xmrig | e5fecef17fedc98925e0f2c0fdce0347355c908de47be2fd160c81c91ca8e6c0

Analysis

max time kernel
141s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
Size

1.9MB
MD5

08e3d045f868bf4dd44bec5471a5e6f6
SHA1

f5c9dd263da98543026fa11d0a359f5953e4c755
SHA256

e5fecef17fedc98925e0f2c0fdce0347355c908de47be2fd160c81c91ca8e6c0
SHA512

fb423860f23e2cad396fa60c6073ff41e5ed9ffdce8c03f42ba0f0c688f32303c9cb07c7a7909b8b326023a1f40a76ffc499ec6daf80ba5efe5c55cdb972d954
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pOD:NABu

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/4504-76-0x00007FF71AA00000-0x00007FF71ADF2000-memory.dmp	xmrig
behavioral2/memory/2064-112-0x00007FF7E7590000-0x00007FF7E7982000-memory.dmp	xmrig
behavioral2/memory/3216-145-0x00007FF708100000-0x00007FF7084F2000-memory.dmp	xmrig
behavioral2/memory/3720-180-0x00007FF6A0730000-0x00007FF6A0B22000-memory.dmp	xmrig
behavioral2/memory/3724-245-0x00007FF7D9400000-0x00007FF7D97F2000-memory.dmp	xmrig
behavioral2/memory/4704-251-0x00007FF7F7120000-0x00007FF7F7512000-memory.dmp	xmrig
behavioral2/memory/3764-250-0x00007FF778B80000-0x00007FF778F72000-memory.dmp	xmrig
behavioral2/memory/836-249-0x00007FF7DE7C0000-0x00007FF7DEBB2000-memory.dmp	xmrig
behavioral2/memory/4412-248-0x00007FF764BC0000-0x00007FF764FB2000-memory.dmp	xmrig
behavioral2/memory/3488-247-0x00007FF63DD80000-0x00007FF63E172000-memory.dmp	xmrig
behavioral2/memory/3976-246-0x00007FF7BB320000-0x00007FF7BB712000-memory.dmp	xmrig
behavioral2/memory/4300-244-0x00007FF687DF0000-0x00007FF6881E2000-memory.dmp	xmrig
behavioral2/memory/3748-243-0x00007FF7F5F20000-0x00007FF7F6312000-memory.dmp	xmrig
behavioral2/memory/2984-159-0x00007FF61A7E0000-0x00007FF61ABD2000-memory.dmp	xmrig
behavioral2/memory/2540-158-0x00007FF7058A0000-0x00007FF705C92000-memory.dmp	xmrig
behavioral2/memory/468-131-0x00007FF6A9790000-0x00007FF6A9B82000-memory.dmp	xmrig
behavioral2/memory/2684-111-0x00007FF7842A0000-0x00007FF784692000-memory.dmp	xmrig
behavioral2/memory/3504-95-0x00007FF7DD290000-0x00007FF7DD682000-memory.dmp	xmrig
behavioral2/memory/1224-63-0x00007FF6C7FF0000-0x00007FF6C83E2000-memory.dmp	xmrig
behavioral2/memory/1696-22-0x00007FF7D0BA0000-0x00007FF7D0F92000-memory.dmp	xmrig
behavioral2/memory/1224-4992-0x00007FF6C7FF0000-0x00007FF6C83E2000-memory.dmp	xmrig
behavioral2/memory/3488-5019-0x00007FF63DD80000-0x00007FF63E172000-memory.dmp	xmrig
behavioral2/memory/2684-5035-0x00007FF7842A0000-0x00007FF784692000-memory.dmp	xmrig
behavioral2/memory/836-5068-0x00007FF7DE7C0000-0x00007FF7DEBB2000-memory.dmp	xmrig
behavioral2/memory/4300-5083-0x00007FF687DF0000-0x00007FF6881E2000-memory.dmp	xmrig
behavioral2/memory/2984-5080-0x00007FF61A7E0000-0x00007FF61ABD2000-memory.dmp	xmrig
behavioral2/memory/3748-5079-0x00007FF7F5F20000-0x00007FF7F6312000-memory.dmp	xmrig
behavioral2/memory/3764-5071-0x00007FF778B80000-0x00007FF778F72000-memory.dmp	xmrig
behavioral2/memory/3216-5062-0x00007FF708100000-0x00007FF7084F2000-memory.dmp	xmrig
behavioral2/memory/4412-5054-0x00007FF764BC0000-0x00007FF764FB2000-memory.dmp	xmrig
behavioral2/memory/2540-5057-0x00007FF7058A0000-0x00007FF705C92000-memory.dmp	xmrig
behavioral2/memory/468-5045-0x00007FF6A9790000-0x00007FF6A9B82000-memory.dmp	xmrig
behavioral2/memory/2064-5042-0x00007FF7E7590000-0x00007FF7E7982000-memory.dmp	xmrig
behavioral2/memory/3504-5028-0x00007FF7DD290000-0x00007FF7DD682000-memory.dmp	xmrig
behavioral2/memory/1692-5021-0x00007FF798850000-0x00007FF798C42000-memory.dmp	xmrig
behavioral2/memory/3724-5092-0x00007FF7D9400000-0x00007FF7D97F2000-memory.dmp	xmrig
behavioral2/memory/4704-5100-0x00007FF7F7120000-0x00007FF7F7512000-memory.dmp	xmrig
behavioral2/memory/3976-5109-0x00007FF7BB320000-0x00007FF7BB712000-memory.dmp	xmrig
behavioral2/memory/3720-5090-0x00007FF6A0730000-0x00007FF6A0B22000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1696	tHlItRA.exe
1224	MiydccD.exe
4472	GVWLTny.exe
4016	kjoJcWt.exe
1052	Bxwfqes.exe
4504	ngfTSit.exe
1692	cHAtPVF.exe
3504	gKhxKoo.exe
3488	pCZCOnd.exe
2684	aQXnNHS.exe
2064	KhGCWSV.exe
4412	ErwDAuL.exe
468	tOqJvSZ.exe
3216	rkYIYaB.exe
2540	VwmXeIY.exe
836	ikogXKH.exe
2984	uAxakeE.exe
3720	zTMdkeg.exe
3764	MgEHuoB.exe
3748	RWSSxKZ.exe
4300	WQWVHwE.exe
3724	RNMOMOo.exe
4704	gylfmts.exe
3976	TZgCNQo.exe
2484	ilMOnXT.exe
3148	QgpuxoJ.exe
404	STDuGQy.exe
1292	FgbjNaI.exe
3940	DUJOQFh.exe
3272	YyJqAsB.exe
856	QiUKqLH.exe
400	GnUyKuB.exe
4084	XIONrTk.exe
2272	lBxiHxX.exe
2180	HkfdpcU.exe
1520	lRElpvD.exe
3588	PjXhxjM.exe
4832	gapaAhL.exe
1048	zzjmlcO.exe
2904	xHRkXGI.exe
4948	nJAfaCG.exe
1896	mgkLjUD.exe
4988	wZjosDW.exe
4912	yRclbFw.exe
2080	lKmKosq.exe
5004	QevEsgT.exe
1036	yhVrtWu.exe
4880	jyfcDyz.exe
4416	xZfWyau.exe
4220	jxCPNZy.exe
912	lPkXzWd.exe
3232	FRLIdfg.exe
3668	ISGKxNr.exe
1204	BSdCiGk.exe
1488	KMhILOf.exe
1060	hpuDWDC.exe
1772	xICBKfa.exe
1960	QNebiRv.exe
2156	AbSGMZg.exe
4688	lZLtZMI.exe
64	LBjdajN.exe
1396	fypLGjl.exe
3796	bLXlRzH.exe
452	ToQGacQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/740-0-0x00007FF7E6530000-0x00007FF7E6922000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-8.dat	upx
behavioral2/files/0x000c000000023b34-6.dat	upx
behavioral2/memory/4472-25-0x00007FF6E5EF0000-0x00007FF6E62E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-33.dat	upx
behavioral2/memory/1692-47-0x00007FF798850000-0x00007FF798C42000-memory.dmp	upx
behavioral2/memory/4504-76-0x00007FF71AA00000-0x00007FF71ADF2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-94.dat	upx
behavioral2/memory/2064-112-0x00007FF7E7590000-0x00007FF7E7982000-memory.dmp	upx
behavioral2/memory/3216-145-0x00007FF708100000-0x00007FF7084F2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-162.dat	upx
behavioral2/memory/3720-180-0x00007FF6A0730000-0x00007FF6A0B22000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-184.dat	upx
behavioral2/memory/3724-245-0x00007FF7D9400000-0x00007FF7D97F2000-memory.dmp	upx
behavioral2/memory/4704-251-0x00007FF7F7120000-0x00007FF7F7512000-memory.dmp	upx
behavioral2/memory/3764-250-0x00007FF778B80000-0x00007FF778F72000-memory.dmp	upx
behavioral2/memory/836-249-0x00007FF7DE7C0000-0x00007FF7DEBB2000-memory.dmp	upx
behavioral2/memory/4412-248-0x00007FF764BC0000-0x00007FF764FB2000-memory.dmp	upx
behavioral2/memory/3488-247-0x00007FF63DD80000-0x00007FF63E172000-memory.dmp	upx
behavioral2/memory/3976-246-0x00007FF7BB320000-0x00007FF7BB712000-memory.dmp	upx
behavioral2/memory/4300-244-0x00007FF687DF0000-0x00007FF6881E2000-memory.dmp	upx
behavioral2/memory/3748-243-0x00007FF7F5F20000-0x00007FF7F6312000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-183.dat	upx
behavioral2/files/0x000a000000023bab-173.dat	upx
behavioral2/files/0x000a000000023baa-170.dat	upx
behavioral2/files/0x000a000000023ba9-168.dat	upx
behavioral2/files/0x000a000000023ba8-166.dat	upx
behavioral2/files/0x000a000000023bae-164.dat	upx
behavioral2/files/0x000a000000023bad-161.dat	upx
behavioral2/files/0x000b000000023b8e-160.dat	upx
behavioral2/memory/2984-159-0x00007FF61A7E0000-0x00007FF61ABD2000-memory.dmp	upx
behavioral2/memory/2540-158-0x00007FF7058A0000-0x00007FF705C92000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-157.dat	upx
behavioral2/files/0x000a000000023ba6-154.dat	upx
behavioral2/files/0x000a000000023ba1-148.dat	upx
behavioral2/files/0x000a000000023ba5-141.dat	upx
behavioral2/files/0x000a000000023ba0-139.dat	upx
behavioral2/files/0x000a000000023ba4-135.dat	upx
behavioral2/memory/468-131-0x00007FF6A9790000-0x00007FF6A9B82000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-119.dat	upx
behavioral2/files/0x000a000000023ba2-117.dat	upx
behavioral2/files/0x000a000000023b9e-113.dat	upx
behavioral2/memory/2684-111-0x00007FF7842A0000-0x00007FF784692000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-103.dat	upx
behavioral2/files/0x000a000000023b9c-99.dat	upx
behavioral2/memory/3504-95-0x00007FF7DD290000-0x00007FF7DD682000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-90.dat	upx
behavioral2/files/0x000a000000023b9a-83.dat	upx
behavioral2/files/0x000a000000023b9b-71.dat	upx
behavioral2/memory/1224-63-0x00007FF6C7FF0000-0x00007FF6C83E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-53.dat	upx
behavioral2/files/0x000a000000023b94-52.dat	upx
behavioral2/files/0x000a000000023b99-51.dat	upx
behavioral2/files/0x000a000000023b95-58.dat	upx
behavioral2/files/0x000b000000023b90-40.dat	upx
behavioral2/files/0x000a000000023b93-38.dat	upx
behavioral2/files/0x000a000000023b92-35.dat	upx
behavioral2/memory/1052-31-0x00007FF778330000-0x00007FF778722000-memory.dmp	upx
behavioral2/memory/4016-30-0x00007FF6F51D0000-0x00007FF6F55C2000-memory.dmp	upx
behavioral2/memory/1696-22-0x00007FF7D0BA0000-0x00007FF7D0F92000-memory.dmp	upx
behavioral2/memory/1224-4992-0x00007FF6C7FF0000-0x00007FF6C83E2000-memory.dmp	upx
behavioral2/memory/3488-5019-0x00007FF63DD80000-0x00007FF63E172000-memory.dmp	upx
behavioral2/memory/2684-5035-0x00007FF7842A0000-0x00007FF784692000-memory.dmp	upx
behavioral2/memory/836-5068-0x00007FF7DE7C0000-0x00007FF7DEBB2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iGhUNsz.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\exbaKER.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\FEmQwua.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\nlwkKel.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\lYrvPop.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\FaSOICH.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\HDgxpeB.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\HiUDKzG.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\GRplfas.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\wTFcdTA.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\LlpRHGq.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\WiGNDco.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\OXfmcxI.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\SIdRLFA.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\TUbqXla.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\mwwtgkc.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\NpyYogj.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\gmTAUrR.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\WPOGjxw.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\uiCzTlf.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\ihCadll.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\QJLvUUW.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\miigBNf.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\HVAZCjJ.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\KfTZJZn.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\AkjfwsJ.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\cKwUuNi.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\PycwTHI.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\xIguaaQ.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\jrbVLvl.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\yDWarud.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\PDhShYJ.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\hOIDDNX.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\GQKIbyG.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\EGAIDpE.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\xGKCqid.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\cydJNqF.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\ZaSjwgv.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\yvKOMVh.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\JobyZSB.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\jNVPOCT.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\EglsBrf.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\ImyQxIP.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\kKXEKSU.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\xnFirfH.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\kuhHKqZ.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\Lqeicfm.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\AtpkSlT.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\XvrzfFD.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\aVvNrgJ.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\dhCheLn.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\SoaPsTZ.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\ItGKJhz.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\zwbVDxY.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\XadtdUB.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\rvXMhsZ.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\VpaFmfu.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\xphdCCU.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\kbshxZJ.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\sqxWckx.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\UcTvhmL.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\KjnEpgo.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\ZAgiDPv.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\cJpjnUp.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4664	powershell.exe
4664	powershell.exe
4664	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeLockMemoryPrivilege	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 4664	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	86
PID 740 wrote to memory of 4664	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	86
PID 740 wrote to memory of 1696	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	87
PID 740 wrote to memory of 1696	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	87
PID 740 wrote to memory of 1052	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	88
PID 740 wrote to memory of 1052	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	88
PID 740 wrote to memory of 1224	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	89
PID 740 wrote to memory of 1224	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	89
PID 740 wrote to memory of 4472	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	90
PID 740 wrote to memory of 4472	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	90
PID 740 wrote to memory of 4016	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	91
PID 740 wrote to memory of 4016	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	91
PID 740 wrote to memory of 4504	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	92
PID 740 wrote to memory of 4504	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	92
PID 740 wrote to memory of 1692	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	93
PID 740 wrote to memory of 1692	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	93
PID 740 wrote to memory of 3504	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	94
PID 740 wrote to memory of 3504	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	94
PID 740 wrote to memory of 3488	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	95
PID 740 wrote to memory of 3488	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	95
PID 740 wrote to memory of 4412	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	96
PID 740 wrote to memory of 4412	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	96
PID 740 wrote to memory of 2684	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	97
PID 740 wrote to memory of 2684	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	97
PID 740 wrote to memory of 2064	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	98
PID 740 wrote to memory of 2064	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	98
PID 740 wrote to memory of 468	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	99
PID 740 wrote to memory of 468	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	99
PID 740 wrote to memory of 3216	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	100
PID 740 wrote to memory of 3216	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	100
PID 740 wrote to memory of 2540	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	101
PID 740 wrote to memory of 2540	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	101
PID 740 wrote to memory of 836	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	102
PID 740 wrote to memory of 836	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	102
PID 740 wrote to memory of 2984	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	103
PID 740 wrote to memory of 2984	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	103
PID 740 wrote to memory of 3720	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	104
PID 740 wrote to memory of 3720	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	104
PID 740 wrote to memory of 4704	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	105
PID 740 wrote to memory of 4704	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	105
PID 740 wrote to memory of 3764	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	106
PID 740 wrote to memory of 3764	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	106
PID 740 wrote to memory of 3748	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	107
PID 740 wrote to memory of 3748	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	107
PID 740 wrote to memory of 4300	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	108
PID 740 wrote to memory of 4300	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	108
PID 740 wrote to memory of 3724	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	109
PID 740 wrote to memory of 3724	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	109
PID 740 wrote to memory of 3976	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	110
PID 740 wrote to memory of 3976	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	110
PID 740 wrote to memory of 2484	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	111
PID 740 wrote to memory of 2484	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	111
PID 740 wrote to memory of 3148	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	112
PID 740 wrote to memory of 3148	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	112
PID 740 wrote to memory of 404	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	113
PID 740 wrote to memory of 404	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	113
PID 740 wrote to memory of 1292	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	114
PID 740 wrote to memory of 1292	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	114
PID 740 wrote to memory of 3940	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	115
PID 740 wrote to memory of 3940	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	115
PID 740 wrote to memory of 3272	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	116
PID 740 wrote to memory of 3272	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	116
PID 740 wrote to memory of 856	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	117
PID 740 wrote to memory of 856	740	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Windows\System\tHlItRA.exe
  C:\Windows\System\tHlItRA.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\Bxwfqes.exe
  C:\Windows\System\Bxwfqes.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\MiydccD.exe
  C:\Windows\System\MiydccD.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\GVWLTny.exe
  C:\Windows\System\GVWLTny.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\kjoJcWt.exe
  C:\Windows\System\kjoJcWt.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\ngfTSit.exe
  C:\Windows\System\ngfTSit.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\cHAtPVF.exe
  C:\Windows\System\cHAtPVF.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\gKhxKoo.exe
  C:\Windows\System\gKhxKoo.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\pCZCOnd.exe
  C:\Windows\System\pCZCOnd.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\ErwDAuL.exe
  C:\Windows\System\ErwDAuL.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\aQXnNHS.exe
  C:\Windows\System\aQXnNHS.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\KhGCWSV.exe
  C:\Windows\System\KhGCWSV.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\tOqJvSZ.exe
  C:\Windows\System\tOqJvSZ.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\rkYIYaB.exe
  C:\Windows\System\rkYIYaB.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\VwmXeIY.exe
  C:\Windows\System\VwmXeIY.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\ikogXKH.exe
  C:\Windows\System\ikogXKH.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\uAxakeE.exe
  C:\Windows\System\uAxakeE.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\zTMdkeg.exe
  C:\Windows\System\zTMdkeg.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\gylfmts.exe
  C:\Windows\System\gylfmts.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\MgEHuoB.exe
  C:\Windows\System\MgEHuoB.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\RWSSxKZ.exe
  C:\Windows\System\RWSSxKZ.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\WQWVHwE.exe
  C:\Windows\System\WQWVHwE.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\RNMOMOo.exe
  C:\Windows\System\RNMOMOo.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\TZgCNQo.exe
  C:\Windows\System\TZgCNQo.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\ilMOnXT.exe
  C:\Windows\System\ilMOnXT.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\QgpuxoJ.exe
  C:\Windows\System\QgpuxoJ.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\STDuGQy.exe
  C:\Windows\System\STDuGQy.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\FgbjNaI.exe
  C:\Windows\System\FgbjNaI.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\DUJOQFh.exe
  C:\Windows\System\DUJOQFh.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\YyJqAsB.exe
  C:\Windows\System\YyJqAsB.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\QiUKqLH.exe
  C:\Windows\System\QiUKqLH.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\GnUyKuB.exe
  C:\Windows\System\GnUyKuB.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\XIONrTk.exe
  C:\Windows\System\XIONrTk.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\lBxiHxX.exe
  C:\Windows\System\lBxiHxX.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\HkfdpcU.exe
  C:\Windows\System\HkfdpcU.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\lRElpvD.exe
  C:\Windows\System\lRElpvD.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\PjXhxjM.exe
  C:\Windows\System\PjXhxjM.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\gapaAhL.exe
  C:\Windows\System\gapaAhL.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\zzjmlcO.exe
  C:\Windows\System\zzjmlcO.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\xHRkXGI.exe
  C:\Windows\System\xHRkXGI.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\nJAfaCG.exe
  C:\Windows\System\nJAfaCG.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\mgkLjUD.exe
  C:\Windows\System\mgkLjUD.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\wZjosDW.exe
  C:\Windows\System\wZjosDW.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\yRclbFw.exe
  C:\Windows\System\yRclbFw.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\lKmKosq.exe
  C:\Windows\System\lKmKosq.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\QevEsgT.exe
  C:\Windows\System\QevEsgT.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\yhVrtWu.exe
  C:\Windows\System\yhVrtWu.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\jyfcDyz.exe
  C:\Windows\System\jyfcDyz.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\xZfWyau.exe
  C:\Windows\System\xZfWyau.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\jxCPNZy.exe
  C:\Windows\System\jxCPNZy.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\lPkXzWd.exe
  C:\Windows\System\lPkXzWd.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\FRLIdfg.exe
  C:\Windows\System\FRLIdfg.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\ISGKxNr.exe
  C:\Windows\System\ISGKxNr.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\BSdCiGk.exe
  C:\Windows\System\BSdCiGk.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\KMhILOf.exe
  C:\Windows\System\KMhILOf.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\hpuDWDC.exe
  C:\Windows\System\hpuDWDC.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\QNebiRv.exe
  C:\Windows\System\QNebiRv.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\xICBKfa.exe
  C:\Windows\System\xICBKfa.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\AbSGMZg.exe
  C:\Windows\System\AbSGMZg.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\lZLtZMI.exe
  C:\Windows\System\lZLtZMI.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\LBjdajN.exe
  C:\Windows\System\LBjdajN.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\fypLGjl.exe
  C:\Windows\System\fypLGjl.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\bLXlRzH.exe
  C:\Windows\System\bLXlRzH.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\ToQGacQ.exe
  C:\Windows\System\ToQGacQ.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\VumMPGl.exe
  C:\Windows\System\VumMPGl.exe
  2⤵
  PID:2768
- C:\Windows\System\buWThGF.exe
  C:\Windows\System\buWThGF.exe
  2⤵
  PID:3204
- C:\Windows\System\pQkkyJE.exe
  C:\Windows\System\pQkkyJE.exe
  2⤵
  PID:1728
- C:\Windows\System\jmHpwVZ.exe
  C:\Windows\System\jmHpwVZ.exe
  2⤵
  PID:3308
- C:\Windows\System\vnyyJZd.exe
  C:\Windows\System\vnyyJZd.exe
  2⤵
  PID:2828
- C:\Windows\System\mghGVOy.exe
  C:\Windows\System\mghGVOy.exe
  2⤵
  PID:824
- C:\Windows\System\NLHQhPd.exe
  C:\Windows\System\NLHQhPd.exe
  2⤵
  PID:1496
- C:\Windows\System\OAbWWYh.exe
  C:\Windows\System\OAbWWYh.exe
  2⤵
  PID:3012
- C:\Windows\System\yDCzqQP.exe
  C:\Windows\System\yDCzqQP.exe
  2⤵
  PID:4108
- C:\Windows\System\fPKiEUu.exe
  C:\Windows\System\fPKiEUu.exe
  2⤵
  PID:8
- C:\Windows\System\ofKGDHM.exe
  C:\Windows\System\ofKGDHM.exe
  2⤵
  PID:1420
- C:\Windows\System\VZGoAxU.exe
  C:\Windows\System\VZGoAxU.exe
  2⤵
  PID:4804
- C:\Windows\System\sGuBbzd.exe
  C:\Windows\System\sGuBbzd.exe
  2⤵
  PID:1284
- C:\Windows\System\jBhUAkO.exe
  C:\Windows\System\jBhUAkO.exe
  2⤵
  PID:4892
- C:\Windows\System\KQLrrQv.exe
  C:\Windows\System\KQLrrQv.exe
  2⤵
  PID:3348
- C:\Windows\System\jioXWQK.exe
  C:\Windows\System\jioXWQK.exe
  2⤵
  PID:1484
- C:\Windows\System\KGZBZhH.exe
  C:\Windows\System\KGZBZhH.exe
  2⤵
  PID:2732
- C:\Windows\System\EyTRFcl.exe
  C:\Windows\System\EyTRFcl.exe
  2⤵
  PID:4500
- C:\Windows\System\DgLPwbQ.exe
  C:\Windows\System\DgLPwbQ.exe
  2⤵
  PID:4468
- C:\Windows\System\QoaqZlX.exe
  C:\Windows\System\QoaqZlX.exe
  2⤵
  PID:3192
- C:\Windows\System\uXwtLjQ.exe
  C:\Windows\System\uXwtLjQ.exe
  2⤵
  PID:440
- C:\Windows\System\CiXCWSz.exe
  C:\Windows\System\CiXCWSz.exe
  2⤵
  PID:4620
- C:\Windows\System\ogElCPz.exe
  C:\Windows\System\ogElCPz.exe
  2⤵
  PID:2152
- C:\Windows\System\pakKLHE.exe
  C:\Windows\System\pakKLHE.exe
  2⤵
  PID:1444
- C:\Windows\System\tNgwyPb.exe
  C:\Windows\System\tNgwyPb.exe
  2⤵
  PID:5136
- C:\Windows\System\bIaJUSk.exe
  C:\Windows\System\bIaJUSk.exe
  2⤵
  PID:5160
- C:\Windows\System\ZKginYW.exe
  C:\Windows\System\ZKginYW.exe
  2⤵
  PID:5192
- C:\Windows\System\WvbRYQu.exe
  C:\Windows\System\WvbRYQu.exe
  2⤵
  PID:5216
- C:\Windows\System\UGTVehB.exe
  C:\Windows\System\UGTVehB.exe
  2⤵
  PID:5244
- C:\Windows\System\SadiERI.exe
  C:\Windows\System\SadiERI.exe
  2⤵
  PID:5264
- C:\Windows\System\hwQleQn.exe
  C:\Windows\System\hwQleQn.exe
  2⤵
  PID:5292
- C:\Windows\System\mORTpJU.exe
  C:\Windows\System\mORTpJU.exe
  2⤵
  PID:5324
- C:\Windows\System\aVfwRyv.exe
  C:\Windows\System\aVfwRyv.exe
  2⤵
  PID:5344
- C:\Windows\System\nksGIoi.exe
  C:\Windows\System\nksGIoi.exe
  2⤵
  PID:5376
- C:\Windows\System\JBymYwr.exe
  C:\Windows\System\JBymYwr.exe
  2⤵
  PID:5396
- C:\Windows\System\afxDaTf.exe
  C:\Windows\System\afxDaTf.exe
  2⤵
  PID:5416
- C:\Windows\System\MncBCLs.exe
  C:\Windows\System\MncBCLs.exe
  2⤵
  PID:5440
- C:\Windows\System\bQrkcbl.exe
  C:\Windows\System\bQrkcbl.exe
  2⤵
  PID:5464
- C:\Windows\System\ZXlzVyh.exe
  C:\Windows\System\ZXlzVyh.exe
  2⤵
  PID:5492
- C:\Windows\System\PRttZRW.exe
  C:\Windows\System\PRttZRW.exe
  2⤵
  PID:5516
- C:\Windows\System\CqyDkLm.exe
  C:\Windows\System\CqyDkLm.exe
  2⤵
  PID:5532
- C:\Windows\System\Ydioyvh.exe
  C:\Windows\System\Ydioyvh.exe
  2⤵
  PID:5576
- C:\Windows\System\ZtgyBtN.exe
  C:\Windows\System\ZtgyBtN.exe
  2⤵
  PID:5620
- C:\Windows\System\HYmUbgK.exe
  C:\Windows\System\HYmUbgK.exe
  2⤵
  PID:5640
- C:\Windows\System\oMsXyZA.exe
  C:\Windows\System\oMsXyZA.exe
  2⤵
  PID:5664
- C:\Windows\System\KCtKKfr.exe
  C:\Windows\System\KCtKKfr.exe
  2⤵
  PID:5680
- C:\Windows\System\riGjSMu.exe
  C:\Windows\System\riGjSMu.exe
  2⤵
  PID:5708
- C:\Windows\System\Tsbpuse.exe
  C:\Windows\System\Tsbpuse.exe
  2⤵
  PID:5732
- C:\Windows\System\tgTkwEa.exe
  C:\Windows\System\tgTkwEa.exe
  2⤵
  PID:5752
- C:\Windows\System\dCXrQrp.exe
  C:\Windows\System\dCXrQrp.exe
  2⤵
  PID:5776
- C:\Windows\System\NsXdyXX.exe
  C:\Windows\System\NsXdyXX.exe
  2⤵
  PID:5792
- C:\Windows\System\pLprhjI.exe
  C:\Windows\System\pLprhjI.exe
  2⤵
  PID:5816
- C:\Windows\System\fPIUrnK.exe
  C:\Windows\System\fPIUrnK.exe
  2⤵
  PID:5852
- C:\Windows\System\MFSTaWM.exe
  C:\Windows\System\MFSTaWM.exe
  2⤵
  PID:5884
- C:\Windows\System\yqLBMeN.exe
  C:\Windows\System\yqLBMeN.exe
  2⤵
  PID:5904
- C:\Windows\System\HYXclEF.exe
  C:\Windows\System\HYXclEF.exe
  2⤵
  PID:5924
- C:\Windows\System\lFgeQmq.exe
  C:\Windows\System\lFgeQmq.exe
  2⤵
  PID:5944
- C:\Windows\System\DcOaRdx.exe
  C:\Windows\System\DcOaRdx.exe
  2⤵
  PID:5964
- C:\Windows\System\tCCBAWQ.exe
  C:\Windows\System\tCCBAWQ.exe
  2⤵
  PID:5984
- C:\Windows\System\EvJcSPl.exe
  C:\Windows\System\EvJcSPl.exe
  2⤵
  PID:6016
- C:\Windows\System\ZdqKFWf.exe
  C:\Windows\System\ZdqKFWf.exe
  2⤵
  PID:6040
- C:\Windows\System\LpHBwsD.exe
  C:\Windows\System\LpHBwsD.exe
  2⤵
  PID:6064
- C:\Windows\System\suLbebI.exe
  C:\Windows\System\suLbebI.exe
  2⤵
  PID:6084
- C:\Windows\System\BklilIK.exe
  C:\Windows\System\BklilIK.exe
  2⤵
  PID:6108
- C:\Windows\System\bJjzuwh.exe
  C:\Windows\System\bJjzuwh.exe
  2⤵
  PID:6124
- C:\Windows\System\SzaNEMi.exe
  C:\Windows\System\SzaNEMi.exe
  2⤵
  PID:2424
- C:\Windows\System\wHhWDpB.exe
  C:\Windows\System\wHhWDpB.exe
  2⤵
  PID:4568
- C:\Windows\System\oBlfTzK.exe
  C:\Windows\System\oBlfTzK.exe
  2⤵
  PID:5168
- C:\Windows\System\aHyZqOh.exe
  C:\Windows\System\aHyZqOh.exe
  2⤵
  PID:5260
- C:\Windows\System\cMTwtOt.exe
  C:\Windows\System\cMTwtOt.exe
  2⤵
  PID:5300
- C:\Windows\System\ZyznXVg.exe
  C:\Windows\System\ZyznXVg.exe
  2⤵
  PID:5336
- C:\Windows\System\JQUVyDl.exe
  C:\Windows\System\JQUVyDl.exe
  2⤵
  PID:5472
- C:\Windows\System\rPGxKZH.exe
  C:\Windows\System\rPGxKZH.exe
  2⤵
  PID:5508
- C:\Windows\System\AsTOvkF.exe
  C:\Windows\System\AsTOvkF.exe
  2⤵
  PID:5352
- C:\Windows\System\fXerQjj.exe
  C:\Windows\System\fXerQjj.exe
  2⤵
  PID:5388
- C:\Windows\System\gbqZMkJ.exe
  C:\Windows\System\gbqZMkJ.exe
  2⤵
  PID:5452
- C:\Windows\System\PXRnyDp.exe
  C:\Windows\System\PXRnyDp.exe
  2⤵
  PID:5524
- C:\Windows\System\yllPgzd.exe
  C:\Windows\System\yllPgzd.exe
  2⤵
  PID:5724
- C:\Windows\System\CDwqqkD.exe
  C:\Windows\System\CDwqqkD.exe
  2⤵
  PID:5648
- C:\Windows\System\mtzzzMi.exe
  C:\Windows\System\mtzzzMi.exe
  2⤵
  PID:5688
- C:\Windows\System\eyWjfZX.exe
  C:\Windows\System\eyWjfZX.exe
  2⤵
  PID:5760
- C:\Windows\System\qBJChdC.exe
  C:\Windows\System\qBJChdC.exe
  2⤵
  PID:5800
- C:\Windows\System\vTGKwTz.exe
  C:\Windows\System\vTGKwTz.exe
  2⤵
  PID:6000
- C:\Windows\System\rfoYxML.exe
  C:\Windows\System\rfoYxML.exe
  2⤵
  PID:5844
- C:\Windows\System\kgJbQWL.exe
  C:\Windows\System\kgJbQWL.exe
  2⤵
  PID:5960
- C:\Windows\System\NDdIiMv.exe
  C:\Windows\System\NDdIiMv.exe
  2⤵
  PID:5144
- C:\Windows\System\hWUglYc.exe
  C:\Windows\System\hWUglYc.exe
  2⤵
  PID:6060
- C:\Windows\System\TsTgJMU.exe
  C:\Windows\System\TsTgJMU.exe
  2⤵
  PID:6096
- C:\Windows\System\IkJVDox.exe
  C:\Windows\System\IkJVDox.exe
  2⤵
  PID:5356
- C:\Windows\System\PYllmpk.exe
  C:\Windows\System\PYllmpk.exe
  2⤵
  PID:5384
- C:\Windows\System\oFHrXza.exe
  C:\Windows\System\oFHrXza.exe
  2⤵
  PID:6164
- C:\Windows\System\eQLWcrd.exe
  C:\Windows\System\eQLWcrd.exe
  2⤵
  PID:6196
- C:\Windows\System\PAozTAy.exe
  C:\Windows\System\PAozTAy.exe
  2⤵
  PID:6216
- C:\Windows\System\TMehNni.exe
  C:\Windows\System\TMehNni.exe
  2⤵
  PID:6240
- C:\Windows\System\OQEIYGp.exe
  C:\Windows\System\OQEIYGp.exe
  2⤵
  PID:6256
- C:\Windows\System\qewesfu.exe
  C:\Windows\System\qewesfu.exe
  2⤵
  PID:6280
- C:\Windows\System\oxgDxmL.exe
  C:\Windows\System\oxgDxmL.exe
  2⤵
  PID:6304
- C:\Windows\System\CvlhcFx.exe
  C:\Windows\System\CvlhcFx.exe
  2⤵
  PID:6332
- C:\Windows\System\AGQIKnX.exe
  C:\Windows\System\AGQIKnX.exe
  2⤵
  PID:6352
- C:\Windows\System\SIyhJEB.exe
  C:\Windows\System\SIyhJEB.exe
  2⤵
  PID:6376
- C:\Windows\System\OHnqWyg.exe
  C:\Windows\System\OHnqWyg.exe
  2⤵
  PID:6400
- C:\Windows\System\NolWVah.exe
  C:\Windows\System\NolWVah.exe
  2⤵
  PID:6420
- C:\Windows\System\rtvYzUG.exe
  C:\Windows\System\rtvYzUG.exe
  2⤵
  PID:6440
- C:\Windows\System\fyrNqHN.exe
  C:\Windows\System\fyrNqHN.exe
  2⤵
  PID:6460
- C:\Windows\System\JWxCbNZ.exe
  C:\Windows\System\JWxCbNZ.exe
  2⤵
  PID:6484
- C:\Windows\System\rupbRkU.exe
  C:\Windows\System\rupbRkU.exe
  2⤵
  PID:6508
- C:\Windows\System\vJEKadb.exe
  C:\Windows\System\vJEKadb.exe
  2⤵
  PID:6528
- C:\Windows\System\DisXxcy.exe
  C:\Windows\System\DisXxcy.exe
  2⤵
  PID:6548
- C:\Windows\System\wjsJXwK.exe
  C:\Windows\System\wjsJXwK.exe
  2⤵
  PID:6572
- C:\Windows\System\rNEHGuw.exe
  C:\Windows\System\rNEHGuw.exe
  2⤵
  PID:6588
- C:\Windows\System\SCzqZOY.exe
  C:\Windows\System\SCzqZOY.exe
  2⤵
  PID:6612
- C:\Windows\System\crlZzay.exe
  C:\Windows\System\crlZzay.exe
  2⤵
  PID:6632
- C:\Windows\System\caEOzKA.exe
  C:\Windows\System\caEOzKA.exe
  2⤵
  PID:6652
- C:\Windows\System\PAVNNvs.exe
  C:\Windows\System\PAVNNvs.exe
  2⤵
  PID:6680
- C:\Windows\System\ttMYRrg.exe
  C:\Windows\System\ttMYRrg.exe
  2⤵
  PID:6696
- C:\Windows\System\EjjelEp.exe
  C:\Windows\System\EjjelEp.exe
  2⤵
  PID:6720
- C:\Windows\System\XYjMwQF.exe
  C:\Windows\System\XYjMwQF.exe
  2⤵
  PID:6740
- C:\Windows\System\fLMommN.exe
  C:\Windows\System\fLMommN.exe
  2⤵
  PID:6764
- C:\Windows\System\FTwCGsk.exe
  C:\Windows\System\FTwCGsk.exe
  2⤵
  PID:6784
- C:\Windows\System\OMvzkVT.exe
  C:\Windows\System\OMvzkVT.exe
  2⤵
  PID:6808
- C:\Windows\System\tLqVvzY.exe
  C:\Windows\System\tLqVvzY.exe
  2⤵
  PID:6824
- C:\Windows\System\uYweeqh.exe
  C:\Windows\System\uYweeqh.exe
  2⤵
  PID:6848
- C:\Windows\System\zKIZwTr.exe
  C:\Windows\System\zKIZwTr.exe
  2⤵
  PID:6868
- C:\Windows\System\uDYHIeb.exe
  C:\Windows\System\uDYHIeb.exe
  2⤵
  PID:6896
- C:\Windows\System\tGcQkVF.exe
  C:\Windows\System\tGcQkVF.exe
  2⤵
  PID:6920
- C:\Windows\System\RDiuobf.exe
  C:\Windows\System\RDiuobf.exe
  2⤵
  PID:6940
- C:\Windows\System\EvveEXH.exe
  C:\Windows\System\EvveEXH.exe
  2⤵
  PID:6964
- C:\Windows\System\gILcXnh.exe
  C:\Windows\System\gILcXnh.exe
  2⤵
  PID:6984
- C:\Windows\System\lSYOeOC.exe
  C:\Windows\System\lSYOeOC.exe
  2⤵
  PID:7004
- C:\Windows\System\ypAUZNs.exe
  C:\Windows\System\ypAUZNs.exe
  2⤵
  PID:7032
- C:\Windows\System\rWjAPvH.exe
  C:\Windows\System\rWjAPvH.exe
  2⤵
  PID:7048
- C:\Windows\System\AXGwWKp.exe
  C:\Windows\System\AXGwWKp.exe
  2⤵
  PID:7076
- C:\Windows\System\LccxdLt.exe
  C:\Windows\System\LccxdLt.exe
  2⤵
  PID:7092
- C:\Windows\System\dZWyzjq.exe
  C:\Windows\System\dZWyzjq.exe
  2⤵
  PID:7116
- C:\Windows\System\LnfyXQc.exe
  C:\Windows\System\LnfyXQc.exe
  2⤵
  PID:7140
- C:\Windows\System\SEgdhIp.exe
  C:\Windows\System\SEgdhIp.exe
  2⤵
  PID:7160
- C:\Windows\System\fKeqPvN.exe
  C:\Windows\System\fKeqPvN.exe
  2⤵
  PID:6028
- C:\Windows\System\laVYNTA.exe
  C:\Windows\System\laVYNTA.exe
  2⤵
  PID:5448
- C:\Windows\System\AghWEZK.exe
  C:\Windows\System\AghWEZK.exe
  2⤵
  PID:5608
- C:\Windows\System\poSuIgs.exe
  C:\Windows\System\poSuIgs.exe
  2⤵
  PID:5940
- C:\Windows\System\zQOOVKi.exe
  C:\Windows\System\zQOOVKi.exe
  2⤵
  PID:6264
- C:\Windows\System\hTGuyTV.exe
  C:\Windows\System\hTGuyTV.exe
  2⤵
  PID:6292
- C:\Windows\System\NYNGZkO.exe
  C:\Windows\System\NYNGZkO.exe
  2⤵
  PID:5980
- C:\Windows\System\pohmYGV.exe
  C:\Windows\System\pohmYGV.exe
  2⤵
  PID:5504
- C:\Windows\System\AkOBfGr.exe
  C:\Windows\System\AkOBfGr.exe
  2⤵
  PID:2592
- C:\Windows\System\lRIMQVH.exe
  C:\Windows\System\lRIMQVH.exe
  2⤵
  PID:6388
- C:\Windows\System\wGJmwGO.exe
  C:\Windows\System\wGJmwGO.exe
  2⤵
  PID:6524
- C:\Windows\System\eFObNjm.exe
  C:\Windows\System\eFObNjm.exe
  2⤵
  PID:6320
- C:\Windows\System\yOrlxAW.exe
  C:\Windows\System\yOrlxAW.exe
  2⤵
  PID:5540
- C:\Windows\System\veyNCDW.exe
  C:\Windows\System\veyNCDW.exe
  2⤵
  PID:6732
- C:\Windows\System\yuQnhWb.exe
  C:\Windows\System\yuQnhWb.exe
  2⤵
  PID:6432
- C:\Windows\System\Lyfclnx.exe
  C:\Windows\System\Lyfclnx.exe
  2⤵
  PID:6456
- C:\Windows\System\uNlClRi.exe
  C:\Windows\System\uNlClRi.exe
  2⤵
  PID:7300
- C:\Windows\System\xNugroA.exe
  C:\Windows\System\xNugroA.exe
  2⤵
  PID:7320
- C:\Windows\System\JdwjaBV.exe
  C:\Windows\System\JdwjaBV.exe
  2⤵
  PID:7348
- C:\Windows\System\uQvDEuH.exe
  C:\Windows\System\uQvDEuH.exe
  2⤵
  PID:7364
- C:\Windows\System\DoedEhS.exe
  C:\Windows\System\DoedEhS.exe
  2⤵
  PID:7384
- C:\Windows\System\LNzgIaN.exe
  C:\Windows\System\LNzgIaN.exe
  2⤵
  PID:7412
- C:\Windows\System\qbIlyxu.exe
  C:\Windows\System\qbIlyxu.exe
  2⤵
  PID:7436
- C:\Windows\System\ofGPKvt.exe
  C:\Windows\System\ofGPKvt.exe
  2⤵
  PID:7452
- C:\Windows\System\GLuGdvS.exe
  C:\Windows\System\GLuGdvS.exe
  2⤵
  PID:7476
- C:\Windows\System\XwkdLul.exe
  C:\Windows\System\XwkdLul.exe
  2⤵
  PID:7500
- C:\Windows\System\hPPrQpS.exe
  C:\Windows\System\hPPrQpS.exe
  2⤵
  PID:7520
- C:\Windows\System\qLYiGJd.exe
  C:\Windows\System\qLYiGJd.exe
  2⤵
  PID:7544
- C:\Windows\System\NYINpUg.exe
  C:\Windows\System\NYINpUg.exe
  2⤵
  PID:7568
- C:\Windows\System\VzcAfZv.exe
  C:\Windows\System\VzcAfZv.exe
  2⤵
  PID:7588
- C:\Windows\System\HeIBZTi.exe
  C:\Windows\System\HeIBZTi.exe
  2⤵
  PID:7608
- C:\Windows\System\wFTmPoL.exe
  C:\Windows\System\wFTmPoL.exe
  2⤵
  PID:7632
- C:\Windows\System\CwHJfkH.exe
  C:\Windows\System\CwHJfkH.exe
  2⤵
  PID:7660
- C:\Windows\System\GcLoHAP.exe
  C:\Windows\System\GcLoHAP.exe
  2⤵
  PID:7680
- C:\Windows\System\OqFgyxq.exe
  C:\Windows\System\OqFgyxq.exe
  2⤵
  PID:7704
- C:\Windows\System\CSOOoZN.exe
  C:\Windows\System\CSOOoZN.exe
  2⤵
  PID:7720
- C:\Windows\System\Ruilzyk.exe
  C:\Windows\System\Ruilzyk.exe
  2⤵
  PID:7744
- C:\Windows\System\fifsWOI.exe
  C:\Windows\System\fifsWOI.exe
  2⤵
  PID:7764
- C:\Windows\System\lcIVdJg.exe
  C:\Windows\System\lcIVdJg.exe
  2⤵
  PID:7788
- C:\Windows\System\SHNKcSp.exe
  C:\Windows\System\SHNKcSp.exe
  2⤵
  PID:7808
- C:\Windows\System\CCsXTBU.exe
  C:\Windows\System\CCsXTBU.exe
  2⤵
  PID:7828
- C:\Windows\System\DeSgKeY.exe
  C:\Windows\System\DeSgKeY.exe
  2⤵
  PID:7848
- C:\Windows\System\PHTBCJG.exe
  C:\Windows\System\PHTBCJG.exe
  2⤵
  PID:7872
- C:\Windows\System\aiKUqZZ.exe
  C:\Windows\System\aiKUqZZ.exe
  2⤵
  PID:7892
- C:\Windows\System\FHBqXHs.exe
  C:\Windows\System\FHBqXHs.exe
  2⤵
  PID:7912
- C:\Windows\System\IMRFfvt.exe
  C:\Windows\System\IMRFfvt.exe
  2⤵
  PID:7936
- C:\Windows\System\EyqngWS.exe
  C:\Windows\System\EyqngWS.exe
  2⤵
  PID:7956
- C:\Windows\System\zdYrXwa.exe
  C:\Windows\System\zdYrXwa.exe
  2⤵
  PID:7976
- C:\Windows\System\ZPdcLMI.exe
  C:\Windows\System\ZPdcLMI.exe
  2⤵
  PID:8000
- C:\Windows\System\OVUDXyl.exe
  C:\Windows\System\OVUDXyl.exe
  2⤵
  PID:8020
- C:\Windows\System\HSxLeWP.exe
  C:\Windows\System\HSxLeWP.exe
  2⤵
  PID:8036
- C:\Windows\System\euKmgBA.exe
  C:\Windows\System\euKmgBA.exe
  2⤵
  PID:8060
- C:\Windows\System\REzHOxc.exe
  C:\Windows\System\REzHOxc.exe
  2⤵
  PID:8084
- C:\Windows\System\jLhHhyW.exe
  C:\Windows\System\jLhHhyW.exe
  2⤵
  PID:8100
- C:\Windows\System\wvXvHoN.exe
  C:\Windows\System\wvXvHoN.exe
  2⤵
  PID:8124
- C:\Windows\System\YBQToEs.exe
  C:\Windows\System\YBQToEs.exe
  2⤵
  PID:8148
- C:\Windows\System\KipIHNS.exe
  C:\Windows\System\KipIHNS.exe
  2⤵
  PID:8168
- C:\Windows\System\rTMBSkx.exe
  C:\Windows\System\rTMBSkx.exe
  2⤵
  PID:8188
- C:\Windows\System\ACklyMY.exe
  C:\Windows\System\ACklyMY.exe
  2⤵
  PID:6344
- C:\Windows\System\zQspfhi.exe
  C:\Windows\System\zQspfhi.exe
  2⤵
  PID:6392
- C:\Windows\System\ABgDsdd.exe
  C:\Windows\System\ABgDsdd.exe
  2⤵
  PID:6324
- C:\Windows\System\yNYUuYV.exe
  C:\Windows\System\yNYUuYV.exe
  2⤵
  PID:6568
- C:\Windows\System\SIPtQrn.exe
  C:\Windows\System\SIPtQrn.exe
  2⤵
  PID:6908
- C:\Windows\System\TBNjLfu.exe
  C:\Windows\System\TBNjLfu.exe
  2⤵
  PID:6948
- C:\Windows\System\CPnmiaB.exe
  C:\Windows\System\CPnmiaB.exe
  2⤵
  PID:6780
- C:\Windows\System\vwyzegv.exe
  C:\Windows\System\vwyzegv.exe
  2⤵
  PID:7296
- C:\Windows\System\ClpTrJE.exe
  C:\Windows\System\ClpTrJE.exe
  2⤵
  PID:7012
- C:\Windows\System\icjLONN.exe
  C:\Windows\System\icjLONN.exe
  2⤵
  PID:6660
- C:\Windows\System\paCXTMm.exe
  C:\Windows\System\paCXTMm.exe
  2⤵
  PID:7068
- C:\Windows\System\KAfdxvM.exe
  C:\Windows\System\KAfdxvM.exe
  2⤵
  PID:7112
- C:\Windows\System\vfzcZZT.exe
  C:\Windows\System\vfzcZZT.exe
  2⤵
  PID:7148
- C:\Windows\System\Rwoddkl.exe
  C:\Windows\System\Rwoddkl.exe
  2⤵
  PID:5788
- C:\Windows\System\aySGjbg.exe
  C:\Windows\System\aySGjbg.exe
  2⤵
  PID:7448
- C:\Windows\System\CaaFDzN.exe
  C:\Windows\System\CaaFDzN.exe
  2⤵
  PID:6728
- C:\Windows\System\uahoXYW.exe
  C:\Windows\System\uahoXYW.exe
  2⤵
  PID:7516
- C:\Windows\System\sthdnKH.exe
  C:\Windows\System\sthdnKH.exe
  2⤵
  PID:6224
- C:\Windows\System\ClwmcAZ.exe
  C:\Windows\System\ClwmcAZ.exe
  2⤵
  PID:7672
- C:\Windows\System\swotcrf.exe
  C:\Windows\System\swotcrf.exe
  2⤵
  PID:6624
- C:\Windows\System\iBsuPRE.exe
  C:\Windows\System\iBsuPRE.exe
  2⤵
  PID:7696
- C:\Windows\System\QBuRNmJ.exe
  C:\Windows\System\QBuRNmJ.exe
  2⤵
  PID:7820
- C:\Windows\System\nZCLXDV.exe
  C:\Windows\System\nZCLXDV.exe
  2⤵
  PID:7864
- C:\Windows\System\kaRPfJY.exe
  C:\Windows\System\kaRPfJY.exe
  2⤵
  PID:8204
- C:\Windows\System\PJXnAtl.exe
  C:\Windows\System\PJXnAtl.exe
  2⤵
  PID:8228
- C:\Windows\System\wqssCSP.exe
  C:\Windows\System\wqssCSP.exe
  2⤵
  PID:8248
- C:\Windows\System\XYDarNO.exe
  C:\Windows\System\XYDarNO.exe
  2⤵
  PID:8272
- C:\Windows\System\CdoHriq.exe
  C:\Windows\System\CdoHriq.exe
  2⤵
  PID:8292
- C:\Windows\System\RgEreII.exe
  C:\Windows\System\RgEreII.exe
  2⤵
  PID:8320
- C:\Windows\System\SoKxWOI.exe
  C:\Windows\System\SoKxWOI.exe
  2⤵
  PID:8344
- C:\Windows\System\CtDgzYC.exe
  C:\Windows\System\CtDgzYC.exe
  2⤵
  PID:8364
- C:\Windows\System\doFbiso.exe
  C:\Windows\System\doFbiso.exe
  2⤵
  PID:8388
- C:\Windows\System\eWZVhZS.exe
  C:\Windows\System\eWZVhZS.exe
  2⤵
  PID:8404
- C:\Windows\System\cZhXnPr.exe
  C:\Windows\System\cZhXnPr.exe
  2⤵
  PID:8428
- C:\Windows\System\xWUKfEc.exe
  C:\Windows\System\xWUKfEc.exe
  2⤵
  PID:8452
- C:\Windows\System\VtDVyQA.exe
  C:\Windows\System\VtDVyQA.exe
  2⤵
  PID:8480
- C:\Windows\System\XFjJlbL.exe
  C:\Windows\System\XFjJlbL.exe
  2⤵
  PID:8500
- C:\Windows\System\mwZQWjS.exe
  C:\Windows\System\mwZQWjS.exe
  2⤵
  PID:8520
- C:\Windows\System\fcezUjK.exe
  C:\Windows\System\fcezUjK.exe
  2⤵
  PID:8540
- C:\Windows\System\LGfGYfO.exe
  C:\Windows\System\LGfGYfO.exe
  2⤵
  PID:8568
- C:\Windows\System\rIVrYWd.exe
  C:\Windows\System\rIVrYWd.exe
  2⤵
  PID:8584
- C:\Windows\System\glgpMqB.exe
  C:\Windows\System\glgpMqB.exe
  2⤵
  PID:8608
- C:\Windows\System\TmiznbH.exe
  C:\Windows\System\TmiznbH.exe
  2⤵
  PID:8632
- C:\Windows\System\CTChQGS.exe
  C:\Windows\System\CTChQGS.exe
  2⤵
  PID:8648
- C:\Windows\System\vdJHiRe.exe
  C:\Windows\System\vdJHiRe.exe
  2⤵
  PID:8672
- C:\Windows\System\BEUAPQV.exe
  C:\Windows\System\BEUAPQV.exe
  2⤵
  PID:8700
- C:\Windows\System\AMQhgke.exe
  C:\Windows\System\AMQhgke.exe
  2⤵
  PID:8720
- C:\Windows\System\kVdSubT.exe
  C:\Windows\System\kVdSubT.exe
  2⤵
  PID:8740
- C:\Windows\System\tNtILyj.exe
  C:\Windows\System\tNtILyj.exe
  2⤵
  PID:8764
- C:\Windows\System\fIwRpDn.exe
  C:\Windows\System\fIwRpDn.exe
  2⤵
  PID:8792
- C:\Windows\System\PmhhGln.exe
  C:\Windows\System\PmhhGln.exe
  2⤵
  PID:8808
- C:\Windows\System\BPDdiZj.exe
  C:\Windows\System\BPDdiZj.exe
  2⤵
  PID:8828
- C:\Windows\System\ptcHIZn.exe
  C:\Windows\System\ptcHIZn.exe
  2⤵
  PID:8852
- C:\Windows\System\QqMtoNU.exe
  C:\Windows\System\QqMtoNU.exe
  2⤵
  PID:8872
- C:\Windows\System\fLICljF.exe
  C:\Windows\System\fLICljF.exe
  2⤵
  PID:8888
- C:\Windows\System\PfStepB.exe
  C:\Windows\System\PfStepB.exe
  2⤵
  PID:8912
- C:\Windows\System\fLTzsnj.exe
  C:\Windows\System\fLTzsnj.exe
  2⤵
  PID:8936
- C:\Windows\System\iQcQMBH.exe
  C:\Windows\System\iQcQMBH.exe
  2⤵
  PID:8956
- C:\Windows\System\uCRkHFy.exe
  C:\Windows\System\uCRkHFy.exe
  2⤵
  PID:8976
- C:\Windows\System\kiwkrNG.exe
  C:\Windows\System\kiwkrNG.exe
  2⤵
  PID:9000
- C:\Windows\System\iiIpnOJ.exe
  C:\Windows\System\iiIpnOJ.exe
  2⤵
  PID:9024
- C:\Windows\System\STngBVW.exe
  C:\Windows\System\STngBVW.exe
  2⤵
  PID:9040
- C:\Windows\System\WwzyJBk.exe
  C:\Windows\System\WwzyJBk.exe
  2⤵
  PID:9076
- C:\Windows\System\hGqzGeC.exe
  C:\Windows\System\hGqzGeC.exe
  2⤵
  PID:9092
- C:\Windows\System\WPTjYIu.exe
  C:\Windows\System\WPTjYIu.exe
  2⤵
  PID:9120
- C:\Windows\System\BblWRpZ.exe
  C:\Windows\System\BblWRpZ.exe
  2⤵
  PID:9136
- C:\Windows\System\PvqrRbt.exe
  C:\Windows\System\PvqrRbt.exe
  2⤵
  PID:9160
- C:\Windows\System\BgLtdSb.exe
  C:\Windows\System\BgLtdSb.exe
  2⤵
  PID:9176
- C:\Windows\System\PCDvbDX.exe
  C:\Windows\System\PCDvbDX.exe
  2⤵
  PID:9200
- C:\Windows\System\yKUaMqW.exe
  C:\Windows\System\yKUaMqW.exe
  2⤵
  PID:7428
- C:\Windows\System\MjYzypI.exe
  C:\Windows\System\MjYzypI.exe
  2⤵
  PID:7444
- C:\Windows\System\zHhEXUu.exe
  C:\Windows\System\zHhEXUu.exe
  2⤵
  PID:8076
- C:\Windows\System\JDAJGUj.exe
  C:\Windows\System\JDAJGUj.exe
  2⤵
  PID:6300
- C:\Windows\System\CeXnQTg.exe
  C:\Windows\System\CeXnQTg.exe
  2⤵
  PID:5272
- C:\Windows\System\QkfqIMT.exe
  C:\Windows\System\QkfqIMT.exe
  2⤵
  PID:8176
- C:\Windows\System\LLYAGQR.exe
  C:\Windows\System\LLYAGQR.exe
  2⤵
  PID:6364
- C:\Windows\System\daMzDzP.exe
  C:\Windows\System\daMzDzP.exe
  2⤵
  PID:6492
- C:\Windows\System\TNRfMHJ.exe
  C:\Windows\System\TNRfMHJ.exe
  2⤵
  PID:7728
- C:\Windows\System\XavzxIf.exe
  C:\Windows\System\XavzxIf.exe
  2⤵
  PID:6160
- C:\Windows\System\LPCHJvi.exe
  C:\Windows\System\LPCHJvi.exe
  2⤵
  PID:5656
- C:\Windows\System\ZrrQNgW.exe
  C:\Windows\System\ZrrQNgW.exe
  2⤵
  PID:7816
- C:\Windows\System\NsEeGHi.exe
  C:\Windows\System\NsEeGHi.exe
  2⤵
  PID:7920
- C:\Windows\System\TsfULvY.exe
  C:\Windows\System\TsfULvY.exe
  2⤵
  PID:8264
- C:\Windows\System\sdyNYzW.exe
  C:\Windows\System\sdyNYzW.exe
  2⤵
  PID:8280
- C:\Windows\System\ZCEYpgT.exe
  C:\Windows\System\ZCEYpgT.exe
  2⤵
  PID:7472
- C:\Windows\System\WEDsMDC.exe
  C:\Windows\System\WEDsMDC.exe
  2⤵
  PID:9240
- C:\Windows\System\zszjzam.exe
  C:\Windows\System\zszjzam.exe
  2⤵
  PID:9264
- C:\Windows\System\HwPtqJl.exe
  C:\Windows\System\HwPtqJl.exe
  2⤵
  PID:9284
- C:\Windows\System\GOoudUd.exe
  C:\Windows\System\GOoudUd.exe
  2⤵
  PID:9304
- C:\Windows\System\lLAQlzR.exe
  C:\Windows\System\lLAQlzR.exe
  2⤵
  PID:9324
- C:\Windows\System\ZEGsWwj.exe
  C:\Windows\System\ZEGsWwj.exe
  2⤵
  PID:9344
- C:\Windows\System\BDhBsee.exe
  C:\Windows\System\BDhBsee.exe
  2⤵
  PID:9360
- C:\Windows\System\LAhcvMt.exe
  C:\Windows\System\LAhcvMt.exe
  2⤵
  PID:9384
- C:\Windows\System\qGohGof.exe
  C:\Windows\System\qGohGof.exe
  2⤵
  PID:9404
- C:\Windows\System\eoNyqWR.exe
  C:\Windows\System\eoNyqWR.exe
  2⤵
  PID:9432
- C:\Windows\System\rmAujiA.exe
  C:\Windows\System\rmAujiA.exe
  2⤵
  PID:9448
- C:\Windows\System\RZJUVIC.exe
  C:\Windows\System\RZJUVIC.exe
  2⤵
  PID:9472
- C:\Windows\System\qqbztBE.exe
  C:\Windows\System\qqbztBE.exe
  2⤵
  PID:9492
- C:\Windows\System\DFtxUPY.exe
  C:\Windows\System\DFtxUPY.exe
  2⤵
  PID:9520
- C:\Windows\System\hZOSrxG.exe
  C:\Windows\System\hZOSrxG.exe
  2⤵
  PID:9540
- C:\Windows\System\SfhZSLr.exe
  C:\Windows\System\SfhZSLr.exe
  2⤵
  PID:9568
- C:\Windows\System\GEitFAE.exe
  C:\Windows\System\GEitFAE.exe
  2⤵
  PID:9584
- C:\Windows\System\nzJlqqz.exe
  C:\Windows\System\nzJlqqz.exe
  2⤵
  PID:9608
- C:\Windows\System\JeNuosG.exe
  C:\Windows\System\JeNuosG.exe
  2⤵
  PID:9636
- C:\Windows\System\UeHAijU.exe
  C:\Windows\System\UeHAijU.exe
  2⤵
  PID:9652
- C:\Windows\System\irzHCDz.exe
  C:\Windows\System\irzHCDz.exe
  2⤵
  PID:9680
- C:\Windows\System\KDgvBGp.exe
  C:\Windows\System\KDgvBGp.exe
  2⤵
  PID:9700
- C:\Windows\System\AZxNTfe.exe
  C:\Windows\System\AZxNTfe.exe
  2⤵
  PID:9728
- C:\Windows\System\clrOsRG.exe
  C:\Windows\System\clrOsRG.exe
  2⤵
  PID:9748
- C:\Windows\System\lRkZGZJ.exe
  C:\Windows\System\lRkZGZJ.exe
  2⤵
  PID:9768
- C:\Windows\System\IOJBaQn.exe
  C:\Windows\System\IOJBaQn.exe
  2⤵
  PID:9792
- C:\Windows\System\eoaIiPz.exe
  C:\Windows\System\eoaIiPz.exe
  2⤵
  PID:9812
- C:\Windows\System\FkoseaN.exe
  C:\Windows\System\FkoseaN.exe
  2⤵
  PID:9832
- C:\Windows\System\gInbgFL.exe
  C:\Windows\System\gInbgFL.exe
  2⤵
  PID:9852
- C:\Windows\System\HVTOcBy.exe
  C:\Windows\System\HVTOcBy.exe
  2⤵
  PID:9876
- C:\Windows\System\BJRdKQj.exe
  C:\Windows\System\BJRdKQj.exe
  2⤵
  PID:9892
- C:\Windows\System\SZnPFMB.exe
  C:\Windows\System\SZnPFMB.exe
  2⤵
  PID:9916
- C:\Windows\System\uMGBQyj.exe
  C:\Windows\System\uMGBQyj.exe
  2⤵
  PID:9940
- C:\Windows\System\pErkrtR.exe
  C:\Windows\System\pErkrtR.exe
  2⤵
  PID:9960
- C:\Windows\System\NRHeVea.exe
  C:\Windows\System\NRHeVea.exe
  2⤵
  PID:9980
- C:\Windows\System\psPQFLH.exe
  C:\Windows\System\psPQFLH.exe
  2⤵
  PID:10000
- C:\Windows\System\FsbOmGs.exe
  C:\Windows\System\FsbOmGs.exe
  2⤵
  PID:10028
- C:\Windows\System\NJVzrrJ.exe
  C:\Windows\System\NJVzrrJ.exe
  2⤵
  PID:10048
- C:\Windows\System\kjnsyeB.exe
  C:\Windows\System\kjnsyeB.exe
  2⤵
  PID:10064
- C:\Windows\System\wfcWBoy.exe
  C:\Windows\System\wfcWBoy.exe
  2⤵
  PID:10084
- C:\Windows\System\MpcLEMR.exe
  C:\Windows\System\MpcLEMR.exe
  2⤵
  PID:10108
- C:\Windows\System\JZUcZtX.exe
  C:\Windows\System\JZUcZtX.exe
  2⤵
  PID:10128
- C:\Windows\System\IqzEtHU.exe
  C:\Windows\System\IqzEtHU.exe
  2⤵
  PID:10148
- C:\Windows\System\hAQzCuU.exe
  C:\Windows\System\hAQzCuU.exe
  2⤵
  PID:10168
- C:\Windows\System\WRDGwmD.exe
  C:\Windows\System\WRDGwmD.exe
  2⤵
  PID:10192
- C:\Windows\System\DSfUOHx.exe
  C:\Windows\System\DSfUOHx.exe
  2⤵
  PID:10212
- C:\Windows\System\kOGWiRT.exe
  C:\Windows\System\kOGWiRT.exe
  2⤵
  PID:10236
- C:\Windows\System\rAzdqHy.exe
  C:\Windows\System\rAzdqHy.exe
  2⤵
  PID:8356
- C:\Windows\System\uoyAAKf.exe
  C:\Windows\System\uoyAAKf.exe
  2⤵
  PID:8396
- C:\Windows\System\qZtfeRk.exe
  C:\Windows\System\qZtfeRk.exe
  2⤵
  PID:7652
- C:\Windows\System\jaqTnft.exe
  C:\Windows\System\jaqTnft.exe
  2⤵
  PID:8668
- C:\Windows\System\VphAXWm.exe
  C:\Windows\System\VphAXWm.exe
  2⤵
  PID:8716
- C:\Windows\System\ozgbYVS.exe
  C:\Windows\System\ozgbYVS.exe
  2⤵
  PID:7760
- C:\Windows\System\Lfqqryr.exe
  C:\Windows\System\Lfqqryr.exe
  2⤵
  PID:7776
- C:\Windows\System\HNFWHRk.exe
  C:\Windows\System\HNFWHRk.exe
  2⤵
  PID:8952
- C:\Windows\System\dneoWBQ.exe
  C:\Windows\System\dneoWBQ.exe
  2⤵
  PID:7512
- C:\Windows\System\KKxaCid.exe
  C:\Windows\System\KKxaCid.exe
  2⤵
  PID:7860
- C:\Windows\System\jkDYXzB.exe
  C:\Windows\System\jkDYXzB.exe
  2⤵
  PID:7952
- C:\Windows\System\FtsChrc.exe
  C:\Windows\System\FtsChrc.exe
  2⤵
  PID:5996
- C:\Windows\System\FVstirO.exe
  C:\Windows\System\FVstirO.exe
  2⤵
  PID:5556
- C:\Windows\System\pOmzDvP.exe
  C:\Windows\System\pOmzDvP.exe
  2⤵
  PID:6856
- C:\Windows\System\GYIbENo.exe
  C:\Windows\System\GYIbENo.exe
  2⤵
  PID:8016
- C:\Windows\System\cAMFoon.exe
  C:\Windows\System\cAMFoon.exe
  2⤵
  PID:8044
- C:\Windows\System\ragpxHY.exe
  C:\Windows\System\ragpxHY.exe
  2⤵
  PID:8336
- C:\Windows\System\VFGkeKH.exe
  C:\Windows\System\VFGkeKH.exe
  2⤵
  PID:9332
- C:\Windows\System\iRzncRU.exe
  C:\Windows\System\iRzncRU.exe
  2⤵
  PID:9352
- C:\Windows\System\ovqYAbR.exe
  C:\Windows\System\ovqYAbR.exe
  2⤵
  PID:8460
- C:\Windows\System\nAIKSVF.exe
  C:\Windows\System\nAIKSVF.exe
  2⤵
  PID:9456
- C:\Windows\System\eLRsdUF.exe
  C:\Windows\System\eLRsdUF.exe
  2⤵
  PID:9508
- C:\Windows\System\xZbHApH.exe
  C:\Windows\System\xZbHApH.exe
  2⤵
  PID:10260
- C:\Windows\System\KQSLBeX.exe
  C:\Windows\System\KQSLBeX.exe
  2⤵
  PID:10280
- C:\Windows\System\QXNxlxg.exe
  C:\Windows\System\QXNxlxg.exe
  2⤵
  PID:10300
- C:\Windows\System\XssWmYm.exe
  C:\Windows\System\XssWmYm.exe
  2⤵
  PID:10328
- C:\Windows\System\FSWXSNS.exe
  C:\Windows\System\FSWXSNS.exe
  2⤵
  PID:10344
- C:\Windows\System\zcaHTmH.exe
  C:\Windows\System\zcaHTmH.exe
  2⤵
  PID:10360
- C:\Windows\System\sYjUUGp.exe
  C:\Windows\System\sYjUUGp.exe
  2⤵
  PID:10384
- C:\Windows\System\qhBjRwm.exe
  C:\Windows\System\qhBjRwm.exe
  2⤵
  PID:10404
- C:\Windows\System\BEUpYMZ.exe
  C:\Windows\System\BEUpYMZ.exe
  2⤵
  PID:10428
- C:\Windows\System\DAkjMuj.exe
  C:\Windows\System\DAkjMuj.exe
  2⤵
  PID:10448
- C:\Windows\System\EsPJLwV.exe
  C:\Windows\System\EsPJLwV.exe
  2⤵
  PID:10468
- C:\Windows\System\CkMjKkP.exe
  C:\Windows\System\CkMjKkP.exe
  2⤵
  PID:10488
- C:\Windows\System\FVwzmDv.exe
  C:\Windows\System\FVwzmDv.exe
  2⤵
  PID:10512
- C:\Windows\System\ZBJjfdR.exe
  C:\Windows\System\ZBJjfdR.exe
  2⤵
  PID:10532
- C:\Windows\System\zRnecyL.exe
  C:\Windows\System\zRnecyL.exe
  2⤵
  PID:10552
- C:\Windows\System\avhtcGA.exe
  C:\Windows\System\avhtcGA.exe
  2⤵
  PID:10572
- C:\Windows\System\XwRArIs.exe
  C:\Windows\System\XwRArIs.exe
  2⤵
  PID:10596
- C:\Windows\System\Ozkljxg.exe
  C:\Windows\System\Ozkljxg.exe
  2⤵
  PID:10616
- C:\Windows\System\UDMnbVU.exe
  C:\Windows\System\UDMnbVU.exe
  2⤵
  PID:10640
- C:\Windows\System\SqPHglF.exe
  C:\Windows\System\SqPHglF.exe
  2⤵
  PID:10664
- C:\Windows\System\zWCqFZh.exe
  C:\Windows\System\zWCqFZh.exe
  2⤵
  PID:10684
- C:\Windows\System\BZFhAei.exe
  C:\Windows\System\BZFhAei.exe
  2⤵
  PID:10704
- C:\Windows\System\qgCelwL.exe
  C:\Windows\System\qgCelwL.exe
  2⤵
  PID:10728
- C:\Windows\System\fzWnBdV.exe
  C:\Windows\System\fzWnBdV.exe
  2⤵
  PID:10760
- C:\Windows\System\ENLIOYi.exe
  C:\Windows\System\ENLIOYi.exe
  2⤵
  PID:11128
- C:\Windows\System\ICfZKHV.exe
  C:\Windows\System\ICfZKHV.exe
  2⤵
  PID:11228
- C:\Windows\System\WNlefsJ.exe
  C:\Windows\System\WNlefsJ.exe
  2⤵
  PID:11252
- C:\Windows\System\qGCqoUq.exe
  C:\Windows\System\qGCqoUq.exe
  2⤵
  PID:8536
- C:\Windows\System\FtdSvpD.exe
  C:\Windows\System\FtdSvpD.exe
  2⤵
  PID:8580
- C:\Windows\System\BUBfLhu.exe
  C:\Windows\System\BUBfLhu.exe
  2⤵
  PID:9740
- C:\Windows\System\oaSbEaP.exe
  C:\Windows\System\oaSbEaP.exe
  2⤵
  PID:8752
- C:\Windows\System\wTxkIYX.exe
  C:\Windows\System\wTxkIYX.exe
  2⤵
  PID:9788
- C:\Windows\System\ddLojLv.exe
  C:\Windows\System\ddLojLv.exe
  2⤵
  PID:9808
- C:\Windows\System\vbeoybK.exe
  C:\Windows\System\vbeoybK.exe
  2⤵
  PID:7024
- C:\Windows\System\hjdezXG.exe
  C:\Windows\System\hjdezXG.exe
  2⤵
  PID:8844
- C:\Windows\System\gIHjjdt.exe
  C:\Windows\System\gIHjjdt.exe
  2⤵
  PID:7136
- C:\Windows\System\wxiFRea.exe
  C:\Windows\System\wxiFRea.exe
  2⤵
  PID:8924
- C:\Windows\System\ASFNjKh.exe
  C:\Windows\System\ASFNjKh.exe
  2⤵
  PID:7492
- C:\Windows\System\Ouzgaje.exe
  C:\Windows\System\Ouzgaje.exe
  2⤵
  PID:6796
- C:\Windows\System\aFNukHC.exe
  C:\Windows\System\aFNukHC.exe
  2⤵
  PID:10144
- C:\Windows\System\MFdjKSq.exe
  C:\Windows\System\MFdjKSq.exe
  2⤵
  PID:9132
- C:\Windows\System\uqZmMos.exe
  C:\Windows\System\uqZmMos.exe
  2⤵
  PID:9192
- C:\Windows\System\DYcGOVr.exe
  C:\Windows\System\DYcGOVr.exe
  2⤵
  PID:8360
- C:\Windows\System\LXtyDqE.exe
  C:\Windows\System\LXtyDqE.exe
  2⤵
  PID:8256
- C:\Windows\System\SvKmwOL.exe
  C:\Windows\System\SvKmwOL.exe
  2⤵
  PID:7356
- C:\Windows\System\RnJnFJd.exe
  C:\Windows\System\RnJnFJd.exe
  2⤵
  PID:7584
- C:\Windows\System\GEEGQnS.exe
  C:\Windows\System\GEEGQnS.exe
  2⤵
  PID:8420
- C:\Windows\System\GHkfRnJ.exe
  C:\Windows\System\GHkfRnJ.exe
  2⤵
  PID:8508
- C:\Windows\System\krcMXXQ.exe
  C:\Windows\System\krcMXXQ.exe
  2⤵
  PID:9580
- C:\Windows\System\VmWTKjW.exe
  C:\Windows\System\VmWTKjW.exe
  2⤵
  PID:8616
- C:\Windows\System\VSfSVVH.exe
  C:\Windows\System\VSfSVVH.exe
  2⤵
  PID:9632
- C:\Windows\System\SoaPsTZ.exe
  C:\Windows\System\SoaPsTZ.exe
  2⤵
  PID:10356
- C:\Windows\System\WOggPSs.exe
  C:\Windows\System\WOggPSs.exe
  2⤵
  PID:10420
- C:\Windows\System\prcwlBi.exe
  C:\Windows\System\prcwlBi.exe
  2⤵
  PID:9848
- C:\Windows\System\DruXTQe.exe
  C:\Windows\System\DruXTQe.exe
  2⤵
  PID:8800
- C:\Windows\System\oitkchq.exe
  C:\Windows\System\oitkchq.exe
  2⤵
  PID:8864
- C:\Windows\System\llHZFFz.exe
  C:\Windows\System\llHZFFz.exe
  2⤵
  PID:8908
- C:\Windows\System\OmaAxxi.exe
  C:\Windows\System\OmaAxxi.exe
  2⤵
  PID:10352
- C:\Windows\System\lJJTxMs.exe
  C:\Windows\System\lJJTxMs.exe
  2⤵
  PID:8372
- C:\Windows\System\BBvKfIg.exe
  C:\Windows\System\BBvKfIg.exe
  2⤵
  PID:10160
- C:\Windows\System\AJpqbty.exe
  C:\Windows\System\AJpqbty.exe
  2⤵
  PID:10648
- C:\Windows\System\yGgAmMd.exe
  C:\Windows\System\yGgAmMd.exe
  2⤵
  PID:10520
- C:\Windows\System\waVYlpN.exe
  C:\Windows\System\waVYlpN.exe
  2⤵
  PID:10272
- C:\Windows\System\ShpDmyn.exe
  C:\Windows\System\ShpDmyn.exe
  2⤵
  PID:8136
- C:\Windows\System\RvKwJBQ.exe
  C:\Windows\System\RvKwJBQ.exe
  2⤵
  PID:10076
- C:\Windows\System\TvDNkLP.exe
  C:\Windows\System\TvDNkLP.exe
  2⤵
  PID:9048
- C:\Windows\System\pQiqcWt.exe
  C:\Windows\System\pQiqcWt.exe
  2⤵
  PID:7988
- C:\Windows\System\RXetQTF.exe
  C:\Windows\System\RXetQTF.exe
  2⤵
  PID:10828
- C:\Windows\System\rXMxTkp.exe
  C:\Windows\System\rXMxTkp.exe
  2⤵
  PID:10856
- C:\Windows\System\EGVKLkr.exe
  C:\Windows\System\EGVKLkr.exe
  2⤵
  PID:7332
- C:\Windows\System\twDaOSZ.exe
  C:\Windows\System\twDaOSZ.exe
  2⤵
  PID:9252
- C:\Windows\System\anrrVbf.exe
  C:\Windows\System\anrrVbf.exe
  2⤵
  PID:9340
- C:\Windows\System\FLGyMMh.exe
  C:\Windows\System\FLGyMMh.exe
  2⤵
  PID:9440
- C:\Windows\System\IZIvzvy.exe
  C:\Windows\System\IZIvzvy.exe
  2⤵
  PID:11272
- C:\Windows\System\lzhoqdF.exe
  C:\Windows\System\lzhoqdF.exe
  2⤵
  PID:11296
- C:\Windows\System\QJNafry.exe
  C:\Windows\System\QJNafry.exe
  2⤵
  PID:11328
- C:\Windows\System\HOPgugE.exe
  C:\Windows\System\HOPgugE.exe
  2⤵
  PID:11348
- C:\Windows\System\xOXCJXp.exe
  C:\Windows\System\xOXCJXp.exe
  2⤵
  PID:11384
- C:\Windows\System\KYtOAYG.exe
  C:\Windows\System\KYtOAYG.exe
  2⤵
  PID:11416
- C:\Windows\System\tqcusNO.exe
  C:\Windows\System\tqcusNO.exe
  2⤵
  PID:11444
- C:\Windows\System\UqjGPUX.exe
  C:\Windows\System\UqjGPUX.exe
  2⤵
  PID:11468
- C:\Windows\System\GbEhQIJ.exe
  C:\Windows\System\GbEhQIJ.exe
  2⤵
  PID:11484
- C:\Windows\System\roqdAnh.exe
  C:\Windows\System\roqdAnh.exe
  2⤵
  PID:11508
- C:\Windows\System\pJPWJkV.exe
  C:\Windows\System\pJPWJkV.exe
  2⤵
  PID:11528
- C:\Windows\System\qgPiZCi.exe
  C:\Windows\System\qgPiZCi.exe
  2⤵
  PID:11552
- C:\Windows\System\BZODlfO.exe
  C:\Windows\System\BZODlfO.exe
  2⤵
  PID:11580
- C:\Windows\System\MIBBPdd.exe
  C:\Windows\System\MIBBPdd.exe
  2⤵
  PID:11596
- C:\Windows\System\ikJgboR.exe
  C:\Windows\System\ikJgboR.exe
  2⤵
  PID:11620
- C:\Windows\System\uSBYuah.exe
  C:\Windows\System\uSBYuah.exe
  2⤵
  PID:11640
- C:\Windows\System\eZNMgyS.exe
  C:\Windows\System\eZNMgyS.exe
  2⤵
  PID:11656
- C:\Windows\System\szHerFg.exe
  C:\Windows\System\szHerFg.exe
  2⤵
  PID:11672
- C:\Windows\System\LRoFnuF.exe
  C:\Windows\System\LRoFnuF.exe
  2⤵
  PID:11688
- C:\Windows\System\RQJDUpz.exe
  C:\Windows\System\RQJDUpz.exe
  2⤵
  PID:11712
- C:\Windows\System\xoGTIYn.exe
  C:\Windows\System\xoGTIYn.exe
  2⤵
  PID:11728
- C:\Windows\System\sMXHrfw.exe
  C:\Windows\System\sMXHrfw.exe
  2⤵
  PID:11744
- C:\Windows\System\NJctwSM.exe
  C:\Windows\System\NJctwSM.exe
  2⤵
  PID:11760
- C:\Windows\System\dNPylma.exe
  C:\Windows\System\dNPylma.exe
  2⤵
  PID:11776
- C:\Windows\System\VKWvbEc.exe
  C:\Windows\System\VKWvbEc.exe
  2⤵
  PID:11800
- C:\Windows\System\RmpDLGQ.exe
  C:\Windows\System\RmpDLGQ.exe
  2⤵
  PID:11824
- C:\Windows\System\Irctllo.exe
  C:\Windows\System\Irctllo.exe
  2⤵
  PID:11840
- C:\Windows\System\xDcGLve.exe
  C:\Windows\System\xDcGLve.exe
  2⤵
  PID:11868
- C:\Windows\System\mTuBskr.exe
  C:\Windows\System\mTuBskr.exe
  2⤵
  PID:11888
- C:\Windows\System\XggLueU.exe
  C:\Windows\System\XggLueU.exe
  2⤵
  PID:11908
- C:\Windows\System\yAnNZlE.exe
  C:\Windows\System\yAnNZlE.exe
  2⤵
  PID:11928
- C:\Windows\System\aFuntrW.exe
  C:\Windows\System\aFuntrW.exe
  2⤵
  PID:11960
- C:\Windows\System\GhcKcMA.exe
  C:\Windows\System\GhcKcMA.exe
  2⤵
  PID:11988
- C:\Windows\System\prsfIqO.exe
  C:\Windows\System\prsfIqO.exe
  2⤵
  PID:12016
- C:\Windows\System\denPeIB.exe
  C:\Windows\System\denPeIB.exe
  2⤵
  PID:12064
- C:\Windows\System\KanFwDX.exe
  C:\Windows\System\KanFwDX.exe
  2⤵
  PID:12084
- C:\Windows\System\QnWdDko.exe
  C:\Windows\System\QnWdDko.exe
  2⤵
  PID:12108
- C:\Windows\System\wwZYcSB.exe
  C:\Windows\System\wwZYcSB.exe
  2⤵
  PID:12128
- C:\Windows\System\XtJmnij.exe
  C:\Windows\System\XtJmnij.exe
  2⤵
  PID:12144
- C:\Windows\System\WbYzlnh.exe
  C:\Windows\System\WbYzlnh.exe
  2⤵
  PID:12164
- C:\Windows\System\AtwptqV.exe
  C:\Windows\System\AtwptqV.exe
  2⤵
  PID:12188
- C:\Windows\System\LppvCoJ.exe
  C:\Windows\System\LppvCoJ.exe
  2⤵
  PID:12212
- C:\Windows\System\znaVkLW.exe
  C:\Windows\System\znaVkLW.exe
  2⤵
  PID:12232
- C:\Windows\System\MKtowpS.exe
  C:\Windows\System\MKtowpS.exe
  2⤵
  PID:12256
- C:\Windows\System\KLqesxL.exe
  C:\Windows\System\KLqesxL.exe
  2⤵
  PID:12284
- C:\Windows\System\SxbAGIW.exe
  C:\Windows\System\SxbAGIW.exe
  2⤵
  PID:10368
- C:\Windows\System\CJIkizv.exe
  C:\Windows\System\CJIkizv.exe
  2⤵
  PID:10524
- C:\Windows\System\lqUrNoT.exe
  C:\Windows\System\lqUrNoT.exe
  2⤵
  PID:9844
- C:\Windows\System\gqEbEPQ.exe
  C:\Windows\System\gqEbEPQ.exe
  2⤵
  PID:9936
- C:\Windows\System\FeNHbVh.exe
  C:\Windows\System\FeNHbVh.exe
  2⤵
  PID:10756
- C:\Windows\System\jXyeDBF.exe
  C:\Windows\System\jXyeDBF.exe
  2⤵
  PID:9172
- C:\Windows\System\hXaFGlV.exe
  C:\Windows\System\hXaFGlV.exe
  2⤵
  PID:9972
- C:\Windows\System\iisLOgG.exe
  C:\Windows\System\iisLOgG.exe
  2⤵
  PID:9536
- C:\Windows\System\bxdbgMG.exe
  C:\Windows\System\bxdbgMG.exe
  2⤵
  PID:7072
- C:\Windows\System\tOmqVEb.exe
  C:\Windows\System\tOmqVEb.exe
  2⤵
  PID:10036
- C:\Windows\System\WqnbRbp.exe
  C:\Windows\System\WqnbRbp.exe
  2⤵
  PID:8656
- C:\Windows\System\LVhKQZx.exe
  C:\Windows\System\LVhKQZx.exe
  2⤵
  PID:12300
- C:\Windows\System\MwvCwQk.exe
  C:\Windows\System\MwvCwQk.exe
  2⤵
  PID:12320
- C:\Windows\System\ZDOqRIU.exe
  C:\Windows\System\ZDOqRIU.exe
  2⤵
  PID:12348
- C:\Windows\System\QLCptAr.exe
  C:\Windows\System\QLCptAr.exe
  2⤵
  PID:12376
- C:\Windows\System\eGXCKdP.exe
  C:\Windows\System\eGXCKdP.exe
  2⤵
  PID:12392
- C:\Windows\System\rddKXtq.exe
  C:\Windows\System\rddKXtq.exe
  2⤵
  PID:12416
- C:\Windows\System\FDtmHsh.exe
  C:\Windows\System\FDtmHsh.exe
  2⤵
  PID:12440
- C:\Windows\System\lnSebyW.exe
  C:\Windows\System\lnSebyW.exe
  2⤵
  PID:12464
- C:\Windows\System\NFfnvFj.exe
  C:\Windows\System\NFfnvFj.exe
  2⤵
  PID:12492
- C:\Windows\System\FpcDXgD.exe
  C:\Windows\System\FpcDXgD.exe
  2⤵
  PID:12512
- C:\Windows\System\mPUfnVp.exe
  C:\Windows\System\mPUfnVp.exe
  2⤵
  PID:12532
- C:\Windows\System\JJyBABY.exe
  C:\Windows\System\JJyBABY.exe
  2⤵
  PID:12560
- C:\Windows\System\zXPfjAQ.exe
  C:\Windows\System\zXPfjAQ.exe
  2⤵
  PID:12580
- C:\Windows\System\jwtkzQO.exe
  C:\Windows\System\jwtkzQO.exe
  2⤵
  PID:12604
- C:\Windows\System\AUbTIMr.exe
  C:\Windows\System\AUbTIMr.exe
  2⤵
  PID:12624
- C:\Windows\System\bVIersO.exe
  C:\Windows\System\bVIersO.exe
  2⤵
  PID:12648
- C:\Windows\System\qCnsOHf.exe
  C:\Windows\System\qCnsOHf.exe
  2⤵
  PID:12672
- C:\Windows\System\dwgCNdn.exe
  C:\Windows\System\dwgCNdn.exe
  2⤵
  PID:12688
- C:\Windows\System\oTajVRi.exe
  C:\Windows\System\oTajVRi.exe
  2⤵
  PID:12720
- C:\Windows\System\EFLhzcc.exe
  C:\Windows\System\EFLhzcc.exe
  2⤵
  PID:12740
- C:\Windows\System\rHtqyfW.exe
  C:\Windows\System\rHtqyfW.exe
  2⤵
  PID:12760
- C:\Windows\System\HZnboEz.exe
  C:\Windows\System\HZnboEz.exe
  2⤵
  PID:12780
- C:\Windows\System\sUgAaRT.exe
  C:\Windows\System\sUgAaRT.exe
  2⤵
  PID:12804
- C:\Windows\System\tbZWZWh.exe
  C:\Windows\System\tbZWZWh.exe
  2⤵
  PID:12828
- C:\Windows\System\TSbnbPg.exe
  C:\Windows\System\TSbnbPg.exe
  2⤵
  PID:12848
- C:\Windows\System\GvqArqo.exe
  C:\Windows\System\GvqArqo.exe
  2⤵
  PID:12872
- C:\Windows\System\tppCQeA.exe
  C:\Windows\System\tppCQeA.exe
  2⤵
  PID:12896
- C:\Windows\System\cyggymC.exe
  C:\Windows\System\cyggymC.exe
  2⤵
  PID:12912
- C:\Windows\System\bEZAQlf.exe
  C:\Windows\System\bEZAQlf.exe
  2⤵
  PID:12928
- C:\Windows\System\dsxCuvc.exe
  C:\Windows\System\dsxCuvc.exe
  2⤵
  PID:12944
- C:\Windows\System\htHSxdL.exe
  C:\Windows\System\htHSxdL.exe
  2⤵
  PID:12964
- C:\Windows\System\fVBxzMV.exe
  C:\Windows\System\fVBxzMV.exe
  2⤵
  PID:12980
- C:\Windows\System\vXhOSmN.exe
  C:\Windows\System\vXhOSmN.exe
  2⤵
  PID:12996
- C:\Windows\System\cbynkiw.exe
  C:\Windows\System\cbynkiw.exe
  2⤵
  PID:13016
- C:\Windows\System\SXggdYT.exe
  C:\Windows\System\SXggdYT.exe
  2⤵
  PID:13032
- C:\Windows\System\WUSnGVc.exe
  C:\Windows\System\WUSnGVc.exe
  2⤵
  PID:13048
- C:\Windows\System\lhheoIN.exe
  C:\Windows\System\lhheoIN.exe
  2⤵
  PID:13064
- C:\Windows\System\lnffFcu.exe
  C:\Windows\System\lnffFcu.exe
  2⤵
  PID:13088
- C:\Windows\System\xCRkPgU.exe
  C:\Windows\System\xCRkPgU.exe
  2⤵
  PID:13112
- C:\Windows\System\qCtBrHb.exe
  C:\Windows\System\qCtBrHb.exe
  2⤵
  PID:13132
- C:\Windows\System\OSbaMwK.exe
  C:\Windows\System\OSbaMwK.exe
  2⤵
  PID:13152
- C:\Windows\System\fMJPftn.exe
  C:\Windows\System\fMJPftn.exe
  2⤵
  PID:13180
- C:\Windows\System\AaDNgty.exe
  C:\Windows\System\AaDNgty.exe
  2⤵
  PID:13200
- C:\Windows\System\oNYYwZq.exe
  C:\Windows\System\oNYYwZq.exe
  2⤵
  PID:13224
- C:\Windows\System\cNJcAjA.exe
  C:\Windows\System\cNJcAjA.exe
  2⤵
  PID:13252
- C:\Windows\System\rRJtbLg.exe
  C:\Windows\System\rRJtbLg.exe
  2⤵
  PID:13272
- C:\Windows\System\QaOxuOP.exe
  C:\Windows\System\QaOxuOP.exe
  2⤵
  PID:13296
- C:\Windows\System\OEpYqqq.exe
  C:\Windows\System\OEpYqqq.exe
  2⤵
  PID:8412
- C:\Windows\System\FjxuqpT.exe
  C:\Windows\System\FjxuqpT.exe
  2⤵
  PID:10884
- C:\Windows\System\xdbsogs.exe
  C:\Windows\System\xdbsogs.exe
  2⤵
  PID:9032
- C:\Windows\System\ZuURQpa.exe
  C:\Windows\System\ZuURQpa.exe
  2⤵
  PID:7756
- C:\Windows\System\BoGfOKi.exe
  C:\Windows\System\BoGfOKi.exe
  2⤵
  PID:10204
- C:\Windows\System\sOTjCYh.exe
  C:\Windows\System\sOTjCYh.exe
  2⤵
  PID:10696
- C:\Windows\System\ZgCidHC.exe
  C:\Windows\System\ZgCidHC.exe
  2⤵
  PID:8472
- C:\Windows\System\fGskOSK.exe
  C:\Windows\System\fGskOSK.exe
  2⤵
  PID:10964
- C:\Windows\System\fjgsQGT.exe
  C:\Windows\System\fjgsQGT.exe
  2⤵
  PID:10840
- C:\Windows\System\VNqGbGr.exe
  C:\Windows\System\VNqGbGr.exe
  2⤵
  PID:8996
- C:\Windows\System\YKaISix.exe
  C:\Windows\System\YKaISix.exe
  2⤵
  PID:11292
- C:\Windows\System\hxrEqdm.exe
  C:\Windows\System\hxrEqdm.exe
  2⤵
  PID:11460
- C:\Windows\System\ikboHaG.exe
  C:\Windows\System\ikboHaG.exe
  2⤵
  PID:11496
- C:\Windows\System\oCORPQt.exe
  C:\Windows\System\oCORPQt.exe
  2⤵
  PID:12656
- C:\Windows\System\ywmIdkA.exe
  C:\Windows\System\ywmIdkA.exe
  2⤵
  PID:10460
- C:\Windows\System\gAChzHY.exe
  C:\Windows\System\gAChzHY.exe
  2⤵
  PID:12728
- C:\Windows\System\kmWCGse.exe
  C:\Windows\System\kmWCGse.exe
  2⤵
  PID:7732
- C:\Windows\System\ZTbQjBX.exe
  C:\Windows\System\ZTbQjBX.exe
  2⤵
  PID:12800
- C:\Windows\System\oZEtbvi.exe
  C:\Windows\System\oZEtbvi.exe
  2⤵
  PID:12868
- C:\Windows\System\fWeFRbE.exe
  C:\Windows\System\fWeFRbE.exe
  2⤵
  PID:13040
- C:\Windows\System\xtEesSa.exe
  C:\Windows\System\xtEesSa.exe
  2⤵
  PID:13084
- C:\Windows\System\YLEDxLn.exe
  C:\Windows\System\YLEDxLn.exe
  2⤵
  PID:13124
- C:\Windows\System\qEBYISg.exe
  C:\Windows\System\qEBYISg.exe
  2⤵
  PID:13216
- C:\Windows\System\XymKItW.exe
  C:\Windows\System\XymKItW.exe
  2⤵
  PID:11536
- C:\Windows\System\DuhMBNi.exe
  C:\Windows\System\DuhMBNi.exe
  2⤵
  PID:11808
- C:\Windows\System\SFVfORb.exe
  C:\Windows\System\SFVfORb.exe
  2⤵
  PID:11152
- C:\Windows\System\bwANpcp.exe
  C:\Windows\System\bwANpcp.exe
  2⤵
  PID:11204
- C:\Windows\System\SnvklHS.exe
  C:\Windows\System\SnvklHS.exe
  2⤵
  PID:9760
- C:\Windows\System\jESCSdY.exe
  C:\Windows\System\jESCSdY.exe
  2⤵
  PID:7316
- C:\Windows\System\iJBrAVQ.exe
  C:\Windows\System\iJBrAVQ.exe
  2⤵
  PID:11260
- C:\Windows\System\qvGAqVp.exe
  C:\Windows\System\qvGAqVp.exe
  2⤵
  PID:10104
- C:\Windows\System\Tceeiak.exe
  C:\Windows\System\Tceeiak.exe
  2⤵
  PID:9648
- C:\Windows\System\GXKoOWm.exe
  C:\Windows\System\GXKoOWm.exe
  2⤵
  PID:12504
- C:\Windows\System\lRBZyLR.exe
  C:\Windows\System\lRBZyLR.exe
  2⤵
  PID:12812
- C:\Windows\System\hCEwRAb.exe
  C:\Windows\System\hCEwRAb.exe
  2⤵
  PID:11372
- C:\Windows\System\SmIDqGW.exe
  C:\Windows\System\SmIDqGW.exe
  2⤵
  PID:11524
- C:\Windows\System\tzTRABw.exe
  C:\Windows\System\tzTRABw.exe
  2⤵
  PID:11652
- C:\Windows\System\arrDRjY.exe
  C:\Windows\System\arrDRjY.exe
  2⤵
  PID:11720
- C:\Windows\System\FycMotI.exe
  C:\Windows\System\FycMotI.exe
  2⤵
  PID:11756
- C:\Windows\System\nkytyXZ.exe
  C:\Windows\System\nkytyXZ.exe
  2⤵
  PID:11816
- C:\Windows\System\pYegICr.exe
  C:\Windows\System\pYegICr.exe
  2⤵
  PID:11924
- C:\Windows\System\XSeMmaN.exe
  C:\Windows\System\XSeMmaN.exe
  2⤵
  PID:13372
- C:\Windows\System\evPRXft.exe
  C:\Windows\System\evPRXft.exe
  2⤵
  PID:12140
- C:\Windows\System\gLTrQxt.exe
  C:\Windows\System\gLTrQxt.exe
  2⤵
  PID:12248
- C:\Windows\System\PBuTuJl.exe
  C:\Windows\System\PBuTuJl.exe
  2⤵
  PID:13476
- C:\Windows\System\lFDRGdA.exe
  C:\Windows\System\lFDRGdA.exe
  2⤵
  PID:12960
- C:\Windows\System\qLUfrbG.exe
  C:\Windows\System\qLUfrbG.exe
  2⤵
  PID:13192
- C:\Windows\System\blNhcGK.exe
  C:\Windows\System\blNhcGK.exe
  2⤵
  PID:13292
- C:\Windows\System\NGnNLGE.exe
  C:\Windows\System\NGnNLGE.exe
  2⤵
  PID:8904
- C:\Windows\System\rOqPKqW.exe
  C:\Windows\System\rOqPKqW.exe
  2⤵
  PID:8244
- C:\Windows\System\NSgzSKq.exe
  C:\Windows\System\NSgzSKq.exe
  2⤵
  PID:11064
- C:\Windows\System\zxnleHT.exe
  C:\Windows\System\zxnleHT.exe
  2⤵
  PID:13324
- C:\Windows\System\KEAPLuK.exe
  C:\Windows\System\KEAPLuK.exe
  2⤵
  PID:13436
- C:\Windows\System\quSqvgk.exe
  C:\Windows\System\quSqvgk.exe
  2⤵
  PID:13472
- C:\Windows\System\FjGyJat.exe
  C:\Windows\System\FjGyJat.exe
  2⤵
  PID:13508
- C:\Windows\System\CKujCqu.exe
  C:\Windows\System\CKujCqu.exe
  2⤵
  PID:13856
- C:\Windows\System\CUqUTUk.exe
  C:\Windows\System\CUqUTUk.exe
  2⤵
  PID:13776
- C:\Windows\System\Mgwtclg.exe
  C:\Windows\System\Mgwtclg.exe
  2⤵
  PID:14292
- C:\Windows\System\nWNgpJK.exe
  C:\Windows\System\nWNgpJK.exe
  2⤵
  PID:9872
- C:\Windows\System\oChqKuV.exe
  C:\Windows\System\oChqKuV.exe
  2⤵
  PID:10812
- C:\Windows\System\ZHKBPeu.exe
  C:\Windows\System\ZHKBPeu.exe
  2⤵
  PID:8628
- C:\Windows\System\xPrQJCW.exe
  C:\Windows\System\xPrQJCW.exe
  2⤵
  PID:12436
- C:\Windows\System\dncufBv.exe
  C:\Windows\System\dncufBv.exe
  2⤵
  PID:14112
- C:\Windows\System\IfFGagQ.exe
  C:\Windows\System\IfFGagQ.exe
  2⤵
  PID:13104
- C:\Windows\System\jLcwfSQ.exe
  C:\Windows\System\jLcwfSQ.exe
  2⤵
  PID:8560
- C:\Windows\System\zQhZALo.exe
  C:\Windows\System\zQhZALo.exe
  2⤵
  PID:11212
- C:\Windows\System\FITiKWF.exe
  C:\Windows\System\FITiKWF.exe
  2⤵
  PID:8384
- C:\Windows\System\FbopMKj.exe
  C:\Windows\System\FbopMKj.exe
  2⤵
  PID:11616
- C:\Windows\System\XVgzVks.exe
  C:\Windows\System\XVgzVks.exe
  2⤵
  PID:11784
- C:\Windows\System\rLZLNSn.exe
  C:\Windows\System\rLZLNSn.exe
  2⤵
  PID:12316
- C:\Windows\System\tcFpiiD.exe
  C:\Windows\System\tcFpiiD.exe
  2⤵
  PID:12412
- C:\Windows\System\gBvVJeH.exe
  C:\Windows\System\gBvVJeH.exe
  2⤵
  PID:10612
- C:\Windows\System\NUSZxls.exe
  C:\Windows\System\NUSZxls.exe
  2⤵
  PID:12680
- C:\Windows\System\HmRWcGo.exe
  C:\Windows\System\HmRWcGo.exe
  2⤵
  PID:12908
- C:\Windows\System\TSHbEph.exe
  C:\Windows\System\TSHbEph.exe
  2⤵
  PID:5100
- C:\Windows\System\SXBjCjw.exe
  C:\Windows\System\SXBjCjw.exe
  2⤵
  PID:12180
- C:\Windows\System\egqdBSM.exe
  C:\Windows\System\egqdBSM.exe
  2⤵
  PID:13892
- C:\Windows\System\thDdsZS.exe
  C:\Windows\System\thDdsZS.exe
  2⤵
  PID:13624
- C:\Windows\System\FFLBQlS.exe
  C:\Windows\System\FFLBQlS.exe
  2⤵
  PID:11288
- C:\Windows\System\wPMjuhL.exe
  C:\Windows\System\wPMjuhL.exe
  2⤵
  PID:10624
- C:\Windows\System\keNSdjL.exe
  C:\Windows\System\keNSdjL.exe
  2⤵
  PID:13816
- C:\Windows\System\HEzLAXt.exe
  C:\Windows\System\HEzLAXt.exe
  2⤵
  PID:12796
- C:\Windows\System\OpbdQfn.exe
  C:\Windows\System\OpbdQfn.exe
  2⤵
  PID:7844
- C:\Windows\System\AVfoZXz.exe
  C:\Windows\System\AVfoZXz.exe
  2⤵
  PID:13820
- C:\Windows\System\KMpcpTy.exe
  C:\Windows\System\KMpcpTy.exe
  2⤵
  PID:13728
- C:\Windows\System\nsJUotU.exe
  C:\Windows\System\nsJUotU.exe
  2⤵
  PID:14008
- C:\Windows\System\XRTREZG.exe
  C:\Windows\System\XRTREZG.exe
  2⤵
  PID:11612
- C:\Windows\System\AiciioU.exe
  C:\Windows\System\AiciioU.exe
  2⤵
  PID:13772
- C:\Windows\System\iAIWKPq.exe
  C:\Windows\System\iAIWKPq.exe
  2⤵
  PID:11952
- C:\Windows\System\PREnNQe.exe
  C:\Windows\System\PREnNQe.exe
  2⤵
  PID:13884
- C:\Windows\System\YJiSDLL.exe
  C:\Windows\System\YJiSDLL.exe
  2⤵
  PID:13208
- C:\Windows\System\HkaprPU.exe
  C:\Windows\System\HkaprPU.exe
  2⤵
  PID:11812
- C:\Windows\System\iViGCzW.exe
  C:\Windows\System\iViGCzW.exe
  2⤵
  PID:7196
- C:\Windows\System\RMQLjFq.exe
  C:\Windows\System\RMQLjFq.exe
  2⤵
  PID:12820
- C:\Windows\System\VncfFIC.exe
  C:\Windows\System\VncfFIC.exe
  2⤵
  PID:13260
- C:\Windows\System\gpTCAVt.exe
  C:\Windows\System\gpTCAVt.exe
  2⤵
  PID:11880
- C:\Windows\System\WUWoYob.exe
  C:\Windows\System\WUWoYob.exe
  2⤵
  PID:13416
- C:\Windows\System\rkGDNzd.exe
  C:\Windows\System\rkGDNzd.exe
  2⤵
  PID:13588
- C:\Windows\System\dpQWbnR.exe
  C:\Windows\System\dpQWbnR.exe
  2⤵
  PID:13904
- C:\Windows\System\GLoLmjo.exe
  C:\Windows\System\GLoLmjo.exe
  2⤵
  PID:12592
- C:\Windows\System\uzkWkdZ.exe
  C:\Windows\System\uzkWkdZ.exe
  2⤵
  PID:9620
- C:\Windows\System\HpHHftM.exe
  C:\Windows\System\HpHHftM.exe
  2⤵
  PID:11736
- C:\Windows\System\UaSOIgr.exe
  C:\Windows\System\UaSOIgr.exe
  2⤵
  PID:10720
- C:\Windows\System\KzIEfZp.exe
  C:\Windows\System\KzIEfZp.exe
  2⤵
  PID:5028
- C:\Windows\System\mSWjMqC.exe
  C:\Windows\System\mSWjMqC.exe
  2⤵
  PID:3124
- C:\Windows\System\EzmQuXk.exe
  C:\Windows\System\EzmQuXk.exe
  2⤵
  PID:14256
- C:\Windows\System\YJPZWYn.exe
  C:\Windows\System\YJPZWYn.exe
  2⤵
  PID:13024
- C:\Windows\System\ElEEtpb.exe
  C:\Windows\System\ElEEtpb.exe
  2⤵
  PID:2428
- C:\Windows\System\tPnTUNd.exe
  C:\Windows\System\tPnTUNd.exe
  2⤵
  PID:13732
- C:\Windows\System\dSPETKl.exe
  C:\Windows\System\dSPETKl.exe
  2⤵
  PID:11092
- C:\Windows\System\bvfysLv.exe
  C:\Windows\System\bvfysLv.exe
  2⤵
  PID:9208
- C:\Windows\System\zLJkpHx.exe
  C:\Windows\System\zLJkpHx.exe
  2⤵
  PID:11604
- C:\Windows\System\qlbdqjm.exe
  C:\Windows\System\qlbdqjm.exe
  2⤵
  PID:7256
- C:\Windows\System\QzfyQjY.exe
  C:\Windows\System\QzfyQjY.exe
  2⤵
  PID:10020
- C:\Windows\System\NtolSEP.exe
  C:\Windows\System\NtolSEP.exe
  2⤵
  PID:13404
- C:\Windows\System\ZSXrDmx.exe
  C:\Windows\System\ZSXrDmx.exe
  2⤵
  PID:14104
- C:\Windows\System\XbdGBpb.exe
  C:\Windows\System\XbdGBpb.exe
  2⤵
  PID:13356
- C:\Windows\System\CeJpIUZ.exe
  C:\Windows\System\CeJpIUZ.exe
  2⤵
  PID:12136
- C:\Windows\System\FnRUTNM.exe
  C:\Windows\System\FnRUTNM.exe
  2⤵
  PID:4784
- C:\Windows\System\TTsdqPN.exe
  C:\Windows\System\TTsdqPN.exe
  2⤵
  PID:4460
- C:\Windows\System\evRZVOp.exe
  C:\Windows\System\evRZVOp.exe
  2⤵
  PID:4916
- C:\Windows\System\QPQdYfl.exe
  C:\Windows\System\QPQdYfl.exe
  2⤵
  PID:13888
- C:\Windows\System\rLvwxDT.exe
  C:\Windows\System\rLvwxDT.exe
  2⤵
  PID:13076
- C:\Windows\System\EnkEJxa.exe
  C:\Windows\System\EnkEJxa.exe
  2⤵
  PID:1196
- C:\Windows\System\kjjaEsQ.exe
  C:\Windows\System\kjjaEsQ.exe
  2⤵
  PID:13352
- C:\Windows\System\OoSKqxJ.exe
  C:\Windows\System\OoSKqxJ.exe
  2⤵
  PID:2388
- C:\Windows\System\xvJqTgi.exe
  C:\Windows\System\xvJqTgi.exe
  2⤵
  PID:3968
- C:\Windows\System\HOZIwea.exe
  C:\Windows\System\HOZIwea.exe
  2⤵
  PID:2964
- C:\Windows\System\nERimfr.exe
  C:\Windows\System\nERimfr.exe
  2⤵
  PID:464
- C:\Windows\System\rKfzirR.exe
  C:\Windows\System\rKfzirR.exe
  2⤵
  PID:13484
- C:\Windows\System\sMARIHj.exe
  C:\Windows\System\sMARIHj.exe
  2⤵
  PID:2568
- C:\Windows\System\yqpnnuE.exe
  C:\Windows\System\yqpnnuE.exe
  2⤵
  PID:3052
- C:\Windows\System\hgSvpKH.exe
  C:\Windows\System\hgSvpKH.exe
  2⤵
  PID:632
- C:\Windows\System\qzNIlrq.exe
  C:\Windows\System\qzNIlrq.exe
  2⤵
  PID:10692
- C:\Windows\System\FijbZrn.exe
  C:\Windows\System\FijbZrn.exe
  2⤵
  PID:14180
- C:\Windows\System\okbYsqb.exe
  C:\Windows\System\okbYsqb.exe
  2⤵
  PID:2752
- C:\Windows\System\JroqpQV.exe
  C:\Windows\System\JroqpQV.exe
  2⤵
  PID:4308
- C:\Windows\System\VlfOVvh.exe
  C:\Windows\System\VlfOVvh.exe
  2⤵
  PID:4896
- C:\Windows\System\kUttdao.exe
  C:\Windows\System\kUttdao.exe
  2⤵
  PID:12500
- C:\Windows\System\AvgYcXo.exe
  C:\Windows\System\AvgYcXo.exe
  2⤵
  PID:12788
- C:\Windows\System\TZHAcqs.exe
  C:\Windows\System\TZHAcqs.exe
  2⤵
  PID:13780
- C:\Windows\System\VjyaMQQ.exe
  C:\Windows\System\VjyaMQQ.exe
  2⤵
  PID:4440
- C:\Windows\System\bUpnCuC.exe
  C:\Windows\System\bUpnCuC.exe
  2⤵
  PID:6972
- C:\Windows\System\gaYKwYR.exe
  C:\Windows\System\gaYKwYR.exe
  2⤵
  PID:3948
- C:\Windows\System\MhKonNA.exe
  C:\Windows\System\MhKonNA.exe
  2⤵
  PID:3556
- C:\Windows\System\ZFDunNI.exe
  C:\Windows\System\ZFDunNI.exe
  2⤵
  PID:1448
- C:\Windows\System\LPkEZJq.exe
  C:\Windows\System\LPkEZJq.exe
  2⤵
  PID:2656
- C:\Windows\System\BeVRxvQ.exe
  C:\Windows\System\BeVRxvQ.exe
  2⤵
  PID:10972
- C:\Windows\System\cRTLifg.exe
  C:\Windows\System\cRTLifg.exe
  2⤵
  PID:3700
- C:\Windows\System\sOVWaSo.exe
  C:\Windows\System\sOVWaSo.exe
  2⤵
  PID:4144
- C:\Windows\System\mSJHVPt.exe
  C:\Windows\System\mSJHVPt.exe
  2⤵
  PID:2808
- C:\Windows\System\XufgoCJ.exe
  C:\Windows\System\XufgoCJ.exe
  2⤵
  PID:5060
- C:\Windows\System\SxwaAlK.exe
  C:\Windows\System\SxwaAlK.exe
  2⤵
  PID:3628
- C:\Windows\System\edSLVUW.exe
  C:\Windows\System\edSLVUW.exe
  2⤵
  PID:3624
- C:\Windows\System\JVxMweN.exe
  C:\Windows\System\JVxMweN.exe
  2⤵
  PID:3268
- C:\Windows\System\OXnwzfk.exe
  C:\Windows\System\OXnwzfk.exe
  2⤵
  PID:4256
- C:\Windows\System\jlZVtRf.exe
  C:\Windows\System\jlZVtRf.exe
  2⤵
  PID:10740
- C:\Windows\System\zgxXQkf.exe
  C:\Windows\System\zgxXQkf.exe
  2⤵
  PID:13592
- C:\Windows\System\yEOpCXm.exe
  C:\Windows\System\yEOpCXm.exe
  2⤵
  PID:456
- C:\Windows\System\XFqcIbl.exe
  C:\Windows\System\XFqcIbl.exe
  2⤵
  PID:3996
- C:\Windows\System\VYjrrAW.exe
  C:\Windows\System\VYjrrAW.exe
  2⤵
  PID:2312
- C:\Windows\System\PeaoNee.exe
  C:\Windows\System\PeaoNee.exe
  2⤵
  PID:4708
- C:\Windows\System\lHuaQje.exe
  C:\Windows\System\lHuaQje.exe
  2⤵
  PID:4476
- C:\Windows\System\LoqXyEu.exe
  C:\Windows\System\LoqXyEu.exe
  2⤵
  PID:1568
- C:\Windows\System\cHLaEhJ.exe
  C:\Windows\System\cHLaEhJ.exe
  2⤵
  PID:548
- C:\Windows\System\TWtcmAN.exe
  C:\Windows\System\TWtcmAN.exe
  2⤵
  PID:936
- C:\Windows\System\zWImnkB.exe
  C:\Windows\System\zWImnkB.exe
  2⤵
  PID:832
- C:\Windows\System\VxaKhwc.exe
  C:\Windows\System\VxaKhwc.exe
  2⤵
  PID:3956
- C:\Windows\System\NXgGVIu.exe
  C:\Windows\System\NXgGVIu.exe
  2⤵
  PID:14248
- C:\Windows\System\yePazqu.exe
  C:\Windows\System\yePazqu.exe
  2⤵
  PID:3220
- C:\Windows\System\HNyFjaI.exe
  C:\Windows\System\HNyFjaI.exe
  2⤵
  PID:1808
- C:\Windows\System\nBcUqlR.exe
  C:\Windows\System\nBcUqlR.exe
  2⤵
  PID:4488
- C:\Windows\System\ClAzQhh.exe
  C:\Windows\System\ClAzQhh.exe
  2⤵
  PID:4720
- C:\Windows\System\TaLNodb.exe
  C:\Windows\System\TaLNodb.exe
  2⤵
  PID:4952
- C:\Windows\System\VlMyEXp.exe
  C:\Windows\System\VlMyEXp.exe
  2⤵
  PID:868
- C:\Windows\System\mejyMiK.exe
  C:\Windows\System\mejyMiK.exe
  2⤵
  PID:4276
- C:\Windows\System\HRsfNsz.exe
  C:\Windows\System\HRsfNsz.exe
  2⤵
  PID:4260
- C:\Windows\System\LGrViWs.exe
  C:\Windows\System\LGrViWs.exe
  2⤵
  PID:1084
- C:\Windows\System\zoQOJck.exe
  C:\Windows\System\zoQOJck.exe
  2⤵
  PID:764
- C:\Windows\System\mpkGhDJ.exe
  C:\Windows\System\mpkGhDJ.exe
  2⤵
  PID:4240
- C:\Windows\System\yQtaAjq.exe
  C:\Windows\System\yQtaAjq.exe
  2⤵
  PID:3196
- C:\Windows\System\wvNCgmI.exe
  C:\Windows\System\wvNCgmI.exe
  2⤵
  PID:5020
- C:\Windows\System\eBtpCUe.exe
  C:\Windows\System\eBtpCUe.exe
  2⤵
  PID:9692
- C:\Windows\System\iupDpGZ.exe
  C:\Windows\System\iupDpGZ.exe
  2⤵
  PID:9276
- C:\Windows\System\wCpgFEN.exe
  C:\Windows\System\wCpgFEN.exe
  2⤵
  PID:2348
- C:\Windows\System\uYsVUSo.exe
  C:\Windows\System\uYsVUSo.exe
  2⤵
  PID:4168
- C:\Windows\System\QMlmojx.exe
  C:\Windows\System\QMlmojx.exe
  2⤵
  PID:7944
- C:\Windows\System\pbHcAVm.exe
  C:\Windows\System\pbHcAVm.exe
  2⤵
  PID:8340
- C:\Windows\System\XxKSSyD.exe
  C:\Windows\System\XxKSSyD.exe
  2⤵
  PID:6476
- C:\Windows\System\GeWDUAd.exe
  C:\Windows\System\GeWDUAd.exe
  2⤵
  PID:8660
- C:\Windows\System\qpWAlBx.exe
  C:\Windows\System\qpWAlBx.exe
  2⤵
  PID:1576
- C:\Windows\System\VIGYBqm.exe
  C:\Windows\System\VIGYBqm.exe
  2⤵
  PID:9400
- C:\Windows\System\owrahkX.exe
  C:\Windows\System\owrahkX.exe
  2⤵
  PID:4584
- C:\Windows\System\thAeeoo.exe
  C:\Windows\System\thAeeoo.exe
  2⤵
  PID:316
- C:\Windows\System\iPpAgnK.exe
  C:\Windows\System\iPpAgnK.exe
  2⤵
  PID:9036
- C:\Windows\System\CHHFzlU.exe
  C:\Windows\System\CHHFzlU.exe
  2⤵
  PID:636
- C:\Windows\System\dBWihyB.exe
  C:\Windows\System\dBWihyB.exe
  2⤵
  PID:8476
- C:\Windows\System\VuvXbqV.exe
  C:\Windows\System\VuvXbqV.exe
  2⤵
  PID:13432
- C:\Windows\System\qdJqwfP.exe
  C:\Windows\System\qdJqwfP.exe
  2⤵
  PID:2536
- C:\Windows\System\VpaFmfu.exe
  C:\Windows\System\VpaFmfu.exe
  2⤵
  PID:4132
- C:\Windows\System\CSjDiQM.exe
  C:\Windows\System\CSjDiQM.exe
  2⤵
  PID:3524
- C:\Windows\System\pLNCJQG.exe
  C:\Windows\System\pLNCJQG.exe
  2⤵
  PID:2132
- C:\Windows\System\ABzcxhV.exe
  C:\Windows\System\ABzcxhV.exe
  2⤵
  PID:2944
- C:\Windows\System\MGeJduk.exe
  C:\Windows\System\MGeJduk.exe
  2⤵
  PID:4732
- C:\Windows\System\mIRVMZR.exe
  C:\Windows\System\mIRVMZR.exe
  2⤵
  PID:4380
- C:\Windows\System\MBQNKYo.exe
  C:\Windows\System\MBQNKYo.exe
  2⤵
  PID:5068
- C:\Windows\System\bjJawdB.exe
  C:\Windows\System\bjJawdB.exe
  2⤵
  PID:1172
- C:\Windows\System\hckidoP.exe
  C:\Windows\System\hckidoP.exe
  2⤵
  PID:4080
- C:\Windows\System\MgqBLqV.exe
  C:\Windows\System\MgqBLqV.exe
  2⤵
  PID:2036
- C:\Windows\System\gEaXhnl.exe
  C:\Windows\System\gEaXhnl.exe
  2⤵
  PID:10724
- C:\Windows\System\HufJSZb.exe
  C:\Windows\System\HufJSZb.exe
  2⤵
  PID:8596
- C:\Windows\System\OGNNhiY.exe
  C:\Windows\System\OGNNhiY.exe
  2⤵
  PID:8328
- C:\Windows\System\AaVyTxE.exe
  C:\Windows\System\AaVyTxE.exe
  2⤵
  PID:5076
- C:\Windows\System\KvcyUHa.exe
  C:\Windows\System\KvcyUHa.exe
  2⤵
  PID:10608
- C:\Windows\System\ZJPRfPL.exe
  C:\Windows\System\ZJPRfPL.exe
  2⤵
  PID:6452
- C:\Windows\System\gwZXOHQ.exe
  C:\Windows\System\gwZXOHQ.exe
  2⤵
  PID:3544
- C:\Windows\System\qgliENf.exe
  C:\Windows\System\qgliENf.exe
  2⤵
  PID:432
- C:\Windows\System\TgfBWXl.exe
  C:\Windows\System\TgfBWXl.exe
  2⤵
  PID:2908
- C:\Windows\System\ccQzzeU.exe
  C:\Windows\System\ccQzzeU.exe
  2⤵
  PID:4204
- C:\Windows\System\ibdFjHf.exe
  C:\Windows\System\ibdFjHf.exe
  2⤵
  PID:540
- C:\Windows\System\PevHcYS.exe
  C:\Windows\System\PevHcYS.exe
  2⤵
  PID:10008
- C:\Windows\System\MyMSJVm.exe
  C:\Windows\System\MyMSJVm.exe
  2⤵
  PID:3584
- C:\Windows\System\fzByXtm.exe
  C:\Windows\System\fzByXtm.exe
  2⤵
  PID:4140
- C:\Windows\System\fGfftoe.exe
  C:\Windows\System\fGfftoe.exe
  2⤵
  PID:3704
- C:\Windows\System\zBQuloo.exe
  C:\Windows\System\zBQuloo.exe
  2⤵
  PID:4984
- C:\Windows\System\LFqEqeu.exe
  C:\Windows\System\LFqEqeu.exe
  2⤵
  PID:8748
- C:\Windows\System\yliGLxx.exe
  C:\Windows\System\yliGLxx.exe
  2⤵
  PID:1120
- C:\Windows\System\jjowppu.exe
  C:\Windows\System\jjowppu.exe
  2⤵
  PID:5476
- C:\Windows\System\NrNjsWd.exe
  C:\Windows\System\NrNjsWd.exe
  2⤵
  PID:5284
- C:\Windows\System\GwolFlZ.exe
  C:\Windows\System\GwolFlZ.exe
  2⤵
  PID:5412
- C:\Windows\System\tdCsOhX.exe
  C:\Windows\System\tdCsOhX.exe
  2⤵
  PID:2556
- C:\Windows\System\SSxATBt.exe
  C:\Windows\System\SSxATBt.exe
  2⤵
  PID:13932
- C:\Windows\System\gQlpJTm.exe
  C:\Windows\System\gQlpJTm.exe
  2⤵
  PID:2492
- C:\Windows\System\siUWVLz.exe
  C:\Windows\System\siUWVLz.exe
  2⤵
  PID:4632
- C:\Windows\System\ZUldZQj.exe
  C:\Windows\System\ZUldZQj.exe
  2⤵
  PID:5744
- C:\Windows\System\qQDTrzW.exe
  C:\Windows\System\qQDTrzW.exe
  2⤵
  PID:5332
- C:\Windows\System\ZlEvtrq.exe
  C:\Windows\System\ZlEvtrq.exe
  2⤵
  PID:3440
- C:\Windows\System\WsVVoOh.exe
  C:\Windows\System\WsVVoOh.exe
  2⤵
  PID:4464
- C:\Windows\System\ecFRzes.exe
  C:\Windows\System\ecFRzes.exe
  2⤵
  PID:4100
- C:\Windows\System\zbuMdkI.exe
  C:\Windows\System\zbuMdkI.exe
  2⤵
  PID:6004
- C:\Windows\System\lPGafty.exe
  C:\Windows\System\lPGafty.exe
  2⤵
  PID:6032
- C:\Windows\System\iFmqiMy.exe
  C:\Windows\System\iFmqiMy.exe
  2⤵
  PID:5864
- C:\Windows\System\gHygqOI.exe
  C:\Windows\System\gHygqOI.exe
  2⤵
  PID:5212
- C:\Windows\System\RjvdbeR.exe
  C:\Windows\System\RjvdbeR.exe
  2⤵
  PID:3004
- C:\Windows\System\nzhyOkd.exe
  C:\Windows\System\nzhyOkd.exe
  2⤵
  PID:5896
- C:\Windows\System\MAakUwZ.exe
  C:\Windows\System\MAakUwZ.exe
  2⤵
  PID:5932
- C:\Windows\System\fLpQUBF.exe
  C:\Windows\System\fLpQUBF.exe
  2⤵
  PID:5512
- C:\Windows\System\VOPnlIR.exe
  C:\Windows\System\VOPnlIR.exe
  2⤵
  PID:2300
- C:\Windows\System\mkUhuln.exe
  C:\Windows\System\mkUhuln.exe
  2⤵
  PID:6024
- C:\Windows\System\FhjcChx.exe
  C:\Windows\System\FhjcChx.exe
  2⤵
  PID:6188
- C:\Windows\System\YMmxwJq.exe
  C:\Windows\System\YMmxwJq.exe
  2⤵
  PID:6312
- C:\Windows\System\kUaVPOr.exe
  C:\Windows\System\kUaVPOr.exe
  2⤵
  PID:6120
- C:\Windows\System\tsFJLeb.exe
  C:\Windows\System\tsFJLeb.exe
  2⤵
  PID:6860
- C:\Windows\System\CAPcRST.exe
  C:\Windows\System\CAPcRST.exe
  2⤵
  PID:13616
- C:\Windows\System\tNlaQOL.exe
  C:\Windows\System\tNlaQOL.exe
  2⤵
  PID:6564
- C:\Windows\System\kaKRBhQ.exe
  C:\Windows\System\kaKRBhQ.exe
  2⤵
  PID:6396
- C:\Windows\System\GQrvMhn.exe
  C:\Windows\System\GQrvMhn.exe
  2⤵
  PID:7564
- C:\Windows\System\MRMrPAY.exe
  C:\Windows\System\MRMrPAY.exe
  2⤵
  PID:6468
- C:\Windows\System\QtorNRI.exe
  C:\Windows\System\QtorNRI.exe
  2⤵
  PID:7836
- C:\Windows\System\GIXDude.exe
  C:\Windows\System\GIXDude.exe
  2⤵
  PID:7404
- C:\Windows\System\qKtMMwe.exe
  C:\Windows\System\qKtMMwe.exe
  2⤵
  PID:8184
- C:\Windows\System\EgCqtQZ.exe
  C:\Windows\System\EgCqtQZ.exe
  2⤵
  PID:7740
- C:\Windows\System\OXzHZXA.exe
  C:\Windows\System\OXzHZXA.exe
  2⤵
  PID:6428
- C:\Windows\System\emnNvaT.exe
  C:\Windows\System\emnNvaT.exe
  2⤵
  PID:5408
- C:\Windows\System\eqNsuzf.exe
  C:\Windows\System\eqNsuzf.exe
  2⤵
  PID:7656
- C:\Windows\System\ZVSlgRe.exe
  C:\Windows\System\ZVSlgRe.exe
  2⤵
  PID:7392
- C:\Windows\System\ITfPSqp.exe
  C:\Windows\System\ITfPSqp.exe
  2⤵
  PID:6840
- C:\Windows\System\iprinkt.exe
  C:\Windows\System\iprinkt.exe
  2⤵
  PID:7996
- C:\Windows\System\YvMZidl.exe
  C:\Windows\System\YvMZidl.exe
  2⤵
  PID:6648
- C:\Windows\System\PQiMhzc.exe
  C:\Windows\System\PQiMhzc.exe
  2⤵
  PID:7624
- C:\Windows\System\NIdwwNS.exe
  C:\Windows\System\NIdwwNS.exe
  2⤵
  PID:7328
- C:\Windows\System\DEKJQVW.exe
  C:\Windows\System\DEKJQVW.exe
  2⤵
  PID:8056
- C:\Windows\System\IYZvMzl.exe
  C:\Windows\System\IYZvMzl.exe
  2⤵
  PID:7060
- C:\Windows\System\VOhFoMw.exe
  C:\Windows\System\VOhFoMw.exe
  2⤵
  PID:5372
- C:\Windows\System\iMbolJw.exe
  C:\Windows\System\iMbolJw.exe
  2⤵
  PID:8760
- C:\Windows\System\JaFamun.exe
  C:\Windows\System\JaFamun.exe
  2⤵
  PID:8784
- C:\Windows\System\ykioNmE.exe
  C:\Windows\System\ykioNmE.exe
  2⤵
  PID:8316
- C:\Windows\System\DqylMYW.exe
  C:\Windows\System\DqylMYW.exe
  2⤵
  PID:7108
- C:\Windows\System\kFUtWOb.exe
  C:\Windows\System\kFUtWOb.exe
  2⤵
  PID:6640
- C:\Windows\System\AIYoTpR.exe
  C:\Windows\System\AIYoTpR.exe
  2⤵
  PID:7240
- C:\Windows\System\mFKhweJ.exe
  C:\Windows\System\mFKhweJ.exe
  2⤵
  PID:14340
- C:\Windows\System\BvIidEX.exe
  C:\Windows\System\BvIidEX.exe
  2⤵
  PID:14368
- C:\Windows\System\UMGhUYE.exe
  C:\Windows\System\UMGhUYE.exe
  2⤵
  PID:14396
- C:\Windows\System\OQysnIU.exe
  C:\Windows\System\OQysnIU.exe
  2⤵
  PID:14424
- C:\Windows\System\WoopzLv.exe
  C:\Windows\System\WoopzLv.exe
  2⤵
  PID:14452
- C:\Windows\System\WLqVUdu.exe
  C:\Windows\System\WLqVUdu.exe
  2⤵
  PID:14500
- C:\Windows\System\ryMjikf.exe
  C:\Windows\System\ryMjikf.exe
  2⤵
  PID:14540
- C:\Windows\System\MjmhEEb.exe
  C:\Windows\System\MjmhEEb.exe
  2⤵
  PID:14572
- C:\Windows\System\couPPIG.exe
  C:\Windows\System\couPPIG.exe
  2⤵
  PID:14588
- C:\Windows\System\lTEABrt.exe
  C:\Windows\System\lTEABrt.exe
  2⤵
  PID:14612
- C:\Windows\System\obFFDir.exe
  C:\Windows\System\obFFDir.exe
  2⤵
  PID:14636
- C:\Windows\System\OKkUZbF.exe
  C:\Windows\System\OKkUZbF.exe
  2⤵
  PID:14660
- C:\Windows\System\HiyGxGF.exe
  C:\Windows\System\HiyGxGF.exe
  2⤵
  PID:14696
- C:\Windows\System\CcBjzFs.exe
  C:\Windows\System\CcBjzFs.exe
  2⤵
  PID:14724
- C:\Windows\System\UKLjyPO.exe
  C:\Windows\System\UKLjyPO.exe
  2⤵
  PID:14752
- C:\Windows\System\rnrtCPD.exe
  C:\Windows\System\rnrtCPD.exe
  2⤵
  PID:14784
- C:\Windows\System\jOBMkaa.exe
  C:\Windows\System\jOBMkaa.exe
  2⤵
  PID:14808
- C:\Windows\System\TRxukMJ.exe
  C:\Windows\System\TRxukMJ.exe
  2⤵
  PID:14840
- C:\Windows\System\OVALSat.exe
  C:\Windows\System\OVALSat.exe
  2⤵
  PID:14876
- C:\Windows\System\uMtFEfc.exe
  C:\Windows\System\uMtFEfc.exe
  2⤵
  PID:14912
- C:\Windows\System\ridfPNY.exe
  C:\Windows\System\ridfPNY.exe
  2⤵
  PID:14936
- C:\Windows\System\IeOlhvX.exe
  C:\Windows\System\IeOlhvX.exe
  2⤵
  PID:14968
- C:\Windows\System\ukjwaOp.exe
  C:\Windows\System\ukjwaOp.exe
  2⤵
  PID:14996
- C:\Windows\System\pXqBlLo.exe
  C:\Windows\System\pXqBlLo.exe
  2⤵
  PID:15016
- C:\Windows\System\VCjAQwu.exe
  C:\Windows\System\VCjAQwu.exe
  2⤵
  PID:15044
- C:\Windows\System\wkeLqHJ.exe
  C:\Windows\System\wkeLqHJ.exe
  2⤵
  PID:15072
- C:\Windows\System\wajgpqm.exe
  C:\Windows\System\wajgpqm.exe
  2⤵
  PID:15100
- C:\Windows\System\faBQFSz.exe
  C:\Windows\System\faBQFSz.exe
  2⤵
  PID:15128
- C:\Windows\System\IoHklgW.exe
  C:\Windows\System\IoHklgW.exe
  2⤵
  PID:15152
- C:\Windows\System\QuoXyaP.exe
  C:\Windows\System\QuoXyaP.exe
  2⤵
  PID:15180
- C:\Windows\System\XeVzhlF.exe
  C:\Windows\System\XeVzhlF.exe
  2⤵
  PID:15212
- C:\Windows\System\knOffUi.exe
  C:\Windows\System\knOffUi.exe
  2⤵
  PID:15240
- C:\Windows\System\odKMbuX.exe
  C:\Windows\System\odKMbuX.exe
  2⤵
  PID:15284
- C:\Windows\System\LaZLGii.exe
  C:\Windows\System\LaZLGii.exe
  2⤵
  PID:15316
- C:\Windows\System\jAtAGyG.exe
  C:\Windows\System\jAtAGyG.exe
  2⤵
  PID:15348
- C:\Windows\System\vndKMDU.exe
  C:\Windows\System\vndKMDU.exe
  2⤵
  PID:11752
- C:\Windows\System\pdXqdoj.exe
  C:\Windows\System\pdXqdoj.exe
  2⤵
  PID:6952
- C:\Windows\System\UGSzeOS.exe
  C:\Windows\System\UGSzeOS.exe
  2⤵
  PID:7752
- C:\Windows\System\GggoIDw.exe
  C:\Windows\System\GggoIDw.exe
  2⤵
  PID:8988
- C:\Windows\System\PZiQcwr.exe
  C:\Windows\System\PZiQcwr.exe
  2⤵
  PID:5500
- C:\Windows\System\pxcGBcf.exe
  C:\Windows\System\pxcGBcf.exe
  2⤵
  PID:9412
- C:\Windows\System\demUIjn.exe
  C:\Windows\System\demUIjn.exe
  2⤵
  PID:9416
- C:\Windows\System\WUYeJvm.exe
  C:\Windows\System\WUYeJvm.exe
  2⤵
  PID:14444
- C:\Windows\System\pvFnyMi.exe
  C:\Windows\System\pvFnyMi.exe
  2⤵
  PID:14508
- C:\Windows\System\XigYwxa.exe
  C:\Windows\System\XigYwxa.exe
  2⤵
  PID:14520
- C:\Windows\System\ydbquNj.exe
  C:\Windows\System\ydbquNj.exe
  2⤵
  PID:14736
- C:\Windows\System\fqQaqUv.exe
  C:\Windows\System\fqQaqUv.exe
  2⤵
  PID:14484
- C:\Windows\System\BLCTFkP.exe
  C:\Windows\System\BLCTFkP.exe
  2⤵
  PID:8860
- C:\Windows\System\SrONFWK.exe
  C:\Windows\System\SrONFWK.exe
  2⤵
  PID:14516
- C:\Windows\System\ioAAWKt.exe
  C:\Windows\System\ioAAWKt.exe
  2⤵
  PID:14720
- C:\Windows\System\UhFRFQI.exe
  C:\Windows\System\UhFRFQI.exe
  2⤵
  PID:9188
- C:\Windows\System\EhxlaAc.exe
  C:\Windows\System\EhxlaAc.exe
  2⤵
  PID:6820
- C:\Windows\System\jZSXKJn.exe
  C:\Windows\System\jZSXKJn.exe
  2⤵
  PID:10156
- C:\Windows\System\AXItjWb.exe
  C:\Windows\System\AXItjWb.exe
  2⤵
  PID:14868
- C:\Windows\System\THwFKmO.exe
  C:\Windows\System\THwFKmO.exe
  2⤵
  PID:7604
- C:\Windows\System\cOnPSIV.exe
  C:\Windows\System\cOnPSIV.exe
  2⤵
  PID:15080
- C:\Windows\System\YqQGxYA.exe
  C:\Windows\System\YqQGxYA.exe
  2⤵
  PID:15140
- C:\Windows\System\NknnDRG.exe
  C:\Windows\System\NknnDRG.exe
  2⤵
  PID:14892
- C:\Windows\System\ldjxwWq.exe
  C:\Windows\System\ldjxwWq.exe
  2⤵
  PID:14924
- C:\Windows\System\qnhXSjP.exe
  C:\Windows\System\qnhXSjP.exe
  2⤵
  PID:9248
- C:\Windows\System\njqChmM.exe
  C:\Windows\System\njqChmM.exe
  2⤵
  PID:14960
- C:\Windows\System\QqOsbAW.exe
  C:\Windows\System\QqOsbAW.exe
  2⤵
  PID:6268
- C:\Windows\System\oCEWZGQ.exe
  C:\Windows\System\oCEWZGQ.exe
  2⤵
  PID:9800
- C:\Windows\System\XcvHEyi.exe
  C:\Windows\System\XcvHEyi.exe
  2⤵
  PID:13960
- C:\Windows\System\RkRScwU.exe
  C:\Windows\System\RkRScwU.exe
  2⤵
  PID:9516
- C:\Windows\System\YzMnVVx.exe
  C:\Windows\System\YzMnVVx.exe
  2⤵
  PID:14348
- C:\Windows\System\FcbPBqs.exe
  C:\Windows\System\FcbPBqs.exe
  2⤵
  PID:10588
- C:\Windows\System\VLLYHJw.exe
  C:\Windows\System\VLLYHJw.exe
  2⤵
  PID:15340
- C:\Windows\System\ZDjVTpJ.exe
  C:\Windows\System\ZDjVTpJ.exe
  2⤵
  PID:14548
- C:\Windows\System\zvajsLH.exe
  C:\Windows\System\zvajsLH.exe
  2⤵
  PID:14856
- C:\Windows\System\nDJdYOj.exe
  C:\Windows\System\nDJdYOj.exe
  2⤵
  PID:9312
- C:\Windows\System\CAxmrHh.exe
  C:\Windows\System\CAxmrHh.exe
  2⤵
  PID:7948
- C:\Windows\System\jyEAMnE.exe
  C:\Windows\System\jyEAMnE.exe
  2⤵
  PID:10968
- C:\Windows\System\CrYcSHi.exe
  C:\Windows\System\CrYcSHi.exe
  2⤵
  PID:15092
- C:\Windows\System\vgGbwWc.exe
  C:\Windows\System\vgGbwWc.exe
  2⤵
  PID:10996
- C:\Windows\System\PoYSrug.exe
  C:\Windows\System\PoYSrug.exe
  2⤵
  PID:9460
- C:\Windows\System\qUKNJrG.exe
  C:\Windows\System\qUKNJrG.exe
  2⤵
  PID:14684
- C:\Windows\System\UmWCPlP.exe
  C:\Windows\System\UmWCPlP.exe
  2⤵
  PID:13172
- C:\Windows\System\CXZoPfb.exe
  C:\Windows\System\CXZoPfb.exe
  2⤵
  PID:6056
- C:\Windows\System\VBYQQQl.exe
  C:\Windows\System\VBYQQQl.exe
  2⤵
  PID:10820
- C:\Windows\System\tbTXxUz.exe
  C:\Windows\System\tbTXxUz.exe
  2⤵
  PID:14472
- C:\Windows\System\HuzQZqx.exe
  C:\Windows\System\HuzQZqx.exe
  2⤵
  PID:7928
- C:\Windows\System\XoctbSt.exe
  C:\Windows\System\XoctbSt.exe
  2⤵
  PID:10072
- C:\Windows\System\VnPpZsC.exe
  C:\Windows\System\VnPpZsC.exe
  2⤵
  PID:11956
- C:\Windows\System\iIRPHXN.exe
  C:\Windows\System\iIRPHXN.exe
  2⤵
  PID:11076
- C:\Windows\System\PaRKpFH.exe
  C:\Windows\System\PaRKpFH.exe
  2⤵
  PID:9168
- C:\Windows\System\WvWCNVi.exe
  C:\Windows\System\WvWCNVi.exe
  2⤵
  PID:15136
- C:\Windows\System\sisTpLz.exe
  C:\Windows\System\sisTpLz.exe
  2⤵
  PID:10796
- C:\Windows\System\UiyuIPQ.exe
  C:\Windows\System\UiyuIPQ.exe
  2⤵
  PID:14820
- C:\Windows\System\uWSNCRF.exe
  C:\Windows\System\uWSNCRF.exe
  2⤵
  PID:9776
- C:\Windows\System\eDjNUvB.exe
  C:\Windows\System\eDjNUvB.exe
  2⤵
  PID:9928
- C:\Windows\System\amafBnt.exe
  C:\Windows\System\amafBnt.exe
  2⤵
  PID:10936
- C:\Windows\System\scLBZwr.exe
  C:\Windows\System\scLBZwr.exe
  2⤵
  PID:14460
- C:\Windows\System\kuwschh.exe
  C:\Windows\System\kuwschh.exe
  2⤵
  PID:15248
- C:\Windows\System\OTcAYbW.exe
  C:\Windows\System\OTcAYbW.exe
  2⤵
  PID:10924
- C:\Windows\System\dKWHhcf.exe
  C:\Windows\System\dKWHhcf.exe
  2⤵
  PID:11404
- C:\Windows\System\AfpklOB.exe
  C:\Windows\System\AfpklOB.exe
  2⤵
  PID:9712
- C:\Windows\System\wcPUMXI.exe
  C:\Windows\System\wcPUMXI.exe
  2⤵
  PID:7468
- C:\Windows\System\COhvKuT.exe
  C:\Windows\System\COhvKuT.exe
  2⤵
  PID:10308
- C:\Windows\System\OGqBNRS.exe
  C:\Windows\System\OGqBNRS.exe
  2⤵
  PID:12100
- C:\Windows\System\dCPPSTM.exe
  C:\Windows\System\dCPPSTM.exe
  2⤵
  PID:9444
- C:\Windows\System\adhOtxX.exe
  C:\Windows\System\adhOtxX.exe
  2⤵
  PID:15144
- C:\Windows\System\syiXDKV.exe
  C:\Windows\System\syiXDKV.exe
  2⤵
  PID:14536
- C:\Windows\System\vueHxgb.exe
  C:\Windows\System\vueHxgb.exe
  2⤵
  PID:7712
- C:\Windows\System\TZSkAuj.exe
  C:\Windows\System\TZSkAuj.exe
  2⤵
  PID:15160
- C:\Windows\System\AQIaxal.exe
  C:\Windows\System\AQIaxal.exe
  2⤵
  PID:11160
- C:\Windows\System\bCczOxY.exe
  C:\Windows\System\bCczOxY.exe
  2⤵
  PID:9552
- C:\Windows\System\YDULwtl.exe
  C:\Windows\System\YDULwtl.exe
  2⤵
  PID:10224
- C:\Windows\System\IVuxBcC.exe
  C:\Windows\System\IVuxBcC.exe
  2⤵
  PID:6776
- C:\Windows\System\NWTUTwC.exe
  C:\Windows\System\NWTUTwC.exe
  2⤵
  PID:12208
- C:\Windows\System\fyglCiX.exe
  C:\Windows\System\fyglCiX.exe
  2⤵
  PID:6560
- C:\Windows\System\CTDxwvv.exe
  C:\Windows\System\CTDxwvv.exe
  2⤵
  PID:12356
- C:\Windows\System\ZGRNopH.exe
  C:\Windows\System\ZGRNopH.exe
  2⤵
  PID:9480
- C:\Windows\System\FPodvJF.exe
  C:\Windows\System\FPodvJF.exe
  2⤵
  PID:9100
- C:\Windows\System\IDnkUtC.exe
  C:\Windows\System\IDnkUtC.exe
  2⤵
  PID:14920
- C:\Windows\System\fhpkRDu.exe
  C:\Windows\System\fhpkRDu.exe
  2⤵
  PID:10888
- C:\Windows\System\ImXlguW.exe
  C:\Windows\System\ImXlguW.exe
  2⤵
  PID:11028
- C:\Windows\System\HgjsMmv.exe
  C:\Windows\System\HgjsMmv.exe
  2⤵
  PID:11440
- C:\Windows\System\qYhmcEF.exe
  C:\Windows\System\qYhmcEF.exe
  2⤵
  PID:11164
- C:\Windows\System\dwhfRQb.exe
  C:\Windows\System\dwhfRQb.exe
  2⤵
  PID:10248
- C:\Windows\System\jLaTsKE.exe
  C:\Windows\System\jLaTsKE.exe
  2⤵
  PID:7000
- C:\Windows\System\awzuVnU.exe
  C:\Windows\System\awzuVnU.exe
  2⤵
  PID:3236
- C:\Windows\System\IwAfRZv.exe
  C:\Windows\System\IwAfRZv.exe
  2⤵
  PID:6628
- C:\Windows\System\RSZInPT.exe
  C:\Windows\System\RSZInPT.exe
  2⤵
  PID:7088
- C:\Windows\System\EbrhPCi.exe
  C:\Windows\System\EbrhPCi.exe
  2⤵
  PID:13340
- C:\Windows\System\gdiZGDK.exe
  C:\Windows\System\gdiZGDK.exe
  2⤵
  PID:13248
- C:\Windows\System\uQkqmqO.exe
  C:\Windows\System\uQkqmqO.exe
  2⤵
  PID:11864
- C:\Windows\System\ZepGKYt.exe
  C:\Windows\System\ZepGKYt.exe
  2⤵
  PID:8824
- C:\Windows\System\eqofduA.exe
  C:\Windows\System\eqofduA.exe
  2⤵
  PID:9720
- C:\Windows\System\LvsGopp.exe
  C:\Windows\System\LvsGopp.exe
  2⤵
  PID:12056
- C:\Windows\System\uBFemoT.exe
  C:\Windows\System\uBFemoT.exe
  2⤵
  PID:5048
- C:\Windows\System\KVaeFMb.exe
  C:\Windows\System\KVaeFMb.exe
  2⤵
  PID:11100
- C:\Windows\System\GuNDHch.exe
  C:\Windows\System\GuNDHch.exe
  2⤵
  PID:5804
- C:\Windows\System\MHkcqpO.exe
  C:\Windows\System\MHkcqpO.exe
  2⤵
  PID:10060
- C:\Windows\System\gjYNmdl.exe
  C:\Windows\System\gjYNmdl.exe
  2⤵
  PID:11108
- C:\Windows\System\RmXATzI.exe
  C:\Windows\System\RmXATzI.exe
  2⤵
  PID:11020
- C:\Windows\System\vMwhzya.exe
  C:\Windows\System\vMwhzya.exe
  2⤵
  PID:7556
- C:\Windows\System\WcArmha.exe
  C:\Windows\System\WcArmha.exe
  2⤵
  PID:10016
- C:\Windows\System\AFZxKAr.exe
  C:\Windows\System\AFZxKAr.exe
  2⤵
  PID:11144
- C:\Windows\System\uOEcIwT.exe
  C:\Windows\System\uOEcIwT.exe
  2⤵
  PID:12012
- C:\Windows\System\KeRXykW.exe
  C:\Windows\System\KeRXykW.exe
  2⤵
  PID:12544
- C:\Windows\System\ZBtGOVx.exe
  C:\Windows\System\ZBtGOVx.exe
  2⤵
  PID:10024
- C:\Windows\System\JedLakO.exe
  C:\Windows\System\JedLakO.exe
  2⤵
  PID:8448
- C:\Windows\System\pWTmxdo.exe
  C:\Windows\System\pWTmxdo.exe
  2⤵
  PID:5432
- C:\Windows\System\tWpaKVu.exe
  C:\Windows\System\tWpaKVu.exe
  2⤵
  PID:8196
- C:\Windows\System\TCpTyCF.exe
  C:\Windows\System\TCpTyCF.exe
  2⤵
  PID:9212
- C:\Windows\System\ZCtIqhf.exe
  C:\Windows\System\ZCtIqhf.exe
  2⤵
  PID:11004
- C:\Windows\System\tvjGCQW.exe
  C:\Windows\System\tvjGCQW.exe
  2⤵
  PID:13536
- C:\Windows\System\xSagKdX.exe
  C:\Windows\System\xSagKdX.exe
  2⤵
  PID:11248
- C:\Windows\System\zxAdTaW.exe
  C:\Windows\System\zxAdTaW.exe
  2⤵
  PID:9996
- C:\Windows\System\WQRYxuS.exe
  C:\Windows\System\WQRYxuS.exe
  2⤵
  PID:14436
- C:\Windows\System\sCTRIbd.exe
  C:\Windows\System\sCTRIbd.exe
  2⤵
  PID:13636
- C:\Windows\System\WRuxmgQ.exe
  C:\Windows\System\WRuxmgQ.exe
  2⤵
  PID:10120
- C:\Windows\System\nhtNdwY.exe
  C:\Windows\System\nhtNdwY.exe
  2⤵
  PID:11012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_alomvvsc.4z2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\Bxwfqes.exe

Filesize
1.9MB

MD5
a43bc33be0546f92f6b7025a7067577a

SHA1
b31805d14b6e6f0287b90169ebb23d2c141591ca

SHA256
97cf6c4a2ac24f8835f63e69213f5183f2dc211f17526db3e71ca1d4401d8481

SHA512
ec012bc87ea9573ff0439c4c3f2981550a554398746fd7a18ec75d85f27ebec781a8445cc8522353ba3ca03f10c423210ed12115638298cfb64d22a85ab5c99d

Download Submit
C:\Windows\System\DUJOQFh.exe

Filesize
1.9MB

MD5
4ab481632b0586eb9fe84d0ae348de5b

SHA1
9f5b2fc7ca366707776b42b56a985a043d8c1ee4

SHA256
1e21cbd565ca20445c72ea01c62405840b385de98e2694a9e4f6a031518b3c4d

SHA512
d216eb5194f8cb99e1ccf65a2ca412c889a7eb0b0f35172979ea04f37a9fe519e4234b9072bc5ecb7cb2bb24c5e7e2f3e303e2758e9ae81a27d5a565ef9c6930

Download Submit
C:\Windows\System\ErwDAuL.exe

Filesize
1.9MB

MD5
95d922dce37acc3ade4c82d5fb3abfc4

SHA1
e82d15881c19514775745bf688b6313e4056228e

SHA256
8377284f30f27a06fa757d4e41e739a6cfbca84ca253944d9278f730eb19d0a2

SHA512
73a05a66e0700465842303b5c2b12193b5b559da9956ce3d47e34b1ebb8050e6fe663f35cd99b8fdf1d2b8b7bb8a50ab2a0ef8b7673f709c89f1eb726f0b0f1d

Download Submit
C:\Windows\System\FgbjNaI.exe

Filesize
1.9MB

MD5
d54d6b698dee2a5f274fe9223aae39aa

SHA1
552d17b2e8a0f2eac8d07f646c850c8862484017

SHA256
47225a11259850605a6238b8f34c895be22169e66310712cc8c053638521e174

SHA512
be9b56b2842afe24c1b8135bece78ef373efbd11de462d7ec61df85ad9cce9c78e90989b0553003e443277c6add39fdf395137d161940b18ffbde7783ce83c0c

Download Submit
C:\Windows\System\GVWLTny.exe

Filesize
1.9MB

MD5
cc3f6a9bb610b146fd45ceeef52276d1

SHA1
308596a907fe479f02442f857f0220fdc003f895

SHA256
3b7a963217e29b0b392ae5c6a712f0fff764ab20c63e81dde9d7eb9ec20d5a68

SHA512
db2b499b69301303337e4564f52b423708c997719a61ff1fb383891a500a6465931b2f149ed98d4961f11aacc02a7efd4dde4e5dd9a29d57492c8f2c610ea03a

Download Submit
C:\Windows\System\GnUyKuB.exe

Filesize
1.9MB

MD5
77800dfced819a707bea212d7ef184d9

SHA1
d0cf1f45f6c11ea250a1596b6a63a4ea673490d6

SHA256
73b3be37e2045d6c1e40670cb8a0c5f38eca89310924a3ac53450a4dff809683

SHA512
485184f8fa9f275724ce21a275c8ba8a160a8301981bf6cd29459997538c574874200de2b2b5a15cfe062c7c4ed75100452ebb0797445f2485590abb5bbfec48

Download Submit
C:\Windows\System\HkfdpcU.exe

Filesize
1.9MB

MD5
ec64467572ee343946a8466dc801c6a2

SHA1
6ebb2dd00113a93383cdd8597a690a971b657c7e

SHA256
084458c18823bbae5104cbf17d1daf947aba9bc6c181bb30d6cdf3b3bc6c9cf0

SHA512
9ca1e3fadf68bc44dbaf7a25fa34afc910ce3b122cfe68fab08de123966015c3d6f6f54dc11a5bb56d0379ca18e3ce7119bde48d1bb22ef3446637d75c2ee237

Download Submit
C:\Windows\System\KhGCWSV.exe

Filesize
1.9MB

MD5
0fb6e5742e72751062a64f83e2ecad1b

SHA1
8c75aab83af2a8c8a54f22b111981a9a7ebd0fbe

SHA256
372e39ce911f8c3453894a021bee9e5005ac3fcc741d03ffd4a92a1766e25e41

SHA512
a19e8e7a8a11d3b7a92ab8e821a01e728fca80d694b08bea217500f13ce867e47a35343b15de4fe83651c9db42bdf8fdfafcfb071bd56c002c55dfaa5ec728c2

Download Submit
C:\Windows\System\MgEHuoB.exe

Filesize
1.9MB

MD5
c043aded48c95b185f9e9a578f9abf7f

SHA1
4ae8e9039d588a01158a8d71af3188796d2e32ab

SHA256
fb3b300029a43d8a3b77f4f390497e9bed08e2354908aa5aed7f1289de848a1d

SHA512
82595d20ee8c01f57c0dfc0f0030d3e2a28a47dd5ea15e9f508417d5b317c7030534ddea01a08977966412d1c26c154f199d37123d70b2f1d6e0f07b077f1b57

Download Submit
C:\Windows\System\MiydccD.exe

Filesize
1.9MB

MD5
92487ba810fc9081f323fa780c7e8ec3

SHA1
625758a9c55bf2f085d021a4fdfdf6951918e93d

SHA256
e4e724e955d5b5ee948b39a9c0d7f436a34ac603ee3daf9b6bbdd95ba35731d8

SHA512
f8f0f964313ff212148627efc0ddcc2fbf6666fd3271cae81a9355ed55a9c724190b7ba80d40bec53147bbc51d4c7f1be782a0ebdd8f88e924740dc5b3d809aa

Download Submit
C:\Windows\System\QgpuxoJ.exe

Filesize
1.9MB

MD5
5766ee3e144252ceb637bb8ec94270e8

SHA1
d5afcbc616593afdabee29cc5621d68caf48995e

SHA256
e8f678c2ca101e075c04baf59e7b7fc79c12cbd83b235a947c57dba8e3e5009c

SHA512
8670b5202e69c079ad1cf3b33f1c67a4a6567bdda94b092ed015310869cb9d484da795356189988f3288d02c66965198b14cca7fa60424d630a1703f26b5be44

Download Submit
C:\Windows\System\QiUKqLH.exe

Filesize
1.9MB

MD5
e9cd2ba9d912e46ed51eb9ba9c1f8a35

SHA1
67cea25ef37af29ab5c9b834e3e56ca3109633ce

SHA256
e1c1de1b8aa6e53fa33368559bd2c2e026daacf162016790315c64c23b2d08df

SHA512
2cb323ff9dd847d616fbbd016a0bd39360ce1916283f11f8059dab684113096139f140352e858d306b7be38be0b01c3a76826a941b819b188570345ba2d262a6

Download Submit
C:\Windows\System\RNMOMOo.exe

Filesize
1.9MB

MD5
766e5eecdd90c088cd78276c54f8d457

SHA1
6e9243efc06e3bd98979ae50fd1d0f5c626f09d7

SHA256
11e458265b9d91e809053cf4c71678e9ede37701a5e54d82907ca85e1cc72a84

SHA512
7da5cdb71677d6d3b90ef2665f7922f22ee7760be801b35723a2657ea64e3368e871be59ff76b513b167c3b0cee2db62d049810e6f5c2c65f13aa42be4906ef3

Download Submit
C:\Windows\System\RWSSxKZ.exe

Filesize
1.9MB

MD5
2d35b4a2f779c1005422b16b901fc04c

SHA1
2a5689f1806952a7adfb2eba0b98fc38209d1486

SHA256
c69aa9b57d215ce9bce34efd0f21fb5c52ba9b158a35a34339353a8b28b73ff1

SHA512
f01551b7986ef60280ad8e62e03e9998542ebf97f435db92bce69365b61ec2d8a943a4b4140298adc765ad0529d0f3048534dfa8ec5d3d02f45702338d720861

Download Submit
C:\Windows\System\SNbcaGu.exe

Filesize
18B

MD5
78e69eb0a41877a1c6a39b6895b51435

SHA1
1d8004474a59c8c9038d183093e32ccf603c7af4

SHA256
db72d8c0e4c270ca2b090504876e68c2da29c2ffd0505f696acb152cc4c05f53

SHA512
952d231d47ac71b2a27861288e0ab964a8d53a0156a694ab3b4a9ff9aa52a710a47baad73e6e370215aecc0e6999433d8414ba8358fd4555669d517b5b979f9d

Download Submit
C:\Windows\System\STDuGQy.exe

Filesize
1.9MB

MD5
d19f5f2d2cfdd8b1e8715f803ae88ebf

SHA1
67b3a04c47ef680a84754ac56076995bad74512c

SHA256
e5d8746b8449b5049491d6c2e757f710c8af24d5b1bb6d360c4f9751af757cef

SHA512
739eff68c30fd268df5ec9c1cfb6a7ad40947ae9ff33670c9372056730d50cb609cb4ea24105f858f5a8328c3fbbc52148a2dca9720a9b39ad65597187a6012d

Download Submit
C:\Windows\System\TZgCNQo.exe

Filesize
1.9MB

MD5
3991ee5d48c185e8b7b112944c173932

SHA1
25fb11a25ed8c50fa488c96b1a3afc0fa80ba388

SHA256
78ea66f5c637545eb240122f148dbf8d3386024743db99f2ca80481e6b7a1037

SHA512
474a9d63480a2a78c595838d377eaaf7dd14a5c8c44c48803acd60e746c2f04d2ee83b0132e264dddac3e8d998848d8ea8178c09fd6048b301e9ca9b1ee8035b

Download Submit
C:\Windows\System\VwmXeIY.exe

Filesize
1.9MB

MD5
8ece2ce8215db7a2d54f38d05f62dd48

SHA1
e67056ab31231c6273df7b6bcddd5f6d1daac4f3

SHA256
175555191aeec3b020f522d3f69295f6b6c128c03159243f07df16b0a345c6c9

SHA512
bb4b5a62ea142086fc90454c971b8e9eed75d8bf7e09bf389e66547a08c497c6579a9f98ec2ba498e881ecdcac65d3a3b34f33e9dd7358bcdc54f084d84fff3d

Download Submit
C:\Windows\System\WQWVHwE.exe

Filesize
1.9MB

MD5
1e618b7b2f2a0d28109ddfd2deb806fc

SHA1
c4b6c5b37574e4ec2dc0239e7fe73d0194a6b20e

SHA256
ba9d3c99512e6215969be38c60a5b4240d6f394a1dfbaae4a47542ee89ecd231

SHA512
c8d8f0e60c50d857e825d628e4e94913a91e43584a00f545c0fcce5df5c2bb7881a48f27379f82868795cd2adec90e71cc7e175011d001dc191548f04f1e9c81

Download Submit
C:\Windows\System\XIONrTk.exe

Filesize
1.9MB

MD5
35b27e3103f027ad1847050184779d3b

SHA1
449b68377f9168542f35a1315e23cfac00ff29e2

SHA256
f823df46fc0f7f760c0d1d8ebd988e6b27fcc2bf805ff6716d928b14cdc89238

SHA512
2800851ea418749eda3a213580c351efdd977b7604fa780cf59f18d13d57743d0467ffc43377caaa77189d4cde0c6ca28235a3bc607889f787a096dceb1c4727

Download Submit
C:\Windows\System\YclHQbc.exe

Filesize
8B

MD5
7e1e9fcc71af27d4f3a70b3e20ac77b9

SHA1
09ec64762a6dbe9e03ecdb61ea5de2d274d170f0

SHA256
2f18658787aeca4d305f9fde7c9bc7343e5969bd51ec0e2c8583a2e506b9b404

SHA512
3beada4b1cd8ead153972e6e1293d504f7cea2d7323223a87897681d13a0872baba6942b9d88c8943892c0ad02e1f51ed3730edd702cc7d53ab31d006770ca91

Download Submit
C:\Windows\System\YyJqAsB.exe

Filesize
1.9MB

MD5
6b7751ee344ecc3635c9c9c93b809512

SHA1
ec3fb965cc216bbb6f8d5d63e8d0556a2bc0fce5

SHA256
2bf5c034b3637a1fa7708aba0eaf51822c4b4a2c2f20cea73d6e30f799f90d2b

SHA512
263e278f64071676d6ee8dfee6183bc6c65302e0a0fb723399783738e2a3c590af0b18a8daccf0e642b4282310dbcfb8ccb4fb885ce40706440563e3ee75cebc

Download Submit
C:\Windows\System\aQXnNHS.exe

Filesize
1.9MB

MD5
88f3d004b9287320f01a7cdb2180eba4

SHA1
18cae7f8ae168f08d9312468f232a06843285d10

SHA256
60cbb41811ea243f194dd127cd97b1bdb4edff7d83db5aead41dfd0a6ebe2d7e

SHA512
1f4782766cc5fb7bacaca5e7bbb0e9af6859ab6d9af69d056b6c8ffa8a6bd8d383cc9feabea5d24fc3300bd2147d75e493eee2c4e84086b035b1a7974dfe6345

Download Submit
C:\Windows\System\cHAtPVF.exe

Filesize
1.9MB

MD5
8e9a168be0f4bc59d8762e29537d7a46

SHA1
4e5a0d43714b53ef7ef67de89e0eae242147d87b

SHA256
891d490feb6cfca64124d2c1f1c7e22d39e7ea3782708403b919d9a0f902859b

SHA512
bdedfff39be2c5da67dab937c4ea67e82a1272c7bb5afd1c6be515917a881e667719e12f7c9aa81573dae3c3218aec7b2423eef865bd7c7732e60c46b350b29e

Download Submit
C:\Windows\System\gKhxKoo.exe

Filesize
1.9MB

MD5
0946802a36975159e74152179965bce1

SHA1
8d56156f0a7aadbd58353fef17e06f99b1c25087

SHA256
bb22f551c32e577479e766cd3fdd46774650863b0d9a93d892d908ba1ae143e4

SHA512
92c7c511752d6693e2f9bd39b43346e86cf85dce4676ffb03190a89dea9033496f459c94249c20e8112054db610a3f03f9dedc13f2a1789b2d5b8a370a8c4a93

Download Submit
C:\Windows\System\gylfmts.exe

Filesize
1.9MB

MD5
e5d7ce3baf8ac6c721f70aeb0f17e29f

SHA1
bad2cb6666b53fa04bd157908023f342797a5872

SHA256
f277cd12bf4e7d896ebcddc9f15f5e447e8f8385be4eeb0f6cfcb0ca6fa15c1b

SHA512
07d192e999e4027a4f4196bed97112f234d096e892ebb35e658287b7b7c64dc8ed4b65de39065f72d985215e0cdf9abe6c19a586faba17babed0c2f0f5215e7c

Download Submit
C:\Windows\System\ikogXKH.exe

Filesize
1.9MB

MD5
783921d56369e32235152fc0109caf41

SHA1
d11aa7e8ecc6671a4cb483129c246435b12a09e3

SHA256
f7783ead32329b59e6892ad3e65ba72ee242fe8b39a18c485f5332d8cd1f99ca

SHA512
606235e755fce6760191292a7415ebec2dd0d7e54c154b33d419b862a2d009f55e7a40a2d82db44df0719dfd54306b359c60653af0511d5e5c336368b2ed2e5c

Download Submit
C:\Windows\System\ilMOnXT.exe

Filesize
1.9MB

MD5
2ca4955a553b78e454ee9eb8c8b4ac9b

SHA1
6b5b1568c603c026eadb8a418212a5c83585c569

SHA256
b71798affed8dce8969302d6c738c929c63eea642bd59c2728c7643d8590793f

SHA512
bffa88d7b0f96d9652d1b8cfa96bdb9b9676877f5e18df26acd54b135c698d420788af2d39f8bd3b2803688b706daf912f6563b18f53a2a58813592bf1adbb9c

Download Submit
C:\Windows\System\kjoJcWt.exe

Filesize
1.9MB

MD5
194cb060262fd6dbcf55900513843933

SHA1
bb11b0de4c91d04c0a3695930af3e626f52d355a

SHA256
a4013b69c216f090d64a0b58681161fe45cd46ecdc27f846fa294fc930c28f30

SHA512
44b66ecbaa43958c577f660c3750b78b9133d91760978662d58b8819ec7b2074b60231c051e4cbc06ade62e5544bafff948df03458a311bcf6e59ccbc150ab46

Download Submit
C:\Windows\System\lBxiHxX.exe

Filesize
1.9MB

MD5
8cf80d5a8370c521cee8ef5841ef3072

SHA1
a1476cd54a71a8216000479fa725a19aebcc380d

SHA256
c2f4cf125b31befc5de86ff010d690494d14f3dee56d6a8ffd33001e962ba86c

SHA512
0abfc2517762e5b4a1906ac2c190e96a18f5012bcd1be51264c6be9a3cacb22797ac8d5c7583cac5b8ec993866c7335a0121ff3a695c9790bcf166276929a0d5

Download Submit
C:\Windows\System\ngfTSit.exe

Filesize
1.9MB

MD5
5f5fe0efe8f13c089402e27fc188ac1a

SHA1
fdcab947d95b052b4881dc2ca2a84fdd726bc12a

SHA256
72f1365b4d4a1e6d5e9900873348753d2133f410ad46a069c1ce9bcbcb129334

SHA512
5d72a6fbadfe62755fa6ec02106b4d168b9fe0b8cdee50b96e388b177d4f34391657f96225182ba4a7e09e19432a8541c78844281b1f05f09f7b9f615838c5eb

Download Submit
C:\Windows\System\pCZCOnd.exe

Filesize
1.9MB

MD5
fdf64c38af4dcb17785aacdfc0fbc3e4

SHA1
500d0e79d5e5d2e96ad00be4e25c473a02aa52fe

SHA256
08467a49674b5b42f0c6e7ef91369a9fa910f8781fa1005ee7f4806b878f7a09

SHA512
be0ac10e8c51164716371eee010b47bdd04ede2a6554fc43fd43c403f376aa9397a73cab08e7eab7f8a7de3165e6d4263bb72a8f0a1d2e9c78db22df5821c4d4

Download Submit
C:\Windows\System\rkYIYaB.exe

Filesize
1.9MB

MD5
cf56558d88e1143da5c3a26d1a424e20

SHA1
72745bbcf7eaaa6275c53d0a1c5a2498246e89dc

SHA256
e991646807fdfa9412defbfbbcd3d5a8edcfd1763c01d6a7c32fb33dedda8fa3

SHA512
bebd758bac31ab1f02b3505a07117db1bf21d034c51b0ca4c7d27048fcea3d1f5d8bf8f34af146be03a9e95fdcee3491afc786162f5d782c7db519a30632fbe8

Download Submit
C:\Windows\System\tHlItRA.exe

Filesize
1.9MB

MD5
18975a4608422b01f2280930db9eb1b7

SHA1
578572f5010bab6c587f7bfc60a5d77c90e3d43a

SHA256
9c620966348f615bef24383344b851821283ed65926e1fabc30cf1e029384a7b

SHA512
1f16a20495c69127f2fc371f9fa76ee0fca07a2ea599c4883cd72350f3eb765d2e3737495258bc7fdad518572b2ee502053d23cb394677990349fff6405870ce

Download Submit
C:\Windows\System\tOqJvSZ.exe

Filesize
1.9MB

MD5
3000f24dfb6549d394d4b0564abab508

SHA1
46221ae73d20850c773e49b951feba64f933e9bf

SHA256
80e10007e904a37e3327602acb731608fb75926d556099fb2965e83c60f3eaf2

SHA512
b8b6e02c103c546c3cde09f6d3345f17b1a5393edefa7957dc7fde46b7efe1a07dfe5c1b9df0fbd41e171db0df79fe08ad0aebfb374111e5e22e9b546b57a886

Download Submit
C:\Windows\System\uAxakeE.exe

Filesize
1.9MB

MD5
a031ae26ad839d3d53db052282245208

SHA1
98f9fb5ee8a97fcfef025da763dab738f4a5726f

SHA256
49ba26b39fc0577d6a95bc4d097091845e09ef8d30e39c339701b806e084602d

SHA512
0f1fc0413151a531346b47cbc1e9882c3250f54a697827259ad03f0eaa0314a43936eaceacb0541c36ee11ba303c83d921af7089706b43c411643a488485c416

Download Submit
C:\Windows\System\zTMdkeg.exe

Filesize
1.9MB

MD5
3a146f3f67a9cf92527b8622d58be9f9

SHA1
173d5b02999edb76cd586c87e4fb33e402958d68

SHA256
cb9f31387c82d57c41106ef2e999ea3fb2b4cec5c23b15857c385b411ba6d313

SHA512
eb6531ffb380317241e9a63e833a9fb10c07a186375a42c5cddf2d017163067bf57ee9246b21a3c104cd9258f3d627b9a08eac595131e0e36a1891c8b2bf6886

Download Submit
memory/468-131-0x00007FF6A9790000-0x00007FF6A9B82000-memory.dmp

Filesize
3.9MB

Download
memory/468-5045-0x00007FF6A9790000-0x00007FF6A9B82000-memory.dmp

Filesize
3.9MB

Download
memory/740-0-0x00007FF7E6530000-0x00007FF7E6922000-memory.dmp

Filesize
3.9MB

Download
memory/740-1-0x000002B951C90000-0x000002B951CA0000-memory.dmp

Filesize
64KB

Download
memory/836-5068-0x00007FF7DE7C0000-0x00007FF7DEBB2000-memory.dmp

Filesize
3.9MB

Download
memory/836-249-0x00007FF7DE7C0000-0x00007FF7DEBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1052-31-0x00007FF778330000-0x00007FF778722000-memory.dmp

Filesize
3.9MB

Download
memory/1224-4992-0x00007FF6C7FF0000-0x00007FF6C83E2000-memory.dmp

Filesize
3.9MB

Download
memory/1224-63-0x00007FF6C7FF0000-0x00007FF6C83E2000-memory.dmp

Filesize
3.9MB

Download
memory/1692-5021-0x00007FF798850000-0x00007FF798C42000-memory.dmp

Filesize
3.9MB

Download
memory/1692-47-0x00007FF798850000-0x00007FF798C42000-memory.dmp

Filesize
3.9MB

Download
memory/1696-22-0x00007FF7D0BA0000-0x00007FF7D0F92000-memory.dmp

Filesize
3.9MB

Download
memory/2064-112-0x00007FF7E7590000-0x00007FF7E7982000-memory.dmp

Filesize
3.9MB

Download
memory/2064-5042-0x00007FF7E7590000-0x00007FF7E7982000-memory.dmp

Filesize
3.9MB

Download
memory/2540-158-0x00007FF7058A0000-0x00007FF705C92000-memory.dmp

Filesize
3.9MB

Download
memory/2540-5057-0x00007FF7058A0000-0x00007FF705C92000-memory.dmp

Filesize
3.9MB

Download
memory/2684-111-0x00007FF7842A0000-0x00007FF784692000-memory.dmp

Filesize
3.9MB

Download
memory/2684-5035-0x00007FF7842A0000-0x00007FF784692000-memory.dmp

Filesize
3.9MB

Download
memory/2984-5080-0x00007FF61A7E0000-0x00007FF61ABD2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-159-0x00007FF61A7E0000-0x00007FF61ABD2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-5062-0x00007FF708100000-0x00007FF7084F2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-145-0x00007FF708100000-0x00007FF7084F2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-247-0x00007FF63DD80000-0x00007FF63E172000-memory.dmp

Filesize
3.9MB

Download
memory/3488-5019-0x00007FF63DD80000-0x00007FF63E172000-memory.dmp

Filesize
3.9MB

Download
memory/3504-95-0x00007FF7DD290000-0x00007FF7DD682000-memory.dmp

Filesize
3.9MB

Download
memory/3504-5028-0x00007FF7DD290000-0x00007FF7DD682000-memory.dmp

Filesize
3.9MB

Download
memory/3720-180-0x00007FF6A0730000-0x00007FF6A0B22000-memory.dmp

Filesize
3.9MB

Download
memory/3720-5090-0x00007FF6A0730000-0x00007FF6A0B22000-memory.dmp

Filesize
3.9MB

Download
memory/3724-245-0x00007FF7D9400000-0x00007FF7D97F2000-memory.dmp

Filesize
3.9MB

Download
memory/3724-5092-0x00007FF7D9400000-0x00007FF7D97F2000-memory.dmp

Filesize
3.9MB

Download
memory/3748-5079-0x00007FF7F5F20000-0x00007FF7F6312000-memory.dmp

Filesize
3.9MB

Download
memory/3748-243-0x00007FF7F5F20000-0x00007FF7F6312000-memory.dmp

Filesize
3.9MB

Download
memory/3764-5071-0x00007FF778B80000-0x00007FF778F72000-memory.dmp

Filesize
3.9MB

Download
memory/3764-250-0x00007FF778B80000-0x00007FF778F72000-memory.dmp

Filesize
3.9MB

Download
memory/3976-246-0x00007FF7BB320000-0x00007FF7BB712000-memory.dmp

Filesize
3.9MB

Download
memory/3976-5109-0x00007FF7BB320000-0x00007FF7BB712000-memory.dmp

Filesize
3.9MB

Download
memory/4016-30-0x00007FF6F51D0000-0x00007FF6F55C2000-memory.dmp

Filesize
3.9MB

Download
memory/4300-5083-0x00007FF687DF0000-0x00007FF6881E2000-memory.dmp

Filesize
3.9MB

Download
memory/4300-244-0x00007FF687DF0000-0x00007FF6881E2000-memory.dmp

Filesize
3.9MB

Download
memory/4412-248-0x00007FF764BC0000-0x00007FF764FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4412-5054-0x00007FF764BC0000-0x00007FF764FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4472-25-0x00007FF6E5EF0000-0x00007FF6E62E2000-memory.dmp

Filesize
3.9MB

Download
memory/4504-76-0x00007FF71AA00000-0x00007FF71ADF2000-memory.dmp

Filesize
3.9MB

Download
memory/4664-199-0x000002AB7F430000-0x000002AB7F452000-memory.dmp

Filesize
136KB

Download
memory/4704-5100-0x00007FF7F7120000-0x00007FF7F7512000-memory.dmp

Filesize
3.9MB

Download
memory/4704-251-0x00007FF7F7120000-0x00007FF7F7512000-memory.dmp

Filesize
3.9MB

Download