xmrig | 68882589f65c3e5a0657529d1104c2603c69204d572dc90c6615511570dd863a

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
Size

2.1MB
MD5

0a9ec5a9494ccdb3b944ba90ed587e15
SHA1

c7da4167ac3fb41fa71d2defa9ab252ecd50a21f
SHA256

68882589f65c3e5a0657529d1104c2603c69204d572dc90c6615511570dd863a
SHA512

992de9fcfaece30eb5f4ca404e206c3b49f290a6e68cccaef903328ae9c5ca2bb036b1768b4844f1062c0b31d12301e7030b7f266e53f4987b750702317c021f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrp:NABy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/4948-196-0x00007FF763110000-0x00007FF763502000-memory.dmp	xmrig
behavioral2/memory/3488-245-0x00007FF6BFD20000-0x00007FF6C0112000-memory.dmp	xmrig
behavioral2/memory/824-246-0x00007FF6CB890000-0x00007FF6CBC82000-memory.dmp	xmrig
behavioral2/memory/4320-279-0x00007FF600500000-0x00007FF6008F2000-memory.dmp	xmrig
behavioral2/memory/2884-286-0x00007FF6F14B0000-0x00007FF6F18A2000-memory.dmp	xmrig
behavioral2/memory/2380-285-0x00007FF6DF3C0000-0x00007FF6DF7B2000-memory.dmp	xmrig
behavioral2/memory/3168-284-0x00007FF6F51E0000-0x00007FF6F55D2000-memory.dmp	xmrig
behavioral2/memory/4368-283-0x00007FF764430000-0x00007FF764822000-memory.dmp	xmrig
behavioral2/memory/1656-282-0x00007FF67AB70000-0x00007FF67AF62000-memory.dmp	xmrig
behavioral2/memory/1996-281-0x00007FF69BED0000-0x00007FF69C2C2000-memory.dmp	xmrig
behavioral2/memory/4660-280-0x00007FF6D7230000-0x00007FF6D7622000-memory.dmp	xmrig
behavioral2/memory/4512-278-0x00007FF7A9420000-0x00007FF7A9812000-memory.dmp	xmrig
behavioral2/memory/784-273-0x00007FF7BEA70000-0x00007FF7BEE62000-memory.dmp	xmrig
behavioral2/memory/3236-240-0x00007FF6B8DB0000-0x00007FF6B91A2000-memory.dmp	xmrig
behavioral2/memory/224-239-0x00007FF6A1320000-0x00007FF6A1712000-memory.dmp	xmrig
behavioral2/memory/1584-228-0x00007FF7737B0000-0x00007FF773BA2000-memory.dmp	xmrig
behavioral2/memory/1728-227-0x00007FF7F6CD0000-0x00007FF7F70C2000-memory.dmp	xmrig
behavioral2/memory/1596-171-0x00007FF665AC0000-0x00007FF665EB2000-memory.dmp	xmrig
behavioral2/memory/732-161-0x00007FF6E0C70000-0x00007FF6E1062000-memory.dmp	xmrig
behavioral2/memory/2948-129-0x00007FF763250000-0x00007FF763642000-memory.dmp	xmrig
behavioral2/memory/3428-6075-0x00007FF671BE0000-0x00007FF671FD2000-memory.dmp	xmrig
behavioral2/memory/2948-6092-0x00007FF763250000-0x00007FF763642000-memory.dmp	xmrig
behavioral2/memory/224-6114-0x00007FF6A1320000-0x00007FF6A1712000-memory.dmp	xmrig
behavioral2/memory/1596-6155-0x00007FF665AC0000-0x00007FF665EB2000-memory.dmp	xmrig
behavioral2/memory/4368-6182-0x00007FF764430000-0x00007FF764822000-memory.dmp	xmrig
behavioral2/memory/1996-6166-0x00007FF69BED0000-0x00007FF69C2C2000-memory.dmp	xmrig
behavioral2/memory/732-6144-0x00007FF6E0C70000-0x00007FF6E1062000-memory.dmp	xmrig
behavioral2/memory/784-6150-0x00007FF7BEA70000-0x00007FF7BEE62000-memory.dmp	xmrig
behavioral2/memory/4320-6137-0x00007FF600500000-0x00007FF6008F2000-memory.dmp	xmrig
behavioral2/memory/2884-6104-0x00007FF6F14B0000-0x00007FF6F18A2000-memory.dmp	xmrig
behavioral2/memory/2380-6085-0x00007FF6DF3C0000-0x00007FF6DF7B2000-memory.dmp	xmrig
behavioral2/memory/1656-6186-0x00007FF67AB70000-0x00007FF67AF62000-memory.dmp	xmrig
behavioral2/memory/3488-6201-0x00007FF6BFD20000-0x00007FF6C0112000-memory.dmp	xmrig
behavioral2/memory/3168-6181-0x00007FF6F51E0000-0x00007FF6F55D2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	888	powershell.exe
6	888	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3428	MMxXZTG.exe
2380	yTqgwUH.exe
2948	IWOYior.exe
2884	ZGEkhTW.exe
732	lWtTYNI.exe
1596	NGKAxdy.exe
4948	mcEceDo.exe
1728	HnYHeWL.exe
1584	yrsnjSk.exe
224	WxrSgqC.exe
3236	ZzTaRSW.exe
3488	sYvbcyI.exe
824	TuzVCnf.exe
784	Cgcukgu.exe
4512	WMkynRY.exe
4320	uEgjkFS.exe
4660	LvXwUuk.exe
1996	TyzEfoO.exe
1656	AEOozDm.exe
4368	ykXOgyW.exe
3168	CPMjvYS.exe
2976	vdSvkJS.exe
1880	ZeKRkfq.exe
4148	EgAjzwl.exe
3828	cjrDITv.exe
2156	Qhidwdu.exe
1160	hOguUkR.exe
1356	NHMrmDM.exe
2428	FYWBsAv.exe
2400	AKMRJVC.exe
820	ubDHWXf.exe
4828	bcvHARD.exe
4136	hujgJtp.exe
624	asuQagf.exe
4440	rogZSiR.exe
2424	wYauuhf.exe
4892	eQeejwK.exe
2412	yyZnYQa.exe
4000	aoUuECZ.exe
4628	bVpFmCb.exe
4132	yQiCPdy.exe
772	KMhNPKg.exe
1536	jVjznZI.exe
1788	NsQNmok.exe
3476	yizlSsK.exe
3232	aKIyWna.exe
2100	muimYaz.exe
1516	igWXEOb.exe
4156	QBQYOlj.exe
4708	LDQvKJD.exe
1144	eMDlYVA.exe
1288	whrcsQG.exe
1844	aMCAuir.exe
4380	fHcrdxC.exe
4792	COOZeRe.exe
4716	cQRmbwK.exe
4908	iXTqsSh.exe
5032	jaimXoH.exe
768	MvWsKSK.exe
3784	HwmRrTs.exe
900	YnRuGou.exe
5076	kNtqOqu.exe
4044	DEttpvj.exe
3436	dZaAWSZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3240-0-0x00007FF71AD40000-0x00007FF71B132000-memory.dmp	upx
behavioral2/files/0x0006000000023298-5.dat	upx
behavioral2/files/0x0007000000023418-8.dat	upx
behavioral2/files/0x0008000000023417-14.dat	upx
behavioral2/files/0x000700000002341f-43.dat	upx
behavioral2/files/0x0007000000023422-61.dat	upx
behavioral2/files/0x0007000000023427-97.dat	upx
behavioral2/files/0x0007000000023424-125.dat	upx
behavioral2/files/0x0007000000023421-177.dat	upx
behavioral2/memory/4948-196-0x00007FF763110000-0x00007FF763502000-memory.dmp	upx
behavioral2/memory/3488-245-0x00007FF6BFD20000-0x00007FF6C0112000-memory.dmp	upx
behavioral2/memory/824-246-0x00007FF6CB890000-0x00007FF6CBC82000-memory.dmp	upx
behavioral2/memory/4320-279-0x00007FF600500000-0x00007FF6008F2000-memory.dmp	upx
behavioral2/memory/2884-286-0x00007FF6F14B0000-0x00007FF6F18A2000-memory.dmp	upx
behavioral2/memory/2380-285-0x00007FF6DF3C0000-0x00007FF6DF7B2000-memory.dmp	upx
behavioral2/memory/3168-284-0x00007FF6F51E0000-0x00007FF6F55D2000-memory.dmp	upx
behavioral2/memory/4368-283-0x00007FF764430000-0x00007FF764822000-memory.dmp	upx
behavioral2/memory/1656-282-0x00007FF67AB70000-0x00007FF67AF62000-memory.dmp	upx
behavioral2/memory/1996-281-0x00007FF69BED0000-0x00007FF69C2C2000-memory.dmp	upx
behavioral2/memory/4660-280-0x00007FF6D7230000-0x00007FF6D7622000-memory.dmp	upx
behavioral2/memory/4512-278-0x00007FF7A9420000-0x00007FF7A9812000-memory.dmp	upx
behavioral2/memory/784-273-0x00007FF7BEA70000-0x00007FF7BEE62000-memory.dmp	upx
behavioral2/memory/3236-240-0x00007FF6B8DB0000-0x00007FF6B91A2000-memory.dmp	upx
behavioral2/memory/224-239-0x00007FF6A1320000-0x00007FF6A1712000-memory.dmp	upx
behavioral2/memory/1584-228-0x00007FF7737B0000-0x00007FF773BA2000-memory.dmp	upx
behavioral2/memory/1728-227-0x00007FF7F6CD0000-0x00007FF7F70C2000-memory.dmp	upx
behavioral2/files/0x0007000000023439-181.dat	upx
behavioral2/files/0x0007000000023438-180.dat	upx
behavioral2/files/0x0007000000023437-179.dat	upx
behavioral2/memory/1596-171-0x00007FF665AC0000-0x00007FF665EB2000-memory.dmp	upx
behavioral2/files/0x000700000002342f-167.dat	upx
behavioral2/files/0x0007000000023432-166.dat	upx
behavioral2/files/0x0007000000023436-165.dat	upx
behavioral2/files/0x0007000000023435-164.dat	upx
behavioral2/memory/732-161-0x00007FF6E0C70000-0x00007FF6E1062000-memory.dmp	upx
behavioral2/files/0x0007000000023434-159.dat	upx
behavioral2/files/0x0007000000023430-155.dat	upx
behavioral2/files/0x0007000000023429-154.dat	upx
behavioral2/files/0x000700000002342b-149.dat	upx
behavioral2/files/0x000700000002342a-146.dat	upx
behavioral2/files/0x0007000000023428-144.dat	upx
behavioral2/files/0x0007000000023433-141.dat	upx
behavioral2/files/0x000700000002342e-140.dat	upx
behavioral2/files/0x0007000000023431-133.dat	upx
behavioral2/memory/2948-129-0x00007FF763250000-0x00007FF763642000-memory.dmp	upx
behavioral2/files/0x0007000000023426-121.dat	upx
behavioral2/files/0x000700000002342d-116.dat	upx
behavioral2/files/0x000700000002342c-112.dat	upx
behavioral2/files/0x000700000002341b-109.dat	upx
behavioral2/files/0x0007000000023423-99.dat	upx
behavioral2/files/0x000700000002341d-85.dat	upx
behavioral2/files/0x000700000002341e-82.dat	upx
behavioral2/files/0x0007000000023425-75.dat	upx
behavioral2/files/0x0007000000023420-55.dat	upx
behavioral2/files/0x000700000002341a-50.dat	upx
behavioral2/files/0x000700000002341c-47.dat	upx
behavioral2/files/0x0007000000023419-35.dat	upx
behavioral2/memory/3428-18-0x00007FF671BE0000-0x00007FF671FD2000-memory.dmp	upx
behavioral2/memory/3428-6075-0x00007FF671BE0000-0x00007FF671FD2000-memory.dmp	upx
behavioral2/memory/2948-6092-0x00007FF763250000-0x00007FF763642000-memory.dmp	upx
behavioral2/memory/224-6114-0x00007FF6A1320000-0x00007FF6A1712000-memory.dmp	upx
behavioral2/memory/1596-6155-0x00007FF665AC0000-0x00007FF665EB2000-memory.dmp	upx
behavioral2/memory/4368-6182-0x00007FF764430000-0x00007FF764822000-memory.dmp	upx
behavioral2/memory/1996-6166-0x00007FF69BED0000-0x00007FF69C2C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cFiEWrp.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\lcoeajK.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\NsqeoOi.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\PnNohdf.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\aVJvDGJ.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\YwFxvAT.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\JxGVJmO.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\kBwRfNI.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\DHEdbrU.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\FeFctJm.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\LngYUci.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\CFEnsZo.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\ANBwzUR.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\CHyiASe.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\TFxlVZH.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\fpldKUG.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\jiEEJJm.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\onDIthH.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\pDgsCCu.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\ycyTIyV.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\MEDwcPi.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\qaCjNsZ.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\YNZaluZ.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\YQuGdex.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\cUTRRWW.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\CaBGLBk.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\TUzICPP.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\VoGLyOF.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\ObrlonY.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\ZZFBKrl.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\MPQcZbb.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\nxxtKNd.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\JzrZJUj.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\PbooWcv.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\YIBiCAB.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\VamauUv.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\eUYJjKm.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\FKAJEIb.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\xGhgaNS.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\ydEHAWS.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\uzufkLv.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\HpPyJsO.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\EjbaQUt.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\ZOZMsxe.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\yULnGVw.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\lffxZnT.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\aIQaLSY.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\UfHhbrW.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\yrOdqgk.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\CPMjvYS.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\BtsXVSU.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\YQivOjX.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\FeYnNWP.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\XxkUNnc.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\eQeejwK.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\qsRbGRH.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\qHLmZoP.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\IGfTWYl.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\yJCtSJf.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\eOKnkig.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\VEjTaBI.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\kBoKfqs.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\snxFeeF.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\SFamumJ.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
888	powershell.exe
888	powershell.exe
888	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	888	powershell.exe
Token: SeLockMemoryPrivilege	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 888	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	83
PID 3240 wrote to memory of 888	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	83
PID 3240 wrote to memory of 3428	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	84
PID 3240 wrote to memory of 3428	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	84
PID 3240 wrote to memory of 2380	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	85
PID 3240 wrote to memory of 2380	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	85
PID 3240 wrote to memory of 732	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	86
PID 3240 wrote to memory of 732	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	86
PID 3240 wrote to memory of 2948	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	87
PID 3240 wrote to memory of 2948	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	87
PID 3240 wrote to memory of 2884	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	88
PID 3240 wrote to memory of 2884	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	88
PID 3240 wrote to memory of 1596	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	89
PID 3240 wrote to memory of 1596	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	89
PID 3240 wrote to memory of 4948	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	90
PID 3240 wrote to memory of 4948	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	90
PID 3240 wrote to memory of 1728	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	91
PID 3240 wrote to memory of 1728	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	91
PID 3240 wrote to memory of 1584	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	92
PID 3240 wrote to memory of 1584	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	92
PID 3240 wrote to memory of 224	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	93
PID 3240 wrote to memory of 224	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	93
PID 3240 wrote to memory of 3236	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	94
PID 3240 wrote to memory of 3236	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	94
PID 3240 wrote to memory of 3488	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	95
PID 3240 wrote to memory of 3488	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	95
PID 3240 wrote to memory of 824	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	96
PID 3240 wrote to memory of 824	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	96
PID 3240 wrote to memory of 784	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	97
PID 3240 wrote to memory of 784	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	97
PID 3240 wrote to memory of 4512	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	98
PID 3240 wrote to memory of 4512	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	98
PID 3240 wrote to memory of 4320	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	99
PID 3240 wrote to memory of 4320	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	99
PID 3240 wrote to memory of 4660	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	100
PID 3240 wrote to memory of 4660	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	100
PID 3240 wrote to memory of 1996	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	101
PID 3240 wrote to memory of 1996	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	101
PID 3240 wrote to memory of 1656	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	102
PID 3240 wrote to memory of 1656	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	102
PID 3240 wrote to memory of 2156	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	103
PID 3240 wrote to memory of 2156	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	103
PID 3240 wrote to memory of 4368	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	104
PID 3240 wrote to memory of 4368	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	104
PID 3240 wrote to memory of 3168	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	105
PID 3240 wrote to memory of 3168	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	105
PID 3240 wrote to memory of 2976	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	106
PID 3240 wrote to memory of 2976	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	106
PID 3240 wrote to memory of 1880	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	107
PID 3240 wrote to memory of 1880	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	107
PID 3240 wrote to memory of 4148	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	108
PID 3240 wrote to memory of 4148	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	108
PID 3240 wrote to memory of 3828	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	109
PID 3240 wrote to memory of 3828	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	109
PID 3240 wrote to memory of 1160	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	110
PID 3240 wrote to memory of 1160	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	110
PID 3240 wrote to memory of 1356	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	111
PID 3240 wrote to memory of 1356	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	111
PID 3240 wrote to memory of 4136	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	112
PID 3240 wrote to memory of 4136	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	112
PID 3240 wrote to memory of 2428	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	113
PID 3240 wrote to memory of 2428	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	113
PID 3240 wrote to memory of 2400	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	114
PID 3240 wrote to memory of 2400	3240	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:888
- C:\Windows\System\MMxXZTG.exe
  C:\Windows\System\MMxXZTG.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\yTqgwUH.exe
  C:\Windows\System\yTqgwUH.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\lWtTYNI.exe
  C:\Windows\System\lWtTYNI.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\IWOYior.exe
  C:\Windows\System\IWOYior.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\ZGEkhTW.exe
  C:\Windows\System\ZGEkhTW.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\NGKAxdy.exe
  C:\Windows\System\NGKAxdy.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\mcEceDo.exe
  C:\Windows\System\mcEceDo.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\HnYHeWL.exe
  C:\Windows\System\HnYHeWL.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\yrsnjSk.exe
  C:\Windows\System\yrsnjSk.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\WxrSgqC.exe
  C:\Windows\System\WxrSgqC.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\ZzTaRSW.exe
  C:\Windows\System\ZzTaRSW.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\sYvbcyI.exe
  C:\Windows\System\sYvbcyI.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\TuzVCnf.exe
  C:\Windows\System\TuzVCnf.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\Cgcukgu.exe
  C:\Windows\System\Cgcukgu.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\WMkynRY.exe
  C:\Windows\System\WMkynRY.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\uEgjkFS.exe
  C:\Windows\System\uEgjkFS.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\LvXwUuk.exe
  C:\Windows\System\LvXwUuk.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\TyzEfoO.exe
  C:\Windows\System\TyzEfoO.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\AEOozDm.exe
  C:\Windows\System\AEOozDm.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\Qhidwdu.exe
  C:\Windows\System\Qhidwdu.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\ykXOgyW.exe
  C:\Windows\System\ykXOgyW.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\CPMjvYS.exe
  C:\Windows\System\CPMjvYS.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\vdSvkJS.exe
  C:\Windows\System\vdSvkJS.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\ZeKRkfq.exe
  C:\Windows\System\ZeKRkfq.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\EgAjzwl.exe
  C:\Windows\System\EgAjzwl.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\cjrDITv.exe
  C:\Windows\System\cjrDITv.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\hOguUkR.exe
  C:\Windows\System\hOguUkR.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\NHMrmDM.exe
  C:\Windows\System\NHMrmDM.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\hujgJtp.exe
  C:\Windows\System\hujgJtp.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\FYWBsAv.exe
  C:\Windows\System\FYWBsAv.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\AKMRJVC.exe
  C:\Windows\System\AKMRJVC.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\ubDHWXf.exe
  C:\Windows\System\ubDHWXf.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\bcvHARD.exe
  C:\Windows\System\bcvHARD.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\asuQagf.exe
  C:\Windows\System\asuQagf.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\rogZSiR.exe
  C:\Windows\System\rogZSiR.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\wYauuhf.exe
  C:\Windows\System\wYauuhf.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\eQeejwK.exe
  C:\Windows\System\eQeejwK.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\jVjznZI.exe
  C:\Windows\System\jVjznZI.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\yyZnYQa.exe
  C:\Windows\System\yyZnYQa.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\aoUuECZ.exe
  C:\Windows\System\aoUuECZ.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\bVpFmCb.exe
  C:\Windows\System\bVpFmCb.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\yQiCPdy.exe
  C:\Windows\System\yQiCPdy.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\KMhNPKg.exe
  C:\Windows\System\KMhNPKg.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\NsQNmok.exe
  C:\Windows\System\NsQNmok.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\yizlSsK.exe
  C:\Windows\System\yizlSsK.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\aKIyWna.exe
  C:\Windows\System\aKIyWna.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\muimYaz.exe
  C:\Windows\System\muimYaz.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\igWXEOb.exe
  C:\Windows\System\igWXEOb.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\QBQYOlj.exe
  C:\Windows\System\QBQYOlj.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\LDQvKJD.exe
  C:\Windows\System\LDQvKJD.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\eMDlYVA.exe
  C:\Windows\System\eMDlYVA.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\whrcsQG.exe
  C:\Windows\System\whrcsQG.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\aMCAuir.exe
  C:\Windows\System\aMCAuir.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\fHcrdxC.exe
  C:\Windows\System\fHcrdxC.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\COOZeRe.exe
  C:\Windows\System\COOZeRe.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\cQRmbwK.exe
  C:\Windows\System\cQRmbwK.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\iXTqsSh.exe
  C:\Windows\System\iXTqsSh.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\jaimXoH.exe
  C:\Windows\System\jaimXoH.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\MvWsKSK.exe
  C:\Windows\System\MvWsKSK.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\HwmRrTs.exe
  C:\Windows\System\HwmRrTs.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\YnRuGou.exe
  C:\Windows\System\YnRuGou.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\kNtqOqu.exe
  C:\Windows\System\kNtqOqu.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\DEttpvj.exe
  C:\Windows\System\DEttpvj.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\dZaAWSZ.exe
  C:\Windows\System\dZaAWSZ.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\nfEciWl.exe
  C:\Windows\System\nfEciWl.exe
  2⤵
  PID:4400
- C:\Windows\System\bvaLbSa.exe
  C:\Windows\System\bvaLbSa.exe
  2⤵
  PID:536
- C:\Windows\System\JtvwrVx.exe
  C:\Windows\System\JtvwrVx.exe
  2⤵
  PID:3920
- C:\Windows\System\DcatBgl.exe
  C:\Windows\System\DcatBgl.exe
  2⤵
  PID:1328
- C:\Windows\System\jUvoCAU.exe
  C:\Windows\System\jUvoCAU.exe
  2⤵
  PID:2580
- C:\Windows\System\vRWXVEu.exe
  C:\Windows\System\vRWXVEu.exe
  2⤵
  PID:2408
- C:\Windows\System\wFDXyPw.exe
  C:\Windows\System\wFDXyPw.exe
  2⤵
  PID:3264
- C:\Windows\System\glYMTsO.exe
  C:\Windows\System\glYMTsO.exe
  2⤵
  PID:3096
- C:\Windows\System\njqSDSt.exe
  C:\Windows\System\njqSDSt.exe
  2⤵
  PID:4364
- C:\Windows\System\BFGFasf.exe
  C:\Windows\System\BFGFasf.exe
  2⤵
  PID:984
- C:\Windows\System\bNrtPwo.exe
  C:\Windows\System\bNrtPwo.exe
  2⤵
  PID:3988
- C:\Windows\System\bkaoFYg.exe
  C:\Windows\System\bkaoFYg.exe
  2⤵
  PID:4580
- C:\Windows\System\NEMSVBx.exe
  C:\Windows\System\NEMSVBx.exe
  2⤵
  PID:5136
- C:\Windows\System\gvnXZuI.exe
  C:\Windows\System\gvnXZuI.exe
  2⤵
  PID:5152
- C:\Windows\System\zfIhHnQ.exe
  C:\Windows\System\zfIhHnQ.exe
  2⤵
  PID:5168
- C:\Windows\System\LvxHzzt.exe
  C:\Windows\System\LvxHzzt.exe
  2⤵
  PID:5184
- C:\Windows\System\Rpywutk.exe
  C:\Windows\System\Rpywutk.exe
  2⤵
  PID:5284
- C:\Windows\System\pFoGyaR.exe
  C:\Windows\System\pFoGyaR.exe
  2⤵
  PID:5488
- C:\Windows\System\nxDqFAV.exe
  C:\Windows\System\nxDqFAV.exe
  2⤵
  PID:5520
- C:\Windows\System\gdjvuXg.exe
  C:\Windows\System\gdjvuXg.exe
  2⤵
  PID:5536
- C:\Windows\System\oQvUImE.exe
  C:\Windows\System\oQvUImE.exe
  2⤵
  PID:5564
- C:\Windows\System\TWstdWo.exe
  C:\Windows\System\TWstdWo.exe
  2⤵
  PID:5592
- C:\Windows\System\FahRadQ.exe
  C:\Windows\System\FahRadQ.exe
  2⤵
  PID:5612
- C:\Windows\System\YoAMVgx.exe
  C:\Windows\System\YoAMVgx.exe
  2⤵
  PID:5640
- C:\Windows\System\hrzdxQl.exe
  C:\Windows\System\hrzdxQl.exe
  2⤵
  PID:5660
- C:\Windows\System\qHgKIvd.exe
  C:\Windows\System\qHgKIvd.exe
  2⤵
  PID:5692
- C:\Windows\System\dIONUTk.exe
  C:\Windows\System\dIONUTk.exe
  2⤵
  PID:5708
- C:\Windows\System\MXrTyuz.exe
  C:\Windows\System\MXrTyuz.exe
  2⤵
  PID:5736
- C:\Windows\System\tIaskXQ.exe
  C:\Windows\System\tIaskXQ.exe
  2⤵
  PID:5752
- C:\Windows\System\bvFtbGE.exe
  C:\Windows\System\bvFtbGE.exe
  2⤵
  PID:5772
- C:\Windows\System\AfQayLR.exe
  C:\Windows\System\AfQayLR.exe
  2⤵
  PID:5792
- C:\Windows\System\zYMtAbV.exe
  C:\Windows\System\zYMtAbV.exe
  2⤵
  PID:5820
- C:\Windows\System\OPLaqhw.exe
  C:\Windows\System\OPLaqhw.exe
  2⤵
  PID:5848
- C:\Windows\System\AATLTHY.exe
  C:\Windows\System\AATLTHY.exe
  2⤵
  PID:5868
- C:\Windows\System\rtPtwAk.exe
  C:\Windows\System\rtPtwAk.exe
  2⤵
  PID:5888
- C:\Windows\System\Tvzeyaf.exe
  C:\Windows\System\Tvzeyaf.exe
  2⤵
  PID:5908
- C:\Windows\System\fgJDDBo.exe
  C:\Windows\System\fgJDDBo.exe
  2⤵
  PID:5936
- C:\Windows\System\RosdnFd.exe
  C:\Windows\System\RosdnFd.exe
  2⤵
  PID:5956
- C:\Windows\System\CdiLXjW.exe
  C:\Windows\System\CdiLXjW.exe
  2⤵
  PID:5988
- C:\Windows\System\ULeSXub.exe
  C:\Windows\System\ULeSXub.exe
  2⤵
  PID:6004
- C:\Windows\System\yHztdFN.exe
  C:\Windows\System\yHztdFN.exe
  2⤵
  PID:6032
- C:\Windows\System\EzDfhTj.exe
  C:\Windows\System\EzDfhTj.exe
  2⤵
  PID:6056
- C:\Windows\System\vwQqege.exe
  C:\Windows\System\vwQqege.exe
  2⤵
  PID:6072
- C:\Windows\System\TeRzSWA.exe
  C:\Windows\System\TeRzSWA.exe
  2⤵
  PID:6096
- C:\Windows\System\qhtYPIv.exe
  C:\Windows\System\qhtYPIv.exe
  2⤵
  PID:6116
- C:\Windows\System\yGqLasr.exe
  C:\Windows\System\yGqLasr.exe
  2⤵
  PID:4940
- C:\Windows\System\zsGPtpx.exe
  C:\Windows\System\zsGPtpx.exe
  2⤵
  PID:4800
- C:\Windows\System\OpulGXO.exe
  C:\Windows\System\OpulGXO.exe
  2⤵
  PID:4488
- C:\Windows\System\bGfaxVd.exe
  C:\Windows\System\bGfaxVd.exe
  2⤵
  PID:5128
- C:\Windows\System\mzXoXwI.exe
  C:\Windows\System\mzXoXwI.exe
  2⤵
  PID:1320
- C:\Windows\System\iqWvbRW.exe
  C:\Windows\System\iqWvbRW.exe
  2⤵
  PID:3536
- C:\Windows\System\PIIAfnB.exe
  C:\Windows\System\PIIAfnB.exe
  2⤵
  PID:676
- C:\Windows\System\HDODuaV.exe
  C:\Windows\System\HDODuaV.exe
  2⤵
  PID:5216
- C:\Windows\System\stJfrgd.exe
  C:\Windows\System\stJfrgd.exe
  2⤵
  PID:5264
- C:\Windows\System\KprTDFB.exe
  C:\Windows\System\KprTDFB.exe
  2⤵
  PID:5360
- C:\Windows\System\wWAwnvg.exe
  C:\Windows\System\wWAwnvg.exe
  2⤵
  PID:5468
- C:\Windows\System\dwdYOtp.exe
  C:\Windows\System\dwdYOtp.exe
  2⤵
  PID:4072
- C:\Windows\System\kKvabrJ.exe
  C:\Windows\System\kKvabrJ.exe
  2⤵
  PID:4456
- C:\Windows\System\kocxKtS.exe
  C:\Windows\System\kocxKtS.exe
  2⤵
  PID:1136
- C:\Windows\System\cigaaxn.exe
  C:\Windows\System\cigaaxn.exe
  2⤵
  PID:3148
- C:\Windows\System\NBVpXwf.exe
  C:\Windows\System\NBVpXwf.exe
  2⤵
  PID:1956
- C:\Windows\System\wqjrlnC.exe
  C:\Windows\System\wqjrlnC.exe
  2⤵
  PID:5512
- C:\Windows\System\LdJUodz.exe
  C:\Windows\System\LdJUodz.exe
  2⤵
  PID:3484
- C:\Windows\System\RFeToib.exe
  C:\Windows\System\RFeToib.exe
  2⤵
  PID:4392
- C:\Windows\System\PqAearr.exe
  C:\Windows\System\PqAearr.exe
  2⤵
  PID:4996
- C:\Windows\System\locIWrG.exe
  C:\Windows\System\locIWrG.exe
  2⤵
  PID:4592
- C:\Windows\System\TfkUXdG.exe
  C:\Windows\System\TfkUXdG.exe
  2⤵
  PID:5528
- C:\Windows\System\RbrPinO.exe
  C:\Windows\System\RbrPinO.exe
  2⤵
  PID:4168
- C:\Windows\System\jPezvEf.exe
  C:\Windows\System\jPezvEf.exe
  2⤵
  PID:316
- C:\Windows\System\NJkcKEN.exe
  C:\Windows\System\NJkcKEN.exe
  2⤵
  PID:4092
- C:\Windows\System\aZKOvlf.exe
  C:\Windows\System\aZKOvlf.exe
  2⤵
  PID:1524
- C:\Windows\System\PxbfZlu.exe
  C:\Windows\System\PxbfZlu.exe
  2⤵
  PID:5652
- C:\Windows\System\QWmuIHq.exe
  C:\Windows\System\QWmuIHq.exe
  2⤵
  PID:5704
- C:\Windows\System\CILjoeE.exe
  C:\Windows\System\CILjoeE.exe
  2⤵
  PID:5784
- C:\Windows\System\DwWPmqz.exe
  C:\Windows\System\DwWPmqz.exe
  2⤵
  PID:5768
- C:\Windows\System\rciFUkP.exe
  C:\Windows\System\rciFUkP.exe
  2⤵
  PID:5864
- C:\Windows\System\WhbZQmN.exe
  C:\Windows\System\WhbZQmN.exe
  2⤵
  PID:5916
- C:\Windows\System\bNbBhVV.exe
  C:\Windows\System\bNbBhVV.exe
  2⤵
  PID:5900
- C:\Windows\System\oqNFBHQ.exe
  C:\Windows\System\oqNFBHQ.exe
  2⤵
  PID:6044
- C:\Windows\System\vLIyqAs.exe
  C:\Windows\System\vLIyqAs.exe
  2⤵
  PID:6140
- C:\Windows\System\kztrzxg.exe
  C:\Windows\System\kztrzxg.exe
  2⤵
  PID:6068
- C:\Windows\System\qasqIDJ.exe
  C:\Windows\System\qasqIDJ.exe
  2⤵
  PID:6112
- C:\Windows\System\AsonLGc.exe
  C:\Windows\System\AsonLGc.exe
  2⤵
  PID:5180
- C:\Windows\System\XIedjrB.exe
  C:\Windows\System\XIedjrB.exe
  2⤵
  PID:5336
- C:\Windows\System\whHEIpy.exe
  C:\Windows\System\whHEIpy.exe
  2⤵
  PID:4964
- C:\Windows\System\AExkMSR.exe
  C:\Windows\System\AExkMSR.exe
  2⤵
  PID:2012
- C:\Windows\System\bStsiXa.exe
  C:\Windows\System\bStsiXa.exe
  2⤵
  PID:5164
- C:\Windows\System\QDpKDxO.exe
  C:\Windows\System\QDpKDxO.exe
  2⤵
  PID:5232
- C:\Windows\System\mSfACSF.exe
  C:\Windows\System\mSfACSF.exe
  2⤵
  PID:2348
- C:\Windows\System\iCAnfGs.exe
  C:\Windows\System\iCAnfGs.exe
  2⤵
  PID:3400
- C:\Windows\System\ULUTwSU.exe
  C:\Windows\System\ULUTwSU.exe
  2⤵
  PID:5012
- C:\Windows\System\TXUPzzx.exe
  C:\Windows\System\TXUPzzx.exe
  2⤵
  PID:5744
- C:\Windows\System\PjrNrtz.exe
  C:\Windows\System\PjrNrtz.exe
  2⤵
  PID:5116
- C:\Windows\System\eFqBJqb.exe
  C:\Windows\System\eFqBJqb.exe
  2⤵
  PID:6172
- C:\Windows\System\QRgkime.exe
  C:\Windows\System\QRgkime.exe
  2⤵
  PID:6204
- C:\Windows\System\bPNSWbU.exe
  C:\Windows\System\bPNSWbU.exe
  2⤵
  PID:6232
- C:\Windows\System\Gegaqbs.exe
  C:\Windows\System\Gegaqbs.exe
  2⤵
  PID:6248
- C:\Windows\System\rTLwYeC.exe
  C:\Windows\System\rTLwYeC.exe
  2⤵
  PID:6276
- C:\Windows\System\KHBpRps.exe
  C:\Windows\System\KHBpRps.exe
  2⤵
  PID:6296
- C:\Windows\System\BNxCcVy.exe
  C:\Windows\System\BNxCcVy.exe
  2⤵
  PID:6320
- C:\Windows\System\ufjLMNA.exe
  C:\Windows\System\ufjLMNA.exe
  2⤵
  PID:6344
- C:\Windows\System\bbKkmeK.exe
  C:\Windows\System\bbKkmeK.exe
  2⤵
  PID:6364
- C:\Windows\System\LrcmogE.exe
  C:\Windows\System\LrcmogE.exe
  2⤵
  PID:6396
- C:\Windows\System\IMbRbxm.exe
  C:\Windows\System\IMbRbxm.exe
  2⤵
  PID:6416
- C:\Windows\System\KHBNalB.exe
  C:\Windows\System\KHBNalB.exe
  2⤵
  PID:6440
- C:\Windows\System\RcwKEFN.exe
  C:\Windows\System\RcwKEFN.exe
  2⤵
  PID:6456
- C:\Windows\System\WertlqK.exe
  C:\Windows\System\WertlqK.exe
  2⤵
  PID:6488
- C:\Windows\System\onUwJJX.exe
  C:\Windows\System\onUwJJX.exe
  2⤵
  PID:6508
- C:\Windows\System\DyWrUkt.exe
  C:\Windows\System\DyWrUkt.exe
  2⤵
  PID:6532
- C:\Windows\System\jzoBZSY.exe
  C:\Windows\System\jzoBZSY.exe
  2⤵
  PID:6556
- C:\Windows\System\dLcFYWa.exe
  C:\Windows\System\dLcFYWa.exe
  2⤵
  PID:6572
- C:\Windows\System\gARJpcO.exe
  C:\Windows\System\gARJpcO.exe
  2⤵
  PID:6596
- C:\Windows\System\iYPEHiu.exe
  C:\Windows\System\iYPEHiu.exe
  2⤵
  PID:6620
- C:\Windows\System\DBtAjHD.exe
  C:\Windows\System\DBtAjHD.exe
  2⤵
  PID:6640
- C:\Windows\System\lyIHvUc.exe
  C:\Windows\System\lyIHvUc.exe
  2⤵
  PID:6660
- C:\Windows\System\jTHdxTg.exe
  C:\Windows\System\jTHdxTg.exe
  2⤵
  PID:6684
- C:\Windows\System\jndsSZg.exe
  C:\Windows\System\jndsSZg.exe
  2⤵
  PID:6700
- C:\Windows\System\NLiEXkU.exe
  C:\Windows\System\NLiEXkU.exe
  2⤵
  PID:6724
- C:\Windows\System\SbiiWqK.exe
  C:\Windows\System\SbiiWqK.exe
  2⤵
  PID:6752
- C:\Windows\System\lzbmCGH.exe
  C:\Windows\System\lzbmCGH.exe
  2⤵
  PID:6772
- C:\Windows\System\sJnHZdI.exe
  C:\Windows\System\sJnHZdI.exe
  2⤵
  PID:6792
- C:\Windows\System\PnWBKCV.exe
  C:\Windows\System\PnWBKCV.exe
  2⤵
  PID:6812
- C:\Windows\System\pylXObv.exe
  C:\Windows\System\pylXObv.exe
  2⤵
  PID:6832
- C:\Windows\System\hzDrDEA.exe
  C:\Windows\System\hzDrDEA.exe
  2⤵
  PID:6852
- C:\Windows\System\cmgewjV.exe
  C:\Windows\System\cmgewjV.exe
  2⤵
  PID:6872
- C:\Windows\System\MGmYeqp.exe
  C:\Windows\System\MGmYeqp.exe
  2⤵
  PID:6896
- C:\Windows\System\naOMteq.exe
  C:\Windows\System\naOMteq.exe
  2⤵
  PID:6924
- C:\Windows\System\Ayypaya.exe
  C:\Windows\System\Ayypaya.exe
  2⤵
  PID:6952
- C:\Windows\System\LMdQbBl.exe
  C:\Windows\System\LMdQbBl.exe
  2⤵
  PID:6972
- C:\Windows\System\SIyAEoy.exe
  C:\Windows\System\SIyAEoy.exe
  2⤵
  PID:6996
- C:\Windows\System\uSUnXwd.exe
  C:\Windows\System\uSUnXwd.exe
  2⤵
  PID:7020
- C:\Windows\System\wwNCqii.exe
  C:\Windows\System\wwNCqii.exe
  2⤵
  PID:7044
- C:\Windows\System\xIEQbsT.exe
  C:\Windows\System\xIEQbsT.exe
  2⤵
  PID:7064
- C:\Windows\System\PULlOqU.exe
  C:\Windows\System\PULlOqU.exe
  2⤵
  PID:7092
- C:\Windows\System\klbjvox.exe
  C:\Windows\System\klbjvox.exe
  2⤵
  PID:7116
- C:\Windows\System\AbSNalr.exe
  C:\Windows\System\AbSNalr.exe
  2⤵
  PID:7140
- C:\Windows\System\WUvSEyW.exe
  C:\Windows\System\WUvSEyW.exe
  2⤵
  PID:7164
- C:\Windows\System\VfjHvTL.exe
  C:\Windows\System\VfjHvTL.exe
  2⤵
  PID:5828
- C:\Windows\System\hloUdDL.exe
  C:\Windows\System\hloUdDL.exe
  2⤵
  PID:6024
- C:\Windows\System\qAbLteO.exe
  C:\Windows\System\qAbLteO.exe
  2⤵
  PID:3924
- C:\Windows\System\lTKvnsl.exe
  C:\Windows\System\lTKvnsl.exe
  2⤵
  PID:5244
- C:\Windows\System\hXhLieB.exe
  C:\Windows\System\hXhLieB.exe
  2⤵
  PID:4264
- C:\Windows\System\SwnxthL.exe
  C:\Windows\System\SwnxthL.exe
  2⤵
  PID:1368
- C:\Windows\System\YsLjVJR.exe
  C:\Windows\System\YsLjVJR.exe
  2⤵
  PID:5816
- C:\Windows\System\PkKcKrT.exe
  C:\Windows\System\PkKcKrT.exe
  2⤵
  PID:6156
- C:\Windows\System\sdkFDgy.exe
  C:\Windows\System\sdkFDgy.exe
  2⤵
  PID:6064
- C:\Windows\System\kkvPYnW.exe
  C:\Windows\System\kkvPYnW.exe
  2⤵
  PID:6264
- C:\Windows\System\nylUCAp.exe
  C:\Windows\System\nylUCAp.exe
  2⤵
  PID:4936
- C:\Windows\System\fFZzkYS.exe
  C:\Windows\System\fFZzkYS.exe
  2⤵
  PID:6372
- C:\Windows\System\BeXkRbt.exe
  C:\Windows\System\BeXkRbt.exe
  2⤵
  PID:6436
- C:\Windows\System\pWKXcro.exe
  C:\Windows\System\pWKXcro.exe
  2⤵
  PID:6504
- C:\Windows\System\jYhfASL.exe
  C:\Windows\System\jYhfASL.exe
  2⤵
  PID:6580
- C:\Windows\System\PsAXstz.exe
  C:\Windows\System\PsAXstz.exe
  2⤵
  PID:6656
- C:\Windows\System\seobrgY.exe
  C:\Windows\System\seobrgY.exe
  2⤵
  PID:6696
- C:\Windows\System\QsJjIEu.exe
  C:\Windows\System\QsJjIEu.exe
  2⤵
  PID:6768
- C:\Windows\System\Satgrte.exe
  C:\Windows\System\Satgrte.exe
  2⤵
  PID:6844
- C:\Windows\System\cdoqaic.exe
  C:\Windows\System\cdoqaic.exe
  2⤵
  PID:6200
- C:\Windows\System\AjPGpQK.exe
  C:\Windows\System\AjPGpQK.exe
  2⤵
  PID:6448
- C:\Windows\System\lOJWkUT.exe
  C:\Windows\System\lOJWkUT.exe
  2⤵
  PID:6480
- C:\Windows\System\NDUVArX.exe
  C:\Windows\System\NDUVArX.exe
  2⤵
  PID:7132
- C:\Windows\System\KUxbZyr.exe
  C:\Windows\System\KUxbZyr.exe
  2⤵
  PID:6636
- C:\Windows\System\NPWDwZy.exe
  C:\Windows\System\NPWDwZy.exe
  2⤵
  PID:7184
- C:\Windows\System\jDTHPCN.exe
  C:\Windows\System\jDTHPCN.exe
  2⤵
  PID:7212
- C:\Windows\System\YucXcCM.exe
  C:\Windows\System\YucXcCM.exe
  2⤵
  PID:7232
- C:\Windows\System\nagldFx.exe
  C:\Windows\System\nagldFx.exe
  2⤵
  PID:7256
- C:\Windows\System\CeyEPEu.exe
  C:\Windows\System\CeyEPEu.exe
  2⤵
  PID:7280
- C:\Windows\System\bsTfKWi.exe
  C:\Windows\System\bsTfKWi.exe
  2⤵
  PID:7304
- C:\Windows\System\XOrWvTp.exe
  C:\Windows\System\XOrWvTp.exe
  2⤵
  PID:7320
- C:\Windows\System\JQQpFCp.exe
  C:\Windows\System\JQQpFCp.exe
  2⤵
  PID:7344
- C:\Windows\System\rGcXaqx.exe
  C:\Windows\System\rGcXaqx.exe
  2⤵
  PID:7368
- C:\Windows\System\jqELwrH.exe
  C:\Windows\System\jqELwrH.exe
  2⤵
  PID:7388
- C:\Windows\System\NpMDNVV.exe
  C:\Windows\System\NpMDNVV.exe
  2⤵
  PID:7412
- C:\Windows\System\blPgprt.exe
  C:\Windows\System\blPgprt.exe
  2⤵
  PID:7440
- C:\Windows\System\jrYvhqo.exe
  C:\Windows\System\jrYvhqo.exe
  2⤵
  PID:7460
- C:\Windows\System\eBazlhj.exe
  C:\Windows\System\eBazlhj.exe
  2⤵
  PID:7488
- C:\Windows\System\pwDEkpI.exe
  C:\Windows\System\pwDEkpI.exe
  2⤵
  PID:7508
- C:\Windows\System\htdTnlH.exe
  C:\Windows\System\htdTnlH.exe
  2⤵
  PID:7528
- C:\Windows\System\jpWOIGK.exe
  C:\Windows\System\jpWOIGK.exe
  2⤵
  PID:7552
- C:\Windows\System\hHRSzPU.exe
  C:\Windows\System\hHRSzPU.exe
  2⤵
  PID:7584
- C:\Windows\System\zlzSdJS.exe
  C:\Windows\System\zlzSdJS.exe
  2⤵
  PID:7600
- C:\Windows\System\EJbktII.exe
  C:\Windows\System\EJbktII.exe
  2⤵
  PID:7624
- C:\Windows\System\qpxCSGW.exe
  C:\Windows\System\qpxCSGW.exe
  2⤵
  PID:7652
- C:\Windows\System\zcxGbYr.exe
  C:\Windows\System\zcxGbYr.exe
  2⤵
  PID:7676
- C:\Windows\System\RRNOitn.exe
  C:\Windows\System\RRNOitn.exe
  2⤵
  PID:7708
- C:\Windows\System\TVTLmTe.exe
  C:\Windows\System\TVTLmTe.exe
  2⤵
  PID:7736
- C:\Windows\System\guZmycB.exe
  C:\Windows\System\guZmycB.exe
  2⤵
  PID:7760
- C:\Windows\System\QSatKRR.exe
  C:\Windows\System\QSatKRR.exe
  2⤵
  PID:7788
- C:\Windows\System\TsPcppd.exe
  C:\Windows\System\TsPcppd.exe
  2⤵
  PID:7808
- C:\Windows\System\uICWZeV.exe
  C:\Windows\System\uICWZeV.exe
  2⤵
  PID:7824
- C:\Windows\System\pueZhuT.exe
  C:\Windows\System\pueZhuT.exe
  2⤵
  PID:7848
- C:\Windows\System\ELPprww.exe
  C:\Windows\System\ELPprww.exe
  2⤵
  PID:7872
- C:\Windows\System\RptFsWj.exe
  C:\Windows\System\RptFsWj.exe
  2⤵
  PID:7896
- C:\Windows\System\IyQHfVd.exe
  C:\Windows\System\IyQHfVd.exe
  2⤵
  PID:7912
- C:\Windows\System\ZpXXLhg.exe
  C:\Windows\System\ZpXXLhg.exe
  2⤵
  PID:7936
- C:\Windows\System\UiTlfrp.exe
  C:\Windows\System\UiTlfrp.exe
  2⤵
  PID:7960
- C:\Windows\System\GqgdnwS.exe
  C:\Windows\System\GqgdnwS.exe
  2⤵
  PID:7984
- C:\Windows\System\NyRsEkF.exe
  C:\Windows\System\NyRsEkF.exe
  2⤵
  PID:8008
- C:\Windows\System\muTLEJJ.exe
  C:\Windows\System\muTLEJJ.exe
  2⤵
  PID:8032
- C:\Windows\System\OpBApNn.exe
  C:\Windows\System\OpBApNn.exe
  2⤵
  PID:8060
- C:\Windows\System\AWHyEKJ.exe
  C:\Windows\System\AWHyEKJ.exe
  2⤵
  PID:8096
- C:\Windows\System\PWxrqOJ.exe
  C:\Windows\System\PWxrqOJ.exe
  2⤵
  PID:8112
- C:\Windows\System\SpfOWtf.exe
  C:\Windows\System\SpfOWtf.exe
  2⤵
  PID:8140
- C:\Windows\System\pUNTQAs.exe
  C:\Windows\System\pUNTQAs.exe
  2⤵
  PID:8168
- C:\Windows\System\qnyWgFn.exe
  C:\Windows\System\qnyWgFn.exe
  2⤵
  PID:8188
- C:\Windows\System\yWQLSVz.exe
  C:\Windows\System\yWQLSVz.exe
  2⤵
  PID:1088
- C:\Windows\System\gpjBixk.exe
  C:\Windows\System\gpjBixk.exe
  2⤵
  PID:6720
- C:\Windows\System\ftOVkdF.exe
  C:\Windows\System\ftOVkdF.exe
  2⤵
  PID:6804
- C:\Windows\System\rAhMsxL.exe
  C:\Windows\System\rAhMsxL.exe
  2⤵
  PID:6864
- C:\Windows\System\LlwdreR.exe
  C:\Windows\System\LlwdreR.exe
  2⤵
  PID:6936
- C:\Windows\System\UFHeyEo.exe
  C:\Windows\System\UFHeyEo.exe
  2⤵
  PID:6304
- C:\Windows\System\JSONioI.exe
  C:\Windows\System\JSONioI.exe
  2⤵
  PID:1588
- C:\Windows\System\CxaTTbt.exe
  C:\Windows\System\CxaTTbt.exe
  2⤵
  PID:6604
- C:\Windows\System\firQrLm.exe
  C:\Windows\System\firQrLm.exe
  2⤵
  PID:6192
- C:\Windows\System\LLOPRpV.exe
  C:\Windows\System\LLOPRpV.exe
  2⤵
  PID:6544
- C:\Windows\System\vVwTgdM.exe
  C:\Windows\System\vVwTgdM.exe
  2⤵
  PID:7192
- C:\Windows\System\ADFaSGa.exe
  C:\Windows\System\ADFaSGa.exe
  2⤵
  PID:916
- C:\Windows\System\lOqbNGl.exe
  C:\Windows\System\lOqbNGl.exe
  2⤵
  PID:4276
- C:\Windows\System\noWqfOh.exe
  C:\Windows\System\noWqfOh.exe
  2⤵
  PID:7340
- C:\Windows\System\bbFiIys.exe
  C:\Windows\System\bbFiIys.exe
  2⤵
  PID:7380
- C:\Windows\System\iVQqdoy.exe
  C:\Windows\System\iVQqdoy.exe
  2⤵
  PID:7396
- C:\Windows\System\iAIFhbO.exe
  C:\Windows\System\iAIFhbO.exe
  2⤵
  PID:6500
- C:\Windows\System\TFKULDg.exe
  C:\Windows\System\TFKULDg.exe
  2⤵
  PID:6592
- C:\Windows\System\tngRcTz.exe
  C:\Windows\System\tngRcTz.exe
  2⤵
  PID:7568
- C:\Windows\System\FgWXCrB.exe
  C:\Windows\System\FgWXCrB.exe
  2⤵
  PID:7112
- C:\Windows\System\HGhwZbs.exe
  C:\Windows\System\HGhwZbs.exe
  2⤵
  PID:7180
- C:\Windows\System\JxNNOnS.exe
  C:\Windows\System\JxNNOnS.exe
  2⤵
  PID:8204
- C:\Windows\System\KMTkZLM.exe
  C:\Windows\System\KMTkZLM.exe
  2⤵
  PID:8224
- C:\Windows\System\PnPljIZ.exe
  C:\Windows\System\PnPljIZ.exe
  2⤵
  PID:8244
- C:\Windows\System\qsRbGRH.exe
  C:\Windows\System\qsRbGRH.exe
  2⤵
  PID:8268
- C:\Windows\System\gsqQeYZ.exe
  C:\Windows\System\gsqQeYZ.exe
  2⤵
  PID:8292
- C:\Windows\System\POcQbmL.exe
  C:\Windows\System\POcQbmL.exe
  2⤵
  PID:8316
- C:\Windows\System\THmSCRq.exe
  C:\Windows\System\THmSCRq.exe
  2⤵
  PID:8336
- C:\Windows\System\kYUaiCz.exe
  C:\Windows\System\kYUaiCz.exe
  2⤵
  PID:8360
- C:\Windows\System\vafYhbt.exe
  C:\Windows\System\vafYhbt.exe
  2⤵
  PID:8388
- C:\Windows\System\GjVnfMg.exe
  C:\Windows\System\GjVnfMg.exe
  2⤵
  PID:8408
- C:\Windows\System\TuxmHDy.exe
  C:\Windows\System\TuxmHDy.exe
  2⤵
  PID:8428
- C:\Windows\System\VdzMihl.exe
  C:\Windows\System\VdzMihl.exe
  2⤵
  PID:8456
- C:\Windows\System\sKtuUgm.exe
  C:\Windows\System\sKtuUgm.exe
  2⤵
  PID:8480
- C:\Windows\System\EKGuJhm.exe
  C:\Windows\System\EKGuJhm.exe
  2⤵
  PID:8508
- C:\Windows\System\zuIKjeG.exe
  C:\Windows\System\zuIKjeG.exe
  2⤵
  PID:8540
- C:\Windows\System\suLDZRH.exe
  C:\Windows\System\suLDZRH.exe
  2⤵
  PID:8556
- C:\Windows\System\IiqHFMf.exe
  C:\Windows\System\IiqHFMf.exe
  2⤵
  PID:8588
- C:\Windows\System\QeGAnKl.exe
  C:\Windows\System\QeGAnKl.exe
  2⤵
  PID:8608
- C:\Windows\System\igFkTNa.exe
  C:\Windows\System\igFkTNa.exe
  2⤵
  PID:8628
- C:\Windows\System\URArSKJ.exe
  C:\Windows\System\URArSKJ.exe
  2⤵
  PID:8660
- C:\Windows\System\oWUQrpm.exe
  C:\Windows\System\oWUQrpm.exe
  2⤵
  PID:8680
- C:\Windows\System\npyOvFb.exe
  C:\Windows\System\npyOvFb.exe
  2⤵
  PID:8704
- C:\Windows\System\XgSUiTc.exe
  C:\Windows\System\XgSUiTc.exe
  2⤵
  PID:8728
- C:\Windows\System\LdnzCHM.exe
  C:\Windows\System\LdnzCHM.exe
  2⤵
  PID:8744
- C:\Windows\System\PDbOuWz.exe
  C:\Windows\System\PDbOuWz.exe
  2⤵
  PID:8768
- C:\Windows\System\SANhuDs.exe
  C:\Windows\System\SANhuDs.exe
  2⤵
  PID:8796
- C:\Windows\System\sdwKGLB.exe
  C:\Windows\System\sdwKGLB.exe
  2⤵
  PID:8816
- C:\Windows\System\NoIwWpV.exe
  C:\Windows\System\NoIwWpV.exe
  2⤵
  PID:8840
- C:\Windows\System\FJDvawp.exe
  C:\Windows\System\FJDvawp.exe
  2⤵
  PID:8856
- C:\Windows\System\hQvmUEu.exe
  C:\Windows\System\hQvmUEu.exe
  2⤵
  PID:8872
- C:\Windows\System\ENfEuhA.exe
  C:\Windows\System\ENfEuhA.exe
  2⤵
  PID:8892
- C:\Windows\System\IsgnoTB.exe
  C:\Windows\System\IsgnoTB.exe
  2⤵
  PID:8912
- C:\Windows\System\abntDRr.exe
  C:\Windows\System\abntDRr.exe
  2⤵
  PID:8944
- C:\Windows\System\FAVpjKW.exe
  C:\Windows\System\FAVpjKW.exe
  2⤵
  PID:8964
- C:\Windows\System\drZxnrZ.exe
  C:\Windows\System\drZxnrZ.exe
  2⤵
  PID:8988
- C:\Windows\System\vqJiVnn.exe
  C:\Windows\System\vqJiVnn.exe
  2⤵
  PID:9008
- C:\Windows\System\wQQBRGK.exe
  C:\Windows\System\wQQBRGK.exe
  2⤵
  PID:9032
- C:\Windows\System\dUYdpID.exe
  C:\Windows\System\dUYdpID.exe
  2⤵
  PID:9056
- C:\Windows\System\hTgZimV.exe
  C:\Windows\System\hTgZimV.exe
  2⤵
  PID:9072
- C:\Windows\System\NwIEqor.exe
  C:\Windows\System\NwIEqor.exe
  2⤵
  PID:9096
- C:\Windows\System\WvVAlGU.exe
  C:\Windows\System\WvVAlGU.exe
  2⤵
  PID:9120
- C:\Windows\System\roFsMdz.exe
  C:\Windows\System\roFsMdz.exe
  2⤵
  PID:9140
- C:\Windows\System\tFhRyOs.exe
  C:\Windows\System\tFhRyOs.exe
  2⤵
  PID:9160
- C:\Windows\System\JnBWFNq.exe
  C:\Windows\System\JnBWFNq.exe
  2⤵
  PID:9188
- C:\Windows\System\POmpYmv.exe
  C:\Windows\System\POmpYmv.exe
  2⤵
  PID:9208
- C:\Windows\System\JnLrcKK.exe
  C:\Windows\System\JnLrcKK.exe
  2⤵
  PID:7228
- C:\Windows\System\dwCCLyC.exe
  C:\Windows\System\dwCCLyC.exe
  2⤵
  PID:7244
- C:\Windows\System\emLTOUz.exe
  C:\Windows\System\emLTOUz.exe
  2⤵
  PID:7288
- C:\Windows\System\bLcWiIT.exe
  C:\Windows\System\bLcWiIT.exe
  2⤵
  PID:8024
- C:\Windows\System\ROsasoP.exe
  C:\Windows\System\ROsasoP.exe
  2⤵
  PID:8068
- C:\Windows\System\ySsXGHn.exe
  C:\Windows\System\ySsXGHn.exe
  2⤵
  PID:8120
- C:\Windows\System\ygcZsVc.exe
  C:\Windows\System\ygcZsVc.exe
  2⤵
  PID:7432
- C:\Windows\System\MQHwbCT.exe
  C:\Windows\System\MQHwbCT.exe
  2⤵
  PID:6352
- C:\Windows\System\OIbgDgb.exe
  C:\Windows\System\OIbgDgb.exe
  2⤵
  PID:7476
- C:\Windows\System\PnnMsqm.exe
  C:\Windows\System\PnnMsqm.exe
  2⤵
  PID:6332
- C:\Windows\System\mcKfTtG.exe
  C:\Windows\System\mcKfTtG.exe
  2⤵
  PID:7608
- C:\Windows\System\FbbnPMj.exe
  C:\Windows\System\FbbnPMj.exe
  2⤵
  PID:7336
- C:\Windows\System\rwIXIIc.exe
  C:\Windows\System\rwIXIIc.exe
  2⤵
  PID:6980
- C:\Windows\System\ZILZtKW.exe
  C:\Windows\System\ZILZtKW.exe
  2⤵
  PID:7664
- C:\Windows\System\XsfzdvW.exe
  C:\Windows\System\XsfzdvW.exe
  2⤵
  PID:7040
- C:\Windows\System\JSlOcIZ.exe
  C:\Windows\System\JSlOcIZ.exe
  2⤵
  PID:8260
- C:\Windows\System\uDcwuvu.exe
  C:\Windows\System\uDcwuvu.exe
  2⤵
  PID:8324
- C:\Windows\System\jrEvUKb.exe
  C:\Windows\System\jrEvUKb.exe
  2⤵
  PID:7968
- C:\Windows\System\frBeAhq.exe
  C:\Windows\System\frBeAhq.exe
  2⤵
  PID:8488
- C:\Windows\System\XcqyDho.exe
  C:\Windows\System\XcqyDho.exe
  2⤵
  PID:8552
- C:\Windows\System\PjjEvjI.exe
  C:\Windows\System\PjjEvjI.exe
  2⤵
  PID:6716
- C:\Windows\System\ekxnTMN.exe
  C:\Windows\System\ekxnTMN.exe
  2⤵
  PID:4576
- C:\Windows\System\TbIujIK.exe
  C:\Windows\System\TbIujIK.exe
  2⤵
  PID:7028
- C:\Windows\System\qqMEkeo.exe
  C:\Windows\System\qqMEkeo.exe
  2⤵
  PID:8700
- C:\Windows\System\Urlimjr.exe
  C:\Windows\System\Urlimjr.exe
  2⤵
  PID:6880
- C:\Windows\System\OIlIWfQ.exe
  C:\Windows\System\OIlIWfQ.exe
  2⤵
  PID:8776
- C:\Windows\System\gLSkVPN.exe
  C:\Windows\System\gLSkVPN.exe
  2⤵
  PID:8760
- C:\Windows\System\SMRqskv.exe
  C:\Windows\System\SMRqskv.exe
  2⤵
  PID:8884
- C:\Windows\System\XShGmYP.exe
  C:\Windows\System\XShGmYP.exe
  2⤵
  PID:9236
- C:\Windows\System\kazxYfK.exe
  C:\Windows\System\kazxYfK.exe
  2⤵
  PID:9260
- C:\Windows\System\KLxOPAm.exe
  C:\Windows\System\KLxOPAm.exe
  2⤵
  PID:9280
- C:\Windows\System\ARHBxrA.exe
  C:\Windows\System\ARHBxrA.exe
  2⤵
  PID:9304
- C:\Windows\System\qjDSejB.exe
  C:\Windows\System\qjDSejB.exe
  2⤵
  PID:9328
- C:\Windows\System\gqZSCuR.exe
  C:\Windows\System\gqZSCuR.exe
  2⤵
  PID:9352
- C:\Windows\System\oGGvObe.exe
  C:\Windows\System\oGGvObe.exe
  2⤵
  PID:9372
- C:\Windows\System\wFxqjqh.exe
  C:\Windows\System\wFxqjqh.exe
  2⤵
  PID:9396
- C:\Windows\System\kOZkbYr.exe
  C:\Windows\System\kOZkbYr.exe
  2⤵
  PID:9416
- C:\Windows\System\aFTSTSG.exe
  C:\Windows\System\aFTSTSG.exe
  2⤵
  PID:9452
- C:\Windows\System\VjBlmwL.exe
  C:\Windows\System\VjBlmwL.exe
  2⤵
  PID:9476
- C:\Windows\System\dXtzljK.exe
  C:\Windows\System\dXtzljK.exe
  2⤵
  PID:9496
- C:\Windows\System\omkXQSt.exe
  C:\Windows\System\omkXQSt.exe
  2⤵
  PID:9516
- C:\Windows\System\zBmCqAa.exe
  C:\Windows\System\zBmCqAa.exe
  2⤵
  PID:9540
- C:\Windows\System\TEBgIEM.exe
  C:\Windows\System\TEBgIEM.exe
  2⤵
  PID:9564
- C:\Windows\System\MpUhSkW.exe
  C:\Windows\System\MpUhSkW.exe
  2⤵
  PID:9588
- C:\Windows\System\GngomUk.exe
  C:\Windows\System\GngomUk.exe
  2⤵
  PID:9612
- C:\Windows\System\WymZSPs.exe
  C:\Windows\System\WymZSPs.exe
  2⤵
  PID:9632
- C:\Windows\System\LhIBkfD.exe
  C:\Windows\System\LhIBkfD.exe
  2⤵
  PID:9656
- C:\Windows\System\OUxSlUe.exe
  C:\Windows\System\OUxSlUe.exe
  2⤵
  PID:9676
- C:\Windows\System\FwPQvBK.exe
  C:\Windows\System\FwPQvBK.exe
  2⤵
  PID:9700
- C:\Windows\System\trlSccP.exe
  C:\Windows\System\trlSccP.exe
  2⤵
  PID:9716
- C:\Windows\System\clkPwuH.exe
  C:\Windows\System\clkPwuH.exe
  2⤵
  PID:9732
- C:\Windows\System\NrCZCtw.exe
  C:\Windows\System\NrCZCtw.exe
  2⤵
  PID:9748
- C:\Windows\System\jYasDIE.exe
  C:\Windows\System\jYasDIE.exe
  2⤵
  PID:9764
- C:\Windows\System\wXbeobK.exe
  C:\Windows\System\wXbeobK.exe
  2⤵
  PID:9784
- C:\Windows\System\LYEXiSX.exe
  C:\Windows\System\LYEXiSX.exe
  2⤵
  PID:9808
- C:\Windows\System\TGSFvcq.exe
  C:\Windows\System\TGSFvcq.exe
  2⤵
  PID:9828
- C:\Windows\System\gTgPbwz.exe
  C:\Windows\System\gTgPbwz.exe
  2⤵
  PID:9848
- C:\Windows\System\JGUjkxd.exe
  C:\Windows\System\JGUjkxd.exe
  2⤵
  PID:9876
- C:\Windows\System\Sacqpsc.exe
  C:\Windows\System\Sacqpsc.exe
  2⤵
  PID:9896
- C:\Windows\System\gArwoWy.exe
  C:\Windows\System\gArwoWy.exe
  2⤵
  PID:9924
- C:\Windows\System\DBohftm.exe
  C:\Windows\System\DBohftm.exe
  2⤵
  PID:9944
- C:\Windows\System\BUVBqBg.exe
  C:\Windows\System\BUVBqBg.exe
  2⤵
  PID:9968
- C:\Windows\System\CGGwtNK.exe
  C:\Windows\System\CGGwtNK.exe
  2⤵
  PID:9988
- C:\Windows\System\BbTIvAE.exe
  C:\Windows\System\BbTIvAE.exe
  2⤵
  PID:10016
- C:\Windows\System\fQMNTdT.exe
  C:\Windows\System\fQMNTdT.exe
  2⤵
  PID:10036
- C:\Windows\System\UXykmVe.exe
  C:\Windows\System\UXykmVe.exe
  2⤵
  PID:10056
- C:\Windows\System\JWfdTKT.exe
  C:\Windows\System\JWfdTKT.exe
  2⤵
  PID:10080
- C:\Windows\System\XeFFRgo.exe
  C:\Windows\System\XeFFRgo.exe
  2⤵
  PID:10104
- C:\Windows\System\GHJNWYE.exe
  C:\Windows\System\GHJNWYE.exe
  2⤵
  PID:10124
- C:\Windows\System\CoHMLRU.exe
  C:\Windows\System\CoHMLRU.exe
  2⤵
  PID:10144
- C:\Windows\System\SwQXQHH.exe
  C:\Windows\System\SwQXQHH.exe
  2⤵
  PID:10168
- C:\Windows\System\qlsdHwV.exe
  C:\Windows\System\qlsdHwV.exe
  2⤵
  PID:10188
- C:\Windows\System\pTUpbke.exe
  C:\Windows\System\pTUpbke.exe
  2⤵
  PID:10216
- C:\Windows\System\ANBheyz.exe
  C:\Windows\System\ANBheyz.exe
  2⤵
  PID:10236
- C:\Windows\System\YaWNgFK.exe
  C:\Windows\System\YaWNgFK.exe
  2⤵
  PID:8984
- C:\Windows\System\CkUjHRX.exe
  C:\Windows\System\CkUjHRX.exe
  2⤵
  PID:9052
- C:\Windows\System\KueLkBd.exe
  C:\Windows\System\KueLkBd.exe
  2⤵
  PID:9104
- C:\Windows\System\JOQsbxV.exe
  C:\Windows\System\JOQsbxV.exe
  2⤵
  PID:9168
- C:\Windows\System\SOxTsHO.exe
  C:\Windows\System\SOxTsHO.exe
  2⤵
  PID:8236
- C:\Windows\System\wvmtSCO.exe
  C:\Windows\System\wvmtSCO.exe
  2⤵
  PID:7776
- C:\Windows\System\bjQcaxA.exe
  C:\Windows\System\bjQcaxA.exe
  2⤵
  PID:8108
- C:\Windows\System\XYFGKVS.exe
  C:\Windows\System\XYFGKVS.exe
  2⤵
  PID:7904
- C:\Windows\System\UkaplZS.exe
  C:\Windows\System\UkaplZS.exe
  2⤵
  PID:6916
- C:\Windows\System\vFXJsnz.exe
  C:\Windows\System\vFXJsnz.exe
  2⤵
  PID:8420
- C:\Windows\System\jzyuZvo.exe
  C:\Windows\System\jzyuZvo.exe
  2⤵
  PID:7548
- C:\Windows\System\ZdzWCpI.exe
  C:\Windows\System\ZdzWCpI.exe
  2⤵
  PID:8472
- C:\Windows\System\mvzlAzi.exe
  C:\Windows\System\mvzlAzi.exe
  2⤵
  PID:8080
- C:\Windows\System\BwSmjFh.exe
  C:\Windows\System\BwSmjFh.exe
  2⤵
  PID:8548
- C:\Windows\System\sPEJnev.exe
  C:\Windows\System\sPEJnev.exe
  2⤵
  PID:8604
- C:\Windows\System\XwihSdw.exe
  C:\Windows\System\XwihSdw.exe
  2⤵
  PID:8672
- C:\Windows\System\MLdiChm.exe
  C:\Windows\System\MLdiChm.exe
  2⤵
  PID:8736
- C:\Windows\System\TnDQfIV.exe
  C:\Windows\System\TnDQfIV.exe
  2⤵
  PID:8788
- C:\Windows\System\KeAESos.exe
  C:\Windows\System\KeAESos.exe
  2⤵
  PID:9220
- C:\Windows\System\iKymXku.exe
  C:\Windows\System\iKymXku.exe
  2⤵
  PID:8956
- C:\Windows\System\gznfdSh.exe
  C:\Windows\System\gznfdSh.exe
  2⤵
  PID:9292
- C:\Windows\System\FQSSYkJ.exe
  C:\Windows\System\FQSSYkJ.exe
  2⤵
  PID:9340
- C:\Windows\System\UMlyWiv.exe
  C:\Windows\System\UMlyWiv.exe
  2⤵
  PID:7620
- C:\Windows\System\PPEFaJm.exe
  C:\Windows\System\PPEFaJm.exe
  2⤵
  PID:9132
- C:\Windows\System\nmPbQqQ.exe
  C:\Windows\System\nmPbQqQ.exe
  2⤵
  PID:7856
- C:\Windows\System\aRssAnE.exe
  C:\Windows\System\aRssAnE.exe
  2⤵
  PID:9464
- C:\Windows\System\zIsDnGW.exe
  C:\Windows\System\zIsDnGW.exe
  2⤵
  PID:8300
- C:\Windows\System\ajuNJRR.exe
  C:\Windows\System\ajuNJRR.exe
  2⤵
  PID:7312
- C:\Windows\System\BOMhmyH.exe
  C:\Windows\System\BOMhmyH.exe
  2⤵
  PID:8184
- C:\Windows\System\brTPGRa.exe
  C:\Windows\System\brTPGRa.exe
  2⤵
  PID:10252
- C:\Windows\System\YHfBgqH.exe
  C:\Windows\System\YHfBgqH.exe
  2⤵
  PID:10272
- C:\Windows\System\CQNhmSW.exe
  C:\Windows\System\CQNhmSW.exe
  2⤵
  PID:10296
- C:\Windows\System\ecMuwHI.exe
  C:\Windows\System\ecMuwHI.exe
  2⤵
  PID:10316
- C:\Windows\System\bxgqCNm.exe
  C:\Windows\System\bxgqCNm.exe
  2⤵
  PID:10336
- C:\Windows\System\YEednxm.exe
  C:\Windows\System\YEednxm.exe
  2⤵
  PID:10360
- C:\Windows\System\EORtjpT.exe
  C:\Windows\System\EORtjpT.exe
  2⤵
  PID:10384
- C:\Windows\System\XAENVxK.exe
  C:\Windows\System\XAENVxK.exe
  2⤵
  PID:10400
- C:\Windows\System\XXlZiBZ.exe
  C:\Windows\System\XXlZiBZ.exe
  2⤵
  PID:10424
- C:\Windows\System\CUkCBgC.exe
  C:\Windows\System\CUkCBgC.exe
  2⤵
  PID:10448
- C:\Windows\System\BrtXmrb.exe
  C:\Windows\System\BrtXmrb.exe
  2⤵
  PID:10472
- C:\Windows\System\VSywiHN.exe
  C:\Windows\System\VSywiHN.exe
  2⤵
  PID:10488
- C:\Windows\System\mNBkJIN.exe
  C:\Windows\System\mNBkJIN.exe
  2⤵
  PID:10508
- C:\Windows\System\HRaFfZs.exe
  C:\Windows\System\HRaFfZs.exe
  2⤵
  PID:10524
- C:\Windows\System\zIFrgVT.exe
  C:\Windows\System\zIFrgVT.exe
  2⤵
  PID:10540
- C:\Windows\System\RomvUNA.exe
  C:\Windows\System\RomvUNA.exe
  2⤵
  PID:10556
- C:\Windows\System\dwFUXxR.exe
  C:\Windows\System\dwFUXxR.exe
  2⤵
  PID:10576
- C:\Windows\System\SNBazea.exe
  C:\Windows\System\SNBazea.exe
  2⤵
  PID:10600
- C:\Windows\System\jOPoKlb.exe
  C:\Windows\System\jOPoKlb.exe
  2⤵
  PID:10620
- C:\Windows\System\ozVtRFh.exe
  C:\Windows\System\ozVtRFh.exe
  2⤵
  PID:10644
- C:\Windows\System\bGwrvuN.exe
  C:\Windows\System\bGwrvuN.exe
  2⤵
  PID:10668
- C:\Windows\System\VBHIvdj.exe
  C:\Windows\System\VBHIvdj.exe
  2⤵
  PID:10696
- C:\Windows\System\JGjmzZj.exe
  C:\Windows\System\JGjmzZj.exe
  2⤵
  PID:10720
- C:\Windows\System\qCNQglL.exe
  C:\Windows\System\qCNQglL.exe
  2⤵
  PID:10740
- C:\Windows\System\QMcRFrR.exe
  C:\Windows\System\QMcRFrR.exe
  2⤵
  PID:10764
- C:\Windows\System\xQDjAhm.exe
  C:\Windows\System\xQDjAhm.exe
  2⤵
  PID:10784
- C:\Windows\System\WDdMtBL.exe
  C:\Windows\System\WDdMtBL.exe
  2⤵
  PID:10956
- C:\Windows\System\lWwMLzH.exe
  C:\Windows\System\lWwMLzH.exe
  2⤵
  PID:10988
- C:\Windows\System\KAFnczS.exe
  C:\Windows\System\KAFnczS.exe
  2⤵
  PID:11012
- C:\Windows\System\SNJvNgh.exe
  C:\Windows\System\SNJvNgh.exe
  2⤵
  PID:11040
- C:\Windows\System\WVzyGpl.exe
  C:\Windows\System\WVzyGpl.exe
  2⤵
  PID:11056
- C:\Windows\System\hSnNAdH.exe
  C:\Windows\System\hSnNAdH.exe
  2⤵
  PID:11080
- C:\Windows\System\MNDXFPl.exe
  C:\Windows\System\MNDXFPl.exe
  2⤵
  PID:11108
- C:\Windows\System\XVdvaLn.exe
  C:\Windows\System\XVdvaLn.exe
  2⤵
  PID:11132
- C:\Windows\System\IdKgsNd.exe
  C:\Windows\System\IdKgsNd.exe
  2⤵
  PID:11152
- C:\Windows\System\STUPPLh.exe
  C:\Windows\System\STUPPLh.exe
  2⤵
  PID:11172
- C:\Windows\System\ADQdPWP.exe
  C:\Windows\System\ADQdPWP.exe
  2⤵
  PID:11192
- C:\Windows\System\TqHypWn.exe
  C:\Windows\System\TqHypWn.exe
  2⤵
  PID:11216
- C:\Windows\System\ZcGIMNK.exe
  C:\Windows\System\ZcGIMNK.exe
  2⤵
  PID:11244
- C:\Windows\System\zeSCsXD.exe
  C:\Windows\System\zeSCsXD.exe
  2⤵
  PID:9604
- C:\Windows\System\ngERSCN.exe
  C:\Windows\System\ngERSCN.exe
  2⤵
  PID:7328
- C:\Windows\System\gmaVAdV.exe
  C:\Windows\System\gmaVAdV.exe
  2⤵
  PID:7564
- C:\Windows\System\tHJIQvi.exe
  C:\Windows\System\tHJIQvi.exe
  2⤵
  PID:9800
- C:\Windows\System\sVIAYfJ.exe
  C:\Windows\System\sVIAYfJ.exe
  2⤵
  PID:9960
- C:\Windows\System\CjTLtQX.exe
  C:\Windows\System\CjTLtQX.exe
  2⤵
  PID:10032
- C:\Windows\System\QuYGsPm.exe
  C:\Windows\System\QuYGsPm.exe
  2⤵
  PID:10076
- C:\Windows\System\MpqWHoX.exe
  C:\Windows\System\MpqWHoX.exe
  2⤵
  PID:7004
- C:\Windows\System\wltCJpj.exe
  C:\Windows\System\wltCJpj.exe
  2⤵
  PID:10208
- C:\Windows\System\chOgUmC.exe
  C:\Windows\System\chOgUmC.exe
  2⤵
  PID:9016
- C:\Windows\System\RIEYjPd.exe
  C:\Windows\System\RIEYjPd.exe
  2⤵
  PID:11280
- C:\Windows\System\ldnpyes.exe
  C:\Windows\System\ldnpyes.exe
  2⤵
  PID:11304
- C:\Windows\System\MqppqRu.exe
  C:\Windows\System\MqppqRu.exe
  2⤵
  PID:11324
- C:\Windows\System\RYfUCMt.exe
  C:\Windows\System\RYfUCMt.exe
  2⤵
  PID:11348
- C:\Windows\System\UUywBYh.exe
  C:\Windows\System\UUywBYh.exe
  2⤵
  PID:11376
- C:\Windows\System\cSijcXo.exe
  C:\Windows\System\cSijcXo.exe
  2⤵
  PID:11396
- C:\Windows\System\sQMvHHV.exe
  C:\Windows\System\sQMvHHV.exe
  2⤵
  PID:11432
- C:\Windows\System\eLOWhya.exe
  C:\Windows\System\eLOWhya.exe
  2⤵
  PID:11456
- C:\Windows\System\aRkPUcQ.exe
  C:\Windows\System\aRkPUcQ.exe
  2⤵
  PID:11480
- C:\Windows\System\DCrutEY.exe
  C:\Windows\System\DCrutEY.exe
  2⤵
  PID:11500
- C:\Windows\System\rGxJMzt.exe
  C:\Windows\System\rGxJMzt.exe
  2⤵
  PID:11520
- C:\Windows\System\lbatBEo.exe
  C:\Windows\System\lbatBEo.exe
  2⤵
  PID:11544
- C:\Windows\System\EDRMjLm.exe
  C:\Windows\System\EDRMjLm.exe
  2⤵
  PID:11568
- C:\Windows\System\XkXNJlk.exe
  C:\Windows\System\XkXNJlk.exe
  2⤵
  PID:11596
- C:\Windows\System\XSjrKTP.exe
  C:\Windows\System\XSjrKTP.exe
  2⤵
  PID:11612
- C:\Windows\System\tXazRWE.exe
  C:\Windows\System\tXazRWE.exe
  2⤵
  PID:11636
- C:\Windows\System\lXrHazt.exe
  C:\Windows\System\lXrHazt.exe
  2⤵
  PID:11660
- C:\Windows\System\qkbwSbr.exe
  C:\Windows\System\qkbwSbr.exe
  2⤵
  PID:11680
- C:\Windows\System\eqgAyQi.exe
  C:\Windows\System\eqgAyQi.exe
  2⤵
  PID:11700
- C:\Windows\System\sujxyir.exe
  C:\Windows\System\sujxyir.exe
  2⤵
  PID:11724
- C:\Windows\System\crSdvGo.exe
  C:\Windows\System\crSdvGo.exe
  2⤵
  PID:11748
- C:\Windows\System\ypCxyVs.exe
  C:\Windows\System\ypCxyVs.exe
  2⤵
  PID:11776
- C:\Windows\System\ZdizDuO.exe
  C:\Windows\System\ZdizDuO.exe
  2⤵
  PID:11796
- C:\Windows\System\QVthqAI.exe
  C:\Windows\System\QVthqAI.exe
  2⤵
  PID:11820
- C:\Windows\System\vjztsAt.exe
  C:\Windows\System\vjztsAt.exe
  2⤵
  PID:11848
- C:\Windows\System\GgZWNBA.exe
  C:\Windows\System\GgZWNBA.exe
  2⤵
  PID:11864
- C:\Windows\System\VCZlyCO.exe
  C:\Windows\System\VCZlyCO.exe
  2⤵
  PID:11884
- C:\Windows\System\mweVVfv.exe
  C:\Windows\System\mweVVfv.exe
  2⤵
  PID:11900
- C:\Windows\System\icCpPnw.exe
  C:\Windows\System\icCpPnw.exe
  2⤵
  PID:11916
- C:\Windows\System\GXhJyFz.exe
  C:\Windows\System\GXhJyFz.exe
  2⤵
  PID:11936
- C:\Windows\System\WNfZNTC.exe
  C:\Windows\System\WNfZNTC.exe
  2⤵
  PID:11952
- C:\Windows\System\Etqdiuv.exe
  C:\Windows\System\Etqdiuv.exe
  2⤵
  PID:11968
- C:\Windows\System\NXMpeGg.exe
  C:\Windows\System\NXMpeGg.exe
  2⤵
  PID:11988
- C:\Windows\System\DEhTYUS.exe
  C:\Windows\System\DEhTYUS.exe
  2⤵
  PID:12004
- C:\Windows\System\GfXMcMU.exe
  C:\Windows\System\GfXMcMU.exe
  2⤵
  PID:12028
- C:\Windows\System\ZyYsmSV.exe
  C:\Windows\System\ZyYsmSV.exe
  2⤵
  PID:12052
- C:\Windows\System\OeVleRt.exe
  C:\Windows\System\OeVleRt.exe
  2⤵
  PID:12076
- C:\Windows\System\tLyXHrp.exe
  C:\Windows\System\tLyXHrp.exe
  2⤵
  PID:12096
- C:\Windows\System\zUMnMkW.exe
  C:\Windows\System\zUMnMkW.exe
  2⤵
  PID:12120
- C:\Windows\System\XcXaRAA.exe
  C:\Windows\System\XcXaRAA.exe
  2⤵
  PID:12144
- C:\Windows\System\rFWCqPx.exe
  C:\Windows\System\rFWCqPx.exe
  2⤵
  PID:12164
- C:\Windows\System\WRDPdQN.exe
  C:\Windows\System\WRDPdQN.exe
  2⤵
  PID:12192
- C:\Windows\System\xBmggId.exe
  C:\Windows\System\xBmggId.exe
  2⤵
  PID:12212
- C:\Windows\System\vyoTsWs.exe
  C:\Windows\System\vyoTsWs.exe
  2⤵
  PID:12240
- C:\Windows\System\ouAAnPA.exe
  C:\Windows\System\ouAAnPA.exe
  2⤵
  PID:12264
- C:\Windows\System\beIgnWh.exe
  C:\Windows\System\beIgnWh.exe
  2⤵
  PID:12280
- C:\Windows\System\CedxlaE.exe
  C:\Windows\System\CedxlaE.exe
  2⤵
  PID:9080
- C:\Windows\System\pxCeVVB.exe
  C:\Windows\System\pxCeVVB.exe
  2⤵
  PID:7240
- C:\Windows\System\yrEePjo.exe
  C:\Windows\System\yrEePjo.exe
  2⤵
  PID:7868
- C:\Windows\System\ViapeQc.exe
  C:\Windows\System\ViapeQc.exe
  2⤵
  PID:8440
- C:\Windows\System\QDuJYGz.exe
  C:\Windows\System\QDuJYGz.exe
  2⤵
  PID:8516
- C:\Windows\System\grSGDvd.exe
  C:\Windows\System\grSGDvd.exe
  2⤵
  PID:9404
- C:\Windows\System\mbkjuOi.exe
  C:\Windows\System\mbkjuOi.exe
  2⤵
  PID:8696
- C:\Windows\System\lNJUOnH.exe
  C:\Windows\System\lNJUOnH.exe
  2⤵
  PID:9024
- C:\Windows\System\qzSsrKa.exe
  C:\Windows\System\qzSsrKa.exe
  2⤵
  PID:7944
- C:\Windows\System\uIDdpoc.exe
  C:\Windows\System\uIDdpoc.exe
  2⤵
  PID:7420
- C:\Windows\System\VFFioSx.exe
  C:\Windows\System\VFFioSx.exe
  2⤵
  PID:10308
- C:\Windows\System\ODYwHhc.exe
  C:\Windows\System\ODYwHhc.exe
  2⤵
  PID:10368
- C:\Windows\System\RtwIZmj.exe
  C:\Windows\System\RtwIZmj.exe
  2⤵
  PID:10444
- C:\Windows\System\WsCEPJk.exe
  C:\Windows\System\WsCEPJk.exe
  2⤵
  PID:9696
- C:\Windows\System\AppWKyN.exe
  C:\Windows\System\AppWKyN.exe
  2⤵
  PID:10612
- C:\Windows\System\jAaCuxc.exe
  C:\Windows\System\jAaCuxc.exe
  2⤵
  PID:10640
- C:\Windows\System\vpiSbna.exe
  C:\Windows\System\vpiSbna.exe
  2⤵
  PID:10736
- C:\Windows\System\TOLmktx.exe
  C:\Windows\System\TOLmktx.exe
  2⤵
  PID:10976
- C:\Windows\System\ajpfQiq.exe
  C:\Windows\System\ajpfQiq.exe
  2⤵
  PID:9912
- C:\Windows\System\yLvkHid.exe
  C:\Windows\System\yLvkHid.exe
  2⤵
  PID:11028
- C:\Windows\System\wEyZbzd.exe
  C:\Windows\System\wEyZbzd.exe
  2⤵
  PID:12308
- C:\Windows\System\OrLTWYG.exe
  C:\Windows\System\OrLTWYG.exe
  2⤵
  PID:12332
- C:\Windows\System\XULHtoX.exe
  C:\Windows\System\XULHtoX.exe
  2⤵
  PID:12352
- C:\Windows\System\WdDkHQi.exe
  C:\Windows\System\WdDkHQi.exe
  2⤵
  PID:12376
- C:\Windows\System\jXohsJW.exe
  C:\Windows\System\jXohsJW.exe
  2⤵
  PID:12400
- C:\Windows\System\shYAceh.exe
  C:\Windows\System\shYAceh.exe
  2⤵
  PID:12436
- C:\Windows\System\UdRZcKM.exe
  C:\Windows\System\UdRZcKM.exe
  2⤵
  PID:12460
- C:\Windows\System\mvBCtbz.exe
  C:\Windows\System\mvBCtbz.exe
  2⤵
  PID:12480
- C:\Windows\System\LBobHKh.exe
  C:\Windows\System\LBobHKh.exe
  2⤵
  PID:12500
- C:\Windows\System\LmaUbtW.exe
  C:\Windows\System\LmaUbtW.exe
  2⤵
  PID:12524
- C:\Windows\System\vpGkUYD.exe
  C:\Windows\System\vpGkUYD.exe
  2⤵
  PID:12548
- C:\Windows\System\rcptsHR.exe
  C:\Windows\System\rcptsHR.exe
  2⤵
  PID:12572
- C:\Windows\System\TYUVTUV.exe
  C:\Windows\System\TYUVTUV.exe
  2⤵
  PID:12600
- C:\Windows\System\SrDYbUd.exe
  C:\Windows\System\SrDYbUd.exe
  2⤵
  PID:12620
- C:\Windows\System\uzouCOt.exe
  C:\Windows\System\uzouCOt.exe
  2⤵
  PID:12640
- C:\Windows\System\wWVNGHI.exe
  C:\Windows\System\wWVNGHI.exe
  2⤵
  PID:12664
- C:\Windows\System\iVibqGY.exe
  C:\Windows\System\iVibqGY.exe
  2⤵
  PID:12684
- C:\Windows\System\UhmwmSB.exe
  C:\Windows\System\UhmwmSB.exe
  2⤵
  PID:12712
- C:\Windows\System\yzuwsSo.exe
  C:\Windows\System\yzuwsSo.exe
  2⤵
  PID:12752
- C:\Windows\System\olQhQiQ.exe
  C:\Windows\System\olQhQiQ.exe
  2⤵
  PID:12772
- C:\Windows\System\VPwshzj.exe
  C:\Windows\System\VPwshzj.exe
  2⤵
  PID:12796
- C:\Windows\System\FvjaAhi.exe
  C:\Windows\System\FvjaAhi.exe
  2⤵
  PID:12820
- C:\Windows\System\tqOBpnP.exe
  C:\Windows\System\tqOBpnP.exe
  2⤵
  PID:12836
- C:\Windows\System\BPDnbfW.exe
  C:\Windows\System\BPDnbfW.exe
  2⤵
  PID:12856
- C:\Windows\System\SaBfAKS.exe
  C:\Windows\System\SaBfAKS.exe
  2⤵
  PID:12872
- C:\Windows\System\HVKlwyL.exe
  C:\Windows\System\HVKlwyL.exe
  2⤵
  PID:12888
- C:\Windows\System\qNcQgca.exe
  C:\Windows\System\qNcQgca.exe
  2⤵
  PID:12908
- C:\Windows\System\qHCwmnm.exe
  C:\Windows\System\qHCwmnm.exe
  2⤵
  PID:12924
- C:\Windows\System\IToarNV.exe
  C:\Windows\System\IToarNV.exe
  2⤵
  PID:12940
- C:\Windows\System\TNrNvmo.exe
  C:\Windows\System\TNrNvmo.exe
  2⤵
  PID:12956
- C:\Windows\System\UJTJmTh.exe
  C:\Windows\System\UJTJmTh.exe
  2⤵
  PID:12976
- C:\Windows\System\xDrYaGe.exe
  C:\Windows\System\xDrYaGe.exe
  2⤵
  PID:13004
- C:\Windows\System\UYjkshj.exe
  C:\Windows\System\UYjkshj.exe
  2⤵
  PID:13024
- C:\Windows\System\HynvnOm.exe
  C:\Windows\System\HynvnOm.exe
  2⤵
  PID:9092
- C:\Windows\System\RrVtDfv.exe
  C:\Windows\System\RrVtDfv.exe
  2⤵
  PID:9180
- C:\Windows\System\zfNAjpa.exe
  C:\Windows\System\zfNAjpa.exe
  2⤵
  PID:12016
- C:\Windows\System\lvGQZhN.exe
  C:\Windows\System\lvGQZhN.exe
  2⤵
  PID:12172
- C:\Windows\System\kCJPjFL.exe
  C:\Windows\System\kCJPjFL.exe
  2⤵
  PID:9524
- C:\Windows\System\dfISvkq.exe
  C:\Windows\System\dfISvkq.exe
  2⤵
  PID:10244
- C:\Windows\System\wXDFqGf.exe
  C:\Windows\System\wXDFqGf.exe
  2⤵
  PID:8868
- C:\Windows\System\VkxMedh.exe
  C:\Windows\System\VkxMedh.exe
  2⤵
  PID:7928
- C:\Windows\System\abzZqJP.exe
  C:\Windows\System\abzZqJP.exe
  2⤵
  PID:10480
- C:\Windows\System\bMVLHNk.exe
  C:\Windows\System\bMVLHNk.exe
  2⤵
  PID:10584
- C:\Windows\System\iMlOckY.exe
  C:\Windows\System\iMlOckY.exe
  2⤵
  PID:10660
- C:\Windows\System\SgaaPyi.exe
  C:\Windows\System\SgaaPyi.exe
  2⤵
  PID:10504
- C:\Windows\System\EwdXshn.exe
  C:\Windows\System\EwdXshn.exe
  2⤵
  PID:10732
- C:\Windows\System\maNvKJS.exe
  C:\Windows\System\maNvKJS.exe
  2⤵
  PID:9864
- C:\Windows\System\MjNKqcY.exe
  C:\Windows\System\MjNKqcY.exe
  2⤵
  PID:11024
- C:\Windows\System\egmnjqB.exe
  C:\Windows\System\egmnjqB.exe
  2⤵
  PID:11168
- C:\Windows\System\sFGgvoD.exe
  C:\Windows\System\sFGgvoD.exe
  2⤵
  PID:9620
- C:\Windows\System\lWuSLGO.exe
  C:\Windows\System\lWuSLGO.exe
  2⤵
  PID:12444
- C:\Windows\System\NtaUMFy.exe
  C:\Windows\System\NtaUMFy.exe
  2⤵
  PID:12588
- C:\Windows\System\qwkOjVS.exe
  C:\Windows\System\qwkOjVS.exe
  2⤵
  PID:12648
- C:\Windows\System\HRzHQzf.exe
  C:\Windows\System\HRzHQzf.exe
  2⤵
  PID:12676
- C:\Windows\System\gVtXFMK.exe
  C:\Windows\System\gVtXFMK.exe
  2⤵
  PID:11580
- C:\Windows\System\EQxYiVl.exe
  C:\Windows\System\EQxYiVl.exe
  2⤵
  PID:11492
- C:\Windows\System\ChgBknb.exe
  C:\Windows\System\ChgBknb.exe
  2⤵
  PID:11620
- C:\Windows\System\obWIJMp.exe
  C:\Windows\System\obWIJMp.exe
  2⤵
  PID:11808
- C:\Windows\System\TPsafOP.exe
  C:\Windows\System\TPsafOP.exe
  2⤵
  PID:11744
- C:\Windows\System\egMwEYP.exe
  C:\Windows\System\egMwEYP.exe
  2⤵
  PID:12204
- C:\Windows\System\uOoJEEi.exe
  C:\Windows\System\uOoJEEi.exe
  2⤵
  PID:11980
- C:\Windows\System\oYMJqmd.exe
  C:\Windows\System\oYMJqmd.exe
  2⤵
  PID:10688
- C:\Windows\System\rkXKFuJ.exe
  C:\Windows\System\rkXKFuJ.exe
  2⤵
  PID:12368
- C:\Windows\System\ebBSibF.exe
  C:\Windows\System\ebBSibF.exe
  2⤵
  PID:12412
- C:\Windows\System\bdbhStN.exe
  C:\Windows\System\bdbhStN.exe
  2⤵
  PID:12488
- C:\Windows\System\UqvAFVf.exe
  C:\Windows\System\UqvAFVf.exe
  2⤵
  PID:12512
- C:\Windows\System\WUOYESp.exe
  C:\Windows\System\WUOYESp.exe
  2⤵
  PID:12744
- C:\Windows\System\fmkGqZO.exe
  C:\Windows\System\fmkGqZO.exe
  2⤵
  PID:12780
- C:\Windows\System\fUqlKlt.exe
  C:\Windows\System\fUqlKlt.exe
  2⤵
  PID:12868
- C:\Windows\System\lVkgFjD.exe
  C:\Windows\System\lVkgFjD.exe
  2⤵
  PID:12984
- C:\Windows\System\PazUrcS.exe
  C:\Windows\System\PazUrcS.exe
  2⤵
  PID:13048
- C:\Windows\System\sKvWhEv.exe
  C:\Windows\System\sKvWhEv.exe
  2⤵
  PID:13072
- C:\Windows\System\IUOZDlC.exe
  C:\Windows\System\IUOZDlC.exe
  2⤵
  PID:13136
- C:\Windows\System\sqMuoTq.exe
  C:\Windows\System\sqMuoTq.exe
  2⤵
  PID:13228
- C:\Windows\System\sMbSLqO.exe
  C:\Windows\System\sMbSLqO.exe
  2⤵
  PID:10028
- C:\Windows\System\TUzICPP.exe
  C:\Windows\System\TUzICPP.exe
  2⤵
  PID:11272
- C:\Windows\System\LBIVBHo.exe
  C:\Windows\System\LBIVBHo.exe
  2⤵
  PID:11448
- C:\Windows\System\lexwFDI.exe
  C:\Windows\System\lexwFDI.exe
  2⤵
  PID:9436
- C:\Windows\System\EUyFlmA.exe
  C:\Windows\System\EUyFlmA.exe
  2⤵
  PID:8928
- C:\Windows\System\NCNomuX.exe
  C:\Windows\System\NCNomuX.exe
  2⤵
  PID:11232
- C:\Windows\System\gHYGlFj.exe
  C:\Windows\System\gHYGlFj.exe
  2⤵
  PID:11144
- C:\Windows\System\UIJcXkR.exe
  C:\Windows\System\UIJcXkR.exe
  2⤵
  PID:10796
- C:\Windows\System\YMohJQV.exe
  C:\Windows\System\YMohJQV.exe
  2⤵
  PID:10916
- C:\Windows\System\hDjENbc.exe
  C:\Windows\System\hDjENbc.exe
  2⤵
  PID:10896
- C:\Windows\System\DVErFtY.exe
  C:\Windows\System\DVErFtY.exe
  2⤵
  PID:10868
- C:\Windows\System\sRyBfTJ.exe
  C:\Windows\System\sRyBfTJ.exe
  2⤵
  PID:10848
- C:\Windows\System\mBppTIi.exe
  C:\Windows\System\mBppTIi.exe
  2⤵
  PID:10824
- C:\Windows\System\xsgVbZn.exe
  C:\Windows\System\xsgVbZn.exe
  2⤵
  PID:10804
- C:\Windows\System\wXLzgVB.exe
  C:\Windows\System\wXLzgVB.exe
  2⤵
  PID:10264
- C:\Windows\System\VUIkQdI.exe
  C:\Windows\System\VUIkQdI.exe
  2⤵
  PID:9724
- C:\Windows\System\PhjgrRh.exe
  C:\Windows\System\PhjgrRh.exe
  2⤵
  PID:12232
- C:\Windows\System\BZQHiCf.exe
  C:\Windows\System\BZQHiCf.exe
  2⤵
  PID:12252
- C:\Windows\System\iHijqPN.exe
  C:\Windows\System\iHijqPN.exe
  2⤵
  PID:12968
- C:\Windows\System\unvJqdS.exe
  C:\Windows\System\unvJqdS.exe
  2⤵
  PID:12012
- C:\Windows\System\tgHjVUV.exe
  C:\Windows\System\tgHjVUV.exe
  2⤵
  PID:13012
- C:\Windows\System\XoObmFA.exe
  C:\Windows\System\XoObmFA.exe
  2⤵
  PID:13128
- C:\Windows\System\LWJXEOV.exe
  C:\Windows\System\LWJXEOV.exe
  2⤵
  PID:11944
- C:\Windows\System\WSkMiwt.exe
  C:\Windows\System\WSkMiwt.exe
  2⤵
  PID:5496
- C:\Windows\System\klpEpbG.exe
  C:\Windows\System\klpEpbG.exe
  2⤵
  PID:10328
- C:\Windows\System\nNSrPrn.exe
  C:\Windows\System\nNSrPrn.exe
  2⤵
  PID:10932
- C:\Windows\System\ThDKcOc.exe
  C:\Windows\System\ThDKcOc.exe
  2⤵
  PID:10864
- C:\Windows\System\dFfgFKn.exe
  C:\Windows\System\dFfgFKn.exe
  2⤵
  PID:11896
- C:\Windows\System\iasjffH.exe
  C:\Windows\System\iasjffH.exe
  2⤵
  PID:9112
- C:\Windows\System\UhKkLfQ.exe
  C:\Windows\System\UhKkLfQ.exe
  2⤵
  PID:8436
- C:\Windows\System\cmmqhyP.exe
  C:\Windows\System\cmmqhyP.exe
  2⤵
  PID:12064
- C:\Windows\System\IVfyXQU.exe
  C:\Windows\System\IVfyXQU.exe
  2⤵
  PID:3032
- C:\Windows\System\IlNMxoN.exe
  C:\Windows\System\IlNMxoN.exe
  2⤵
  PID:10500
- C:\Windows\System\YmKNfSd.exe
  C:\Windows\System\YmKNfSd.exe
  2⤵
  PID:9560
- C:\Windows\System\DOkcyaD.exe
  C:\Windows\System\DOkcyaD.exe
  2⤵
  PID:13324
- C:\Windows\System\sgaztEY.exe
  C:\Windows\System\sgaztEY.exe
  2⤵
  PID:11048
- C:\Windows\System\HDnYHLO.exe
  C:\Windows\System\HDnYHLO.exe
  2⤵
  PID:12672
- C:\Windows\System\owecoME.exe
  C:\Windows\System\owecoME.exe
  2⤵
  PID:10096
- C:\Windows\System\UIJHgii.exe
  C:\Windows\System\UIJHgii.exe
  2⤵
  PID:12864
- C:\Windows\System\NDmEPDT.exe
  C:\Windows\System\NDmEPDT.exe
  2⤵
  PID:13488
- C:\Windows\System\jknIiLd.exe
  C:\Windows\System\jknIiLd.exe
  2⤵
  PID:13500
- C:\Windows\System\ZJxfRvb.exe
  C:\Windows\System\ZJxfRvb.exe
  2⤵
  PID:12364
- C:\Windows\System\tPFJiLF.exe
  C:\Windows\System\tPFJiLF.exe
  2⤵
  PID:12476
- C:\Windows\System\UhLkZXv.exe
  C:\Windows\System\UhLkZXv.exe
  2⤵
  PID:12808
- C:\Windows\System\dgUbqrO.exe
  C:\Windows\System\dgUbqrO.exe
  2⤵
  PID:13016
- C:\Windows\System\nfLGLaE.exe
  C:\Windows\System\nfLGLaE.exe
  2⤵
  PID:8908
- C:\Windows\System\ffLDjky.exe
  C:\Windows\System\ffLDjky.exe
  2⤵
  PID:13620
- C:\Windows\System\KSLaFvW.exe
  C:\Windows\System\KSLaFvW.exe
  2⤵
  PID:13708
- C:\Windows\System\YULyOPp.exe
  C:\Windows\System\YULyOPp.exe
  2⤵
  PID:10420
- C:\Windows\System\qLNwzYh.exe
  C:\Windows\System\qLNwzYh.exe
  2⤵
  PID:13820
- C:\Windows\System\RxDBDJI.exe
  C:\Windows\System\RxDBDJI.exe
  2⤵
  PID:11260
- C:\Windows\System\aZAGHuq.exe
  C:\Windows\System\aZAGHuq.exe
  2⤵
  PID:11528
- C:\Windows\System\MGMBAZx.exe
  C:\Windows\System\MGMBAZx.exe
  2⤵
  PID:12496
- C:\Windows\System\oAfvhEy.exe
  C:\Windows\System\oAfvhEy.exe
  2⤵
  PID:13288
- C:\Windows\System\YkQQbrW.exe
  C:\Windows\System\YkQQbrW.exe
  2⤵
  PID:13760
- C:\Windows\System\oYPwOgM.exe
  C:\Windows\System\oYPwOgM.exe
  2⤵
  PID:2836
- C:\Windows\System\aYajGxP.exe
  C:\Windows\System\aYajGxP.exe
  2⤵
  PID:14004
- C:\Windows\System\ANXuUql.exe
  C:\Windows\System\ANXuUql.exe
  2⤵
  PID:14208
- C:\Windows\System\gzWHqSQ.exe
  C:\Windows\System\gzWHqSQ.exe
  2⤵
  PID:13624
- C:\Windows\System\LSAtdJG.exe
  C:\Windows\System\LSAtdJG.exe
  2⤵
  PID:14272
- C:\Windows\System\eHKabLR.exe
  C:\Windows\System\eHKabLR.exe
  2⤵
  PID:10812
- C:\Windows\System\DjXtrdt.exe
  C:\Windows\System\DjXtrdt.exe
  2⤵
  PID:12320
- C:\Windows\System\juHcurZ.exe
  C:\Windows\System\juHcurZ.exe
  2⤵
  PID:13400
- C:\Windows\System\MglLjln.exe
  C:\Windows\System\MglLjln.exe
  2⤵
  PID:13776
- C:\Windows\System\iubgCuU.exe
  C:\Windows\System\iubgCuU.exe
  2⤵
  PID:13964
- C:\Windows\System\lCLnVpG.exe
  C:\Windows\System\lCLnVpG.exe
  2⤵
  PID:13932
- C:\Windows\System\rkzUIap.exe
  C:\Windows\System\rkzUIap.exe
  2⤵
  PID:14228
- C:\Windows\System\KFyOQol.exe
  C:\Windows\System\KFyOQol.exe
  2⤵
  PID:14040
- C:\Windows\System\MsJajup.exe
  C:\Windows\System\MsJajup.exe
  2⤵
  PID:14044
- C:\Windows\System\JgcessQ.exe
  C:\Windows\System\JgcessQ.exe
  2⤵
  PID:14048
- C:\Windows\System\wXYHzjL.exe
  C:\Windows\System\wXYHzjL.exe
  2⤵
  PID:13748
- C:\Windows\System\dhDzjQh.exe
  C:\Windows\System\dhDzjQh.exe
  2⤵
  PID:14188
- C:\Windows\System\UVEAvmw.exe
  C:\Windows\System\UVEAvmw.exe
  2⤵
  PID:14284
- C:\Windows\System\yxjicwb.exe
  C:\Windows\System\yxjicwb.exe
  2⤵
  PID:14060
- C:\Windows\System\wOOocMI.exe
  C:\Windows\System\wOOocMI.exe
  2⤵
  PID:9936
- C:\Windows\System\zzVJEzg.exe
  C:\Windows\System\zzVJEzg.exe
  2⤵
  PID:12000
- C:\Windows\System\jkOzaAc.exe
  C:\Windows\System\jkOzaAc.exe
  2⤵
  PID:11860
- C:\Windows\System\alFFSmg.exe
  C:\Windows\System\alFFSmg.exe
  2⤵
  PID:9744
- C:\Windows\System\BBRTrof.exe
  C:\Windows\System\BBRTrof.exe
  2⤵
  PID:4712
- C:\Windows\System\onbzgbi.exe
  C:\Windows\System\onbzgbi.exe
  2⤵
  PID:13924
- C:\Windows\System\LHonJRW.exe
  C:\Windows\System\LHonJRW.exe
  2⤵
  PID:13556
- C:\Windows\System\YhxxcNz.exe
  C:\Windows\System\YhxxcNz.exe
  2⤵
  PID:13236
- C:\Windows\System\XGHBJsi.exe
  C:\Windows\System\XGHBJsi.exe
  2⤵
  PID:11540
- C:\Windows\System\xeRcLZM.exe
  C:\Windows\System\xeRcLZM.exe
  2⤵
  PID:13992
- C:\Windows\System\gbpLEeb.exe
  C:\Windows\System\gbpLEeb.exe
  2⤵
  PID:13724
- C:\Windows\System\GXLJFeM.exe
  C:\Windows\System\GXLJFeM.exe
  2⤵
  PID:11276
- C:\Windows\System\MmWAlRu.exe
  C:\Windows\System\MmWAlRu.exe
  2⤵
  PID:5472
- C:\Windows\System\pEOZQta.exe
  C:\Windows\System\pEOZQta.exe
  2⤵
  PID:13460
- C:\Windows\System\SMBpbcg.exe
  C:\Windows\System\SMBpbcg.exe
  2⤵
  PID:12852
- C:\Windows\System\KcNRbCo.exe
  C:\Windows\System\KcNRbCo.exe
  2⤵
  PID:4916
- C:\Windows\System\NELMBcv.exe
  C:\Windows\System\NELMBcv.exe
  2⤵
  PID:5008
- C:\Windows\System\NlppoFR.exe
  C:\Windows\System\NlppoFR.exe
  2⤵
  PID:13364
- C:\Windows\System\CzdBXuy.exe
  C:\Windows\System\CzdBXuy.exe
  2⤵
  PID:13976
- C:\Windows\System\JbtyzMM.exe
  C:\Windows\System\JbtyzMM.exe
  2⤵
  PID:11764
- C:\Windows\System\HTpCzZO.exe
  C:\Windows\System\HTpCzZO.exe
  2⤵
  PID:4776
- C:\Windows\System\LZoALGD.exe
  C:\Windows\System\LZoALGD.exe
  2⤵
  PID:8216
- C:\Windows\System\QmnDAAm.exe
  C:\Windows\System\QmnDAAm.exe
  2⤵
  PID:14160
- C:\Windows\System\pIjrvxs.exe
  C:\Windows\System\pIjrvxs.exe
  2⤵
  PID:12952
- C:\Windows\System\pekiFVE.exe
  C:\Windows\System\pekiFVE.exe
  2⤵
  PID:13412
- C:\Windows\System\OTAgkCS.exe
  C:\Windows\System\OTAgkCS.exe
  2⤵
  PID:2208
- C:\Windows\System\eFctHFl.exe
  C:\Windows\System\eFctHFl.exe
  2⤵
  PID:13536
- C:\Windows\System\aPFgMVh.exe
  C:\Windows\System\aPFgMVh.exe
  2⤵
  PID:12732
- C:\Windows\System\PvUKSBF.exe
  C:\Windows\System\PvUKSBF.exe
  2⤵
  PID:6196
- C:\Windows\System\ReLDHhT.exe
  C:\Windows\System\ReLDHhT.exe
  2⤵
  PID:13332
- C:\Windows\System\YjFOjtc.exe
  C:\Windows\System\YjFOjtc.exe
  2⤵
  PID:10064
- C:\Windows\System\HjmaGSr.exe
  C:\Windows\System\HjmaGSr.exe
  2⤵
  PID:5348
- C:\Windows\System\JHrrQBB.exe
  C:\Windows\System\JHrrQBB.exe
  2⤵
  PID:13908
- C:\Windows\System\haSerOh.exe
  C:\Windows\System\haSerOh.exe
  2⤵
  PID:4784
- C:\Windows\System\NfWbXbk.exe
  C:\Windows\System\NfWbXbk.exe
  2⤵
  PID:14024
- C:\Windows\System\yjvtzKH.exe
  C:\Windows\System\yjvtzKH.exe
  2⤵
  PID:4636
- C:\Windows\System\xjQIaWM.exe
  C:\Windows\System\xjQIaWM.exe
  2⤵
  PID:3296
- C:\Windows\System\vLwalvz.exe
  C:\Windows\System\vLwalvz.exe
  2⤵
  PID:5444
- C:\Windows\System\IuDtWtz.exe
  C:\Windows\System\IuDtWtz.exe
  2⤵
  PID:1608
- C:\Windows\System\YfPNnqd.exe
  C:\Windows\System\YfPNnqd.exe
  2⤵
  PID:396
- C:\Windows\System\FMbkykS.exe
  C:\Windows\System\FMbkykS.exe
  2⤵
  PID:620
- C:\Windows\System\dVDERUe.exe
  C:\Windows\System\dVDERUe.exe
  2⤵
  PID:10628
- C:\Windows\System\eNsewfn.exe
  C:\Windows\System\eNsewfn.exe
  2⤵
  PID:13832
- C:\Windows\System\dACkyMp.exe
  C:\Windows\System\dACkyMp.exe
  2⤵
  PID:9684
- C:\Windows\System\JTWtFFq.exe
  C:\Windows\System\JTWtFFq.exe
  2⤵
  PID:11256
- C:\Windows\System\FeVXvHJ.exe
  C:\Windows\System\FeVXvHJ.exe
  2⤵
  PID:3412
- C:\Windows\System\TqrRCBg.exe
  C:\Windows\System\TqrRCBg.exe
  2⤵
  PID:14036
- C:\Windows\System\uHAOCHW.exe
  C:\Windows\System\uHAOCHW.exe
  2⤵
  PID:1592
- C:\Windows\System\XdbCzxc.exe
  C:\Windows\System\XdbCzxc.exe
  2⤵
  PID:3284
- C:\Windows\System\KdtiHkA.exe
  C:\Windows\System\KdtiHkA.exe
  2⤵
  PID:13428
- C:\Windows\System\Sjdwqej.exe
  C:\Windows\System\Sjdwqej.exe
  2⤵
  PID:4912
- C:\Windows\System\DyTUJyn.exe
  C:\Windows\System\DyTUJyn.exe
  2⤵
  PID:3332
- C:\Windows\System\reioAgs.exe
  C:\Windows\System\reioAgs.exe
  2⤵
  PID:5600
- C:\Windows\System\yQgDwwi.exe
  C:\Windows\System\yQgDwwi.exe
  2⤵
  PID:4544
- C:\Windows\System\kdLlqSm.exe
  C:\Windows\System\kdLlqSm.exe
  2⤵
  PID:10344
- C:\Windows\System\fZPxAIS.exe
  C:\Windows\System\fZPxAIS.exe
  2⤵
  PID:11392
- C:\Windows\System\FcYePKF.exe
  C:\Windows\System\FcYePKF.exe
  2⤵
  PID:13548
- C:\Windows\System\CEQrWGq.exe
  C:\Windows\System\CEQrWGq.exe
  2⤵
  PID:10136
- C:\Windows\System\pGDiIhV.exe
  C:\Windows\System\pGDiIhV.exe
  2⤵
  PID:3432
- C:\Windows\System\ILcVqTt.exe
  C:\Windows\System\ILcVqTt.exe
  2⤵
  PID:4160
- C:\Windows\System\RNbqRKH.exe
  C:\Windows\System\RNbqRKH.exe
  2⤵
  PID:4548
- C:\Windows\System\goYEQez.exe
  C:\Windows\System\goYEQez.exe
  2⤵
  PID:844
- C:\Windows\System\HdOtxmh.exe
  C:\Windows\System\HdOtxmh.exe
  2⤵
  PID:10832
- C:\Windows\System\kMZDNXq.exe
  C:\Windows\System\kMZDNXq.exe
  2⤵
  PID:1428
- C:\Windows\System\urFLBml.exe
  C:\Windows\System\urFLBml.exe
  2⤵
  PID:10880
- C:\Windows\System\YtqvGxI.exe
  C:\Windows\System\YtqvGxI.exe
  2⤵
  PID:2228
- C:\Windows\System\KVMoxXF.exe
  C:\Windows\System\KVMoxXF.exe
  2⤵
  PID:3680
- C:\Windows\System\VXQPBnZ.exe
  C:\Windows\System\VXQPBnZ.exe
  2⤵
  PID:1148
- C:\Windows\System\YFSgTsZ.exe
  C:\Windows\System\YFSgTsZ.exe
  2⤵
  PID:8376
- C:\Windows\System\QZNubmy.exe
  C:\Windows\System\QZNubmy.exe
  2⤵
  PID:552
- C:\Windows\System\LNgCCJw.exe
  C:\Windows\System\LNgCCJw.exe
  2⤵
  PID:11208
- C:\Windows\System\BERjyvG.exe
  C:\Windows\System\BERjyvG.exe
  2⤵
  PID:5040
- C:\Windows\System\sQVNMsf.exe
  C:\Windows\System\sQVNMsf.exe
  2⤵
  PID:2616
- C:\Windows\System\mbsUzQz.exe
  C:\Windows\System\mbsUzQz.exe
  2⤵
  PID:2672
- C:\Windows\System\vRIzzoB.exe
  C:\Windows\System\vRIzzoB.exe
  2⤵
  PID:2540
- C:\Windows\System\gaKGzAY.exe
  C:\Windows\System\gaKGzAY.exe
  2⤵
  PID:4788
- C:\Windows\System\HoMmNSO.exe
  C:\Windows\System\HoMmNSO.exe
  2⤵
  PID:4868
- C:\Windows\System\yiwnqNY.exe
  C:\Windows\System\yiwnqNY.exe
  2⤵
  PID:3628
- C:\Windows\System\LtQlYea.exe
  C:\Windows\System\LtQlYea.exe
  2⤵
  PID:884
- C:\Windows\System\yHZJTvL.exe
  C:\Windows\System\yHZJTvL.exe
  2⤵
  PID:528
- C:\Windows\System\GRdXcmk.exe
  C:\Windows\System\GRdXcmk.exe
  2⤵
  PID:2708
- C:\Windows\System\ClSSSqo.exe
  C:\Windows\System\ClSSSqo.exe
  2⤵
  PID:4932
- C:\Windows\System\FRNvUwK.exe
  C:\Windows\System\FRNvUwK.exe
  2⤵
  PID:2812
- C:\Windows\System\ZqLbEAO.exe
  C:\Windows\System\ZqLbEAO.exe
  2⤵
  PID:3836
- C:\Windows\System\NLQMGtA.exe
  C:\Windows\System\NLQMGtA.exe
  2⤵
  PID:1612
- C:\Windows\System\DxPhJtu.exe
  C:\Windows\System\DxPhJtu.exe
  2⤵
  PID:5100
- C:\Windows\System\XplxKzk.exe
  C:\Windows\System\XplxKzk.exe
  2⤵
  PID:2040
- C:\Windows\System\EnKuOpF.exe
  C:\Windows\System\EnKuOpF.exe
  2⤵
  PID:5056
- C:\Windows\System\zVmWwDY.exe
  C:\Windows\System\zVmWwDY.exe
  2⤵
  PID:3908
- C:\Windows\System\umiacDG.exe
  C:\Windows\System\umiacDG.exe
  2⤵
  PID:1276
- C:\Windows\System\XIXsoQJ.exe
  C:\Windows\System\XIXsoQJ.exe
  2⤵
  PID:4128
- C:\Windows\System\efFbwkc.exe
  C:\Windows\System\efFbwkc.exe
  2⤵
  PID:996
- C:\Windows\System\SpRZBwM.exe
  C:\Windows\System\SpRZBwM.exe
  2⤵
  PID:4556
- C:\Windows\System\HbBAewC.exe
  C:\Windows\System\HbBAewC.exe
  2⤵
  PID:4620
- C:\Windows\System\uJgCdhU.exe
  C:\Windows\System\uJgCdhU.exe
  2⤵
  PID:2432
- C:\Windows\System\bPEirUC.exe
  C:\Windows\System\bPEirUC.exe
  2⤵
  PID:116
- C:\Windows\System\tMtsWVZ.exe
  C:\Windows\System\tMtsWVZ.exe
  2⤵
  PID:3404
- C:\Windows\System\wpSHQIl.exe
  C:\Windows\System\wpSHQIl.exe
  2⤵
  PID:9792
- C:\Windows\System\VrfxNYb.exe
  C:\Windows\System\VrfxNYb.exe
  2⤵
  PID:5296
- C:\Windows\System\fhjbVIq.exe
  C:\Windows\System\fhjbVIq.exe
  2⤵
  PID:5304
- C:\Windows\System\qxRrQsK.exe
  C:\Windows\System\qxRrQsK.exe
  2⤵
  PID:4016
- C:\Windows\System\mZYVMCR.exe
  C:\Windows\System\mZYVMCR.exe
  2⤵
  PID:7524
- C:\Windows\System\JqXhNsF.exe
  C:\Windows\System\JqXhNsF.exe
  2⤵
  PID:1864
- C:\Windows\System\LJMnDiu.exe
  C:\Windows\System\LJMnDiu.exe
  2⤵
  PID:3324
- C:\Windows\System\zSFIDhh.exe
  C:\Windows\System\zSFIDhh.exe
  2⤵
  PID:848
- C:\Windows\System\rQtDGhl.exe
  C:\Windows\System\rQtDGhl.exe
  2⤵
  PID:1364
- C:\Windows\System\lNgtYrI.exe
  C:\Windows\System\lNgtYrI.exe
  2⤵
  PID:5624
- C:\Windows\System\YIeyVpZ.exe
  C:\Windows\System\YIeyVpZ.exe
  2⤵
  PID:6084
- C:\Windows\System\MGOQpVm.exe
  C:\Windows\System\MGOQpVm.exe
  2⤵
  PID:6128
- C:\Windows\System\sCUXMOs.exe
  C:\Windows\System\sCUXMOs.exe
  2⤵
  PID:5836
- C:\Windows\System\ZyjQaJd.exe
  C:\Windows\System\ZyjQaJd.exe
  2⤵
  PID:3684
- C:\Windows\System\dncDEzn.exe
  C:\Windows\System\dncDEzn.exe
  2⤵
  PID:5404
- C:\Windows\System\jXZjtZv.exe
  C:\Windows\System\jXZjtZv.exe
  2⤵
  PID:5392
- C:\Windows\System\UWDeVum.exe
  C:\Windows\System\UWDeVum.exe
  2⤵
  PID:5976
- C:\Windows\System\QqxqcpZ.exe
  C:\Windows\System\QqxqcpZ.exe
  2⤵
  PID:5632
- C:\Windows\System\wiwpnlN.exe
  C:\Windows\System\wiwpnlN.exe
  2⤵
  PID:5516
- C:\Windows\System\smZuvFC.exe
  C:\Windows\System\smZuvFC.exe
  2⤵
  PID:5176
- C:\Windows\System\KFlQFfr.exe
  C:\Windows\System\KFlQFfr.exe
  2⤵
  PID:5504
- C:\Windows\System\pWdfCwi.exe
  C:\Windows\System\pWdfCwi.exe
  2⤵
  PID:5308
- C:\Windows\System\WDAhCjU.exe
  C:\Windows\System\WDAhCjU.exe
  2⤵
  PID:3508
- C:\Windows\System\HFfWQjk.exe
  C:\Windows\System\HFfWQjk.exe
  2⤵
  PID:5628
- C:\Windows\System\HtsQWrk.exe
  C:\Windows\System\HtsQWrk.exe
  2⤵
  PID:872
- C:\Windows\System\FwnVnvO.exe
  C:\Windows\System\FwnVnvO.exe
  2⤵
  PID:5968
- C:\Windows\System\rCygoSJ.exe
  C:\Windows\System\rCygoSJ.exe
  2⤵
  PID:5388
- C:\Windows\System\qcATEfo.exe
  C:\Windows\System\qcATEfo.exe
  2⤵
  PID:5840
- C:\Windows\System\hGlkTlb.exe
  C:\Windows\System\hGlkTlb.exe
  2⤵
  PID:6136
- C:\Windows\System\CBzpqjW.exe
  C:\Windows\System\CBzpqjW.exe
  2⤵
  PID:3612
- C:\Windows\System\DMSrapq.exe
  C:\Windows\System\DMSrapq.exe
  2⤵
  PID:6012
- C:\Windows\System\chDZvVZ.exe
  C:\Windows\System\chDZvVZ.exe
  2⤵
  PID:14368
- C:\Windows\System\MSFrXJi.exe
  C:\Windows\System\MSFrXJi.exe
  2⤵
  PID:14396
- C:\Windows\System\cTCeIcL.exe
  C:\Windows\System\cTCeIcL.exe
  2⤵
  PID:14432
- C:\Windows\System\RnEyCPi.exe
  C:\Windows\System\RnEyCPi.exe
  2⤵
  PID:14464
- C:\Windows\System\pIsbpkd.exe
  C:\Windows\System\pIsbpkd.exe
  2⤵
  PID:14492
- C:\Windows\System\svQvFMT.exe
  C:\Windows\System\svQvFMT.exe
  2⤵
  PID:14520
- C:\Windows\System\rUqbuXu.exe
  C:\Windows\System\rUqbuXu.exe
  2⤵
  PID:14552
- C:\Windows\System\UdlhLhZ.exe
  C:\Windows\System\UdlhLhZ.exe
  2⤵
  PID:14580
- C:\Windows\System\HxFLwWU.exe
  C:\Windows\System\HxFLwWU.exe
  2⤵
  PID:14612
- C:\Windows\System\gYJcCZz.exe
  C:\Windows\System\gYJcCZz.exe
  2⤵
  PID:14636
- C:\Windows\System\GZVASMp.exe
  C:\Windows\System\GZVASMp.exe
  2⤵
  PID:14664
- C:\Windows\System\yOCseeK.exe
  C:\Windows\System\yOCseeK.exe
  2⤵
  PID:14692
- C:\Windows\System\xPudTVM.exe
  C:\Windows\System\xPudTVM.exe
  2⤵
  PID:14720
- C:\Windows\System\XMLLiHj.exe
  C:\Windows\System\XMLLiHj.exe
  2⤵
  PID:14752
- C:\Windows\System\teUItjs.exe
  C:\Windows\System\teUItjs.exe
  2⤵
  PID:14784
- C:\Windows\System\QRIrLQo.exe
  C:\Windows\System\QRIrLQo.exe
  2⤵
  PID:14820
- C:\Windows\System\PnyXLSQ.exe
  C:\Windows\System\PnyXLSQ.exe
  2⤵
  PID:14900
- C:\Windows\System\xGRqqGq.exe
  C:\Windows\System\xGRqqGq.exe
  2⤵
  PID:14928
- C:\Windows\System\yYpvbhn.exe
  C:\Windows\System\yYpvbhn.exe
  2⤵
  PID:14964
- C:\Windows\System\rSkRiEH.exe
  C:\Windows\System\rSkRiEH.exe
  2⤵
  PID:14992
- C:\Windows\System\WhOQuLS.exe
  C:\Windows\System\WhOQuLS.exe
  2⤵
  PID:15028
- C:\Windows\System\PElsRoB.exe
  C:\Windows\System\PElsRoB.exe
  2⤵
  PID:15052
- C:\Windows\System\kSFKpgm.exe
  C:\Windows\System\kSFKpgm.exe
  2⤵
  PID:15088
- C:\Windows\System\WNVCecU.exe
  C:\Windows\System\WNVCecU.exe
  2⤵
  PID:15116
- C:\Windows\System\HlLhtYn.exe
  C:\Windows\System\HlLhtYn.exe
  2⤵
  PID:15192
- C:\Windows\System\GIXgBXu.exe
  C:\Windows\System\GIXgBXu.exe
  2⤵
  PID:15240
- C:\Windows\System\Jwamxyh.exe
  C:\Windows\System\Jwamxyh.exe
  2⤵
  PID:15280
- C:\Windows\System\AqYiHSj.exe
  C:\Windows\System\AqYiHSj.exe
  2⤵
  PID:15308
- C:\Windows\System\ZWeumuR.exe
  C:\Windows\System\ZWeumuR.exe
  2⤵
  PID:14448
- C:\Windows\System\HxNSEnN.exe
  C:\Windows\System\HxNSEnN.exe
  2⤵
  PID:14360
- C:\Windows\System\lNCgLuN.exe
  C:\Windows\System\lNCgLuN.exe
  2⤵
  PID:14456
- C:\Windows\System\bvLwpPC.exe
  C:\Windows\System\bvLwpPC.exe
  2⤵
  PID:14528
- C:\Windows\System\LjWuRth.exe
  C:\Windows\System\LjWuRth.exe
  2⤵
  PID:14592
- C:\Windows\System\JQiqavZ.exe
  C:\Windows\System\JQiqavZ.exe
  2⤵
  PID:6648
- C:\Windows\System\uxmGnyb.exe
  C:\Windows\System\uxmGnyb.exe
  2⤵
  PID:6748
- C:\Windows\System\ftCpQik.exe
  C:\Windows\System\ftCpQik.exe
  2⤵
  PID:14880
- C:\Windows\System\gMZHUXJ.exe
  C:\Windows\System\gMZHUXJ.exe
  2⤵
  PID:14908
- C:\Windows\System\VCBGYxk.exe
  C:\Windows\System\VCBGYxk.exe
  2⤵
  PID:14812
- C:\Windows\System\BDjFXyG.exe
  C:\Windows\System\BDjFXyG.exe
  2⤵
  PID:14828
- C:\Windows\System\qHfRUrO.exe
  C:\Windows\System\qHfRUrO.exe
  2⤵
  PID:15000
- C:\Windows\System\fDBPpuv.exe
  C:\Windows\System\fDBPpuv.exe
  2⤵
  PID:14940
- C:\Windows\System\RqNLxHz.exe
  C:\Windows\System\RqNLxHz.exe
  2⤵
  PID:15048
- C:\Windows\System\HApBaOk.exe
  C:\Windows\System\HApBaOk.exe
  2⤵
  PID:15024
- C:\Windows\System\MgIcExV.exe
  C:\Windows\System\MgIcExV.exe
  2⤵
  PID:7008
- C:\Windows\System\EKzjPoU.exe
  C:\Windows\System\EKzjPoU.exe
  2⤵
  PID:15176
- C:\Windows\System\zlceZZo.exe
  C:\Windows\System\zlceZZo.exe
  2⤵
  PID:15276
- C:\Windows\System\fOcNjjP.exe
  C:\Windows\System\fOcNjjP.exe
  2⤵
  PID:15188
- C:\Windows\System\ArQyVQl.exe
  C:\Windows\System\ArQyVQl.exe
  2⤵
  PID:5480
- C:\Windows\System\WDUFRkB.exe
  C:\Windows\System\WDUFRkB.exe
  2⤵
  PID:6552
- C:\Windows\System\tSsQyhH.exe
  C:\Windows\System\tSsQyhH.exe
  2⤵
  PID:14488
- C:\Windows\System\SRHxDxA.exe
  C:\Windows\System\SRHxDxA.exe
  2⤵
  PID:7076
- C:\Windows\System\lplZcDv.exe
  C:\Windows\System\lplZcDv.exe
  2⤵
  PID:14864
- C:\Windows\System\xcoiGdQ.exe
  C:\Windows\System\xcoiGdQ.exe
  2⤵
  PID:14708
- C:\Windows\System\ysGarsJ.exe
  C:\Windows\System\ysGarsJ.exe
  2⤵
  PID:14588
- C:\Windows\System\hwsepuI.exe
  C:\Windows\System\hwsepuI.exe
  2⤵
  PID:14424
- C:\Windows\System\oBxnAMf.exe
  C:\Windows\System\oBxnAMf.exe
  2⤵
  PID:8044
- C:\Windows\System\lcIPiLL.exe
  C:\Windows\System\lcIPiLL.exe
  2⤵
  PID:14500
- C:\Windows\System\uoUwfKW.exe
  C:\Windows\System\uoUwfKW.exe
  2⤵
  PID:14740
- C:\Windows\System\JmsPwjC.exe
  C:\Windows\System\JmsPwjC.exe
  2⤵
  PID:14876
- C:\Windows\System\DhTUyIE.exe
  C:\Windows\System\DhTUyIE.exe
  2⤵
  PID:14912
- C:\Windows\System\IsPVtgC.exe
  C:\Windows\System\IsPVtgC.exe
  2⤵
  PID:14676
- C:\Windows\System\uYURRhM.exe
  C:\Windows\System\uYURRhM.exe
  2⤵
  PID:15040
- C:\Windows\System\yykOgrt.exe
  C:\Windows\System\yykOgrt.exe
  2⤵
  PID:15104
- C:\Windows\System\gzcSyEv.exe
  C:\Windows\System\gzcSyEv.exe
  2⤵
  PID:14796
- C:\Windows\System\XIJhpsS.exe
  C:\Windows\System\XIJhpsS.exe
  2⤵
  PID:8452
- C:\Windows\System\NDzTDvg.exe
  C:\Windows\System\NDzTDvg.exe
  2⤵
  PID:15084
- C:\Windows\System\mBNbHDy.exe
  C:\Windows\System\mBNbHDy.exe
  2⤵
  PID:13788
- C:\Windows\System\uVWYoPB.exe
  C:\Windows\System\uVWYoPB.exe
  2⤵
  PID:15152
- C:\Windows\System\nAWxqvi.exe
  C:\Windows\System\nAWxqvi.exe
  2⤵
  PID:15272
- C:\Windows\System\bTjeGoF.exe
  C:\Windows\System\bTjeGoF.exe
  2⤵
  PID:6840
- C:\Windows\System\ThbsHiX.exe
  C:\Windows\System\ThbsHiX.exe
  2⤵
  PID:7300
- C:\Windows\System\tCrysYa.exe
  C:\Windows\System\tCrysYa.exe
  2⤵
  PID:4656
- C:\Windows\System\AWtuTqY.exe
  C:\Windows\System\AWtuTqY.exe
  2⤵
  PID:8156
- C:\Windows\System\ivZHtjP.exe
  C:\Windows\System\ivZHtjP.exe
  2⤵
  PID:7888
- C:\Windows\System\uZCJtPZ.exe
  C:\Windows\System\uZCJtPZ.exe
  2⤵
  PID:15128
- C:\Windows\System\VRwDXoY.exe
  C:\Windows\System\VRwDXoY.exe
  2⤵
  PID:8232
- C:\Windows\System\qLbmveh.exe
  C:\Windows\System\qLbmveh.exe
  2⤵
  PID:8076
- C:\Windows\System\XITKEXG.exe
  C:\Windows\System\XITKEXG.exe
  2⤵
  PID:6808
- C:\Windows\System\TnMppTs.exe
  C:\Windows\System\TnMppTs.exe
  2⤵
  PID:7520
- C:\Windows\System\lHfzQnn.exe
  C:\Windows\System\lHfzQnn.exe
  2⤵
  PID:5376
- C:\Windows\System\RhIvRar.exe
  C:\Windows\System\RhIvRar.exe
  2⤵
  PID:7448
- C:\Windows\System\oDSvhLD.exe
  C:\Windows\System\oDSvhLD.exe
  2⤵
  PID:7724
- C:\Windows\System\JDdYiAj.exe
  C:\Windows\System\JDdYiAj.exe
  2⤵
  PID:8584
- C:\Windows\System\jyfLzOS.exe
  C:\Windows\System\jyfLzOS.exe
  2⤵
  PID:8052
- C:\Windows\System\BRsEOzE.exe
  C:\Windows\System\BRsEOzE.exe
  2⤵
  PID:6988
- C:\Windows\System\YApdwrq.exe
  C:\Windows\System\YApdwrq.exe
  2⤵
  PID:5676
- C:\Windows\System\WsyTaPG.exe
  C:\Windows\System\WsyTaPG.exe
  2⤵
  PID:7296
- C:\Windows\System\RyuOurK.exe
  C:\Windows\System\RyuOurK.exe
  2⤵
  PID:7544
- C:\Windows\System\jDwwgau.exe
  C:\Windows\System\jDwwgau.exe
  2⤵
  PID:6468
- C:\Windows\System\HPsTIYp.exe
  C:\Windows\System\HPsTIYp.exe
  2⤵
  PID:6496
- C:\Windows\System\YviiNQm.exe
  C:\Windows\System\YviiNQm.exe
  2⤵
  PID:14504
- C:\Windows\System\eDORqhM.exe
  C:\Windows\System\eDORqhM.exe
  2⤵
  PID:8668
- C:\Windows\System\XnzrTbw.exe
  C:\Windows\System\XnzrTbw.exe
  2⤵
  PID:6404
- C:\Windows\System\VBrRQMS.exe
  C:\Windows\System\VBrRQMS.exe
  2⤵
  PID:15184
- C:\Windows\System\oIAWzPa.exe
  C:\Windows\System\oIAWzPa.exe
  2⤵
  PID:8932
- C:\Windows\System\JJzqEJy.exe
  C:\Windows\System\JJzqEJy.exe
  2⤵
  PID:14844
- C:\Windows\System\NoqFlpu.exe
  C:\Windows\System\NoqFlpu.exe
  2⤵
  PID:15292
- C:\Windows\System\SXQqoXN.exe
  C:\Windows\System\SXQqoXN.exe
  2⤵
  PID:9440
- C:\Windows\System\goxxQOs.exe
  C:\Windows\System\goxxQOs.exe
  2⤵
  PID:14392
- C:\Windows\System\xLnfDMY.exe
  C:\Windows\System\xLnfDMY.exe
  2⤵
  PID:14892
- C:\Windows\System\hyjigBc.exe
  C:\Windows\System\hyjigBc.exe
  2⤵
  PID:7572
- C:\Windows\System\lGZQadm.exe
  C:\Windows\System\lGZQadm.exe
  2⤵
  PID:9920
- C:\Windows\System\upMyWtS.exe
  C:\Windows\System\upMyWtS.exe
  2⤵
  PID:9312
- C:\Windows\System\JOWKPNY.exe
  C:\Windows\System\JOWKPNY.exe
  2⤵
  PID:7696
- C:\Windows\System\AeQpHIA.exe
  C:\Windows\System\AeQpHIA.exe
  2⤵
  PID:6212
- C:\Windows\System\aQJNcan.exe
  C:\Windows\System\aQJNcan.exe
  2⤵
  PID:5700
- C:\Windows\System\CKrGhHq.exe
  C:\Windows\System\CKrGhHq.exe
  2⤵
  PID:7200
- C:\Windows\System\BDKvouJ.exe
  C:\Windows\System\BDKvouJ.exe
  2⤵
  PID:7756
- C:\Windows\System\kNFVuXX.exe
  C:\Windows\System\kNFVuXX.exe
  2⤵
  PID:15332
- C:\Windows\System\FrmOCDj.exe
  C:\Windows\System\FrmOCDj.exe
  2⤵
  PID:6892
- C:\Windows\System\QmWERPR.exe
  C:\Windows\System\QmWERPR.exe
  2⤵
  PID:6960
- C:\Windows\System\XOiCqSh.exe
  C:\Windows\System\XOiCqSh.exe
  2⤵
  PID:7668
- C:\Windows\System\UjSpoAu.exe
  C:\Windows\System\UjSpoAu.exe
  2⤵
  PID:9344
- C:\Windows\System\hkldmoj.exe
  C:\Windows\System\hkldmoj.exe
  2⤵
  PID:5972
- C:\Windows\System\FueFEBv.exe
  C:\Windows\System\FueFEBv.exe
  2⤵
  PID:7504
- C:\Windows\System\FljMEPx.exe
  C:\Windows\System\FljMEPx.exe
  2⤵
  PID:6152
- C:\Windows\System\lhnumlW.exe
  C:\Windows\System\lhnumlW.exe
  2⤵
  PID:7924
- C:\Windows\System\wyllaJL.exe
  C:\Windows\System\wyllaJL.exe
  2⤵
  PID:15144
- C:\Windows\System\WrHIykd.exe
  C:\Windows\System\WrHIykd.exe
  2⤵
  PID:11404
- C:\Windows\System\BWwxkjx.exe
  C:\Windows\System\BWwxkjx.exe
  2⤵
  PID:5364
- C:\Windows\System\dCTvbGf.exe
  C:\Windows\System\dCTvbGf.exe
  2⤵
  PID:8636
- C:\Windows\System\RGQklOi.exe
  C:\Windows\System\RGQklOi.exe
  2⤵
  PID:11452
- C:\Windows\System\bYsNASX.exe
  C:\Windows\System\bYsNASX.exe
  2⤵
  PID:8940
- C:\Windows\System\JtPhUJV.exe
  C:\Windows\System\JtPhUJV.exe
  2⤵
  PID:8960
- C:\Windows\System\sJERxui.exe
  C:\Windows\System\sJERxui.exe
  2⤵
  PID:11288
- C:\Windows\System\BFrAcbd.exe
  C:\Windows\System\BFrAcbd.exe
  2⤵
  PID:11828
- C:\Windows\System\tBNGjuC.exe
  C:\Windows\System\tBNGjuC.exe
  2⤵
  PID:10100
- C:\Windows\System\pQoFwLX.exe
  C:\Windows\System\pQoFwLX.exe
  2⤵
  PID:7276
- C:\Windows\System\OtvDpwt.exe
  C:\Windows\System\OtvDpwt.exe
  2⤵
  PID:9796
- C:\Windows\System\fNQiHjG.exe
  C:\Windows\System\fNQiHjG.exe
  2⤵
  PID:14832
- C:\Windows\System\nmNYlPM.exe
  C:\Windows\System\nmNYlPM.exe
  2⤵
  PID:7220
- C:\Windows\System\RpXnvmI.exe
  C:\Windows\System\RpXnvmI.exe
  2⤵
  PID:7692
- C:\Windows\System\KBiBXMP.exe
  C:\Windows\System\KBiBXMP.exe
  2⤵
  PID:10748
- C:\Windows\System\cHmBCgG.exe
  C:\Windows\System\cHmBCgG.exe
  2⤵
  PID:11020
- C:\Windows\System\bSfGiyF.exe
  C:\Windows\System\bSfGiyF.exe
  2⤵
  PID:8356
- C:\Windows\System\xXMVSkI.exe
  C:\Windows\System\xXMVSkI.exe
  2⤵
  PID:668
- C:\Windows\System\TchYBGb.exe
  C:\Windows\System\TchYBGb.exe
  2⤵
  PID:11840
- C:\Windows\System\qAbnpPv.exe
  C:\Windows\System\qAbnpPv.exe
  2⤵
  PID:12428
- C:\Windows\System\DamDIek.exe
  C:\Windows\System\DamDIek.exe
  2⤵
  PID:7152
- C:\Windows\System\gOQhxmU.exe
  C:\Windows\System\gOQhxmU.exe
  2⤵
  PID:11204
- C:\Windows\System\KMqrhWW.exe
  C:\Windows\System\KMqrhWW.exe
  2⤵
  PID:7364
- C:\Windows\System\XLmgacZ.exe
  C:\Windows\System\XLmgacZ.exe
  2⤵
  PID:7408
- C:\Windows\System\ZKtDBks.exe
  C:\Windows\System\ZKtDBks.exe
  2⤵
  PID:9268
- C:\Windows\System\KDiNVMx.exe
  C:\Windows\System\KDiNVMx.exe
  2⤵
  PID:12372
- C:\Windows\System\zUvwqRi.exe
  C:\Windows\System\zUvwqRi.exe
  2⤵
  PID:8864
- C:\Windows\System\hXdpbOO.exe
  C:\Windows\System\hXdpbOO.exe
  2⤵
  PID:15268
- C:\Windows\System\UeZvbzL.exe
  C:\Windows\System\UeZvbzL.exe
  2⤵
  PID:14760
- C:\Windows\System\lvlpGuI.exe
  C:\Windows\System\lvlpGuI.exe
  2⤵
  PID:10232
- C:\Windows\System\QYbATSr.exe
  C:\Windows\System\QYbATSr.exe
  2⤵
  PID:10380
- C:\Windows\System\UhGKmks.exe
  C:\Windows\System\UhGKmks.exe
  2⤵
  PID:10164
- C:\Windows\System\PWiKJYa.exe
  C:\Windows\System\PWiKJYa.exe
  2⤵
  PID:11584
- C:\Windows\System\XtrNgvb.exe
  C:\Windows\System\XtrNgvb.exe
  2⤵
  PID:8444
- C:\Windows\System\dAODVmt.exe
  C:\Windows\System\dAODVmt.exe
  2⤵
  PID:12708
- C:\Windows\System\ktLhhqI.exe
  C:\Windows\System\ktLhhqI.exe
  2⤵
  PID:8332
- C:\Windows\System\MBcdDUO.exe
  C:\Windows\System\MBcdDUO.exe
  2⤵
  PID:9904
- C:\Windows\System\JKfqdJX.exe
  C:\Windows\System\JKfqdJX.exe
  2⤵
  PID:10984
- C:\Windows\System\sHWwViY.exe
  C:\Windows\System\sHWwViY.exe
  2⤵
  PID:13112
- C:\Windows\System\zEnYPdE.exe
  C:\Windows\System\zEnYPdE.exe
  2⤵
  PID:9600
- C:\Windows\System\WPTRyUP.exe
  C:\Windows\System\WPTRyUP.exe
  2⤵
  PID:12536
- C:\Windows\System\pIrBjWz.exe
  C:\Windows\System\pIrBjWz.exe
  2⤵
  PID:12036
- C:\Windows\System\EXoXVhT.exe
  C:\Windows\System\EXoXVhT.exe
  2⤵
  PID:7948
- C:\Windows\System\YzvKBWp.exe
  C:\Windows\System\YzvKBWp.exe
  2⤵
  PID:10756
- C:\Windows\System\tbxSOIv.exe
  C:\Windows\System\tbxSOIv.exe
  2⤵
  PID:9552
- C:\Windows\System\XHLJZVf.exe
  C:\Windows\System\XHLJZVf.exe
  2⤵
  PID:13264
- C:\Windows\System\rVMeuIf.exe
  C:\Windows\System\rVMeuIf.exe
  2⤵
  PID:13204
- C:\Windows\System\TaOhJBv.exe
  C:\Windows\System\TaOhJBv.exe
  2⤵
  PID:10712
- C:\Windows\System\vNBACJK.exe
  C:\Windows\System\vNBACJK.exe
  2⤵
  PID:13216
- C:\Windows\System\jCZzDmy.exe
  C:\Windows\System\jCZzDmy.exe
  2⤵
  PID:8176
- C:\Windows\System\FNTawmu.exe
  C:\Windows\System\FNTawmu.exe
  2⤵
  PID:8576
- C:\Windows\System\YZOgYnA.exe
  C:\Windows\System\YZOgYnA.exe
  2⤵
  PID:11140
- C:\Windows\System\kvRqDSA.exe
  C:\Windows\System\kvRqDSA.exe
  2⤵
  PID:11508
- C:\Windows\System\NFDSDLK.exe
  C:\Windows\System\NFDSDLK.exe
  2⤵
  PID:5636
- C:\Windows\System\JOSxTbP.exe
  C:\Windows\System\JOSxTbP.exe
  2⤵
  PID:9964
- C:\Windows\System\cokkNSj.exe
  C:\Windows\System\cokkNSj.exe
  2⤵
  PID:12748
- C:\Windows\System\wmepZdJ.exe
  C:\Windows\System\wmepZdJ.exe
  2⤵
  PID:12468
- C:\Windows\System\gmlUNpv.exe
  C:\Windows\System\gmlUNpv.exe
  2⤵
  PID:11984
- C:\Windows\System\HEiLnmD.exe
  C:\Windows\System\HEiLnmD.exe
  2⤵
  PID:9976
- C:\Windows\System\ffdQxpn.exe
  C:\Windows\System\ffdQxpn.exe
  2⤵
  PID:12104
- C:\Windows\System\qaVgpiU.exe
  C:\Windows\System\qaVgpiU.exe
  2⤵
  PID:13068
- C:\Windows\System\VaMFzhz.exe
  C:\Windows\System\VaMFzhz.exe
  2⤵
  PID:11000
- C:\Windows\System\pBrxPKe.exe
  C:\Windows\System\pBrxPKe.exe
  2⤵
  PID:13220
- C:\Windows\System\WPncfuw.exe
  C:\Windows\System\WPncfuw.exe
  2⤵
  PID:10180
- C:\Windows\System\szbkjwP.exe
  C:\Windows\System\szbkjwP.exe
  2⤵
  PID:9256
- C:\Windows\System\gFTqNrF.exe
  C:\Windows\System\gFTqNrF.exe
  2⤵
  PID:4796
- C:\Windows\System\qQJIHXu.exe
  C:\Windows\System\qQJIHXu.exe
  2⤵
  PID:12456
- C:\Windows\System\BUBdiFl.exe
  C:\Windows\System\BUBdiFl.exe
  2⤵
  PID:9712
- C:\Windows\System\kVUGwWW.exe
  C:\Windows\System\kVUGwWW.exe
  2⤵
  PID:10176
- C:\Windows\System\BpyUlhu.exe
  C:\Windows\System\BpyUlhu.exe
  2⤵
  PID:12424
- C:\Windows\System\nxxtKNd.exe
  C:\Windows\System\nxxtKNd.exe
  2⤵
  PID:9504
- C:\Windows\System\LRbjvmg.exe
  C:\Windows\System\LRbjvmg.exe
  2⤵
  PID:12508
- C:\Windows\System\acjjqUT.exe
  C:\Windows\System\acjjqUT.exe
  2⤵
  PID:10228
- C:\Windows\System\UQoIkmB.exe
  C:\Windows\System\UQoIkmB.exe
  2⤵
  PID:9596
- C:\Windows\System\aaiuvfY.exe
  C:\Windows\System\aaiuvfY.exe
  2⤵
  PID:11880
- C:\Windows\System\NgImStQ.exe
  C:\Windows\System\NgImStQ.exe
  2⤵
  PID:7148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hl3dauk3.t0f.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AEOozDm.exe

Filesize
2.1MB

MD5
70f7d9fe08ed01b903d5c0665238d4f0

SHA1
df4cf6c5d666fd3a3c92e969621dbc3b803fce2e

SHA256
3e6e33073c0afa752ced3a2f0089f62a5f4fbc7ccee03f70ded1e35b9e080e4b

SHA512
b947012729d782c64f873d7d1af554ef13e1122257c5481296ae8c4e675a7800bc7406c60e0e887d05ebd4dfb2c9b5ae7095ff9d3497b6a424ed33f7488ae2cf

Download Submit
C:\Windows\System\AKMRJVC.exe

Filesize
2.1MB

MD5
40cf5b90b34d4ceb68945e24fabf5f3a

SHA1
92060fe9ad01ad18fe33cce7435ed17590205958

SHA256
d4ff1ea9264af4e0445655ca430ee7fe6f5efbe940a430584caa25a337f010a0

SHA512
bac4e034a6db278b447eaa51c3931e019567b6cc2252a48197c92b9c421be84a312f49ce09bd1e6381d28c47000d54b3f1e615f65a81636abfd9ab9989ea2d08

Download Submit
C:\Windows\System\CPMjvYS.exe

Filesize
2.1MB

MD5
6e9985a47bc1835857a07a5fcfaaab31

SHA1
1aa287a3a1eded612576b1b2da06a46c227303af

SHA256
68314e00613527fefdfa5d175e6398e605fc758b890010f4c3e3f5de088354ea

SHA512
4d69dd0e807ebaf7233fc1a6592545cbd1c21caf29099519f0e8edeab6f62c5b4fff369d1e685cab72097a7a2d6c6af1600c5e929b5c3bf5434595b3e5e39078

Download Submit
C:\Windows\System\Cgcukgu.exe

Filesize
2.1MB

MD5
fe40e7f2e1304e2c8e247b12fc811dfd

SHA1
72170c495437133d579c8f68658ef8106d6f242c

SHA256
a2d102abcdb088a64d62c5a7f4fa0870057c2e20d68c1e224dfcd4dc369f50e9

SHA512
41665c16710b72251de082380d0eb62a7dac073f8eac1f6bac4a99c2b82694348a45f8efd07e2d599afc7d63778230456a643b893f1e26528f3cf781a8a5ab3a

Download Submit
C:\Windows\System\EgAjzwl.exe

Filesize
2.1MB

MD5
297f1fab6be0591d26567df98fbc0879

SHA1
ea5a8545c23cb28350c0d29a4fd61a31a2f4a6e8

SHA256
7ede8f2dbfd4c70f3c15aface7c230185d35e31081c14ac1becce12463c53f79

SHA512
6f9d720ad87f575ebecb6ae4b175e672040b7bdf8dfdeece34ce8e26989f561eeefd5bd62eec18c21e1d0895b5519b5d5c70f4c63d2fd5ac089e8db1423e3fc6

Download Submit
C:\Windows\System\FYWBsAv.exe

Filesize
2.1MB

MD5
18c6fdb8ab166b1bbdcf9fca6dd93aed

SHA1
bbaadf710b1d6d045b243309dbcad3ce03556247

SHA256
1da9119fe40382952ea636acf8705148566e717891abc0e262fd9fa5cef8ce86

SHA512
0ae75ce4a688b3beb7ad4fe0b2f5802ff24675f9ec5b657398eff08d3dc7bb46505bbbc69150eb88c578281627fc46615d74517a8ab788b13e965dd1bdb94230

Download Submit
C:\Windows\System\HnYHeWL.exe

Filesize
2.1MB

MD5
2df19242430d797b8e8224255de0201c

SHA1
bd7d49dd5478c4c64c5fdcd4aa667625fb1c0d20

SHA256
bbd95b74f6022c355f946741311bab6a01d14e256349544117551d437e0db220

SHA512
ba77adfe03a4c44d3f0bb7fe141918626b4756b9b81bdd38a549f935b093a02a35a5d209aa6b4dda78f9530c7b6365ac288d0173e5f9be95bcf684d0eabe2467

Download Submit
C:\Windows\System\IWOYior.exe

Filesize
2.1MB

MD5
9cad03c8a3d64cd185c8ece0a6960ebe

SHA1
23979f3ac143632e229d1d3456196b5ca7f93420

SHA256
0a0aebf856d60763b712a0158ea3755772176c1885e3d07361ced1fa7596d31d

SHA512
5b103fa2e0b3c4b5bde33a79e2516ec1987af5b6ef1eb9b2c632b074f1fc2698a4bbd0c6ae2f5bd0e950c3b43f75b8e06a39c946618deaaaf9bacd2d93f7bc50

Download Submit
C:\Windows\System\LvXwUuk.exe

Filesize
2.1MB

MD5
0e5683708873d7e060d4b16cde127570

SHA1
a17c0438a0b46110c8f5a4e750a7813fa0dc7e1b

SHA256
cee09ef4758849e9f870f4092624c246860aefa10367f3535078833685dd72e2

SHA512
63ea174c51f0f9700efa7e6930fd759e2f8237f857e9a7c2b5052d0326cd176adbb02bbde6b135b691e2e9a4209d1b6d5203cb88946f5e2c8e4294487a97426c

Download Submit
C:\Windows\System\MMxXZTG.exe

Filesize
2.1MB

MD5
9502fcc2b48c5cc87b54d22547dc7d27

SHA1
9943def5825098ce0cd27209a815711ddeb14615

SHA256
357d530cd32de28b0833773976d8f018175be290f48287d151b98fd39be8d013

SHA512
09165ec7e9484f9c4dbc15bbdb326ba3f500653b9f92066e76411bbb35223079c6274995eb9506c22ce1f59f99aaf0a47b01dc8aaa2db7f6e43e15d5e7d1655f

Download Submit
C:\Windows\System\NGKAxdy.exe

Filesize
2.1MB

MD5
456c1e319d3033af7b32b7754df1d513

SHA1
59d5ad24dd8f89aa600a8db1430b93171022b440

SHA256
749e4fdb55b5dc39c2c603f2a096dc397af1bcf1bb3ac9d45282309ad4f7870c

SHA512
7e2f967b047d8c1ad1d423f3fefc6815e5a5cf64e2d972d8260d2cc9e54819203401f7ff1884ecbb9e804f1f3d9d103b3829ed8b26ebe23feae08e58c8c7da07

Download Submit
C:\Windows\System\NHMrmDM.exe

Filesize
2.1MB

MD5
447971a58d4220db0ac6580f4a00d109

SHA1
a75b84977588e51aa4f18a490e7f4018f9ab7ca6

SHA256
cd83a1c3487829d1bbc940b16d6edbde311a37b760b740181407dae8b0a5e623

SHA512
dcd5328f62ac50d65a52e1406963a18d5479f98e973d4ac924e3a962f1ea51bf3aa9100ecc0416d5e7d12503cd4f8d4ab2c0e3e87a69299bd4dfde0a22bda571

Download Submit
C:\Windows\System\Qhidwdu.exe

Filesize
2.1MB

MD5
b8d78d2810268775a1b163c26ef4fcd8

SHA1
45849fd645c8120cb58587751c56db453dc4b9c0

SHA256
3f68a66296b5435732e013cd959ac47e581948a27627202ccec57a93812daa9f

SHA512
af5e1eca61ecd790e3dd9e3a5ed10792badb99ba58785979d9fd2846b65e426c24a35344d5f61958145112a0bfff3c096feccef902cfddabadfed7d5d5774616

Download Submit
C:\Windows\System\TuzVCnf.exe

Filesize
2.1MB

MD5
ce0f564a5e429d653efbc2ffb6e2c3ae

SHA1
65bd47d9635ec582a2dfd4266709000366438199

SHA256
8976423eecbf0c5829533d0aa67b982067e5fe0b4f859eee2219b45be0b9d8de

SHA512
5699404d5f99a51de14f6743d879f19798447ebc9cb79ae516b169c78141ad5bed60879bf9440ec138aae75a56677c6148d0c994a9625b048a8bf4352edf2c1f

Download Submit
C:\Windows\System\TyzEfoO.exe

Filesize
2.1MB

MD5
aabb7806d943e83d54a9a5f7c100ac35

SHA1
eb6c7a84997187d6e601b96cdd32fad7e27ba9af

SHA256
cded3756e5c04a11c17448bd9dbdd124c66c4003da03e15170807aad40e1d07d

SHA512
b762a3f825882cb9ba21faec29cff190d2f9374c3f76686da81a19475f93cd99edce0d61e0419074caa64ba11ebfd863add558ee9709f626983b8f7ed12a3275

Download Submit
C:\Windows\System\WMkynRY.exe

Filesize
2.1MB

MD5
72150832fde561952262bd8d7d843d90

SHA1
ff0ef6d23c629adca9fc8131610399c18eed1925

SHA256
b538e0609ab0677c12989d7e7a06b1e1b2ebe479e477f3dc0610708feb23d940

SHA512
3af0ae84bc3a1e6734eec64fbf9f0d655469bc7352d71deee9bae6648d319e9273160ec2a8f430c2f265f96880fd9d138806d3ad852a2c72ff046b9c6815587f

Download Submit
C:\Windows\System\WxrSgqC.exe

Filesize
2.1MB

MD5
b2e04ab7e69c9cc1b1233ae362f632be

SHA1
15ca341d33a921bb5f2575dfcb72471f89852e1b

SHA256
a3649798257eedc8c10c59fae966bde9a7f56d9661737839a3d07266aa17cb0b

SHA512
115daf79b31903a1abdeef4955d5137851156f7c45b4d3fb7c2cd0adb73046395762e25e7d35544f10679cd6064b0b5a718308d3842af00584d19897f46c847a

Download Submit
C:\Windows\System\ZGEkhTW.exe

Filesize
2.1MB

MD5
e21d9f47de36aa1712db8d7c7ecb8c7c

SHA1
56e8ef3b16ef74f40e3b19c049876696be100611

SHA256
a9ac6231928d8d2edfe235a7d5e774d409c31da40062febb6072c0aa1e79e2d5

SHA512
6bacee4c491cec2537e91863d2a0735aa1d5af0437e615fe031632cbe73943d196568d2d31eab796d7b486be5fca9162707920fb1541ef2bc18a9b4db31625b2

Download Submit
C:\Windows\System\ZeKRkfq.exe

Filesize
2.1MB

MD5
f4cd0ce5d2ff919fed7f01a046fc595d

SHA1
240b6d50e0d1372d01ca45b4e338cce74089b179

SHA256
72e3879ce165d775d6b479568f9f86885786fc0138d698f2b53d14f4221273ed

SHA512
c5f2e82dff0b2c7e38ce83455703ee791dbc5d4bcc0b05b90e0b082e14c01f8aca175e583254eb2cb6a6b0b3a8c56f2da115c2db8153015e0c62c7108f9dfa48

Download Submit
C:\Windows\System\ZzTaRSW.exe

Filesize
2.1MB

MD5
18d9af756baf310e1fa04abfb05a207c

SHA1
7059a0b171d9f5c650f3ccb601f359c75e1fdb9e

SHA256
bc0823394ef249ce851a32b7304d5adbe138ada47de2c823b9923e9cdf4ebbf3

SHA512
1c3ca9b0f95333864434ec24e9b7ac5bcd28847e4b3101fe4cc6828eea2b657ce0fce44e2830d9c02735cb8c870cac5ae992b7a62644e86ac667b72e0815ca2e

Download Submit
C:\Windows\System\asuQagf.exe

Filesize
2.1MB

MD5
39a726fa060b2c0f288471a32d83e624

SHA1
f8dee3fc28c2b43ef7dd51cd2d418772e5e18273

SHA256
964f728b887a27a1ab15394096531829b5dc9c7aa5e44cf75c75f2c69638a673

SHA512
1db1144e1f93e94d7be0afd8a7e71ec610d02ba89b003503400af658863a6dddb7be5d3d7c1ceff362a98b71fa53341c7033f31bb4edc731ee93004e830a94ad

Download Submit
C:\Windows\System\bcvHARD.exe

Filesize
2.1MB

MD5
d4b4cea8b6c21329fb8a0a693fe00692

SHA1
5e35d392536152703f7ef0f4526b4be87f454d00

SHA256
62dc39f19981811fb9f37383ba6e785189fa6d6710c0ef43ba2eb7c67f5ad966

SHA512
4dddcc34f65e1059b2f09945084f8ccb38a75b4c61dd521c44ab279f57199706f0e1ba38cafdca3338db1ea43bc7d2d13e808f215760e15b5652b447a018beb3

Download Submit
C:\Windows\System\cjrDITv.exe

Filesize
2.1MB

MD5
9711a6841ce7335a711d456af7703ac1

SHA1
423eb0cc7eb851911efc59d4770bd901d2884944

SHA256
8b5e6a026fe5b24b3a6b06b43cfcb87108c2884ba5cf5687d4c2ab261ccdd836

SHA512
c793f3b8ddad2e123a74ad86c10fa8d05a7402419cfb35aca82df92a65559e1fd78650c96528ea98ab49b8352d24683f260008503e38a899a6fd26fcc0f37e2c

Download Submit
C:\Windows\System\hOguUkR.exe

Filesize
2.1MB

MD5
e84c24afa1761bfbb3ce0b4cb748509a

SHA1
c560d9f59ca02d28e08f0dacb884a7b6eef0cd06

SHA256
75753712895d70d067f92be70fb8fbe671cf4d77ef7cbe9faeb1ce05f900be33

SHA512
9ee2ad9d1717aef30082618badd1b57629aea6655cc77e6be3e7d790af340b7ed9e8d706ebcfc22e2c3712f7f1465866e484f32ddfb3326fb02e4adccae6da71

Download Submit
C:\Windows\System\hujgJtp.exe

Filesize
2.1MB

MD5
80534ef85eae9d212cd5f779fb94cc8b

SHA1
b95fc00ff6e584e86ff6bd70d2ade0403291ebc6

SHA256
027534c4a7fe3ab41099896b3f12142a6e128ba20753299cdfe2ab435b45156b

SHA512
cdf2441056beb2dafd47a0c94460eaa5395f127de9843c5321eebd9737973f0d17319c50c07784dd72ff3b163d5cc25df84d882bb15376b03ca7ed5afb779ce6

Download Submit
C:\Windows\System\lWtTYNI.exe

Filesize
2.1MB

MD5
04acce90309bb7539b1816e8cf2bdfd5

SHA1
091468e1ce1dd3fb31fccc9b5d96dd4cc5f600da

SHA256
eef4f55e9494bba384a03aaf150c15ba0ca3abe27995935db221f075df57d442

SHA512
5bab9a69c360b8374c963227dc36494f9cc7078632511751a8719f681a00064d521a0a069c281d3aefbf806f53115869b04f145051fd487a6aa5752e38d4e112

Download Submit
C:\Windows\System\mcEceDo.exe

Filesize
2.1MB

MD5
5b132564d045034281bf7dc46e9b2f43

SHA1
daaa18c6918780dba3af1c8a2b6203172b66f5ef

SHA256
27cc2dbe6dd77174573dcc203f97cbb30c99b7a39212a056223706a469fec027

SHA512
17a0633f27794a4619d5b258a1399be3d9194c5656ff8e331d2f3ec7db1697fed2a25743dd1e006e164f04afc31a1b0af1161b62bc5cb99571964f71fe158576

Download Submit
C:\Windows\System\pjkybxe.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\System\rogZSiR.exe

Filesize
2.1MB

MD5
2745dc516bac07bea08b8925f9d7bb6d

SHA1
c881cd41f827dbee5a501223dfc889c4a4823ad3

SHA256
db5af2343b652d1fbd2a4077fef9b2c5b90d149c710bdb97961fb71919ed081e

SHA512
262fbbde4498e9cacc55f470340e6e24fafe4fddbff588fcdd346c68215a77da894df59b747bfd8352f9b203bc0f2c7331adb5ecbfefd2fc863d66ba550092df

Download Submit
C:\Windows\System\sYvbcyI.exe

Filesize
2.1MB

MD5
cdf2b6b309d06f3e887bd962d928af05

SHA1
eca7ff75b53fb88f918275bab38df71dd371437b

SHA256
970975c158b72e2297ad4867d81507f2cd99f98da63ea675a5ced9aac1f1b4a8

SHA512
00b43e09323fd07a4058a61fd710c8a3a5c0e577cc65f723aa1f3aae8449af1705a7e30ea65f0e1b864082c5b2677433dbd9bd5c070e3b4861e7d2d8ee31a6d2

Download Submit
C:\Windows\System\uEgjkFS.exe

Filesize
2.1MB

MD5
1e7a9108cc1ef1f9d8b0314632ab25b8

SHA1
a8656063d26b2454fa4fbc7341cbf48722c490a4

SHA256
03c1eb0b39a9c84f482ab98dfcf9832e11830f81aaced29ea70d719ab6afccc5

SHA512
7e8c01384c619e904275e970396c510137574e348758eeae9ae5986f760f16a633856d678b7a2e9ce113842b5d8b3a0d28f0e616f66f358e824a726275ce0fa4

Download Submit
C:\Windows\System\ubDHWXf.exe

Filesize
2.1MB

MD5
d7dfbc909053ca321a0943c91703e58c

SHA1
29de593eabe9211a57d75fb28a8237159fe247d7

SHA256
1f30b3dd906c54a488b619d6746a055708e744c86ad979397385d56e2fa18b7c

SHA512
097b0f4180be91d5f16e726016235561e23942a38c5eb35602539d47a2b958320e9bdea59f502f0679d189ee74ec2b6860230c95e9abba1c18bbf2f1f310a5da

Download Submit
C:\Windows\System\vdSvkJS.exe

Filesize
2.1MB

MD5
fd3bd652e00028c141b2ec3e415eecc9

SHA1
0fe1a4032a5d83dfa7c7c369178c949a801e15c9

SHA256
e2c991f04cdd108563ece1145eaf6f7b0eb0b6693071b879a39a11bfe9c60f4e

SHA512
b6e464048e523f616f3d59264cb165bca538fe14172ab5d6c0290de74282866bbbdf173ae3ba14fef27c11c0bf7166d889a2bb98d9a73e1e39493c8945b3ac36

Download Submit
C:\Windows\System\wYauuhf.exe

Filesize
2.1MB

MD5
558fa50fc738b14439ccede14c497547

SHA1
528726155b2b1cd5087d8e19bc8819d41c2e131e

SHA256
09d983dfd9b058d75c01e378aa39982b45f4e113785eeb7f8be774b50aca8db0

SHA512
877adbb88595e12f31fcef48c0bbac74adb54543cf0ad566810bcbd68c345749db59d89a57566d56a0b9b81f325f37033aa8d124bd3d216f23a6ba6262d72a3c

Download Submit
C:\Windows\System\yTqgwUH.exe

Filesize
2.1MB

MD5
532699c7ef1c55f6e6c908e82a93743a

SHA1
6403fa38d658b91768c525c56e710cc9fa71b137

SHA256
86afc6c225652c6ce961cff96114f1939ba405040bd3be1019fab54417ce44e9

SHA512
a851f305bcf87d22004c13aa97e697babbbe235e0a929ca71bfd657c9be6f63633fbae60866b8324fbe85d2b5b84097c57c38ef1582c318b7bb5bcd036090731

Download Submit
C:\Windows\System\ykXOgyW.exe

Filesize
2.1MB

MD5
6aee658c8528a76736ac04749d8f8907

SHA1
166fdefa05192fdae99a25e557124ffb458cc4f3

SHA256
091bd5cf1780ae485f67e67bbe066be7be5d3d60a0c77b65dfee4c5b0557f004

SHA512
fd1384f3470e4f81dd9010cb6d7e795f16bc875f16bbf7165a986d7b0f3536cb7c0501a9ceff872b2c2862c1910ab6779a0aad192f5e48c89687f96b42781e1d

Download Submit
C:\Windows\System\yrsnjSk.exe

Filesize
2.1MB

MD5
5749fb953e1616409e39546c711edb44

SHA1
df2bf0ca731e3d45c3589ec863220aee6e8a2dae

SHA256
e95282598d67a9ea4706d47797b913693585c57ec239fdd90f83a08c87bcdbd7

SHA512
b6bf8c96adace26e4aed304cd8a37f5c3560bf5c8c9a03381f0dc9a27680304e05a25e607011c913dd2e450fab5a8708dffe31df70e08bea673e6c93b5e0c283

Download Submit
memory/224-6114-0x00007FF6A1320000-0x00007FF6A1712000-memory.dmp

Filesize
3.9MB

Download
memory/224-239-0x00007FF6A1320000-0x00007FF6A1712000-memory.dmp

Filesize
3.9MB

Download
memory/732-161-0x00007FF6E0C70000-0x00007FF6E1062000-memory.dmp

Filesize
3.9MB

Download
memory/732-6144-0x00007FF6E0C70000-0x00007FF6E1062000-memory.dmp

Filesize
3.9MB

Download
memory/784-273-0x00007FF7BEA70000-0x00007FF7BEE62000-memory.dmp

Filesize
3.9MB

Download
memory/784-6150-0x00007FF7BEA70000-0x00007FF7BEE62000-memory.dmp

Filesize
3.9MB

Download
memory/824-246-0x00007FF6CB890000-0x00007FF6CBC82000-memory.dmp

Filesize
3.9MB

Download
memory/888-340-0x00000127F8C70000-0x00000127F9416000-memory.dmp

Filesize
7.6MB

Download
memory/888-216-0x00000127DFCA0000-0x00000127DFCC2000-memory.dmp

Filesize
136KB

Download
memory/888-106-0x00000127F7E50000-0x00000127F7E60000-memory.dmp

Filesize
64KB

Download
memory/888-103-0x00007FF8E5BB0000-0x00007FF8E6671000-memory.dmp

Filesize
10.8MB

Download
memory/888-107-0x00000127F7E50000-0x00000127F7E60000-memory.dmp

Filesize
64KB

Download
memory/1584-228-0x00007FF7737B0000-0x00007FF773BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1596-6155-0x00007FF665AC0000-0x00007FF665EB2000-memory.dmp

Filesize
3.9MB

Download
memory/1596-171-0x00007FF665AC0000-0x00007FF665EB2000-memory.dmp

Filesize
3.9MB

Download
memory/1656-282-0x00007FF67AB70000-0x00007FF67AF62000-memory.dmp

Filesize
3.9MB

Download
memory/1656-6186-0x00007FF67AB70000-0x00007FF67AF62000-memory.dmp

Filesize
3.9MB

Download
memory/1728-227-0x00007FF7F6CD0000-0x00007FF7F70C2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-6166-0x00007FF69BED0000-0x00007FF69C2C2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-281-0x00007FF69BED0000-0x00007FF69C2C2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-6085-0x00007FF6DF3C0000-0x00007FF6DF7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-285-0x00007FF6DF3C0000-0x00007FF6DF7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-6104-0x00007FF6F14B0000-0x00007FF6F18A2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-286-0x00007FF6F14B0000-0x00007FF6F18A2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-6092-0x00007FF763250000-0x00007FF763642000-memory.dmp

Filesize
3.9MB

Download
memory/2948-129-0x00007FF763250000-0x00007FF763642000-memory.dmp

Filesize
3.9MB

Download
memory/3168-284-0x00007FF6F51E0000-0x00007FF6F55D2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-6181-0x00007FF6F51E0000-0x00007FF6F55D2000-memory.dmp

Filesize
3.9MB

Download
memory/3236-240-0x00007FF6B8DB0000-0x00007FF6B91A2000-memory.dmp

Filesize
3.9MB

Download
memory/3240-0-0x00007FF71AD40000-0x00007FF71B132000-memory.dmp

Filesize
3.9MB

Download
memory/3240-1-0x0000025EF5F30000-0x0000025EF5F40000-memory.dmp

Filesize
64KB

Download
memory/3428-6075-0x00007FF671BE0000-0x00007FF671FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3428-18-0x00007FF671BE0000-0x00007FF671FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-6201-0x00007FF6BFD20000-0x00007FF6C0112000-memory.dmp

Filesize
3.9MB

Download
memory/3488-245-0x00007FF6BFD20000-0x00007FF6C0112000-memory.dmp

Filesize
3.9MB

Download
memory/4320-279-0x00007FF600500000-0x00007FF6008F2000-memory.dmp

Filesize
3.9MB

Download
memory/4320-6137-0x00007FF600500000-0x00007FF6008F2000-memory.dmp

Filesize
3.9MB

Download
memory/4368-283-0x00007FF764430000-0x00007FF764822000-memory.dmp

Filesize
3.9MB

Download
memory/4368-6182-0x00007FF764430000-0x00007FF764822000-memory.dmp

Filesize
3.9MB

Download
memory/4512-278-0x00007FF7A9420000-0x00007FF7A9812000-memory.dmp

Filesize
3.9MB

Download
memory/4660-280-0x00007FF6D7230000-0x00007FF6D7622000-memory.dmp

Filesize
3.9MB

Download
memory/4948-196-0x00007FF763110000-0x00007FF763502000-memory.dmp

Filesize
3.9MB

Download