xmrig | 6b9dc8abde1a811ace4a219770a5370190c42d96cfcb54e08533009c7904621a

Analysis

max time kernel
129s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
Size

1.9MB
MD5

058f662496114544a10d9377ee0b7224
SHA1

568bfd16f185aab8baa66b9103ad3fdb835dc737
SHA256

6b9dc8abde1a811ace4a219770a5370190c42d96cfcb54e08533009c7904621a
SHA512

a816ebad037f7cdeacd6dcac51319e2eb6038c580e2ea9a247c3e56ed2fca21e35db5cb14a9ef1a12c1b687cbef6f87722a56cfce190460345fa206c9d4ef80c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1v:NABQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/memory/220-66-0x00007FF746260000-0x00007FF746652000-memory.dmp	xmrig
behavioral2/memory/4868-123-0x00007FF626B10000-0x00007FF626F02000-memory.dmp	xmrig
behavioral2/memory/4940-130-0x00007FF727AD0000-0x00007FF727EC2000-memory.dmp	xmrig
behavioral2/memory/2228-134-0x00007FF7232D0000-0x00007FF7236C2000-memory.dmp	xmrig
behavioral2/memory/1792-387-0x00007FF730610000-0x00007FF730A02000-memory.dmp	xmrig
behavioral2/memory/992-133-0x00007FF793000000-0x00007FF7933F2000-memory.dmp	xmrig
behavioral2/memory/4216-127-0x00007FF6C0F20000-0x00007FF6C1312000-memory.dmp	xmrig
behavioral2/memory/4872-111-0x00007FF686820000-0x00007FF686C12000-memory.dmp	xmrig
behavioral2/memory/2944-110-0x00007FF655360000-0x00007FF655752000-memory.dmp	xmrig
behavioral2/memory/4308-106-0x00007FF7DD3A0000-0x00007FF7DD792000-memory.dmp	xmrig
behavioral2/memory/3568-105-0x00007FF75A930000-0x00007FF75AD22000-memory.dmp	xmrig
behavioral2/memory/4328-100-0x00007FF65BAE0000-0x00007FF65BED2000-memory.dmp	xmrig
behavioral2/memory/1008-78-0x00007FF63F5D0000-0x00007FF63F9C2000-memory.dmp	xmrig
behavioral2/memory/2604-69-0x00007FF7A3C00000-0x00007FF7A3FF2000-memory.dmp	xmrig
behavioral2/memory/716-53-0x00007FF6F7B10000-0x00007FF6F7F02000-memory.dmp	xmrig
behavioral2/memory/3692-50-0x00007FF751CD0000-0x00007FF7520C2000-memory.dmp	xmrig
behavioral2/memory/2640-2558-0x00007FF645D00000-0x00007FF6460F2000-memory.dmp	xmrig
behavioral2/memory/228-3385-0x00007FF7F9410000-0x00007FF7F9802000-memory.dmp	xmrig
behavioral2/memory/1388-3387-0x00007FF731BA0000-0x00007FF731F92000-memory.dmp	xmrig
behavioral2/memory/2960-3807-0x00007FF675740000-0x00007FF675B32000-memory.dmp	xmrig
behavioral2/memory/220-6220-0x00007FF746260000-0x00007FF746652000-memory.dmp	xmrig
behavioral2/memory/4308-6250-0x00007FF7DD3A0000-0x00007FF7DD792000-memory.dmp	xmrig
behavioral2/memory/2944-6257-0x00007FF655360000-0x00007FF655752000-memory.dmp	xmrig
behavioral2/memory/228-6271-0x00007FF7F9410000-0x00007FF7F9802000-memory.dmp	xmrig
behavioral2/memory/2640-6274-0x00007FF645D00000-0x00007FF6460F2000-memory.dmp	xmrig
behavioral2/memory/4872-6279-0x00007FF686820000-0x00007FF686C12000-memory.dmp	xmrig
behavioral2/memory/4868-6286-0x00007FF626B10000-0x00007FF626F02000-memory.dmp	xmrig
behavioral2/memory/4216-6289-0x00007FF6C0F20000-0x00007FF6C1312000-memory.dmp	xmrig
behavioral2/memory/4940-6292-0x00007FF727AD0000-0x00007FF727EC2000-memory.dmp	xmrig
behavioral2/memory/992-6295-0x00007FF793000000-0x00007FF7933F2000-memory.dmp	xmrig
behavioral2/memory/2228-6298-0x00007FF7232D0000-0x00007FF7236C2000-memory.dmp	xmrig
behavioral2/memory/1792-6301-0x00007FF730610000-0x00007FF730A02000-memory.dmp	xmrig
behavioral2/memory/2960-6572-0x00007FF675740000-0x00007FF675B32000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1340	powershell.exe
5	1340	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3692	WBQrLey.exe
4328	YypQmWX.exe
3568	IfoYLUQ.exe
716	HJExMWq.exe
220	CWcTbdF.exe
2604	dZpuHUo.exe
1008	ufVfIxE.exe
4308	FQnfUBv.exe
2944	omeNlHJ.exe
1492	yiaJfLn.exe
4872	NVQmfId.exe
228	JKxlieo.exe
2640	UauiQYd.exe
2960	NjGVvZT.exe
1388	DXyuske.exe
4868	JJknJeh.exe
4216	kaDSvcC.exe
4940	ViOeJNR.exe
992	oporfWP.exe
2228	YNbCAWP.exe
1792	AWiOkoE.exe
4588	ghsAIKD.exe
1268	fUAmSBm.exe
1364	JhHZGjQ.exe
1748	kjimaTh.exe
1228	UEvNjib.exe
4220	KfxUfzU.exe
5028	lknHPbD.exe
1772	qXcQqxA.exe
4172	uKcDCwC.exe
4168	HjZBNkd.exe
4992	SCqsehX.exe
3776	MkwTaXR.exe
3712	gjGMNzm.exe
1588	mbCJRFL.exe
4404	hQyPmeJ.exe
4204	ixmAMJW.exe
4024	dIfLnQJ.exe
1144	CLTzMbX.exe
3768	gXuFRej.exe
3240	fiHxJcp.exe
4676	OPsEIhy.exe
4804	gKHrkYA.exe
4080	itYQOUN.exe
1236	kqemQKy.exe
4820	obrCdcv.exe
760	COrRSXo.exe
1096	OmdSJDa.exe
820	cibaSiV.exe
2188	cBjGONZ.exe
4524	eLTlhyY.exe
1408	ZVqdXgw.exe
2184	yKaNYqX.exe
3524	WRWOQcw.exe
3108	jdIjMMY.exe
3336	jkrKIfM.exe
3188	JmcFSfS.exe
4496	HdyzeJq.exe
316	yhBHHsY.exe
568	MpfknVB.exe
2108	FhkHUlt.exe
1016	xLHMpAQ.exe
1900	neuQGQQ.exe
1468	BkdRCoR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3144-0-0x00007FF7282B0000-0x00007FF7286A2000-memory.dmp	upx
behavioral2/files/0x0008000000023286-5.dat	upx
behavioral2/files/0x000800000002341c-8.dat	upx
behavioral2/files/0x0007000000023420-33.dat	upx
behavioral2/files/0x0007000000023421-34.dat	upx
behavioral2/files/0x0007000000023426-63.dat	upx
behavioral2/memory/220-66-0x00007FF746260000-0x00007FF746652000-memory.dmp	upx
behavioral2/files/0x0007000000023427-85.dat	upx
behavioral2/files/0x0007000000023428-87.dat	upx
behavioral2/files/0x000700000002342a-101.dat	upx
behavioral2/files/0x000700000002342d-107.dat	upx
behavioral2/files/0x000700000002342e-114.dat	upx
behavioral2/memory/4868-123-0x00007FF626B10000-0x00007FF626F02000-memory.dmp	upx
behavioral2/memory/4940-130-0x00007FF727AD0000-0x00007FF727EC2000-memory.dmp	upx
behavioral2/memory/2228-134-0x00007FF7232D0000-0x00007FF7236C2000-memory.dmp	upx
behavioral2/files/0x0007000000023431-143.dat	upx
behavioral2/files/0x0007000000023433-153.dat	upx
behavioral2/memory/1792-387-0x00007FF730610000-0x00007FF730A02000-memory.dmp	upx
behavioral2/files/0x000700000002343c-195.dat	upx
behavioral2/files/0x000700000002343a-191.dat	upx
behavioral2/files/0x000700000002343b-190.dat	upx
behavioral2/files/0x0007000000023439-186.dat	upx
behavioral2/files/0x0007000000023438-181.dat	upx
behavioral2/files/0x0007000000023437-176.dat	upx
behavioral2/files/0x0007000000023436-171.dat	upx
behavioral2/files/0x0007000000023435-163.dat	upx
behavioral2/files/0x0007000000023434-158.dat	upx
behavioral2/files/0x0007000000023432-148.dat	upx
behavioral2/files/0x0007000000023430-141.dat	upx
behavioral2/memory/992-133-0x00007FF793000000-0x00007FF7933F2000-memory.dmp	upx
behavioral2/files/0x000700000002342f-131.dat	upx
behavioral2/files/0x000800000002341d-128.dat	upx
behavioral2/memory/4216-127-0x00007FF6C0F20000-0x00007FF6C1312000-memory.dmp	upx
behavioral2/memory/2960-117-0x00007FF675740000-0x00007FF675B32000-memory.dmp	upx
behavioral2/files/0x000700000002342c-112.dat	upx
behavioral2/memory/4872-111-0x00007FF686820000-0x00007FF686C12000-memory.dmp	upx
behavioral2/memory/2944-110-0x00007FF655360000-0x00007FF655752000-memory.dmp	upx
behavioral2/memory/4308-106-0x00007FF7DD3A0000-0x00007FF7DD792000-memory.dmp	upx
behavioral2/memory/3568-105-0x00007FF75A930000-0x00007FF75AD22000-memory.dmp	upx
behavioral2/memory/4328-100-0x00007FF65BAE0000-0x00007FF65BED2000-memory.dmp	upx
behavioral2/files/0x000700000002342b-96.dat	upx
behavioral2/memory/1388-94-0x00007FF731BA0000-0x00007FF731F92000-memory.dmp	upx
behavioral2/memory/2640-92-0x00007FF645D00000-0x00007FF6460F2000-memory.dmp	upx
behavioral2/files/0x0007000000023429-89.dat	upx
behavioral2/memory/228-83-0x00007FF7F9410000-0x00007FF7F9802000-memory.dmp	upx
behavioral2/memory/1492-79-0x00007FF7D0120000-0x00007FF7D0512000-memory.dmp	upx
behavioral2/memory/1008-78-0x00007FF63F5D0000-0x00007FF63F9C2000-memory.dmp	upx
behavioral2/memory/2604-69-0x00007FF7A3C00000-0x00007FF7A3FF2000-memory.dmp	upx
behavioral2/files/0x0008000000023423-64.dat	upx
behavioral2/files/0x0007000000023425-56.dat	upx
behavioral2/memory/716-53-0x00007FF6F7B10000-0x00007FF6F7F02000-memory.dmp	upx
behavioral2/files/0x0008000000023424-52.dat	upx
behavioral2/memory/3692-50-0x00007FF751CD0000-0x00007FF7520C2000-memory.dmp	upx
behavioral2/files/0x0007000000023422-49.dat	upx
behavioral2/files/0x000800000002341f-35.dat	upx
behavioral2/memory/2640-2558-0x00007FF645D00000-0x00007FF6460F2000-memory.dmp	upx
behavioral2/memory/228-3385-0x00007FF7F9410000-0x00007FF7F9802000-memory.dmp	upx
behavioral2/memory/1388-3387-0x00007FF731BA0000-0x00007FF731F92000-memory.dmp	upx
behavioral2/memory/2960-3807-0x00007FF675740000-0x00007FF675B32000-memory.dmp	upx
behavioral2/memory/220-6220-0x00007FF746260000-0x00007FF746652000-memory.dmp	upx
behavioral2/memory/4308-6250-0x00007FF7DD3A0000-0x00007FF7DD792000-memory.dmp	upx
behavioral2/memory/2944-6257-0x00007FF655360000-0x00007FF655752000-memory.dmp	upx
behavioral2/memory/228-6271-0x00007FF7F9410000-0x00007FF7F9802000-memory.dmp	upx
behavioral2/memory/2640-6274-0x00007FF645D00000-0x00007FF6460F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zTKLbPN.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\VhszPhu.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\YoHQzPy.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\ToIayAX.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\rJqpEJn.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\ndLKnVH.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\UyzVBni.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\FyNyLUe.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\DXDDpKX.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\mPHSiFf.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\HrULflA.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\HBogGjc.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\mqafSwG.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\erVyGjG.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\hOaapQd.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\HjUoADq.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\WHsElRT.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\kXVfjLO.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\idOOqum.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\UkIRVRu.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\MvvSmXq.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\qItfhEB.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\tzonspz.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\lqKoZKD.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\oKIeWNI.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\HXrkMWI.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\XUrMKCP.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\GcQEzFi.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\dNHwqRs.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\mFocqhf.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\vTuMFhY.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\TeGLNcU.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\IVEDelC.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\fLHIAAR.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\FejSqyP.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\ZAPDUEw.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\klOPnwG.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\zlkzVHW.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\ihTzCeW.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\XwkmnAZ.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\vfcVneo.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\VddZEAi.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\wjhBWpA.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\HTJCypx.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\vpXeuVr.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\HvJRVzQ.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\uJDwfTA.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\fyZbCuj.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\aavdVNY.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\vyFegJM.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\heVkkMo.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\bJwlmgT.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\pYrWaMZ.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\OjQjLat.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\vclSUtr.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\XftrdwS.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\BZjdofx.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\kTRCXKJ.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\mDzILrL.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\gBULlep.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\qvnaGBf.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\lWpOWnw.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\eSvVAFO.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\XOnAWtm.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1340	powershell.exe
1340	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeLockMemoryPrivilege	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1340	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	83
PID 3144 wrote to memory of 1340	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	83
PID 3144 wrote to memory of 3692	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	84
PID 3144 wrote to memory of 3692	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	84
PID 3144 wrote to memory of 4328	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	85
PID 3144 wrote to memory of 4328	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	85
PID 3144 wrote to memory of 3568	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	86
PID 3144 wrote to memory of 3568	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	86
PID 3144 wrote to memory of 716	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	87
PID 3144 wrote to memory of 716	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	87
PID 3144 wrote to memory of 220	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	88
PID 3144 wrote to memory of 220	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	88
PID 3144 wrote to memory of 2604	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	89
PID 3144 wrote to memory of 2604	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	89
PID 3144 wrote to memory of 1008	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	90
PID 3144 wrote to memory of 1008	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	90
PID 3144 wrote to memory of 4308	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	91
PID 3144 wrote to memory of 4308	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	91
PID 3144 wrote to memory of 2944	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	92
PID 3144 wrote to memory of 2944	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	92
PID 3144 wrote to memory of 1492	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	93
PID 3144 wrote to memory of 1492	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	93
PID 3144 wrote to memory of 4872	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	94
PID 3144 wrote to memory of 4872	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	94
PID 3144 wrote to memory of 228	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	95
PID 3144 wrote to memory of 228	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	95
PID 3144 wrote to memory of 2640	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	96
PID 3144 wrote to memory of 2640	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	96
PID 3144 wrote to memory of 2960	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	97
PID 3144 wrote to memory of 2960	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	97
PID 3144 wrote to memory of 1388	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	98
PID 3144 wrote to memory of 1388	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	98
PID 3144 wrote to memory of 4868	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	99
PID 3144 wrote to memory of 4868	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	99
PID 3144 wrote to memory of 4216	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	100
PID 3144 wrote to memory of 4216	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	100
PID 3144 wrote to memory of 4940	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	101
PID 3144 wrote to memory of 4940	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	101
PID 3144 wrote to memory of 992	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	102
PID 3144 wrote to memory of 992	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	102
PID 3144 wrote to memory of 2228	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	103
PID 3144 wrote to memory of 2228	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	103
PID 3144 wrote to memory of 1792	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	104
PID 3144 wrote to memory of 1792	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	104
PID 3144 wrote to memory of 4588	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	105
PID 3144 wrote to memory of 4588	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	105
PID 3144 wrote to memory of 1268	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	106
PID 3144 wrote to memory of 1268	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	106
PID 3144 wrote to memory of 1364	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	107
PID 3144 wrote to memory of 1364	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	107
PID 3144 wrote to memory of 1748	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	108
PID 3144 wrote to memory of 1748	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	108
PID 3144 wrote to memory of 1228	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	109
PID 3144 wrote to memory of 1228	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	109
PID 3144 wrote to memory of 4220	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	110
PID 3144 wrote to memory of 4220	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	110
PID 3144 wrote to memory of 5028	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	111
PID 3144 wrote to memory of 5028	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	111
PID 3144 wrote to memory of 1772	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	112
PID 3144 wrote to memory of 1772	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	112
PID 3144 wrote to memory of 4172	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	113
PID 3144 wrote to memory of 4172	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	113
PID 3144 wrote to memory of 4168	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	114
PID 3144 wrote to memory of 4168	3144	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\058f662496114544a10d9377ee0b7224_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1340
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1340" "2952" "2876" "2956" "0" "0" "2960" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3192
- C:\Windows\System\WBQrLey.exe
  C:\Windows\System\WBQrLey.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\YypQmWX.exe
  C:\Windows\System\YypQmWX.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\IfoYLUQ.exe
  C:\Windows\System\IfoYLUQ.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\HJExMWq.exe
  C:\Windows\System\HJExMWq.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\CWcTbdF.exe
  C:\Windows\System\CWcTbdF.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\dZpuHUo.exe
  C:\Windows\System\dZpuHUo.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\ufVfIxE.exe
  C:\Windows\System\ufVfIxE.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\FQnfUBv.exe
  C:\Windows\System\FQnfUBv.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\omeNlHJ.exe
  C:\Windows\System\omeNlHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\yiaJfLn.exe
  C:\Windows\System\yiaJfLn.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\NVQmfId.exe
  C:\Windows\System\NVQmfId.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\JKxlieo.exe
  C:\Windows\System\JKxlieo.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\UauiQYd.exe
  C:\Windows\System\UauiQYd.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\NjGVvZT.exe
  C:\Windows\System\NjGVvZT.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\DXyuske.exe
  C:\Windows\System\DXyuske.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\JJknJeh.exe
  C:\Windows\System\JJknJeh.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\kaDSvcC.exe
  C:\Windows\System\kaDSvcC.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\ViOeJNR.exe
  C:\Windows\System\ViOeJNR.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\oporfWP.exe
  C:\Windows\System\oporfWP.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\YNbCAWP.exe
  C:\Windows\System\YNbCAWP.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\AWiOkoE.exe
  C:\Windows\System\AWiOkoE.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\ghsAIKD.exe
  C:\Windows\System\ghsAIKD.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\fUAmSBm.exe
  C:\Windows\System\fUAmSBm.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\JhHZGjQ.exe
  C:\Windows\System\JhHZGjQ.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\kjimaTh.exe
  C:\Windows\System\kjimaTh.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\UEvNjib.exe
  C:\Windows\System\UEvNjib.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\KfxUfzU.exe
  C:\Windows\System\KfxUfzU.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\lknHPbD.exe
  C:\Windows\System\lknHPbD.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\qXcQqxA.exe
  C:\Windows\System\qXcQqxA.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\uKcDCwC.exe
  C:\Windows\System\uKcDCwC.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\HjZBNkd.exe
  C:\Windows\System\HjZBNkd.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\SCqsehX.exe
  C:\Windows\System\SCqsehX.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\MkwTaXR.exe
  C:\Windows\System\MkwTaXR.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\gjGMNzm.exe
  C:\Windows\System\gjGMNzm.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\mbCJRFL.exe
  C:\Windows\System\mbCJRFL.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\hQyPmeJ.exe
  C:\Windows\System\hQyPmeJ.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\ixmAMJW.exe
  C:\Windows\System\ixmAMJW.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\dIfLnQJ.exe
  C:\Windows\System\dIfLnQJ.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\CLTzMbX.exe
  C:\Windows\System\CLTzMbX.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\gXuFRej.exe
  C:\Windows\System\gXuFRej.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\fiHxJcp.exe
  C:\Windows\System\fiHxJcp.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\OPsEIhy.exe
  C:\Windows\System\OPsEIhy.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\gKHrkYA.exe
  C:\Windows\System\gKHrkYA.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\itYQOUN.exe
  C:\Windows\System\itYQOUN.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\kqemQKy.exe
  C:\Windows\System\kqemQKy.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\obrCdcv.exe
  C:\Windows\System\obrCdcv.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\COrRSXo.exe
  C:\Windows\System\COrRSXo.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\OmdSJDa.exe
  C:\Windows\System\OmdSJDa.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\cibaSiV.exe
  C:\Windows\System\cibaSiV.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\cBjGONZ.exe
  C:\Windows\System\cBjGONZ.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\eLTlhyY.exe
  C:\Windows\System\eLTlhyY.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\ZVqdXgw.exe
  C:\Windows\System\ZVqdXgw.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\yKaNYqX.exe
  C:\Windows\System\yKaNYqX.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\WRWOQcw.exe
  C:\Windows\System\WRWOQcw.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\jdIjMMY.exe
  C:\Windows\System\jdIjMMY.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\jkrKIfM.exe
  C:\Windows\System\jkrKIfM.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\JmcFSfS.exe
  C:\Windows\System\JmcFSfS.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\HdyzeJq.exe
  C:\Windows\System\HdyzeJq.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\yhBHHsY.exe
  C:\Windows\System\yhBHHsY.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\MpfknVB.exe
  C:\Windows\System\MpfknVB.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\FhkHUlt.exe
  C:\Windows\System\FhkHUlt.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\xLHMpAQ.exe
  C:\Windows\System\xLHMpAQ.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\neuQGQQ.exe
  C:\Windows\System\neuQGQQ.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\BkdRCoR.exe
  C:\Windows\System\BkdRCoR.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\mMFQRTp.exe
  C:\Windows\System\mMFQRTp.exe
  2⤵
  PID:1520
- C:\Windows\System\gkwcRnf.exe
  C:\Windows\System\gkwcRnf.exe
  2⤵
  PID:4436
- C:\Windows\System\jtpeURN.exe
  C:\Windows\System\jtpeURN.exe
  2⤵
  PID:4780
- C:\Windows\System\DwRfQdO.exe
  C:\Windows\System\DwRfQdO.exe
  2⤵
  PID:2444
- C:\Windows\System\LzZEAOI.exe
  C:\Windows\System\LzZEAOI.exe
  2⤵
  PID:400
- C:\Windows\System\wNlqzID.exe
  C:\Windows\System\wNlqzID.exe
  2⤵
  PID:3620
- C:\Windows\System\JUJoeHf.exe
  C:\Windows\System\JUJoeHf.exe
  2⤵
  PID:4240
- C:\Windows\System\MXNkrfT.exe
  C:\Windows\System\MXNkrfT.exe
  2⤵
  PID:1500
- C:\Windows\System\jQirlRr.exe
  C:\Windows\System\jQirlRr.exe
  2⤵
  PID:4528
- C:\Windows\System\zBsFCin.exe
  C:\Windows\System\zBsFCin.exe
  2⤵
  PID:1648
- C:\Windows\System\jqyDJNX.exe
  C:\Windows\System\jqyDJNX.exe
  2⤵
  PID:1692
- C:\Windows\System\qPDbdRD.exe
  C:\Windows\System\qPDbdRD.exe
  2⤵
  PID:2636
- C:\Windows\System\fWMVdGc.exe
  C:\Windows\System\fWMVdGc.exe
  2⤵
  PID:3008
- C:\Windows\System\zFxUYnu.exe
  C:\Windows\System\zFxUYnu.exe
  2⤵
  PID:5132
- C:\Windows\System\OBXfVnP.exe
  C:\Windows\System\OBXfVnP.exe
  2⤵
  PID:5160
- C:\Windows\System\ptVlbGV.exe
  C:\Windows\System\ptVlbGV.exe
  2⤵
  PID:5192
- C:\Windows\System\BwyJvab.exe
  C:\Windows\System\BwyJvab.exe
  2⤵
  PID:5220
- C:\Windows\System\RNnvqit.exe
  C:\Windows\System\RNnvqit.exe
  2⤵
  PID:5256
- C:\Windows\System\bqVYIfY.exe
  C:\Windows\System\bqVYIfY.exe
  2⤵
  PID:5288
- C:\Windows\System\nAMQgQM.exe
  C:\Windows\System\nAMQgQM.exe
  2⤵
  PID:5316
- C:\Windows\System\dzkelLk.exe
  C:\Windows\System\dzkelLk.exe
  2⤵
  PID:5344
- C:\Windows\System\FwaWFqR.exe
  C:\Windows\System\FwaWFqR.exe
  2⤵
  PID:5372
- C:\Windows\System\rMvPDwF.exe
  C:\Windows\System\rMvPDwF.exe
  2⤵
  PID:5400
- C:\Windows\System\dEwXDQm.exe
  C:\Windows\System\dEwXDQm.exe
  2⤵
  PID:5428
- C:\Windows\System\tsWUkRD.exe
  C:\Windows\System\tsWUkRD.exe
  2⤵
  PID:5456
- C:\Windows\System\OIpzpRL.exe
  C:\Windows\System\OIpzpRL.exe
  2⤵
  PID:5484
- C:\Windows\System\uCDjokj.exe
  C:\Windows\System\uCDjokj.exe
  2⤵
  PID:5512
- C:\Windows\System\EgkIwDF.exe
  C:\Windows\System\EgkIwDF.exe
  2⤵
  PID:5540
- C:\Windows\System\usEYlRi.exe
  C:\Windows\System\usEYlRi.exe
  2⤵
  PID:5568
- C:\Windows\System\KHCNswD.exe
  C:\Windows\System\KHCNswD.exe
  2⤵
  PID:5596
- C:\Windows\System\njUjInk.exe
  C:\Windows\System\njUjInk.exe
  2⤵
  PID:5624
- C:\Windows\System\apJaVQY.exe
  C:\Windows\System\apJaVQY.exe
  2⤵
  PID:5652
- C:\Windows\System\UNyzVDb.exe
  C:\Windows\System\UNyzVDb.exe
  2⤵
  PID:5680
- C:\Windows\System\TMYfqtX.exe
  C:\Windows\System\TMYfqtX.exe
  2⤵
  PID:5748
- C:\Windows\System\tXOeACs.exe
  C:\Windows\System\tXOeACs.exe
  2⤵
  PID:5796
- C:\Windows\System\RJUcLUR.exe
  C:\Windows\System\RJUcLUR.exe
  2⤵
  PID:5836
- C:\Windows\System\OUIaQIS.exe
  C:\Windows\System\OUIaQIS.exe
  2⤵
  PID:5856
- C:\Windows\System\wXpBbvq.exe
  C:\Windows\System\wXpBbvq.exe
  2⤵
  PID:5876
- C:\Windows\System\OwONsZn.exe
  C:\Windows\System\OwONsZn.exe
  2⤵
  PID:5904
- C:\Windows\System\jEnZFkC.exe
  C:\Windows\System\jEnZFkC.exe
  2⤵
  PID:5960
- C:\Windows\System\wAsHXKQ.exe
  C:\Windows\System\wAsHXKQ.exe
  2⤵
  PID:5976
- C:\Windows\System\pnTiSSE.exe
  C:\Windows\System\pnTiSSE.exe
  2⤵
  PID:5996
- C:\Windows\System\dpaCibs.exe
  C:\Windows\System\dpaCibs.exe
  2⤵
  PID:6016
- C:\Windows\System\EmFbDEw.exe
  C:\Windows\System\EmFbDEw.exe
  2⤵
  PID:6032
- C:\Windows\System\zhfoWzt.exe
  C:\Windows\System\zhfoWzt.exe
  2⤵
  PID:6052
- C:\Windows\System\DVJBAgK.exe
  C:\Windows\System\DVJBAgK.exe
  2⤵
  PID:6108
- C:\Windows\System\cmycIhw.exe
  C:\Windows\System\cmycIhw.exe
  2⤵
  PID:4912
- C:\Windows\System\oTMGzFT.exe
  C:\Windows\System\oTMGzFT.exe
  2⤵
  PID:2988
- C:\Windows\System\UhooGzd.exe
  C:\Windows\System\UhooGzd.exe
  2⤵
  PID:4212
- C:\Windows\System\QvvZAeI.exe
  C:\Windows\System\QvvZAeI.exe
  2⤵
  PID:4800
- C:\Windows\System\hezBPMp.exe
  C:\Windows\System\hezBPMp.exe
  2⤵
  PID:1576
- C:\Windows\System\rqgWjZU.exe
  C:\Windows\System\rqgWjZU.exe
  2⤵
  PID:5216
- C:\Windows\System\lYRjdwJ.exe
  C:\Windows\System\lYRjdwJ.exe
  2⤵
  PID:5272
- C:\Windows\System\VFlKhTd.exe
  C:\Windows\System\VFlKhTd.exe
  2⤵
  PID:5328
- C:\Windows\System\kJrcXwk.exe
  C:\Windows\System\kJrcXwk.exe
  2⤵
  PID:5360
- C:\Windows\System\gmCPOgK.exe
  C:\Windows\System\gmCPOgK.exe
  2⤵
  PID:5416
- C:\Windows\System\XPbDOTJ.exe
  C:\Windows\System\XPbDOTJ.exe
  2⤵
  PID:5440
- C:\Windows\System\kZpuXGV.exe
  C:\Windows\System\kZpuXGV.exe
  2⤵
  PID:5472
- C:\Windows\System\gZcUIDh.exe
  C:\Windows\System\gZcUIDh.exe
  2⤵
  PID:5524
- C:\Windows\System\AxTabCT.exe
  C:\Windows\System\AxTabCT.exe
  2⤵
  PID:5584
- C:\Windows\System\ZdnGshO.exe
  C:\Windows\System\ZdnGshO.exe
  2⤵
  PID:5728
- C:\Windows\System\CABvalb.exe
  C:\Windows\System\CABvalb.exe
  2⤵
  PID:5644
- C:\Windows\System\mELdZWW.exe
  C:\Windows\System\mELdZWW.exe
  2⤵
  PID:652
- C:\Windows\System\flFRsVI.exe
  C:\Windows\System\flFRsVI.exe
  2⤵
  PID:1616
- C:\Windows\System\pXZjIvq.exe
  C:\Windows\System\pXZjIvq.exe
  2⤵
  PID:5780
- C:\Windows\System\vQASHZY.exe
  C:\Windows\System\vQASHZY.exe
  2⤵
  PID:5900
- C:\Windows\System\MxIvkdF.exe
  C:\Windows\System\MxIvkdF.exe
  2⤵
  PID:756
- C:\Windows\System\CnRaluB.exe
  C:\Windows\System\CnRaluB.exe
  2⤵
  PID:5968
- C:\Windows\System\IvEHEwt.exe
  C:\Windows\System\IvEHEwt.exe
  2⤵
  PID:2292
- C:\Windows\System\vyFegJM.exe
  C:\Windows\System\vyFegJM.exe
  2⤵
  PID:6048
- C:\Windows\System\idwSJuf.exe
  C:\Windows\System\idwSJuf.exe
  2⤵
  PID:6120
- C:\Windows\System\UvtEVtO.exe
  C:\Windows\System\UvtEVtO.exe
  2⤵
  PID:6100
- C:\Windows\System\WOHulwc.exe
  C:\Windows\System\WOHulwc.exe
  2⤵
  PID:2920
- C:\Windows\System\QJELPtA.exe
  C:\Windows\System\QJELPtA.exe
  2⤵
  PID:2536
- C:\Windows\System\aaWQKrO.exe
  C:\Windows\System\aaWQKrO.exe
  2⤵
  PID:4844
- C:\Windows\System\tlkrMhH.exe
  C:\Windows\System\tlkrMhH.exe
  2⤵
  PID:5180
- C:\Windows\System\vAvnALL.exe
  C:\Windows\System\vAvnALL.exe
  2⤵
  PID:5024
- C:\Windows\System\zbYolUx.exe
  C:\Windows\System\zbYolUx.exe
  2⤵
  PID:5448
- C:\Windows\System\kXogARh.exe
  C:\Windows\System\kXogARh.exe
  2⤵
  PID:5552
- C:\Windows\System\ZbxjgXQ.exe
  C:\Windows\System\ZbxjgXQ.exe
  2⤵
  PID:2324
- C:\Windows\System\VVtybia.exe
  C:\Windows\System\VVtybia.exe
  2⤵
  PID:5784
- C:\Windows\System\yGeaVjY.exe
  C:\Windows\System\yGeaVjY.exe
  2⤵
  PID:4624
- C:\Windows\System\GMwzEZa.exe
  C:\Windows\System\GMwzEZa.exe
  2⤵
  PID:5896
- C:\Windows\System\wDwTMfX.exe
  C:\Windows\System\wDwTMfX.exe
  2⤵
  PID:5972
- C:\Windows\System\biZtyrw.exe
  C:\Windows\System\biZtyrw.exe
  2⤵
  PID:6012
- C:\Windows\System\MSQMnJw.exe
  C:\Windows\System\MSQMnJw.exe
  2⤵
  PID:2728
- C:\Windows\System\SZtgUBB.exe
  C:\Windows\System\SZtgUBB.exe
  2⤵
  PID:6084
- C:\Windows\System\iFuoCZx.exe
  C:\Windows\System\iFuoCZx.exe
  2⤵
  PID:392
- C:\Windows\System\FxBKbOn.exe
  C:\Windows\System\FxBKbOn.exe
  2⤵
  PID:484
- C:\Windows\System\JuRnBwU.exe
  C:\Windows\System\JuRnBwU.exe
  2⤵
  PID:1044
- C:\Windows\System\cDPBQRF.exe
  C:\Windows\System\cDPBQRF.exe
  2⤵
  PID:3148
- C:\Windows\System\dMYTeVU.exe
  C:\Windows\System\dMYTeVU.exe
  2⤵
  PID:4464
- C:\Windows\System\jnGPOaz.exe
  C:\Windows\System\jnGPOaz.exe
  2⤵
  PID:5664
- C:\Windows\System\ERbRbSq.exe
  C:\Windows\System\ERbRbSq.exe
  2⤵
  PID:4916
- C:\Windows\System\iDzrbVl.exe
  C:\Windows\System\iDzrbVl.exe
  2⤵
  PID:5928
- C:\Windows\System\TrCrSXp.exe
  C:\Windows\System\TrCrSXp.exe
  2⤵
  PID:4836
- C:\Windows\System\OepEsyS.exe
  C:\Windows\System\OepEsyS.exe
  2⤵
  PID:704
- C:\Windows\System\XoXNdvH.exe
  C:\Windows\System\XoXNdvH.exe
  2⤵
  PID:2876
- C:\Windows\System\yjTfNPJ.exe
  C:\Windows\System\yjTfNPJ.exe
  2⤵
  PID:5744
- C:\Windows\System\vKOZcMa.exe
  C:\Windows\System\vKOZcMa.exe
  2⤵
  PID:6164
- C:\Windows\System\CJcTrke.exe
  C:\Windows\System\CJcTrke.exe
  2⤵
  PID:6188
- C:\Windows\System\NmWIUve.exe
  C:\Windows\System\NmWIUve.exe
  2⤵
  PID:6228
- C:\Windows\System\wKqUWZc.exe
  C:\Windows\System\wKqUWZc.exe
  2⤵
  PID:6244
- C:\Windows\System\jEyEAmF.exe
  C:\Windows\System\jEyEAmF.exe
  2⤵
  PID:6284
- C:\Windows\System\YqEXlSS.exe
  C:\Windows\System\YqEXlSS.exe
  2⤵
  PID:6304
- C:\Windows\System\kMQmDza.exe
  C:\Windows\System\kMQmDza.exe
  2⤵
  PID:6352
- C:\Windows\System\mFjcezo.exe
  C:\Windows\System\mFjcezo.exe
  2⤵
  PID:6380
- C:\Windows\System\lLerByx.exe
  C:\Windows\System\lLerByx.exe
  2⤵
  PID:6428
- C:\Windows\System\ubdSvdf.exe
  C:\Windows\System\ubdSvdf.exe
  2⤵
  PID:6460
- C:\Windows\System\wfMCfdX.exe
  C:\Windows\System\wfMCfdX.exe
  2⤵
  PID:6480
- C:\Windows\System\aChoGSG.exe
  C:\Windows\System\aChoGSG.exe
  2⤵
  PID:6500
- C:\Windows\System\TmAFHcD.exe
  C:\Windows\System\TmAFHcD.exe
  2⤵
  PID:6524
- C:\Windows\System\bAQgmKv.exe
  C:\Windows\System\bAQgmKv.exe
  2⤵
  PID:6540
- C:\Windows\System\ezxIFzP.exe
  C:\Windows\System\ezxIFzP.exe
  2⤵
  PID:6560
- C:\Windows\System\dsNcgKf.exe
  C:\Windows\System\dsNcgKf.exe
  2⤵
  PID:6584
- C:\Windows\System\zTKLbPN.exe
  C:\Windows\System\zTKLbPN.exe
  2⤵
  PID:6604
- C:\Windows\System\FliEEVm.exe
  C:\Windows\System\FliEEVm.exe
  2⤵
  PID:6656
- C:\Windows\System\IeFbnwX.exe
  C:\Windows\System\IeFbnwX.exe
  2⤵
  PID:6672
- C:\Windows\System\FuNvGSs.exe
  C:\Windows\System\FuNvGSs.exe
  2⤵
  PID:6696
- C:\Windows\System\drPYLhY.exe
  C:\Windows\System\drPYLhY.exe
  2⤵
  PID:6720
- C:\Windows\System\VAaOvFG.exe
  C:\Windows\System\VAaOvFG.exe
  2⤵
  PID:6744
- C:\Windows\System\mEdcrfT.exe
  C:\Windows\System\mEdcrfT.exe
  2⤵
  PID:6776
- C:\Windows\System\sPwIXfx.exe
  C:\Windows\System\sPwIXfx.exe
  2⤵
  PID:6816
- C:\Windows\System\CxrCntn.exe
  C:\Windows\System\CxrCntn.exe
  2⤵
  PID:6880
- C:\Windows\System\azUtLCc.exe
  C:\Windows\System\azUtLCc.exe
  2⤵
  PID:6896
- C:\Windows\System\tuOPYhT.exe
  C:\Windows\System\tuOPYhT.exe
  2⤵
  PID:6924
- C:\Windows\System\pGkbNHS.exe
  C:\Windows\System\pGkbNHS.exe
  2⤵
  PID:6964
- C:\Windows\System\WXTwxGX.exe
  C:\Windows\System\WXTwxGX.exe
  2⤵
  PID:6992
- C:\Windows\System\TbKyUwc.exe
  C:\Windows\System\TbKyUwc.exe
  2⤵
  PID:7016
- C:\Windows\System\UHeMszk.exe
  C:\Windows\System\UHeMszk.exe
  2⤵
  PID:7048
- C:\Windows\System\YnMPWqi.exe
  C:\Windows\System\YnMPWqi.exe
  2⤵
  PID:7068
- C:\Windows\System\jGlWrpZ.exe
  C:\Windows\System\jGlWrpZ.exe
  2⤵
  PID:7092
- C:\Windows\System\GVBaWZz.exe
  C:\Windows\System\GVBaWZz.exe
  2⤵
  PID:7120
- C:\Windows\System\sqEzZVq.exe
  C:\Windows\System\sqEzZVq.exe
  2⤵
  PID:464
- C:\Windows\System\SSfGtPB.exe
  C:\Windows\System\SSfGtPB.exe
  2⤵
  PID:3628
- C:\Windows\System\QGmzmLR.exe
  C:\Windows\System\QGmzmLR.exe
  2⤵
  PID:6216
- C:\Windows\System\uQLfOJS.exe
  C:\Windows\System\uQLfOJS.exe
  2⤵
  PID:6252
- C:\Windows\System\dMetYtY.exe
  C:\Windows\System\dMetYtY.exe
  2⤵
  PID:6320
- C:\Windows\System\SDobigc.exe
  C:\Windows\System\SDobigc.exe
  2⤵
  PID:6344
- C:\Windows\System\PiJrVgQ.exe
  C:\Windows\System\PiJrVgQ.exe
  2⤵
  PID:6420
- C:\Windows\System\jZoVbMd.exe
  C:\Windows\System\jZoVbMd.exe
  2⤵
  PID:6512
- C:\Windows\System\iWOeCTL.exe
  C:\Windows\System\iWOeCTL.exe
  2⤵
  PID:6532
- C:\Windows\System\tlFWrEt.exe
  C:\Windows\System\tlFWrEt.exe
  2⤵
  PID:6556
- C:\Windows\System\qrKvvIq.exe
  C:\Windows\System\qrKvvIq.exe
  2⤵
  PID:6688
- C:\Windows\System\PyjkQsj.exe
  C:\Windows\System\PyjkQsj.exe
  2⤵
  PID:6788
- C:\Windows\System\fRWEcza.exe
  C:\Windows\System\fRWEcza.exe
  2⤵
  PID:6768
- C:\Windows\System\yNpmWjv.exe
  C:\Windows\System\yNpmWjv.exe
  2⤵
  PID:6808
- C:\Windows\System\caYfsJL.exe
  C:\Windows\System\caYfsJL.exe
  2⤵
  PID:6892
- C:\Windows\System\VQrsgnw.exe
  C:\Windows\System\VQrsgnw.exe
  2⤵
  PID:7004
- C:\Windows\System\dlRcCFt.exe
  C:\Windows\System\dlRcCFt.exe
  2⤵
  PID:7060
- C:\Windows\System\EJfXSEe.exe
  C:\Windows\System\EJfXSEe.exe
  2⤵
  PID:7116
- C:\Windows\System\gwajIWy.exe
  C:\Windows\System\gwajIWy.exe
  2⤵
  PID:6148
- C:\Windows\System\rLQOmtZ.exe
  C:\Windows\System\rLQOmtZ.exe
  2⤵
  PID:6200
- C:\Windows\System\NGKPMvQ.exe
  C:\Windows\System\NGKPMvQ.exe
  2⤵
  PID:6372
- C:\Windows\System\hDIvLHL.exe
  C:\Windows\System\hDIvLHL.exe
  2⤵
  PID:6444
- C:\Windows\System\gBULlep.exe
  C:\Windows\System\gBULlep.exe
  2⤵
  PID:6536
- C:\Windows\System\oURRquU.exe
  C:\Windows\System\oURRquU.exe
  2⤵
  PID:6728
- C:\Windows\System\tScRDuT.exe
  C:\Windows\System\tScRDuT.exe
  2⤵
  PID:6836
- C:\Windows\System\zbaMntc.exe
  C:\Windows\System\zbaMntc.exe
  2⤵
  PID:6956
- C:\Windows\System\gGoYnCB.exe
  C:\Windows\System\gGoYnCB.exe
  2⤵
  PID:6240
- C:\Windows\System\vQrWkGv.exe
  C:\Windows\System\vQrWkGv.exe
  2⤵
  PID:6488
- C:\Windows\System\klHSHBq.exe
  C:\Windows\System\klHSHBq.exe
  2⤵
  PID:6920
- C:\Windows\System\bMeuJnl.exe
  C:\Windows\System\bMeuJnl.exe
  2⤵
  PID:7064
- C:\Windows\System\UfkoVKB.exe
  C:\Windows\System\UfkoVKB.exe
  2⤵
  PID:6300
- C:\Windows\System\Gslkpst.exe
  C:\Windows\System\Gslkpst.exe
  2⤵
  PID:7204
- C:\Windows\System\OcHMKin.exe
  C:\Windows\System\OcHMKin.exe
  2⤵
  PID:7228
- C:\Windows\System\ynwsYMP.exe
  C:\Windows\System\ynwsYMP.exe
  2⤵
  PID:7244
- C:\Windows\System\LeCfGws.exe
  C:\Windows\System\LeCfGws.exe
  2⤵
  PID:7264
- C:\Windows\System\OAwYpVN.exe
  C:\Windows\System\OAwYpVN.exe
  2⤵
  PID:7304
- C:\Windows\System\AwbVSNM.exe
  C:\Windows\System\AwbVSNM.exe
  2⤵
  PID:7336
- C:\Windows\System\MsBlJmA.exe
  C:\Windows\System\MsBlJmA.exe
  2⤵
  PID:7352
- C:\Windows\System\wFfMEVv.exe
  C:\Windows\System\wFfMEVv.exe
  2⤵
  PID:7368
- C:\Windows\System\HmdvbaB.exe
  C:\Windows\System\HmdvbaB.exe
  2⤵
  PID:7396
- C:\Windows\System\BWigTdx.exe
  C:\Windows\System\BWigTdx.exe
  2⤵
  PID:7424
- C:\Windows\System\eaHZKoQ.exe
  C:\Windows\System\eaHZKoQ.exe
  2⤵
  PID:7452
- C:\Windows\System\TcWPGnA.exe
  C:\Windows\System\TcWPGnA.exe
  2⤵
  PID:7476
- C:\Windows\System\NEcInTW.exe
  C:\Windows\System\NEcInTW.exe
  2⤵
  PID:7520
- C:\Windows\System\XJsCJUC.exe
  C:\Windows\System\XJsCJUC.exe
  2⤵
  PID:7544
- C:\Windows\System\tfYOXcI.exe
  C:\Windows\System\tfYOXcI.exe
  2⤵
  PID:7564
- C:\Windows\System\nEYKkgM.exe
  C:\Windows\System\nEYKkgM.exe
  2⤵
  PID:7592
- C:\Windows\System\qvxUqbM.exe
  C:\Windows\System\qvxUqbM.exe
  2⤵
  PID:7620
- C:\Windows\System\pzghqvK.exe
  C:\Windows\System\pzghqvK.exe
  2⤵
  PID:7672
- C:\Windows\System\HmLqeSD.exe
  C:\Windows\System\HmLqeSD.exe
  2⤵
  PID:7696
- C:\Windows\System\LxGvymW.exe
  C:\Windows\System\LxGvymW.exe
  2⤵
  PID:7720
- C:\Windows\System\wJdCMhU.exe
  C:\Windows\System\wJdCMhU.exe
  2⤵
  PID:7760
- C:\Windows\System\IuflVdd.exe
  C:\Windows\System\IuflVdd.exe
  2⤵
  PID:7796
- C:\Windows\System\wjSzYWY.exe
  C:\Windows\System\wjSzYWY.exe
  2⤵
  PID:7816
- C:\Windows\System\HGHaPTx.exe
  C:\Windows\System\HGHaPTx.exe
  2⤵
  PID:7852
- C:\Windows\System\onqiUKR.exe
  C:\Windows\System\onqiUKR.exe
  2⤵
  PID:7868
- C:\Windows\System\XPukGuE.exe
  C:\Windows\System\XPukGuE.exe
  2⤵
  PID:7896
- C:\Windows\System\pIlWaan.exe
  C:\Windows\System\pIlWaan.exe
  2⤵
  PID:7912
- C:\Windows\System\pECGsfl.exe
  C:\Windows\System\pECGsfl.exe
  2⤵
  PID:7932
- C:\Windows\System\TSWbIsv.exe
  C:\Windows\System\TSWbIsv.exe
  2⤵
  PID:7984
- C:\Windows\System\tnidbFn.exe
  C:\Windows\System\tnidbFn.exe
  2⤵
  PID:8004
- C:\Windows\System\qkKOYLC.exe
  C:\Windows\System\qkKOYLC.exe
  2⤵
  PID:8040
- C:\Windows\System\gdAHRDb.exe
  C:\Windows\System\gdAHRDb.exe
  2⤵
  PID:8060
- C:\Windows\System\BtHgnrY.exe
  C:\Windows\System\BtHgnrY.exe
  2⤵
  PID:8104
- C:\Windows\System\HPHijra.exe
  C:\Windows\System\HPHijra.exe
  2⤵
  PID:8128
- C:\Windows\System\UvyfZzt.exe
  C:\Windows\System\UvyfZzt.exe
  2⤵
  PID:8148
- C:\Windows\System\RPpltuj.exe
  C:\Windows\System\RPpltuj.exe
  2⤵
  PID:8168
- C:\Windows\System\KuiwcxW.exe
  C:\Windows\System\KuiwcxW.exe
  2⤵
  PID:6716
- C:\Windows\System\IUKWCwk.exe
  C:\Windows\System\IUKWCwk.exe
  2⤵
  PID:7220
- C:\Windows\System\qHzmEuV.exe
  C:\Windows\System\qHzmEuV.exe
  2⤵
  PID:7256
- C:\Windows\System\QYmFudz.exe
  C:\Windows\System\QYmFudz.exe
  2⤵
  PID:7288
- C:\Windows\System\HLzlIqv.exe
  C:\Windows\System\HLzlIqv.exe
  2⤵
  PID:7384
- C:\Windows\System\kgzcggq.exe
  C:\Windows\System\kgzcggq.exe
  2⤵
  PID:7416
- C:\Windows\System\xDJSTOf.exe
  C:\Windows\System\xDJSTOf.exe
  2⤵
  PID:7552
- C:\Windows\System\kJszOds.exe
  C:\Windows\System\kJszOds.exe
  2⤵
  PID:7584
- C:\Windows\System\wEFjpAV.exe
  C:\Windows\System\wEFjpAV.exe
  2⤵
  PID:7600
- C:\Windows\System\eqYWUYR.exe
  C:\Windows\System\eqYWUYR.exe
  2⤵
  PID:7680
- C:\Windows\System\GojcHNY.exe
  C:\Windows\System\GojcHNY.exe
  2⤵
  PID:7748
- C:\Windows\System\fhjFhFR.exe
  C:\Windows\System\fhjFhFR.exe
  2⤵
  PID:7792
- C:\Windows\System\koaxaGb.exe
  C:\Windows\System\koaxaGb.exe
  2⤵
  PID:7860
- C:\Windows\System\eoSJRPj.exe
  C:\Windows\System\eoSJRPj.exe
  2⤵
  PID:7888
- C:\Windows\System\cNMbMde.exe
  C:\Windows\System\cNMbMde.exe
  2⤵
  PID:7952
- C:\Windows\System\GhUutoc.exe
  C:\Windows\System\GhUutoc.exe
  2⤵
  PID:8068
- C:\Windows\System\AsKbWuU.exe
  C:\Windows\System\AsKbWuU.exe
  2⤵
  PID:8184
- C:\Windows\System\SQZVFDj.exe
  C:\Windows\System\SQZVFDj.exe
  2⤵
  PID:7196
- C:\Windows\System\gsWXvFx.exe
  C:\Windows\System\gsWXvFx.exe
  2⤵
  PID:7324
- C:\Windows\System\TZgHUYz.exe
  C:\Windows\System\TZgHUYz.exe
  2⤵
  PID:7560
- C:\Windows\System\qriahTl.exe
  C:\Windows\System\qriahTl.exe
  2⤵
  PID:7616
- C:\Windows\System\gUpzbYi.exe
  C:\Windows\System\gUpzbYi.exe
  2⤵
  PID:7712
- C:\Windows\System\jHsGYXE.exe
  C:\Windows\System\jHsGYXE.exe
  2⤵
  PID:7992
- C:\Windows\System\essnRtF.exe
  C:\Windows\System\essnRtF.exe
  2⤵
  PID:7360
- C:\Windows\System\XhxRVpx.exe
  C:\Windows\System\XhxRVpx.exe
  2⤵
  PID:7648
- C:\Windows\System\hBGzkze.exe
  C:\Windows\System\hBGzkze.exe
  2⤵
  PID:7880
- C:\Windows\System\xbPlbko.exe
  C:\Windows\System\xbPlbko.exe
  2⤵
  PID:8144
- C:\Windows\System\fwxPsWO.exe
  C:\Windows\System\fwxPsWO.exe
  2⤵
  PID:8204
- C:\Windows\System\Lhkjpjg.exe
  C:\Windows\System\Lhkjpjg.exe
  2⤵
  PID:8228
- C:\Windows\System\EXwRkzG.exe
  C:\Windows\System\EXwRkzG.exe
  2⤵
  PID:8248
- C:\Windows\System\RgbFyxI.exe
  C:\Windows\System\RgbFyxI.exe
  2⤵
  PID:8300
- C:\Windows\System\Zmspeje.exe
  C:\Windows\System\Zmspeje.exe
  2⤵
  PID:8316
- C:\Windows\System\eWjPBqF.exe
  C:\Windows\System\eWjPBqF.exe
  2⤵
  PID:8368
- C:\Windows\System\cNPAgue.exe
  C:\Windows\System\cNPAgue.exe
  2⤵
  PID:8388
- C:\Windows\System\nttaHKL.exe
  C:\Windows\System\nttaHKL.exe
  2⤵
  PID:8424
- C:\Windows\System\yfUaPLH.exe
  C:\Windows\System\yfUaPLH.exe
  2⤵
  PID:8448
- C:\Windows\System\AYGjhQn.exe
  C:\Windows\System\AYGjhQn.exe
  2⤵
  PID:8532
- C:\Windows\System\kNrPvfB.exe
  C:\Windows\System\kNrPvfB.exe
  2⤵
  PID:8596
- C:\Windows\System\lyFHCBx.exe
  C:\Windows\System\lyFHCBx.exe
  2⤵
  PID:8620
- C:\Windows\System\PHBgXHQ.exe
  C:\Windows\System\PHBgXHQ.exe
  2⤵
  PID:8636
- C:\Windows\System\dvoOByv.exe
  C:\Windows\System\dvoOByv.exe
  2⤵
  PID:8664
- C:\Windows\System\GJJDTBs.exe
  C:\Windows\System\GJJDTBs.exe
  2⤵
  PID:8688
- C:\Windows\System\SxNYyuM.exe
  C:\Windows\System\SxNYyuM.exe
  2⤵
  PID:8708
- C:\Windows\System\JOlmFvF.exe
  C:\Windows\System\JOlmFvF.exe
  2⤵
  PID:8736
- C:\Windows\System\boynbJJ.exe
  C:\Windows\System\boynbJJ.exe
  2⤵
  PID:8760
- C:\Windows\System\UkDMdlz.exe
  C:\Windows\System\UkDMdlz.exe
  2⤵
  PID:8780
- C:\Windows\System\FugHfAL.exe
  C:\Windows\System\FugHfAL.exe
  2⤵
  PID:8808
- C:\Windows\System\FNSyYkD.exe
  C:\Windows\System\FNSyYkD.exe
  2⤵
  PID:8828
- C:\Windows\System\jvfMWLE.exe
  C:\Windows\System\jvfMWLE.exe
  2⤵
  PID:8852
- C:\Windows\System\fxPdJeu.exe
  C:\Windows\System\fxPdJeu.exe
  2⤵
  PID:8872
- C:\Windows\System\RdlRwOM.exe
  C:\Windows\System\RdlRwOM.exe
  2⤵
  PID:8900
- C:\Windows\System\LDjXRuo.exe
  C:\Windows\System\LDjXRuo.exe
  2⤵
  PID:8920
- C:\Windows\System\GRmfQrh.exe
  C:\Windows\System\GRmfQrh.exe
  2⤵
  PID:8936
- C:\Windows\System\TNjuIRX.exe
  C:\Windows\System\TNjuIRX.exe
  2⤵
  PID:8992
- C:\Windows\System\BmlTvcS.exe
  C:\Windows\System\BmlTvcS.exe
  2⤵
  PID:9016
- C:\Windows\System\qffziEH.exe
  C:\Windows\System\qffziEH.exe
  2⤵
  PID:9036
- C:\Windows\System\SyZFxdN.exe
  C:\Windows\System\SyZFxdN.exe
  2⤵
  PID:9096
- C:\Windows\System\COPMlHK.exe
  C:\Windows\System\COPMlHK.exe
  2⤵
  PID:9144
- C:\Windows\System\wOFIgwl.exe
  C:\Windows\System\wOFIgwl.exe
  2⤵
  PID:9160
- C:\Windows\System\SNPNTSi.exe
  C:\Windows\System\SNPNTSi.exe
  2⤵
  PID:9208
- C:\Windows\System\QbndaxF.exe
  C:\Windows\System\QbndaxF.exe
  2⤵
  PID:8244
- C:\Windows\System\tUeNhHs.exe
  C:\Windows\System\tUeNhHs.exe
  2⤵
  PID:7536
- C:\Windows\System\hFohihn.exe
  C:\Windows\System\hFohihn.exe
  2⤵
  PID:8292
- C:\Windows\System\GCiCKEp.exe
  C:\Windows\System\GCiCKEp.exe
  2⤵
  PID:8380
- C:\Windows\System\sNSvqzP.exe
  C:\Windows\System\sNSvqzP.exe
  2⤵
  PID:8420
- C:\Windows\System\STHGsbb.exe
  C:\Windows\System\STHGsbb.exe
  2⤵
  PID:8496
- C:\Windows\System\vpkQBIP.exe
  C:\Windows\System\vpkQBIP.exe
  2⤵
  PID:8480
- C:\Windows\System\flerHUw.exe
  C:\Windows\System\flerHUw.exe
  2⤵
  PID:8524
- C:\Windows\System\QIfVbcA.exe
  C:\Windows\System\QIfVbcA.exe
  2⤵
  PID:8568
- C:\Windows\System\YTpYjvK.exe
  C:\Windows\System\YTpYjvK.exe
  2⤵
  PID:8632
- C:\Windows\System\HpRfbJW.exe
  C:\Windows\System\HpRfbJW.exe
  2⤵
  PID:8744
- C:\Windows\System\GGpKuri.exe
  C:\Windows\System\GGpKuri.exe
  2⤵
  PID:8752
- C:\Windows\System\sWanzqZ.exe
  C:\Windows\System\sWanzqZ.exe
  2⤵
  PID:8868
- C:\Windows\System\kVwrMer.exe
  C:\Windows\System\kVwrMer.exe
  2⤵
  PID:8864
- C:\Windows\System\UBnJHnc.exe
  C:\Windows\System\UBnJHnc.exe
  2⤵
  PID:9076
- C:\Windows\System\MViDbLl.exe
  C:\Windows\System\MViDbLl.exe
  2⤵
  PID:9116
- C:\Windows\System\klYWeSh.exe
  C:\Windows\System\klYWeSh.exe
  2⤵
  PID:9188
- C:\Windows\System\oDGbwcf.exe
  C:\Windows\System\oDGbwcf.exe
  2⤵
  PID:9184
- C:\Windows\System\iuRoXQe.exe
  C:\Windows\System\iuRoXQe.exe
  2⤵
  PID:8236
- C:\Windows\System\URXQAxx.exe
  C:\Windows\System\URXQAxx.exe
  2⤵
  PID:8324
- C:\Windows\System\chAlOms.exe
  C:\Windows\System\chAlOms.exe
  2⤵
  PID:8400
- C:\Windows\System\HMufRmq.exe
  C:\Windows\System\HMufRmq.exe
  2⤵
  PID:8484
- C:\Windows\System\jfqvzKS.exe
  C:\Windows\System\jfqvzKS.exe
  2⤵
  PID:8676
- C:\Windows\System\jiLJzwI.exe
  C:\Windows\System\jiLJzwI.exe
  2⤵
  PID:8840
- C:\Windows\System\IIdCynV.exe
  C:\Windows\System\IIdCynV.exe
  2⤵
  PID:9124
- C:\Windows\System\qOZewtW.exe
  C:\Windows\System\qOZewtW.exe
  2⤵
  PID:9156
- C:\Windows\System\mTitJrq.exe
  C:\Windows\System\mTitJrq.exe
  2⤵
  PID:8456
- C:\Windows\System\csWSvEV.exe
  C:\Windows\System\csWSvEV.exe
  2⤵
  PID:8772
- C:\Windows\System\ZDKOOGZ.exe
  C:\Windows\System\ZDKOOGZ.exe
  2⤵
  PID:8288
- C:\Windows\System\znimbRF.exe
  C:\Windows\System\znimbRF.exe
  2⤵
  PID:8224
- C:\Windows\System\ncFLMhY.exe
  C:\Windows\System\ncFLMhY.exe
  2⤵
  PID:9224
- C:\Windows\System\tGuUzJg.exe
  C:\Windows\System\tGuUzJg.exe
  2⤵
  PID:9264
- C:\Windows\System\NoFGgjb.exe
  C:\Windows\System\NoFGgjb.exe
  2⤵
  PID:9288
- C:\Windows\System\iuNzXGz.exe
  C:\Windows\System\iuNzXGz.exe
  2⤵
  PID:9312
- C:\Windows\System\AKFMSTe.exe
  C:\Windows\System\AKFMSTe.exe
  2⤵
  PID:9336
- C:\Windows\System\SUcCxtM.exe
  C:\Windows\System\SUcCxtM.exe
  2⤵
  PID:9356
- C:\Windows\System\OBCqpgD.exe
  C:\Windows\System\OBCqpgD.exe
  2⤵
  PID:9384
- C:\Windows\System\KJJBhbT.exe
  C:\Windows\System\KJJBhbT.exe
  2⤵
  PID:9408
- C:\Windows\System\SInBbKL.exe
  C:\Windows\System\SInBbKL.exe
  2⤵
  PID:9452
- C:\Windows\System\qYcRLvB.exe
  C:\Windows\System\qYcRLvB.exe
  2⤵
  PID:9476
- C:\Windows\System\hcNyqNc.exe
  C:\Windows\System\hcNyqNc.exe
  2⤵
  PID:9500
- C:\Windows\System\dzIbwnG.exe
  C:\Windows\System\dzIbwnG.exe
  2⤵
  PID:9528
- C:\Windows\System\GqjOWvr.exe
  C:\Windows\System\GqjOWvr.exe
  2⤵
  PID:9564
- C:\Windows\System\vxGhnmH.exe
  C:\Windows\System\vxGhnmH.exe
  2⤵
  PID:9596
- C:\Windows\System\EbPEkUq.exe
  C:\Windows\System\EbPEkUq.exe
  2⤵
  PID:9624
- C:\Windows\System\lbjEsGW.exe
  C:\Windows\System\lbjEsGW.exe
  2⤵
  PID:9648
- C:\Windows\System\oNgAqsB.exe
  C:\Windows\System\oNgAqsB.exe
  2⤵
  PID:9688
- C:\Windows\System\yPafbEQ.exe
  C:\Windows\System\yPafbEQ.exe
  2⤵
  PID:9704
- C:\Windows\System\BzoinrF.exe
  C:\Windows\System\BzoinrF.exe
  2⤵
  PID:9732
- C:\Windows\System\iJJZBwe.exe
  C:\Windows\System\iJJZBwe.exe
  2⤵
  PID:9772
- C:\Windows\System\xbFkBoo.exe
  C:\Windows\System\xbFkBoo.exe
  2⤵
  PID:9792
- C:\Windows\System\sgYrJpk.exe
  C:\Windows\System\sgYrJpk.exe
  2⤵
  PID:9820
- C:\Windows\System\IAZaVjB.exe
  C:\Windows\System\IAZaVjB.exe
  2⤵
  PID:9848
- C:\Windows\System\ymgYVbL.exe
  C:\Windows\System\ymgYVbL.exe
  2⤵
  PID:9880
- C:\Windows\System\SaKSreP.exe
  C:\Windows\System\SaKSreP.exe
  2⤵
  PID:9900
- C:\Windows\System\xgiqPfp.exe
  C:\Windows\System\xgiqPfp.exe
  2⤵
  PID:9920
- C:\Windows\System\FVIrzox.exe
  C:\Windows\System\FVIrzox.exe
  2⤵
  PID:9944
- C:\Windows\System\TrnWoDE.exe
  C:\Windows\System\TrnWoDE.exe
  2⤵
  PID:9976
- C:\Windows\System\fxoIkXj.exe
  C:\Windows\System\fxoIkXj.exe
  2⤵
  PID:10000
- C:\Windows\System\KkpcThQ.exe
  C:\Windows\System\KkpcThQ.exe
  2⤵
  PID:10032
- C:\Windows\System\sGUAjRc.exe
  C:\Windows\System\sGUAjRc.exe
  2⤵
  PID:10068
- C:\Windows\System\QvSnRdJ.exe
  C:\Windows\System\QvSnRdJ.exe
  2⤵
  PID:10092
- C:\Windows\System\DayVmtc.exe
  C:\Windows\System\DayVmtc.exe
  2⤵
  PID:10112
- C:\Windows\System\PcSMXHT.exe
  C:\Windows\System\PcSMXHT.exe
  2⤵
  PID:10148
- C:\Windows\System\VgoJsTp.exe
  C:\Windows\System\VgoJsTp.exe
  2⤵
  PID:10168
- C:\Windows\System\OZcCIFD.exe
  C:\Windows\System\OZcCIFD.exe
  2⤵
  PID:10188
- C:\Windows\System\FyqMEoa.exe
  C:\Windows\System\FyqMEoa.exe
  2⤵
  PID:10208
- C:\Windows\System\hnszvvn.exe
  C:\Windows\System\hnszvvn.exe
  2⤵
  PID:9072
- C:\Windows\System\sjpvBzK.exe
  C:\Windows\System\sjpvBzK.exe
  2⤵
  PID:9220
- C:\Windows\System\OQOFMvC.exe
  C:\Windows\System\OQOFMvC.exe
  2⤵
  PID:9352
- C:\Windows\System\ENmRddP.exe
  C:\Windows\System\ENmRddP.exe
  2⤵
  PID:9392
- C:\Windows\System\JnuHZNO.exe
  C:\Windows\System\JnuHZNO.exe
  2⤵
  PID:9496
- C:\Windows\System\uLdwSlq.exe
  C:\Windows\System\uLdwSlq.exe
  2⤵
  PID:9592
- C:\Windows\System\TWykTEk.exe
  C:\Windows\System\TWykTEk.exe
  2⤵
  PID:9636
- C:\Windows\System\QDkForz.exe
  C:\Windows\System\QDkForz.exe
  2⤵
  PID:9696
- C:\Windows\System\pkOYWMn.exe
  C:\Windows\System\pkOYWMn.exe
  2⤵
  PID:9764
- C:\Windows\System\mXjxaDu.exe
  C:\Windows\System\mXjxaDu.exe
  2⤵
  PID:9816
- C:\Windows\System\YrNyGvI.exe
  C:\Windows\System\YrNyGvI.exe
  2⤵
  PID:9872
- C:\Windows\System\akMNBBY.exe
  C:\Windows\System\akMNBBY.exe
  2⤵
  PID:9984
- C:\Windows\System\UpUPerS.exe
  C:\Windows\System\UpUPerS.exe
  2⤵
  PID:10080
- C:\Windows\System\oteWVWM.exe
  C:\Windows\System\oteWVWM.exe
  2⤵
  PID:10132
- C:\Windows\System\aqPSFOB.exe
  C:\Windows\System\aqPSFOB.exe
  2⤵
  PID:10140
- C:\Windows\System\sWeHXNd.exe
  C:\Windows\System\sWeHXNd.exe
  2⤵
  PID:10180
- C:\Windows\System\YeTSavh.exe
  C:\Windows\System\YeTSavh.exe
  2⤵
  PID:9304
- C:\Windows\System\Gzmgrrz.exe
  C:\Windows\System\Gzmgrrz.exe
  2⤵
  PID:9520
- C:\Windows\System\QzsIIap.exe
  C:\Windows\System\QzsIIap.exe
  2⤵
  PID:9616
- C:\Windows\System\KpYCVEC.exe
  C:\Windows\System\KpYCVEC.exe
  2⤵
  PID:9752
- C:\Windows\System\XnqQUXl.exe
  C:\Windows\System\XnqQUXl.exe
  2⤵
  PID:9856
- C:\Windows\System\DQNmWEx.exe
  C:\Windows\System\DQNmWEx.exe
  2⤵
  PID:10136
- C:\Windows\System\SYlGmYX.exe
  C:\Windows\System\SYlGmYX.exe
  2⤵
  PID:9472
- C:\Windows\System\ofrZDWR.exe
  C:\Windows\System\ofrZDWR.exe
  2⤵
  PID:9572
- C:\Windows\System\oalofkQ.exe
  C:\Windows\System\oalofkQ.exe
  2⤵
  PID:10220
- C:\Windows\System\qZTrkcv.exe
  C:\Windows\System\qZTrkcv.exe
  2⤵
  PID:9608
- C:\Windows\System\OXPhgoz.exe
  C:\Windows\System\OXPhgoz.exe
  2⤵
  PID:9244
- C:\Windows\System\CQdUEmv.exe
  C:\Windows\System\CQdUEmv.exe
  2⤵
  PID:10260
- C:\Windows\System\GkfiXGD.exe
  C:\Windows\System\GkfiXGD.exe
  2⤵
  PID:10304
- C:\Windows\System\TKbbpgt.exe
  C:\Windows\System\TKbbpgt.exe
  2⤵
  PID:10320
- C:\Windows\System\OtFvCjZ.exe
  C:\Windows\System\OtFvCjZ.exe
  2⤵
  PID:10348
- C:\Windows\System\pLSPdMe.exe
  C:\Windows\System\pLSPdMe.exe
  2⤵
  PID:10376
- C:\Windows\System\xUdiXYe.exe
  C:\Windows\System\xUdiXYe.exe
  2⤵
  PID:10408
- C:\Windows\System\YQFiOBH.exe
  C:\Windows\System\YQFiOBH.exe
  2⤵
  PID:10444
- C:\Windows\System\InZegdw.exe
  C:\Windows\System\InZegdw.exe
  2⤵
  PID:10480
- C:\Windows\System\WhasumJ.exe
  C:\Windows\System\WhasumJ.exe
  2⤵
  PID:10500
- C:\Windows\System\aGMBjpY.exe
  C:\Windows\System\aGMBjpY.exe
  2⤵
  PID:10524
- C:\Windows\System\PGOBarx.exe
  C:\Windows\System\PGOBarx.exe
  2⤵
  PID:10564
- C:\Windows\System\dqdYmxN.exe
  C:\Windows\System\dqdYmxN.exe
  2⤵
  PID:10584
- C:\Windows\System\mbJHnIT.exe
  C:\Windows\System\mbJHnIT.exe
  2⤵
  PID:10616
- C:\Windows\System\lABwihf.exe
  C:\Windows\System\lABwihf.exe
  2⤵
  PID:10640
- C:\Windows\System\KrSIbfy.exe
  C:\Windows\System\KrSIbfy.exe
  2⤵
  PID:10656
- C:\Windows\System\NUDPncv.exe
  C:\Windows\System\NUDPncv.exe
  2⤵
  PID:10684
- C:\Windows\System\CTAweSE.exe
  C:\Windows\System\CTAweSE.exe
  2⤵
  PID:10704
- C:\Windows\System\xpCmKXc.exe
  C:\Windows\System\xpCmKXc.exe
  2⤵
  PID:10724
- C:\Windows\System\QEnnlNR.exe
  C:\Windows\System\QEnnlNR.exe
  2⤵
  PID:10752
- C:\Windows\System\TyPaqGz.exe
  C:\Windows\System\TyPaqGz.exe
  2⤵
  PID:10788
- C:\Windows\System\nTFzfTU.exe
  C:\Windows\System\nTFzfTU.exe
  2⤵
  PID:10820
- C:\Windows\System\gswcwjw.exe
  C:\Windows\System\gswcwjw.exe
  2⤵
  PID:10852
- C:\Windows\System\LWvWNqx.exe
  C:\Windows\System\LWvWNqx.exe
  2⤵
  PID:10888
- C:\Windows\System\eOrTfxI.exe
  C:\Windows\System\eOrTfxI.exe
  2⤵
  PID:10912
- C:\Windows\System\sslWBGJ.exe
  C:\Windows\System\sslWBGJ.exe
  2⤵
  PID:10948
- C:\Windows\System\CFMpVfY.exe
  C:\Windows\System\CFMpVfY.exe
  2⤵
  PID:10976
- C:\Windows\System\IIbygBR.exe
  C:\Windows\System\IIbygBR.exe
  2⤵
  PID:11000
- C:\Windows\System\lhPiAjn.exe
  C:\Windows\System\lhPiAjn.exe
  2⤵
  PID:11020
- C:\Windows\System\EbTzPYx.exe
  C:\Windows\System\EbTzPYx.exe
  2⤵
  PID:11048
- C:\Windows\System\QnlTybt.exe
  C:\Windows\System\QnlTybt.exe
  2⤵
  PID:11088
- C:\Windows\System\IJLUVXc.exe
  C:\Windows\System\IJLUVXc.exe
  2⤵
  PID:11104
- C:\Windows\System\DSmigQv.exe
  C:\Windows\System\DSmigQv.exe
  2⤵
  PID:11132
- C:\Windows\System\OllWbOz.exe
  C:\Windows\System\OllWbOz.exe
  2⤵
  PID:11156
- C:\Windows\System\XQsdfjp.exe
  C:\Windows\System\XQsdfjp.exe
  2⤵
  PID:11192
- C:\Windows\System\RurcZhh.exe
  C:\Windows\System\RurcZhh.exe
  2⤵
  PID:11224
- C:\Windows\System\yvuQUBU.exe
  C:\Windows\System\yvuQUBU.exe
  2⤵
  PID:11244
- C:\Windows\System\rIbACCO.exe
  C:\Windows\System\rIbACCO.exe
  2⤵
  PID:9956
- C:\Windows\System\fmMOaxg.exe
  C:\Windows\System\fmMOaxg.exe
  2⤵
  PID:10276
- C:\Windows\System\cOvwFNW.exe
  C:\Windows\System\cOvwFNW.exe
  2⤵
  PID:10316
- C:\Windows\System\KTSDiGE.exe
  C:\Windows\System\KTSDiGE.exe
  2⤵
  PID:10400
- C:\Windows\System\SjmFLHU.exe
  C:\Windows\System\SjmFLHU.exe
  2⤵
  PID:10492
- C:\Windows\System\ZJREYgm.exe
  C:\Windows\System\ZJREYgm.exe
  2⤵
  PID:10544
- C:\Windows\System\FQUOGLq.exe
  C:\Windows\System\FQUOGLq.exe
  2⤵
  PID:10580
- C:\Windows\System\QZiyXTQ.exe
  C:\Windows\System\QZiyXTQ.exe
  2⤵
  PID:10628
- C:\Windows\System\jGYsdHW.exe
  C:\Windows\System\jGYsdHW.exe
  2⤵
  PID:10700
- C:\Windows\System\pJyxkqt.exe
  C:\Windows\System\pJyxkqt.exe
  2⤵
  PID:10764
- C:\Windows\System\vNgnNFJ.exe
  C:\Windows\System\vNgnNFJ.exe
  2⤵
  PID:10780
- C:\Windows\System\UaEhHUy.exe
  C:\Windows\System\UaEhHUy.exe
  2⤵
  PID:10864
- C:\Windows\System\UhIgNTY.exe
  C:\Windows\System\UhIgNTY.exe
  2⤵
  PID:10932
- C:\Windows\System\zUvsRxZ.exe
  C:\Windows\System\zUvsRxZ.exe
  2⤵
  PID:10996
- C:\Windows\System\tXDBmfi.exe
  C:\Windows\System\tXDBmfi.exe
  2⤵
  PID:11084
- C:\Windows\System\qZOqFnI.exe
  C:\Windows\System\qZOqFnI.exe
  2⤵
  PID:11260
- C:\Windows\System\UjTWXBh.exe
  C:\Windows\System\UjTWXBh.exe
  2⤵
  PID:10328
- C:\Windows\System\YSCmHhd.exe
  C:\Windows\System\YSCmHhd.exe
  2⤵
  PID:10428
- C:\Windows\System\nJIslPv.exe
  C:\Windows\System\nJIslPv.exe
  2⤵
  PID:10576
- C:\Windows\System\PLwoNRo.exe
  C:\Windows\System\PLwoNRo.exe
  2⤵
  PID:10720
- C:\Windows\System\HIoAuqz.exe
  C:\Windows\System\HIoAuqz.exe
  2⤵
  PID:10884
- C:\Windows\System\Zoctkkx.exe
  C:\Windows\System\Zoctkkx.exe
  2⤵
  PID:10956
- C:\Windows\System\jJfhRtd.exe
  C:\Windows\System\jJfhRtd.exe
  2⤵
  PID:11240
- C:\Windows\System\FmkjgYC.exe
  C:\Windows\System\FmkjgYC.exe
  2⤵
  PID:10516
- C:\Windows\System\QcsOSaq.exe
  C:\Windows\System\QcsOSaq.exe
  2⤵
  PID:10908
- C:\Windows\System\HrqtajH.exe
  C:\Windows\System\HrqtajH.exe
  2⤵
  PID:11148
- C:\Windows\System\yDAuCNz.exe
  C:\Windows\System\yDAuCNz.exe
  2⤵
  PID:10696
- C:\Windows\System\lFDuteF.exe
  C:\Windows\System\lFDuteF.exe
  2⤵
  PID:11280
- C:\Windows\System\SeiITIt.exe
  C:\Windows\System\SeiITIt.exe
  2⤵
  PID:11304
- C:\Windows\System\dNrNfAZ.exe
  C:\Windows\System\dNrNfAZ.exe
  2⤵
  PID:11328
- C:\Windows\System\WxTwlEz.exe
  C:\Windows\System\WxTwlEz.exe
  2⤵
  PID:11360
- C:\Windows\System\dhITmiE.exe
  C:\Windows\System\dhITmiE.exe
  2⤵
  PID:11380
- C:\Windows\System\AJkIWvz.exe
  C:\Windows\System\AJkIWvz.exe
  2⤵
  PID:11416
- C:\Windows\System\UOAtTbH.exe
  C:\Windows\System\UOAtTbH.exe
  2⤵
  PID:11436
- C:\Windows\System\guPQowE.exe
  C:\Windows\System\guPQowE.exe
  2⤵
  PID:11460
- C:\Windows\System\OrWGKTg.exe
  C:\Windows\System\OrWGKTg.exe
  2⤵
  PID:11480
- C:\Windows\System\eETtQWv.exe
  C:\Windows\System\eETtQWv.exe
  2⤵
  PID:11508
- C:\Windows\System\vcbfAFx.exe
  C:\Windows\System\vcbfAFx.exe
  2⤵
  PID:11552
- C:\Windows\System\umgqctR.exe
  C:\Windows\System\umgqctR.exe
  2⤵
  PID:11584
- C:\Windows\System\AlNSlte.exe
  C:\Windows\System\AlNSlte.exe
  2⤵
  PID:11604
- C:\Windows\System\ZLWcZbh.exe
  C:\Windows\System\ZLWcZbh.exe
  2⤵
  PID:11628
- C:\Windows\System\COZvjxV.exe
  C:\Windows\System\COZvjxV.exe
  2⤵
  PID:11644
- C:\Windows\System\ybBRedQ.exe
  C:\Windows\System\ybBRedQ.exe
  2⤵
  PID:11692
- C:\Windows\System\VShZxlk.exe
  C:\Windows\System\VShZxlk.exe
  2⤵
  PID:11716
- C:\Windows\System\oYyfoEQ.exe
  C:\Windows\System\oYyfoEQ.exe
  2⤵
  PID:11768
- C:\Windows\System\PraBGEe.exe
  C:\Windows\System\PraBGEe.exe
  2⤵
  PID:11792
- C:\Windows\System\vPpcmDZ.exe
  C:\Windows\System\vPpcmDZ.exe
  2⤵
  PID:11832
- C:\Windows\System\CfBdfyZ.exe
  C:\Windows\System\CfBdfyZ.exe
  2⤵
  PID:11852
- C:\Windows\System\EMGDBzR.exe
  C:\Windows\System\EMGDBzR.exe
  2⤵
  PID:11884
- C:\Windows\System\obxAGhs.exe
  C:\Windows\System\obxAGhs.exe
  2⤵
  PID:11920
- C:\Windows\System\erYjBet.exe
  C:\Windows\System\erYjBet.exe
  2⤵
  PID:11968
- C:\Windows\System\DHoczzE.exe
  C:\Windows\System\DHoczzE.exe
  2⤵
  PID:11984
- C:\Windows\System\zxpStyb.exe
  C:\Windows\System\zxpStyb.exe
  2⤵
  PID:12000
- C:\Windows\System\ZCOCptE.exe
  C:\Windows\System\ZCOCptE.exe
  2⤵
  PID:12016
- C:\Windows\System\gEYtQql.exe
  C:\Windows\System\gEYtQql.exe
  2⤵
  PID:12032
- C:\Windows\System\prGgAkv.exe
  C:\Windows\System\prGgAkv.exe
  2⤵
  PID:12048
- C:\Windows\System\PCGHWgt.exe
  C:\Windows\System\PCGHWgt.exe
  2⤵
  PID:12064
- C:\Windows\System\SofRMYK.exe
  C:\Windows\System\SofRMYK.exe
  2⤵
  PID:12080
- C:\Windows\System\nitdAzC.exe
  C:\Windows\System\nitdAzC.exe
  2⤵
  PID:12096
- C:\Windows\System\rvsrSuF.exe
  C:\Windows\System\rvsrSuF.exe
  2⤵
  PID:12120
- C:\Windows\System\qqtxLjV.exe
  C:\Windows\System\qqtxLjV.exe
  2⤵
  PID:12140
- C:\Windows\System\OgCTvNS.exe
  C:\Windows\System\OgCTvNS.exe
  2⤵
  PID:12164
- C:\Windows\System\WXgDBXR.exe
  C:\Windows\System\WXgDBXR.exe
  2⤵
  PID:12184
- C:\Windows\System\IEYbpfm.exe
  C:\Windows\System\IEYbpfm.exe
  2⤵
  PID:12220
- C:\Windows\System\IaElxOF.exe
  C:\Windows\System\IaElxOF.exe
  2⤵
  PID:12240
- C:\Windows\System\XvqhTQF.exe
  C:\Windows\System\XvqhTQF.exe
  2⤵
  PID:11276
- C:\Windows\System\aldKlhl.exe
  C:\Windows\System\aldKlhl.exe
  2⤵
  PID:11340
- C:\Windows\System\fgENMKf.exe
  C:\Windows\System\fgENMKf.exe
  2⤵
  PID:11452
- C:\Windows\System\dvMAwqU.exe
  C:\Windows\System\dvMAwqU.exe
  2⤵
  PID:11500
- C:\Windows\System\QjAOHhM.exe
  C:\Windows\System\QjAOHhM.exe
  2⤵
  PID:11616
- C:\Windows\System\ULyXKZn.exe
  C:\Windows\System\ULyXKZn.exe
  2⤵
  PID:11708
- C:\Windows\System\tEmVgku.exe
  C:\Windows\System\tEmVgku.exe
  2⤵
  PID:11896
- C:\Windows\System\pUWsDtK.exe
  C:\Windows\System\pUWsDtK.exe
  2⤵
  PID:11932
- C:\Windows\System\FYvWUTl.exe
  C:\Windows\System\FYvWUTl.exe
  2⤵
  PID:11944
- C:\Windows\System\yHAuJWy.exe
  C:\Windows\System\yHAuJWy.exe
  2⤵
  PID:11904
- C:\Windows\System\YMVXKmD.exe
  C:\Windows\System\YMVXKmD.exe
  2⤵
  PID:11996
- C:\Windows\System\TIcTZdj.exe
  C:\Windows\System\TIcTZdj.exe
  2⤵
  PID:12108
- C:\Windows\System\cwNKZlC.exe
  C:\Windows\System\cwNKZlC.exe
  2⤵
  PID:12176
- C:\Windows\System\GrVLvjX.exe
  C:\Windows\System\GrVLvjX.exe
  2⤵
  PID:4032
- C:\Windows\System\lxWHvKF.exe
  C:\Windows\System\lxWHvKF.exe
  2⤵
  PID:12116
- C:\Windows\System\iwvjIWX.exe
  C:\Windows\System\iwvjIWX.exe
  2⤵
  PID:12236
- C:\Windows\System\IMWdmXh.exe
  C:\Windows\System\IMWdmXh.exe
  2⤵
  PID:12232
- C:\Windows\System\XOJuTcA.exe
  C:\Windows\System\XOJuTcA.exe
  2⤵
  PID:11428
- C:\Windows\System\eadLdda.exe
  C:\Windows\System\eadLdda.exe
  2⤵
  PID:11600
- C:\Windows\System\MOBRxYf.exe
  C:\Windows\System\MOBRxYf.exe
  2⤵
  PID:11908
- C:\Windows\System\WhqSWze.exe
  C:\Windows\System\WhqSWze.exe
  2⤵
  PID:12040
- C:\Windows\System\zVPuCaY.exe
  C:\Windows\System\zVPuCaY.exe
  2⤵
  PID:12136
- C:\Windows\System\rYLZTjz.exe
  C:\Windows\System\rYLZTjz.exe
  2⤵
  PID:4412
- C:\Windows\System\GIJtBNV.exe
  C:\Windows\System\GIJtBNV.exe
  2⤵
  PID:11612
- C:\Windows\System\ABUBTvK.exe
  C:\Windows\System\ABUBTvK.exe
  2⤵
  PID:11964
- C:\Windows\System\YdomBlA.exe
  C:\Windows\System\YdomBlA.exe
  2⤵
  PID:376
- C:\Windows\System\ltIXUFf.exe
  C:\Windows\System\ltIXUFf.exe
  2⤵
  PID:11576
- C:\Windows\System\OFxHkpU.exe
  C:\Windows\System\OFxHkpU.exe
  2⤵
  PID:11892
- C:\Windows\System\nvXZslw.exe
  C:\Windows\System\nvXZslw.exe
  2⤵
  PID:12228
- C:\Windows\System\ajRckUY.exe
  C:\Windows\System\ajRckUY.exe
  2⤵
  PID:12300
- C:\Windows\System\aEgBjQa.exe
  C:\Windows\System\aEgBjQa.exe
  2⤵
  PID:12336
- C:\Windows\System\SXZqnQq.exe
  C:\Windows\System\SXZqnQq.exe
  2⤵
  PID:12388
- C:\Windows\System\ouEjWiw.exe
  C:\Windows\System\ouEjWiw.exe
  2⤵
  PID:12424
- C:\Windows\System\bthTnSj.exe
  C:\Windows\System\bthTnSj.exe
  2⤵
  PID:12444
- C:\Windows\System\pFJRHxY.exe
  C:\Windows\System\pFJRHxY.exe
  2⤵
  PID:12464
- C:\Windows\System\DBCmkCh.exe
  C:\Windows\System\DBCmkCh.exe
  2⤵
  PID:12488
- C:\Windows\System\kqSdqAr.exe
  C:\Windows\System\kqSdqAr.exe
  2⤵
  PID:12504
- C:\Windows\System\WMcPhbm.exe
  C:\Windows\System\WMcPhbm.exe
  2⤵
  PID:12572
- C:\Windows\System\yRBOAMo.exe
  C:\Windows\System\yRBOAMo.exe
  2⤵
  PID:12592
- C:\Windows\System\qAWzkYI.exe
  C:\Windows\System\qAWzkYI.exe
  2⤵
  PID:12620
- C:\Windows\System\JyDJvcY.exe
  C:\Windows\System\JyDJvcY.exe
  2⤵
  PID:12648
- C:\Windows\System\VTzHGwP.exe
  C:\Windows\System\VTzHGwP.exe
  2⤵
  PID:12672
- C:\Windows\System\CTojOPx.exe
  C:\Windows\System\CTojOPx.exe
  2⤵
  PID:12692
- C:\Windows\System\QGqNxfz.exe
  C:\Windows\System\QGqNxfz.exe
  2⤵
  PID:12720
- C:\Windows\System\nVuxqcJ.exe
  C:\Windows\System\nVuxqcJ.exe
  2⤵
  PID:12764
- C:\Windows\System\vAAbxOQ.exe
  C:\Windows\System\vAAbxOQ.exe
  2⤵
  PID:12784
- C:\Windows\System\QdSVdwp.exe
  C:\Windows\System\QdSVdwp.exe
  2⤵
  PID:12824
- C:\Windows\System\AFNkhWL.exe
  C:\Windows\System\AFNkhWL.exe
  2⤵
  PID:12848
- C:\Windows\System\FQovLjA.exe
  C:\Windows\System\FQovLjA.exe
  2⤵
  PID:12868
- C:\Windows\System\ytZptJs.exe
  C:\Windows\System\ytZptJs.exe
  2⤵
  PID:12908
- C:\Windows\System\knKdjFg.exe
  C:\Windows\System\knKdjFg.exe
  2⤵
  PID:12924
- C:\Windows\System\eMDUMqJ.exe
  C:\Windows\System\eMDUMqJ.exe
  2⤵
  PID:12944
- C:\Windows\System\LvkYVJK.exe
  C:\Windows\System\LvkYVJK.exe
  2⤵
  PID:12968
- C:\Windows\System\kvCGKzw.exe
  C:\Windows\System\kvCGKzw.exe
  2⤵
  PID:12988
- C:\Windows\System\opNnlkk.exe
  C:\Windows\System\opNnlkk.exe
  2⤵
  PID:13004
- C:\Windows\System\JkZkZdK.exe
  C:\Windows\System\JkZkZdK.exe
  2⤵
  PID:13044
- C:\Windows\System\VkevZOr.exe
  C:\Windows\System\VkevZOr.exe
  2⤵
  PID:13072
- C:\Windows\System\cCLLHNe.exe
  C:\Windows\System\cCLLHNe.exe
  2⤵
  PID:13088
- C:\Windows\System\jvgvGtz.exe
  C:\Windows\System\jvgvGtz.exe
  2⤵
  PID:13116
- C:\Windows\System\etLIRxz.exe
  C:\Windows\System\etLIRxz.exe
  2⤵
  PID:13148
- C:\Windows\System\TAkhEpf.exe
  C:\Windows\System\TAkhEpf.exe
  2⤵
  PID:13212
- C:\Windows\System\nTqypZX.exe
  C:\Windows\System\nTqypZX.exe
  2⤵
  PID:12512
- C:\Windows\System\ifuwUcf.exe
  C:\Windows\System\ifuwUcf.exe
  2⤵
  PID:12520
- C:\Windows\System\dbXlUcw.exe
  C:\Windows\System\dbXlUcw.exe
  2⤵
  PID:12568
- C:\Windows\System\zHCaOop.exe
  C:\Windows\System\zHCaOop.exe
  2⤵
  PID:12684
- C:\Windows\System\BYufdsy.exe
  C:\Windows\System\BYufdsy.exe
  2⤵
  PID:12612
- C:\Windows\System\WZtgVIx.exe
  C:\Windows\System\WZtgVIx.exe
  2⤵
  PID:12688
- C:\Windows\System\klMfPJI.exe
  C:\Windows\System\klMfPJI.exe
  2⤵
  PID:12628
- C:\Windows\System\VpCIehI.exe
  C:\Windows\System\VpCIehI.exe
  2⤵
  PID:12712
- C:\Windows\System\JSvmtLS.exe
  C:\Windows\System\JSvmtLS.exe
  2⤵
  PID:4960
- C:\Windows\System\hYOGLpo.exe
  C:\Windows\System\hYOGLpo.exe
  2⤵
  PID:4100
- C:\Windows\System\zxBOosV.exe
  C:\Windows\System\zxBOosV.exe
  2⤵
  PID:12776
- C:\Windows\System\XMODTNy.exe
  C:\Windows\System\XMODTNy.exe
  2⤵
  PID:12368
- C:\Windows\System\sumDCwu.exe
  C:\Windows\System\sumDCwu.exe
  2⤵
  PID:12436
- C:\Windows\System\TqfPhVr.exe
  C:\Windows\System\TqfPhVr.exe
  2⤵
  PID:12500
- C:\Windows\System\hquaAff.exe
  C:\Windows\System\hquaAff.exe
  2⤵
  PID:12656
- C:\Windows\System\QAOEOGL.exe
  C:\Windows\System\QAOEOGL.exe
  2⤵
  PID:12616
- C:\Windows\System\OdzrRgb.exe
  C:\Windows\System\OdzrRgb.exe
  2⤵
  PID:4256
- C:\Windows\System\IrvHeYC.exe
  C:\Windows\System\IrvHeYC.exe
  2⤵
  PID:12772
- C:\Windows\System\JueRqMr.exe
  C:\Windows\System\JueRqMr.exe
  2⤵
  PID:12456
- C:\Windows\System\oFzPhhC.exe
  C:\Windows\System\oFzPhhC.exe
  2⤵
  PID:12564
- C:\Windows\System\VMywwCb.exe
  C:\Windows\System\VMywwCb.exe
  2⤵
  PID:8352
- C:\Windows\System\SXxoMhg.exe
  C:\Windows\System\SXxoMhg.exe
  2⤵
  PID:12808
- C:\Windows\System\HPZpjFb.exe
  C:\Windows\System\HPZpjFb.exe
  2⤵
  PID:12816
- C:\Windows\System\UTzAhcD.exe
  C:\Windows\System\UTzAhcD.exe
  2⤵
  PID:12856
- C:\Windows\System\LjypZaT.exe
  C:\Windows\System\LjypZaT.exe
  2⤵
  PID:12888
- C:\Windows\System\Hbdxbrs.exe
  C:\Windows\System\Hbdxbrs.exe
  2⤵
  PID:12420
- C:\Windows\System\ybpPcDj.exe
  C:\Windows\System\ybpPcDj.exe
  2⤵
  PID:1420
- C:\Windows\System\JnLUJcH.exe
  C:\Windows\System\JnLUJcH.exe
  2⤵
  PID:12332
- C:\Windows\System\XAWwTLp.exe
  C:\Windows\System\XAWwTLp.exe
  2⤵
  PID:12588
- C:\Windows\System\sksIhPM.exe
  C:\Windows\System\sksIhPM.exe
  2⤵
  PID:12904
- C:\Windows\System\MapnHeA.exe
  C:\Windows\System\MapnHeA.exe
  2⤵
  PID:12960
- C:\Windows\System\jwGSemr.exe
  C:\Windows\System\jwGSemr.exe
  2⤵
  PID:556
- C:\Windows\System\FgkdDfD.exe
  C:\Windows\System\FgkdDfD.exe
  2⤵
  PID:13084
- C:\Windows\System\GPauOtn.exe
  C:\Windows\System\GPauOtn.exe
  2⤵
  PID:13112
- C:\Windows\System\pjOYsGM.exe
  C:\Windows\System\pjOYsGM.exe
  2⤵
  PID:4668
- C:\Windows\System\QpwIhcV.exe
  C:\Windows\System\QpwIhcV.exe
  2⤵
  PID:1976
- C:\Windows\System\iGlVpvf.exe
  C:\Windows\System\iGlVpvf.exe
  2⤵
  PID:13140
- C:\Windows\System\bODwZKL.exe
  C:\Windows\System\bODwZKL.exe
  2⤵
  PID:12296
- C:\Windows\System\rLeMCMG.exe
  C:\Windows\System\rLeMCMG.exe
  2⤵
  PID:12404
- C:\Windows\System\wtiOoEv.exe
  C:\Windows\System\wtiOoEv.exe
  2⤵
  PID:4444
- C:\Windows\System\TUGpKJP.exe
  C:\Windows\System\TUGpKJP.exe
  2⤵
  PID:1224
- C:\Windows\System\vogsfel.exe
  C:\Windows\System\vogsfel.exe
  2⤵
  PID:12440
- C:\Windows\System\kegqzXW.exe
  C:\Windows\System\kegqzXW.exe
  2⤵
  PID:1064
- C:\Windows\System\wMVnjjj.exe
  C:\Windows\System\wMVnjjj.exe
  2⤵
  PID:12760
- C:\Windows\System\tbQKalc.exe
  C:\Windows\System\tbQKalc.exe
  2⤵
  PID:3612
- C:\Windows\System\fdmoeZn.exe
  C:\Windows\System\fdmoeZn.exe
  2⤵
  PID:1132
- C:\Windows\System\UWVriMn.exe
  C:\Windows\System\UWVriMn.exe
  2⤵
  PID:1992
- C:\Windows\System\ybEPFah.exe
  C:\Windows\System\ybEPFah.exe
  2⤵
  PID:5064
- C:\Windows\System\dFbxqYy.exe
  C:\Windows\System\dFbxqYy.exe
  2⤵
  PID:4504
- C:\Windows\System\WnXPDCO.exe
  C:\Windows\System\WnXPDCO.exe
  2⤵
  PID:13024
- C:\Windows\System\aiPdddI.exe
  C:\Windows\System\aiPdddI.exe
  2⤵
  PID:13000
- C:\Windows\System\vINvFGQ.exe
  C:\Windows\System\vINvFGQ.exe
  2⤵
  PID:13080
- C:\Windows\System\zoCUNqu.exe
  C:\Windows\System\zoCUNqu.exe
  2⤵
  PID:13228
- C:\Windows\System\KOUKznq.exe
  C:\Windows\System\KOUKznq.exe
  2⤵
  PID:13232
- C:\Windows\System\fnGcyeP.exe
  C:\Windows\System\fnGcyeP.exe
  2⤵
  PID:1996
- C:\Windows\System\AgMPkfx.exe
  C:\Windows\System\AgMPkfx.exe
  2⤵
  PID:12400
- C:\Windows\System\OhXsIYs.exe
  C:\Windows\System\OhXsIYs.exe
  2⤵
  PID:3320
- C:\Windows\System\oezlTTL.exe
  C:\Windows\System\oezlTTL.exe
  2⤵
  PID:3004
- C:\Windows\System\VsMCDNd.exe
  C:\Windows\System\VsMCDNd.exe
  2⤵
  PID:2460
- C:\Windows\System\xIPnwYV.exe
  C:\Windows\System\xIPnwYV.exe
  2⤵
  PID:1852
- C:\Windows\System\RrPNKuN.exe
  C:\Windows\System\RrPNKuN.exe
  2⤵
  PID:380
- C:\Windows\System\sSFcFZV.exe
  C:\Windows\System\sSFcFZV.exe
  2⤵
  PID:3724
- C:\Windows\System\eMPQMWl.exe
  C:\Windows\System\eMPQMWl.exe
  2⤵
  PID:4920
- C:\Windows\System\YHfTBAb.exe
  C:\Windows\System\YHfTBAb.exe
  2⤵
  PID:12964
- C:\Windows\System\LapfpnR.exe
  C:\Windows\System\LapfpnR.exe
  2⤵
  PID:2168
- C:\Windows\System\YhEFmWx.exe
  C:\Windows\System\YhEFmWx.exe
  2⤵
  PID:3944
- C:\Windows\System\SonvYUs.exe
  C:\Windows\System\SonvYUs.exe
  2⤵
  PID:12740
- C:\Windows\System\PefbxnS.exe
  C:\Windows\System\PefbxnS.exe
  2⤵
  PID:12984
- C:\Windows\System\hpVDrXr.exe
  C:\Windows\System\hpVDrXr.exe
  2⤵
  PID:3852
- C:\Windows\System\FUcJCPX.exe
  C:\Windows\System\FUcJCPX.exe
  2⤵
  PID:3016
- C:\Windows\System\aPHcesa.exe
  C:\Windows\System\aPHcesa.exe
  2⤵
  PID:13108
- C:\Windows\System\uLlAtJX.exe
  C:\Windows\System\uLlAtJX.exe
  2⤵
  PID:5812
- C:\Windows\System\TWRfBEP.exe
  C:\Windows\System\TWRfBEP.exe
  2⤵
  PID:5872
- C:\Windows\System\dCofRrf.exe
  C:\Windows\System\dCofRrf.exe
  2⤵
  PID:5932
- C:\Windows\System\bIulifP.exe
  C:\Windows\System\bIulifP.exe
  2⤵
  PID:5940
- C:\Windows\System\WMuxWXG.exe
  C:\Windows\System\WMuxWXG.exe
  2⤵
  PID:2964
- C:\Windows\System\GWMufNT.exe
  C:\Windows\System\GWMufNT.exe
  2⤵
  PID:5688
- C:\Windows\System\qPUvbRR.exe
  C:\Windows\System\qPUvbRR.exe
  2⤵
  PID:1984
- C:\Windows\System\JmZbgvZ.exe
  C:\Windows\System\JmZbgvZ.exe
  2⤵
  PID:4056
- C:\Windows\System\ylhUiRR.exe
  C:\Windows\System\ylhUiRR.exe
  2⤵
  PID:5208
- C:\Windows\System\bsuVevy.exe
  C:\Windows\System\bsuVevy.exe
  2⤵
  PID:5280
- C:\Windows\System\dJnQbjq.exe
  C:\Windows\System\dJnQbjq.exe
  2⤵
  PID:4388
- C:\Windows\System\SkYLqFR.exe
  C:\Windows\System\SkYLqFR.exe
  2⤵
  PID:5384
- C:\Windows\System\fJQqueh.exe
  C:\Windows\System\fJQqueh.exe
  2⤵
  PID:5616
- C:\Windows\System\QUDseoQ.exe
  C:\Windows\System\QUDseoQ.exe
  2⤵
  PID:2860
- C:\Windows\System\FYwDXxv.exe
  C:\Windows\System\FYwDXxv.exe
  2⤵
  PID:12320
- C:\Windows\System\vgOutQi.exe
  C:\Windows\System\vgOutQi.exe
  2⤵
  PID:3040
- C:\Windows\System\CbhyAkW.exe
  C:\Windows\System\CbhyAkW.exe
  2⤵
  PID:3388
- C:\Windows\System\mckysZa.exe
  C:\Windows\System\mckysZa.exe
  2⤵
  PID:3772
- C:\Windows\System\sKhzBrT.exe
  C:\Windows\System\sKhzBrT.exe
  2⤵
  PID:5944
- C:\Windows\System\oJKRHIh.exe
  C:\Windows\System\oJKRHIh.exe
  2⤵
  PID:6044
- C:\Windows\System\Etznmjf.exe
  C:\Windows\System\Etznmjf.exe
  2⤵
  PID:3204
- C:\Windows\System\SDUcVhw.exe
  C:\Windows\System\SDUcVhw.exe
  2⤵
  PID:13240
- C:\Windows\System\XZKsdWv.exe
  C:\Windows\System\XZKsdWv.exe
  2⤵
  PID:552
- C:\Windows\System\NtzdafM.exe
  C:\Windows\System\NtzdafM.exe
  2⤵
  PID:13204
- C:\Windows\System\ebeYXdq.exe
  C:\Windows\System\ebeYXdq.exe
  2⤵
  PID:3128
- C:\Windows\System\CEmKbyw.exe
  C:\Windows\System\CEmKbyw.exe
  2⤵
  PID:3452
- C:\Windows\System\enzYUhR.exe
  C:\Windows\System\enzYUhR.exe
  2⤵
  PID:12940
- C:\Windows\System\RWXUCzM.exe
  C:\Windows\System\RWXUCzM.exe
  2⤵
  PID:2828
- C:\Windows\System\saplYoK.exe
  C:\Windows\System\saplYoK.exe
  2⤵
  PID:312
- C:\Windows\System\svRzZss.exe
  C:\Windows\System\svRzZss.exe
  2⤵
  PID:6268
- C:\Windows\System\CANCrMC.exe
  C:\Windows\System\CANCrMC.exe
  2⤵
  PID:5984
- C:\Windows\System\pYdTLwQ.exe
  C:\Windows\System\pYdTLwQ.exe
  2⤵
  PID:3688
- C:\Windows\System\jDmrLUg.exe
  C:\Windows\System\jDmrLUg.exe
  2⤵
  PID:2296
- C:\Windows\System\grVPMUV.exe
  C:\Windows\System\grVPMUV.exe
  2⤵
  PID:4652
- C:\Windows\System\wcmCtPD.exe
  C:\Windows\System\wcmCtPD.exe
  2⤵
  PID:6620
- C:\Windows\System\cuwTWtW.exe
  C:\Windows\System\cuwTWtW.exe
  2⤵
  PID:13036
- C:\Windows\System\FNZhCDL.exe
  C:\Windows\System\FNZhCDL.exe
  2⤵
  PID:6640
- C:\Windows\System\QNuZwos.exe
  C:\Windows\System\QNuZwos.exe
  2⤵
  PID:6548
- C:\Windows\System\avEkeUj.exe
  C:\Windows\System\avEkeUj.exe
  2⤵
  PID:6784
- C:\Windows\System\CDRUOGB.exe
  C:\Windows\System\CDRUOGB.exe
  2⤵
  PID:6904
- C:\Windows\System\FVKsHcp.exe
  C:\Windows\System\FVKsHcp.exe
  2⤵
  PID:7024
- C:\Windows\System\PvYEcIN.exe
  C:\Windows\System\PvYEcIN.exe
  2⤵
  PID:7080
- C:\Windows\System\rYnWDAn.exe
  C:\Windows\System\rYnWDAn.exe
  2⤵
  PID:6936
- C:\Windows\System\naWqUQP.exe
  C:\Windows\System\naWqUQP.exe
  2⤵
  PID:7140
- C:\Windows\System\nwgSOeY.exe
  C:\Windows\System\nwgSOeY.exe
  2⤵
  PID:6176
- C:\Windows\System\upLKZqZ.exe
  C:\Windows\System\upLKZqZ.exe
  2⤵
  PID:6980
- C:\Windows\System\WyDTGKg.exe
  C:\Windows\System\WyDTGKg.exe
  2⤵
  PID:6472
- C:\Windows\System\ltCgPhe.exe
  C:\Windows\System\ltCgPhe.exe
  2⤵
  PID:6628
- C:\Windows\System\ykcrzEU.exe
  C:\Windows\System\ykcrzEU.exe
  2⤵
  PID:6732
- C:\Windows\System\UzJJUNl.exe
  C:\Windows\System\UzJJUNl.exe
  2⤵
  PID:6128
- C:\Windows\System\PMMtngV.exe
  C:\Windows\System\PMMtngV.exe
  2⤵
  PID:6976
- C:\Windows\System\tgtfDVy.exe
  C:\Windows\System\tgtfDVy.exe
  2⤵
  PID:6180
- C:\Windows\System\mVjaoke.exe
  C:\Windows\System\mVjaoke.exe
  2⤵
  PID:7132
- C:\Windows\System\xRDkCBc.exe
  C:\Windows\System\xRDkCBc.exe
  2⤵
  PID:6692
- C:\Windows\System\BkGgbWV.exe
  C:\Windows\System\BkGgbWV.exe
  2⤵
  PID:7028
- C:\Windows\System\vlbiyqP.exe
  C:\Windows\System\vlbiyqP.exe
  2⤵
  PID:2912
- C:\Windows\System\xnwSyyb.exe
  C:\Windows\System\xnwSyyb.exe
  2⤵
  PID:7188
- C:\Windows\System\gkRSKBt.exe
  C:\Windows\System\gkRSKBt.exe
  2⤵
  PID:7032
- C:\Windows\System\QoQnuur.exe
  C:\Windows\System\QoQnuur.exe
  2⤵
  PID:6196
- C:\Windows\System\XKLzKZU.exe
  C:\Windows\System\XKLzKZU.exe
  2⤵
  PID:7300
- C:\Windows\System\yVaumCy.exe
  C:\Windows\System\yVaumCy.exe
  2⤵
  PID:7312
- C:\Windows\System\CzlfKPC.exe
  C:\Windows\System\CzlfKPC.exe
  2⤵
  PID:6984
- C:\Windows\System\XhraIoN.exe
  C:\Windows\System\XhraIoN.exe
  2⤵
  PID:6508
- C:\Windows\System\ikGctVo.exe
  C:\Windows\System\ikGctVo.exe
  2⤵
  PID:7576
- C:\Windows\System\VIQkSVE.exe
  C:\Windows\System\VIQkSVE.exe
  2⤵
  PID:7192
- C:\Windows\System\WUlcCQp.exe
  C:\Windows\System\WUlcCQp.exe
  2⤵
  PID:7804
- C:\Windows\System\fGheQNj.exe
  C:\Windows\System\fGheQNj.exe
  2⤵
  PID:7920
- C:\Windows\System\qdWNiui.exe
  C:\Windows\System\qdWNiui.exe
  2⤵
  PID:7100
- C:\Windows\System\oKtNzvN.exe
  C:\Windows\System\oKtNzvN.exe
  2⤵
  PID:7272
- C:\Windows\System\cWeWaUK.exe
  C:\Windows\System\cWeWaUK.exe
  2⤵
  PID:6668
- C:\Windows\System\WhNMEyO.exe
  C:\Windows\System\WhNMEyO.exe
  2⤵
  PID:8112
- C:\Windows\System\mkFWFVm.exe
  C:\Windows\System\mkFWFVm.exe
  2⤵
  PID:7784
- C:\Windows\System\HqTxFEd.exe
  C:\Windows\System\HqTxFEd.exe
  2⤵
  PID:7436
- C:\Windows\System\bsZbdYt.exe
  C:\Windows\System\bsZbdYt.exe
  2⤵
  PID:1156
- C:\Windows\System\pzIrGVm.exe
  C:\Windows\System\pzIrGVm.exe
  2⤵
  PID:8672
- C:\Windows\System\URTWeGW.exe
  C:\Windows\System\URTWeGW.exe
  2⤵
  PID:8124
- C:\Windows\System\hQpuzam.exe
  C:\Windows\System\hQpuzam.exe
  2⤵
  PID:7664
- C:\Windows\System\IqgfxCp.exe
  C:\Windows\System\IqgfxCp.exe
  2⤵
  PID:7632
- C:\Windows\System\xfrgQhI.exe
  C:\Windows\System\xfrgQhI.exe
  2⤵
  PID:7216
- C:\Windows\System\PfOLEpl.exe
  C:\Windows\System\PfOLEpl.exe
  2⤵
  PID:2896
- C:\Windows\System\qzpxPUE.exe
  C:\Windows\System\qzpxPUE.exe
  2⤵
  PID:7728
- C:\Windows\System\CzKAeuX.exe
  C:\Windows\System\CzKAeuX.exe
  2⤵
  PID:9192
- C:\Windows\System\sRyZxCN.exe
  C:\Windows\System\sRyZxCN.exe
  2⤵
  PID:8588
- C:\Windows\System\FufFBhg.exe
  C:\Windows\System\FufFBhg.exe
  2⤵
  PID:8576
- C:\Windows\System\AUgGXEh.exe
  C:\Windows\System\AUgGXEh.exe
  2⤵
  PID:7968
- C:\Windows\System\SUolmHk.exe
  C:\Windows\System\SUolmHk.exe
  2⤵
  PID:8088
- C:\Windows\System\LGzspos.exe
  C:\Windows\System\LGzspos.exe
  2⤵
  PID:968
- C:\Windows\System\qCAyXtG.exe
  C:\Windows\System\qCAyXtG.exe
  2⤵
  PID:7704
- C:\Windows\System\apbaPRi.exe
  C:\Windows\System\apbaPRi.exe
  2⤵
  PID:648
- C:\Windows\System\AXsCvyN.exe
  C:\Windows\System\AXsCvyN.exe
  2⤵
  PID:2532
- C:\Windows\System\blEnDaY.exe
  C:\Windows\System\blEnDaY.exe
  2⤵
  PID:9084
- C:\Windows\System\fihxLBX.exe
  C:\Windows\System\fihxLBX.exe
  2⤵
  PID:7484
- C:\Windows\System\VOhnFWK.exe
  C:\Windows\System\VOhnFWK.exe
  2⤵
  PID:8508
- C:\Windows\System\JtWPgrv.exe
  C:\Windows\System\JtWPgrv.exe
  2⤵
  PID:1676
- C:\Windows\System\NBwSAwW.exe
  C:\Windows\System\NBwSAwW.exe
  2⤵
  PID:8296
- C:\Windows\System\qiFBttk.exe
  C:\Windows\System\qiFBttk.exe
  2⤵
  PID:4964
- C:\Windows\System\APGgCqm.exe
  C:\Windows\System\APGgCqm.exe
  2⤵
  PID:8628
- C:\Windows\System\wlofyBh.exe
  C:\Windows\System\wlofyBh.exe
  2⤵
  PID:8340
- C:\Windows\System\ekvYecI.exe
  C:\Windows\System\ekvYecI.exe
  2⤵
  PID:7156
- C:\Windows\System\PozIezo.exe
  C:\Windows\System\PozIezo.exe
  2⤵
  PID:9236
- C:\Windows\System\IUmzYxb.exe
  C:\Windows\System\IUmzYxb.exe
  2⤵
  PID:9108
- C:\Windows\System\uZcmoQo.exe
  C:\Windows\System\uZcmoQo.exe
  2⤵
  PID:9368
- C:\Windows\System\MRJjjSL.exe
  C:\Windows\System\MRJjjSL.exe
  2⤵
  PID:9416
- C:\Windows\System\oESCjKK.exe
  C:\Windows\System\oESCjKK.exe
  2⤵
  PID:1120
- C:\Windows\System\iQGcfbu.exe
  C:\Windows\System\iQGcfbu.exe
  2⤵
  PID:3512
- C:\Windows\System\ZQXhoWQ.exe
  C:\Windows\System\ZQXhoWQ.exe
  2⤵
  PID:6272
- C:\Windows\System\SBRYoFZ.exe
  C:\Windows\System\SBRYoFZ.exe
  2⤵
  PID:9604
- C:\Windows\System\OmaYaJG.exe
  C:\Windows\System\OmaYaJG.exe
  2⤵
  PID:9656
- C:\Windows\System\sKtQIbV.exe
  C:\Windows\System\sKtQIbV.exe
  2⤵
  PID:1540
- C:\Windows\System\OYGUNSt.exe
  C:\Windows\System\OYGUNSt.exe
  2⤵
  PID:7292
- C:\Windows\System\OrThixM.exe
  C:\Windows\System\OrThixM.exe
  2⤵
  PID:9756
- C:\Windows\System\pFtNCRV.exe
  C:\Windows\System\pFtNCRV.exe
  2⤵
  PID:9780
- C:\Windows\System\vlFmMkL.exe
  C:\Windows\System\vlFmMkL.exe
  2⤵
  PID:9876
- C:\Windows\System\qGzjcaH.exe
  C:\Windows\System\qGzjcaH.exe
  2⤵
  PID:9932
- C:\Windows\System\KUNPGCk.exe
  C:\Windows\System\KUNPGCk.exe
  2⤵
  PID:2104
- C:\Windows\System\UoPdqyt.exe
  C:\Windows\System\UoPdqyt.exe
  2⤵
  PID:8348
- C:\Windows\System\esxHbLB.exe
  C:\Windows\System\esxHbLB.exe
  2⤵
  PID:10120
- C:\Windows\System\ALkaNAE.exe
  C:\Windows\System\ALkaNAE.exe
  2⤵
  PID:8888
- C:\Windows\System\QaGDLmU.exe
  C:\Windows\System\QaGDLmU.exe
  2⤵
  PID:7488
- C:\Windows\System\fecrSok.exe
  C:\Windows\System\fecrSok.exe
  2⤵
  PID:1472
- C:\Windows\System\IUnvJOT.exe
  C:\Windows\System\IUnvJOT.exe
  2⤵
  PID:9128
- C:\Windows\System\TrnZPwF.exe
  C:\Windows\System\TrnZPwF.exe
  2⤵
  PID:4572
- C:\Windows\System\JOKFfzx.exe
  C:\Windows\System\JOKFfzx.exe
  2⤵
  PID:5048
- C:\Windows\System\neculBm.exe
  C:\Windows\System\neculBm.exe
  2⤵
  PID:9804
- C:\Windows\System\JEVutay.exe
  C:\Windows\System\JEVutay.exe
  2⤵
  PID:1160
- C:\Windows\System\zktWPbu.exe
  C:\Windows\System\zktWPbu.exe
  2⤵
  PID:4004
- C:\Windows\System\mpNIGRS.exe
  C:\Windows\System\mpNIGRS.exe
  2⤵
  PID:10204
- C:\Windows\System\xjgYcOt.exe
  C:\Windows\System\xjgYcOt.exe
  2⤵
  PID:2264
- C:\Windows\System\FnhuhvM.exe
  C:\Windows\System\FnhuhvM.exe
  2⤵
  PID:9540
- C:\Windows\System\rkIWBqW.exe
  C:\Windows\System\rkIWBqW.exe
  2⤵
  PID:4340
- C:\Windows\System\oqbNwaU.exe
  C:\Windows\System\oqbNwaU.exe
  2⤵
  PID:10024
- C:\Windows\System\vjruAAq.exe
  C:\Windows\System\vjruAAq.exe
  2⤵
  PID:4420
- C:\Windows\System\MQMzWHd.exe
  C:\Windows\System\MQMzWHd.exe
  2⤵
  PID:10012
- C:\Windows\System\sFAypTb.exe
  C:\Windows\System\sFAypTb.exe
  2⤵
  PID:7996
- C:\Windows\System\VATXqoF.exe
  C:\Windows\System\VATXqoF.exe
  2⤵
  PID:4756
- C:\Windows\System\aNLUcON.exe
  C:\Windows\System\aNLUcON.exe
  2⤵
  PID:10268
- C:\Windows\System\ZrJzZtV.exe
  C:\Windows\System\ZrJzZtV.exe
  2⤵
  PID:8196
- C:\Windows\System\vdAwIQW.exe
  C:\Windows\System\vdAwIQW.exe
  2⤵
  PID:10364
- C:\Windows\System\hKvYeyY.exe
  C:\Windows\System\hKvYeyY.exe
  2⤵
  PID:9172
- C:\Windows\System\jdqKWgj.exe
  C:\Windows\System\jdqKWgj.exe
  2⤵
  PID:10424
- C:\Windows\System\qZjRjiG.exe
  C:\Windows\System\qZjRjiG.exe
  2⤵
  PID:10488
- C:\Windows\System\VIYFyWP.exe
  C:\Windows\System\VIYFyWP.exe
  2⤵
  PID:3236
- C:\Windows\System\fVShdHB.exe
  C:\Windows\System\fVShdHB.exe
  2⤵
  PID:4576
- C:\Windows\System\QVpvzga.exe
  C:\Windows\System\QVpvzga.exe
  2⤵
  PID:10600
- C:\Windows\System\UKmfMtu.exe
  C:\Windows\System\UKmfMtu.exe
  2⤵
  PID:2932
- C:\Windows\System\jCYytVI.exe
  C:\Windows\System\jCYytVI.exe
  2⤵
  PID:10672
- C:\Windows\System\HBEGIHe.exe
  C:\Windows\System\HBEGIHe.exe
  2⤵
  PID:9444
- C:\Windows\System\VtzLnOH.exe
  C:\Windows\System\VtzLnOH.exe
  2⤵
  PID:9432
- C:\Windows\System\MQmrJOF.exe
  C:\Windows\System\MQmrJOF.exe
  2⤵
  PID:3360
- C:\Windows\System\tHYqYNe.exe
  C:\Windows\System\tHYqYNe.exe
  2⤵
  PID:9512
- C:\Windows\System\pDRrXqb.exe
  C:\Windows\System\pDRrXqb.exe
  2⤵
  PID:4972
- C:\Windows\System\FnxscNW.exe
  C:\Windows\System\FnxscNW.exe
  2⤵
  PID:10840
- C:\Windows\System\KIulSpS.exe
  C:\Windows\System\KIulSpS.exe
  2⤵
  PID:10900
- C:\Windows\System\MQUVbkO.exe
  C:\Windows\System\MQUVbkO.exe
  2⤵
  PID:10936
- C:\Windows\System\xiRgOnw.exe
  C:\Windows\System\xiRgOnw.exe
  2⤵
  PID:3180
- C:\Windows\System\Ikekurr.exe
  C:\Windows\System\Ikekurr.exe
  2⤵
  PID:11008
- C:\Windows\System\CWOmJrR.exe
  C:\Windows\System\CWOmJrR.exe
  2⤵
  PID:1596
- C:\Windows\System\suzxEwo.exe
  C:\Windows\System\suzxEwo.exe
  2⤵
  PID:11120
- C:\Windows\System\BexVJbT.exe
  C:\Windows\System\BexVJbT.exe
  2⤵
  PID:11164
- C:\Windows\System\YlTryzt.exe
  C:\Windows\System\YlTryzt.exe
  2⤵
  PID:9760
- C:\Windows\System\PaUSjiN.exe
  C:\Windows\System\PaUSjiN.exe
  2⤵
  PID:944
- C:\Windows\System\VSfrBrN.exe
  C:\Windows\System\VSfrBrN.exe
  2⤵
  PID:4612
- C:\Windows\System\rxIeRdc.exe
  C:\Windows\System\rxIeRdc.exe
  2⤵
  PID:9908
- C:\Windows\System\KKlCTpC.exe
  C:\Windows\System\KKlCTpC.exe
  2⤵
  PID:1412
- C:\Windows\System\txlgdQA.exe
  C:\Windows\System\txlgdQA.exe
  2⤵
  PID:8240
- C:\Windows\System\IskHNAI.exe
  C:\Windows\System\IskHNAI.exe
  2⤵
  PID:10312
- C:\Windows\System\QqWimVX.exe
  C:\Windows\System\QqWimVX.exe
  2⤵
  PID:10512
- C:\Windows\System\fNYfiup.exe
  C:\Windows\System\fNYfiup.exe
  2⤵
  PID:11012
- C:\Windows\System\CRSRySJ.exe
  C:\Windows\System\CRSRySJ.exe
  2⤵
  PID:10372
- C:\Windows\System\ARuSyrb.exe
  C:\Windows\System\ARuSyrb.exe
  2⤵
  PID:3044
- C:\Windows\System\NHeAbEV.exe
  C:\Windows\System\NHeAbEV.exe
  2⤵
  PID:11368
- C:\Windows\System\xMNflIE.exe
  C:\Windows\System\xMNflIE.exe
  2⤵
  PID:10176
- C:\Windows\System\fjVcRAd.exe
  C:\Windows\System\fjVcRAd.exe
  2⤵
  PID:3576
- C:\Windows\System\uXYscWS.exe
  C:\Windows\System\uXYscWS.exe
  2⤵
  PID:3224
- C:\Windows\System\AIRzYsp.exe
  C:\Windows\System\AIRzYsp.exe
  2⤵
  PID:11568
- C:\Windows\System\GnPlcuv.exe
  C:\Windows\System\GnPlcuv.exe
  2⤵
  PID:8504
- C:\Windows\System\gLdTZgK.exe
  C:\Windows\System\gLdTZgK.exe
  2⤵
  PID:8280
- C:\Windows\System\APDeVVt.exe
  C:\Windows\System\APDeVVt.exe
  2⤵
  PID:11748
- C:\Windows\System\fZDsfwO.exe
  C:\Windows\System\fZDsfwO.exe
  2⤵
  PID:11776
- C:\Windows\System\IpPqDkX.exe
  C:\Windows\System\IpPqDkX.exe
  2⤵
  PID:11804
- C:\Windows\System\WvPaOVI.exe
  C:\Windows\System\WvPaOVI.exe
  2⤵
  PID:2524
- C:\Windows\System\orKlZsg.exe
  C:\Windows\System\orKlZsg.exe
  2⤵
  PID:1416
- C:\Windows\System\NNoUgIk.exe
  C:\Windows\System\NNoUgIk.exe
  2⤵
  PID:2552
- C:\Windows\System\QAUZNvE.exe
  C:\Windows\System\QAUZNvE.exe
  2⤵
  PID:9276
- C:\Windows\System\LWxLluT.exe
  C:\Windows\System\LWxLluT.exe
  2⤵
  PID:5128
- C:\Windows\System\TgzSIbc.exe
  C:\Windows\System\TgzSIbc.exe
  2⤵
  PID:9588
- C:\Windows\System\zbvEjJj.exe
  C:\Windows\System\zbvEjJj.exe
  2⤵
  PID:4300
- C:\Windows\System\QbcHIkP.exe
  C:\Windows\System\QbcHIkP.exe
  2⤵
  PID:5200
- C:\Windows\System\cNFVUaA.exe
  C:\Windows\System\cNFVUaA.exe
  2⤵
  PID:2744
- C:\Windows\System\JQmCIvs.exe
  C:\Windows\System\JQmCIvs.exe
  2⤵
  PID:5284
- C:\Windows\System\rTAPGZZ.exe
  C:\Windows\System\rTAPGZZ.exe
  2⤵
  PID:5296
- C:\Windows\System\LazBSVn.exe
  C:\Windows\System\LazBSVn.exe
  2⤵
  PID:9404
- C:\Windows\System\WHJAoVN.exe
  C:\Windows\System\WHJAoVN.exe
  2⤵
  PID:9180
- C:\Windows\System\ebdCGsO.exe
  C:\Windows\System\ebdCGsO.exe
  2⤵
  PID:11456
- C:\Windows\System\bBHnaeU.exe
  C:\Windows\System\bBHnaeU.exe
  2⤵
  PID:8972
- C:\Windows\System\vpDLPoy.exe
  C:\Windows\System\vpDLPoy.exe
  2⤵
  PID:5452
- C:\Windows\System\RUcelDP.exe
  C:\Windows\System\RUcelDP.exe
  2⤵
  PID:5480
- C:\Windows\System\fGluUgF.exe
  C:\Windows\System\fGluUgF.exe
  2⤵
  PID:11780
- C:\Windows\System\dUzEpmW.exe
  C:\Windows\System\dUzEpmW.exe
  2⤵
  PID:10252
- C:\Windows\System\vIztGJv.exe
  C:\Windows\System\vIztGJv.exe
  2⤵
  PID:4544
- C:\Windows\System\NrIlHYl.exe
  C:\Windows\System\NrIlHYl.exe
  2⤵
  PID:8464
- C:\Windows\System\OBkPaWu.exe
  C:\Windows\System\OBkPaWu.exe
  2⤵
  PID:10388
- C:\Windows\System\QMGXKWJ.exe
  C:\Windows\System\QMGXKWJ.exe
  2⤵
  PID:7412
- C:\Windows\System\KbaKBHt.exe
  C:\Windows\System\KbaKBHt.exe
  2⤵
  PID:9112
- C:\Windows\System\XhVBrZi.exe
  C:\Windows\System\XhVBrZi.exe
  2⤵
  PID:2512
- C:\Windows\System\YauuCFd.exe
  C:\Windows\System\YauuCFd.exe
  2⤵
  PID:5648
- C:\Windows\System\quGbZXh.exe
  C:\Windows\System\quGbZXh.exe
  2⤵
  PID:5660
- C:\Windows\System\pSnRWry.exe
  C:\Windows\System\pSnRWry.exe
  2⤵
  PID:2156
- C:\Windows\System\eVkjzfA.exe
  C:\Windows\System\eVkjzfA.exe
  2⤵
  PID:5704
- C:\Windows\System\GJKqVCa.exe
  C:\Windows\System\GJKqVCa.exe
  2⤵
  PID:9400
- C:\Windows\System\aEcrYYN.exe
  C:\Windows\System\aEcrYYN.exe
  2⤵
  PID:9488
- C:\Windows\System\HzADTqj.exe
  C:\Windows\System\HzADTqj.exe
  2⤵
  PID:12252
- C:\Windows\System\IrVIlBx.exe
  C:\Windows\System\IrVIlBx.exe
  2⤵
  PID:12352
- C:\Windows\System\tHkxzTA.exe
  C:\Windows\System\tHkxzTA.exe
  2⤵
  PID:12376
- C:\Windows\System\ZNemcgT.exe
  C:\Windows\System\ZNemcgT.exe
  2⤵
  PID:3356
- C:\Windows\System\cnvbWed.exe
  C:\Windows\System\cnvbWed.exe
  2⤵
  PID:5816
- C:\Windows\System\klYKSpT.exe
  C:\Windows\System\klYKSpT.exe
  2⤵
  PID:9620
- C:\Windows\System\IhBMZIr.exe
  C:\Windows\System\IhBMZIr.exe
  2⤵
  PID:12580
- C:\Windows\System\XfHJXOr.exe
  C:\Windows\System\XfHJXOr.exe
  2⤵
  PID:11032
- C:\Windows\System\Lkqywdh.exe
  C:\Windows\System\Lkqywdh.exe
  2⤵
  PID:12736
- C:\Windows\System\HKVJbjP.exe
  C:\Windows\System\HKVJbjP.exe
  2⤵
  PID:11080
- C:\Windows\System\RIYWtkq.exe
  C:\Windows\System\RIYWtkq.exe
  2⤵
  PID:6060
- C:\Windows\System\shJkDNh.exe
  C:\Windows\System\shJkDNh.exe
  2⤵
  PID:6068
- C:\Windows\System\GDreBzk.exe
  C:\Windows\System\GDreBzk.exe
  2⤵
  PID:1752
- C:\Windows\System\BnWsMOR.exe
  C:\Windows\System\BnWsMOR.exe
  2⤵
  PID:9836
- C:\Windows\System\PTjQBTE.exe
  C:\Windows\System\PTjQBTE.exe
  2⤵
  PID:4396
- C:\Windows\System\UaHNSoM.exe
  C:\Windows\System\UaHNSoM.exe
  2⤵
  PID:6140
- C:\Windows\System\yNvnlDA.exe
  C:\Windows\System\yNvnlDA.exe
  2⤵
  PID:11040
- C:\Windows\System\mFNxEUD.exe
  C:\Windows\System\mFNxEUD.exe
  2⤵
  PID:5556
- C:\Windows\System\gezztYV.exe
  C:\Windows\System\gezztYV.exe
  2⤵
  PID:11488
- C:\Windows\System\TpGMwft.exe
  C:\Windows\System\TpGMwft.exe
  2⤵
  PID:7836
- C:\Windows\System\yFuiQMX.exe
  C:\Windows\System\yFuiQMX.exe
  2⤵
  PID:4176
- C:\Windows\System\hFAgYZF.exe
  C:\Windows\System\hFAgYZF.exe
  2⤵
  PID:7380
- C:\Windows\System\LQSHBul.exe
  C:\Windows\System\LQSHBul.exe
  2⤵
  PID:7972
- C:\Windows\System\UVWKzYI.exe
  C:\Windows\System\UVWKzYI.exe
  2⤵
  PID:8660
- C:\Windows\System\bMgMdjP.exe
  C:\Windows\System\bMgMdjP.exe
  2⤵
  PID:11448
- C:\Windows\System\eVBhTZw.exe
  C:\Windows\System\eVBhTZw.exe
  2⤵
  PID:4316
- C:\Windows\System\bAFTfpM.exe
  C:\Windows\System\bAFTfpM.exe
  2⤵
  PID:11664
- C:\Windows\System\kqPMpqj.exe
  C:\Windows\System\kqPMpqj.exe
  2⤵
  PID:4356
- C:\Windows\System\DAWClih.exe
  C:\Windows\System\DAWClih.exe
  2⤵
  PID:5952
- C:\Windows\System\zYxjmgL.exe
  C:\Windows\System\zYxjmgL.exe
  2⤵
  PID:8648
- C:\Windows\System\xMHOcxX.exe
  C:\Windows\System\xMHOcxX.exe
  2⤵
  PID:4140
- C:\Windows\System\YtZhfog.exe
  C:\Windows\System\YtZhfog.exe
  2⤵
  PID:4696
- C:\Windows\System\GIyhZyq.exe
  C:\Windows\System\GIyhZyq.exe
  2⤵
  PID:5300
- C:\Windows\System\KqbCWVt.exe
  C:\Windows\System\KqbCWVt.exe
  2⤵
  PID:2580
- C:\Windows\System\RHfMmne.exe
  C:\Windows\System\RHfMmne.exe
  2⤵
  PID:5144
- C:\Windows\System\gLtYOpZ.exe
  C:\Windows\System\gLtYOpZ.exe
  2⤵
  PID:5760
- C:\Windows\System\BnQhPvb.exe
  C:\Windows\System\BnQhPvb.exe
  2⤵
  PID:432
- C:\Windows\System\QJyesWl.exe
  C:\Windows\System\QJyesWl.exe
  2⤵
  PID:9996
- C:\Windows\System\XpoEjAi.exe
  C:\Windows\System\XpoEjAi.exe
  2⤵
  PID:5204
- C:\Windows\System\NwpPRVX.exe
  C:\Windows\System\NwpPRVX.exe
  2⤵
  PID:924
- C:\Windows\System\CGHuKZB.exe
  C:\Windows\System\CGHuKZB.exe
  2⤵
  PID:5140
- C:\Windows\System\nHyxyNu.exe
  C:\Windows\System\nHyxyNu.exe
  2⤵
  PID:10232
- C:\Windows\System\VJtcgnn.exe
  C:\Windows\System\VJtcgnn.exe
  2⤵
  PID:5888
- C:\Windows\System\nfZQhpK.exe
  C:\Windows\System\nfZQhpK.exe
  2⤵
  PID:3456
- C:\Windows\System\JpHCfOt.exe
  C:\Windows\System\JpHCfOt.exe
  2⤵
  PID:5708
- C:\Windows\System\hlMpHjQ.exe
  C:\Windows\System\hlMpHjQ.exe
  2⤵
  PID:1084
- C:\Windows\System\WmsgebA.exe
  C:\Windows\System\WmsgebA.exe
  2⤵
  PID:3184
- C:\Windows\System\lAQSiQb.exe
  C:\Windows\System\lAQSiQb.exe
  2⤵
  PID:8800
- C:\Windows\System\RtePXzD.exe
  C:\Windows\System\RtePXzD.exe
  2⤵
  PID:7744
- C:\Windows\System\JIFCBwc.exe
  C:\Windows\System\JIFCBwc.exe
  2⤵
  PID:6316
- C:\Windows\System\EYmBmCs.exe
  C:\Windows\System\EYmBmCs.exe
  2⤵
  PID:11844
- C:\Windows\System\zJXjsYg.exe
  C:\Windows\System\zJXjsYg.exe
  2⤵
  PID:6396
- C:\Windows\System\ASYYfqp.exe
  C:\Windows\System\ASYYfqp.exe
  2⤵
  PID:11960
- C:\Windows\System\GCqaWqK.exe
  C:\Windows\System\GCqaWqK.exe
  2⤵
  PID:6468
- C:\Windows\System\lEQLnOi.exe
  C:\Windows\System\lEQLnOi.exe
  2⤵
  PID:8896
- C:\Windows\System\XGJXTLZ.exe
  C:\Windows\System\XGJXTLZ.exe
  2⤵
  PID:12276
- C:\Windows\System\mCIZNyx.exe
  C:\Windows\System\mCIZNyx.exe
  2⤵
  PID:6648
- C:\Windows\System\sUFelZs.exe
  C:\Windows\System\sUFelZs.exe
  2⤵
  PID:6760
- C:\Windows\System\UFGaJgr.exe
  C:\Windows\System\UFGaJgr.exe
  2⤵
  PID:6796
- C:\Windows\System\jFBvErh.exe
  C:\Windows\System\jFBvErh.exe
  2⤵
  PID:6804
- C:\Windows\System\XAPcYjp.exe
  C:\Windows\System\XAPcYjp.exe
  2⤵
  PID:6860
- C:\Windows\System\LedrOJf.exe
  C:\Windows\System\LedrOJf.exe
  2⤵
  PID:10532
- C:\Windows\System\OcFTTmU.exe
  C:\Windows\System\OcFTTmU.exe
  2⤵
  PID:11268
- C:\Windows\System\pqyRfmG.exe
  C:\Windows\System\pqyRfmG.exe
  2⤵
  PID:9320
- C:\Windows\System\ynBqOVs.exe
  C:\Windows\System\ynBqOVs.exe
  2⤵
  PID:11992
- C:\Windows\System\MGNGjZj.exe
  C:\Windows\System\MGNGjZj.exe
  2⤵
  PID:9556
- C:\Windows\System\MYCeaAU.exe
  C:\Windows\System\MYCeaAU.exe
  2⤵
  PID:6828
- C:\Windows\System\XJfiCps.exe
  C:\Windows\System\XJfiCps.exe
  2⤵
  PID:12560
- C:\Windows\System\DfHrjRg.exe
  C:\Windows\System\DfHrjRg.exe
  2⤵
  PID:12540
- C:\Windows\System\MboXxhB.exe
  C:\Windows\System\MboXxhB.exe
  2⤵
  PID:12608
- C:\Windows\System\RWCgNZG.exe
  C:\Windows\System\RWCgNZG.exe
  2⤵
  PID:11056
- C:\Windows\System\dzybzHR.exe
  C:\Windows\System\dzybzHR.exe
  2⤵
  PID:9800
- C:\Windows\System\oddSHvk.exe
  C:\Windows\System\oddSHvk.exe
  2⤵
  PID:12812
- C:\Windows\System\AxoJggd.exe
  C:\Windows\System\AxoJggd.exe
  2⤵
  PID:11232
- C:\Windows\System\gILuZku.exe
  C:\Windows\System\gILuZku.exe
  2⤵
  PID:12892
- C:\Windows\System\ZpQVoTM.exe
  C:\Windows\System\ZpQVoTM.exe
  2⤵
  PID:12876
- C:\Windows\System\BCbNbxs.exe
  C:\Windows\System\BCbNbxs.exe
  2⤵
  PID:7112
- C:\Windows\System\NWfLIeX.exe
  C:\Windows\System\NWfLIeX.exe
  2⤵
  PID:6092
- C:\Windows\System\sswCMZC.exe
  C:\Windows\System\sswCMZC.exe
  2⤵
  PID:7572
- C:\Windows\System\cyPwZRS.exe
  C:\Windows\System\cyPwZRS.exe
  2⤵
  PID:13196
- C:\Windows\System\xCYLGQI.exe
  C:\Windows\System\xCYLGQI.exe
  2⤵
  PID:8272
- C:\Windows\System\nMTIeeC.exe
  C:\Windows\System\nMTIeeC.exe
  2⤵
  PID:10556
- C:\Windows\System\qtqlunf.exe
  C:\Windows\System\qtqlunf.exe
  2⤵
  PID:5184
- C:\Windows\System\YROFzFf.exe
  C:\Windows\System\YROFzFf.exe
  2⤵
  PID:5500
- C:\Windows\System\RBeoLbZ.exe
  C:\Windows\System\RBeoLbZ.exe
  2⤵
  PID:1288
- C:\Windows\System\heGCzXi.exe
  C:\Windows\System\heGCzXi.exe
  2⤵
  PID:2856
- C:\Windows\System\nwzlLLS.exe
  C:\Windows\System\nwzlLLS.exe
  2⤵
  PID:10144
- C:\Windows\System\PGCAGuq.exe
  C:\Windows\System\PGCAGuq.exe
  2⤵
  PID:7832
- C:\Windows\System\riegUlv.exe
  C:\Windows\System\riegUlv.exe
  2⤵
  PID:11492
- C:\Windows\System\KWPishW.exe
  C:\Windows\System\KWPishW.exe
  2⤵
  PID:10056
- C:\Windows\System\TChcjoi.exe
  C:\Windows\System\TChcjoi.exe
  2⤵
  PID:11388
- C:\Windows\System\CyokHzj.exe
  C:\Windows\System\CyokHzj.exe
  2⤵
  PID:8156
- C:\Windows\System\RxugcjS.exe
  C:\Windows\System\RxugcjS.exe
  2⤵
  PID:1276
- C:\Windows\System\xtPKbwo.exe
  C:\Windows\System\xtPKbwo.exe
  2⤵
  PID:11592
- C:\Windows\System\blJzFfM.exe
  C:\Windows\System\blJzFfM.exe
  2⤵
  PID:7512
- C:\Windows\System\wGaTJJu.exe
  C:\Windows\System\wGaTJJu.exe
  2⤵
  PID:7472
- C:\Windows\System\GkhbSnS.exe
  C:\Windows\System\GkhbSnS.exe
  2⤵
  PID:8052
- C:\Windows\System\aNwOlut.exe
  C:\Windows\System\aNwOlut.exe
  2⤵
  PID:7924
- C:\Windows\System\tectLSc.exe
  C:\Windows\System\tectLSc.exe
  2⤵
  PID:11800
- C:\Windows\System\iBpSAqS.exe
  C:\Windows\System\iBpSAqS.exe
  2⤵
  PID:7184
- C:\Windows\System\WNSVjxh.exe
  C:\Windows\System\WNSVjxh.exe
  2⤵
  PID:8136
- C:\Windows\System\vHeIoNj.exe
  C:\Windows\System\vHeIoNj.exe
  2⤵
  PID:8120
- C:\Windows\System\UhDuQSj.exe
  C:\Windows\System\UhDuQSj.exe
  2⤵
  PID:8140
- C:\Windows\System\DcpjVPP.exe
  C:\Windows\System\DcpjVPP.exe
  2⤵
  PID:7200
- C:\Windows\System\iiajxDx.exe
  C:\Windows\System\iiajxDx.exe
  2⤵
  PID:8012
- C:\Windows\System\vHktJtH.exe
  C:\Windows\System\vHktJtH.exe
  2⤵
  PID:11868
- C:\Windows\System\vcgddXf.exe
  C:\Windows\System\vcgddXf.exe
  2⤵
  PID:3496
- C:\Windows\System\JcuBNNb.exe
  C:\Windows\System\JcuBNNb.exe
  2⤵
  PID:8328
- C:\Windows\System\wzMMpsB.exe
  C:\Windows\System\wzMMpsB.exe
  2⤵
  PID:7464
- C:\Windows\System\ygDcdQw.exe
  C:\Windows\System\ygDcdQw.exe
  2⤵
  PID:1180
- C:\Windows\System\iFQKrPi.exe
  C:\Windows\System\iFQKrPi.exe
  2⤵
  PID:1788
- C:\Windows\System\seSmQHl.exe
  C:\Windows\System\seSmQHl.exe
  2⤵
  PID:8488
- C:\Windows\System\wfYSKCC.exe
  C:\Windows\System\wfYSKCC.exe
  2⤵
  PID:8696
- C:\Windows\System\qPHDkbw.exe
  C:\Windows\System\qPHDkbw.exe
  2⤵
  PID:8616
- C:\Windows\System\QAWShDN.exe
  C:\Windows\System\QAWShDN.exe
  2⤵
  PID:2400
- C:\Windows\System\GpqdPqj.exe
  C:\Windows\System\GpqdPqj.exe
  2⤵
  PID:6160
- C:\Windows\System\JgKTlQu.exe
  C:\Windows\System\JgKTlQu.exe
  2⤵
  PID:8848
- C:\Windows\System\uVvJBVL.exe
  C:\Windows\System\uVvJBVL.exe
  2⤵
  PID:9060
- C:\Windows\System\MzavNsB.exe
  C:\Windows\System\MzavNsB.exe
  2⤵
  PID:11764
- C:\Windows\System\iPOnjKd.exe
  C:\Windows\System\iPOnjKd.exe
  2⤵
  PID:11824
- C:\Windows\System\FCtqwsB.exe
  C:\Windows\System\FCtqwsB.exe
  2⤵
  PID:6364
- C:\Windows\System\CedcNgu.exe
  C:\Windows\System\CedcNgu.exe
  2⤵
  PID:6408
- C:\Windows\System\vHmJVHe.exe
  C:\Windows\System\vHmJVHe.exe
  2⤵
  PID:6452
- C:\Windows\System\iSgysLT.exe
  C:\Windows\System\iSgysLT.exe
  2⤵
  PID:8816
- C:\Windows\System\gVrYABT.exe
  C:\Windows\System\gVrYABT.exe
  2⤵
  PID:5576
- C:\Windows\System\RZNcBjH.exe
  C:\Windows\System\RZNcBjH.exe
  2⤵
  PID:11864
- C:\Windows\System\FzhwXPY.exe
  C:\Windows\System\FzhwXPY.exe
  2⤵
  PID:6856
- C:\Windows\System\HYFMsar.exe
  C:\Windows\System\HYFMsar.exe
  2⤵
  PID:11392
- C:\Windows\System\LoRvpMz.exe
  C:\Windows\System\LoRvpMz.exe
  2⤵
  PID:6156
- C:\Windows\System\EIqhjgR.exe
  C:\Windows\System\EIqhjgR.exe
  2⤵
  PID:2124
- C:\Windows\System\lMgbFlN.exe
  C:\Windows\System\lMgbFlN.exe
  2⤵
  PID:10960
- C:\Windows\System\YXrCcZD.exe
  C:\Windows\System\YXrCcZD.exe
  2⤵
  PID:12680
- C:\Windows\System\fzLbKOt.exe
  C:\Windows\System\fzLbKOt.exe
  2⤵
  PID:12396
- C:\Windows\System\iQsapYI.exe
  C:\Windows\System\iQsapYI.exe
  2⤵
  PID:6596
- C:\Windows\System\VWBQvEx.exe
  C:\Windows\System\VWBQvEx.exe
  2⤵
  PID:6664
- C:\Windows\System\nTaFsRO.exe
  C:\Windows\System\nTaFsRO.exe
  2⤵
  PID:12536
- C:\Windows\System\UYvZmcU.exe
  C:\Windows\System\UYvZmcU.exe
  2⤵
  PID:12752
- C:\Windows\System\arVSTPR.exe
  C:\Windows\System\arVSTPR.exe
  2⤵
  PID:9468
- C:\Windows\System\FuhcuIj.exe
  C:\Windows\System\FuhcuIj.exe
  2⤵
  PID:12896
- C:\Windows\System\jjLsuEg.exe
  C:\Windows\System\jjLsuEg.exe
  2⤵
  PID:5756
- C:\Windows\System\DblpmEm.exe
  C:\Windows\System\DblpmEm.exe
  2⤵
  PID:4048
- C:\Windows\System\bmHqWBR.exe
  C:\Windows\System\bmHqWBR.exe
  2⤵
  PID:3396
- C:\Windows\System\moDIRdE.exe
  C:\Windows\System\moDIRdE.exe
  2⤵
  PID:9808
- C:\Windows\System\VmfUTzX.exe
  C:\Windows\System\VmfUTzX.exe
  2⤵
  PID:3956
- C:\Windows\System\KtQpfFZ.exe
  C:\Windows\System\KtQpfFZ.exe
  2⤵
  PID:10224
- C:\Windows\System\MEpnOWb.exe
  C:\Windows\System\MEpnOWb.exe
  2⤵
  PID:11236
- C:\Windows\System\SejeHee.exe
  C:\Windows\System\SejeHee.exe
  2⤵
  PID:10008
- C:\Windows\System\DfYYefz.exe
  C:\Windows\System\DfYYefz.exe
  2⤵
  PID:9424
- C:\Windows\System\YRqssgx.exe
  C:\Windows\System\YRqssgx.exe
  2⤵
  PID:9544
- C:\Windows\System\cQCziKF.exe
  C:\Windows\System\cQCziKF.exe
  2⤵
  PID:1556
- C:\Windows\System\SjJQmJf.exe
  C:\Windows\System\SjJQmJf.exe
  2⤵
  PID:10216
- C:\Windows\System\eTDenWL.exe
  C:\Windows\System\eTDenWL.exe
  2⤵
  PID:1612
- C:\Windows\System\JeXuUjE.exe
  C:\Windows\System\JeXuUjE.exe
  2⤵
  PID:4864
- C:\Windows\System\BiGEkKA.exe
  C:\Windows\System\BiGEkKA.exe
  2⤵
  PID:7884
- C:\Windows\System\FqccTue.exe
  C:\Windows\System\FqccTue.exe
  2⤵
  PID:10200
- C:\Windows\System\OoQmYlX.exe
  C:\Windows\System\OoQmYlX.exe
  2⤵
  PID:9680
- C:\Windows\System\eGbCZZe.exe
  C:\Windows\System\eGbCZZe.exe
  2⤵
  PID:8028
- C:\Windows\System\UJFvQXX.exe
  C:\Windows\System\UJFvQXX.exe
  2⤵
  PID:1116
- C:\Windows\System\BZXxsbc.exe
  C:\Windows\System\BZXxsbc.exe
  2⤵
  PID:7376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sbqflk54.mt1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AWiOkoE.exe

Filesize
1.9MB

MD5
1b5f5196d56c68fc00c9023dde09016c

SHA1
344d5067474bc20aa95ecf9704429fdc09c5291d

SHA256
76fc6c0e8402fc95f26429499fd2c4a2deeeb0170deeacb5d2dfc19e1a77f1e8

SHA512
d2097409c6eaff87aed1042116c8856824c0c2e26b2e4152aeb36955284b08528749b2badb62490736ad0009791eb137ff4e2692366b2e37755e58ed4d25b3bd

Download Submit
C:\Windows\System\CWcTbdF.exe

Filesize
1.9MB

MD5
89a283dc4aea4568bf497d71fc674ea1

SHA1
eeff585c68aee20ba9359f09d0d330f5e67a84aa

SHA256
1410ecff0aa97cabed5372ac56d9aa08ff92b3d191cf75af88fa17b661ad3c15

SHA512
cd37a7c6aa116bb6fabc1b1ac865fe272f2327d7be8d54ac7e02f01c620cd5be45fb563b7780f0cbafb3d775c88d6ee83372455a9106a22f5a34ff0aeaa8badc

Download Submit
C:\Windows\System\DXyuske.exe

Filesize
1.9MB

MD5
5aee65118478fe907bbf9eb6bdea100e

SHA1
46574f03e980359b2502c0d10e9ec2b44cefaa42

SHA256
1f3873529448e43b0f01c4034b75aeb6e13a1e4bf0ebfbd1b1b9ac81cdde55dd

SHA512
46cb5fbbda77a1dfb392ddefd9bf82103ac260fddf92211aaf8051186d08c2c1857f0fee49ca52c12ba7a123ba19a4ff7d992d14ea53cf01a921ce8370167392

Download Submit
C:\Windows\System\FQnfUBv.exe

Filesize
1.9MB

MD5
9adef77245906bca132303062f79d478

SHA1
f00ab53333b4df15627617ff6efb16eb4c0c6cd9

SHA256
3fbf589d729c5377195b569ded9c2808faeaf286a49662ba4e07d2dc78bfc6fa

SHA512
0979659dc14add75158e1103c2742a38349ef2a8bd47bffe1b812db36b3094e7086d51d26e8a1fd8b9117914170b825c7a028bda170ca686389879d881586f36

Download Submit
C:\Windows\System\HJExMWq.exe

Filesize
1.9MB

MD5
afcab0f7281ebc0307c63ffbe2fbb82b

SHA1
942c2c3a6166c8645ad97f32f0bfea8fa8b8054c

SHA256
1dc496e6dd59c20b2e3b50d91ac449ddd45356ce0de1e36a89602dab72968acc

SHA512
d7938de0c8969529f42d1831cd43d803cd3ca59af6f714e377a38e05befbfca4fbb8b127cc136adf5e282b82816d96827f78fdb1e0523309fabee67abaaa627b

Download Submit
C:\Windows\System\HjZBNkd.exe

Filesize
1.9MB

MD5
616f2d1753326c33efd558caaecc5f82

SHA1
705558d46a441a389b43d8e856666786078d8696

SHA256
1235670dff365f04c548d7164c86ba1e8ab22ac8d391f4ebc0eeab5d27520fbb

SHA512
83c4bb0258cc6065a83220a61559ae0a4b36ca2e0fcf5f0d90e7b818998a14d6a490ecf6c458353095c519898e539a12ebb9ca285e034f7bfcccae4df12bd2d7

Download Submit
C:\Windows\System\IfoYLUQ.exe

Filesize
1.9MB

MD5
dd9145b3a5ef5e768568bec1060c3e83

SHA1
d832134a0f248e1ac56de8a32e7aca711fd45c40

SHA256
3590e4cb37a36efec0964359f414be690255a3b0bd26a982e1818dbfe68c2fd5

SHA512
2e6fe8f60e590a7a2f3b64faa8c00c1c8f8ee04863182c0a7f46b74ce9271d4092641be16eea2d8bb137c1c2f43319e2f1cea125c29bcc13521cd168d7abadeb

Download Submit
C:\Windows\System\JJknJeh.exe

Filesize
1.9MB

MD5
25cc210330f5051ff1c9b1a46b0de5ea

SHA1
fdcf5c5a723ab5b8c2435a3f8243ef8048351e68

SHA256
c5d4b6c666d29e4c0afddff6338abcb630fe7c9f05996a73d05da160cd1a2e6d

SHA512
dd88fd6412f808dd3a9f59b928e8a752c6ed25719e0a272dad26b89f6a69b1a18c7676016c60e0f35f28746d1dbf2d632e23c34255efef11bebacfcd6eb41f06

Download Submit
C:\Windows\System\JKxlieo.exe

Filesize
1.9MB

MD5
145554e6824f19aaed1c31e55bebb4ae

SHA1
51ff4c723d9cb9d292cebf0885ec5d7bc0b466f8

SHA256
e081b5de2c02bdcd23178da642d6c6a302927923aeb73a118746c15b57f53761

SHA512
a944c322da27930e39dc9bcef1a171327e8acb581795b48331f0e466a8f7a89cb122eee89b0c5d5053d3965cca4354bf5940ae7dd8f638f923e0683c3ab7810e

Download Submit
C:\Windows\System\JhHZGjQ.exe

Filesize
1.9MB

MD5
504e4643bbf8d4ade968bb34df863f8e

SHA1
718c423815477b0aea419392f73f576cca9391a0

SHA256
39a77a87a17c51f6be71a6e4f116a6930172dc9dbce96f548bf4fbf10d06ec9d

SHA512
12ba93406e06d77572d1da85284a7b658fbfd944f51ce5898c46077bbedabcb5662b958ee07e4f267cbe2f9b41c54f73530fbc4a6e74c3ef4d55130d5b812f0c

Download Submit
C:\Windows\System\KfxUfzU.exe

Filesize
1.9MB

MD5
833123181327c62158a8edad85135397

SHA1
1308f1099786db6286509272c54652af536fd998

SHA256
2e3a52b853ee4061fbf2c31f17f40b5cd67aa3263d5f8d3f80b4012e6e4344de

SHA512
228685b8c5db7b6916386f75236d5a50c36aa4f6adfdfa941affd97f9b5918d389ca120656e10750071da4293e6d1f9e103677f00442cf56b94539eaf780923e

Download Submit
C:\Windows\System\MkwTaXR.exe

Filesize
1.9MB

MD5
10e03f7768ac2fb001368f41af3119a3

SHA1
02d13f30ef6d7fa509a4eeedbf12f3a17fb0489b

SHA256
bf527ed00c3b677a92314401baa6c61a40138741ee83f2ddf2fb05120172184c

SHA512
c42238d2048de7a51af17c7b17cfeadb0841f9f774ed715c8bf84926927bfa59353f05e0f1f27883d58e19189797694e4829e6f69488f9c3fc7be859d9ed5717

Download Submit
C:\Windows\System\NVQmfId.exe

Filesize
1.9MB

MD5
88bc47f7238677638cffa6cc46080cc9

SHA1
3f1768e2b6b75072deb3080afc4c6fe5ed22c561

SHA256
5f19950f6367aba673b080d8645f17f0e84fe826029b0953543bd3f7a940bbf2

SHA512
91476a4b88bea7853fd68bc4c8dd222a006febe1d30fc90bd157f4728537719d979536e37de7b8018a5db56f36108ed9a973847df010a9797587862a2109a428

Download Submit
C:\Windows\System\NjGVvZT.exe

Filesize
1.9MB

MD5
42db59633d97ce46cf73cf9736726d97

SHA1
197ba638d635201284e87fda9483377ff581656b

SHA256
b42496fc6d7c25264b4498a7f5651d648bc5e3ea6715ff28ecb410a44329f285

SHA512
7d2549a1e634d59ca23ee28da0f2a246a9508f470439e446130b57d6fb094482424d11998ab2435963bcc18c12da961c797ad1ae6267187b7acde7aaf54f623b

Download Submit
C:\Windows\System\QTNswVW.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\SCqsehX.exe

Filesize
1.9MB

MD5
20c8957cc7b56826fbc9f44fca8678a6

SHA1
3b803a586e6598d5c3155a6d53d3837d59366bcf

SHA256
91f3fb5ea82ba479b51b28c1268ac7d9354bde0d67763cb8b492fa1d037c89cf

SHA512
1f38286f5ccb1fab9ecdb257e8126ff36a2a997605ea500330740481aa0a49d3a2db1fda1d2ce4ce73bbb0c454d98da19bb54beaf9f1fcc6e2b8d7f153f19ec4

Download Submit
C:\Windows\System\UEvNjib.exe

Filesize
1.9MB

MD5
c02c715b046a4f73e38785733b1139ed

SHA1
e45e520aeec0fa244b655972773f39eacbe2d4f7

SHA256
c30510a554a3a462f1b549a3bad02191f46d50bd4d0ad88642126368c2ade346

SHA512
ca9d0372a8cfc7d2c192bb047c5bb0556732cc4a83922da313c20258553d1e4b575b4d26bdff97ff1ca761ba1b11c92b64393a0a03482526616ee8f5443fe0dc

Download Submit
C:\Windows\System\UauiQYd.exe

Filesize
1.9MB

MD5
467151c04f2702a2befd705e7a320643

SHA1
2cfccd9381087bffa3a3eb99692f2246832d89c3

SHA256
0a8ee973e0407ef215e58ff004a4a21f4466e52ba65820005298a916a0f8e84b

SHA512
0394d68f3985afe459582cab6310a03d314521476096f77c0aa8816a10c62ceed9fd7a186141d2c2c9cf431818207d98fcea7c244fc7957f4b10097eaf861d7d

Download Submit
C:\Windows\System\ViOeJNR.exe

Filesize
1.9MB

MD5
11592d3a98e139aab373548eea9f84c0

SHA1
aca611b9fac49e8897f0f8f4bd82f76c2ffa6435

SHA256
9da71b56089fe9715f7c08fadd896c96cf912744385287110ca9784890de6f6d

SHA512
9c985a536c7c5574f5d034828c864f0eebd8ee2439b0e49ad69bfdd0b160d0932197a29c2ad8380ddfe345525708ddf5ca8ef946e455eb75e3ad8cb6af98dd3e

Download Submit
C:\Windows\System\WBQrLey.exe

Filesize
1.9MB

MD5
740cbcbfe365c856bee7ba2673608467

SHA1
6a5a976b6ff21045f30cfaf32d85e53fd4951ecf

SHA256
360a28722ce8c41aa24b69e557b0df965b5d4aaeab149bef01d7e44fe8654fd0

SHA512
4f1dc84f2f8846390f17bc3f3fe61c7f663d4c565537f8832f00d15c389b5ce07670cfe89259420b6d38d4400bade43156c1f92b6fa7a73c8d99104034755a41

Download Submit
C:\Windows\System\YNbCAWP.exe

Filesize
1.9MB

MD5
652b4738c3c5bc2fa194af78656925fd

SHA1
1e16cd29215b0177ac7ca751054b1e54e43f01e5

SHA256
b55fedd54c352c4ef0df53766f7f1047495165c276f27240c513a879ff9f0f24

SHA512
674c7fcf00481f3935f5ca6a8131fc178b03a6c4ff07e80df4f3a2bd753cab38fbcfcf20e7e672a5f648ca6a2161784cda03b03df9afe84da6a4743a5de798ec

Download Submit
C:\Windows\System\YypQmWX.exe

Filesize
1.9MB

MD5
08234de56ff8dbb290033514c82810dc

SHA1
001d747419c72d572b97df6cf00df8f57fcd4046

SHA256
797b28086a9915e800a72bc607cac8e39d2cc3eb92fca8c5eb73dc89c8c843f2

SHA512
eb55f75e31a93092cd514cdec333841df190715297f40b28f951b39516e58a00530bb61f50e52b9d442d340e3efb493295eee1878b9be68ac4970c57d2ed0334

Download Submit
C:\Windows\System\dZpuHUo.exe

Filesize
1.9MB

MD5
616be22e8aa3f29d41abbb21225a1b5e

SHA1
2b0aa26462b15c376c0147c3336b5764831ac1ba

SHA256
27ff6f1a181e684aa18a3426ad4ff33c790cc23c471e78f1be8ae7ff79821bdc

SHA512
da9460c434ab85c7d7464855d947dd8acaf4df52e085cce6a644cb0eb8c7ebfe7643cb1e26da066a713f71bf7cfd6362de17d63bf616c3989185ae1246ba8809

Download Submit
C:\Windows\System\fUAmSBm.exe

Filesize
1.9MB

MD5
44742ba97d0fe7251643b6fe9da8e4e3

SHA1
81d167faf10d1f2eda9c27038a36d2fada588181

SHA256
022deb55da90f9a593cf89b4170afebf1ae7d69fa83e65809965f9d5e6e11d85

SHA512
2f777159d35cf2add16709873673b41ec462b0ea173adad71885ff0a65e2fcd89905ce40a82fe822190cf0b228bcc48369281c66b2cd23ec8491a5833b67ad5e

Download Submit
C:\Windows\System\ghsAIKD.exe

Filesize
1.9MB

MD5
34341d9c70a622f0759a4a01a46513b7

SHA1
3118757985ee687ebb9f01095564c71d5f1b1f07

SHA256
fc3dc5ceba7064b40af7930e1481a143508e28fcb208b0362fb773da4664eb62

SHA512
1a7cfc97ea98726e8f62bd1c906fa90be486dd2c49fab7a222ef134bef8ee08b181675b0b4bcafefd9d8181d6fbabfc1052fed38edbb9d1c9ffa6afec621e5bb

Download Submit
C:\Windows\System\kaDSvcC.exe

Filesize
1.9MB

MD5
9482b9ef5a3f2f519914a52bd248c29a

SHA1
e6af69e6f3d557e5b6f1cdada3f32c337ff16cec

SHA256
ebe5d5fafb359ab1d33585e13e33b3f4941c60b60f090ece9b011babf297fb13

SHA512
46910c0635167d349ce90a40257a55c4ac0f248fcb16cbda7140aa8c582ec59d1eb1905d7672e6ee6dd1e8ae069259dc39cf9550f9bcf01d7cc0f2b78d5ed630

Download Submit
C:\Windows\System\kjimaTh.exe

Filesize
1.9MB

MD5
238de183e62ebd26d1477bbeb6738718

SHA1
0ba95b41d9309be3c9c8250290e28106266864c8

SHA256
f8dff995a17bf05399ca855f482e53dc5b1af9139ce46a709c85ff563ff9e85a

SHA512
1ae723df773bab4222bd0c34bd3887736d6121ded7cf9b7e33d5bb90039c093c2ebcc789637cf80b58cecc8fc386e55403fe1bd06608939f2b693595841f3b3c

Download Submit
C:\Windows\System\lknHPbD.exe

Filesize
1.9MB

MD5
8c062c99067bc938d1e1384aca85ee00

SHA1
2ef11a9eda4e8923a614bf84f6d527866a7cf161

SHA256
5fb13f4cae9182b70575181ee46287831750911b8af3b3a7053e7826494e80d7

SHA512
d5cc26ffc807b35bc3c20ed7c2e6708acc96542daa53eb990afe9bf39a33cf00a8a0b90e3cbb74c321c424ab87541f1740cd5d7b9f9364bdb10ea6eff379fc2f

Download Submit
C:\Windows\System\omeNlHJ.exe

Filesize
1.9MB

MD5
ebcde0cfbdd26af0c783321eeb2d8ab5

SHA1
c9bf996df4e5497bc2919ebaf685ca791fb57d3e

SHA256
119ebbee99bb3876f3492d51034fd0a124380f98dcbb71639d1d765ba29b411f

SHA512
62e9deafd3a0cdb5e3254eeceeaa006b5b5589399ccc942f090d4a52792d935414d079dc36fde5d75d63ec45b013db1ae27d9ba040004c9fdc68a97b741ec76d

Download Submit
C:\Windows\System\oporfWP.exe

Filesize
1.9MB

MD5
1f12310d197f6c457c2dd33c575121b1

SHA1
97f805eb8c26c7c2c42c2967356165c2393f8518

SHA256
752fd7977d4c03e45bc6e505bffd2a555fc84dd0c39a016a3820f24265dba89b

SHA512
29ac8ada4eb3a3ab299e154c951f9be56e368fac6981110e04ac711dcb7b95e746ad7d64d4c30bee91e6b1bd7b6afbcab211c6ba1626c861397305848716daae

Download Submit
C:\Windows\System\qXcQqxA.exe

Filesize
1.9MB

MD5
08e7cfb29555fd629e867a1287866785

SHA1
ba16035775ffffc57082112e16c20abae7fa8beb

SHA256
d350f08bb467c87cb9366c875219717764223cfb1207bad05a01eb52b322c41a

SHA512
b485949ae5ac9a7cb2ad5c07b8617fabb12fd1814bc464d400b4ec3cf2552ad22386c8dc28aef2127e30a192573ebda78bac0ee28c1733c1ffe4e90cf7975401

Download Submit
C:\Windows\System\uKcDCwC.exe

Filesize
1.9MB

MD5
964a85fc38552be32d196acdf4d06869

SHA1
fec1a7f44f822dc4a93410c75cff3b0acd9a2feb

SHA256
56d5a072a26e8530586efadbad17f985481c5937e2cb7fc649b7d428e5988661

SHA512
337ee224f1b0395d663c53858f5233a64f7efb455fd470f4b98250bf4b590ecb9026a525005d863061fcac3d5885edc023eb8f475a6f49a97271b12ee582b293

Download Submit
C:\Windows\System\ufVfIxE.exe

Filesize
1.9MB

MD5
34174b6ad107a2e35822be8c6a89c4dd

SHA1
4eefb5b627e94171602649801737e156823c57a8

SHA256
b3285a6bb540e7546dbe67081a295f8eaec7e10f46ea750347fa3ee1eba63a01

SHA512
1a98fd2304f9c346a483b6669108089c863f24d24c19558c1f05eac6c6133a7dba512133ecdadc3f24aac8934c24b07e8b00a40a8872a975339726be71b8a82f

Download Submit
C:\Windows\System\yiaJfLn.exe

Filesize
1.9MB

MD5
606f118b891c36db0d19f39a98cd0e60

SHA1
b0261a228ab32b68ce74889e55794c472f55e914

SHA256
8c0b3ac1cf66f371c1b061b04eb1c71d8b87b36e09bd4d8ff540b501156d22b4

SHA512
8d9f299e3d12c2a9f80da615cf6af1bf16fae5f76ef530256ba725ea27523dc5336f8eb2e08f9d500ef4818120c9a799e1af548e98319fc2f40687b4220b5d20

Download Submit
memory/220-6220-0x00007FF746260000-0x00007FF746652000-memory.dmp

Filesize
3.9MB

Download
memory/220-66-0x00007FF746260000-0x00007FF746652000-memory.dmp

Filesize
3.9MB

Download
memory/228-6271-0x00007FF7F9410000-0x00007FF7F9802000-memory.dmp

Filesize
3.9MB

Download
memory/228-3385-0x00007FF7F9410000-0x00007FF7F9802000-memory.dmp

Filesize
3.9MB

Download
memory/228-83-0x00007FF7F9410000-0x00007FF7F9802000-memory.dmp

Filesize
3.9MB

Download
memory/716-53-0x00007FF6F7B10000-0x00007FF6F7F02000-memory.dmp

Filesize
3.9MB

Download
memory/992-133-0x00007FF793000000-0x00007FF7933F2000-memory.dmp

Filesize
3.9MB

Download
memory/992-6295-0x00007FF793000000-0x00007FF7933F2000-memory.dmp

Filesize
3.9MB

Download
memory/1008-78-0x00007FF63F5D0000-0x00007FF63F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/1340-19-0x000001E4FC1F0000-0x000001E4FC200000-memory.dmp

Filesize
64KB

Download
memory/1340-31-0x000001E4FC070000-0x000001E4FC092000-memory.dmp

Filesize
136KB

Download
memory/1340-5574-0x00007FFB32EF0000-0x00007FFB339B1000-memory.dmp

Filesize
10.8MB

Download
memory/1340-3367-0x000001E4FC1F0000-0x000001E4FC200000-memory.dmp

Filesize
64KB

Download
memory/1340-17-0x00007FFB32EF0000-0x00007FFB339B1000-memory.dmp

Filesize
10.8MB

Download
memory/1340-20-0x000001E4FC1F0000-0x000001E4FC200000-memory.dmp

Filesize
64KB

Download
memory/1340-330-0x000001E4FD0D0000-0x000001E4FD876000-memory.dmp

Filesize
7.6MB

Download
memory/1388-94-0x00007FF731BA0000-0x00007FF731F92000-memory.dmp

Filesize
3.9MB

Download
memory/1388-3387-0x00007FF731BA0000-0x00007FF731F92000-memory.dmp

Filesize
3.9MB

Download
memory/1492-79-0x00007FF7D0120000-0x00007FF7D0512000-memory.dmp

Filesize
3.9MB

Download
memory/1792-6301-0x00007FF730610000-0x00007FF730A02000-memory.dmp

Filesize
3.9MB

Download
memory/1792-387-0x00007FF730610000-0x00007FF730A02000-memory.dmp

Filesize
3.9MB

Download
memory/2228-6298-0x00007FF7232D0000-0x00007FF7236C2000-memory.dmp

Filesize
3.9MB

Download
memory/2228-134-0x00007FF7232D0000-0x00007FF7236C2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-69-0x00007FF7A3C00000-0x00007FF7A3FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-6274-0x00007FF645D00000-0x00007FF6460F2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-92-0x00007FF645D00000-0x00007FF6460F2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-2558-0x00007FF645D00000-0x00007FF6460F2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-6257-0x00007FF655360000-0x00007FF655752000-memory.dmp

Filesize
3.9MB

Download
memory/2944-110-0x00007FF655360000-0x00007FF655752000-memory.dmp

Filesize
3.9MB

Download
memory/2960-117-0x00007FF675740000-0x00007FF675B32000-memory.dmp

Filesize
3.9MB

Download
memory/2960-3807-0x00007FF675740000-0x00007FF675B32000-memory.dmp

Filesize
3.9MB

Download
memory/2960-6572-0x00007FF675740000-0x00007FF675B32000-memory.dmp

Filesize
3.9MB

Download
memory/3144-0-0x00007FF7282B0000-0x00007FF7286A2000-memory.dmp

Filesize
3.9MB

Download
memory/3144-1-0x0000029AF6E70000-0x0000029AF6E80000-memory.dmp

Filesize
64KB

Download
memory/3568-105-0x00007FF75A930000-0x00007FF75AD22000-memory.dmp

Filesize
3.9MB

Download
memory/3692-50-0x00007FF751CD0000-0x00007FF7520C2000-memory.dmp

Filesize
3.9MB

Download
memory/4216-6289-0x00007FF6C0F20000-0x00007FF6C1312000-memory.dmp

Filesize
3.9MB

Download
memory/4216-127-0x00007FF6C0F20000-0x00007FF6C1312000-memory.dmp

Filesize
3.9MB

Download
memory/4308-6250-0x00007FF7DD3A0000-0x00007FF7DD792000-memory.dmp

Filesize
3.9MB

Download
memory/4308-106-0x00007FF7DD3A0000-0x00007FF7DD792000-memory.dmp

Filesize
3.9MB

Download
memory/4328-100-0x00007FF65BAE0000-0x00007FF65BED2000-memory.dmp

Filesize
3.9MB

Download
memory/4868-123-0x00007FF626B10000-0x00007FF626F02000-memory.dmp

Filesize
3.9MB

Download
memory/4868-6286-0x00007FF626B10000-0x00007FF626F02000-memory.dmp

Filesize
3.9MB

Download
memory/4872-6279-0x00007FF686820000-0x00007FF686C12000-memory.dmp

Filesize
3.9MB

Download
memory/4872-111-0x00007FF686820000-0x00007FF686C12000-memory.dmp

Filesize
3.9MB

Download
memory/4940-130-0x00007FF727AD0000-0x00007FF727EC2000-memory.dmp

Filesize
3.9MB

Download
memory/4940-6292-0x00007FF727AD0000-0x00007FF727EC2000-memory.dmp

Filesize
3.9MB

Download