xmrig | bd3b4cb8c783aa5f3a5b67f0543d36102b996b32a0d3629612dd38b49d2750a8

Analysis

max time kernel
140s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
Size

2.1MB
MD5

05903408b04dc2ca2241fb2b5effba99
SHA1

ff2b349a3258561acea2581fdbc997a1a1120a50
SHA256

bd3b4cb8c783aa5f3a5b67f0543d36102b996b32a0d3629612dd38b49d2750a8
SHA512

ef1d7033ce8d4fdb5039aa81d6f86e08a8e9d9ad94483e8e24bc9570c5bb89ec2f5b08728f9f3d9b5885f31ea774875f71df11277c9415f183ca1b1b356e72ef
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrP:NABQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/memory/3512-49-0x00007FF720C50000-0x00007FF721042000-memory.dmp	xmrig
behavioral2/memory/5004-494-0x00007FF6C5100000-0x00007FF6C54F2000-memory.dmp	xmrig
behavioral2/memory/4840-495-0x00007FF7596C0000-0x00007FF759AB2000-memory.dmp	xmrig
behavioral2/memory/8-496-0x00007FF6D3320000-0x00007FF6D3712000-memory.dmp	xmrig
behavioral2/memory/1700-505-0x00007FF670D00000-0x00007FF6710F2000-memory.dmp	xmrig
behavioral2/memory/2632-515-0x00007FF765240000-0x00007FF765632000-memory.dmp	xmrig
behavioral2/memory/4936-518-0x00007FF61C940000-0x00007FF61CD32000-memory.dmp	xmrig
behavioral2/memory/1476-558-0x00007FF7793E0000-0x00007FF7797D2000-memory.dmp	xmrig
behavioral2/memory/2372-570-0x00007FF60C6B0000-0x00007FF60CAA2000-memory.dmp	xmrig
behavioral2/memory/4904-580-0x00007FF6A9DA0000-0x00007FF6AA192000-memory.dmp	xmrig
behavioral2/memory/4036-576-0x00007FF7DB370000-0x00007FF7DB762000-memory.dmp	xmrig
behavioral2/memory/2864-559-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp	xmrig
behavioral2/memory/3876-554-0x00007FF71CD60000-0x00007FF71D152000-memory.dmp	xmrig
behavioral2/memory/632-549-0x00007FF6DC210000-0x00007FF6DC602000-memory.dmp	xmrig
behavioral2/memory/444-543-0x00007FF76C8E0000-0x00007FF76CCD2000-memory.dmp	xmrig
behavioral2/memory/2292-532-0x00007FF613BE0000-0x00007FF613FD2000-memory.dmp	xmrig
behavioral2/memory/5084-526-0x00007FF6000E0000-0x00007FF6004D2000-memory.dmp	xmrig
behavioral2/memory/60-511-0x00007FF660F40000-0x00007FF661332000-memory.dmp	xmrig
behavioral2/memory/3024-499-0x00007FF622D30000-0x00007FF623122000-memory.dmp	xmrig
behavioral2/memory/4916-36-0x00007FF6F2950000-0x00007FF6F2D42000-memory.dmp	xmrig
behavioral2/memory/1180-28-0x00007FF76CC40000-0x00007FF76D032000-memory.dmp	xmrig
behavioral2/memory/2864-4587-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp	xmrig
behavioral2/memory/1180-4600-0x00007FF76CC40000-0x00007FF76D032000-memory.dmp	xmrig
behavioral2/memory/2372-4622-0x00007FF60C6B0000-0x00007FF60CAA2000-memory.dmp	xmrig
behavioral2/memory/4904-4628-0x00007FF6A9DA0000-0x00007FF6AA192000-memory.dmp	xmrig
behavioral2/memory/4036-4625-0x00007FF7DB370000-0x00007FF7DB762000-memory.dmp	xmrig
behavioral2/memory/5004-4612-0x00007FF6C5100000-0x00007FF6C54F2000-memory.dmp	xmrig
behavioral2/memory/8-4635-0x00007FF6D3320000-0x00007FF6D3712000-memory.dmp	xmrig
behavioral2/memory/3024-4640-0x00007FF622D30000-0x00007FF623122000-memory.dmp	xmrig
behavioral2/memory/2632-4664-0x00007FF765240000-0x00007FF765632000-memory.dmp	xmrig
behavioral2/memory/5084-4685-0x00007FF6000E0000-0x00007FF6004D2000-memory.dmp	xmrig
behavioral2/memory/1476-4740-0x00007FF7793E0000-0x00007FF7797D2000-memory.dmp	xmrig
behavioral2/memory/3876-4710-0x00007FF71CD60000-0x00007FF71D152000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2864	SNaSnFX.exe
1180	xySWZOt.exe
4916	HbGoayG.exe
3512	PBnFfvF.exe
5004	nhXvpuE.exe
2372	TJEmRzq.exe
4036	wIyPPft.exe
4904	zwItQmw.exe
4840	SMjdjGo.exe
8	xgVocxB.exe
3024	gUTpcps.exe
1700	wjPbVmq.exe
60	eCnHofb.exe
2632	FCeUziI.exe
4936	NKIxPzC.exe
5084	dZrjwmm.exe
2292	QmVsjuH.exe
444	bLrNXlU.exe
632	aumPCAq.exe
3876	kxNwkri.exe
1476	dgdMXNN.exe
1060	jApPGqJ.exe
3188	VlVZixX.exe
3912	FnamDel.exe
2316	QpUkmrZ.exe
3840	uSTaxeF.exe
4116	wdDuSIr.exe
3456	AfEEnwj.exe
1132	gnYODlY.exe
364	FtwAeiT.exe
2580	DqaUWdl.exe
4092	wTlWlfu.exe
1912	GDHPLoB.exe
3884	BarIyCH.exe
2368	kBfNuvG.exe
3516	DvsrrPd.exe
4736	kvViQyu.exe
3088	yaEIEuW.exe
5096	eDtsSGv.exe
1080	raSdSye.exe
4172	AvJTKLV.exe
2268	svNrAjf.exe
4232	hjzRbaY.exe
2508	kGBrzTN.exe
3284	NDpHUOM.exe
2596	vAcnGch.exe
4024	jVjYjjJ.exe
940	zuAKKTZ.exe
2880	TbaOxUh.exe
2680	MvkLcFG.exe
5072	NNDNvLc.exe
3888	UTexXnT.exe
2768	NMIuMCM.exe
3936	YPRTydZ.exe
1808	QHnDFRT.exe
1508	ylHOADY.exe
1028	KSXZSif.exe
2080	KMdksPs.exe
1608	nfvEWhI.exe
2944	vnaLOMr.exe
4768	wcaWrty.exe
2056	tmAopPC.exe
3276	QkwIUVE.exe
1568	Rbwpwmy.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1016-0-0x00007FF780840000-0x00007FF780C32000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-11.dat	upx
behavioral2/files/0x000c000000023b4c-13.dat	upx
behavioral2/files/0x000a000000023ba9-19.dat	upx
behavioral2/files/0x000a000000023bab-31.dat	upx
behavioral2/files/0x000a000000023baa-30.dat	upx
behavioral2/memory/3512-49-0x00007FF720C50000-0x00007FF721042000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-52.dat	upx
behavioral2/files/0x000b000000023baf-68.dat	upx
behavioral2/files/0x000a000000023bb3-83.dat	upx
behavioral2/files/0x000a000000023bb6-98.dat	upx
behavioral2/files/0x000a000000023bb9-113.dat	upx
behavioral2/files/0x0031000000023bbd-133.dat	upx
behavioral2/files/0x0031000000023bbf-143.dat	upx
behavioral2/files/0x000a000000023bc0-156.dat	upx
behavioral2/files/0x000a000000023bc4-168.dat	upx
behavioral2/memory/5004-494-0x00007FF6C5100000-0x00007FF6C54F2000-memory.dmp	upx
behavioral2/memory/4840-495-0x00007FF7596C0000-0x00007FF759AB2000-memory.dmp	upx
behavioral2/memory/8-496-0x00007FF6D3320000-0x00007FF6D3712000-memory.dmp	upx
behavioral2/memory/1700-505-0x00007FF670D00000-0x00007FF6710F2000-memory.dmp	upx
behavioral2/memory/2632-515-0x00007FF765240000-0x00007FF765632000-memory.dmp	upx
behavioral2/memory/4936-518-0x00007FF61C940000-0x00007FF61CD32000-memory.dmp	upx
behavioral2/memory/1476-558-0x00007FF7793E0000-0x00007FF7797D2000-memory.dmp	upx
behavioral2/memory/2372-570-0x00007FF60C6B0000-0x00007FF60CAA2000-memory.dmp	upx
behavioral2/memory/4904-580-0x00007FF6A9DA0000-0x00007FF6AA192000-memory.dmp	upx
behavioral2/memory/4036-576-0x00007FF7DB370000-0x00007FF7DB762000-memory.dmp	upx
behavioral2/memory/2864-559-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp	upx
behavioral2/memory/3876-554-0x00007FF71CD60000-0x00007FF71D152000-memory.dmp	upx
behavioral2/memory/632-549-0x00007FF6DC210000-0x00007FF6DC602000-memory.dmp	upx
behavioral2/memory/444-543-0x00007FF76C8E0000-0x00007FF76CCD2000-memory.dmp	upx
behavioral2/memory/2292-532-0x00007FF613BE0000-0x00007FF613FD2000-memory.dmp	upx
behavioral2/memory/5084-526-0x00007FF6000E0000-0x00007FF6004D2000-memory.dmp	upx
behavioral2/memory/60-511-0x00007FF660F40000-0x00007FF661332000-memory.dmp	upx
behavioral2/memory/3024-499-0x00007FF622D30000-0x00007FF623122000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-178.dat	upx
behavioral2/files/0x000a000000023bc5-173.dat	upx
behavioral2/files/0x000a000000023bc3-171.dat	upx
behavioral2/files/0x000a000000023bc2-166.dat	upx
behavioral2/files/0x000a000000023bc1-161.dat	upx
behavioral2/files/0x0031000000023bbe-146.dat	upx
behavioral2/files/0x000a000000023bbc-136.dat	upx
behavioral2/files/0x000a000000023bbb-131.dat	upx
behavioral2/files/0x000a000000023bba-126.dat	upx
behavioral2/files/0x000a000000023bb8-116.dat	upx
behavioral2/files/0x000a000000023bb7-111.dat	upx
behavioral2/files/0x000a000000023bb5-101.dat	upx
behavioral2/files/0x000a000000023bb4-96.dat	upx
behavioral2/files/0x000a000000023bb2-86.dat	upx
behavioral2/files/0x000a000000023bb1-81.dat	upx
behavioral2/files/0x000b000000023bae-76.dat	upx
behavioral2/files/0x000a000000023bb0-64.dat	upx
behavioral2/files/0x000a000000023bac-54.dat	upx
behavioral2/memory/4916-36-0x00007FF6F2950000-0x00007FF6F2D42000-memory.dmp	upx
behavioral2/memory/1180-28-0x00007FF76CC40000-0x00007FF76D032000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-22.dat	upx
behavioral2/memory/2864-4587-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp	upx
behavioral2/memory/1180-4600-0x00007FF76CC40000-0x00007FF76D032000-memory.dmp	upx
behavioral2/memory/2372-4622-0x00007FF60C6B0000-0x00007FF60CAA2000-memory.dmp	upx
behavioral2/memory/4904-4628-0x00007FF6A9DA0000-0x00007FF6AA192000-memory.dmp	upx
behavioral2/memory/4036-4625-0x00007FF7DB370000-0x00007FF7DB762000-memory.dmp	upx
behavioral2/memory/5004-4612-0x00007FF6C5100000-0x00007FF6C54F2000-memory.dmp	upx
behavioral2/memory/8-4635-0x00007FF6D3320000-0x00007FF6D3712000-memory.dmp	upx
behavioral2/memory/3024-4640-0x00007FF622D30000-0x00007FF623122000-memory.dmp	upx
behavioral2/memory/2632-4664-0x00007FF765240000-0x00007FF765632000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fkfVudN.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\mJtagey.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\UbiPpTW.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\zvaMANs.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\uqvSlky.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\iAHrofJ.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\lDdDEQJ.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\bdgaRpJ.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\eIHpuxn.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\LGRwkyK.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\AqquZhv.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\qaTQGEF.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\rTcIYqk.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\gTonCEI.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\TpWiTop.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\PtTzGNU.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\MpusxOq.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\nKyIXQx.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\WgpOcey.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\KhdsrYa.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\NEqxGwW.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\oWHzMfO.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\fKiNSZh.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\mukjQdy.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\TAttIOF.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\jOxyHzX.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\ltoLBbF.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\vtKpPUC.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\aucYyPW.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\riLTcbE.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\lQCCzYf.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\RuAfQBr.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\vcSWeVd.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\jmKdEze.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\gyNnSFL.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\qqjqsVL.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\QnQfNCT.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\SUrDPRR.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\ZUSrCLE.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\elFjhHE.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\SsNgaOg.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\qERmRzl.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\iEjCsaG.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\BQlBwMx.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\WgSsRym.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\olcyZgf.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\SCKuugI.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\nVdnpBN.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\GJGEWqu.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\ZlUngUn.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\KaRWEoY.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\NDewjcL.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\DtDhxUY.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\PObZzjB.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\cgdJgQq.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\CWRWWrq.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\yyEOwKV.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\VpyYEiq.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\paYehJd.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\TIqKLiA.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\cswdURI.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\odytuSE.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\tntjuhj.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
File created	C:\Windows\System\FGlENnK.exe	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
688	powershell.exe
688	powershell.exe
688	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
Token: SeDebugPrivilege	688	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 688	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	85
PID 1016 wrote to memory of 688	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	85
PID 1016 wrote to memory of 2864	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	86
PID 1016 wrote to memory of 2864	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	86
PID 1016 wrote to memory of 1180	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	87
PID 1016 wrote to memory of 1180	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	87
PID 1016 wrote to memory of 4916	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	88
PID 1016 wrote to memory of 4916	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	88
PID 1016 wrote to memory of 3512	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	89
PID 1016 wrote to memory of 3512	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	89
PID 1016 wrote to memory of 5004	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	90
PID 1016 wrote to memory of 5004	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	90
PID 1016 wrote to memory of 2372	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	91
PID 1016 wrote to memory of 2372	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	91
PID 1016 wrote to memory of 4036	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	92
PID 1016 wrote to memory of 4036	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	92
PID 1016 wrote to memory of 4904	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	93
PID 1016 wrote to memory of 4904	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	93
PID 1016 wrote to memory of 4840	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	94
PID 1016 wrote to memory of 4840	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	94
PID 1016 wrote to memory of 8	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	95
PID 1016 wrote to memory of 8	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	95
PID 1016 wrote to memory of 3024	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	96
PID 1016 wrote to memory of 3024	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	96
PID 1016 wrote to memory of 1700	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	97
PID 1016 wrote to memory of 1700	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	97
PID 1016 wrote to memory of 60	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	98
PID 1016 wrote to memory of 60	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	98
PID 1016 wrote to memory of 2632	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	99
PID 1016 wrote to memory of 2632	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	99
PID 1016 wrote to memory of 4936	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	100
PID 1016 wrote to memory of 4936	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	100
PID 1016 wrote to memory of 5084	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	101
PID 1016 wrote to memory of 5084	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	101
PID 1016 wrote to memory of 2292	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	102
PID 1016 wrote to memory of 2292	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	102
PID 1016 wrote to memory of 444	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	103
PID 1016 wrote to memory of 444	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	103
PID 1016 wrote to memory of 632	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	104
PID 1016 wrote to memory of 632	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	104
PID 1016 wrote to memory of 3876	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	105
PID 1016 wrote to memory of 3876	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	105
PID 1016 wrote to memory of 1476	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	106
PID 1016 wrote to memory of 1476	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	106
PID 1016 wrote to memory of 1060	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	107
PID 1016 wrote to memory of 1060	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	107
PID 1016 wrote to memory of 3188	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	108
PID 1016 wrote to memory of 3188	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	108
PID 1016 wrote to memory of 3912	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	109
PID 1016 wrote to memory of 3912	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	109
PID 1016 wrote to memory of 2316	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	110
PID 1016 wrote to memory of 2316	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	110
PID 1016 wrote to memory of 3840	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	111
PID 1016 wrote to memory of 3840	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	111
PID 1016 wrote to memory of 4116	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	112
PID 1016 wrote to memory of 4116	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	112
PID 1016 wrote to memory of 3456	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	113
PID 1016 wrote to memory of 3456	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	113
PID 1016 wrote to memory of 1132	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	114
PID 1016 wrote to memory of 1132	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	114
PID 1016 wrote to memory of 364	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	115
PID 1016 wrote to memory of 364	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	115
PID 1016 wrote to memory of 2580	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	116
PID 1016 wrote to memory of 2580	1016	05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05903408b04dc2ca2241fb2b5effba99_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\System\SNaSnFX.exe
  C:\Windows\System\SNaSnFX.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\xySWZOt.exe
  C:\Windows\System\xySWZOt.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\HbGoayG.exe
  C:\Windows\System\HbGoayG.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\PBnFfvF.exe
  C:\Windows\System\PBnFfvF.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\nhXvpuE.exe
  C:\Windows\System\nhXvpuE.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\TJEmRzq.exe
  C:\Windows\System\TJEmRzq.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\wIyPPft.exe
  C:\Windows\System\wIyPPft.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\zwItQmw.exe
  C:\Windows\System\zwItQmw.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\SMjdjGo.exe
  C:\Windows\System\SMjdjGo.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\xgVocxB.exe
  C:\Windows\System\xgVocxB.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\gUTpcps.exe
  C:\Windows\System\gUTpcps.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\wjPbVmq.exe
  C:\Windows\System\wjPbVmq.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\eCnHofb.exe
  C:\Windows\System\eCnHofb.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\FCeUziI.exe
  C:\Windows\System\FCeUziI.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\NKIxPzC.exe
  C:\Windows\System\NKIxPzC.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\dZrjwmm.exe
  C:\Windows\System\dZrjwmm.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\QmVsjuH.exe
  C:\Windows\System\QmVsjuH.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\bLrNXlU.exe
  C:\Windows\System\bLrNXlU.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\aumPCAq.exe
  C:\Windows\System\aumPCAq.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\kxNwkri.exe
  C:\Windows\System\kxNwkri.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\dgdMXNN.exe
  C:\Windows\System\dgdMXNN.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\jApPGqJ.exe
  C:\Windows\System\jApPGqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\VlVZixX.exe
  C:\Windows\System\VlVZixX.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\FnamDel.exe
  C:\Windows\System\FnamDel.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\QpUkmrZ.exe
  C:\Windows\System\QpUkmrZ.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\uSTaxeF.exe
  C:\Windows\System\uSTaxeF.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\wdDuSIr.exe
  C:\Windows\System\wdDuSIr.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\AfEEnwj.exe
  C:\Windows\System\AfEEnwj.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\gnYODlY.exe
  C:\Windows\System\gnYODlY.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\FtwAeiT.exe
  C:\Windows\System\FtwAeiT.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\DqaUWdl.exe
  C:\Windows\System\DqaUWdl.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\wTlWlfu.exe
  C:\Windows\System\wTlWlfu.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\GDHPLoB.exe
  C:\Windows\System\GDHPLoB.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\BarIyCH.exe
  C:\Windows\System\BarIyCH.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\kBfNuvG.exe
  C:\Windows\System\kBfNuvG.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\DvsrrPd.exe
  C:\Windows\System\DvsrrPd.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\kvViQyu.exe
  C:\Windows\System\kvViQyu.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\yaEIEuW.exe
  C:\Windows\System\yaEIEuW.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\eDtsSGv.exe
  C:\Windows\System\eDtsSGv.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\raSdSye.exe
  C:\Windows\System\raSdSye.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\AvJTKLV.exe
  C:\Windows\System\AvJTKLV.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\svNrAjf.exe
  C:\Windows\System\svNrAjf.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\hjzRbaY.exe
  C:\Windows\System\hjzRbaY.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\kGBrzTN.exe
  C:\Windows\System\kGBrzTN.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\NDpHUOM.exe
  C:\Windows\System\NDpHUOM.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\vAcnGch.exe
  C:\Windows\System\vAcnGch.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\jVjYjjJ.exe
  C:\Windows\System\jVjYjjJ.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\zuAKKTZ.exe
  C:\Windows\System\zuAKKTZ.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\TbaOxUh.exe
  C:\Windows\System\TbaOxUh.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\MvkLcFG.exe
  C:\Windows\System\MvkLcFG.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\NNDNvLc.exe
  C:\Windows\System\NNDNvLc.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\UTexXnT.exe
  C:\Windows\System\UTexXnT.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\NMIuMCM.exe
  C:\Windows\System\NMIuMCM.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\YPRTydZ.exe
  C:\Windows\System\YPRTydZ.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\QHnDFRT.exe
  C:\Windows\System\QHnDFRT.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\ylHOADY.exe
  C:\Windows\System\ylHOADY.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\KSXZSif.exe
  C:\Windows\System\KSXZSif.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\KMdksPs.exe
  C:\Windows\System\KMdksPs.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\nfvEWhI.exe
  C:\Windows\System\nfvEWhI.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\vnaLOMr.exe
  C:\Windows\System\vnaLOMr.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\wcaWrty.exe
  C:\Windows\System\wcaWrty.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\tmAopPC.exe
  C:\Windows\System\tmAopPC.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\QkwIUVE.exe
  C:\Windows\System\QkwIUVE.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\Rbwpwmy.exe
  C:\Windows\System\Rbwpwmy.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\eHgTDfc.exe
  C:\Windows\System\eHgTDfc.exe
  2⤵
  PID:3084
- C:\Windows\System\kCpXAdD.exe
  C:\Windows\System\kCpXAdD.exe
  2⤵
  PID:4744
- C:\Windows\System\gkMWWbM.exe
  C:\Windows\System\gkMWWbM.exe
  2⤵
  PID:4664
- C:\Windows\System\SkkVEoK.exe
  C:\Windows\System\SkkVEoK.exe
  2⤵
  PID:2884
- C:\Windows\System\BEDwzUs.exe
  C:\Windows\System\BEDwzUs.exe
  2⤵
  PID:1704
- C:\Windows\System\vwQOfSH.exe
  C:\Windows\System\vwQOfSH.exe
  2⤵
  PID:3536
- C:\Windows\System\SPoGXuE.exe
  C:\Windows\System\SPoGXuE.exe
  2⤵
  PID:1820
- C:\Windows\System\cvGgGnI.exe
  C:\Windows\System\cvGgGnI.exe
  2⤵
  PID:1580
- C:\Windows\System\LTJQWGJ.exe
  C:\Windows\System\LTJQWGJ.exe
  2⤵
  PID:5128
- C:\Windows\System\Uowhwwr.exe
  C:\Windows\System\Uowhwwr.exe
  2⤵
  PID:5156
- C:\Windows\System\pLqsqSc.exe
  C:\Windows\System\pLqsqSc.exe
  2⤵
  PID:5184
- C:\Windows\System\dqRNTJz.exe
  C:\Windows\System\dqRNTJz.exe
  2⤵
  PID:5212
- C:\Windows\System\oZrIYYH.exe
  C:\Windows\System\oZrIYYH.exe
  2⤵
  PID:5240
- C:\Windows\System\tCgdiPI.exe
  C:\Windows\System\tCgdiPI.exe
  2⤵
  PID:5268
- C:\Windows\System\isUoZjX.exe
  C:\Windows\System\isUoZjX.exe
  2⤵
  PID:5296
- C:\Windows\System\hQbgORO.exe
  C:\Windows\System\hQbgORO.exe
  2⤵
  PID:5324
- C:\Windows\System\QjRdoFO.exe
  C:\Windows\System\QjRdoFO.exe
  2⤵
  PID:5352
- C:\Windows\System\TlsUfAQ.exe
  C:\Windows\System\TlsUfAQ.exe
  2⤵
  PID:5380
- C:\Windows\System\iPECVQV.exe
  C:\Windows\System\iPECVQV.exe
  2⤵
  PID:5408
- C:\Windows\System\lRNeHTj.exe
  C:\Windows\System\lRNeHTj.exe
  2⤵
  PID:5436
- C:\Windows\System\frCbpvu.exe
  C:\Windows\System\frCbpvu.exe
  2⤵
  PID:5464
- C:\Windows\System\fTXLYDY.exe
  C:\Windows\System\fTXLYDY.exe
  2⤵
  PID:5492
- C:\Windows\System\EMlRQjl.exe
  C:\Windows\System\EMlRQjl.exe
  2⤵
  PID:5520
- C:\Windows\System\zkWracE.exe
  C:\Windows\System\zkWracE.exe
  2⤵
  PID:5548
- C:\Windows\System\iRVACmV.exe
  C:\Windows\System\iRVACmV.exe
  2⤵
  PID:5576
- C:\Windows\System\uderLya.exe
  C:\Windows\System\uderLya.exe
  2⤵
  PID:5604
- C:\Windows\System\THxcnbG.exe
  C:\Windows\System\THxcnbG.exe
  2⤵
  PID:5632
- C:\Windows\System\jDBGaiA.exe
  C:\Windows\System\jDBGaiA.exe
  2⤵
  PID:5660
- C:\Windows\System\GpKuoyD.exe
  C:\Windows\System\GpKuoyD.exe
  2⤵
  PID:5692
- C:\Windows\System\ipcxjhC.exe
  C:\Windows\System\ipcxjhC.exe
  2⤵
  PID:5716
- C:\Windows\System\cAWTBSI.exe
  C:\Windows\System\cAWTBSI.exe
  2⤵
  PID:5744
- C:\Windows\System\oLvwjmL.exe
  C:\Windows\System\oLvwjmL.exe
  2⤵
  PID:5772
- C:\Windows\System\kdOxWYo.exe
  C:\Windows\System\kdOxWYo.exe
  2⤵
  PID:5800
- C:\Windows\System\EoobxbA.exe
  C:\Windows\System\EoobxbA.exe
  2⤵
  PID:5828
- C:\Windows\System\IVnpijT.exe
  C:\Windows\System\IVnpijT.exe
  2⤵
  PID:5856
- C:\Windows\System\VzaFcxz.exe
  C:\Windows\System\VzaFcxz.exe
  2⤵
  PID:5884
- C:\Windows\System\MJFwYty.exe
  C:\Windows\System\MJFwYty.exe
  2⤵
  PID:5912
- C:\Windows\System\IORaxjB.exe
  C:\Windows\System\IORaxjB.exe
  2⤵
  PID:5940
- C:\Windows\System\kBeaTpi.exe
  C:\Windows\System\kBeaTpi.exe
  2⤵
  PID:6004
- C:\Windows\System\EKVGQPx.exe
  C:\Windows\System\EKVGQPx.exe
  2⤵
  PID:6020
- C:\Windows\System\Ndqhebm.exe
  C:\Windows\System\Ndqhebm.exe
  2⤵
  PID:6036
- C:\Windows\System\YnsmuqF.exe
  C:\Windows\System\YnsmuqF.exe
  2⤵
  PID:6064
- C:\Windows\System\IfGkYoo.exe
  C:\Windows\System\IfGkYoo.exe
  2⤵
  PID:6088
- C:\Windows\System\RNCMuSu.exe
  C:\Windows\System\RNCMuSu.exe
  2⤵
  PID:6116
- C:\Windows\System\upiOgqH.exe
  C:\Windows\System\upiOgqH.exe
  2⤵
  PID:2888
- C:\Windows\System\oXijbMc.exe
  C:\Windows\System\oXijbMc.exe
  2⤵
  PID:2380
- C:\Windows\System\WMXMIpz.exe
  C:\Windows\System\WMXMIpz.exe
  2⤵
  PID:3860
- C:\Windows\System\QltUTDN.exe
  C:\Windows\System\QltUTDN.exe
  2⤵
  PID:884
- C:\Windows\System\GpyUcGG.exe
  C:\Windows\System\GpyUcGG.exe
  2⤵
  PID:3480
- C:\Windows\System\AvcpUEx.exe
  C:\Windows\System\AvcpUEx.exe
  2⤵
  PID:5148
- C:\Windows\System\AwPCmud.exe
  C:\Windows\System\AwPCmud.exe
  2⤵
  PID:5224
- C:\Windows\System\fcXEWap.exe
  C:\Windows\System\fcXEWap.exe
  2⤵
  PID:5260
- C:\Windows\System\wwdiUxa.exe
  C:\Windows\System\wwdiUxa.exe
  2⤵
  PID:5336
- C:\Windows\System\bLbwMUe.exe
  C:\Windows\System\bLbwMUe.exe
  2⤵
  PID:5392
- C:\Windows\System\rFVPIuN.exe
  C:\Windows\System\rFVPIuN.exe
  2⤵
  PID:5452
- C:\Windows\System\YQtqTBB.exe
  C:\Windows\System\YQtqTBB.exe
  2⤵
  PID:5504
- C:\Windows\System\URmMYWS.exe
  C:\Windows\System\URmMYWS.exe
  2⤵
  PID:5564
- C:\Windows\System\cSnyRIh.exe
  C:\Windows\System\cSnyRIh.exe
  2⤵
  PID:5624
- C:\Windows\System\XShCNxj.exe
  C:\Windows\System\XShCNxj.exe
  2⤵
  PID:3628
- C:\Windows\System\CjZVHBn.exe
  C:\Windows\System\CjZVHBn.exe
  2⤵
  PID:5736
- C:\Windows\System\eMtcgFD.exe
  C:\Windows\System\eMtcgFD.exe
  2⤵
  PID:5812
- C:\Windows\System\mKQFAHR.exe
  C:\Windows\System\mKQFAHR.exe
  2⤵
  PID:5848
- C:\Windows\System\fnZFVEd.exe
  C:\Windows\System\fnZFVEd.exe
  2⤵
  PID:5924
- C:\Windows\System\WbNYaNg.exe
  C:\Windows\System\WbNYaNg.exe
  2⤵
  PID:5960
- C:\Windows\System\OKMbRBB.exe
  C:\Windows\System\OKMbRBB.exe
  2⤵
  PID:6052
- C:\Windows\System\nbwxHBO.exe
  C:\Windows\System\nbwxHBO.exe
  2⤵
  PID:6112
- C:\Windows\System\kCeOCPk.exe
  C:\Windows\System\kCeOCPk.exe
  2⤵
  PID:3056
- C:\Windows\System\uBbUfkC.exe
  C:\Windows\System\uBbUfkC.exe
  2⤵
  PID:3996
- C:\Windows\System\FiGrZUJ.exe
  C:\Windows\System\FiGrZUJ.exe
  2⤵
  PID:5140
- C:\Windows\System\UuORPVQ.exe
  C:\Windows\System\UuORPVQ.exe
  2⤵
  PID:5256
- C:\Windows\System\JsXgOgn.exe
  C:\Windows\System\JsXgOgn.exe
  2⤵
  PID:5364
- C:\Windows\System\QlDfIrm.exe
  C:\Windows\System\QlDfIrm.exe
  2⤵
  PID:916
- C:\Windows\System\IYcaPDZ.exe
  C:\Windows\System\IYcaPDZ.exe
  2⤵
  PID:1348
- C:\Windows\System\dHfAZZa.exe
  C:\Windows\System\dHfAZZa.exe
  2⤵
  PID:5676
- C:\Windows\System\SHRQhpF.exe
  C:\Windows\System\SHRQhpF.exe
  2⤵
  PID:5784
- C:\Windows\System\HEJNDzZ.exe
  C:\Windows\System\HEJNDzZ.exe
  2⤵
  PID:6028
- C:\Windows\System\MFjGtbY.exe
  C:\Windows\System\MFjGtbY.exe
  2⤵
  PID:4560
- C:\Windows\System\CUAFRAv.exe
  C:\Windows\System\CUAFRAv.exe
  2⤵
  PID:4868
- C:\Windows\System\HBIuVSj.exe
  C:\Windows\System\HBIuVSj.exe
  2⤵
  PID:5200
- C:\Windows\System\gLMeWWz.exe
  C:\Windows\System\gLMeWWz.exe
  2⤵
  PID:5536
- C:\Windows\System\oqOlipE.exe
  C:\Windows\System\oqOlipE.exe
  2⤵
  PID:5652
- C:\Windows\System\WsmEoJd.exe
  C:\Windows\System\WsmEoJd.exe
  2⤵
  PID:968
- C:\Windows\System\sdBFQqF.exe
  C:\Windows\System\sdBFQqF.exe
  2⤵
  PID:1092
- C:\Windows\System\XQDPawP.exe
  C:\Windows\System\XQDPawP.exe
  2⤵
  PID:1328
- C:\Windows\System\LGOzErQ.exe
  C:\Windows\System\LGOzErQ.exe
  2⤵
  PID:1268
- C:\Windows\System\osmylEv.exe
  C:\Windows\System\osmylEv.exe
  2⤵
  PID:3984
- C:\Windows\System\bazkFEX.exe
  C:\Windows\System\bazkFEX.exe
  2⤵
  PID:2156
- C:\Windows\System\QBhtttI.exe
  C:\Windows\System\QBhtttI.exe
  2⤵
  PID:6140
- C:\Windows\System\sSDqhqs.exe
  C:\Windows\System\sSDqhqs.exe
  2⤵
  PID:2096
- C:\Windows\System\pvTJOtN.exe
  C:\Windows\System\pvTJOtN.exe
  2⤵
  PID:6156
- C:\Windows\System\liTzAMX.exe
  C:\Windows\System\liTzAMX.exe
  2⤵
  PID:6172
- C:\Windows\System\aSrEono.exe
  C:\Windows\System\aSrEono.exe
  2⤵
  PID:6220
- C:\Windows\System\bqraOCn.exe
  C:\Windows\System\bqraOCn.exe
  2⤵
  PID:6236
- C:\Windows\System\YgbCTlQ.exe
  C:\Windows\System\YgbCTlQ.exe
  2⤵
  PID:6280
- C:\Windows\System\pgIxubO.exe
  C:\Windows\System\pgIxubO.exe
  2⤵
  PID:6304
- C:\Windows\System\qXQfbjx.exe
  C:\Windows\System\qXQfbjx.exe
  2⤵
  PID:6344
- C:\Windows\System\fGPDPov.exe
  C:\Windows\System\fGPDPov.exe
  2⤵
  PID:6388
- C:\Windows\System\hTRkVLm.exe
  C:\Windows\System\hTRkVLm.exe
  2⤵
  PID:6420
- C:\Windows\System\LIKfKKy.exe
  C:\Windows\System\LIKfKKy.exe
  2⤵
  PID:6480
- C:\Windows\System\yJhyXIl.exe
  C:\Windows\System\yJhyXIl.exe
  2⤵
  PID:6520
- C:\Windows\System\KjorVWk.exe
  C:\Windows\System\KjorVWk.exe
  2⤵
  PID:6536
- C:\Windows\System\PoLjVEb.exe
  C:\Windows\System\PoLjVEb.exe
  2⤵
  PID:6556
- C:\Windows\System\ndQIUUA.exe
  C:\Windows\System\ndQIUUA.exe
  2⤵
  PID:6580
- C:\Windows\System\PrQYzqy.exe
  C:\Windows\System\PrQYzqy.exe
  2⤵
  PID:6604
- C:\Windows\System\vhsaIYy.exe
  C:\Windows\System\vhsaIYy.exe
  2⤵
  PID:6632
- C:\Windows\System\Hirhukt.exe
  C:\Windows\System\Hirhukt.exe
  2⤵
  PID:6656
- C:\Windows\System\KvRciYy.exe
  C:\Windows\System\KvRciYy.exe
  2⤵
  PID:6680
- C:\Windows\System\jqMsfNH.exe
  C:\Windows\System\jqMsfNH.exe
  2⤵
  PID:6740
- C:\Windows\System\mqMbRgz.exe
  C:\Windows\System\mqMbRgz.exe
  2⤵
  PID:6772
- C:\Windows\System\cIUirBs.exe
  C:\Windows\System\cIUirBs.exe
  2⤵
  PID:6796
- C:\Windows\System\VWsYcml.exe
  C:\Windows\System\VWsYcml.exe
  2⤵
  PID:6812
- C:\Windows\System\cIlCVSD.exe
  C:\Windows\System\cIlCVSD.exe
  2⤵
  PID:6832
- C:\Windows\System\slRqCUO.exe
  C:\Windows\System\slRqCUO.exe
  2⤵
  PID:6860
- C:\Windows\System\CIyzeoN.exe
  C:\Windows\System\CIyzeoN.exe
  2⤵
  PID:6876
- C:\Windows\System\yYyIdfE.exe
  C:\Windows\System\yYyIdfE.exe
  2⤵
  PID:6900
- C:\Windows\System\jUeXbYL.exe
  C:\Windows\System\jUeXbYL.exe
  2⤵
  PID:6920
- C:\Windows\System\ajBeByd.exe
  C:\Windows\System\ajBeByd.exe
  2⤵
  PID:6988
- C:\Windows\System\uNXhMDq.exe
  C:\Windows\System\uNXhMDq.exe
  2⤵
  PID:7008
- C:\Windows\System\DyiejIS.exe
  C:\Windows\System\DyiejIS.exe
  2⤵
  PID:7024
- C:\Windows\System\UDSavwk.exe
  C:\Windows\System\UDSavwk.exe
  2⤵
  PID:7048
- C:\Windows\System\GZTqICu.exe
  C:\Windows\System\GZTqICu.exe
  2⤵
  PID:7068
- C:\Windows\System\UBwZeop.exe
  C:\Windows\System\UBwZeop.exe
  2⤵
  PID:7108
- C:\Windows\System\jlvekbZ.exe
  C:\Windows\System\jlvekbZ.exe
  2⤵
  PID:7164
- C:\Windows\System\xMCWqvX.exe
  C:\Windows\System\xMCWqvX.exe
  2⤵
  PID:2980
- C:\Windows\System\egsTKcW.exe
  C:\Windows\System\egsTKcW.exe
  2⤵
  PID:3248
- C:\Windows\System\wPlxtnv.exe
  C:\Windows\System\wPlxtnv.exe
  2⤵
  PID:3468
- C:\Windows\System\DswoCoU.exe
  C:\Windows\System\DswoCoU.exe
  2⤵
  PID:6300
- C:\Windows\System\ybvzrcP.exe
  C:\Windows\System\ybvzrcP.exe
  2⤵
  PID:6272
- C:\Windows\System\LEOuWnF.exe
  C:\Windows\System\LEOuWnF.exe
  2⤵
  PID:6336
- C:\Windows\System\YcnofUn.exe
  C:\Windows\System\YcnofUn.exe
  2⤵
  PID:6260
- C:\Windows\System\qonyLhh.exe
  C:\Windows\System\qonyLhh.exe
  2⤵
  PID:996
- C:\Windows\System\SsgKGpe.exe
  C:\Windows\System\SsgKGpe.exe
  2⤵
  PID:6104
- C:\Windows\System\JFpbdrQ.exe
  C:\Windows\System\JFpbdrQ.exe
  2⤵
  PID:6488
- C:\Windows\System\NhFzCEQ.exe
  C:\Windows\System\NhFzCEQ.exe
  2⤵
  PID:6448
- C:\Windows\System\gLIOEbd.exe
  C:\Windows\System\gLIOEbd.exe
  2⤵
  PID:6548
- C:\Windows\System\DUcorpF.exe
  C:\Windows\System\DUcorpF.exe
  2⤵
  PID:6572
- C:\Windows\System\OfVHXAR.exe
  C:\Windows\System\OfVHXAR.exe
  2⤵
  PID:6616
- C:\Windows\System\trJYTEj.exe
  C:\Windows\System\trJYTEj.exe
  2⤵
  PID:6672
- C:\Windows\System\tnoVpuw.exe
  C:\Windows\System\tnoVpuw.exe
  2⤵
  PID:6756
- C:\Windows\System\eYuJuCm.exe
  C:\Windows\System\eYuJuCm.exe
  2⤵
  PID:6792
- C:\Windows\System\fxuFSUv.exe
  C:\Windows\System\fxuFSUv.exe
  2⤵
  PID:6868
- C:\Windows\System\fwOomhW.exe
  C:\Windows\System\fwOomhW.exe
  2⤵
  PID:6916
- C:\Windows\System\tPvPgKr.exe
  C:\Windows\System\tPvPgKr.exe
  2⤵
  PID:7020
- C:\Windows\System\BmcpCCe.exe
  C:\Windows\System\BmcpCCe.exe
  2⤵
  PID:7004
- C:\Windows\System\pflscRD.exe
  C:\Windows\System\pflscRD.exe
  2⤵
  PID:7132
- C:\Windows\System\sjKixtV.exe
  C:\Windows\System\sjKixtV.exe
  2⤵
  PID:3944
- C:\Windows\System\NCDGpWO.exe
  C:\Windows\System\NCDGpWO.exe
  2⤵
  PID:6168
- C:\Windows\System\BMbXvIW.exe
  C:\Windows\System\BMbXvIW.exe
  2⤵
  PID:6276
- C:\Windows\System\COiYoVc.exe
  C:\Windows\System\COiYoVc.exe
  2⤵
  PID:6180
- C:\Windows\System\lLusgZF.exe
  C:\Windows\System\lLusgZF.exe
  2⤵
  PID:6436
- C:\Windows\System\kyinVmg.exe
  C:\Windows\System\kyinVmg.exe
  2⤵
  PID:6664
- C:\Windows\System\UCQEiTB.exe
  C:\Windows\System\UCQEiTB.exe
  2⤵
  PID:7000
- C:\Windows\System\zqukKCf.exe
  C:\Windows\System\zqukKCf.exe
  2⤵
  PID:7144
- C:\Windows\System\aKFgixd.exe
  C:\Windows\System\aKFgixd.exe
  2⤵
  PID:7056
- C:\Windows\System\ptNfWeF.exe
  C:\Windows\System\ptNfWeF.exe
  2⤵
  PID:6724
- C:\Windows\System\JyzogRE.exe
  C:\Windows\System\JyzogRE.exe
  2⤵
  PID:6980
- C:\Windows\System\yMovsjM.exe
  C:\Windows\System\yMovsjM.exe
  2⤵
  PID:6532
- C:\Windows\System\aMLCZBy.exe
  C:\Windows\System\aMLCZBy.exe
  2⤵
  PID:6216
- C:\Windows\System\bmQKhVY.exe
  C:\Windows\System\bmQKhVY.exe
  2⤵
  PID:7184
- C:\Windows\System\frpgLCe.exe
  C:\Windows\System\frpgLCe.exe
  2⤵
  PID:7220
- C:\Windows\System\WcxoEcV.exe
  C:\Windows\System\WcxoEcV.exe
  2⤵
  PID:7236
- C:\Windows\System\RKydupZ.exe
  C:\Windows\System\RKydupZ.exe
  2⤵
  PID:7264
- C:\Windows\System\FwRXUze.exe
  C:\Windows\System\FwRXUze.exe
  2⤵
  PID:7284
- C:\Windows\System\dJSikOf.exe
  C:\Windows\System\dJSikOf.exe
  2⤵
  PID:7324
- C:\Windows\System\OKaDzOQ.exe
  C:\Windows\System\OKaDzOQ.exe
  2⤵
  PID:7348
- C:\Windows\System\DBryTBp.exe
  C:\Windows\System\DBryTBp.exe
  2⤵
  PID:7368
- C:\Windows\System\WHUNnzO.exe
  C:\Windows\System\WHUNnzO.exe
  2⤵
  PID:7472
- C:\Windows\System\tUvMWPg.exe
  C:\Windows\System\tUvMWPg.exe
  2⤵
  PID:7488
- C:\Windows\System\FssjWhW.exe
  C:\Windows\System\FssjWhW.exe
  2⤵
  PID:7504
- C:\Windows\System\UCZWBcj.exe
  C:\Windows\System\UCZWBcj.exe
  2⤵
  PID:7544
- C:\Windows\System\abjiofK.exe
  C:\Windows\System\abjiofK.exe
  2⤵
  PID:7564
- C:\Windows\System\CVYbjQI.exe
  C:\Windows\System\CVYbjQI.exe
  2⤵
  PID:7588
- C:\Windows\System\AodQPcl.exe
  C:\Windows\System\AodQPcl.exe
  2⤵
  PID:7608
- C:\Windows\System\WnRNRWu.exe
  C:\Windows\System\WnRNRWu.exe
  2⤵
  PID:7632
- C:\Windows\System\amwTOgP.exe
  C:\Windows\System\amwTOgP.exe
  2⤵
  PID:7676
- C:\Windows\System\nzdCLCn.exe
  C:\Windows\System\nzdCLCn.exe
  2⤵
  PID:7712
- C:\Windows\System\kHVyHCC.exe
  C:\Windows\System\kHVyHCC.exe
  2⤵
  PID:7728
- C:\Windows\System\DFxfLjj.exe
  C:\Windows\System\DFxfLjj.exe
  2⤵
  PID:7748
- C:\Windows\System\aIdPGec.exe
  C:\Windows\System\aIdPGec.exe
  2⤵
  PID:7776
- C:\Windows\System\gZLBArB.exe
  C:\Windows\System\gZLBArB.exe
  2⤵
  PID:7812
- C:\Windows\System\ObYcjRy.exe
  C:\Windows\System\ObYcjRy.exe
  2⤵
  PID:7832
- C:\Windows\System\StwIarK.exe
  C:\Windows\System\StwIarK.exe
  2⤵
  PID:7856
- C:\Windows\System\cxgUbSD.exe
  C:\Windows\System\cxgUbSD.exe
  2⤵
  PID:7876
- C:\Windows\System\rWKsMeQ.exe
  C:\Windows\System\rWKsMeQ.exe
  2⤵
  PID:7908
- C:\Windows\System\eUZfXCV.exe
  C:\Windows\System\eUZfXCV.exe
  2⤵
  PID:7936
- C:\Windows\System\jjxcElO.exe
  C:\Windows\System\jjxcElO.exe
  2⤵
  PID:7960
- C:\Windows\System\EYAnAPI.exe
  C:\Windows\System\EYAnAPI.exe
  2⤵
  PID:7980
- C:\Windows\System\xgpysRT.exe
  C:\Windows\System\xgpysRT.exe
  2⤵
  PID:8004
- C:\Windows\System\lEHTNQq.exe
  C:\Windows\System\lEHTNQq.exe
  2⤵
  PID:8048
- C:\Windows\System\HDIEpzx.exe
  C:\Windows\System\HDIEpzx.exe
  2⤵
  PID:8068
- C:\Windows\System\vDZjBDI.exe
  C:\Windows\System\vDZjBDI.exe
  2⤵
  PID:8112
- C:\Windows\System\gDLkWAg.exe
  C:\Windows\System\gDLkWAg.exe
  2⤵
  PID:8132
- C:\Windows\System\JjtkxdV.exe
  C:\Windows\System\JjtkxdV.exe
  2⤵
  PID:8164
- C:\Windows\System\vVKogxt.exe
  C:\Windows\System\vVKogxt.exe
  2⤵
  PID:8184
- C:\Windows\System\zVYENMk.exe
  C:\Windows\System\zVYENMk.exe
  2⤵
  PID:6996
- C:\Windows\System\zdNIGtp.exe
  C:\Windows\System\zdNIGtp.exe
  2⤵
  PID:7244
- C:\Windows\System\XDsAZgg.exe
  C:\Windows\System\XDsAZgg.exe
  2⤵
  PID:7304
- C:\Windows\System\vDGwDDA.exe
  C:\Windows\System\vDGwDDA.exe
  2⤵
  PID:7400
- C:\Windows\System\zETrhSn.exe
  C:\Windows\System\zETrhSn.exe
  2⤵
  PID:7540
- C:\Windows\System\pDByLKS.exe
  C:\Windows\System\pDByLKS.exe
  2⤵
  PID:7556
- C:\Windows\System\wwwDhwB.exe
  C:\Windows\System\wwwDhwB.exe
  2⤵
  PID:7624
- C:\Windows\System\HvHtJhB.exe
  C:\Windows\System\HvHtJhB.exe
  2⤵
  PID:7672
- C:\Windows\System\ifePRuY.exe
  C:\Windows\System\ifePRuY.exe
  2⤵
  PID:7724
- C:\Windows\System\lDVjjpu.exe
  C:\Windows\System\lDVjjpu.exe
  2⤵
  PID:7808
- C:\Windows\System\NhRpEzQ.exe
  C:\Windows\System\NhRpEzQ.exe
  2⤵
  PID:7884
- C:\Windows\System\ZSxWNet.exe
  C:\Windows\System\ZSxWNet.exe
  2⤵
  PID:7952
- C:\Windows\System\TIjPStq.exe
  C:\Windows\System\TIjPStq.exe
  2⤵
  PID:7972
- C:\Windows\System\pesViIK.exe
  C:\Windows\System\pesViIK.exe
  2⤵
  PID:8088
- C:\Windows\System\nnCmAuN.exe
  C:\Windows\System\nnCmAuN.exe
  2⤵
  PID:6192
- C:\Windows\System\oebYjSa.exe
  C:\Windows\System\oebYjSa.exe
  2⤵
  PID:7216
- C:\Windows\System\tQbMBUa.exe
  C:\Windows\System\tQbMBUa.exe
  2⤵
  PID:7312
- C:\Windows\System\wnMHqdO.exe
  C:\Windows\System\wnMHqdO.exe
  2⤵
  PID:7572
- C:\Windows\System\gCteQJO.exe
  C:\Windows\System\gCteQJO.exe
  2⤵
  PID:7684
- C:\Windows\System\DoIpSzK.exe
  C:\Windows\System\DoIpSzK.exe
  2⤵
  PID:7764
- C:\Windows\System\cnHEjAA.exe
  C:\Windows\System\cnHEjAA.exe
  2⤵
  PID:7948
- C:\Windows\System\CbSQzYp.exe
  C:\Windows\System\CbSQzYp.exe
  2⤵
  PID:8124
- C:\Windows\System\WcstLqe.exe
  C:\Windows\System\WcstLqe.exe
  2⤵
  PID:7628
- C:\Windows\System\HBOBeED.exe
  C:\Windows\System\HBOBeED.exe
  2⤵
  PID:7988
- C:\Windows\System\gFWBcXR.exe
  C:\Windows\System\gFWBcXR.exe
  2⤵
  PID:7584
- C:\Windows\System\OJcnYDT.exe
  C:\Windows\System\OJcnYDT.exe
  2⤵
  PID:8224
- C:\Windows\System\ROJebjT.exe
  C:\Windows\System\ROJebjT.exe
  2⤵
  PID:8248
- C:\Windows\System\FXUsrNL.exe
  C:\Windows\System\FXUsrNL.exe
  2⤵
  PID:8268
- C:\Windows\System\KPmakbV.exe
  C:\Windows\System\KPmakbV.exe
  2⤵
  PID:8292
- C:\Windows\System\bkqBAQj.exe
  C:\Windows\System\bkqBAQj.exe
  2⤵
  PID:8312
- C:\Windows\System\WhOUWsT.exe
  C:\Windows\System\WhOUWsT.exe
  2⤵
  PID:8332
- C:\Windows\System\IxuIXdT.exe
  C:\Windows\System\IxuIXdT.exe
  2⤵
  PID:8360
- C:\Windows\System\BIAPaKE.exe
  C:\Windows\System\BIAPaKE.exe
  2⤵
  PID:8400
- C:\Windows\System\MnpNExc.exe
  C:\Windows\System\MnpNExc.exe
  2⤵
  PID:8440
- C:\Windows\System\mZZgxYh.exe
  C:\Windows\System\mZZgxYh.exe
  2⤵
  PID:8468
- C:\Windows\System\LrUJknb.exe
  C:\Windows\System\LrUJknb.exe
  2⤵
  PID:8488
- C:\Windows\System\afFCNSv.exe
  C:\Windows\System\afFCNSv.exe
  2⤵
  PID:8508
- C:\Windows\System\WtRIGSU.exe
  C:\Windows\System\WtRIGSU.exe
  2⤵
  PID:8544
- C:\Windows\System\XQeyGWy.exe
  C:\Windows\System\XQeyGWy.exe
  2⤵
  PID:8576
- C:\Windows\System\gGbvKiq.exe
  C:\Windows\System\gGbvKiq.exe
  2⤵
  PID:8616
- C:\Windows\System\xzRAGXT.exe
  C:\Windows\System\xzRAGXT.exe
  2⤵
  PID:8656
- C:\Windows\System\JuOdObE.exe
  C:\Windows\System\JuOdObE.exe
  2⤵
  PID:8672
- C:\Windows\System\BmBvZON.exe
  C:\Windows\System\BmBvZON.exe
  2⤵
  PID:8696
- C:\Windows\System\wcryyrZ.exe
  C:\Windows\System\wcryyrZ.exe
  2⤵
  PID:8720
- C:\Windows\System\ezpZfug.exe
  C:\Windows\System\ezpZfug.exe
  2⤵
  PID:8744
- C:\Windows\System\UaBHiRo.exe
  C:\Windows\System\UaBHiRo.exe
  2⤵
  PID:8784
- C:\Windows\System\gPembcO.exe
  C:\Windows\System\gPembcO.exe
  2⤵
  PID:8808
- C:\Windows\System\jSfYtbX.exe
  C:\Windows\System\jSfYtbX.exe
  2⤵
  PID:8836
- C:\Windows\System\dgEwnML.exe
  C:\Windows\System\dgEwnML.exe
  2⤵
  PID:8860
- C:\Windows\System\RtxGjiy.exe
  C:\Windows\System\RtxGjiy.exe
  2⤵
  PID:8908
- C:\Windows\System\RHcmNOR.exe
  C:\Windows\System\RHcmNOR.exe
  2⤵
  PID:8936
- C:\Windows\System\KDPTUGS.exe
  C:\Windows\System\KDPTUGS.exe
  2⤵
  PID:8952
- C:\Windows\System\VisRfcn.exe
  C:\Windows\System\VisRfcn.exe
  2⤵
  PID:8968
- C:\Windows\System\VlLSBOT.exe
  C:\Windows\System\VlLSBOT.exe
  2⤵
  PID:9000
- C:\Windows\System\hJhkFKv.exe
  C:\Windows\System\hJhkFKv.exe
  2⤵
  PID:9020
- C:\Windows\System\RmWBHxk.exe
  C:\Windows\System\RmWBHxk.exe
  2⤵
  PID:9036
- C:\Windows\System\VTZtppM.exe
  C:\Windows\System\VTZtppM.exe
  2⤵
  PID:9060
- C:\Windows\System\OStVYbq.exe
  C:\Windows\System\OStVYbq.exe
  2⤵
  PID:9080
- C:\Windows\System\WsuEYrI.exe
  C:\Windows\System\WsuEYrI.exe
  2⤵
  PID:9104
- C:\Windows\System\mMUunLy.exe
  C:\Windows\System\mMUunLy.exe
  2⤵
  PID:9144
- C:\Windows\System\sdDMiPL.exe
  C:\Windows\System\sdDMiPL.exe
  2⤵
  PID:9200
- C:\Windows\System\BkgzNyT.exe
  C:\Windows\System\BkgzNyT.exe
  2⤵
  PID:7524
- C:\Windows\System\TRmCrkF.exe
  C:\Windows\System\TRmCrkF.exe
  2⤵
  PID:8216
- C:\Windows\System\JmwlOIN.exe
  C:\Windows\System\JmwlOIN.exe
  2⤵
  PID:8264
- C:\Windows\System\SjJLzON.exe
  C:\Windows\System\SjJLzON.exe
  2⤵
  PID:8324
- C:\Windows\System\AApVKuc.exe
  C:\Windows\System\AApVKuc.exe
  2⤵
  PID:8384
- C:\Windows\System\rWauFTG.exe
  C:\Windows\System\rWauFTG.exe
  2⤵
  PID:8464
- C:\Windows\System\ajAtbDD.exe
  C:\Windows\System\ajAtbDD.exe
  2⤵
  PID:8500
- C:\Windows\System\cwLywVc.exe
  C:\Windows\System\cwLywVc.exe
  2⤵
  PID:8684
- C:\Windows\System\tWZZXkR.exe
  C:\Windows\System\tWZZXkR.exe
  2⤵
  PID:8708
- C:\Windows\System\rLhqqhE.exe
  C:\Windows\System\rLhqqhE.exe
  2⤵
  PID:8772
- C:\Windows\System\hTFQEEB.exe
  C:\Windows\System\hTFQEEB.exe
  2⤵
  PID:8848
- C:\Windows\System\enAyCHO.exe
  C:\Windows\System\enAyCHO.exe
  2⤵
  PID:8904
- C:\Windows\System\czWpXwa.exe
  C:\Windows\System\czWpXwa.exe
  2⤵
  PID:9032
- C:\Windows\System\VNTzuxy.exe
  C:\Windows\System\VNTzuxy.exe
  2⤵
  PID:8992
- C:\Windows\System\TWWfbXv.exe
  C:\Windows\System\TWWfbXv.exe
  2⤵
  PID:9124
- C:\Windows\System\bPdryhd.exe
  C:\Windows\System\bPdryhd.exe
  2⤵
  PID:7708
- C:\Windows\System\wFrrvnQ.exe
  C:\Windows\System\wFrrvnQ.exe
  2⤵
  PID:9212
- C:\Windows\System\qcRfzim.exe
  C:\Windows\System\qcRfzim.exe
  2⤵
  PID:8308
- C:\Windows\System\LlXIqKg.exe
  C:\Windows\System\LlXIqKg.exe
  2⤵
  PID:8416
- C:\Windows\System\zKgznVr.exe
  C:\Windows\System\zKgznVr.exe
  2⤵
  PID:8712
- C:\Windows\System\DwklAyI.exe
  C:\Windows\System\DwklAyI.exe
  2⤵
  PID:8824
- C:\Windows\System\IuUdMEG.exe
  C:\Windows\System\IuUdMEG.exe
  2⤵
  PID:9052
- C:\Windows\System\STQVzwk.exe
  C:\Windows\System\STQVzwk.exe
  2⤵
  PID:9156
- C:\Windows\System\KPOhkSg.exe
  C:\Windows\System\KPOhkSg.exe
  2⤵
  PID:9164
- C:\Windows\System\jYcSkjG.exe
  C:\Windows\System\jYcSkjG.exe
  2⤵
  PID:8256
- C:\Windows\System\vkKVNyQ.exe
  C:\Windows\System\vkKVNyQ.exe
  2⤵
  PID:7744
- C:\Windows\System\mwuKXci.exe
  C:\Windows\System\mwuKXci.exe
  2⤵
  PID:8448
- C:\Windows\System\msSbTuG.exe
  C:\Windows\System\msSbTuG.exe
  2⤵
  PID:9220
- C:\Windows\System\uanWptb.exe
  C:\Windows\System\uanWptb.exe
  2⤵
  PID:9260
- C:\Windows\System\JQRNTZY.exe
  C:\Windows\System\JQRNTZY.exe
  2⤵
  PID:9280
- C:\Windows\System\pYrSCZs.exe
  C:\Windows\System\pYrSCZs.exe
  2⤵
  PID:9300
- C:\Windows\System\BxlBhhK.exe
  C:\Windows\System\BxlBhhK.exe
  2⤵
  PID:9320
- C:\Windows\System\mgOkJvD.exe
  C:\Windows\System\mgOkJvD.exe
  2⤵
  PID:9336
- C:\Windows\System\HoPfUUs.exe
  C:\Windows\System\HoPfUUs.exe
  2⤵
  PID:9388
- C:\Windows\System\GgOQJXS.exe
  C:\Windows\System\GgOQJXS.exe
  2⤵
  PID:9408
- C:\Windows\System\gwHUEzr.exe
  C:\Windows\System\gwHUEzr.exe
  2⤵
  PID:9456
- C:\Windows\System\kPqrLEd.exe
  C:\Windows\System\kPqrLEd.exe
  2⤵
  PID:9508
- C:\Windows\System\rzzDEYU.exe
  C:\Windows\System\rzzDEYU.exe
  2⤵
  PID:9560
- C:\Windows\System\gAcTrwk.exe
  C:\Windows\System\gAcTrwk.exe
  2⤵
  PID:9576
- C:\Windows\System\jSgJyRw.exe
  C:\Windows\System\jSgJyRw.exe
  2⤵
  PID:9592
- C:\Windows\System\yybWnHl.exe
  C:\Windows\System\yybWnHl.exe
  2⤵
  PID:9608
- C:\Windows\System\neBpYzx.exe
  C:\Windows\System\neBpYzx.exe
  2⤵
  PID:9624
- C:\Windows\System\SCNuHKL.exe
  C:\Windows\System\SCNuHKL.exe
  2⤵
  PID:9640
- C:\Windows\System\qsKQOqC.exe
  C:\Windows\System\qsKQOqC.exe
  2⤵
  PID:9656
- C:\Windows\System\RNNjsyk.exe
  C:\Windows\System\RNNjsyk.exe
  2⤵
  PID:9672
- C:\Windows\System\oQpffLq.exe
  C:\Windows\System\oQpffLq.exe
  2⤵
  PID:9688
- C:\Windows\System\DvWzVMT.exe
  C:\Windows\System\DvWzVMT.exe
  2⤵
  PID:9704
- C:\Windows\System\wXfySwh.exe
  C:\Windows\System\wXfySwh.exe
  2⤵
  PID:9720
- C:\Windows\System\JKsdGCP.exe
  C:\Windows\System\JKsdGCP.exe
  2⤵
  PID:9736
- C:\Windows\System\heRNRnp.exe
  C:\Windows\System\heRNRnp.exe
  2⤵
  PID:9756
- C:\Windows\System\NAlPMmk.exe
  C:\Windows\System\NAlPMmk.exe
  2⤵
  PID:9780
- C:\Windows\System\SMGhAbS.exe
  C:\Windows\System\SMGhAbS.exe
  2⤵
  PID:9844
- C:\Windows\System\vHpWcxK.exe
  C:\Windows\System\vHpWcxK.exe
  2⤵
  PID:9872
- C:\Windows\System\fumCFCF.exe
  C:\Windows\System\fumCFCF.exe
  2⤵
  PID:9888
- C:\Windows\System\DUTNUFV.exe
  C:\Windows\System\DUTNUFV.exe
  2⤵
  PID:9908
- C:\Windows\System\TVCZBub.exe
  C:\Windows\System\TVCZBub.exe
  2⤵
  PID:9964
- C:\Windows\System\FEmKbfe.exe
  C:\Windows\System\FEmKbfe.exe
  2⤵
  PID:10060
- C:\Windows\System\GgnHduF.exe
  C:\Windows\System\GgnHduF.exe
  2⤵
  PID:10084
- C:\Windows\System\NdDQuzx.exe
  C:\Windows\System\NdDQuzx.exe
  2⤵
  PID:10108
- C:\Windows\System\QqCozBT.exe
  C:\Windows\System\QqCozBT.exe
  2⤵
  PID:10132
- C:\Windows\System\zNrPzhB.exe
  C:\Windows\System\zNrPzhB.exe
  2⤵
  PID:10236
- C:\Windows\System\OIkyggA.exe
  C:\Windows\System\OIkyggA.exe
  2⤵
  PID:9308
- C:\Windows\System\OIiEALz.exe
  C:\Windows\System\OIiEALz.exe
  2⤵
  PID:9364
- C:\Windows\System\qAvtXzq.exe
  C:\Windows\System\qAvtXzq.exe
  2⤵
  PID:9696
- C:\Windows\System\ZowONuf.exe
  C:\Windows\System\ZowONuf.exe
  2⤵
  PID:9796
- C:\Windows\System\apFyYGU.exe
  C:\Windows\System\apFyYGU.exe
  2⤵
  PID:9476
- C:\Windows\System\avVEgiP.exe
  C:\Windows\System\avVEgiP.exe
  2⤵
  PID:9864
- C:\Windows\System\xCxTNTD.exe
  C:\Windows\System\xCxTNTD.exe
  2⤵
  PID:9552
- C:\Windows\System\yNOwgbn.exe
  C:\Windows\System\yNOwgbn.exe
  2⤵
  PID:9616
- C:\Windows\System\SdItSAi.exe
  C:\Windows\System\SdItSAi.exe
  2⤵
  PID:9652
- C:\Windows\System\FwwUaaS.exe
  C:\Windows\System\FwwUaaS.exe
  2⤵
  PID:9680
- C:\Windows\System\FVBNuUJ.exe
  C:\Windows\System\FVBNuUJ.exe
  2⤵
  PID:9768
- C:\Windows\System\EZJJoUl.exe
  C:\Windows\System\EZJJoUl.exe
  2⤵
  PID:9816
- C:\Windows\System\zRHwizX.exe
  C:\Windows\System\zRHwizX.exe
  2⤵
  PID:9960
- C:\Windows\System\cDCjLFD.exe
  C:\Windows\System\cDCjLFD.exe
  2⤵
  PID:9944
- C:\Windows\System\FUhKkjK.exe
  C:\Windows\System\FUhKkjK.exe
  2⤵
  PID:9976
- C:\Windows\System\NBYaywC.exe
  C:\Windows\System\NBYaywC.exe
  2⤵
  PID:10168
- C:\Windows\System\cNJZBcS.exe
  C:\Windows\System\cNJZBcS.exe
  2⤵
  PID:10116
- C:\Windows\System\mYEnokd.exe
  C:\Windows\System\mYEnokd.exe
  2⤵
  PID:10228
- C:\Windows\System\SgYFxhs.exe
  C:\Windows\System\SgYFxhs.exe
  2⤵
  PID:9496
- C:\Windows\System\Glalxdc.exe
  C:\Windows\System\Glalxdc.exe
  2⤵
  PID:9852
- C:\Windows\System\FwBUAar.exe
  C:\Windows\System\FwBUAar.exe
  2⤵
  PID:9664
- C:\Windows\System\QFuBtYY.exe
  C:\Windows\System\QFuBtYY.exe
  2⤵
  PID:9744
- C:\Windows\System\YIEHBop.exe
  C:\Windows\System\YIEHBop.exe
  2⤵
  PID:9900
- C:\Windows\System\jvkrlbv.exe
  C:\Windows\System\jvkrlbv.exe
  2⤵
  PID:10028
- C:\Windows\System\HdbBiIj.exe
  C:\Windows\System\HdbBiIj.exe
  2⤵
  PID:8896
- C:\Windows\System\mpVVKGN.exe
  C:\Windows\System\mpVVKGN.exe
  2⤵
  PID:9788
- C:\Windows\System\IZeonEg.exe
  C:\Windows\System\IZeonEg.exe
  2⤵
  PID:9100
- C:\Windows\System\uJeAOUs.exe
  C:\Windows\System\uJeAOUs.exe
  2⤵
  PID:9792
- C:\Windows\System\zGjMPeS.exe
  C:\Windows\System\zGjMPeS.exe
  2⤵
  PID:9752
- C:\Windows\System\vPnFRzr.exe
  C:\Windows\System\vPnFRzr.exe
  2⤵
  PID:10248
- C:\Windows\System\aLfTfcd.exe
  C:\Windows\System\aLfTfcd.exe
  2⤵
  PID:10264
- C:\Windows\System\UlgAyYV.exe
  C:\Windows\System\UlgAyYV.exe
  2⤵
  PID:10288
- C:\Windows\System\tWtqrVP.exe
  C:\Windows\System\tWtqrVP.exe
  2⤵
  PID:10312
- C:\Windows\System\tigvhBZ.exe
  C:\Windows\System\tigvhBZ.exe
  2⤵
  PID:10352
- C:\Windows\System\ROygcvL.exe
  C:\Windows\System\ROygcvL.exe
  2⤵
  PID:10380
- C:\Windows\System\bwyEDAU.exe
  C:\Windows\System\bwyEDAU.exe
  2⤵
  PID:10400
- C:\Windows\System\MdzVcxd.exe
  C:\Windows\System\MdzVcxd.exe
  2⤵
  PID:10436
- C:\Windows\System\CUCFPMS.exe
  C:\Windows\System\CUCFPMS.exe
  2⤵
  PID:10472
- C:\Windows\System\NgdjPGU.exe
  C:\Windows\System\NgdjPGU.exe
  2⤵
  PID:10496
- C:\Windows\System\gyQQhzh.exe
  C:\Windows\System\gyQQhzh.exe
  2⤵
  PID:10516
- C:\Windows\System\gSYDEuI.exe
  C:\Windows\System\gSYDEuI.exe
  2⤵
  PID:10548
- C:\Windows\System\lHYERGd.exe
  C:\Windows\System\lHYERGd.exe
  2⤵
  PID:10584
- C:\Windows\System\MypTJIh.exe
  C:\Windows\System\MypTJIh.exe
  2⤵
  PID:10600
- C:\Windows\System\AUNEsXs.exe
  C:\Windows\System\AUNEsXs.exe
  2⤵
  PID:10620
- C:\Windows\System\LjurRUA.exe
  C:\Windows\System\LjurRUA.exe
  2⤵
  PID:10648
- C:\Windows\System\ryuiNxl.exe
  C:\Windows\System\ryuiNxl.exe
  2⤵
  PID:10696
- C:\Windows\System\yEkBmuy.exe
  C:\Windows\System\yEkBmuy.exe
  2⤵
  PID:10716
- C:\Windows\System\KDWjkRo.exe
  C:\Windows\System\KDWjkRo.exe
  2⤵
  PID:10744
- C:\Windows\System\CHJIPld.exe
  C:\Windows\System\CHJIPld.exe
  2⤵
  PID:10772
- C:\Windows\System\upDnniI.exe
  C:\Windows\System\upDnniI.exe
  2⤵
  PID:10796
- C:\Windows\System\yuDypGy.exe
  C:\Windows\System\yuDypGy.exe
  2⤵
  PID:10812
- C:\Windows\System\fRGwSlj.exe
  C:\Windows\System\fRGwSlj.exe
  2⤵
  PID:10836
- C:\Windows\System\CCGLBhU.exe
  C:\Windows\System\CCGLBhU.exe
  2⤵
  PID:10856
- C:\Windows\System\VVyqczb.exe
  C:\Windows\System\VVyqczb.exe
  2⤵
  PID:10880
- C:\Windows\System\aUwszpE.exe
  C:\Windows\System\aUwszpE.exe
  2⤵
  PID:10916
- C:\Windows\System\tjONoQP.exe
  C:\Windows\System\tjONoQP.exe
  2⤵
  PID:10936
- C:\Windows\System\bSxLsjD.exe
  C:\Windows\System\bSxLsjD.exe
  2⤵
  PID:10984
- C:\Windows\System\xWuWiBE.exe
  C:\Windows\System\xWuWiBE.exe
  2⤵
  PID:11012
- C:\Windows\System\NmdkiVX.exe
  C:\Windows\System\NmdkiVX.exe
  2⤵
  PID:11032
- C:\Windows\System\zzSXKnM.exe
  C:\Windows\System\zzSXKnM.exe
  2⤵
  PID:11072
- C:\Windows\System\blWuMen.exe
  C:\Windows\System\blWuMen.exe
  2⤵
  PID:11092
- C:\Windows\System\EAHHSie.exe
  C:\Windows\System\EAHHSie.exe
  2⤵
  PID:11176
- C:\Windows\System\Kauctre.exe
  C:\Windows\System\Kauctre.exe
  2⤵
  PID:11192
- C:\Windows\System\pgmkNwv.exe
  C:\Windows\System\pgmkNwv.exe
  2⤵
  PID:11216
- C:\Windows\System\JwaGADR.exe
  C:\Windows\System\JwaGADR.exe
  2⤵
  PID:11244
- C:\Windows\System\qyOYUHb.exe
  C:\Windows\System\qyOYUHb.exe
  2⤵
  PID:5052
- C:\Windows\System\YiphJLI.exe
  C:\Windows\System\YiphJLI.exe
  2⤵
  PID:10300
- C:\Windows\System\bdgaRpJ.exe
  C:\Windows\System\bdgaRpJ.exe
  2⤵
  PID:10336
- C:\Windows\System\tLxyLMD.exe
  C:\Windows\System\tLxyLMD.exe
  2⤵
  PID:10396
- C:\Windows\System\RZDbmpO.exe
  C:\Windows\System\RZDbmpO.exe
  2⤵
  PID:10492
- C:\Windows\System\NwNExFS.exe
  C:\Windows\System\NwNExFS.exe
  2⤵
  PID:10508
- C:\Windows\System\JBZXlMl.exe
  C:\Windows\System\JBZXlMl.exe
  2⤵
  PID:10576
- C:\Windows\System\sshVAjz.exe
  C:\Windows\System\sshVAjz.exe
  2⤵
  PID:9904
- C:\Windows\System\lAlzzCx.exe
  C:\Windows\System\lAlzzCx.exe
  2⤵
  PID:10688
- C:\Windows\System\eVhzCEd.exe
  C:\Windows\System\eVhzCEd.exe
  2⤵
  PID:10736
- C:\Windows\System\VZIDWrj.exe
  C:\Windows\System\VZIDWrj.exe
  2⤵
  PID:10784
- C:\Windows\System\HcnplUW.exe
  C:\Windows\System\HcnplUW.exe
  2⤵
  PID:10780
- C:\Windows\System\XXfbnlW.exe
  C:\Windows\System\XXfbnlW.exe
  2⤵
  PID:10904
- C:\Windows\System\moegmpn.exe
  C:\Windows\System\moegmpn.exe
  2⤵
  PID:10980
- C:\Windows\System\mCYaArF.exe
  C:\Windows\System\mCYaArF.exe
  2⤵
  PID:11028
- C:\Windows\System\ZFbZFGc.exe
  C:\Windows\System\ZFbZFGc.exe
  2⤵
  PID:4280
- C:\Windows\System\OJsSHVC.exe
  C:\Windows\System\OJsSHVC.exe
  2⤵
  PID:3604
- C:\Windows\System\vXJTytG.exe
  C:\Windows\System\vXJTytG.exe
  2⤵
  PID:11208
- C:\Windows\System\NgJJINF.exe
  C:\Windows\System\NgJJINF.exe
  2⤵
  PID:11260
- C:\Windows\System\ERqjYDo.exe
  C:\Windows\System\ERqjYDo.exe
  2⤵
  PID:10488
- C:\Windows\System\gQReNHi.exe
  C:\Windows\System\gQReNHi.exe
  2⤵
  PID:10480
- C:\Windows\System\rrMQLoK.exe
  C:\Windows\System\rrMQLoK.exe
  2⤵
  PID:10684
- C:\Windows\System\gYCThgx.exe
  C:\Windows\System\gYCThgx.exe
  2⤵
  PID:10768
- C:\Windows\System\UWRLkjJ.exe
  C:\Windows\System\UWRLkjJ.exe
  2⤵
  PID:10852
- C:\Windows\System\WgEXgLS.exe
  C:\Windows\System\WgEXgLS.exe
  2⤵
  PID:11024
- C:\Windows\System\DaYDpHs.exe
  C:\Windows\System\DaYDpHs.exe
  2⤵
  PID:3940
- C:\Windows\System\cqzoRrZ.exe
  C:\Windows\System\cqzoRrZ.exe
  2⤵
  PID:11224
- C:\Windows\System\tyJOrSA.exe
  C:\Windows\System\tyJOrSA.exe
  2⤵
  PID:10360
- C:\Windows\System\XWHBHQS.exe
  C:\Windows\System\XWHBHQS.exe
  2⤵
  PID:536
- C:\Windows\System\ZbnXoLK.exe
  C:\Windows\System\ZbnXoLK.exe
  2⤵
  PID:10844
- C:\Windows\System\qCqkdGk.exe
  C:\Windows\System\qCqkdGk.exe
  2⤵
  PID:408
- C:\Windows\System\LVBAoDv.exe
  C:\Windows\System\LVBAoDv.exe
  2⤵
  PID:10392
- C:\Windows\System\WbvzyCd.exe
  C:\Windows\System\WbvzyCd.exe
  2⤵
  PID:10760
- C:\Windows\System\CAQReRT.exe
  C:\Windows\System\CAQReRT.exe
  2⤵
  PID:11308
- C:\Windows\System\yhdteYL.exe
  C:\Windows\System\yhdteYL.exe
  2⤵
  PID:11332
- C:\Windows\System\CEYaitC.exe
  C:\Windows\System\CEYaitC.exe
  2⤵
  PID:11364
- C:\Windows\System\oPBjWew.exe
  C:\Windows\System\oPBjWew.exe
  2⤵
  PID:11384
- C:\Windows\System\NEmObji.exe
  C:\Windows\System\NEmObji.exe
  2⤵
  PID:11408
- C:\Windows\System\RHfhtet.exe
  C:\Windows\System\RHfhtet.exe
  2⤵
  PID:11436
- C:\Windows\System\HmCrACe.exe
  C:\Windows\System\HmCrACe.exe
  2⤵
  PID:11452
- C:\Windows\System\vojJiTi.exe
  C:\Windows\System\vojJiTi.exe
  2⤵
  PID:11492
- C:\Windows\System\eZnNGnm.exe
  C:\Windows\System\eZnNGnm.exe
  2⤵
  PID:11520
- C:\Windows\System\QpCAmwB.exe
  C:\Windows\System\QpCAmwB.exe
  2⤵
  PID:11576
- C:\Windows\System\jhxIVqG.exe
  C:\Windows\System\jhxIVqG.exe
  2⤵
  PID:11604
- C:\Windows\System\HSXvXFx.exe
  C:\Windows\System\HSXvXFx.exe
  2⤵
  PID:11628
- C:\Windows\System\VRkXKxk.exe
  C:\Windows\System\VRkXKxk.exe
  2⤵
  PID:11648
- C:\Windows\System\XfRHKVr.exe
  C:\Windows\System\XfRHKVr.exe
  2⤵
  PID:11672
- C:\Windows\System\fZxmzSR.exe
  C:\Windows\System\fZxmzSR.exe
  2⤵
  PID:11716
- C:\Windows\System\WgymMPa.exe
  C:\Windows\System\WgymMPa.exe
  2⤵
  PID:11740
- C:\Windows\System\VWJVdwK.exe
  C:\Windows\System\VWJVdwK.exe
  2⤵
  PID:11760
- C:\Windows\System\QxdYbuJ.exe
  C:\Windows\System\QxdYbuJ.exe
  2⤵
  PID:11788
- C:\Windows\System\oxBIlgT.exe
  C:\Windows\System\oxBIlgT.exe
  2⤵
  PID:11816
- C:\Windows\System\FWzSQGw.exe
  C:\Windows\System\FWzSQGw.exe
  2⤵
  PID:11844
- C:\Windows\System\pEGgmhb.exe
  C:\Windows\System\pEGgmhb.exe
  2⤵
  PID:11872
- C:\Windows\System\wFBzXnO.exe
  C:\Windows\System\wFBzXnO.exe
  2⤵
  PID:11900
- C:\Windows\System\SnzxQzu.exe
  C:\Windows\System\SnzxQzu.exe
  2⤵
  PID:11932
- C:\Windows\System\PLZGQha.exe
  C:\Windows\System\PLZGQha.exe
  2⤵
  PID:11968
- C:\Windows\System\QdxihjO.exe
  C:\Windows\System\QdxihjO.exe
  2⤵
  PID:11996
- C:\Windows\System\tHBVJCr.exe
  C:\Windows\System\tHBVJCr.exe
  2⤵
  PID:12012
- C:\Windows\System\VULrpSQ.exe
  C:\Windows\System\VULrpSQ.exe
  2⤵
  PID:12036
- C:\Windows\System\dMKLbQm.exe
  C:\Windows\System\dMKLbQm.exe
  2⤵
  PID:12072
- C:\Windows\System\OelhMPc.exe
  C:\Windows\System\OelhMPc.exe
  2⤵
  PID:12092
- C:\Windows\System\rMnlRCq.exe
  C:\Windows\System\rMnlRCq.exe
  2⤵
  PID:12116
- C:\Windows\System\eMjyJcQ.exe
  C:\Windows\System\eMjyJcQ.exe
  2⤵
  PID:12172
- C:\Windows\System\nejcykH.exe
  C:\Windows\System\nejcykH.exe
  2⤵
  PID:12200
- C:\Windows\System\HpYcTPK.exe
  C:\Windows\System\HpYcTPK.exe
  2⤵
  PID:12216
- C:\Windows\System\MGXsSqh.exe
  C:\Windows\System\MGXsSqh.exe
  2⤵
  PID:12268
- C:\Windows\System\ZMXpNvW.exe
  C:\Windows\System\ZMXpNvW.exe
  2⤵
  PID:10616
- C:\Windows\System\fGQAOXX.exe
  C:\Windows\System\fGQAOXX.exe
  2⤵
  PID:11276
- C:\Windows\System\ROAGVBY.exe
  C:\Windows\System\ROAGVBY.exe
  2⤵
  PID:11284
- C:\Windows\System\wvepUVP.exe
  C:\Windows\System\wvepUVP.exe
  2⤵
  PID:11376
- C:\Windows\System\xjyCmsC.exe
  C:\Windows\System\xjyCmsC.exe
  2⤵
  PID:11476
- C:\Windows\System\NOplnuj.exe
  C:\Windows\System\NOplnuj.exe
  2⤵
  PID:11540
- C:\Windows\System\BLmRtDa.exe
  C:\Windows\System\BLmRtDa.exe
  2⤵
  PID:11612
- C:\Windows\System\dEHhUwq.exe
  C:\Windows\System\dEHhUwq.exe
  2⤵
  PID:11688
- C:\Windows\System\oeIqOVc.exe
  C:\Windows\System\oeIqOVc.exe
  2⤵
  PID:11712
- C:\Windows\System\EXIdcuL.exe
  C:\Windows\System\EXIdcuL.exe
  2⤵
  PID:11732
- C:\Windows\System\aVrKhMa.exe
  C:\Windows\System\aVrKhMa.exe
  2⤵
  PID:11808
- C:\Windows\System\LZNJgqw.exe
  C:\Windows\System\LZNJgqw.exe
  2⤵
  PID:11836
- C:\Windows\System\ZOAZxFv.exe
  C:\Windows\System\ZOAZxFv.exe
  2⤵
  PID:11924
- C:\Windows\System\GYyZtbD.exe
  C:\Windows\System\GYyZtbD.exe
  2⤵
  PID:12032
- C:\Windows\System\opfwCdA.exe
  C:\Windows\System\opfwCdA.exe
  2⤵
  PID:12108
- C:\Windows\System\cwXmfEc.exe
  C:\Windows\System\cwXmfEc.exe
  2⤵
  PID:3644
- C:\Windows\System\AdqOrIx.exe
  C:\Windows\System\AdqOrIx.exe
  2⤵
  PID:116
- C:\Windows\System\rYchBdN.exe
  C:\Windows\System\rYchBdN.exe
  2⤵
  PID:2288
- C:\Windows\System\pFbvGbL.exe
  C:\Windows\System\pFbvGbL.exe
  2⤵
  PID:1940
- C:\Windows\System\mnSzXNb.exe
  C:\Windows\System\mnSzXNb.exe
  2⤵
  PID:2856
- C:\Windows\System\QWDyKER.exe
  C:\Windows\System\QWDyKER.exe
  2⤵
  PID:11232
- C:\Windows\System\emxdpxS.exe
  C:\Windows\System\emxdpxS.exe
  2⤵
  PID:11664
- C:\Windows\System\WkQxSVP.exe
  C:\Windows\System\WkQxSVP.exe
  2⤵
  PID:11756
- C:\Windows\System\BMMINMf.exe
  C:\Windows\System\BMMINMf.exe
  2⤵
  PID:12196
- C:\Windows\System\fYRXevd.exe
  C:\Windows\System\fYRXevd.exe
  2⤵
  PID:1656
- C:\Windows\System\qhaiyvK.exe
  C:\Windows\System\qhaiyvK.exe
  2⤵
  PID:12284
- C:\Windows\System\neuxFQo.exe
  C:\Windows\System\neuxFQo.exe
  2⤵
  PID:12252
- C:\Windows\System\NpWgLNJ.exe
  C:\Windows\System\NpWgLNJ.exe
  2⤵
  PID:10928
- C:\Windows\System\QXILVPk.exe
  C:\Windows\System\QXILVPk.exe
  2⤵
  PID:1404
- C:\Windows\System\XnfLRWt.exe
  C:\Windows\System\XnfLRWt.exe
  2⤵
  PID:11868
- C:\Windows\System\PJgyjjf.exe
  C:\Windows\System\PJgyjjf.exe
  2⤵
  PID:11768
- C:\Windows\System\kCwjher.exe
  C:\Windows\System\kCwjher.exe
  2⤵
  PID:12152
- C:\Windows\System\AhzfAaC.exe
  C:\Windows\System\AhzfAaC.exe
  2⤵
  PID:220
- C:\Windows\System\CHzvSDk.exe
  C:\Windows\System\CHzvSDk.exe
  2⤵
  PID:11352
- C:\Windows\System\UZLXXDT.exe
  C:\Windows\System\UZLXXDT.exe
  2⤵
  PID:3964
- C:\Windows\System\fplEEeV.exe
  C:\Windows\System\fplEEeV.exe
  2⤵
  PID:3968
- C:\Windows\System\JVLxYcu.exe
  C:\Windows\System\JVLxYcu.exe
  2⤵
  PID:11644
- C:\Windows\System\aPnoJtS.exe
  C:\Windows\System\aPnoJtS.exe
  2⤵
  PID:4864
- C:\Windows\System\lOLOjrC.exe
  C:\Windows\System\lOLOjrC.exe
  2⤵
  PID:12308
- C:\Windows\System\MPnZdEL.exe
  C:\Windows\System\MPnZdEL.exe
  2⤵
  PID:12328
- C:\Windows\System\JahIPHU.exe
  C:\Windows\System\JahIPHU.exe
  2⤵
  PID:12364
- C:\Windows\System\JWzdawf.exe
  C:\Windows\System\JWzdawf.exe
  2⤵
  PID:12404
- C:\Windows\System\qZhGvOc.exe
  C:\Windows\System\qZhGvOc.exe
  2⤵
  PID:12428
- C:\Windows\System\lglmwsO.exe
  C:\Windows\System\lglmwsO.exe
  2⤵
  PID:12452
- C:\Windows\System\PrsGDtn.exe
  C:\Windows\System\PrsGDtn.exe
  2⤵
  PID:12468
- C:\Windows\System\HGDYfRr.exe
  C:\Windows\System\HGDYfRr.exe
  2⤵
  PID:12484
- C:\Windows\System\wYQLZKZ.exe
  C:\Windows\System\wYQLZKZ.exe
  2⤵
  PID:12516
- C:\Windows\System\ARzRQxR.exe
  C:\Windows\System\ARzRQxR.exe
  2⤵
  PID:12536
- C:\Windows\System\uexEfrV.exe
  C:\Windows\System\uexEfrV.exe
  2⤵
  PID:12556
- C:\Windows\System\fUIYpfi.exe
  C:\Windows\System\fUIYpfi.exe
  2⤵
  PID:12584
- C:\Windows\System\rRnFRHX.exe
  C:\Windows\System\rRnFRHX.exe
  2⤵
  PID:12608
- C:\Windows\System\chCYYmK.exe
  C:\Windows\System\chCYYmK.exe
  2⤵
  PID:12636
- C:\Windows\System\HHZsNdz.exe
  C:\Windows\System\HHZsNdz.exe
  2⤵
  PID:12692
- C:\Windows\System\iVvNQoU.exe
  C:\Windows\System\iVvNQoU.exe
  2⤵
  PID:12716
- C:\Windows\System\UuQcLSx.exe
  C:\Windows\System\UuQcLSx.exe
  2⤵
  PID:12740
- C:\Windows\System\taEddOE.exe
  C:\Windows\System\taEddOE.exe
  2⤵
  PID:12760
- C:\Windows\System\DBSYFTZ.exe
  C:\Windows\System\DBSYFTZ.exe
  2⤵
  PID:12816
- C:\Windows\System\BrGNMNz.exe
  C:\Windows\System\BrGNMNz.exe
  2⤵
  PID:12848
- C:\Windows\System\pJRELuH.exe
  C:\Windows\System\pJRELuH.exe
  2⤵
  PID:12868
- C:\Windows\System\OumUQFD.exe
  C:\Windows\System\OumUQFD.exe
  2⤵
  PID:12884
- C:\Windows\System\CtgIvAc.exe
  C:\Windows\System\CtgIvAc.exe
  2⤵
  PID:12904
- C:\Windows\System\dYiLHQL.exe
  C:\Windows\System\dYiLHQL.exe
  2⤵
  PID:12928
- C:\Windows\System\aHUujok.exe
  C:\Windows\System\aHUujok.exe
  2⤵
  PID:12980
- C:\Windows\System\nSKCjgm.exe
  C:\Windows\System\nSKCjgm.exe
  2⤵
  PID:13004
- C:\Windows\System\WSbLumc.exe
  C:\Windows\System\WSbLumc.exe
  2⤵
  PID:13024
- C:\Windows\System\wIUGyGi.exe
  C:\Windows\System\wIUGyGi.exe
  2⤵
  PID:13044
- C:\Windows\System\bZLZScP.exe
  C:\Windows\System\bZLZScP.exe
  2⤵
  PID:13064
- C:\Windows\System\IWESuTk.exe
  C:\Windows\System\IWESuTk.exe
  2⤵
  PID:13124
- C:\Windows\System\EyDpqjC.exe
  C:\Windows\System\EyDpqjC.exe
  2⤵
  PID:13144
- C:\Windows\System\WrpOaxR.exe
  C:\Windows\System\WrpOaxR.exe
  2⤵
  PID:13172
- C:\Windows\System\jzIZDDC.exe
  C:\Windows\System\jzIZDDC.exe
  2⤵
  PID:13208
- C:\Windows\System\YkqxjmU.exe
  C:\Windows\System\YkqxjmU.exe
  2⤵
  PID:13240
- C:\Windows\System\NmHtxDC.exe
  C:\Windows\System\NmHtxDC.exe
  2⤵
  PID:13280
- C:\Windows\System\cIYcNed.exe
  C:\Windows\System\cIYcNed.exe
  2⤵
  PID:13300
- C:\Windows\System\FaPClya.exe
  C:\Windows\System\FaPClya.exe
  2⤵
  PID:12304
- C:\Windows\System\GtcEqGX.exe
  C:\Windows\System\GtcEqGX.exe
  2⤵
  PID:12340
- C:\Windows\System\ACBryTA.exe
  C:\Windows\System\ACBryTA.exe
  2⤵
  PID:12400
- C:\Windows\System\bgBbaYA.exe
  C:\Windows\System\bgBbaYA.exe
  2⤵
  PID:12440
- C:\Windows\System\icMgVCq.exe
  C:\Windows\System\icMgVCq.exe
  2⤵
  PID:12528
- C:\Windows\System\pctAHct.exe
  C:\Windows\System\pctAHct.exe
  2⤵
  PID:12604
- C:\Windows\System\NXXXcUR.exe
  C:\Windows\System\NXXXcUR.exe
  2⤵
  PID:12676
- C:\Windows\System\gnjiXKm.exe
  C:\Windows\System\gnjiXKm.exe
  2⤵
  PID:12728
- C:\Windows\System\KsiyywL.exe
  C:\Windows\System\KsiyywL.exe
  2⤵
  PID:12824
- C:\Windows\System\FiTWdRr.exe
  C:\Windows\System\FiTWdRr.exe
  2⤵
  PID:13268
- C:\Windows\System\LYkhCHL.exe
  C:\Windows\System\LYkhCHL.exe
  2⤵
  PID:13184
- C:\Windows\System\PnBcrzR.exe
  C:\Windows\System\PnBcrzR.exe
  2⤵
  PID:5688
- C:\Windows\System\QjTPJpe.exe
  C:\Windows\System\QjTPJpe.exe
  2⤵
  PID:13276
- C:\Windows\System\ZnLUHQk.exe
  C:\Windows\System\ZnLUHQk.exe
  2⤵
  PID:5980
- C:\Windows\System\blIurGq.exe
  C:\Windows\System\blIurGq.exe
  2⤵
  PID:12644
- C:\Windows\System\LzAmedd.exe
  C:\Windows\System\LzAmedd.exe
  2⤵
  PID:12212
- C:\Windows\System\BvZQtvB.exe
  C:\Windows\System\BvZQtvB.exe
  2⤵
  PID:4556
- C:\Windows\System\bbkMAWP.exe
  C:\Windows\System\bbkMAWP.exe
  2⤵
  PID:4624
- C:\Windows\System\ldBSFFA.exe
  C:\Windows\System\ldBSFFA.exe
  2⤵
  PID:4692
- C:\Windows\System\cvQhXQa.exe
  C:\Windows\System\cvQhXQa.exe
  2⤵
  PID:964
- C:\Windows\System\cXvdrib.exe
  C:\Windows\System\cXvdrib.exe
  2⤵
  PID:7468
- C:\Windows\System\xXmBWas.exe
  C:\Windows\System\xXmBWas.exe
  2⤵
  PID:12840
- C:\Windows\System\HyHSuqD.exe
  C:\Windows\System\HyHSuqD.exe
  2⤵
  PID:12976
- C:\Windows\System\YXUZRVL.exe
  C:\Windows\System\YXUZRVL.exe
  2⤵
  PID:4628
- C:\Windows\System\wTggydI.exe
  C:\Windows\System\wTggydI.exe
  2⤵
  PID:3980
- C:\Windows\System\ILuKuJK.exe
  C:\Windows\System\ILuKuJK.exe
  2⤵
  PID:13032
- C:\Windows\System\HMskype.exe
  C:\Windows\System\HMskype.exe
  2⤵
  PID:2376
- C:\Windows\System\iMBPxYN.exe
  C:\Windows\System\iMBPxYN.exe
  2⤵
  PID:13248
- C:\Windows\System\dIBksyS.exe
  C:\Windows\System\dIBksyS.exe
  2⤵
  PID:12996
- C:\Windows\System\CgiZLdo.exe
  C:\Windows\System\CgiZLdo.exe
  2⤵
  PID:5956
- C:\Windows\System\agIsYMC.exe
  C:\Windows\System\agIsYMC.exe
  2⤵
  PID:13020
- C:\Windows\System\YWldGCo.exe
  C:\Windows\System\YWldGCo.exe
  2⤵
  PID:13056
- C:\Windows\System\MBtKXtk.exe
  C:\Windows\System\MBtKXtk.exe
  2⤵
  PID:13264
- C:\Windows\System\rnArNGy.exe
  C:\Windows\System\rnArNGy.exe
  2⤵
  PID:4960
- C:\Windows\System\AXaoHnP.exe
  C:\Windows\System\AXaoHnP.exe
  2⤵
  PID:7128
- C:\Windows\System\GLcWrFt.exe
  C:\Windows\System\GLcWrFt.exe
  2⤵
  PID:13040
- C:\Windows\System\NTIjbVP.exe
  C:\Windows\System\NTIjbVP.exe
  2⤵
  PID:4424
- C:\Windows\System\wbXVrcj.exe
  C:\Windows\System\wbXVrcj.exe
  2⤵
  PID:4276
- C:\Windows\System\faxBeVf.exe
  C:\Windows\System\faxBeVf.exe
  2⤵
  PID:6692
- C:\Windows\System\qVsBjDy.exe
  C:\Windows\System\qVsBjDy.exe
  2⤵
  PID:6828
- C:\Windows\System\BGyUmIx.exe
  C:\Windows\System\BGyUmIx.exe
  2⤵
  PID:2440
- C:\Windows\System\gGIuNbc.exe
  C:\Windows\System\gGIuNbc.exe
  2⤵
  PID:3772
- C:\Windows\System\fpvSmZg.exe
  C:\Windows\System\fpvSmZg.exe
  2⤵
  PID:6628
- C:\Windows\System\DnIfRsb.exe
  C:\Windows\System\DnIfRsb.exe
  2⤵
  PID:6316
- C:\Windows\System\hGMfPtY.exe
  C:\Windows\System\hGMfPtY.exe
  2⤵
  PID:6704
- C:\Windows\System\HwenZvz.exe
  C:\Windows\System\HwenZvz.exe
  2⤵
  PID:7016
- C:\Windows\System\UGXivTl.exe
  C:\Windows\System\UGXivTl.exe
  2⤵
  PID:448
- C:\Windows\System\sUnrvxA.exe
  C:\Windows\System\sUnrvxA.exe
  2⤵
  PID:1716
- C:\Windows\System\NALUbXq.exe
  C:\Windows\System\NALUbXq.exe
  2⤵
  PID:7344
- C:\Windows\System\AkKymkc.exe
  C:\Windows\System\AkKymkc.exe
  2⤵
  PID:7420
- C:\Windows\System\QMjaEpm.exe
  C:\Windows\System\QMjaEpm.exe
  2⤵
  PID:552
- C:\Windows\System\mgemMqj.exe
  C:\Windows\System\mgemMqj.exe
  2⤵
  PID:6760
- C:\Windows\System\BYcOxlJ.exe
  C:\Windows\System\BYcOxlJ.exe
  2⤵
  PID:6360
- C:\Windows\System\GvlLcrm.exe
  C:\Windows\System\GvlLcrm.exe
  2⤵
  PID:1492
- C:\Windows\System\MIlzZaG.exe
  C:\Windows\System\MIlzZaG.exe
  2⤵
  PID:4940
- C:\Windows\System\uEaKNOT.exe
  C:\Windows\System\uEaKNOT.exe
  2⤵
  PID:5112
- C:\Windows\System\mtlggLT.exe
  C:\Windows\System\mtlggLT.exe
  2⤵
  PID:4856
- C:\Windows\System\ZCKkvBa.exe
  C:\Windows\System\ZCKkvBa.exe
  2⤵
  PID:3360
- C:\Windows\System\mViwWtF.exe
  C:\Windows\System\mViwWtF.exe
  2⤵
  PID:6928
- C:\Windows\System\oDBiHGM.exe
  C:\Windows\System\oDBiHGM.exe
  2⤵
  PID:6908
- C:\Windows\System\NLdLLMS.exe
  C:\Windows\System\NLdLLMS.exe
  2⤵
  PID:6564
- C:\Windows\System\GSuzPlH.exe
  C:\Windows\System\GSuzPlH.exe
  2⤵
  PID:3404
- C:\Windows\System\UfEnZvg.exe
  C:\Windows\System\UfEnZvg.exe
  2⤵
  PID:5024
- C:\Windows\System\vZXGWMQ.exe
  C:\Windows\System\vZXGWMQ.exe
  2⤵
  PID:7512
- C:\Windows\System\LYVAXiP.exe
  C:\Windows\System\LYVAXiP.exe
  2⤵
  PID:8064
- C:\Windows\System\sDMBGcb.exe
  C:\Windows\System\sDMBGcb.exe
  2⤵
  PID:7296
- C:\Windows\System\gadznTt.exe
  C:\Windows\System\gadznTt.exe
  2⤵
  PID:6544
- C:\Windows\System\LBXCUAj.exe
  C:\Windows\System\LBXCUAj.exe
  2⤵
  PID:4340
- C:\Windows\System\aBEgnPy.exe
  C:\Windows\System\aBEgnPy.exe
  2⤵
  PID:8212
- C:\Windows\System\WfOZFrW.exe
  C:\Windows\System\WfOZFrW.exe
  2⤵
  PID:1172
- C:\Windows\System\abDHznK.exe
  C:\Windows\System\abDHznK.exe
  2⤵
  PID:2840
- C:\Windows\System\tnVCEAy.exe
  C:\Windows\System\tnVCEAy.exe
  2⤵
  PID:3440
- C:\Windows\System\KdzXfIb.exe
  C:\Windows\System\KdzXfIb.exe
  2⤵
  PID:2256
- C:\Windows\System\YfkSavn.exe
  C:\Windows\System\YfkSavn.exe
  2⤵
  PID:12924
- C:\Windows\System\qeRHGQv.exe
  C:\Windows\System\qeRHGQv.exe
  2⤵
  PID:5108
- C:\Windows\System\gSJwAxy.exe
  C:\Windows\System\gSJwAxy.exe
  2⤵
  PID:4452
- C:\Windows\System\vCTYodQ.exe
  C:\Windows\System\vCTYodQ.exe
  2⤵
  PID:3416
- C:\Windows\System\gmcyggI.exe
  C:\Windows\System\gmcyggI.exe
  2⤵
  PID:6896
- C:\Windows\System\HMDNsmi.exe
  C:\Windows\System\HMDNsmi.exe
  2⤵
  PID:4300
- C:\Windows\System\sqntPaa.exe
  C:\Windows\System\sqntPaa.exe
  2⤵
  PID:920
- C:\Windows\System\BFunSDs.exe
  C:\Windows\System\BFunSDs.exe
  2⤵
  PID:3256
- C:\Windows\System\JbtFkyf.exe
  C:\Windows\System\JbtFkyf.exe
  2⤵
  PID:2748
- C:\Windows\System\pWjoytd.exe
  C:\Windows\System\pWjoytd.exe
  2⤵
  PID:8884
- C:\Windows\System\JSdaaWT.exe
  C:\Windows\System\JSdaaWT.exe
  2⤵
  PID:8900
- C:\Windows\System\urFPTRQ.exe
  C:\Windows\System\urFPTRQ.exe
  2⤵
  PID:6364
- C:\Windows\System\ySuhBNY.exe
  C:\Windows\System\ySuhBNY.exe
  2⤵
  PID:8084
- C:\Windows\System\uQJrqFE.exe
  C:\Windows\System\uQJrqFE.exe
  2⤵
  PID:8232
- C:\Windows\System\HDfzVZt.exe
  C:\Windows\System\HDfzVZt.exe
  2⤵
  PID:1816
- C:\Windows\System\MKyyeyk.exe
  C:\Windows\System\MKyyeyk.exe
  2⤵
  PID:6512
- C:\Windows\System\ZZuZYGh.exe
  C:\Windows\System\ZZuZYGh.exe
  2⤵
  PID:5264
- C:\Windows\System\tBzPwYV.exe
  C:\Windows\System\tBzPwYV.exe
  2⤵
  PID:4368
- C:\Windows\System\waMJujV.exe
  C:\Windows\System\waMJujV.exe
  2⤵
  PID:8852
- C:\Windows\System\nMewRgX.exe
  C:\Windows\System\nMewRgX.exe
  2⤵
  PID:7384
- C:\Windows\System\mmhzpHO.exe
  C:\Windows\System\mmhzpHO.exe
  2⤵
  PID:5360
- C:\Windows\System\UtIjDsS.exe
  C:\Windows\System\UtIjDsS.exe
  2⤵
  PID:2932
- C:\Windows\System\pfVzfry.exe
  C:\Windows\System\pfVzfry.exe
  2⤵
  PID:7552
- C:\Windows\System\epevlfU.exe
  C:\Windows\System\epevlfU.exe
  2⤵
  PID:2588
- C:\Windows\System\vrMXOtT.exe
  C:\Windows\System\vrMXOtT.exe
  2⤵
  PID:5472
- C:\Windows\System\CDtNYUJ.exe
  C:\Windows\System\CDtNYUJ.exe
  2⤵
  PID:7292
- C:\Windows\System\XlFoZnD.exe
  C:\Windows\System\XlFoZnD.exe
  2⤵
  PID:8704
- C:\Windows\System\pFOfwSE.exe
  C:\Windows\System\pFOfwSE.exe
  2⤵
  PID:9072
- C:\Windows\System\QakYSea.exe
  C:\Windows\System\QakYSea.exe
  2⤵
  PID:5152
- C:\Windows\System\yvbrXLQ.exe
  C:\Windows\System\yvbrXLQ.exe
  2⤵
  PID:9544
- C:\Windows\System\otMtPci.exe
  C:\Windows\System\otMtPci.exe
  2⤵
  PID:9548
- C:\Windows\System\oTnhHIm.exe
  C:\Windows\System\oTnhHIm.exe
  2⤵
  PID:9732
- C:\Windows\System\lMNGvbT.exe
  C:\Windows\System\lMNGvbT.exe
  2⤵
  PID:4528
- C:\Windows\System\xbTaeGs.exe
  C:\Windows\System\xbTaeGs.exe
  2⤵
  PID:5796
- C:\Windows\System\RzuMplJ.exe
  C:\Windows\System\RzuMplJ.exe
  2⤵
  PID:1416
- C:\Windows\System\hZLRULO.exe
  C:\Windows\System\hZLRULO.exe
  2⤵
  PID:1696
- C:\Windows\System\vZkLzLb.exe
  C:\Windows\System\vZkLzLb.exe
  2⤵
  PID:5332
- C:\Windows\System\CakFXPO.exe
  C:\Windows\System\CakFXPO.exe
  2⤵
  PID:5484
- C:\Windows\System\QWoGgxm.exe
  C:\Windows\System\QWoGgxm.exe
  2⤵
  PID:5344
- C:\Windows\System\tdmFzEU.exe
  C:\Windows\System\tdmFzEU.exe
  2⤵
  PID:5968
- C:\Windows\System\qDlbfoi.exe
  C:\Windows\System\qDlbfoi.exe
  2⤵
  PID:8964
- C:\Windows\System\lqqERax.exe
  C:\Windows\System\lqqERax.exe
  2⤵
  PID:5620
- C:\Windows\System\iQDDPlD.exe
  C:\Windows\System\iQDDPlD.exe
  2⤵
  PID:2052
- C:\Windows\System\PIWyzLt.exe
  C:\Windows\System\PIWyzLt.exe
  2⤵
  PID:8816
- C:\Windows\System\gvdsIvm.exe
  C:\Windows\System\gvdsIvm.exe
  2⤵
  PID:9764
- C:\Windows\System\SmoWFFN.exe
  C:\Windows\System\SmoWFFN.exe
  2⤵
  PID:7212
- C:\Windows\System\BNqwBzs.exe
  C:\Windows\System\BNqwBzs.exe
  2⤵
  PID:2284
- C:\Windows\System\LBJuNVA.exe
  C:\Windows\System\LBJuNVA.exe
  2⤵
  PID:5932
- C:\Windows\System\arKvEuh.exe
  C:\Windows\System\arKvEuh.exe
  2⤵
  PID:10368
- C:\Windows\System\SLslJEx.exe
  C:\Windows\System\SLslJEx.exe
  2⤵
  PID:3036
- C:\Windows\System\lzMFeer.exe
  C:\Windows\System\lzMFeer.exe
  2⤵
  PID:5204
- C:\Windows\System\RFrlhif.exe
  C:\Windows\System\RFrlhif.exe
  2⤵
  PID:6128
- C:\Windows\System\zLrzgtB.exe
  C:\Windows\System\zLrzgtB.exe
  2⤵
  PID:2100
- C:\Windows\System\ltWlSMD.exe
  C:\Windows\System\ltWlSMD.exe
  2⤵
  PID:5164
- C:\Windows\System\XGCUGHC.exe
  C:\Windows\System\XGCUGHC.exe
  2⤵
  PID:10704
- C:\Windows\System\rVmViCF.exe
  C:\Windows\System\rVmViCF.exe
  2⤵
  PID:5284
- C:\Windows\System\XWHQscO.exe
  C:\Windows\System\XWHQscO.exe
  2⤵
  PID:6332
- C:\Windows\System\BtWgQoc.exe
  C:\Windows\System\BtWgQoc.exe
  2⤵
  PID:2008
- C:\Windows\System\HSVBQbl.exe
  C:\Windows\System\HSVBQbl.exe
  2⤵
  PID:6108
- C:\Windows\System\tZDrWvw.exe
  C:\Windows\System\tZDrWvw.exe
  2⤵
  PID:8612
- C:\Windows\System\GAMOnuZ.exe
  C:\Windows\System\GAMOnuZ.exe
  2⤵
  PID:5540
- C:\Windows\System\BvYkcGU.exe
  C:\Windows\System\BvYkcGU.exe
  2⤵
  PID:5892
- C:\Windows\System\Fdjuhcq.exe
  C:\Windows\System\Fdjuhcq.exe
  2⤵
  PID:2364
- C:\Windows\System\YdTgOXD.exe
  C:\Windows\System\YdTgOXD.exe
  2⤵
  PID:6044
- C:\Windows\System\LvjIhde.exe
  C:\Windows\System\LvjIhde.exe
  2⤵
  PID:11128
- C:\Windows\System\PlGkeKm.exe
  C:\Windows\System\PlGkeKm.exe
  2⤵
  PID:5648
- C:\Windows\System\PYukkOv.exe
  C:\Windows\System\PYukkOv.exe
  2⤵
  PID:11212
- C:\Windows\System\JVvTjSw.exe
  C:\Windows\System\JVvTjSw.exe
  2⤵
  PID:9236
- C:\Windows\System\VGPeGjH.exe
  C:\Windows\System\VGPeGjH.exe
  2⤵
  PID:10324
- C:\Windows\System\zodoVWe.exe
  C:\Windows\System\zodoVWe.exe
  2⤵
  PID:10376
- C:\Windows\System\WIeidRL.exe
  C:\Windows\System\WIeidRL.exe
  2⤵
  PID:10416
- C:\Windows\System\IyXwYVp.exe
  C:\Windows\System\IyXwYVp.exe
  2⤵
  PID:5532
- C:\Windows\System\xDSaSSk.exe
  C:\Windows\System\xDSaSSk.exe
  2⤵
  PID:10220
- C:\Windows\System\NJBWrUm.exe
  C:\Windows\System\NJBWrUm.exe
  2⤵
  PID:10864
- C:\Windows\System\ySSYTrY.exe
  C:\Windows\System\ySSYTrY.exe
  2⤵
  PID:10900
- C:\Windows\System\PgbowFK.exe
  C:\Windows\System\PgbowFK.exe
  2⤵
  PID:10824
- C:\Windows\System\RagJLlo.exe
  C:\Windows\System\RagJLlo.exe
  2⤵
  PID:5312
- C:\Windows\System\bIiMDru.exe
  C:\Windows\System\bIiMDru.exe
  2⤵
  PID:896
- C:\Windows\System\yradCTe.exe
  C:\Windows\System\yradCTe.exe
  2⤵
  PID:756
- C:\Windows\System\vWKcZEO.exe
  C:\Windows\System\vWKcZEO.exe
  2⤵
  PID:5908
- C:\Windows\System\LCCpjoG.exe
  C:\Windows\System\LCCpjoG.exe
  2⤵
  PID:5976
- C:\Windows\System\ajAEAfF.exe
  C:\Windows\System\ajAEAfF.exe
  2⤵
  PID:5864
- C:\Windows\System\dgdCley.exe
  C:\Windows\System\dgdCley.exe
  2⤵
  PID:11152
- C:\Windows\System\EeaSBVA.exe
  C:\Windows\System\EeaSBVA.exe
  2⤵
  PID:5500
- C:\Windows\System\RkXVFya.exe
  C:\Windows\System\RkXVFya.exe
  2⤵
  PID:6320
- C:\Windows\System\KrStGCi.exe
  C:\Windows\System\KrStGCi.exe
  2⤵
  PID:5544
- C:\Windows\System\yluJTwR.exe
  C:\Windows\System\yluJTwR.exe
  2⤵
  PID:12164
- C:\Windows\System\WKqBlxL.exe
  C:\Windows\System\WKqBlxL.exe
  2⤵
  PID:6100
- C:\Windows\System\lNxpkZf.exe
  C:\Windows\System\lNxpkZf.exe
  2⤵
  PID:512
- C:\Windows\System\ngGhrRb.exe
  C:\Windows\System\ngGhrRb.exe
  2⤵
  PID:11164
- C:\Windows\System\daKsPMO.exe
  C:\Windows\System\daKsPMO.exe
  2⤵
  PID:12140
- C:\Windows\System\MJbRkUJ.exe
  C:\Windows\System\MJbRkUJ.exe
  2⤵
  PID:10260
- C:\Windows\System\HvwQwpG.exe
  C:\Windows\System\HvwQwpG.exe
  2⤵
  PID:11316
- C:\Windows\System\BnVutAR.exe
  C:\Windows\System\BnVutAR.exe
  2⤵
  PID:11736
- C:\Windows\System\TMXtZkW.exe
  C:\Windows\System\TMXtZkW.exe
  2⤵
  PID:2836
- C:\Windows\System\HMTDkRX.exe
  C:\Windows\System\HMTDkRX.exe
  2⤵
  PID:11340
- C:\Windows\System\yuXZAeg.exe
  C:\Windows\System\yuXZAeg.exe
  2⤵
  PID:3064
- C:\Windows\System\PgVDWJM.exe
  C:\Windows\System\PgVDWJM.exe
  2⤵
  PID:11420
- C:\Windows\System\kZyhyyZ.exe
  C:\Windows\System\kZyhyyZ.exe
  2⤵
  PID:12124
- C:\Windows\System\qZhRlEy.exe
  C:\Windows\System\qZhRlEy.exe
  2⤵
  PID:10932
- C:\Windows\System\wimRYdu.exe
  C:\Windows\System\wimRYdu.exe
  2⤵
  PID:6496
- C:\Windows\System\AvbLEbY.exe
  C:\Windows\System\AvbLEbY.exe
  2⤵
  PID:12412
- C:\Windows\System\eywrKlq.exe
  C:\Windows\System\eywrKlq.exe
  2⤵
  PID:11708
- C:\Windows\System\eMBMEZz.exe
  C:\Windows\System\eMBMEZz.exe
  2⤵
  PID:11296
- C:\Windows\System\BhVvsKU.exe
  C:\Windows\System\BhVvsKU.exe
  2⤵
  PID:11468
- C:\Windows\System\UEOUyBs.exe
  C:\Windows\System\UEOUyBs.exe
  2⤵
  PID:6712
- C:\Windows\System\upfkhpE.exe
  C:\Windows\System\upfkhpE.exe
  2⤵
  PID:6716
- C:\Windows\System\RYaVQBo.exe
  C:\Windows\System\RYaVQBo.exe
  2⤵
  PID:2308
- C:\Windows\System\rbHuZsp.exe
  C:\Windows\System\rbHuZsp.exe
  2⤵
  PID:11592
- C:\Windows\System\KImArNM.exe
  C:\Windows\System\KImArNM.exe
  2⤵
  PID:12792
- C:\Windows\System\cBDvMoU.exe
  C:\Windows\System\cBDvMoU.exe
  2⤵
  PID:6324
- C:\Windows\System\LRLZjdC.exe
  C:\Windows\System\LRLZjdC.exe
  2⤵
  PID:12160
- C:\Windows\System\WUTlHnu.exe
  C:\Windows\System\WUTlHnu.exe
  2⤵
  PID:12844
- C:\Windows\System\HzyQIWa.exe
  C:\Windows\System\HzyQIWa.exe
  2⤵
  PID:12956
- C:\Windows\System\oblGKqI.exe
  C:\Windows\System\oblGKqI.exe
  2⤵
  PID:6456
- C:\Windows\System\FlHnUIO.exe
  C:\Windows\System\FlHnUIO.exe
  2⤵
  PID:6252
- C:\Windows\System\BCmlKBK.exe
  C:\Windows\System\BCmlKBK.exe
  2⤵
  PID:6592
- C:\Windows\System\HcrqqLM.exe
  C:\Windows\System\HcrqqLM.exe
  2⤵
  PID:12616
- C:\Windows\System\ZrplZIB.exe
  C:\Windows\System\ZrplZIB.exe
  2⤵
  PID:10596
- C:\Windows\System\kSHVWmY.exe
  C:\Windows\System\kSHVWmY.exe
  2⤵
  PID:6780
- C:\Windows\System\bvpDJaN.exe
  C:\Windows\System\bvpDJaN.exe
  2⤵
  PID:6752
- C:\Windows\System\MyXtAlX.exe
  C:\Windows\System\MyXtAlX.exe
  2⤵
  PID:10272
- C:\Windows\System\dmJAZvs.exe
  C:\Windows\System\dmJAZvs.exe
  2⤵
  PID:12836
- C:\Windows\System\bRlnDCc.exe
  C:\Windows\System\bRlnDCc.exe
  2⤵
  PID:3492
- C:\Windows\System\xTRBIuN.exe
  C:\Windows\System\xTRBIuN.exe
  2⤵
  PID:13100
- C:\Windows\System\BZEdSdH.exe
  C:\Windows\System\BZEdSdH.exe
  2⤵
  PID:11488
- C:\Windows\System\WxmEzHO.exe
  C:\Windows\System\WxmEzHO.exe
  2⤵
  PID:6428
- C:\Windows\System\CGboNQl.exe
  C:\Windows\System\CGboNQl.exe
  2⤵
  PID:7092
- C:\Windows\System\njcGDqy.exe
  C:\Windows\System\njcGDqy.exe
  2⤵
  PID:10788
- C:\Windows\System\eHMHZTc.exe
  C:\Windows\System\eHMHZTc.exe
  2⤵
  PID:11516
- C:\Windows\System\BeqvdXS.exe
  C:\Windows\System\BeqvdXS.exe
  2⤵
  PID:2244
- C:\Windows\System\IdkFYpD.exe
  C:\Windows\System\IdkFYpD.exe
  2⤵
  PID:11680
- C:\Windows\System\cpMlmXV.exe
  C:\Windows\System\cpMlmXV.exe
  2⤵
  PID:11748
- C:\Windows\System\UvJhAft.exe
  C:\Windows\System\UvJhAft.exe
  2⤵
  PID:6568
- C:\Windows\System\PHLWlkU.exe
  C:\Windows\System\PHLWlkU.exe
  2⤵
  PID:6696
- C:\Windows\System\VVyWrEj.exe
  C:\Windows\System\VVyWrEj.exe
  2⤵
  PID:5904
- C:\Windows\System\tqMMRYg.exe
  C:\Windows\System\tqMMRYg.exe
  2⤵
  PID:6012
- C:\Windows\System\iNJFBwS.exe
  C:\Windows\System\iNJFBwS.exe
  2⤵
  PID:7064
- C:\Windows\System\SRxAlcx.exe
  C:\Windows\System\SRxAlcx.exe
  2⤵
  PID:12948
- C:\Windows\System\flclAHs.exe
  C:\Windows\System\flclAHs.exe
  2⤵
  PID:11424
- C:\Windows\System\VZXIcih.exe
  C:\Windows\System\VZXIcih.exe
  2⤵
  PID:13160
- C:\Windows\System\sClnAAd.exe
  C:\Windows\System\sClnAAd.exe
  2⤵
  PID:11320
- C:\Windows\System\ErkVgiL.exe
  C:\Windows\System\ErkVgiL.exe
  2⤵
  PID:7124
- C:\Windows\System\XjiMOuV.exe
  C:\Windows\System\XjiMOuV.exe
  2⤵
  PID:216
- C:\Windows\System\dPZrBPK.exe
  C:\Windows\System\dPZrBPK.exe
  2⤵
  PID:6212
- C:\Windows\System\SqdjZHV.exe
  C:\Windows\System\SqdjZHV.exe
  2⤵
  PID:5920
- C:\Windows\System\dKTPPjb.exe
  C:\Windows\System\dKTPPjb.exe
  2⤵
  PID:6200
- C:\Windows\System\JSHUYlk.exe
  C:\Windows\System\JSHUYlk.exe
  2⤵
  PID:6820
- C:\Windows\System\JIRCXAd.exe
  C:\Windows\System\JIRCXAd.exe
  2⤵
  PID:12500
- C:\Windows\System\yVkwjIf.exe
  C:\Windows\System\yVkwjIf.exe
  2⤵
  PID:7036
- C:\Windows\System\Ehwlclf.exe
  C:\Windows\System\Ehwlclf.exe
  2⤵
  PID:7396
- C:\Windows\System\fGqYXjD.exe
  C:\Windows\System\fGqYXjD.exe
  2⤵
  PID:7376
- C:\Windows\System\kUgRJXJ.exe
  C:\Windows\System\kUgRJXJ.exe
  2⤵
  PID:7956
- C:\Windows\System\XkyeyMf.exe
  C:\Windows\System\XkyeyMf.exe
  2⤵
  PID:12704
- C:\Windows\System\ERvTBdw.exe
  C:\Windows\System\ERvTBdw.exe
  2⤵
  PID:6948
- C:\Windows\System\OdhBiYW.exe
  C:\Windows\System\OdhBiYW.exe
  2⤵
  PID:7852
- C:\Windows\System\vAXaEeG.exe
  C:\Windows\System\vAXaEeG.exe
  2⤵
  PID:13328
- C:\Windows\System\HsZmoDD.exe
  C:\Windows\System\HsZmoDD.exe
  2⤵
  PID:13360
- C:\Windows\System\HScIpVV.exe
  C:\Windows\System\HScIpVV.exe
  2⤵
  PID:13392
- C:\Windows\System\WApKSZf.exe
  C:\Windows\System\WApKSZf.exe
  2⤵
  PID:13416
- C:\Windows\System\hNXngFp.exe
  C:\Windows\System\hNXngFp.exe
  2⤵
  PID:13444
- C:\Windows\System\dvrjyea.exe
  C:\Windows\System\dvrjyea.exe
  2⤵
  PID:13464
- C:\Windows\System\fqpyncm.exe
  C:\Windows\System\fqpyncm.exe
  2⤵
  PID:13492
- C:\Windows\System\HhjElrL.exe
  C:\Windows\System\HhjElrL.exe
  2⤵
  PID:13600
- C:\Windows\System\mIQzdEm.exe
  C:\Windows\System\mIQzdEm.exe
  2⤵
  PID:13624
- C:\Windows\System\CaOjEvR.exe
  C:\Windows\System\CaOjEvR.exe
  2⤵
  PID:13652
- C:\Windows\System\VpyYEiq.exe
  C:\Windows\System\VpyYEiq.exe
  2⤵
  PID:13684
- C:\Windows\System\SqjVtLd.exe
  C:\Windows\System\SqjVtLd.exe
  2⤵
  PID:13712
- C:\Windows\System\jTjYMDL.exe
  C:\Windows\System\jTjYMDL.exe
  2⤵
  PID:13728
- C:\Windows\System\ejkeXIk.exe
  C:\Windows\System\ejkeXIk.exe
  2⤵
  PID:13752
- C:\Windows\System\VGRIlkV.exe
  C:\Windows\System\VGRIlkV.exe
  2⤵
  PID:13772
- C:\Windows\System\MzTRpQs.exe
  C:\Windows\System\MzTRpQs.exe
  2⤵
  PID:13800
- C:\Windows\System\ZOmRipq.exe
  C:\Windows\System\ZOmRipq.exe
  2⤵
  PID:13820
- C:\Windows\System\riSltWb.exe
  C:\Windows\System\riSltWb.exe
  2⤵
  PID:13868
- C:\Windows\System\dLpwWNU.exe
  C:\Windows\System\dLpwWNU.exe
  2⤵
  PID:13892
- C:\Windows\System\WZnPVhE.exe
  C:\Windows\System\WZnPVhE.exe
  2⤵
  PID:13924
- C:\Windows\System\UfKFefC.exe
  C:\Windows\System\UfKFefC.exe
  2⤵
  PID:14100
- C:\Windows\System\BzdxIeh.exe
  C:\Windows\System\BzdxIeh.exe
  2⤵
  PID:14136
- C:\Windows\System\FmBBqMR.exe
  C:\Windows\System\FmBBqMR.exe
  2⤵
  PID:14160
- C:\Windows\System\hXFPNqq.exe
  C:\Windows\System\hXFPNqq.exe
  2⤵
  PID:14192
- C:\Windows\System\oppDbGl.exe
  C:\Windows\System\oppDbGl.exe
  2⤵
  PID:14232
- C:\Windows\System\cDcXEJj.exe
  C:\Windows\System\cDcXEJj.exe
  2⤵
  PID:14260
- C:\Windows\System\OeqTydF.exe
  C:\Windows\System\OeqTydF.exe
  2⤵
  PID:14288
- C:\Windows\System\pvjnWpX.exe
  C:\Windows\System\pvjnWpX.exe
  2⤵
  PID:14308
- C:\Windows\System\pBPSaDn.exe
  C:\Windows\System\pBPSaDn.exe
  2⤵
  PID:7872
- C:\Windows\System\tpifWzN.exe
  C:\Windows\System\tpifWzN.exe
  2⤵
  PID:7916
- C:\Windows\System\UIilsPu.exe
  C:\Windows\System\UIilsPu.exe
  2⤵
  PID:6620
- C:\Windows\System\pVuFTuC.exe
  C:\Windows\System\pVuFTuC.exe
  2⤵
  PID:12892
- C:\Windows\System\PganGiZ.exe
  C:\Windows\System\PganGiZ.exe
  2⤵
  PID:13708
- C:\Windows\System\agDPGFs.exe
  C:\Windows\System\agDPGFs.exe
  2⤵
  PID:13648
- C:\Windows\System\uvtwPWb.exe
  C:\Windows\System\uvtwPWb.exe
  2⤵
  PID:13876
- C:\Windows\System\qAoMEJG.exe
  C:\Windows\System\qAoMEJG.exe
  2⤵
  PID:8484
- C:\Windows\System\NtbgqwV.exe
  C:\Windows\System\NtbgqwV.exe
  2⤵
  PID:13572
- C:\Windows\System\nrAqBiU.exe
  C:\Windows\System\nrAqBiU.exe
  2⤵
  PID:8352
- C:\Windows\System\GuavJTd.exe
  C:\Windows\System\GuavJTd.exe
  2⤵
  PID:8480
- C:\Windows\System\moOQzsA.exe
  C:\Windows\System\moOQzsA.exe
  2⤵
  PID:13944
- C:\Windows\System\sXtuGaX.exe
  C:\Windows\System\sXtuGaX.exe
  2⤵
  PID:13972
- C:\Windows\System\zrQvYxW.exe
  C:\Windows\System\zrQvYxW.exe
  2⤵
  PID:14032
- C:\Windows\System\DGmTnWC.exe
  C:\Windows\System\DGmTnWC.exe
  2⤵
  PID:8932
- C:\Windows\System\GLfAFcw.exe
  C:\Windows\System\GLfAFcw.exe
  2⤵
  PID:13832
- C:\Windows\System\KrDXJDb.exe
  C:\Windows\System\KrDXJDb.exe
  2⤵
  PID:9184
- C:\Windows\System\moNeJBE.exe
  C:\Windows\System\moNeJBE.exe
  2⤵
  PID:9016
- C:\Windows\System\lpUBLMV.exe
  C:\Windows\System\lpUBLMV.exe
  2⤵
  PID:8732
- C:\Windows\System\nLDqQJg.exe
  C:\Windows\System\nLDqQJg.exe
  2⤵
  PID:8284
- C:\Windows\System\DkdcDEQ.exe
  C:\Windows\System\DkdcDEQ.exe
  2⤵
  PID:6516
- C:\Windows\System\hCKoOOb.exe
  C:\Windows\System\hCKoOOb.exe
  2⤵
  PID:7336
- C:\Windows\System\CLkGCyG.exe
  C:\Windows\System\CLkGCyG.exe
  2⤵
  PID:13412
- C:\Windows\System\RpZSOKK.exe
  C:\Windows\System\RpZSOKK.exe
  2⤵
  PID:2528
- C:\Windows\System\qaisIWZ.exe
  C:\Windows\System\qaisIWZ.exe
  2⤵
  PID:13336
- C:\Windows\System\FqiDkkc.exe
  C:\Windows\System\FqiDkkc.exe
  2⤵
  PID:13548
- C:\Windows\System\lAmzFFy.exe
  C:\Windows\System\lAmzFFy.exe
  2⤵
  PID:9256
- C:\Windows\System\qwNjTVS.exe
  C:\Windows\System\qwNjTVS.exe
  2⤵
  PID:8832
- C:\Windows\System\HGHPvJV.exe
  C:\Windows\System\HGHPvJV.exe
  2⤵
  PID:9348
- C:\Windows\System\oacesYV.exe
  C:\Windows\System\oacesYV.exe
  2⤵
  PID:9472
- C:\Windows\System\zwjPaOp.exe
  C:\Windows\System\zwjPaOp.exe
  2⤵
  PID:10232
- C:\Windows\System\KBHcFMm.exe
  C:\Windows\System\KBHcFMm.exe
  2⤵
  PID:6164
- C:\Windows\System\QBByBiY.exe
  C:\Windows\System\QBByBiY.exe
  2⤵
  PID:10104
- C:\Windows\System\uvLBDHo.exe
  C:\Windows\System\uvLBDHo.exe
  2⤵
  PID:10016
- C:\Windows\System\rcOGPtM.exe
  C:\Windows\System\rcOGPtM.exe
  2⤵
  PID:8652
- C:\Windows\System\qQYSaES.exe
  C:\Windows\System\qQYSaES.exe
  2⤵
  PID:10044
- C:\Windows\System\TGKiVFI.exe
  C:\Windows\System\TGKiVFI.exe
  2⤵
  PID:9416
- C:\Windows\System\lcMcnqV.exe
  C:\Windows\System\lcMcnqV.exe
  2⤵
  PID:13720
- C:\Windows\System\ssPLAyc.exe
  C:\Windows\System\ssPLAyc.exe
  2⤵
  PID:13472
- C:\Windows\System\tSOQQPL.exe
  C:\Windows\System\tSOQQPL.exe
  2⤵
  PID:13584
- C:\Windows\System\vEYPWbE.exe
  C:\Windows\System\vEYPWbE.exe
  2⤵
  PID:13524
- C:\Windows\System\QDFKhxj.exe
  C:\Windows\System\QDFKhxj.exe
  2⤵
  PID:13428
- C:\Windows\System\PkTQvXJ.exe
  C:\Windows\System\PkTQvXJ.exe
  2⤵
  PID:13620
- C:\Windows\System\FvSQcuB.exe
  C:\Windows\System\FvSQcuB.exe
  2⤵
  PID:13568
- C:\Windows\System\ZZBmmGr.exe
  C:\Windows\System\ZZBmmGr.exe
  2⤵
  PID:9572
- C:\Windows\System\fXvAlvX.exe
  C:\Windows\System\fXvAlvX.exe
  2⤵
  PID:9728
- C:\Windows\System\tntjuhj.exe
  C:\Windows\System\tntjuhj.exe
  2⤵
  PID:10076
- C:\Windows\System\DZamlTD.exe
  C:\Windows\System\DZamlTD.exe
  2⤵
  PID:9404
- C:\Windows\System\GCGdBub.exe
  C:\Windows\System\GCGdBub.exe
  2⤵
  PID:14132
- C:\Windows\System\DexMoOd.exe
  C:\Windows\System\DexMoOd.exe
  2⤵
  PID:9992
- C:\Windows\System\LZsKrsK.exe
  C:\Windows\System\LZsKrsK.exe
  2⤵
  PID:13640
- C:\Windows\System\dQHgtlQ.exe
  C:\Windows\System\dQHgtlQ.exe
  2⤵
  PID:14004
- C:\Windows\System\kkAQfTs.exe
  C:\Windows\System\kkAQfTs.exe
  2⤵
  PID:14052
- C:\Windows\System\EjPRCfs.exe
  C:\Windows\System\EjPRCfs.exe
  2⤵
  PID:10484
- C:\Windows\System\AoitsCu.exe
  C:\Windows\System\AoitsCu.exe
  2⤵
  PID:14212
- C:\Windows\System\jDYYSzP.exe
  C:\Windows\System\jDYYSzP.exe
  2⤵
  PID:14084
- C:\Windows\System\KLOhGrl.exe
  C:\Windows\System\KLOhGrl.exe
  2⤵
  PID:10448
- C:\Windows\System\jNgCLuf.exe
  C:\Windows\System\jNgCLuf.exe
  2⤵
  PID:14148
- C:\Windows\System\xwIXDaC.exe
  C:\Windows\System\xwIXDaC.exe
  2⤵
  PID:12524
- C:\Windows\System\IjnCgUF.exe
  C:\Windows\System\IjnCgUF.exe
  2⤵
  PID:13848
- C:\Windows\System\AQYaLKu.exe
  C:\Windows\System\AQYaLKu.exe
  2⤵
  PID:10888
- C:\Windows\System\flowBCn.exe
  C:\Windows\System\flowBCn.exe
  2⤵
  PID:10952
- C:\Windows\System\fskxYdr.exe
  C:\Windows\System\fskxYdr.exe
  2⤵
  PID:11056
- C:\Windows\System\PZnutKy.exe
  C:\Windows\System\PZnutKy.exe
  2⤵
  PID:9376
- C:\Windows\System\zhSdBOq.exe
  C:\Windows\System\zhSdBOq.exe
  2⤵
  PID:9924
- C:\Windows\System\AecPBSW.exe
  C:\Windows\System\AecPBSW.exe
  2⤵
  PID:10020
- C:\Windows\System\fXKDGAw.exe
  C:\Windows\System\fXKDGAw.exe
  2⤵
  PID:11148
- C:\Windows\System\htsRWem.exe
  C:\Windows\System\htsRWem.exe
  2⤵
  PID:9524
- C:\Windows\System\PjRJRmN.exe
  C:\Windows\System\PjRJRmN.exe
  2⤵
  PID:8600
- C:\Windows\System\YoTLRqX.exe
  C:\Windows\System\YoTLRqX.exe
  2⤵
  PID:6788
- C:\Windows\System\dQUImJG.exe
  C:\Windows\System\dQUImJG.exe
  2⤵
  PID:10872
- C:\Windows\System\ywThFVR.exe
  C:\Windows\System\ywThFVR.exe
  2⤵
  PID:8528
- C:\Windows\System\ObziZrT.exe
  C:\Windows\System\ObziZrT.exe
  2⤵
  PID:9528
- C:\Windows\System\UgMHmWq.exe
  C:\Windows\System\UgMHmWq.exe
  2⤵
  PID:8648
- C:\Windows\System\YwkiTRj.exe
  C:\Windows\System\YwkiTRj.exe
  2⤵
  PID:8804
- C:\Windows\System\rkEsFLj.exe
  C:\Windows\System\rkEsFLj.exe
  2⤵
  PID:10100
- C:\Windows\System\vOxIYAH.exe
  C:\Windows\System\vOxIYAH.exe
  2⤵
  PID:9812
- C:\Windows\System\XxrbAcn.exe
  C:\Windows\System\XxrbAcn.exe
  2⤵
  PID:10568
- C:\Windows\System\pxTvLnh.exe
  C:\Windows\System\pxTvLnh.exe
  2⤵
  PID:4184
- C:\Windows\System\EoNJWcx.exe
  C:\Windows\System\EoNJWcx.exe
  2⤵
  PID:14224
- C:\Windows\System\NsDtyUk.exe
  C:\Windows\System\NsDtyUk.exe
  2⤵
  PID:10636
- C:\Windows\System\CxSGnJP.exe
  C:\Windows\System\CxSGnJP.exe
  2⤵
  PID:14000
- C:\Windows\System\EReCEEw.exe
  C:\Windows\System\EReCEEw.exe
  2⤵
  PID:10428
- C:\Windows\System\RHZLttp.exe
  C:\Windows\System\RHZLttp.exe
  2⤵
  PID:10532
- C:\Windows\System\XbkmsaZ.exe
  C:\Windows\System\XbkmsaZ.exe
  2⤵
  PID:11304
- C:\Windows\System\FcYDLVH.exe
  C:\Windows\System\FcYDLVH.exe
  2⤵
  PID:10204
- C:\Windows\System\vlGLWUS.exe
  C:\Windows\System\vlGLWUS.exe
  2⤵
  PID:14324
- C:\Windows\System\sfUslTT.exe
  C:\Windows\System\sfUslTT.exe
  2⤵
  PID:10152
- C:\Windows\System\tKdXPzz.exe
  C:\Windows\System\tKdXPzz.exe
  2⤵
  PID:11536
- C:\Windows\System\OrWcoVd.exe
  C:\Windows\System\OrWcoVd.exe
  2⤵
  PID:11588
- C:\Windows\System\mLbKxXC.exe
  C:\Windows\System\mLbKxXC.exe
  2⤵
  PID:9972
- C:\Windows\System\KKSYrjf.exe
  C:\Windows\System\KKSYrjf.exe
  2⤵
  PID:10180
- C:\Windows\System\joMsofB.exe
  C:\Windows\System\joMsofB.exe
  2⤵
  PID:13380
- C:\Windows\System\oderSxF.exe
  C:\Windows\System\oderSxF.exe
  2⤵
  PID:11944
- C:\Windows\System\znNnFRk.exe
  C:\Windows\System\znNnFRk.exe
  2⤵
  PID:9588
- C:\Windows\System\xIeHtne.exe
  C:\Windows\System\xIeHtne.exe
  2⤵
  PID:10432
- C:\Windows\System\apEeQST.exe
  C:\Windows\System\apEeQST.exe
  2⤵
  PID:13348
- C:\Windows\System\CcVUkEh.exe
  C:\Windows\System\CcVUkEh.exe
  2⤵
  PID:8984
- C:\Windows\System\cgfeXBr.exe
  C:\Windows\System\cgfeXBr.exe
  2⤵
  PID:14092
- C:\Windows\System\crebWlG.exe
  C:\Windows\System\crebWlG.exe
  2⤵
  PID:11104
- C:\Windows\System\adQkAgP.exe
  C:\Windows\System\adQkAgP.exe
  2⤵
  PID:11360
- C:\Windows\System\YbNoWVO.exe
  C:\Windows\System\YbNoWVO.exe
  2⤵
  PID:10036
- C:\Windows\System\CylziUe.exe
  C:\Windows\System\CylziUe.exe
  2⤵
  PID:12052
- C:\Windows\System\xnTRXME.exe
  C:\Windows\System\xnTRXME.exe
  2⤵
  PID:11640
- C:\Windows\System\OICNzMR.exe
  C:\Windows\System\OICNzMR.exe
  2⤵
  PID:8432
- C:\Windows\System\NfdJvOm.exe
  C:\Windows\System\NfdJvOm.exe
  2⤵
  PID:8456
- C:\Windows\System\hpJgaNg.exe
  C:\Windows\System\hpJgaNg.exe
  2⤵
  PID:11532
- C:\Windows\System\qWNxTbd.exe
  C:\Windows\System\qWNxTbd.exe
  2⤵
  PID:9360
- C:\Windows\System\FtSUJle.exe
  C:\Windows\System\FtSUJle.exe
  2⤵
  PID:840
- C:\Windows\System\wqDIPbb.exe
  C:\Windows\System\wqDIPbb.exe
  2⤵
  PID:12144
- C:\Windows\System\sBHJsDM.exe
  C:\Windows\System\sBHJsDM.exe
  2⤵
  PID:112
- C:\Windows\System\ENIoxXM.exe
  C:\Windows\System\ENIoxXM.exe
  2⤵
  PID:732
- C:\Windows\System\BbjNEsd.exe
  C:\Windows\System\BbjNEsd.exe
  2⤵
  PID:12208
- C:\Windows\System\uVhQtuT.exe
  C:\Windows\System\uVhQtuT.exe
  2⤵
  PID:10032
- C:\Windows\System\oiEKKyX.exe
  C:\Windows\System\oiEKKyX.exe
  2⤵
  PID:6964
- C:\Windows\System\dBDlJgg.exe
  C:\Windows\System\dBDlJgg.exe
  2⤵
  PID:12104
- C:\Windows\System\AGyXRxj.exe
  C:\Windows\System\AGyXRxj.exe
  2⤵
  PID:11048
- C:\Windows\System\PYhqjNV.exe
  C:\Windows\System\PYhqjNV.exe
  2⤵
  PID:13768
- C:\Windows\System\skeerKi.exe
  C:\Windows\System\skeerKi.exe
  2⤵
  PID:12044
- C:\Windows\System\yxEtPeS.exe
  C:\Windows\System\yxEtPeS.exe
  2⤵
  PID:13796
- C:\Windows\System\MZPsQun.exe
  C:\Windows\System\MZPsQun.exe
  2⤵
  PID:12508
- C:\Windows\System\hWNCEoG.exe
  C:\Windows\System\hWNCEoG.exe
  2⤵
  PID:12648
- C:\Windows\System\hVwLjRa.exe
  C:\Windows\System\hVwLjRa.exe
  2⤵
  PID:10752
- C:\Windows\System\cBduRbT.exe
  C:\Windows\System\cBduRbT.exe
  2⤵
  PID:12668
- C:\Windows\System\kHjqHUh.exe
  C:\Windows\System\kHjqHUh.exe
  2⤵
  PID:11960
- C:\Windows\System\HCvBxwY.exe
  C:\Windows\System\HCvBxwY.exe
  2⤵
  PID:12236
- C:\Windows\System\XjzbVls.exe
  C:\Windows\System\XjzbVls.exe
  2⤵
  PID:9932
- C:\Windows\System\IvtGlIO.exe
  C:\Windows\System\IvtGlIO.exe
  2⤵
  PID:13096
- C:\Windows\System\pFSntbW.exe
  C:\Windows\System\pFSntbW.exe
  2⤵
  PID:3976
- C:\Windows\System\jZwqsaL.exe
  C:\Windows\System\jZwqsaL.exe
  2⤵
  PID:11772
- C:\Windows\System\pzceEyJ.exe
  C:\Windows\System\pzceEyJ.exe
  2⤵
  PID:12800
- C:\Windows\System\JehZdpR.exe
  C:\Windows\System\JehZdpR.exe
  2⤵
  PID:12436
- C:\Windows\System\hBmUYAA.exe
  C:\Windows\System\hBmUYAA.exe
  2⤵
  PID:12480
- C:\Windows\System\apQoTpe.exe
  C:\Windows\System\apQoTpe.exe
  2⤵
  PID:10000
- C:\Windows\System\VHRdsKI.exe
  C:\Windows\System\VHRdsKI.exe
  2⤵
  PID:12756
- C:\Windows\System\LqSYGkc.exe
  C:\Windows\System\LqSYGkc.exe
  2⤵
  PID:12748
- C:\Windows\System\HxkEZeD.exe
  C:\Windows\System\HxkEZeD.exe
  2⤵
  PID:8776
- C:\Windows\System\ooUdFzS.exe
  C:\Windows\System\ooUdFzS.exe
  2⤵
  PID:14340
- C:\Windows\System\ZrmDGWL.exe
  C:\Windows\System\ZrmDGWL.exe
  2⤵
  PID:14368
- C:\Windows\System\IvksxsY.exe
  C:\Windows\System\IvksxsY.exe
  2⤵
  PID:14396
- C:\Windows\System\XKEdhxU.exe
  C:\Windows\System\XKEdhxU.exe
  2⤵
  PID:14416
- C:\Windows\System\ZlsGoaV.exe
  C:\Windows\System\ZlsGoaV.exe
  2⤵
  PID:14444
- C:\Windows\System\cTBUpOM.exe
  C:\Windows\System\cTBUpOM.exe
  2⤵
  PID:14472
- C:\Windows\System\UnOlzkW.exe
  C:\Windows\System\UnOlzkW.exe
  2⤵
  PID:14512
- C:\Windows\System\XRoTCfs.exe
  C:\Windows\System\XRoTCfs.exe
  2⤵
  PID:14540
- C:\Windows\System\DegaLIM.exe
  C:\Windows\System\DegaLIM.exe
  2⤵
  PID:14576
- C:\Windows\System\tDsqEgD.exe
  C:\Windows\System\tDsqEgD.exe
  2⤵
  PID:14600
- C:\Windows\System\MGoBECp.exe
  C:\Windows\System\MGoBECp.exe
  2⤵
  PID:14624
- C:\Windows\System\eYpXZwU.exe
  C:\Windows\System\eYpXZwU.exe
  2⤵
  PID:14648
- C:\Windows\System\sMZKZjB.exe
  C:\Windows\System\sMZKZjB.exe
  2⤵
  PID:14684
- C:\Windows\System\xrsBgDx.exe
  C:\Windows\System\xrsBgDx.exe
  2⤵
  PID:14712
- C:\Windows\System\pWmcFkE.exe
  C:\Windows\System\pWmcFkE.exe
  2⤵
  PID:14736
- C:\Windows\System\lmQHUpt.exe
  C:\Windows\System\lmQHUpt.exe
  2⤵
  PID:14760
- C:\Windows\System\kEwqfQp.exe
  C:\Windows\System\kEwqfQp.exe
  2⤵
  PID:14776
- C:\Windows\System\iKbXBiD.exe
  C:\Windows\System\iKbXBiD.exe
  2⤵
  PID:14812
- C:\Windows\System\esJOFku.exe
  C:\Windows\System\esJOFku.exe
  2⤵
  PID:14928
- C:\Windows\System\BjFTWfW.exe
  C:\Windows\System\BjFTWfW.exe
  2⤵
  PID:14952
- C:\Windows\System\OObqFdN.exe
  C:\Windows\System\OObqFdN.exe
  2⤵
  PID:15008
- C:\Windows\System\mawTjVb.exe
  C:\Windows\System\mawTjVb.exe
  2⤵
  PID:15024
- C:\Windows\System\JdrUVuf.exe
  C:\Windows\System\JdrUVuf.exe
  2⤵
  PID:15040
- C:\Windows\System\EIcLxss.exe
  C:\Windows\System\EIcLxss.exe
  2⤵
  PID:15092
- C:\Windows\System\ntfbina.exe
  C:\Windows\System\ntfbina.exe
  2⤵
  PID:15124
- C:\Windows\System\ntycENT.exe
  C:\Windows\System\ntycENT.exe
  2⤵
  PID:15160
- C:\Windows\System\PKlQXjJ.exe
  C:\Windows\System\PKlQXjJ.exe
  2⤵
  PID:15196
- C:\Windows\System\gmUgOar.exe
  C:\Windows\System\gmUgOar.exe
  2⤵
  PID:15236
- C:\Windows\System\FrdOYxp.exe
  C:\Windows\System\FrdOYxp.exe
  2⤵
  PID:15256
- C:\Windows\System\vMoYfvE.exe
  C:\Windows\System\vMoYfvE.exe
  2⤵
  PID:15284
- C:\Windows\System\oavMSNW.exe
  C:\Windows\System\oavMSNW.exe
  2⤵
  PID:15324
- C:\Windows\System\eUagfyZ.exe
  C:\Windows\System\eUagfyZ.exe
  2⤵
  PID:15340
- C:\Windows\System\endJDwk.exe
  C:\Windows\System\endJDwk.exe
  2⤵
  PID:14356
- C:\Windows\System\VLaXkuk.exe
  C:\Windows\System\VLaXkuk.exe
  2⤵
  PID:14404
- C:\Windows\System\cdBExEQ.exe
  C:\Windows\System\cdBExEQ.exe
  2⤵
  PID:14456
- C:\Windows\System\CubMFDR.exe
  C:\Windows\System\CubMFDR.exe
  2⤵
  PID:14548
- C:\Windows\System\TzKGhzP.exe
  C:\Windows\System\TzKGhzP.exe
  2⤵
  PID:14612
- C:\Windows\System\ifJYnDx.exe
  C:\Windows\System\ifJYnDx.exe
  2⤵
  PID:14672
- C:\Windows\System\zaIqeOO.exe
  C:\Windows\System\zaIqeOO.exe
  2⤵
  PID:14744
- C:\Windows\System\QMASEbH.exe
  C:\Windows\System\QMASEbH.exe
  2⤵
  PID:14792
- C:\Windows\System\NDpQAPt.exe
  C:\Windows\System\NDpQAPt.exe
  2⤵
  PID:14884
- C:\Windows\System\axUJwIN.exe
  C:\Windows\System\axUJwIN.exe
  2⤵
  PID:14820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bjebqedw.dtn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AfEEnwj.exe

Filesize
2.1MB

MD5
2ce8aaf83cb94f54a75bab9f4f06c41d

SHA1
4c1443869f5ea10e44061816ec45376932879822

SHA256
973481751084449d8dfd9d8ad855cc91e6ae5f68b058fda15e24be644befca77

SHA512
ab0cea85e4f1cd49957946d87e4402766ce80817f404d8b5b82b50d549ad9d7f732573955d975baf2383b6dd8139d932f7f2b00a8415d090fe880c9a1bea0313

Download Submit
C:\Windows\System\DqaUWdl.exe

Filesize
2.1MB

MD5
c7bfbbf30a7ae6fb95bef5eba79fc468

SHA1
b1410e0751afe147dc689b55e833bff274dc401d

SHA256
e8afbd0f3d86eef61fa5a11843ca2fef3b067a8dee2b8969f7909bcd6574fcf9

SHA512
46ce1cb8a20faf18834664a374f271ad3a4f9faf87e81dcb0f2a04d31b09064bb65cc2408dc783a61a37b6eaca40fb002efc2089698de40eadb36612e6a63327

Download Submit
C:\Windows\System\EYbITmZ.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\System\FCeUziI.exe

Filesize
2.1MB

MD5
1b2459236d0756e209bf80accaa2c53c

SHA1
28c797f82a2891278c40ba4bff2dbd9b14ab909e

SHA256
109e64e69b0c9c8bc408879cd4762ce5ad4065805da69cbbb156aff9f7d6f96b

SHA512
8e22d8a1954defd1b9d7fc9be74b029b5b2716026e6142060858ab57a5b81f8bb526ebd650c21f8be0f4fbe2c74aec2dceba14b3035e16970f8e8689b513f088

Download Submit
C:\Windows\System\FnamDel.exe

Filesize
2.1MB

MD5
0893fa51785f75646785b78fb8a844d2

SHA1
cf8d3439ea6fea7a8368f87b1ced0b3869339d0a

SHA256
cbfd294293048217fc8009ef87fbd94d04bcb7ad60f48ad78788121056bb3bdd

SHA512
6325d13acc16bb8ca79b60da943b35d9c56c3e4f330fcff702bb4b6b86a8d42a57057e47a57fdc7596ed0d80b9be425c93e8901f2fc849ba22c672890c0edf75

Download Submit
C:\Windows\System\FtwAeiT.exe

Filesize
2.1MB

MD5
a6af946e6b43d70c2e732f15cb56a5c8

SHA1
3601bcb08d981c9f4b9235646365f427580a3137

SHA256
51eb2a2f600206593d908ac26514ef81620ce908ffa12254a621150d8132fb56

SHA512
99720d292bf7e87d457725a7c4da31d22b3c7b86e47f2cfd6dd0e00a1c25000b522315208f8a2acb6702a847b414e4c2111ce001886cbf4fcef88b2461f7bc56

Download Submit
C:\Windows\System\GDHPLoB.exe

Filesize
2.1MB

MD5
3b89ec3051c817b20f232632c1d40795

SHA1
3ce0fd3da4bd6c117a29f4f5c7efdf41e9043e0e

SHA256
cc6b76ded8da8564f54e51a85e4e5e42da9599178adec960d882b19f868d3610

SHA512
67620de093154ee9ef98722d71e3ab7746ab40acd401ff0367ff904f3011ec3fb1941b4f0f5ce4cb418e15fa64a52369491614eae8917a907f3c1e71ebe94a83

Download Submit
C:\Windows\System\HbGoayG.exe

Filesize
2.1MB

MD5
e086b3296d3b4c96a2b0c7bf30b0f3dc

SHA1
590c4a738ddc3273a7bd9fa548c5b68923686edf

SHA256
a00c65f9c072956ae1ec02227cf90808e751a3587f804e53dde595bd39f8a6fd

SHA512
c37d32eb83c01f7c463cbb38ea07fd7b6bd881696ec63ab0b9d10227c02a029fc981e850aebb9197cdf96592b5f0eee42894162436aa46a584a29f83814d06c5

Download Submit
C:\Windows\System\NKIxPzC.exe

Filesize
2.1MB

MD5
f93bb8fba4c1021a6c54a6c0319f9c70

SHA1
df94c7255a8cd45f97d4872dd72ec854598f59bd

SHA256
d1c029eece480d503ba0122ab4df6c7947807096a8028a9912554d6204c2a3d1

SHA512
11b53f5ad90d835e40a2b1e01b7c26b32265869bf88050cfe39e9295b80a285ac2e8e666bcfe898f55307a8ffaac2342fad3625b512e3e46c5d7d972b460730f

Download Submit
C:\Windows\System\PBnFfvF.exe

Filesize
2.1MB

MD5
4b5ae0813665fa9ee4a7bab89288e179

SHA1
35d32a3388d134bc3a6f494c3ad5c2d98c166c54

SHA256
06cd3516a3d601b578843c9d7633d60ae7425429ad7a94f8cc5936924fbc9ce9

SHA512
6f5e97fad8a6438f17365db97989282255d1cb0977c0aff2d6438598be12817139fb18269be6d973c0d3f50e354beeccfb84766ad84e025c31fc9f9eaa801aee

Download Submit
C:\Windows\System\QmVsjuH.exe

Filesize
2.1MB

MD5
b502d9e85edcb992e9ee4a0412dc0890

SHA1
c5e9bd65dfeb493d7f7bd0b0bda338403b091538

SHA256
895d6f6a9d29128e2e58016933d90d03d5c52b0a3d89642cfcdf923eac8185e0

SHA512
19ec296347c20903210faa5f14efcb774ae4dfa6a1e08d94c2bba7a4cdd97cc78327e1ea1f7cc0bb1f84c32984dea9d6d353e3bf6dc11a95244025ef432a5688

Download Submit
C:\Windows\System\QpUkmrZ.exe

Filesize
2.1MB

MD5
6f34286f61c2d357f231143f4b8c9051

SHA1
671457c568ab59437f9c4191e4074fb86c26f61f

SHA256
f982af52103a3afe52e3fd3f0cf7ae82f06297ba31e7ac1a9616fd384e0103dd

SHA512
18e9c03f4a988c6fc3517c1869e6da086b96d68833e49cae4b3274eb71f469652fe43ef2eeba67413918374b5009790e8e83147f5ae6849c82208cc576630d06

Download Submit
C:\Windows\System\RahMceh.exe

Filesize
18B

MD5
6fe0013890c63ded4f8ff8d16df87289

SHA1
289a7f6e7968aae7b8549ffdd9b978b9db978f87

SHA256
f199c68e43f0f5c8e50bcae2d18e89d3e5e39dfc93aaed12249762ab112691d0

SHA512
d134172fdc11063e45454e6619b8bda3721fc09f325a67b3b4cca8ebbee69cce74d83053e73b70efdb9a6a1fc832c4bc1df3f3d00e9ae3195b7ef87287e98e09

Download Submit
C:\Windows\System\SMjdjGo.exe

Filesize
2.1MB

MD5
b2e19b7e63b4be25a0227ee828bb4668

SHA1
0804c6d2d041dcd36fbcbbfb056d7cfb62ba64ec

SHA256
c1733c869e3383ee98f7c66a85b298d173512d7370adf53a54ab57f16c7d9cb6

SHA512
80cd245b47aef2e4900e97aa2435c6996c5465254dd7d1bdc1e51dc158072ab4cc3741ed61bd8c3b1e1c4d13fba0a87cb6348af17b9378241622c2e8bff9dce5

Download Submit
C:\Windows\System\SNaSnFX.exe

Filesize
2.1MB

MD5
d63f535f102d359054cbf21447f21601

SHA1
4c20f81afbf614970cc6e20aea906a856170600a

SHA256
04c0690f70f31c10b811e4b3560971c59ba6d6b4d3e5683d108583e5d9f58763

SHA512
72a26ece1bf95d48e0bf8370dc621072f07b8ee06d761fcb874bc65cedb00f17eb0bbfefccf1c3ba244341ea4a7ef6b644de3752e6f37c285ba5ef5cb5ef2ac0

Download Submit
C:\Windows\System\TJEmRzq.exe

Filesize
2.1MB

MD5
783f3f4377300ecdcb01b97e21a12896

SHA1
5d26f51b7720ebd52f2e6d58e8cb4184a1d1615d

SHA256
598f0dae050749fd3ccef1934df4ef0ac0c0164e1489b784f8fffb0a50b523a8

SHA512
7c447b7dc389a82e30beed0fb8cfd74236526e1396c94b2a50dfab97d9e0a4d9e3500ebf6fefa4f21e141abe357a287857f3dde72f92df8757456dfa12f73e8e

Download Submit
C:\Windows\System\VlVZixX.exe

Filesize
2.1MB

MD5
67a116a70b1c02fd728fc116d83e1958

SHA1
2818983d7630f62ce10e1739ae475d9b736c2e5a

SHA256
bf08bc50aa44137b2d2277ccd02583cac2b290a8a36f606dc8c9fe8983d4212e

SHA512
319b6c24bf958a1df72d19fa3f4c55a5e575d452a11f48c827ad61314e009bcdc51e52337b0237d07dc4084f9d56a4d842c61d55e4f4285946d734049a20ad42

Download Submit
C:\Windows\System\aumPCAq.exe

Filesize
2.1MB

MD5
339002b2d561755e3c8a342b8c00d9a0

SHA1
c0c3c0c44a600b89387fa183474fe79c82b0153b

SHA256
fa623d87ec06c84f77df9ffba4be7137d18c52ecb1bcfa33d7e43d3d562f9a39

SHA512
33bbcbb2e3202c31ce9db2fc7768baa5e406855ed4bdf2e8c1a83b121b90d789a135f25366de9f4229ff83156fccf9bac4d33f5087428d8d86c107f0b517b52f

Download Submit
C:\Windows\System\bLrNXlU.exe

Filesize
2.1MB

MD5
173cea5b5c3022096efe988d7a7f26c0

SHA1
0d400b805c2d7836ad4e3b6e1569a3e95e74539a

SHA256
a3da96a65b14df04070fd11f79823444b46ceb23adf8cb220e039a69bc00348d

SHA512
abc51852cdc07cfbaca95caccf43b6a2aa9a46935456ce4241c266b44250a795785b550611f48c5b2091d14b5c3412013712dde5c6be9edd2866cecc1a9421c2

Download Submit
C:\Windows\System\dZrjwmm.exe

Filesize
2.1MB

MD5
6901402e821e348c07c563938be77f8c

SHA1
a2b94e219ea438cb145c38311a2cdd03377e8f92

SHA256
c890c2824ab1ad57394c4f83045f66cfd978657a81495065f1247ee7d734e2ae

SHA512
182a8e6144922f7320bf6272ce98682ef48e45ca10925ff0f8a4ffa72c102e3af14ac0ff8cfa7b7b3b13bb21a14f8ab430d9f83b898ff5de5119a1289eb5f8d6

Download Submit
C:\Windows\System\dgdMXNN.exe

Filesize
2.1MB

MD5
94f69a2b83762f0109f2ac861177d1eb

SHA1
f778d8d6077fcad0324c1a7d00ea33b0390113d2

SHA256
798eebfc8d7521deb70ca0bbf718dab7e8bf3540d76e18cd3fd491c75c6970a8

SHA512
f2db37e1cbf88c87a819058f6f6c64794fde0f8822612a3dd4d28287597c596da936a508cbc8e74a714f3750aee1162e0919212e8e9b8a85d4fa628fe92bb121

Download Submit
C:\Windows\System\eCnHofb.exe

Filesize
2.1MB

MD5
ada5ed1214a8e0df382628f64e8c1789

SHA1
d10b1314b64f4219c96ade194b51a1eecaa302b1

SHA256
3ff0410e94206f9b79647999b08a3d3f831008ab91c9c3dc090216506e46a60e

SHA512
dd94b48e1fae47fc5eea199175d5a95f63f22d63ffb45552052b65f2201c012c6e77d2d4a38773c13340d40d62ae69b1430a8eb93ff90ec9c3890f2a5a4a2021

Download Submit
C:\Windows\System\gUTpcps.exe

Filesize
2.1MB

MD5
20c182e419f4eec1ebdcd7acfde73d79

SHA1
270a9f82ffb9b1817f367e613d2288f09d72d1fc

SHA256
3ff96c5f8a690fe16857c141e1851914760885872ff09f606d6d29271155bc4d

SHA512
0127a5e19f006a982e938ba48509e42dab1818aa6f368fea41f7d060930549aec5cccf01873302dd962f2633d254c43197cd735f638b558abac7545606692942

Download Submit
C:\Windows\System\gnYODlY.exe

Filesize
2.1MB

MD5
5a83bcb6f7fdee94df9af4dfc9be8a25

SHA1
8db4542caeb8cc0860c44e7c863374b23b368d08

SHA256
5186220eecee194db8866a6bcdeb5865506a3fe2ba4302f1a8544fc05ece65e6

SHA512
c585bcf6a997dd05fad423a49cb7874ffb3f2b1f63787623e47f33505cd61b2e17898a852571bbea5047086ab73156036f106eb67933e20ad9e94054a95ff355

Download Submit
C:\Windows\System\jApPGqJ.exe

Filesize
2.1MB

MD5
92a3ef441305958e604bc1f352706c5d

SHA1
e6e43aad4f9e06d07048202ff1f7ca8e5946abab

SHA256
cf0ddc9e87f852e2ce4e54f33d96c93d4cd59c7706fb19b09382266bf708197e

SHA512
63e3539819df0ea903380ee3a1f95686dcc99107c4fd6fb9b90167ba71e8910cac62bcbf5f630f24b2774ed93e19ead73ea8a85f52979da160bcacebf9c4e225

Download Submit
C:\Windows\System\kxNwkri.exe

Filesize
2.1MB

MD5
a9cd067acf99f6229b6e629d841400ce

SHA1
c0c0bade399b65a2df4c98518f32f2f8d4b5a1cf

SHA256
40ba696723ff466f90dcbcd959306213288c158e32e43b88e5c7c5a7fdf48f6b

SHA512
a8de1d04ae85e432307cc8755d9903c99bf26cc6cdb5265ae2a5ba7ff9544fd16dbeaf8eebe437248e5ccf28d961840adb5599b6c46438ebb476f1ba63d74a37

Download Submit
C:\Windows\System\nhXvpuE.exe

Filesize
2.1MB

MD5
72f9d74a288d553ff5f8760346a524bf

SHA1
a53161a0072c735b7576afecbe962a2610ef8dfb

SHA256
c9aa52f393169e581ed5a178267d7fbbcd8f1eed8b410c62b99678492a3dd38d

SHA512
0b1d7782000ecd5b60168f4d8b52cd9d4b9830871478a7e93f2e08a2149f6c22ee4982643b554d80303b7bbf8ed2d5fe9445d4ea9d36c5bff7984f240281e427

Download Submit
C:\Windows\System\uSTaxeF.exe

Filesize
2.1MB

MD5
8b8c50bdb069e808b336f840dc73b3ea

SHA1
a3a1502f016715088d98f2b60996f5ba6ffc0d50

SHA256
ba50c06eea87e2c8902df61513979bba492bff551a89ef05e466173bdd04b813

SHA512
4cc9ebd7c823034ed81968d9f8ca0ce9beab8b2ad92ec554f4d9013119ba2893ed45fc13fa275d30bd43be97903cff6ce7e72672b3c7c6352569593d14a9071a

Download Submit
C:\Windows\System\wIyPPft.exe

Filesize
2.1MB

MD5
4dce7dbcd02b616ff87d224611903c88

SHA1
6dd898bf29e7bbcdc9c4c9e8d5885730862750e5

SHA256
af828a20c7388335e818f4dc77fecbf7063379263d3d81e67e173c493c5233cd

SHA512
3b639ee7fe5fcb0aee8acc62a799bae7516b150076af9df7c774dcdc9ea6ff93843f5c4330f717a3383dd8b1f74174d4939d32f3c62e6061762796a808a9e758

Download Submit
C:\Windows\System\wTlWlfu.exe

Filesize
2.1MB

MD5
2ff8254ff1ba0d4eaeded5531f823390

SHA1
05a26ef614a285aed0cd56ceecbea2702458e280

SHA256
8317f91b8a456e3affa3cb9b06a6688759e8ffc4da2ee6fda30d78d8d77a4a6d

SHA512
5faff42630a838045b1980cf1cd06925a3d760c249efb654e5d9a68ed3045b9ab549ffba84580c5846f5a480e4801b0f78f2c7ed7249a7360e72657ae008a91a

Download Submit
C:\Windows\System\wdDuSIr.exe

Filesize
2.1MB

MD5
8d6f526ca79bfdad045e49be68252afb

SHA1
729c37bde5013a923583412754cff74375b5c208

SHA256
6882ecbd7933a9be6e77164d7d372a8ed4618bf027dafddc23f21a7b2a929efa

SHA512
ec4cb57aa7bd8b7f22dcfaf255f95981bc74d4dd190d8bf5d04234c705891dba516b9491f48ef918c825ee3a9dbc0903b502f8309e46073fef771ebec1fdfe28

Download Submit
C:\Windows\System\wjPbVmq.exe

Filesize
2.1MB

MD5
65bfe0ed1adb0841fc7d91d33dce4247

SHA1
17f42db37e5e9cc4b29e21e40596aa6c52246167

SHA256
5019e1134cab88d83f40626d3104bd869582f55314f5f23bf44165997f5514e7

SHA512
34aaefbeb19b78420c54804295f3dc17bc91c75a0492140d8fc10f1d877b3ae759e2dd4e4052aa2d8418ca9beee583ef515447970d2efdc85e1a0e6093e882ba

Download Submit
C:\Windows\System\xgVocxB.exe

Filesize
2.1MB

MD5
02e61d68d816dfd67102dda8ceef180b

SHA1
5dc39b0ab2a4a9db3f3dff8c904ffa6124fd1242

SHA256
6c62e0d48e5fce11360f311a3525e30f231901191a515e403584bee55e59bfaf

SHA512
1de2375cf750aa7ec5d0624a4eb8a5ab0e8dea1a77ba31d0d95706738c0feb02b6bc7b9dfb2cfb5ee05e4366c17c339f7330796feeaa8da87410eb9bc17cf4c9

Download Submit
C:\Windows\System\xySWZOt.exe

Filesize
2.1MB

MD5
eff71b0dc81cfd55dcbcc25a655185e8

SHA1
4de795d0cbb359af1c85a71f077528b2cc389ab0

SHA256
005ed6ad51276f0b98b09de9c85d2382f17eb06253a7d937b344046ef466724c

SHA512
02f34dc4804bb85c420ab843bfca91dbccb8f705f3de25bcc73913f06712d44b7113eb99f8bf5aa96e1bd2b0e2aaa5da15f002b201e682c701a6e6adb37282ef

Download Submit
C:\Windows\System\zwItQmw.exe

Filesize
2.1MB

MD5
9da92b3347e3350405594fb05068a587

SHA1
802370547b3191001ba6b16f792e91514e7f460a

SHA256
7c7efbc538a78f2ff0dc67c2b4bb1cc33857aa1d58136e08da87a13f161e3088

SHA512
cad05a5d4b3e51841991a8e1e522acbd45f05f6cb3c40a23c82229c8a3ff4e6607604797e4e3c329fa56e7b3a75c540e71e468276591db42877e7e1df992331a

Download Submit
memory/8-496-0x00007FF6D3320000-0x00007FF6D3712000-memory.dmp

Filesize
3.9MB

Download
memory/8-4635-0x00007FF6D3320000-0x00007FF6D3712000-memory.dmp

Filesize
3.9MB

Download
memory/60-511-0x00007FF660F40000-0x00007FF661332000-memory.dmp

Filesize
3.9MB

Download
memory/444-543-0x00007FF76C8E0000-0x00007FF76CCD2000-memory.dmp

Filesize
3.9MB

Download
memory/632-549-0x00007FF6DC210000-0x00007FF6DC602000-memory.dmp

Filesize
3.9MB

Download
memory/688-1660-0x00007FF8036A0000-0x00007FF804161000-memory.dmp

Filesize
10.8MB

Download
memory/688-23-0x00007FF8036A0000-0x00007FF804161000-memory.dmp

Filesize
10.8MB

Download
memory/688-25-0x000002A019CD0000-0x000002A019CE0000-memory.dmp

Filesize
64KB

Download
memory/688-43-0x000002A031FB0000-0x000002A031FD2000-memory.dmp

Filesize
136KB

Download
memory/1016-0-0x00007FF780840000-0x00007FF780C32000-memory.dmp

Filesize
3.9MB

Download
memory/1016-1-0x000001E857F10000-0x000001E857F20000-memory.dmp

Filesize
64KB

Download
memory/1180-4600-0x00007FF76CC40000-0x00007FF76D032000-memory.dmp

Filesize
3.9MB

Download
memory/1180-28-0x00007FF76CC40000-0x00007FF76D032000-memory.dmp

Filesize
3.9MB

Download
memory/1476-558-0x00007FF7793E0000-0x00007FF7797D2000-memory.dmp

Filesize
3.9MB

Download
memory/1476-4740-0x00007FF7793E0000-0x00007FF7797D2000-memory.dmp

Filesize
3.9MB

Download
memory/1700-505-0x00007FF670D00000-0x00007FF6710F2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-532-0x00007FF613BE0000-0x00007FF613FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-570-0x00007FF60C6B0000-0x00007FF60CAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-4622-0x00007FF60C6B0000-0x00007FF60CAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-4664-0x00007FF765240000-0x00007FF765632000-memory.dmp

Filesize
3.9MB

Download
memory/2632-515-0x00007FF765240000-0x00007FF765632000-memory.dmp

Filesize
3.9MB

Download
memory/2864-4587-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-559-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-4640-0x00007FF622D30000-0x00007FF623122000-memory.dmp

Filesize
3.9MB

Download
memory/3024-499-0x00007FF622D30000-0x00007FF623122000-memory.dmp

Filesize
3.9MB

Download
memory/3512-49-0x00007FF720C50000-0x00007FF721042000-memory.dmp

Filesize
3.9MB

Download
memory/3876-4710-0x00007FF71CD60000-0x00007FF71D152000-memory.dmp

Filesize
3.9MB

Download
memory/3876-554-0x00007FF71CD60000-0x00007FF71D152000-memory.dmp

Filesize
3.9MB

Download
memory/4036-4625-0x00007FF7DB370000-0x00007FF7DB762000-memory.dmp

Filesize
3.9MB

Download
memory/4036-576-0x00007FF7DB370000-0x00007FF7DB762000-memory.dmp

Filesize
3.9MB

Download
memory/4840-495-0x00007FF7596C0000-0x00007FF759AB2000-memory.dmp

Filesize
3.9MB

Download
memory/4904-4628-0x00007FF6A9DA0000-0x00007FF6AA192000-memory.dmp

Filesize
3.9MB

Download
memory/4904-580-0x00007FF6A9DA0000-0x00007FF6AA192000-memory.dmp

Filesize
3.9MB

Download
memory/4916-36-0x00007FF6F2950000-0x00007FF6F2D42000-memory.dmp

Filesize
3.9MB

Download
memory/4936-518-0x00007FF61C940000-0x00007FF61CD32000-memory.dmp

Filesize
3.9MB

Download
memory/5004-4612-0x00007FF6C5100000-0x00007FF6C54F2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-494-0x00007FF6C5100000-0x00007FF6C54F2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-4685-0x00007FF6000E0000-0x00007FF6004D2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-526-0x00007FF6000E0000-0x00007FF6004D2000-memory.dmp

Filesize
3.9MB

Download