671f4958cc9fdd6e9b0ed60b659b40fceb381701d44242a070401f092ca994b35683ad05da7b04a62098875ca196cb1

Download Submit
C:\Windows\System\kYstnEU.exe

Filesize
1.9MB

MD5
f6c7e08394048c770bc1c9b417295bb1

SHA1
38198b3088f1975eb05d2ba581f6c83df95693d7

SHA256
4d4195e43bac4a53985bc554f44f59e69c51b419f115f6bc2e7bbdb5d3c7c741

SHA512
bd29fff67a212705693d1e86c55bfca5f54dc42b4b4679976b655a1009ef81e89a413afc71b45f6e6bd46b8691f77cf5d28870585b42996d6b419464c964b5da

Download Submit
C:\Windows\System\ktBOryN.exe

Filesize
1.9MB

MD5
65f24549641b8f50f15c7e27f1ef2e0b

SHA1
d40a6e28aee54036466321b14dc2fffd1eb5543c

SHA256
946fb2d57c2ef318f6a348d21d87cd63d4a2aa8429be6133096c5a64e602c15b

SHA512
6458183b778e2a1ff6f43909fedc3909cbda9944f215ecef056288df7a3a8a0acd6723fb7ff7a4eaf3ba59e2f7394f1e21e1c126743079befe12f49cfb7241f4

Download Submit
C:\Windows\System\mIiYLUx.exe

Filesize
1.9MB

MD5
b21221f0c33273e44f14f9ca4add543c

SHA1
cc9a5e98b8b34452a2e3b2bfcaac64a7588fd0b6

SHA256
52acda47c3008544ecf9c237a0a5f73b70e692baa2f5904a92e69312bb4de645

SHA512
79e0b06cab204340100cc801229cfdc099609c3d21ba2d3ff19ef9edcfed5f3146b22b3d8e648e7ef5ccc4f7efc00d973d34768c1ffa1488af7ffd0bdb3111d2

Download Submit
C:\Windows\System\qKuCfdo.exe

Filesize
1.9MB

MD5
9669acbea80f2c1c8b4a39f7afe1be47

SHA1
84305f20f41859627880dd67247e5d58a20bd76a

SHA256
412a8851a860b0aed6bcf00885c1a6779c765e4c62d7eef817110994f86e34c3

SHA512
bf1ddf50cb01b27bb135488ae9613f9a9385b951df16c355a45d6d215ab0e3fbef388aa0e383bec67a59d0f782d75d183c1f1308e6f9b59344b74cb23814c94c

Download Submit
C:\Windows\System\rhvGlAx.exe

Filesize
18B

MD5
0ccf85372d6f08655cc5b8a1bfb286c6

SHA1
19c0d15afa3a1724e4aad3aeb560d62824d96ee6

SHA256
e346037445c26dd1dcaee6ec19c9921976440e12a46b5265512a2ebbe020b707

SHA512
46b3e86ab66175e5bdeaa19cae91f567d8c433aabd58be58bf936f08366e274c54b36c7ca0cfdeb255aae1ffab900a8353ef7f99aee465b682ac697979899e2c

Download Submit
C:\Windows\System\tcFEpMS.exe

Filesize
1.9MB

MD5
4cf68d70ad503630774337751e14d95a

SHA1
b5573a99258b97043c58d33020c4b18399792344

SHA256
704f3594f8ac62b8c7ed5666cc840526c601f383b5643b9c79324ebea15fd1b6

SHA512
fbdc3e399ed0081cc7c02f409e69b38fe716c0b1e4370a802f1edbf1c7b36152396f6a71f206b7cf30d88866e55252d6720b3f7a604d882a14a9c054f70f7c4c

Download Submit
C:\Windows\System\wCFyVmS.exe

Filesize
1.9MB

MD5
d86a70b71879f054873ade129b60c301

SHA1
f555c7eeb18f104266d64b4f34b58b6ea54102ba

SHA256
18797062bad96a4bbe559edda4aea1a16c5ddfab01ca67b40e3a27219d157bfd

SHA512
8f6163af5514d3518a152b2561b632e49c608d0e1d2dc20bfbd374b26186e7e946866e85a2ac8dfc61b397b109b2697c517edb13be31d52c66b8b7794e214e9d

Download Submit
C:\Windows\System\ycNoAlu.exe

Filesize
1.9MB

MD5
f85d5bd0c954352ca8d6ff03a3c5b075

SHA1
9922aaed8600964497aeabac2f983d38b400da33

SHA256
eccc73db20501cf60a11a44a87d6a74e55f627fb8d816105b7f212002b1eb6b7

SHA512
671f689f13dc48fb284a8fbc03a61d92c0df2dcc6abf61eb85b9c141ab2c24544ecaa7cacf7d5f2df736cfcb3d4f3d5cc96b8d9a2d2c69456a02e9cec231f2cb

Download Submit
C:\Windows\System\yeDMqCE.exe

Filesize
1.9MB

MD5
a613a408db16f92712de24be25a201fc

SHA1
27f218d4d8782268d69c8c5c1f92457eefb0c215

SHA256
159f3574790045f7b64651c7265cfc69985ba149ec4bca5f055b299e8ebd436c

SHA512
4d483d1de7db8a5c226dee210a1a4e74979670110acf51ff7f5b93ca7adf789840c1563e0465c2333278f73fed58db245be99eb68cb7802aff3b27b590dfeb83

Download Submit
C:\Windows\System\zDErLmH.exe

Filesize
1.9MB

MD5
78e1e8feec7f4ac0b83b487560228093

SHA1
78661e46ae9140ede7fe4797fd4993b8c5eacdaa

SHA256
39059d6b6a66a5bb08d389cdad4945b06c085210021f13e4207e8a77580f502e

SHA512
e69bbbf5a3f7ff0ac2947336b2ba371c006a99d8a10c8eebc14319cea37af52fbbfd8b8b2dd74ada7f63818d42c69359133e554f8073a20b2e0c613d679c8a3e

Download Submit
C:\Windows\System\zbSeEsd.exe

Filesize
1.9MB

MD5
cf76c9296e861c24c9adbef3cf417204

SHA1
0966ac851675e0afce07bc5da3918bec89eed60d

SHA256
13d3a79fe0d43f9f0175e13c79fe54d4cd5a03fad8af3414fb2fc242904f04e8

SHA512
74c73d53a96499f10952ff84066c7e75329b33b5bbe63ba76bd113a755ed506c23a8841821290a309ef85cc1795ae880e3e7c127b54b5471935df921b4f86386

Download Submit
C:\Windows\System\zurjPas.exe

Filesize
1.9MB

MD5
54feef3f2a8f511ab8f9d4b48286a256

SHA1
a4c0ee00eb0a5a98e60d8fb404ef179d8b472ae8

SHA256
1d33f63f0d44cc74cb64d244a955cea2c057d6d459b91b888f9e1a8c9f0eca87

SHA512
a6cc568ebcdd275a606183cb245cfd94f2f40171aa7590dd4060ab83b57539990f898aaeb7122ae1fff77ad781b1534aa3670459347cfd15f37e8df7ec895200

Download Submit
memory/228-4876-0x00007FF6A6E10000-0x00007FF6A7202000-memory.dmp

Filesize
3.9MB

Download
memory/228-81-0x00007FF6A6E10000-0x00007FF6A7202000-memory.dmp

Filesize
3.9MB

Download
memory/348-0-0x00007FF7637B0000-0x00007FF763BA2000-memory.dmp

Filesize
3.9MB

Download
memory/348-1-0x000002CC5F3A0000-0x000002CC5F3B0000-memory.dmp

Filesize
64KB

Download
memory/520-51-0x0000023B0BA90000-0x0000023B0BAA0000-memory.dmp

Filesize
64KB

Download
memory/520-46-0x00007FFAE6EB0000-0x00007FFAE7971000-memory.dmp

Filesize
10.8MB

Download
memory/520-108-0x0000023B245A0000-0x0000023B245C2000-memory.dmp

Filesize
136KB

Download
memory/520-50-0x0000023B0BA90000-0x0000023B0BAA0000-memory.dmp

Filesize
64KB

Download
memory/600-359-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp

Filesize
3.9MB

Download
memory/600-4995-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-106-0x00007FF796510000-0x00007FF796902000-memory.dmp

Filesize
3.9MB

Download
memory/1928-234-0x00007FF7C4FA0000-0x00007FF7C5392000-memory.dmp

Filesize
3.9MB

Download
memory/1928-4938-0x00007FF7C4FA0000-0x00007FF7C5392000-memory.dmp

Filesize
3.9MB

Download
memory/2088-52-0x00007FF714820000-0x00007FF714C12000-memory.dmp

Filesize
3.9MB

Download
memory/2296-364-0x00007FF652160000-0x00007FF652552000-memory.dmp

Filesize
3.9MB

Download
memory/2740-183-0x00007FF6F6770000-0x00007FF6F6B62000-memory.dmp

Filesize
3.9MB

Download
memory/2740-4905-0x00007FF6F6770000-0x00007FF6F6B62000-memory.dmp

Filesize
3.9MB

Download
memory/3332-4894-0x00007FF6FA7B0000-0x00007FF6FABA2000-memory.dmp

Filesize
3.9MB

Download
memory/3332-160-0x00007FF6FA7B0000-0x00007FF6FABA2000-memory.dmp

Filesize
3.9MB

Download
memory/3396-205-0x00007FF75CC00000-0x00007FF75CFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3396-4951-0x00007FF75CC00000-0x00007FF75CFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3552-4935-0x00007FF733480000-0x00007FF733872000-memory.dmp

Filesize
3.9MB

Download
memory/3552-143-0x00007FF733480000-0x00007FF733872000-memory.dmp

Filesize
3.9MB

Download
memory/3632-362-0x00007FF7AFE50000-0x00007FF7B0242000-memory.dmp

Filesize
3.9MB

Download
memory/3760-4924-0x00007FF6E6820000-0x00007FF6E6C12000-memory.dmp

Filesize
3.9MB

Download
memory/3760-223-0x00007FF6E6820000-0x00007FF6E6C12000-memory.dmp

Filesize
3.9MB

Download
memory/3784-339-0x00007FF62DAF0000-0x00007FF62DEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3784-4957-0x00007FF62DAF0000-0x00007FF62DEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3832-4981-0x00007FF698F10000-0x00007FF699302000-memory.dmp

Filesize
3.9MB

Download
memory/3832-232-0x00007FF698F10000-0x00007FF699302000-memory.dmp

Filesize
3.9MB

Download
memory/4036-4839-0x00007FF6B7020000-0x00007FF6B7412000-memory.dmp

Filesize
3.9MB

Download
memory/4036-60-0x00007FF6B7020000-0x00007FF6B7412000-memory.dmp

Filesize
3.9MB

Download
memory/4632-4947-0x00007FF70F460000-0x00007FF70F852000-memory.dmp

Filesize
3.9MB

Download
memory/4632-231-0x00007FF70F460000-0x00007FF70F852000-memory.dmp

Filesize
3.9MB

Download
memory/4804-365-0x00007FF627750000-0x00007FF627B42000-memory.dmp

Filesize
3.9MB

Download
memory/4804-4989-0x00007FF627750000-0x00007FF627B42000-memory.dmp

Filesize
3.9MB

Download
memory/4840-366-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp

Filesize
3.9MB

Download
memory/4840-4991-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-4974-0x00007FF7C53E0000-0x00007FF7C57D2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-193-0x00007FF7C53E0000-0x00007FF7C57D2000-memory.dmp

Filesize
3.9MB

Download
memory/5008-4960-0x00007FF6742E0000-0x00007FF6746D2000-memory.dmp

Filesize
3.9MB

Download
memory/5008-209-0x00007FF6742E0000-0x00007FF6746D2000-memory.dmp

Filesize
3.9MB

Download
memory/5116-4969-0x00007FF61BB90000-0x00007FF61BF82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-250-0x00007FF61BB90000-0x00007FF61BF82000-memory.dmp

Filesize
3.9MB

Download