xmrig | 707c9accc48e8733ec2c841648df291245d999207bb434c0af133d97ccb36ab8

Analysis

max time kernel
42s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
Size

1.9MB
MD5

09376d4b4c0299feb55ebf9c35ef8e63
SHA1

82dda1ecccdcd591a5e4758c2b31de08fb119165
SHA256

707c9accc48e8733ec2c841648df291245d999207bb434c0af133d97ccb36ab8
SHA512

d6de8347c892b0ff266024a42da9be2c2aafce22dc48e5cf41975c9efe9e9a84d28ca0b3e72c89349d6adbc8533c61415000feaf5f26c79bf785b3ebe2ee0713
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UXo:NABf

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/1572-12-0x00007FF6A06F0000-0x00007FF6A0AE2000-memory.dmp	xmrig
behavioral2/memory/3876-14-0x00007FF7B74F0000-0x00007FF7B78E2000-memory.dmp	xmrig
behavioral2/memory/2728-422-0x00007FF734D60000-0x00007FF735152000-memory.dmp	xmrig
behavioral2/memory/4056-437-0x00007FF6DD100000-0x00007FF6DD4F2000-memory.dmp	xmrig
behavioral2/memory/2940-1022-0x00007FF7C9890000-0x00007FF7C9C82000-memory.dmp	xmrig
behavioral2/memory/3468-1047-0x00007FF7C3AA0000-0x00007FF7C3E92000-memory.dmp	xmrig
behavioral2/memory/548-1052-0x00007FF6EB750000-0x00007FF6EBB42000-memory.dmp	xmrig
behavioral2/memory/740-1051-0x00007FF60F1E0000-0x00007FF60F5D2000-memory.dmp	xmrig
behavioral2/memory/1056-1119-0x00007FF6857F0000-0x00007FF685BE2000-memory.dmp	xmrig
behavioral2/memory/4076-1097-0x00007FF7EF250000-0x00007FF7EF642000-memory.dmp	xmrig
behavioral2/memory/4972-1162-0x00007FF7EE4C0000-0x00007FF7EE8B2000-memory.dmp	xmrig
behavioral2/memory/4836-1233-0x00007FF7E17E0000-0x00007FF7E1BD2000-memory.dmp	xmrig
behavioral2/memory/4924-1143-0x00007FF6F0950000-0x00007FF6F0D42000-memory.dmp	xmrig
behavioral2/memory/5112-1078-0x00007FF744820000-0x00007FF744C12000-memory.dmp	xmrig
behavioral2/memory/4024-1069-0x00007FF7C1890000-0x00007FF7C1C82000-memory.dmp	xmrig
behavioral2/memory/2188-1447-0x00007FF696590000-0x00007FF696982000-memory.dmp	xmrig
behavioral2/memory/3624-1390-0x00007FF69B8F0000-0x00007FF69BCE2000-memory.dmp	xmrig
behavioral2/memory/3876-2065-0x00007FF7B74F0000-0x00007FF7B78E2000-memory.dmp	xmrig
behavioral2/memory/740-2164-0x00007FF60F1E0000-0x00007FF60F5D2000-memory.dmp	xmrig
behavioral2/memory/3468-2217-0x00007FF7C3AA0000-0x00007FF7C3E92000-memory.dmp	xmrig
behavioral2/memory/2728-2216-0x00007FF734D60000-0x00007FF735152000-memory.dmp	xmrig
behavioral2/memory/4024-2211-0x00007FF7C1890000-0x00007FF7C1C82000-memory.dmp	xmrig
behavioral2/memory/4076-2208-0x00007FF7EF250000-0x00007FF7EF642000-memory.dmp	xmrig
behavioral2/memory/4972-2191-0x00007FF7EE4C0000-0x00007FF7EE8B2000-memory.dmp	xmrig
behavioral2/memory/3624-2244-0x00007FF69B8F0000-0x00007FF69BCE2000-memory.dmp	xmrig
behavioral2/memory/4924-2243-0x00007FF6F0950000-0x00007FF6F0D42000-memory.dmp	xmrig
behavioral2/memory/4836-2242-0x00007FF7E17E0000-0x00007FF7E1BD2000-memory.dmp	xmrig
behavioral2/memory/544-2241-0x00007FF7210E0000-0x00007FF7214D2000-memory.dmp	xmrig
behavioral2/memory/3692-2240-0x00007FF6AE5A0000-0x00007FF6AE992000-memory.dmp	xmrig
behavioral2/memory/1056-2239-0x00007FF6857F0000-0x00007FF685BE2000-memory.dmp	xmrig
behavioral2/memory/1768-2238-0x00007FF647990000-0x00007FF647D82000-memory.dmp	xmrig
behavioral2/memory/3780-2237-0x00007FF724E40000-0x00007FF725232000-memory.dmp	xmrig
behavioral2/memory/2940-2172-0x00007FF7C9890000-0x00007FF7C9C82000-memory.dmp	xmrig
behavioral2/memory/4056-2112-0x00007FF6DD100000-0x00007FF6DD4F2000-memory.dmp	xmrig
behavioral2/memory/1572-2057-0x00007FF6A06F0000-0x00007FF6A0AE2000-memory.dmp	xmrig
behavioral2/memory/3780-1289-0x00007FF724E40000-0x00007FF725232000-memory.dmp	xmrig
behavioral2/memory/1768-1286-0x00007FF647990000-0x00007FF647D82000-memory.dmp	xmrig
behavioral2/memory/3692-1280-0x00007FF6AE5A0000-0x00007FF6AE992000-memory.dmp	xmrig
behavioral2/memory/544-1272-0x00007FF7210E0000-0x00007FF7214D2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1596	powershell.exe
5	1596	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1572	mkMASPk.exe
3876	UUGzRlG.exe
2188	JqhDMxX.exe
2728	NcbSLCO.exe
4056	jbkSdJh.exe
2940	xnZzAuu.exe
3468	WTaDNpD.exe
740	OtYPGIe.exe
548	vWhZENC.exe
4024	OYcugqh.exe
5112	NmjuxsF.exe
4076	xdhjZDd.exe
1056	tDiNuLf.exe
4924	JlJEUdR.exe
4972	hVXiMyl.exe
4836	ZtASUEW.exe
544	ZtEfgFF.exe
3692	vwtyTSu.exe
1768	JqLDZXy.exe
3780	OaGwYoG.exe
3624	rfbfEUQ.exe
1132	djhqaGk.exe
3852	QMJRpdp.exe
2800	YAmrBhf.exe
3288	zqrqHHN.exe
2784	HSlKYYB.exe
3628	oKOvsYA.exe
1740	bEpesMj.exe
4548	KvBbiCw.exe
1612	hVzEGZS.exe
4764	YaatFSI.exe
3812	NMjxZLj.exe
4912	nVBoGxK.exe
2720	PhLTKBa.exe
1436	UfVqyRx.exe
4396	RKoSJtC.exe
2716	reDfgWB.exe
3348	mOYicSR.exe
4448	fUtnYbr.exe
2484	ubsKxkA.exe
1860	vJkfgVP.exe
3556	ZWUcyFU.exe
3948	cFgmcMz.exe
4324	hJdvFEv.exe
3376	RybEPXA.exe
4424	bNoEkWJ.exe
1844	PWyWlrD.exe
3668	EaNbtMK.exe
4412	yicUtad.exe
4956	vIoxcpW.exe
5128	xnjhtSt.exe
5156	MUHybXh.exe
5184	hdNROfa.exe
5208	OSjeaFF.exe
5232	jRGDqLC.exe
5268	jJwkgDu.exe
5296	cUugkMF.exe
5324	qaopjzs.exe
5364	zbScARL.exe
5384	obqKyjS.exe
5412	uyLioAp.exe
5444	lisGNmj.exe
5480	pDwOKHf.exe
5508	ewsLsFs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3152-0-0x00007FF69DC40000-0x00007FF69E032000-memory.dmp	upx
behavioral2/files/0x000900000002324b-5.dat	upx
behavioral2/files/0x0008000000023251-10.dat	upx
behavioral2/memory/1572-12-0x00007FF6A06F0000-0x00007FF6A0AE2000-memory.dmp	upx
behavioral2/files/0x0007000000023252-9.dat	upx
behavioral2/files/0x000800000002324f-34.dat	upx
behavioral2/files/0x0007000000023255-52.dat	upx
behavioral2/files/0x0008000000023257-59.dat	upx
behavioral2/files/0x0008000000023256-64.dat	upx
behavioral2/files/0x0007000000023259-68.dat	upx
behavioral2/files/0x000700000002325b-79.dat	upx
behavioral2/files/0x000700000002325c-84.dat	upx
behavioral2/files/0x000700000002325d-92.dat	upx
behavioral2/files/0x000700000002325f-100.dat	upx
behavioral2/files/0x0007000000023260-108.dat	upx
behavioral2/files/0x0007000000023263-119.dat	upx
behavioral2/files/0x0007000000023265-130.dat	upx
behavioral2/files/0x0007000000023269-152.dat	upx
behavioral2/files/0x000700000002326e-176.dat	upx
behavioral2/files/0x000700000002326f-175.dat	upx
behavioral2/files/0x000700000002326d-170.dat	upx
behavioral2/files/0x000700000002326c-164.dat	upx
behavioral2/files/0x000700000002326b-162.dat	upx
behavioral2/files/0x000700000002326a-158.dat	upx
behavioral2/files/0x0007000000023268-147.dat	upx
behavioral2/files/0x0007000000023267-143.dat	upx
behavioral2/files/0x0007000000023266-135.dat	upx
behavioral2/files/0x0007000000023264-127.dat	upx
behavioral2/files/0x0007000000023262-115.dat	upx
behavioral2/files/0x0007000000023261-110.dat	upx
behavioral2/files/0x000700000002325e-98.dat	upx
behavioral2/files/0x000700000002325a-75.dat	upx
behavioral2/files/0x0007000000023258-54.dat	upx
behavioral2/files/0x0007000000023254-29.dat	upx
behavioral2/files/0x0007000000023253-25.dat	upx
behavioral2/memory/3876-14-0x00007FF7B74F0000-0x00007FF7B78E2000-memory.dmp	upx
behavioral2/memory/2728-422-0x00007FF734D60000-0x00007FF735152000-memory.dmp	upx
behavioral2/memory/4056-437-0x00007FF6DD100000-0x00007FF6DD4F2000-memory.dmp	upx
behavioral2/memory/2940-1022-0x00007FF7C9890000-0x00007FF7C9C82000-memory.dmp	upx
behavioral2/memory/3468-1047-0x00007FF7C3AA0000-0x00007FF7C3E92000-memory.dmp	upx
behavioral2/memory/548-1052-0x00007FF6EB750000-0x00007FF6EBB42000-memory.dmp	upx
behavioral2/memory/740-1051-0x00007FF60F1E0000-0x00007FF60F5D2000-memory.dmp	upx
behavioral2/memory/1056-1119-0x00007FF6857F0000-0x00007FF685BE2000-memory.dmp	upx
behavioral2/memory/4076-1097-0x00007FF7EF250000-0x00007FF7EF642000-memory.dmp	upx
behavioral2/memory/4972-1162-0x00007FF7EE4C0000-0x00007FF7EE8B2000-memory.dmp	upx
behavioral2/memory/4836-1233-0x00007FF7E17E0000-0x00007FF7E1BD2000-memory.dmp	upx
behavioral2/memory/4924-1143-0x00007FF6F0950000-0x00007FF6F0D42000-memory.dmp	upx
behavioral2/memory/5112-1078-0x00007FF744820000-0x00007FF744C12000-memory.dmp	upx
behavioral2/memory/4024-1069-0x00007FF7C1890000-0x00007FF7C1C82000-memory.dmp	upx
behavioral2/memory/2188-1447-0x00007FF696590000-0x00007FF696982000-memory.dmp	upx
behavioral2/memory/3624-1390-0x00007FF69B8F0000-0x00007FF69BCE2000-memory.dmp	upx
behavioral2/memory/3876-2065-0x00007FF7B74F0000-0x00007FF7B78E2000-memory.dmp	upx
behavioral2/memory/740-2164-0x00007FF60F1E0000-0x00007FF60F5D2000-memory.dmp	upx
behavioral2/memory/3468-2217-0x00007FF7C3AA0000-0x00007FF7C3E92000-memory.dmp	upx
behavioral2/memory/2728-2216-0x00007FF734D60000-0x00007FF735152000-memory.dmp	upx
behavioral2/memory/4024-2211-0x00007FF7C1890000-0x00007FF7C1C82000-memory.dmp	upx
behavioral2/memory/4076-2208-0x00007FF7EF250000-0x00007FF7EF642000-memory.dmp	upx
behavioral2/memory/4972-2191-0x00007FF7EE4C0000-0x00007FF7EE8B2000-memory.dmp	upx
behavioral2/memory/3624-2244-0x00007FF69B8F0000-0x00007FF69BCE2000-memory.dmp	upx
behavioral2/memory/4924-2243-0x00007FF6F0950000-0x00007FF6F0D42000-memory.dmp	upx
behavioral2/memory/4836-2242-0x00007FF7E17E0000-0x00007FF7E1BD2000-memory.dmp	upx
behavioral2/memory/544-2241-0x00007FF7210E0000-0x00007FF7214D2000-memory.dmp	upx
behavioral2/memory/3692-2240-0x00007FF6AE5A0000-0x00007FF6AE992000-memory.dmp	upx
behavioral2/memory/1056-2239-0x00007FF6857F0000-0x00007FF685BE2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KvBbiCw.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\JlQLKjb.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\dUvFXxZ.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\kYbmjcN.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\orMTlzH.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\tBbkPrY.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\AvRPRDf.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\mOYicSR.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\GIYAlel.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\mKdXoxO.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\cHUaXzR.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\QdLViKm.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\UQQQASn.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\LyvksHX.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\hoaePYg.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\glGmLkD.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\VKVMMqD.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\yyIhMXB.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\ZceoDkl.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\bQhyjSI.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\EBEMJHL.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\EgJgCIr.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\qLVyHrO.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\ltWLEWI.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\kmilbTM.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\mLxUfsI.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\hYacvuc.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\sMiJLYl.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\tMlqctq.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\xgJNlhV.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\qJmoGqT.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\YwPgxnK.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\ZtEfgFF.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\EwgYOAb.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\SLRMCpJ.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\zQzScqQ.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\dpMxgWa.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\ziqHfjO.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\tMIsjvA.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\QAEobIx.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\IEEEEzM.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\ZHOfQKJ.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\FYIxRfQ.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\jNyeuUO.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\XcbQMJs.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\aGgIZnA.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\ZtASUEW.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\mXtBxnI.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\GuVMAWm.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\wenMkjB.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\lPITiEL.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\ykaOyHp.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\RCOvRbq.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\DSZhcHn.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\aXybLlg.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\qBHzBGE.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\iRlIdDa.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\ipBRQFS.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\gNaUHJr.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\fXOZJMw.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\KBBNqHM.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\glEjyfA.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\SumRgnK.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
File created	C:\Windows\System\orrHhCc.exe	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
Token: SeDebugPrivilege	1596	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 1596	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	93
PID 3152 wrote to memory of 1596	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	93
PID 3152 wrote to memory of 1572	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	94
PID 3152 wrote to memory of 1572	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	94
PID 3152 wrote to memory of 3876	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	95
PID 3152 wrote to memory of 3876	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	95
PID 3152 wrote to memory of 2188	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	96
PID 3152 wrote to memory of 2188	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	96
PID 3152 wrote to memory of 2728	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	97
PID 3152 wrote to memory of 2728	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	97
PID 3152 wrote to memory of 4056	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	98
PID 3152 wrote to memory of 4056	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	98
PID 3152 wrote to memory of 2940	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	99
PID 3152 wrote to memory of 2940	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	99
PID 3152 wrote to memory of 3468	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	100
PID 3152 wrote to memory of 3468	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	100
PID 3152 wrote to memory of 740	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	101
PID 3152 wrote to memory of 740	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	101
PID 3152 wrote to memory of 548	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	102
PID 3152 wrote to memory of 548	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	102
PID 3152 wrote to memory of 4024	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	103
PID 3152 wrote to memory of 4024	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	103
PID 3152 wrote to memory of 5112	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	104
PID 3152 wrote to memory of 5112	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	104
PID 3152 wrote to memory of 4076	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	105
PID 3152 wrote to memory of 4076	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	105
PID 3152 wrote to memory of 1056	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	106
PID 3152 wrote to memory of 1056	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	106
PID 3152 wrote to memory of 4924	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	107
PID 3152 wrote to memory of 4924	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	107
PID 3152 wrote to memory of 4972	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	108
PID 3152 wrote to memory of 4972	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	108
PID 3152 wrote to memory of 4836	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	109
PID 3152 wrote to memory of 4836	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	109
PID 3152 wrote to memory of 544	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	110
PID 3152 wrote to memory of 544	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	110
PID 3152 wrote to memory of 3692	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	111
PID 3152 wrote to memory of 3692	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	111
PID 3152 wrote to memory of 1768	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	112
PID 3152 wrote to memory of 1768	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	112
PID 3152 wrote to memory of 3780	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	113
PID 3152 wrote to memory of 3780	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	113
PID 3152 wrote to memory of 3624	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	114
PID 3152 wrote to memory of 3624	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	114
PID 3152 wrote to memory of 1132	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	115
PID 3152 wrote to memory of 1132	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	115
PID 3152 wrote to memory of 3852	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	116
PID 3152 wrote to memory of 3852	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	116
PID 3152 wrote to memory of 2800	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	117
PID 3152 wrote to memory of 2800	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	117
PID 3152 wrote to memory of 3288	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	118
PID 3152 wrote to memory of 3288	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	118
PID 3152 wrote to memory of 2784	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	119
PID 3152 wrote to memory of 2784	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	119
PID 3152 wrote to memory of 3628	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	120
PID 3152 wrote to memory of 3628	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	120
PID 3152 wrote to memory of 1740	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	121
PID 3152 wrote to memory of 1740	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	121
PID 3152 wrote to memory of 4548	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	122
PID 3152 wrote to memory of 4548	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	122
PID 3152 wrote to memory of 1612	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	123
PID 3152 wrote to memory of 1612	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	123
PID 3152 wrote to memory of 4764	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	124
PID 3152 wrote to memory of 4764	3152	09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe	124

C:\Users\Admin\AppData\Local\Temp\09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09376d4b4c0299feb55ebf9c35ef8e63_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\System\mkMASPk.exe
  C:\Windows\System\mkMASPk.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\UUGzRlG.exe
  C:\Windows\System\UUGzRlG.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\JqhDMxX.exe
  C:\Windows\System\JqhDMxX.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\NcbSLCO.exe
  C:\Windows\System\NcbSLCO.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\jbkSdJh.exe
  C:\Windows\System\jbkSdJh.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\xnZzAuu.exe
  C:\Windows\System\xnZzAuu.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\WTaDNpD.exe
  C:\Windows\System\WTaDNpD.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\OtYPGIe.exe
  C:\Windows\System\OtYPGIe.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\vWhZENC.exe
  C:\Windows\System\vWhZENC.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\OYcugqh.exe
  C:\Windows\System\OYcugqh.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\NmjuxsF.exe
  C:\Windows\System\NmjuxsF.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\xdhjZDd.exe
  C:\Windows\System\xdhjZDd.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\tDiNuLf.exe
  C:\Windows\System\tDiNuLf.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\JlJEUdR.exe
  C:\Windows\System\JlJEUdR.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\hVXiMyl.exe
  C:\Windows\System\hVXiMyl.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\ZtASUEW.exe
  C:\Windows\System\ZtASUEW.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\ZtEfgFF.exe
  C:\Windows\System\ZtEfgFF.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\vwtyTSu.exe
  C:\Windows\System\vwtyTSu.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\JqLDZXy.exe
  C:\Windows\System\JqLDZXy.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\OaGwYoG.exe
  C:\Windows\System\OaGwYoG.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\rfbfEUQ.exe
  C:\Windows\System\rfbfEUQ.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\djhqaGk.exe
  C:\Windows\System\djhqaGk.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\QMJRpdp.exe
  C:\Windows\System\QMJRpdp.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\YAmrBhf.exe
  C:\Windows\System\YAmrBhf.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\zqrqHHN.exe
  C:\Windows\System\zqrqHHN.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\HSlKYYB.exe
  C:\Windows\System\HSlKYYB.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\oKOvsYA.exe
  C:\Windows\System\oKOvsYA.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\bEpesMj.exe
  C:\Windows\System\bEpesMj.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\KvBbiCw.exe
  C:\Windows\System\KvBbiCw.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\hVzEGZS.exe
  C:\Windows\System\hVzEGZS.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\YaatFSI.exe
  C:\Windows\System\YaatFSI.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\NMjxZLj.exe
  C:\Windows\System\NMjxZLj.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\nVBoGxK.exe
  C:\Windows\System\nVBoGxK.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\PhLTKBa.exe
  C:\Windows\System\PhLTKBa.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\UfVqyRx.exe
  C:\Windows\System\UfVqyRx.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\RKoSJtC.exe
  C:\Windows\System\RKoSJtC.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\reDfgWB.exe
  C:\Windows\System\reDfgWB.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\mOYicSR.exe
  C:\Windows\System\mOYicSR.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\fUtnYbr.exe
  C:\Windows\System\fUtnYbr.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\ubsKxkA.exe
  C:\Windows\System\ubsKxkA.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\vJkfgVP.exe
  C:\Windows\System\vJkfgVP.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\ZWUcyFU.exe
  C:\Windows\System\ZWUcyFU.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\cFgmcMz.exe
  C:\Windows\System\cFgmcMz.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\hJdvFEv.exe
  C:\Windows\System\hJdvFEv.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\RybEPXA.exe
  C:\Windows\System\RybEPXA.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\bNoEkWJ.exe
  C:\Windows\System\bNoEkWJ.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\PWyWlrD.exe
  C:\Windows\System\PWyWlrD.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\EaNbtMK.exe
  C:\Windows\System\EaNbtMK.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\yicUtad.exe
  C:\Windows\System\yicUtad.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\vIoxcpW.exe
  C:\Windows\System\vIoxcpW.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\xnjhtSt.exe
  C:\Windows\System\xnjhtSt.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\MUHybXh.exe
  C:\Windows\System\MUHybXh.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\hdNROfa.exe
  C:\Windows\System\hdNROfa.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\OSjeaFF.exe
  C:\Windows\System\OSjeaFF.exe
  2⤵
  - Executes dropped EXE
  PID:5208
- C:\Windows\System\jRGDqLC.exe
  C:\Windows\System\jRGDqLC.exe
  2⤵
  - Executes dropped EXE
  PID:5232
- C:\Windows\System\jJwkgDu.exe
  C:\Windows\System\jJwkgDu.exe
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Windows\System\cUugkMF.exe
  C:\Windows\System\cUugkMF.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System\qaopjzs.exe
  C:\Windows\System\qaopjzs.exe
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Windows\System\zbScARL.exe
  C:\Windows\System\zbScARL.exe
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\System\obqKyjS.exe
  C:\Windows\System\obqKyjS.exe
  2⤵
  - Executes dropped EXE
  PID:5384
- C:\Windows\System\uyLioAp.exe
  C:\Windows\System\uyLioAp.exe
  2⤵
  - Executes dropped EXE
  PID:5412
- C:\Windows\System\lisGNmj.exe
  C:\Windows\System\lisGNmj.exe
  2⤵
  - Executes dropped EXE
  PID:5444
- C:\Windows\System\pDwOKHf.exe
  C:\Windows\System\pDwOKHf.exe
  2⤵
  - Executes dropped EXE
  PID:5480
- C:\Windows\System\ewsLsFs.exe
  C:\Windows\System\ewsLsFs.exe
  2⤵
  - Executes dropped EXE
  PID:5508
- C:\Windows\System\hvZoxOM.exe
  C:\Windows\System\hvZoxOM.exe
  2⤵
  PID:5536
- C:\Windows\System\MFVNlWw.exe
  C:\Windows\System\MFVNlWw.exe
  2⤵
  PID:5564
- C:\Windows\System\xnKrKnM.exe
  C:\Windows\System\xnKrKnM.exe
  2⤵
  PID:5592
- C:\Windows\System\bkgygAD.exe
  C:\Windows\System\bkgygAD.exe
  2⤵
  PID:5616
- C:\Windows\System\QPyZdUR.exe
  C:\Windows\System\QPyZdUR.exe
  2⤵
  PID:5648
- C:\Windows\System\gublkmp.exe
  C:\Windows\System\gublkmp.exe
  2⤵
  PID:5676
- C:\Windows\System\XhXeTLv.exe
  C:\Windows\System\XhXeTLv.exe
  2⤵
  PID:5708
- C:\Windows\System\VqWwgcy.exe
  C:\Windows\System\VqWwgcy.exe
  2⤵
  PID:5744
- C:\Windows\System\KScdvVd.exe
  C:\Windows\System\KScdvVd.exe
  2⤵
  PID:5764
- C:\Windows\System\OVnBnDN.exe
  C:\Windows\System\OVnBnDN.exe
  2⤵
  PID:5812
- C:\Windows\System\vuZzhxV.exe
  C:\Windows\System\vuZzhxV.exe
  2⤵
  PID:5836
- C:\Windows\System\JptTfET.exe
  C:\Windows\System\JptTfET.exe
  2⤵
  PID:5868
- C:\Windows\System\WFhKDdm.exe
  C:\Windows\System\WFhKDdm.exe
  2⤵
  PID:5904
- C:\Windows\System\DvAxbIf.exe
  C:\Windows\System\DvAxbIf.exe
  2⤵
  PID:5920
- C:\Windows\System\XyjXMyT.exe
  C:\Windows\System\XyjXMyT.exe
  2⤵
  PID:5948
- C:\Windows\System\WkhzhIn.exe
  C:\Windows\System\WkhzhIn.exe
  2⤵
  PID:5972
- C:\Windows\System\iaTPNtj.exe
  C:\Windows\System\iaTPNtj.exe
  2⤵
  PID:6012
- C:\Windows\System\RCOvRbq.exe
  C:\Windows\System\RCOvRbq.exe
  2⤵
  PID:6032
- C:\Windows\System\ppZskiT.exe
  C:\Windows\System\ppZskiT.exe
  2⤵
  PID:6052
- C:\Windows\System\xauCpYL.exe
  C:\Windows\System\xauCpYL.exe
  2⤵
  PID:6076
- C:\Windows\System\tfeHTCp.exe
  C:\Windows\System\tfeHTCp.exe
  2⤵
  PID:6104
- C:\Windows\System\GIYAlel.exe
  C:\Windows\System\GIYAlel.exe
  2⤵
  PID:6128
- C:\Windows\System\sFUFKCc.exe
  C:\Windows\System\sFUFKCc.exe
  2⤵
  PID:4216
- C:\Windows\System\QyyfKnl.exe
  C:\Windows\System\QyyfKnl.exe
  2⤵
  PID:3428
- C:\Windows\System\NFsYGMj.exe
  C:\Windows\System\NFsYGMj.exe
  2⤵
  PID:5280
- C:\Windows\System\ipXhAEk.exe
  C:\Windows\System\ipXhAEk.exe
  2⤵
  PID:5116
- C:\Windows\System\tcbojGT.exe
  C:\Windows\System\tcbojGT.exe
  2⤵
  PID:5360
- C:\Windows\System\GAXbOLv.exe
  C:\Windows\System\GAXbOLv.exe
  2⤵
  PID:5404
- C:\Windows\System\WbswOHB.exe
  C:\Windows\System\WbswOHB.exe
  2⤵
  PID:5456
- C:\Windows\System\mnkiIuD.exe
  C:\Windows\System\mnkiIuD.exe
  2⤵
  PID:5492
- C:\Windows\System\ghfWorW.exe
  C:\Windows\System\ghfWorW.exe
  2⤵
  PID:2096
- C:\Windows\System\gXkzEtW.exe
  C:\Windows\System\gXkzEtW.exe
  2⤵
  PID:5580
- C:\Windows\System\MKKbUwj.exe
  C:\Windows\System\MKKbUwj.exe
  2⤵
  PID:4048
- C:\Windows\System\ydYFdSD.exe
  C:\Windows\System\ydYFdSD.exe
  2⤵
  PID:4052
- C:\Windows\System\PaASUnc.exe
  C:\Windows\System\PaASUnc.exe
  2⤵
  PID:5696
- C:\Windows\System\eQpakig.exe
  C:\Windows\System\eQpakig.exe
  2⤵
  PID:5728
- C:\Windows\System\RExvDYO.exe
  C:\Windows\System\RExvDYO.exe
  2⤵
  PID:5772
- C:\Windows\System\XvWnTpZ.exe
  C:\Windows\System\XvWnTpZ.exe
  2⤵
  PID:5792
- C:\Windows\System\XPIzjbq.exe
  C:\Windows\System\XPIzjbq.exe
  2⤵
  PID:2932
- C:\Windows\System\DXrbqsX.exe
  C:\Windows\System\DXrbqsX.exe
  2⤵
  PID:2668
- C:\Windows\System\aKJQUGB.exe
  C:\Windows\System\aKJQUGB.exe
  2⤵
  PID:5852
- C:\Windows\System\hoaePYg.exe
  C:\Windows\System\hoaePYg.exe
  2⤵
  PID:5884
- C:\Windows\System\Sjydinb.exe
  C:\Windows\System\Sjydinb.exe
  2⤵
  PID:4184
- C:\Windows\System\ZivoITs.exe
  C:\Windows\System\ZivoITs.exe
  2⤵
  PID:5960
- C:\Windows\System\CkPakFR.exe
  C:\Windows\System\CkPakFR.exe
  2⤵
  PID:3660
- C:\Windows\System\lksygme.exe
  C:\Windows\System\lksygme.exe
  2⤵
  PID:5988
- C:\Windows\System\TCSSzrh.exe
  C:\Windows\System\TCSSzrh.exe
  2⤵
  PID:6024
- C:\Windows\System\vyWRknz.exe
  C:\Windows\System\vyWRknz.exe
  2⤵
  PID:6060
- C:\Windows\System\JlrshWv.exe
  C:\Windows\System\JlrshWv.exe
  2⤵
  PID:4356
- C:\Windows\System\HByCald.exe
  C:\Windows\System\HByCald.exe
  2⤵
  PID:6100
- C:\Windows\System\FeZCTqw.exe
  C:\Windows\System\FeZCTqw.exe
  2⤵
  PID:3768
- C:\Windows\System\IPLEXnX.exe
  C:\Windows\System\IPLEXnX.exe
  2⤵
  PID:3044
- C:\Windows\System\xKsgSkP.exe
  C:\Windows\System\xKsgSkP.exe
  2⤵
  PID:212
- C:\Windows\System\gNaUHJr.exe
  C:\Windows\System\gNaUHJr.exe
  2⤵
  PID:5408
- C:\Windows\System\KLjAcxP.exe
  C:\Windows\System\KLjAcxP.exe
  2⤵
  PID:2232
- C:\Windows\System\vPtpxmy.exe
  C:\Windows\System\vPtpxmy.exe
  2⤵
  PID:5344
- C:\Windows\System\qLVyHrO.exe
  C:\Windows\System\qLVyHrO.exe
  2⤵
  PID:5996
- C:\Windows\System\OLxzNDI.exe
  C:\Windows\System\OLxzNDI.exe
  2⤵
  PID:5936
- C:\Windows\System\NSvzWFa.exe
  C:\Windows\System\NSvzWFa.exe
  2⤵
  PID:5716
- C:\Windows\System\SzStMHe.exe
  C:\Windows\System\SzStMHe.exe
  2⤵
  PID:3884
- C:\Windows\System\tZsPzBE.exe
  C:\Windows\System\tZsPzBE.exe
  2⤵
  PID:4428
- C:\Windows\System\ekrtIkG.exe
  C:\Windows\System\ekrtIkG.exe
  2⤵
  PID:2768
- C:\Windows\System\glGmLkD.exe
  C:\Windows\System\glGmLkD.exe
  2⤵
  PID:5604
- C:\Windows\System\ykRnVOj.exe
  C:\Windows\System\ykRnVOj.exe
  2⤵
  PID:4516
- C:\Windows\System\YvkGlRS.exe
  C:\Windows\System\YvkGlRS.exe
  2⤵
  PID:5292
- C:\Windows\System\VBzzctH.exe
  C:\Windows\System\VBzzctH.exe
  2⤵
  PID:5520
- C:\Windows\System\TyuLgqV.exe
  C:\Windows\System\TyuLgqV.exe
  2⤵
  PID:6116
- C:\Windows\System\FGSNStK.exe
  C:\Windows\System\FGSNStK.exe
  2⤵
  PID:6168
- C:\Windows\System\nHHfdIa.exe
  C:\Windows\System\nHHfdIa.exe
  2⤵
  PID:6208
- C:\Windows\System\biZdCQy.exe
  C:\Windows\System\biZdCQy.exe
  2⤵
  PID:6264
- C:\Windows\System\kgQSHtd.exe
  C:\Windows\System\kgQSHtd.exe
  2⤵
  PID:6332
- C:\Windows\System\kijuBYr.exe
  C:\Windows\System\kijuBYr.exe
  2⤵
  PID:6352
- C:\Windows\System\snDbjUD.exe
  C:\Windows\System\snDbjUD.exe
  2⤵
  PID:6400
- C:\Windows\System\DhoZKZm.exe
  C:\Windows\System\DhoZKZm.exe
  2⤵
  PID:6440
- C:\Windows\System\SFCgcLl.exe
  C:\Windows\System\SFCgcLl.exe
  2⤵
  PID:6464
- C:\Windows\System\IjhRicg.exe
  C:\Windows\System\IjhRicg.exe
  2⤵
  PID:6500
- C:\Windows\System\mPCEknp.exe
  C:\Windows\System\mPCEknp.exe
  2⤵
  PID:6528
- C:\Windows\System\QniIcpr.exe
  C:\Windows\System\QniIcpr.exe
  2⤵
  PID:6548
- C:\Windows\System\iogiuGO.exe
  C:\Windows\System\iogiuGO.exe
  2⤵
  PID:6564
- C:\Windows\System\qasjGtd.exe
  C:\Windows\System\qasjGtd.exe
  2⤵
  PID:6604
- C:\Windows\System\LUaSQtX.exe
  C:\Windows\System\LUaSQtX.exe
  2⤵
  PID:6628
- C:\Windows\System\FONQDIn.exe
  C:\Windows\System\FONQDIn.exe
  2⤵
  PID:6652
- C:\Windows\System\jkMBLec.exe
  C:\Windows\System\jkMBLec.exe
  2⤵
  PID:6692
- C:\Windows\System\voHLkbW.exe
  C:\Windows\System\voHLkbW.exe
  2⤵
  PID:6724
- C:\Windows\System\yaTDAZw.exe
  C:\Windows\System\yaTDAZw.exe
  2⤵
  PID:6748
- C:\Windows\System\ambhpGM.exe
  C:\Windows\System\ambhpGM.exe
  2⤵
  PID:6780
- C:\Windows\System\PMjAplA.exe
  C:\Windows\System\PMjAplA.exe
  2⤵
  PID:6796
- C:\Windows\System\LLwwunQ.exe
  C:\Windows\System\LLwwunQ.exe
  2⤵
  PID:6828
- C:\Windows\System\buunGRs.exe
  C:\Windows\System\buunGRs.exe
  2⤵
  PID:6852
- C:\Windows\System\XrbFDuM.exe
  C:\Windows\System\XrbFDuM.exe
  2⤵
  PID:6872
- C:\Windows\System\LhbNPMj.exe
  C:\Windows\System\LhbNPMj.exe
  2⤵
  PID:6892
- C:\Windows\System\oNiDNdH.exe
  C:\Windows\System\oNiDNdH.exe
  2⤵
  PID:6912
- C:\Windows\System\oBvZVMn.exe
  C:\Windows\System\oBvZVMn.exe
  2⤵
  PID:6956
- C:\Windows\System\mKdXoxO.exe
  C:\Windows\System\mKdXoxO.exe
  2⤵
  PID:7012
- C:\Windows\System\kOYikgI.exe
  C:\Windows\System\kOYikgI.exe
  2⤵
  PID:7028
- C:\Windows\System\ZEZhfVV.exe
  C:\Windows\System\ZEZhfVV.exe
  2⤵
  PID:7048
- C:\Windows\System\hBBIAWi.exe
  C:\Windows\System\hBBIAWi.exe
  2⤵
  PID:7072
- C:\Windows\System\aBjzMZc.exe
  C:\Windows\System\aBjzMZc.exe
  2⤵
  PID:7108
- C:\Windows\System\siRfSHz.exe
  C:\Windows\System\siRfSHz.exe
  2⤵
  PID:3156
- C:\Windows\System\qwPrpvd.exe
  C:\Windows\System\qwPrpvd.exe
  2⤵
  PID:2612
- C:\Windows\System\dgRrsXH.exe
  C:\Windows\System\dgRrsXH.exe
  2⤵
  PID:6160
- C:\Windows\System\XBNirTk.exe
  C:\Windows\System\XBNirTk.exe
  2⤵
  PID:5396
- C:\Windows\System\cyMNfmA.exe
  C:\Windows\System\cyMNfmA.exe
  2⤵
  PID:2540
- C:\Windows\System\BbJdvwe.exe
  C:\Windows\System\BbJdvwe.exe
  2⤵
  PID:6204
- C:\Windows\System\QXzXFWD.exe
  C:\Windows\System\QXzXFWD.exe
  2⤵
  PID:6316
- C:\Windows\System\zqrjIIN.exe
  C:\Windows\System\zqrjIIN.exe
  2⤵
  PID:6364
- C:\Windows\System\GvnMfMg.exe
  C:\Windows\System\GvnMfMg.exe
  2⤵
  PID:6300
- C:\Windows\System\coSvlNk.exe
  C:\Windows\System\coSvlNk.exe
  2⤵
  PID:3712
- C:\Windows\System\ASVARce.exe
  C:\Windows\System\ASVARce.exe
  2⤵
  PID:6432
- C:\Windows\System\uECydBO.exe
  C:\Windows\System\uECydBO.exe
  2⤵
  PID:6560
- C:\Windows\System\nWzkEii.exe
  C:\Windows\System\nWzkEii.exe
  2⤵
  PID:6496
- C:\Windows\System\ryJzTjO.exe
  C:\Windows\System\ryJzTjO.exe
  2⤵
  PID:6648
- C:\Windows\System\oWvxiFp.exe
  C:\Windows\System\oWvxiFp.exe
  2⤵
  PID:6732
- C:\Windows\System\KhPbQDU.exe
  C:\Windows\System\KhPbQDU.exe
  2⤵
  PID:6888
- C:\Windows\System\drOwOrr.exe
  C:\Windows\System\drOwOrr.exe
  2⤵
  PID:6984
- C:\Windows\System\gzUAUWs.exe
  C:\Windows\System\gzUAUWs.exe
  2⤵
  PID:7104
- C:\Windows\System\yPQSipq.exe
  C:\Windows\System\yPQSipq.exe
  2⤵
  PID:7136
- C:\Windows\System\bqOHKEw.exe
  C:\Windows\System\bqOHKEw.exe
  2⤵
  PID:4352
- C:\Windows\System\VKVMMqD.exe
  C:\Windows\System\VKVMMqD.exe
  2⤵
  PID:4776
- C:\Windows\System\MUUtkOb.exe
  C:\Windows\System\MUUtkOb.exe
  2⤵
  PID:6292
- C:\Windows\System\fctPABO.exe
  C:\Windows\System\fctPABO.exe
  2⤵
  PID:5552
- C:\Windows\System\HGUUyTI.exe
  C:\Windows\System\HGUUyTI.exe
  2⤵
  PID:6644
- C:\Windows\System\cYeqnau.exe
  C:\Windows\System\cYeqnau.exe
  2⤵
  PID:6396
- C:\Windows\System\IUTdIzJ.exe
  C:\Windows\System\IUTdIzJ.exe
  2⤵
  PID:7044
- C:\Windows\System\yHcgrvo.exe
  C:\Windows\System\yHcgrvo.exe
  2⤵
  PID:7024
- C:\Windows\System\SMOPRtN.exe
  C:\Windows\System\SMOPRtN.exe
  2⤵
  PID:7100
- C:\Windows\System\SUwRaoa.exe
  C:\Windows\System\SUwRaoa.exe
  2⤵
  PID:6312
- C:\Windows\System\PXwIGcz.exe
  C:\Windows\System\PXwIGcz.exe
  2⤵
  PID:6456
- C:\Windows\System\fIKKDDv.exe
  C:\Windows\System\fIKKDDv.exe
  2⤵
  PID:6556
- C:\Windows\System\kkfNmIe.exe
  C:\Windows\System\kkfNmIe.exe
  2⤵
  PID:7208
- C:\Windows\System\GNREtia.exe
  C:\Windows\System\GNREtia.exe
  2⤵
  PID:7228
- C:\Windows\System\fscpaMM.exe
  C:\Windows\System\fscpaMM.exe
  2⤵
  PID:7292
- C:\Windows\System\wpWNxyk.exe
  C:\Windows\System\wpWNxyk.exe
  2⤵
  PID:7308
- C:\Windows\System\pCNjVGL.exe
  C:\Windows\System\pCNjVGL.exe
  2⤵
  PID:7336
- C:\Windows\System\UlaWghm.exe
  C:\Windows\System\UlaWghm.exe
  2⤵
  PID:7356
- C:\Windows\System\yWijRBY.exe
  C:\Windows\System\yWijRBY.exe
  2⤵
  PID:7380
- C:\Windows\System\qBHzBGE.exe
  C:\Windows\System\qBHzBGE.exe
  2⤵
  PID:7400
- C:\Windows\System\WQUwpzr.exe
  C:\Windows\System\WQUwpzr.exe
  2⤵
  PID:7460
- C:\Windows\System\HYyRjSm.exe
  C:\Windows\System\HYyRjSm.exe
  2⤵
  PID:7480
- C:\Windows\System\bZylQoT.exe
  C:\Windows\System\bZylQoT.exe
  2⤵
  PID:7496
- C:\Windows\System\HAFmYad.exe
  C:\Windows\System\HAFmYad.exe
  2⤵
  PID:7544
- C:\Windows\System\xvqpmaa.exe
  C:\Windows\System\xvqpmaa.exe
  2⤵
  PID:7568
- C:\Windows\System\PXFXNdx.exe
  C:\Windows\System\PXFXNdx.exe
  2⤵
  PID:7588
- C:\Windows\System\yLfjnPg.exe
  C:\Windows\System\yLfjnPg.exe
  2⤵
  PID:7608
- C:\Windows\System\HEeGJoZ.exe
  C:\Windows\System\HEeGJoZ.exe
  2⤵
  PID:7628
- C:\Windows\System\emDqBbF.exe
  C:\Windows\System\emDqBbF.exe
  2⤵
  PID:7660
- C:\Windows\System\nNviZga.exe
  C:\Windows\System\nNviZga.exe
  2⤵
  PID:7680
- C:\Windows\System\wGQmwmY.exe
  C:\Windows\System\wGQmwmY.exe
  2⤵
  PID:7720
- C:\Windows\System\gVrDWlG.exe
  C:\Windows\System\gVrDWlG.exe
  2⤵
  PID:7744
- C:\Windows\System\KtIvyIe.exe
  C:\Windows\System\KtIvyIe.exe
  2⤵
  PID:7768
- C:\Windows\System\yvDkGPg.exe
  C:\Windows\System\yvDkGPg.exe
  2⤵
  PID:7788
- C:\Windows\System\mXtBxnI.exe
  C:\Windows\System\mXtBxnI.exe
  2⤵
  PID:7824
- C:\Windows\System\sPMFXpv.exe
  C:\Windows\System\sPMFXpv.exe
  2⤵
  PID:7876
- C:\Windows\System\BABUaBE.exe
  C:\Windows\System\BABUaBE.exe
  2⤵
  PID:7904
- C:\Windows\System\zNuaaDn.exe
  C:\Windows\System\zNuaaDn.exe
  2⤵
  PID:7936
- C:\Windows\System\enpYyKJ.exe
  C:\Windows\System\enpYyKJ.exe
  2⤵
  PID:7956
- C:\Windows\System\EzIuYrZ.exe
  C:\Windows\System\EzIuYrZ.exe
  2⤵
  PID:7976
- C:\Windows\System\CKOaWIL.exe
  C:\Windows\System\CKOaWIL.exe
  2⤵
  PID:8000
- C:\Windows\System\kfHENzg.exe
  C:\Windows\System\kfHENzg.exe
  2⤵
  PID:8032
- C:\Windows\System\PtgHNdJ.exe
  C:\Windows\System\PtgHNdJ.exe
  2⤵
  PID:8052
- C:\Windows\System\pBsTtQV.exe
  C:\Windows\System\pBsTtQV.exe
  2⤵
  PID:8092
- C:\Windows\System\DblJvRi.exe
  C:\Windows\System\DblJvRi.exe
  2⤵
  PID:8116
- C:\Windows\System\GQpDjgb.exe
  C:\Windows\System\GQpDjgb.exe
  2⤵
  PID:8140
- C:\Windows\System\ltWLEWI.exe
  C:\Windows\System\ltWLEWI.exe
  2⤵
  PID:8160
- C:\Windows\System\nkXsSjZ.exe
  C:\Windows\System\nkXsSjZ.exe
  2⤵
  PID:8180
- C:\Windows\System\nFQLNpK.exe
  C:\Windows\System\nFQLNpK.exe
  2⤵
  PID:7056
- C:\Windows\System\ADMBJMI.exe
  C:\Windows\System\ADMBJMI.exe
  2⤵
  PID:6992
- C:\Windows\System\hKGyAWd.exe
  C:\Windows\System\hKGyAWd.exe
  2⤵
  PID:6436
- C:\Windows\System\GuVMAWm.exe
  C:\Windows\System\GuVMAWm.exe
  2⤵
  PID:7196
- C:\Windows\System\fzOdZCP.exe
  C:\Windows\System\fzOdZCP.exe
  2⤵
  PID:7220
- C:\Windows\System\sbOHwiJ.exe
  C:\Windows\System\sbOHwiJ.exe
  2⤵
  PID:7284
- C:\Windows\System\yXWYHCH.exe
  C:\Windows\System\yXWYHCH.exe
  2⤵
  PID:7348
- C:\Windows\System\keuOtAV.exe
  C:\Windows\System\keuOtAV.exe
  2⤵
  PID:7352
- C:\Windows\System\HhbMcYc.exe
  C:\Windows\System\HhbMcYc.exe
  2⤵
  PID:7416
- C:\Windows\System\bsNYOVu.exe
  C:\Windows\System\bsNYOVu.exe
  2⤵
  PID:7452
- C:\Windows\System\kEPiBrd.exe
  C:\Windows\System\kEPiBrd.exe
  2⤵
  PID:7532
- C:\Windows\System\SQjxCYI.exe
  C:\Windows\System\SQjxCYI.exe
  2⤵
  PID:7536
- C:\Windows\System\KhWsKzY.exe
  C:\Windows\System\KhWsKzY.exe
  2⤵
  PID:7580
- C:\Windows\System\AIatQln.exe
  C:\Windows\System\AIatQln.exe
  2⤵
  PID:7600
- C:\Windows\System\rJWmbYf.exe
  C:\Windows\System\rJWmbYf.exe
  2⤵
  PID:7648
- C:\Windows\System\dXIAxbp.exe
  C:\Windows\System\dXIAxbp.exe
  2⤵
  PID:7752
- C:\Windows\System\FEjVaan.exe
  C:\Windows\System\FEjVaan.exe
  2⤵
  PID:7756
- C:\Windows\System\sOntOJW.exe
  C:\Windows\System\sOntOJW.exe
  2⤵
  PID:7820
- C:\Windows\System\aXjSwjB.exe
  C:\Windows\System\aXjSwjB.exe
  2⤵
  PID:7868
- C:\Windows\System\kmilbTM.exe
  C:\Windows\System\kmilbTM.exe
  2⤵
  PID:7928
- C:\Windows\System\GdSSShl.exe
  C:\Windows\System\GdSSShl.exe
  2⤵
  PID:7992
- C:\Windows\System\huzZcoW.exe
  C:\Windows\System\huzZcoW.exe
  2⤵
  PID:8020
- C:\Windows\System\qnRMiiy.exe
  C:\Windows\System\qnRMiiy.exe
  2⤵
  PID:8044
- C:\Windows\System\whDtazF.exe
  C:\Windows\System\whDtazF.exe
  2⤵
  PID:8100
- C:\Windows\System\BUKDTBi.exe
  C:\Windows\System\BUKDTBi.exe
  2⤵
  PID:8108
- C:\Windows\System\TYaySXT.exe
  C:\Windows\System\TYaySXT.exe
  2⤵
  PID:5248
- C:\Windows\System\LqjcOHn.exe
  C:\Windows\System\LqjcOHn.exe
  2⤵
  PID:7300
- C:\Windows\System\ZrWUXMv.exe
  C:\Windows\System\ZrWUXMv.exe
  2⤵
  PID:8136
- C:\Windows\System\oSSPZgO.exe
  C:\Windows\System\oSSPZgO.exe
  2⤵
  PID:8132
- C:\Windows\System\zOGIWUF.exe
  C:\Windows\System\zOGIWUF.exe
  2⤵
  PID:7488
- C:\Windows\System\gQbsjDd.exe
  C:\Windows\System\gQbsjDd.exe
  2⤵
  PID:7944
- C:\Windows\System\SGozMta.exe
  C:\Windows\System\SGozMta.exe
  2⤵
  PID:7368
- C:\Windows\System\PckvunS.exe
  C:\Windows\System\PckvunS.exe
  2⤵
  PID:7716
- C:\Windows\System\DKIjnxG.exe
  C:\Windows\System\DKIjnxG.exe
  2⤵
  PID:8084
- C:\Windows\System\VUcZaUu.exe
  C:\Windows\System\VUcZaUu.exe
  2⤵
  PID:8212
- C:\Windows\System\ElQRRDX.exe
  C:\Windows\System\ElQRRDX.exe
  2⤵
  PID:8236
- C:\Windows\System\uKboQzR.exe
  C:\Windows\System\uKboQzR.exe
  2⤵
  PID:8256
- C:\Windows\System\ltxiquI.exe
  C:\Windows\System\ltxiquI.exe
  2⤵
  PID:8272
- C:\Windows\System\OxIzTCR.exe
  C:\Windows\System\OxIzTCR.exe
  2⤵
  PID:8292
- C:\Windows\System\asfhwXp.exe
  C:\Windows\System\asfhwXp.exe
  2⤵
  PID:8312
- C:\Windows\System\ydWoiWI.exe
  C:\Windows\System\ydWoiWI.exe
  2⤵
  PID:8332
- C:\Windows\System\RMvKmOe.exe
  C:\Windows\System\RMvKmOe.exe
  2⤵
  PID:8356
- C:\Windows\System\NjQgvXX.exe
  C:\Windows\System\NjQgvXX.exe
  2⤵
  PID:8376
- C:\Windows\System\HEaNvNK.exe
  C:\Windows\System\HEaNvNK.exe
  2⤵
  PID:8396
- C:\Windows\System\JlQLKjb.exe
  C:\Windows\System\JlQLKjb.exe
  2⤵
  PID:8420
- C:\Windows\System\IpIYXbM.exe
  C:\Windows\System\IpIYXbM.exe
  2⤵
  PID:8440
- C:\Windows\System\BOKACkt.exe
  C:\Windows\System\BOKACkt.exe
  2⤵
  PID:8468
- C:\Windows\System\AyOMXay.exe
  C:\Windows\System\AyOMXay.exe
  2⤵
  PID:8488
- C:\Windows\System\ShNwKKX.exe
  C:\Windows\System\ShNwKKX.exe
  2⤵
  PID:8508
- C:\Windows\System\JcwzcRq.exe
  C:\Windows\System\JcwzcRq.exe
  2⤵
  PID:8528
- C:\Windows\System\IrlFsBc.exe
  C:\Windows\System\IrlFsBc.exe
  2⤵
  PID:8548
- C:\Windows\System\cOjZqrR.exe
  C:\Windows\System\cOjZqrR.exe
  2⤵
  PID:8572
- C:\Windows\System\lMLAcNt.exe
  C:\Windows\System\lMLAcNt.exe
  2⤵
  PID:8588
- C:\Windows\System\NALckUg.exe
  C:\Windows\System\NALckUg.exe
  2⤵
  PID:8612
- C:\Windows\System\rOVIUWR.exe
  C:\Windows\System\rOVIUWR.exe
  2⤵
  PID:8632
- C:\Windows\System\tMIsjvA.exe
  C:\Windows\System\tMIsjvA.exe
  2⤵
  PID:8656
- C:\Windows\System\NHYedNf.exe
  C:\Windows\System\NHYedNf.exe
  2⤵
  PID:8676
- C:\Windows\System\jCiXdqf.exe
  C:\Windows\System\jCiXdqf.exe
  2⤵
  PID:8692
- C:\Windows\System\TZhyPDh.exe
  C:\Windows\System\TZhyPDh.exe
  2⤵
  PID:8716
- C:\Windows\System\FSUoPEO.exe
  C:\Windows\System\FSUoPEO.exe
  2⤵
  PID:8736
- C:\Windows\System\vddIlyk.exe
  C:\Windows\System\vddIlyk.exe
  2⤵
  PID:8756
- C:\Windows\System\elMXYmj.exe
  C:\Windows\System\elMXYmj.exe
  2⤵
  PID:8780
- C:\Windows\System\wvhxkwb.exe
  C:\Windows\System\wvhxkwb.exe
  2⤵
  PID:8800
- C:\Windows\System\mLxUfsI.exe
  C:\Windows\System\mLxUfsI.exe
  2⤵
  PID:8824
- C:\Windows\System\LVwqRtW.exe
  C:\Windows\System\LVwqRtW.exe
  2⤵
  PID:8952
- C:\Windows\System\XZgHRdr.exe
  C:\Windows\System\XZgHRdr.exe
  2⤵
  PID:8968
- C:\Windows\System\TUdgsly.exe
  C:\Windows\System\TUdgsly.exe
  2⤵
  PID:8992
- C:\Windows\System\YaMTdVd.exe
  C:\Windows\System\YaMTdVd.exe
  2⤵
  PID:9008
- C:\Windows\System\YzYueoF.exe
  C:\Windows\System\YzYueoF.exe
  2⤵
  PID:9032
- C:\Windows\System\XmbGpwr.exe
  C:\Windows\System\XmbGpwr.exe
  2⤵
  PID:9052
- C:\Windows\System\hYacvuc.exe
  C:\Windows\System\hYacvuc.exe
  2⤵
  PID:9072
- C:\Windows\System\JaxhJRw.exe
  C:\Windows\System\JaxhJRw.exe
  2⤵
  PID:9100
- C:\Windows\System\bgaINJB.exe
  C:\Windows\System\bgaINJB.exe
  2⤵
  PID:9120
- C:\Windows\System\mTPuCeI.exe
  C:\Windows\System\mTPuCeI.exe
  2⤵
  PID:9080
- C:\Windows\System\sensPdI.exe
  C:\Windows\System\sensPdI.exe
  2⤵
  PID:8484
- C:\Windows\System\EosTLpb.exe
  C:\Windows\System\EosTLpb.exe
  2⤵
  PID:7264
- C:\Windows\System\cHUaXzR.exe
  C:\Windows\System\cHUaXzR.exe
  2⤵
  PID:8764
- C:\Windows\System\oEgrukE.exe
  C:\Windows\System\oEgrukE.exe
  2⤵
  PID:8392
- C:\Windows\System\ubNCMdh.exe
  C:\Windows\System\ubNCMdh.exe
  2⤵
  PID:8628
- C:\Windows\System\BCKvAHB.exe
  C:\Windows\System\BCKvAHB.exe
  2⤵
  PID:8648
- C:\Windows\System\yyIhMXB.exe
  C:\Windows\System\yyIhMXB.exe
  2⤵
  PID:8456
- C:\Windows\System\fXOZJMw.exe
  C:\Windows\System\fXOZJMw.exe
  2⤵
  PID:9024
- C:\Windows\System\TGcfTmY.exe
  C:\Windows\System\TGcfTmY.exe
  2⤵
  PID:9180
- C:\Windows\System\VJXejfF.exe
  C:\Windows\System\VJXejfF.exe
  2⤵
  PID:9004
- C:\Windows\System\XCLPnXK.exe
  C:\Windows\System\XCLPnXK.exe
  2⤵
  PID:7816
- C:\Windows\System\MrgRULf.exe
  C:\Windows\System\MrgRULf.exe
  2⤵
  PID:8048
- C:\Windows\System\PvjlJEm.exe
  C:\Windows\System\PvjlJEm.exe
  2⤵
  PID:7804
- C:\Windows\System\AVcmtfC.exe
  C:\Windows\System\AVcmtfC.exe
  2⤵
  PID:7656
- C:\Windows\System\RSadfwN.exe
  C:\Windows\System\RSadfwN.exe
  2⤵
  PID:8712
- C:\Windows\System\UptUoVL.exe
  C:\Windows\System\UptUoVL.exe
  2⤵
  PID:8328
- C:\Windows\System\fPEZScc.exe
  C:\Windows\System\fPEZScc.exe
  2⤵
  PID:9228
- C:\Windows\System\OeqkVIN.exe
  C:\Windows\System\OeqkVIN.exe
  2⤵
  PID:9248
- C:\Windows\System\yIsqbaD.exe
  C:\Windows\System\yIsqbaD.exe
  2⤵
  PID:9268
- C:\Windows\System\ZPeVbyT.exe
  C:\Windows\System\ZPeVbyT.exe
  2⤵
  PID:9284
- C:\Windows\System\dUvFXxZ.exe
  C:\Windows\System\dUvFXxZ.exe
  2⤵
  PID:9304
- C:\Windows\System\ufZCPlV.exe
  C:\Windows\System\ufZCPlV.exe
  2⤵
  PID:9320
- C:\Windows\System\snNtVXH.exe
  C:\Windows\System\snNtVXH.exe
  2⤵
  PID:9340
- C:\Windows\System\zwkeQYw.exe
  C:\Windows\System\zwkeQYw.exe
  2⤵
  PID:9364
- C:\Windows\System\NWsrWXR.exe
  C:\Windows\System\NWsrWXR.exe
  2⤵
  PID:9384
- C:\Windows\System\JRmmHHQ.exe
  C:\Windows\System\JRmmHHQ.exe
  2⤵
  PID:9408
- C:\Windows\System\EwgYOAb.exe
  C:\Windows\System\EwgYOAb.exe
  2⤵
  PID:9424
- C:\Windows\System\ZCGnwoq.exe
  C:\Windows\System\ZCGnwoq.exe
  2⤵
  PID:9444
- C:\Windows\System\wuWjLEa.exe
  C:\Windows\System\wuWjLEa.exe
  2⤵
  PID:9468
- C:\Windows\System\OEUPbpv.exe
  C:\Windows\System\OEUPbpv.exe
  2⤵
  PID:9488
- C:\Windows\System\KszFPtE.exe
  C:\Windows\System\KszFPtE.exe
  2⤵
  PID:9508
- C:\Windows\System\iRlIdDa.exe
  C:\Windows\System\iRlIdDa.exe
  2⤵
  PID:9528
- C:\Windows\System\FqkMOTf.exe
  C:\Windows\System\FqkMOTf.exe
  2⤵
  PID:9544
- C:\Windows\System\rGAqTmy.exe
  C:\Windows\System\rGAqTmy.exe
  2⤵
  PID:9568
- C:\Windows\System\GvDFvgO.exe
  C:\Windows\System\GvDFvgO.exe
  2⤵
  PID:9652
- C:\Windows\System\blDVFHf.exe
  C:\Windows\System\blDVFHf.exe
  2⤵
  PID:9668
- C:\Windows\System\mvBfGQw.exe
  C:\Windows\System\mvBfGQw.exe
  2⤵
  PID:9700
- C:\Windows\System\VOvEEca.exe
  C:\Windows\System\VOvEEca.exe
  2⤵
  PID:9716
- C:\Windows\System\GXiHavG.exe
  C:\Windows\System\GXiHavG.exe
  2⤵
  PID:9732
- C:\Windows\System\LCxAQVj.exe
  C:\Windows\System\LCxAQVj.exe
  2⤵
  PID:9756
- C:\Windows\System\PdDODss.exe
  C:\Windows\System\PdDODss.exe
  2⤵
  PID:9772
- C:\Windows\System\ppyqHWB.exe
  C:\Windows\System\ppyqHWB.exe
  2⤵
  PID:9796
- C:\Windows\System\erGUuTD.exe
  C:\Windows\System\erGUuTD.exe
  2⤵
  PID:9816
- C:\Windows\System\IuqFvaZ.exe
  C:\Windows\System\IuqFvaZ.exe
  2⤵
  PID:9836
- C:\Windows\System\VeKWoKx.exe
  C:\Windows\System\VeKWoKx.exe
  2⤵
  PID:9856
- C:\Windows\System\wIqVuEP.exe
  C:\Windows\System\wIqVuEP.exe
  2⤵
  PID:9876
- C:\Windows\System\QdLViKm.exe
  C:\Windows\System\QdLViKm.exe
  2⤵
  PID:9896
- C:\Windows\System\KBBNqHM.exe
  C:\Windows\System\KBBNqHM.exe
  2⤵
  PID:9912
- C:\Windows\System\EIiRdia.exe
  C:\Windows\System\EIiRdia.exe
  2⤵
  PID:9932
- C:\Windows\System\QAEobIx.exe
  C:\Windows\System\QAEobIx.exe
  2⤵
  PID:9956
- C:\Windows\System\sWoyLMD.exe
  C:\Windows\System\sWoyLMD.exe
  2⤵
  PID:9972
- C:\Windows\System\HNdgEVd.exe
  C:\Windows\System\HNdgEVd.exe
  2⤵
  PID:9996
- C:\Windows\System\DPtsKGr.exe
  C:\Windows\System\DPtsKGr.exe
  2⤵
  PID:10020
- C:\Windows\System\DSZhcHn.exe
  C:\Windows\System\DSZhcHn.exe
  2⤵
  PID:10036
- C:\Windows\System\SLRMCpJ.exe
  C:\Windows\System\SLRMCpJ.exe
  2⤵
  PID:10052
- C:\Windows\System\uEObidY.exe
  C:\Windows\System\uEObidY.exe
  2⤵
  PID:10072
- C:\Windows\System\jFbKbOj.exe
  C:\Windows\System\jFbKbOj.exe
  2⤵
  PID:10088
- C:\Windows\System\tDchXHa.exe
  C:\Windows\System\tDchXHa.exe
  2⤵
  PID:10112
- C:\Windows\System\bCtIiPw.exe
  C:\Windows\System\bCtIiPw.exe
  2⤵
  PID:10140
- C:\Windows\System\oYUiVcB.exe
  C:\Windows\System\oYUiVcB.exe
  2⤵
  PID:10160
- C:\Windows\System\nVmFQZM.exe
  C:\Windows\System\nVmFQZM.exe
  2⤵
  PID:10184
- C:\Windows\System\txbvkXb.exe
  C:\Windows\System\txbvkXb.exe
  2⤵
  PID:10204
- C:\Windows\System\rTRbjyd.exe
  C:\Windows\System\rTRbjyd.exe
  2⤵
  PID:10224
- C:\Windows\System\BrRfLnN.exe
  C:\Windows\System\BrRfLnN.exe
  2⤵
  PID:8520
- C:\Windows\System\dXGXwME.exe
  C:\Windows\System\dXGXwME.exe
  2⤵
  PID:8688
- C:\Windows\System\ZQyzKdw.exe
  C:\Windows\System\ZQyzKdw.exe
  2⤵
  PID:9236
- C:\Windows\System\bdtTrAC.exe
  C:\Windows\System\bdtTrAC.exe
  2⤵
  PID:9092
- C:\Windows\System\KAxsflp.exe
  C:\Windows\System\KAxsflp.exe
  2⤵
  PID:8264
- C:\Windows\System\pecpGxJ.exe
  C:\Windows\System\pecpGxJ.exe
  2⤵
  PID:9420
- C:\Windows\System\sMiJLYl.exe
  C:\Windows\System\sMiJLYl.exe
  2⤵
  PID:7204
- C:\Windows\System\QKyzMMh.exe
  C:\Windows\System\QKyzMMh.exe
  2⤵
  PID:9256
- C:\Windows\System\JKNzufQ.exe
  C:\Windows\System\JKNzufQ.exe
  2⤵
  PID:9476
- C:\Windows\System\UMvUSxn.exe
  C:\Windows\System\UMvUSxn.exe
  2⤵
  PID:9316
- C:\Windows\System\NNlVQzh.exe
  C:\Windows\System\NNlVQzh.exe
  2⤵
  PID:9580
- C:\Windows\System\RTuJbzs.exe
  C:\Windows\System\RTuJbzs.exe
  2⤵
  PID:9392
- C:\Windows\System\wenMkjB.exe
  C:\Windows\System\wenMkjB.exe
  2⤵
  PID:9464
- C:\Windows\System\QMiweVx.exe
  C:\Windows\System\QMiweVx.exe
  2⤵
  PID:9764
- C:\Windows\System\mBbgnZn.exe
  C:\Windows\System\mBbgnZn.exe
  2⤵
  PID:9524
- C:\Windows\System\EBEMJHL.exe
  C:\Windows\System\EBEMJHL.exe
  2⤵
  PID:9576
- C:\Windows\System\Zbdhwaa.exe
  C:\Windows\System\Zbdhwaa.exe
  2⤵
  PID:9904
- C:\Windows\System\lMfpdhx.exe
  C:\Windows\System\lMfpdhx.exe
  2⤵
  PID:9964
- C:\Windows\System\EnKvYPm.exe
  C:\Windows\System\EnKvYPm.exe
  2⤵
  PID:10012
- C:\Windows\System\yEAxklp.exe
  C:\Windows\System\yEAxklp.exe
  2⤵
  PID:10028
- C:\Windows\System\GvtCHGX.exe
  C:\Windows\System\GvtCHGX.exe
  2⤵
  PID:10244
- C:\Windows\System\aSnoHaH.exe
  C:\Windows\System\aSnoHaH.exe
  2⤵
  PID:10272
- C:\Windows\System\cnEplGh.exe
  C:\Windows\System\cnEplGh.exe
  2⤵
  PID:10296
- C:\Windows\System\tDaSlms.exe
  C:\Windows\System\tDaSlms.exe
  2⤵
  PID:10312
- C:\Windows\System\KsvruKA.exe
  C:\Windows\System\KsvruKA.exe
  2⤵
  PID:10508
- C:\Windows\System\jrMFhEM.exe
  C:\Windows\System\jrMFhEM.exe
  2⤵
  PID:10524
- C:\Windows\System\KycUmTZ.exe
  C:\Windows\System\KycUmTZ.exe
  2⤵
  PID:10548
- C:\Windows\System\UQQQASn.exe
  C:\Windows\System\UQQQASn.exe
  2⤵
  PID:10572
- C:\Windows\System\nZRFayx.exe
  C:\Windows\System\nZRFayx.exe
  2⤵
  PID:10592
- C:\Windows\System\GtdNitJ.exe
  C:\Windows\System\GtdNitJ.exe
  2⤵
  PID:10612
- C:\Windows\System\oyzlfAx.exe
  C:\Windows\System\oyzlfAx.exe
  2⤵
  PID:10632
- C:\Windows\System\SsIJaEr.exe
  C:\Windows\System\SsIJaEr.exe
  2⤵
  PID:10656
- C:\Windows\System\ugIfZjo.exe
  C:\Windows\System\ugIfZjo.exe
  2⤵
  PID:10680
- C:\Windows\System\zIqZmhc.exe
  C:\Windows\System\zIqZmhc.exe
  2⤵
  PID:10696
- C:\Windows\System\aVuFUex.exe
  C:\Windows\System\aVuFUex.exe
  2⤵
  PID:10720
- C:\Windows\System\gUpmACd.exe
  C:\Windows\System\gUpmACd.exe
  2⤵
  PID:10744
- C:\Windows\System\sEuHSHr.exe
  C:\Windows\System\sEuHSHr.exe
  2⤵
  PID:10772
- C:\Windows\System\zVgQvwF.exe
  C:\Windows\System\zVgQvwF.exe
  2⤵
  PID:10792
- C:\Windows\System\gCzlEPK.exe
  C:\Windows\System\gCzlEPK.exe
  2⤵
  PID:10812
- C:\Windows\System\xxIMlaA.exe
  C:\Windows\System\xxIMlaA.exe
  2⤵
  PID:10828
- C:\Windows\System\FcvPatK.exe
  C:\Windows\System\FcvPatK.exe
  2⤵
  PID:10848
- C:\Windows\System\rzIniIK.exe
  C:\Windows\System\rzIniIK.exe
  2⤵
  PID:10864
- C:\Windows\System\pSbPeXE.exe
  C:\Windows\System\pSbPeXE.exe
  2⤵
  PID:10884
- C:\Windows\System\FatoQJy.exe
  C:\Windows\System\FatoQJy.exe
  2⤵
  PID:10904
- C:\Windows\System\ZsRXdpL.exe
  C:\Windows\System\ZsRXdpL.exe
  2⤵
  PID:10928
- C:\Windows\System\RIXieYK.exe
  C:\Windows\System\RIXieYK.exe
  2⤵
  PID:10952
- C:\Windows\System\cXPGEuv.exe
  C:\Windows\System\cXPGEuv.exe
  2⤵
  PID:10972
- C:\Windows\System\zQzScqQ.exe
  C:\Windows\System\zQzScqQ.exe
  2⤵
  PID:10996
- C:\Windows\System\ReBtwoI.exe
  C:\Windows\System\ReBtwoI.exe
  2⤵
  PID:11016
- C:\Windows\System\beNTKuo.exe
  C:\Windows\System\beNTKuo.exe
  2⤵
  PID:11036
- C:\Windows\System\QjNxhnn.exe
  C:\Windows\System\QjNxhnn.exe
  2⤵
  PID:11060
- C:\Windows\System\iaKlUbf.exe
  C:\Windows\System\iaKlUbf.exe
  2⤵
  PID:11084
- C:\Windows\System\ipBRQFS.exe
  C:\Windows\System\ipBRQFS.exe
  2⤵
  PID:11104
- C:\Windows\System\hnBGSTb.exe
  C:\Windows\System\hnBGSTb.exe
  2⤵
  PID:11124
- C:\Windows\System\ZrflACf.exe
  C:\Windows\System\ZrflACf.exe
  2⤵
  PID:11148
- C:\Windows\System\tlKXVfn.exe
  C:\Windows\System\tlKXVfn.exe
  2⤵
  PID:11172
- C:\Windows\System\RMoipVQ.exe
  C:\Windows\System\RMoipVQ.exe
  2⤵
  PID:11192
- C:\Windows\System\oGjwnHA.exe
  C:\Windows\System\oGjwnHA.exe
  2⤵
  PID:11216
- C:\Windows\System\iNkcvvp.exe
  C:\Windows\System\iNkcvvp.exe
  2⤵
  PID:11236
- C:\Windows\System\voEyVgQ.exe
  C:\Windows\System\voEyVgQ.exe
  2⤵
  PID:11256
- C:\Windows\System\OljJxSV.exe
  C:\Windows\System\OljJxSV.exe
  2⤵
  PID:7872
- C:\Windows\System\YwYMfji.exe
  C:\Windows\System\YwYMfji.exe
  2⤵
  PID:9792
- C:\Windows\System\eTgqLLH.exe
  C:\Windows\System\eTgqLLH.exe
  2⤵
  PID:9276
- C:\Windows\System\jMkPLuD.exe
  C:\Windows\System\jMkPLuD.exe
  2⤵
  PID:9864
- C:\Windows\System\PwNlqSd.exe
  C:\Windows\System\PwNlqSd.exe
  2⤵
  PID:9944
- C:\Windows\System\LDzGSJt.exe
  C:\Windows\System\LDzGSJt.exe
  2⤵
  PID:9980
- C:\Windows\System\iRIZCxY.exe
  C:\Windows\System\iRIZCxY.exe
  2⤵
  PID:9292
- C:\Windows\System\EiEJkTs.exe
  C:\Windows\System\EiEJkTs.exe
  2⤵
  PID:9908
- C:\Windows\System\BaZaceX.exe
  C:\Windows\System\BaZaceX.exe
  2⤵
  PID:10096
- C:\Windows\System\DfjViZw.exe
  C:\Windows\System\DfjViZw.exe
  2⤵
  PID:10152
- C:\Windows\System\DNCINeW.exe
  C:\Windows\System\DNCINeW.exe
  2⤵
  PID:10176
- C:\Windows\System\onNrBvR.exe
  C:\Windows\System\onNrBvR.exe
  2⤵
  PID:10220
- C:\Windows\System\KdyrYsy.exe
  C:\Windows\System\KdyrYsy.exe
  2⤵
  PID:8516
- C:\Windows\System\sVxpUiy.exe
  C:\Windows\System\sVxpUiy.exe
  2⤵
  PID:9300
- C:\Windows\System\IvvSbFT.exe
  C:\Windows\System\IvvSbFT.exe
  2⤵
  PID:9356
- C:\Windows\System\lPITiEL.exe
  C:\Windows\System\lPITiEL.exe
  2⤵
  PID:9724
- C:\Windows\System\qRsYgNz.exe
  C:\Windows\System\qRsYgNz.exe
  2⤵
  PID:9872
- C:\Windows\System\gWpNUxi.exe
  C:\Windows\System\gWpNUxi.exe
  2⤵
  PID:10068
- C:\Windows\System\xwylRsK.exe
  C:\Windows\System\xwylRsK.exe
  2⤵
  PID:10292
- C:\Windows\System\yJZPMRQ.exe
  C:\Windows\System\yJZPMRQ.exe
  2⤵
  PID:10408
- C:\Windows\System\lWuwiuX.exe
  C:\Windows\System\lWuwiuX.exe
  2⤵
  PID:10516
- C:\Windows\System\pImCIHH.exe
  C:\Windows\System\pImCIHH.exe
  2⤵
  PID:10604
- C:\Windows\System\wlkrEqd.exe
  C:\Windows\System\wlkrEqd.exe
  2⤵
  PID:10676
- C:\Windows\System\vMHHiNr.exe
  C:\Windows\System\vMHHiNr.exe
  2⤵
  PID:5664
- C:\Windows\System\TGGmbnT.exe
  C:\Windows\System\TGGmbnT.exe
  2⤵
  PID:10820
- C:\Windows\System\mFYlOvf.exe
  C:\Windows\System\mFYlOvf.exe
  2⤵
  PID:10940
- C:\Windows\System\DCaHPMV.exe
  C:\Windows\System\DCaHPMV.exe
  2⤵
  PID:11008
- C:\Windows\System\CBzAfYu.exe
  C:\Windows\System\CBzAfYu.exe
  2⤵
  PID:11428
- C:\Windows\System\glEjyfA.exe
  C:\Windows\System\glEjyfA.exe
  2⤵
  PID:11444
- C:\Windows\System\jrxzkmg.exe
  C:\Windows\System\jrxzkmg.exe
  2⤵
  PID:11464
- C:\Windows\System\HlKZyZs.exe
  C:\Windows\System\HlKZyZs.exe
  2⤵
  PID:11484
- C:\Windows\System\FYmMJtP.exe
  C:\Windows\System\FYmMJtP.exe
  2⤵
  PID:11504
- C:\Windows\System\OIQWwCM.exe
  C:\Windows\System\OIQWwCM.exe
  2⤵
  PID:11528
- C:\Windows\System\PMNGhVz.exe
  C:\Windows\System\PMNGhVz.exe
  2⤵
  PID:11548
- C:\Windows\System\EgJgCIr.exe
  C:\Windows\System\EgJgCIr.exe
  2⤵
  PID:11564
- C:\Windows\System\FpOmbxE.exe
  C:\Windows\System\FpOmbxE.exe
  2⤵
  PID:11580
- C:\Windows\System\rTgFXbN.exe
  C:\Windows\System\rTgFXbN.exe
  2⤵
  PID:11596
- C:\Windows\System\OKPaAIV.exe
  C:\Windows\System\OKPaAIV.exe
  2⤵
  PID:11616
- C:\Windows\System\tBoKfte.exe
  C:\Windows\System\tBoKfte.exe
  2⤵
  PID:11652
- C:\Windows\System\XxqgYBa.exe
  C:\Windows\System\XxqgYBa.exe
  2⤵
  PID:11676
- C:\Windows\System\OCyFnKn.exe
  C:\Windows\System\OCyFnKn.exe
  2⤵
  PID:11696
- C:\Windows\System\nAsYyrS.exe
  C:\Windows\System\nAsYyrS.exe
  2⤵
  PID:11716
- C:\Windows\System\tciKwHo.exe
  C:\Windows\System\tciKwHo.exe
  2⤵
  PID:11736
- C:\Windows\System\bJPPdBo.exe
  C:\Windows\System\bJPPdBo.exe
  2⤵
  PID:11760
- C:\Windows\System\ywhMJEY.exe
  C:\Windows\System\ywhMJEY.exe
  2⤵
  PID:11780
- C:\Windows\System\OrTIsxs.exe
  C:\Windows\System\OrTIsxs.exe
  2⤵
  PID:11804
- C:\Windows\System\AoHZOrK.exe
  C:\Windows\System\AoHZOrK.exe
  2⤵
  PID:11832
- C:\Windows\System\uPKsRxt.exe
  C:\Windows\System\uPKsRxt.exe
  2⤵
  PID:11852
- C:\Windows\System\UomgiIm.exe
  C:\Windows\System\UomgiIm.exe
  2⤵
  PID:11876
- C:\Windows\System\GWxcheL.exe
  C:\Windows\System\GWxcheL.exe
  2⤵
  PID:11892
- C:\Windows\System\yCHwChY.exe
  C:\Windows\System\yCHwChY.exe
  2⤵
  PID:11908
- C:\Windows\System\dtrBcpg.exe
  C:\Windows\System\dtrBcpg.exe
  2⤵
  PID:12092
- C:\Windows\System\PoCrsUK.exe
  C:\Windows\System\PoCrsUK.exe
  2⤵
  PID:12108
- C:\Windows\System\kcyurvu.exe
  C:\Windows\System\kcyurvu.exe
  2⤵
  PID:12128
- C:\Windows\System\mDzNxxs.exe
  C:\Windows\System\mDzNxxs.exe
  2⤵
  PID:12148
- C:\Windows\System\SduMZoz.exe
  C:\Windows\System\SduMZoz.exe
  2⤵
  PID:12176
- C:\Windows\System\uIsSUKt.exe
  C:\Windows\System\uIsSUKt.exe
  2⤵
  PID:12200
- C:\Windows\System\vUqyful.exe
  C:\Windows\System\vUqyful.exe
  2⤵
  PID:12220
- C:\Windows\System\hjpqkfb.exe
  C:\Windows\System\hjpqkfb.exe
  2⤵
  PID:12248
- C:\Windows\System\QhgBqxf.exe
  C:\Windows\System\QhgBqxf.exe
  2⤵
  PID:12264
- C:\Windows\System\nWKbSkj.exe
  C:\Windows\System\nWKbSkj.exe
  2⤵
  PID:12280
- C:\Windows\System\CNqSSpi.exe
  C:\Windows\System\CNqSSpi.exe
  2⤵
  PID:10496
- C:\Windows\System\GcdmcEM.exe
  C:\Windows\System\GcdmcEM.exe
  2⤵
  PID:10640
- C:\Windows\System\xtOcomQ.exe
  C:\Windows\System\xtOcomQ.exe
  2⤵
  PID:10740
- C:\Windows\System\itEpIkE.exe
  C:\Windows\System\itEpIkE.exe
  2⤵
  PID:11028
- C:\Windows\System\GQWacZv.exe
  C:\Windows\System\GQWacZv.exe
  2⤵
  PID:11156
- C:\Windows\System\gQfsyDo.exe
  C:\Windows\System\gQfsyDo.exe
  2⤵
  PID:10212
- C:\Windows\System\SRlCVhn.exe
  C:\Windows\System\SRlCVhn.exe
  2⤵
  PID:10540
- C:\Windows\System\lGxirtT.exe
  C:\Windows\System\lGxirtT.exe
  2⤵
  PID:10108
- C:\Windows\System\vGkFCOz.exe
  C:\Windows\System\vGkFCOz.exe
  2⤵
  PID:10760
- C:\Windows\System\foCJkMi.exe
  C:\Windows\System\foCJkMi.exe
  2⤵
  PID:10800
- C:\Windows\System\KlmPYni.exe
  C:\Windows\System\KlmPYni.exe
  2⤵
  PID:10836
- C:\Windows\System\mnToBJO.exe
  C:\Windows\System\mnToBJO.exe
  2⤵
  PID:10324
- C:\Windows\System\hFIgULC.exe
  C:\Windows\System\hFIgULC.exe
  2⤵
  PID:10924
- C:\Windows\System\xFfjHZY.exe
  C:\Windows\System\xFfjHZY.exe
  2⤵
  PID:11228
- C:\Windows\System\dpMxgWa.exe
  C:\Windows\System\dpMxgWa.exe
  2⤵
  PID:8500
- C:\Windows\System\wyadAUc.exe
  C:\Windows\System\wyadAUc.exe
  2⤵
  PID:8476
- C:\Windows\System\NtimCTr.exe
  C:\Windows\System\NtimCTr.exe
  2⤵
  PID:1120
- C:\Windows\System\YRyqYDA.exe
  C:\Windows\System\YRyqYDA.exe
  2⤵
  PID:10348
- C:\Windows\System\rSwVNSS.exe
  C:\Windows\System\rSwVNSS.exe
  2⤵
  PID:10172
- C:\Windows\System\RHpcTjq.exe
  C:\Windows\System\RHpcTjq.exe
  2⤵
  PID:4748
- C:\Windows\System\NtpIwse.exe
  C:\Windows\System\NtpIwse.exe
  2⤵
  PID:9536
- C:\Windows\System\qRHzicp.exe
  C:\Windows\System\qRHzicp.exe
  2⤵
  PID:10376
- C:\Windows\System\UiYvpZL.exe
  C:\Windows\System\UiYvpZL.exe
  2⤵
  PID:10568
- C:\Windows\System\RPnChSD.exe
  C:\Windows\System\RPnChSD.exe
  2⤵
  PID:10692
- C:\Windows\System\HuqnrPy.exe
  C:\Windows\System\HuqnrPy.exe
  2⤵
  PID:11452
- C:\Windows\System\tHKWHrf.exe
  C:\Windows\System\tHKWHrf.exe
  2⤵
  PID:11340
- C:\Windows\System\CCdKmZB.exe
  C:\Windows\System\CCdKmZB.exe
  2⤵
  PID:11844
- C:\Windows\System\XJabTZE.exe
  C:\Windows\System\XJabTZE.exe
  2⤵
  PID:12084
- C:\Windows\System\OFlcamz.exe
  C:\Windows\System\OFlcamz.exe
  2⤵
  PID:12312
- C:\Windows\System\UULCNLu.exe
  C:\Windows\System\UULCNLu.exe
  2⤵
  PID:12332
- C:\Windows\System\fPCxiqs.exe
  C:\Windows\System\fPCxiqs.exe
  2⤵
  PID:12352
- C:\Windows\System\TDkdHXW.exe
  C:\Windows\System\TDkdHXW.exe
  2⤵
  PID:12372
- C:\Windows\System\BWmdnFA.exe
  C:\Windows\System\BWmdnFA.exe
  2⤵
  PID:12392
- C:\Windows\System\zZFoNbh.exe
  C:\Windows\System\zZFoNbh.exe
  2⤵
  PID:12412
- C:\Windows\System\IHbYyOP.exe
  C:\Windows\System\IHbYyOP.exe
  2⤵
  PID:12432
- C:\Windows\System\LulAhvg.exe
  C:\Windows\System\LulAhvg.exe
  2⤵
  PID:12456
- C:\Windows\System\sUZNnwP.exe
  C:\Windows\System\sUZNnwP.exe
  2⤵
  PID:12480
- C:\Windows\System\VsybcNy.exe
  C:\Windows\System\VsybcNy.exe
  2⤵
  PID:12500
- C:\Windows\System\sElOJZM.exe
  C:\Windows\System\sElOJZM.exe
  2⤵
  PID:12524
- C:\Windows\System\vEUkSdA.exe
  C:\Windows\System\vEUkSdA.exe
  2⤵
  PID:12544
- C:\Windows\System\bPqDvQf.exe
  C:\Windows\System\bPqDvQf.exe
  2⤵
  PID:12568
- C:\Windows\System\jSzpgkh.exe
  C:\Windows\System\jSzpgkh.exe
  2⤵
  PID:12588
- C:\Windows\System\tMlqctq.exe
  C:\Windows\System\tMlqctq.exe
  2⤵
  PID:12608
- C:\Windows\System\aXybLlg.exe
  C:\Windows\System\aXybLlg.exe
  2⤵
  PID:12628
- C:\Windows\System\vMtyiZt.exe
  C:\Windows\System\vMtyiZt.exe
  2⤵
  PID:12644
- C:\Windows\System\banXIVO.exe
  C:\Windows\System\banXIVO.exe
  2⤵
  PID:12672
- C:\Windows\System\dtroTEr.exe
  C:\Windows\System\dtroTEr.exe
  2⤵
  PID:12688
- C:\Windows\System\TqYrGGJ.exe
  C:\Windows\System\TqYrGGJ.exe
  2⤵
  PID:12708
- C:\Windows\System\KHBWasa.exe
  C:\Windows\System\KHBWasa.exe
  2⤵
  PID:12724
- C:\Windows\System\fLBxrCK.exe
  C:\Windows\System\fLBxrCK.exe
  2⤵
  PID:12740
- C:\Windows\System\EcuAONg.exe
  C:\Windows\System\EcuAONg.exe
  2⤵
  PID:12756
- C:\Windows\System\IUBqryd.exe
  C:\Windows\System\IUBqryd.exe
  2⤵
  PID:12772
- C:\Windows\System\lCnASjq.exe
  C:\Windows\System\lCnASjq.exe
  2⤵
  PID:12800
- C:\Windows\System\mXVKjeV.exe
  C:\Windows\System\mXVKjeV.exe
  2⤵
  PID:12820
- C:\Windows\System\zagXSYn.exe
  C:\Windows\System\zagXSYn.exe
  2⤵
  PID:12844
- C:\Windows\System\tbAHSbA.exe
  C:\Windows\System\tbAHSbA.exe
  2⤵
  PID:12880
- C:\Windows\System\ecSJTNJ.exe
  C:\Windows\System\ecSJTNJ.exe
  2⤵
  PID:12912
- C:\Windows\System\NtZzyyX.exe
  C:\Windows\System\NtZzyyX.exe
  2⤵
  PID:12952
- C:\Windows\System\EvVTSNQ.exe
  C:\Windows\System\EvVTSNQ.exe
  2⤵
  PID:12992
- C:\Windows\System\lVxnvxA.exe
  C:\Windows\System\lVxnvxA.exe
  2⤵
  PID:13008
- C:\Windows\System\YxxrzGr.exe
  C:\Windows\System\YxxrzGr.exe
  2⤵
  PID:11476
- C:\Windows\System\zZynPIs.exe
  C:\Windows\System\zZynPIs.exe
  2⤵
  PID:11672
- C:\Windows\System\hpNwsjc.exe
  C:\Windows\System\hpNwsjc.exe
  2⤵
  PID:12556
- C:\Windows\System\ZHOfQKJ.exe
  C:\Windows\System\ZHOfQKJ.exe
  2⤵
  PID:12620
- C:\Windows\System\VUoiplS.exe
  C:\Windows\System\VUoiplS.exe
  2⤵
  PID:12300
- C:\Windows\System\VIsIyVd.exe
  C:\Windows\System\VIsIyVd.exe
  2⤵
  PID:12364
- C:\Windows\System\trZwCRi.exe
  C:\Windows\System\trZwCRi.exe
  2⤵
  PID:12408
- C:\Windows\System\ZeiebcO.exe
  C:\Windows\System\ZeiebcO.exe
  2⤵
  PID:11756
- C:\Windows\System\vSLoCFu.exe
  C:\Windows\System\vSLoCFu.exe
  2⤵
  PID:11660
- C:\Windows\System\FREZcNQ.exe
  C:\Windows\System\FREZcNQ.exe
  2⤵
  PID:12104
- C:\Windows\System\VsvEzNd.exe
  C:\Windows\System\VsvEzNd.exe
  2⤵
  PID:12184
- C:\Windows\System\xfPoJTz.exe
  C:\Windows\System\xfPoJTz.exe
  2⤵
  PID:12192
- C:\Windows\System\aGgIZnA.exe
  C:\Windows\System\aGgIZnA.exe
  2⤵
  PID:11996
- C:\Windows\System\OFEITIK.exe
  C:\Windows\System\OFEITIK.exe
  2⤵
  PID:10588
- C:\Windows\System\jUKAYXp.exe
  C:\Windows\System\jUKAYXp.exe
  2⤵
  PID:5176
- C:\Windows\System\qKEXYqB.exe
  C:\Windows\System\qKEXYqB.exe
  2⤵
  PID:13152
- C:\Windows\System\LyvksHX.exe
  C:\Windows\System\LyvksHX.exe
  2⤵
  PID:12668
- C:\Windows\System\DSuBQPh.exe
  C:\Windows\System\DSuBQPh.exe
  2⤵
  PID:12720
- C:\Windows\System\HuuBPvo.exe
  C:\Windows\System\HuuBPvo.exe
  2⤵
  PID:11728
- C:\Windows\System\pQjnGUR.exe
  C:\Windows\System\pQjnGUR.exe
  2⤵
  PID:12216
- C:\Windows\System\xTLPqYs.exe
  C:\Windows\System\xTLPqYs.exe
  2⤵
  PID:11744
- C:\Windows\System\OuxpmyA.exe
  C:\Windows\System\OuxpmyA.exe
  2⤵
  PID:5028
- C:\Windows\System\YWubIvT.exe
  C:\Windows\System\YWubIvT.exe
  2⤵
  PID:11768
- C:\Windows\System\JxFrYQL.exe
  C:\Windows\System\JxFrYQL.exe
  2⤵
  PID:12624
- C:\Windows\System\EffAupZ.exe
  C:\Windows\System\EffAupZ.exe
  2⤵
  PID:10900
- C:\Windows\System\orMTlzH.exe
  C:\Windows\System\orMTlzH.exe
  2⤵
  PID:1468
- C:\Windows\System\FUrVWFV.exe
  C:\Windows\System\FUrVWFV.exe
  2⤵
  PID:8524
- C:\Windows\System\ZCDmuzf.exe
  C:\Windows\System\ZCDmuzf.exe
  2⤵
  PID:4212
- C:\Windows\System\yOhJyli.exe
  C:\Windows\System\yOhJyli.exe
  2⤵
  PID:6048
- C:\Windows\System\bHngPsT.exe
  C:\Windows\System\bHngPsT.exe
  2⤵
  PID:6140
- C:\Windows\System\SdqOcdv.exe
  C:\Windows\System\SdqOcdv.exe
  2⤵
  PID:3544
- C:\Windows\System\jAhwiUC.exe
  C:\Windows\System\jAhwiUC.exe
  2⤵
  PID:12328
- C:\Windows\System\QMTTDMA.exe
  C:\Windows\System\QMTTDMA.exe
  2⤵
  PID:9432
- C:\Windows\System\SjBKqcf.exe
  C:\Windows\System\SjBKqcf.exe
  2⤵
  PID:13140
- C:\Windows\System\nPSjhaJ.exe
  C:\Windows\System\nPSjhaJ.exe
  2⤵
  PID:12036
- C:\Windows\System\NmtxNie.exe
  C:\Windows\System\NmtxNie.exe
  2⤵
  PID:13300
- C:\Windows\System\StHcwAO.exe
  C:\Windows\System\StHcwAO.exe
  2⤵
  PID:3164
- C:\Windows\System\ucBUjgy.exe
  C:\Windows\System\ucBUjgy.exe
  2⤵
  PID:13024
- C:\Windows\System\rzjcOSV.exe
  C:\Windows\System\rzjcOSV.exe
  2⤵
  PID:6064
- C:\Windows\System\rDlcxwh.exe
  C:\Windows\System\rDlcxwh.exe
  2⤵
  PID:12464
- C:\Windows\System\lEdbexk.exe
  C:\Windows\System\lEdbexk.exe
  2⤵
  PID:12888
- C:\Windows\System\NwicxkX.exe
  C:\Windows\System\NwicxkX.exe
  2⤵
  PID:9240
- C:\Windows\System\YYckTaS.exe
  C:\Windows\System\YYckTaS.exe
  2⤵
  PID:13408
- C:\Windows\System\yzteUcw.exe
  C:\Windows\System\yzteUcw.exe
  2⤵
  PID:13428
- C:\Windows\System\ywXyzqK.exe
  C:\Windows\System\ywXyzqK.exe
  2⤵
  PID:13492
- C:\Windows\System\XEAqvYN.exe
  C:\Windows\System\XEAqvYN.exe
  2⤵
  PID:13556
- C:\Windows\System\mIdthCW.exe
  C:\Windows\System\mIdthCW.exe
  2⤵
  PID:13628
- C:\Windows\System\ashvUZc.exe
  C:\Windows\System\ashvUZc.exe
  2⤵
  PID:13716
- C:\Windows\System\riKgFEA.exe
  C:\Windows\System\riKgFEA.exe
  2⤵
  PID:13740
- C:\Windows\System\zqRrKcs.exe
  C:\Windows\System\zqRrKcs.exe
  2⤵
  PID:13832
- C:\Windows\System\ACEdMLw.exe
  C:\Windows\System\ACEdMLw.exe
  2⤵
  PID:13860
- C:\Windows\System\qhlEULR.exe
  C:\Windows\System\qhlEULR.exe
  2⤵
  PID:13884
- C:\Windows\System\IsEoBWV.exe
  C:\Windows\System\IsEoBWV.exe
  2⤵
  PID:14164
- C:\Windows\System\FukFzIp.exe
  C:\Windows\System\FukFzIp.exe
  2⤵
  PID:14224
- C:\Windows\System\fcLnLvV.exe
  C:\Windows\System\fcLnLvV.exe
  2⤵
  PID:14300
- C:\Windows\System\pNvBukt.exe
  C:\Windows\System\pNvBukt.exe
  2⤵
  PID:12380
- C:\Windows\System\mzXuDer.exe
  C:\Windows\System\mzXuDer.exe
  2⤵
  PID:11712
- C:\Windows\System\USyhFIx.exe
  C:\Windows\System\USyhFIx.exe
  2⤵
  PID:744
- C:\Windows\System\rRuIZvj.exe
  C:\Windows\System\rRuIZvj.exe
  2⤵
  PID:852
- C:\Windows\System\mhyCiba.exe
  C:\Windows\System\mhyCiba.exe
  2⤵
  PID:12788
- C:\Windows\System\DSdlgot.exe
  C:\Windows\System\DSdlgot.exe
  2⤵
  PID:13344
- C:\Windows\System\GVINROB.exe
  C:\Windows\System\GVINROB.exe
  2⤵
  PID:6112
- C:\Windows\System\gcPRnIi.exe
  C:\Windows\System\gcPRnIi.exe
  2⤵
  PID:10264
- C:\Windows\System\YhqeqWc.exe
  C:\Windows\System\YhqeqWc.exe
  2⤵
  PID:13368
- C:\Windows\System\QgvKhBG.exe
  C:\Windows\System\QgvKhBG.exe
  2⤵
  PID:13132
- C:\Windows\System\kLKPEOD.exe
  C:\Windows\System\kLKPEOD.exe
  2⤵
  PID:3224
- C:\Windows\System\ZfpLtaS.exe
  C:\Windows\System\ZfpLtaS.exe
  2⤵
  PID:10460
- C:\Windows\System\Hrxtokc.exe
  C:\Windows\System\Hrxtokc.exe
  2⤵
  PID:12296
- C:\Windows\System\rkRfpGL.exe
  C:\Windows\System\rkRfpGL.exe
  2⤵
  PID:6084
- C:\Windows\System\yhhZrbt.exe
  C:\Windows\System\yhhZrbt.exe
  2⤵
  PID:12052
- C:\Windows\System\YWqGgsB.exe
  C:\Windows\System\YWqGgsB.exe
  2⤵
  PID:10444
- C:\Windows\System\hXZuHhI.exe
  C:\Windows\System\hXZuHhI.exe
  2⤵
  PID:13404
- C:\Windows\System\ckKWhWt.exe
  C:\Windows\System\ckKWhWt.exe
  2⤵
  PID:13688
- C:\Windows\System\NPoYUYs.exe
  C:\Windows\System\NPoYUYs.exe
  2⤵
  PID:13528
- C:\Windows\System\wBtIVMx.exe
  C:\Windows\System\wBtIVMx.exe
  2⤵
  PID:13540
- C:\Windows\System\dZkDRYg.exe
  C:\Windows\System\dZkDRYg.exe
  2⤵
  PID:13580
- C:\Windows\System\eJBWxnU.exe
  C:\Windows\System\eJBWxnU.exe
  2⤵
  PID:13604
- C:\Windows\System\gSZtYoL.exe
  C:\Windows\System\gSZtYoL.exe
  2⤵
  PID:6020
- C:\Windows\System\VpBpeRA.exe
  C:\Windows\System\VpBpeRA.exe
  2⤵
  PID:13384
- C:\Windows\System\UbKanQX.exe
  C:\Windows\System\UbKanQX.exe
  2⤵
  PID:13436
- C:\Windows\System\QSSwhqq.exe
  C:\Windows\System\QSSwhqq.exe
  2⤵
  PID:13472
- C:\Windows\System\PalbHBg.exe
  C:\Windows\System\PalbHBg.exe
  2⤵
  PID:3472
- C:\Windows\System\wAYjGYH.exe
  C:\Windows\System\wAYjGYH.exe
  2⤵
  PID:5036
- C:\Windows\System\CvJlmGq.exe
  C:\Windows\System\CvJlmGq.exe
  2⤵
  PID:2004
- C:\Windows\System\FbLJHtQ.exe
  C:\Windows\System\FbLJHtQ.exe
  2⤵
  PID:13756
- C:\Windows\System\zpFOOoo.exe
  C:\Windows\System\zpFOOoo.exe
  2⤵
  PID:13784
- C:\Windows\System\ldWUmwB.exe
  C:\Windows\System\ldWUmwB.exe
  2⤵
  PID:13824
- C:\Windows\System\cKDAmba.exe
  C:\Windows\System\cKDAmba.exe
  2⤵
  PID:13704
- C:\Windows\System\DxTpzwC.exe
  C:\Windows\System\DxTpzwC.exe
  2⤵
  PID:13736
- C:\Windows\System\FbIhvet.exe
  C:\Windows\System\FbIhvet.exe
  2⤵
  PID:13780
- C:\Windows\System\JtKUBua.exe
  C:\Windows\System\JtKUBua.exe
  2⤵
  PID:11732
- C:\Windows\System\OQbllRx.exe
  C:\Windows\System\OQbllRx.exe
  2⤵
  PID:13932
- C:\Windows\System\yvOoWiZ.exe
  C:\Windows\System\yvOoWiZ.exe
  2⤵
  PID:13904
- C:\Windows\System\jTZInEY.exe
  C:\Windows\System\jTZInEY.exe
  2⤵
  PID:1124
- C:\Windows\System\BqtSixY.exe
  C:\Windows\System\BqtSixY.exe
  2⤵
  PID:14012
- C:\Windows\System\eiTjuGr.exe
  C:\Windows\System\eiTjuGr.exe
  2⤵
  PID:11948
- C:\Windows\System\MmtwAjI.exe
  C:\Windows\System\MmtwAjI.exe
  2⤵
  PID:6516
- C:\Windows\System\kTeuvKN.exe
  C:\Windows\System\kTeuvKN.exe
  2⤵
  PID:6672
- C:\Windows\System\LnsxzFK.exe
  C:\Windows\System\LnsxzFK.exe
  2⤵
  PID:14112
- C:\Windows\System\fyzRsVl.exe
  C:\Windows\System\fyzRsVl.exe
  2⤵
  PID:3332
- C:\Windows\System\SgkcdGQ.exe
  C:\Windows\System\SgkcdGQ.exe
  2⤵
  PID:2008
- C:\Windows\System\JfiXrJb.exe
  C:\Windows\System\JfiXrJb.exe
  2⤵
  PID:1208
- C:\Windows\System\VKnbafy.exe
  C:\Windows\System\VKnbafy.exe
  2⤵
  PID:2120
- C:\Windows\System\OCPCrBB.exe
  C:\Windows\System\OCPCrBB.exe
  2⤵
  PID:1556
- C:\Windows\System\doSnPVj.exe
  C:\Windows\System\doSnPVj.exe
  2⤵
  PID:1564
- C:\Windows\System\AMgTYWU.exe
  C:\Windows\System\AMgTYWU.exe
  2⤵
  PID:14020
- C:\Windows\System\beIDDGc.exe
  C:\Windows\System\beIDDGc.exe
  2⤵
  PID:14308
- C:\Windows\System\OVCgWuy.exe
  C:\Windows\System\OVCgWuy.exe
  2⤵
  PID:4600
- C:\Windows\System\anIDLLt.exe
  C:\Windows\System\anIDLLt.exe
  2⤵
  PID:2288
- C:\Windows\System\wzIHyVc.exe
  C:\Windows\System\wzIHyVc.exe
  2⤵
  PID:2992
- C:\Windows\System\fSQdSUU.exe
  C:\Windows\System\fSQdSUU.exe
  2⤵
  PID:6636
- C:\Windows\System\JGAQNOX.exe
  C:\Windows\System\JGAQNOX.exe
  2⤵
  PID:5928
- C:\Windows\System\ZUlTbXj.exe
  C:\Windows\System\ZUlTbXj.exe
  2⤵
  PID:12520
- C:\Windows\System\ugJcQmL.exe
  C:\Windows\System\ugJcQmL.exe
  2⤵
  PID:13036
- C:\Windows\System\LyFRlIH.exe
  C:\Windows\System\LyFRlIH.exe
  2⤵
  PID:13512
- C:\Windows\System\jwsdKBK.exe
  C:\Windows\System\jwsdKBK.exe
  2⤵
  PID:13264
- C:\Windows\System\zVzobWk.exe
  C:\Windows\System\zVzobWk.exe
  2⤵
  PID:13316
- C:\Windows\System\onnpkRV.exe
  C:\Windows\System\onnpkRV.exe
  2⤵
  PID:7172
- C:\Windows\System\nrUVrUq.exe
  C:\Windows\System\nrUVrUq.exe
  2⤵
  PID:12424
- C:\Windows\System\clWVhCX.exe
  C:\Windows\System\clWVhCX.exe
  2⤵
  PID:4436
- C:\Windows\System\WrppLhP.exe
  C:\Windows\System\WrppLhP.exe
  2⤵
  PID:5288
- C:\Windows\System\nJcktQk.exe
  C:\Windows\System\nJcktQk.exe
  2⤵
  PID:13364
- C:\Windows\System\kxrmLiq.exe
  C:\Windows\System\kxrmLiq.exe
  2⤵
  PID:13760
- C:\Windows\System\LgEnGfo.exe
  C:\Windows\System\LgEnGfo.exe
  2⤵
  PID:2680
- C:\Windows\System\zEVPWgf.exe
  C:\Windows\System\zEVPWgf.exe
  2⤵
  PID:13520
- C:\Windows\System\fJnvhwD.exe
  C:\Windows\System\fJnvhwD.exe
  2⤵
  PID:13144
- C:\Windows\System\LZnMdpk.exe
  C:\Windows\System\LZnMdpk.exe
  2⤵
  PID:5468
- C:\Windows\System\wBsANMM.exe
  C:\Windows\System\wBsANMM.exe
  2⤵
  PID:13572
- C:\Windows\System\DgxtwDF.exe
  C:\Windows\System\DgxtwDF.exe
  2⤵
  PID:13360
- C:\Windows\System\mpijguv.exe
  C:\Windows\System\mpijguv.exe
  2⤵
  PID:5420
- C:\Windows\System\GNlLeiy.exe
  C:\Windows\System\GNlLeiy.exe
  2⤵
  PID:5440
- C:\Windows\System\EsoQYdm.exe
  C:\Windows\System\EsoQYdm.exe
  2⤵
  PID:4200
- C:\Windows\System\kuKCtRI.exe
  C:\Windows\System\kuKCtRI.exe
  2⤵
  PID:13600
- C:\Windows\System\UaaLsOo.exe
  C:\Windows\System\UaaLsOo.exe
  2⤵
  PID:13804
- C:\Windows\System\cdmjsgJ.exe
  C:\Windows\System\cdmjsgJ.exe
  2⤵
  PID:13844
- C:\Windows\System\olqaOYt.exe
  C:\Windows\System\olqaOYt.exe
  2⤵
  PID:14072
- C:\Windows\System\oRCIuId.exe
  C:\Windows\System\oRCIuId.exe
  2⤵
  PID:6664
- C:\Windows\System\sxJsKSy.exe
  C:\Windows\System\sxJsKSy.exe
  2⤵
  PID:5048
- C:\Windows\System\CsFyIMv.exe
  C:\Windows\System\CsFyIMv.exe
  2⤵
  PID:3396
- C:\Windows\System\jkOSKWG.exe
  C:\Windows\System\jkOSKWG.exe
  2⤵
  PID:1332
- C:\Windows\System\pJXRTYV.exe
  C:\Windows\System\pJXRTYV.exe
  2⤵
  PID:5656
- C:\Windows\System\dOTBBFi.exe
  C:\Windows\System\dOTBBFi.exe
  2⤵
  PID:14120
- C:\Windows\System\DRcZUUh.exe
  C:\Windows\System\DRcZUUh.exe
  2⤵
  PID:5720
- C:\Windows\System\ikOLpxJ.exe
  C:\Windows\System\ikOLpxJ.exe
  2⤵
  PID:13460
- C:\Windows\System\gAlaWgd.exe
  C:\Windows\System\gAlaWgd.exe
  2⤵
  PID:13648
- C:\Windows\System\iLWgtad.exe
  C:\Windows\System\iLWgtad.exe
  2⤵
  PID:4488
- C:\Windows\System\MwnjsXW.exe
  C:\Windows\System\MwnjsXW.exe
  2⤵
  PID:5848
- C:\Windows\System\CfjpppG.exe
  C:\Windows\System\CfjpppG.exe
  2⤵
  PID:2296
- C:\Windows\System\OoopxRV.exe
  C:\Windows\System\OoopxRV.exe
  2⤵
  PID:7344
- C:\Windows\System\BrmQkmz.exe
  C:\Windows\System\BrmQkmz.exe
  2⤵
  PID:5900
- C:\Windows\System\DurFxEf.exe
  C:\Windows\System\DurFxEf.exe
  2⤵
  PID:10668
- C:\Windows\System\lvUveMp.exe
  C:\Windows\System\lvUveMp.exe
  2⤵
  PID:2336
- C:\Windows\System\BkJDWbc.exe
  C:\Windows\System\BkJDWbc.exe
  2⤵
  PID:1216
- C:\Windows\System\vlHAgzy.exe
  C:\Windows\System\vlHAgzy.exe
  2⤵
  PID:4404
- C:\Windows\System\pRwNnJr.exe
  C:\Windows\System\pRwNnJr.exe
  2⤵
  PID:4544
- C:\Windows\System\KNhtAIk.exe
  C:\Windows\System\KNhtAIk.exe
  2⤵
  PID:4420
- C:\Windows\System\uHtROtY.exe
  C:\Windows\System\uHtROtY.exe
  2⤵
  PID:13672
- C:\Windows\System\apUIquA.exe
  C:\Windows\System\apUIquA.exe
  2⤵
  PID:5488
- C:\Windows\System\FGLrVDn.exe
  C:\Windows\System\FGLrVDn.exe
  2⤵
  PID:2436
- C:\Windows\System\tRMwvtq.exe
  C:\Windows\System\tRMwvtq.exe
  2⤵
  PID:14192
- C:\Windows\System\hzmLBUj.exe
  C:\Windows\System\hzmLBUj.exe
  2⤵
  PID:13852
- C:\Windows\System\KtoMmff.exe
  C:\Windows\System\KtoMmff.exe
  2⤵
  PID:6180
- C:\Windows\System\CKKYqhW.exe
  C:\Windows\System\CKKYqhW.exe
  2⤵
  PID:14148
- C:\Windows\System\MzOLvsy.exe
  C:\Windows\System\MzOLvsy.exe
  2⤵
  PID:14008
- C:\Windows\System\PSLPdLP.exe
  C:\Windows\System\PSLPdLP.exe
  2⤵
  PID:2172
- C:\Windows\System\mxGqWmi.exe
  C:\Windows\System\mxGqWmi.exe
  2⤵
  PID:8448
- C:\Windows\System\KSwjgOY.exe
  C:\Windows\System\KSwjgOY.exe
  2⤵
  PID:4060
- C:\Windows\System\YlbldZh.exe
  C:\Windows\System\YlbldZh.exe
  2⤵
  PID:9452
- C:\Windows\System\DbcTroN.exe
  C:\Windows\System\DbcTroN.exe
  2⤵
  PID:3980
- C:\Windows\System\xLjtOcs.exe
  C:\Windows\System\xLjtOcs.exe
  2⤵
  PID:6044
- C:\Windows\System\QbiWSEl.exe
  C:\Windows\System\QbiWSEl.exe
  2⤵
  PID:2392
- C:\Windows\System\VuPIcBH.exe
  C:\Windows\System\VuPIcBH.exe
  2⤵
  PID:4088
- C:\Windows\System\udoKRbs.exe
  C:\Windows\System\udoKRbs.exe
  2⤵
  PID:6484
- C:\Windows\System\VDSzGrA.exe
  C:\Windows\System\VDSzGrA.exe
  2⤵
  PID:6412
- C:\Windows\System\iIFGKji.exe
  C:\Windows\System\iIFGKji.exe
  2⤵
  PID:6124
- C:\Windows\System\dHPSbYc.exe
  C:\Windows\System\dHPSbYc.exe
  2⤵
  PID:5020
- C:\Windows\System\ZdlVTRb.exe
  C:\Windows\System\ZdlVTRb.exe
  2⤵
  PID:6360
- C:\Windows\System\VZHJLjX.exe
  C:\Windows\System\VZHJLjX.exe
  2⤵
  PID:9584
- C:\Windows\System\DPSYazZ.exe
  C:\Windows\System\DPSYazZ.exe
  2⤵
  PID:14204
- C:\Windows\System\ztrZfXM.exe
  C:\Windows\System\ztrZfXM.exe
  2⤵
  PID:5916
- C:\Windows\System\MFvAPTM.exe
  C:\Windows\System\MFvAPTM.exe
  2⤵
  PID:3564
- C:\Windows\System\OLkOJUW.exe
  C:\Windows\System\OLkOJUW.exe
  2⤵
  PID:9328
- C:\Windows\System\XEZUcTv.exe
  C:\Windows\System\XEZUcTv.exe
  2⤵
  PID:9680
- C:\Windows\System\AbNEWJh.exe
  C:\Windows\System\AbNEWJh.exe
  2⤵
  PID:13768
- C:\Windows\System\eCWKBPn.exe
  C:\Windows\System\eCWKBPn.exe
  2⤵
  PID:564
- C:\Windows\System\oMuSnpg.exe
  C:\Windows\System\oMuSnpg.exe
  2⤵
  PID:12388
- C:\Windows\System\KoOQMLX.exe
  C:\Windows\System\KoOQMLX.exe
  2⤵
  PID:6252
- C:\Windows\System\WyjpRvA.exe
  C:\Windows\System\WyjpRvA.exe
  2⤵
  PID:14188
- C:\Windows\System\ZwYUtrg.exe
  C:\Windows\System\ZwYUtrg.exe
  2⤵
  PID:4136
- C:\Windows\System\stedBcg.exe
  C:\Windows\System\stedBcg.exe
  2⤵
  PID:6488
- C:\Windows\System\dpNYKbt.exe
  C:\Windows\System\dpNYKbt.exe
  2⤵
  PID:3996
- C:\Windows\System\wWxMVWB.exe
  C:\Windows\System\wWxMVWB.exe
  2⤵
  PID:6376
- C:\Windows\System\tnGebQC.exe
  C:\Windows\System\tnGebQC.exe
  2⤵
  PID:6764
- C:\Windows\System\pyBFRbw.exe
  C:\Windows\System\pyBFRbw.exe
  2⤵
  PID:7144
- C:\Windows\System\fyIceHA.exe
  C:\Windows\System\fyIceHA.exe
  2⤵
  PID:7088
- C:\Windows\System\fSDcfdz.exe
  C:\Windows\System\fSDcfdz.exe
  2⤵
  PID:6928
- C:\Windows\System\aRABFJO.exe
  C:\Windows\System\aRABFJO.exe
  2⤵
  PID:14084
- C:\Windows\System\WSPhTHq.exe
  C:\Windows\System\WSPhTHq.exe
  2⤵
  PID:5548
- C:\Windows\System\qjSLjtl.exe
  C:\Windows\System\qjSLjtl.exe
  2⤵
  PID:14344
- C:\Windows\System\eqyOojh.exe
  C:\Windows\System\eqyOojh.exe
  2⤵
  PID:14364
- C:\Windows\System\MWYqXtZ.exe
  C:\Windows\System\MWYqXtZ.exe
  2⤵
  PID:14380
- C:\Windows\System\LyCLLJb.exe
  C:\Windows\System\LyCLLJb.exe
  2⤵
  PID:14396
- C:\Windows\System\zEGTnKZ.exe
  C:\Windows\System\zEGTnKZ.exe
  2⤵
  PID:14412
- C:\Windows\System\ElMxWQC.exe
  C:\Windows\System\ElMxWQC.exe
  2⤵
  PID:14432
- C:\Windows\System\vsWYuKX.exe
  C:\Windows\System\vsWYuKX.exe
  2⤵
  PID:14448
- C:\Windows\System\MshbzSH.exe
  C:\Windows\System\MshbzSH.exe
  2⤵
  PID:14464
- C:\Windows\System\FDdLfTm.exe
  C:\Windows\System\FDdLfTm.exe
  2⤵
  PID:14480
- C:\Windows\System\iatJPYa.exe
  C:\Windows\System\iatJPYa.exe
  2⤵
  PID:14500
- C:\Windows\System\QDxjBIH.exe
  C:\Windows\System\QDxjBIH.exe
  2⤵
  PID:14520
- C:\Windows\System\ImISLLf.exe
  C:\Windows\System\ImISLLf.exe
  2⤵
  PID:14536
- C:\Windows\System\MBSspVz.exe
  C:\Windows\System\MBSspVz.exe
  2⤵
  PID:14556
- C:\Windows\System\SObamVP.exe
  C:\Windows\System\SObamVP.exe
  2⤵
  PID:14576
- C:\Windows\System\VTiZOcv.exe
  C:\Windows\System\VTiZOcv.exe
  2⤵
  PID:14596
- C:\Windows\System\CMbPcqI.exe
  C:\Windows\System\CMbPcqI.exe
  2⤵
  PID:14724
- C:\Windows\System\oSMcmbN.exe
  C:\Windows\System\oSMcmbN.exe
  2⤵
  PID:14740
- C:\Windows\System\ceGqAtK.exe
  C:\Windows\System\ceGqAtK.exe
  2⤵
  PID:14756
- C:\Windows\System\ADUIbaS.exe
  C:\Windows\System\ADUIbaS.exe
  2⤵
  PID:14780
- C:\Windows\System\SiSdKiH.exe
  C:\Windows\System\SiSdKiH.exe
  2⤵
  PID:14808
- C:\Windows\System\JFfrKCd.exe
  C:\Windows\System\JFfrKCd.exe
  2⤵
  PID:14828
- C:\Windows\System\JgvTwtp.exe
  C:\Windows\System\JgvTwtp.exe
  2⤵
  PID:14848
- C:\Windows\System\LcMSxfQ.exe
  C:\Windows\System\LcMSxfQ.exe
  2⤵
  PID:14868
- C:\Windows\System\VWAUVkm.exe
  C:\Windows\System\VWAUVkm.exe
  2⤵
  PID:14888
- C:\Windows\System\YxhilOQ.exe
  C:\Windows\System\YxhilOQ.exe
  2⤵
  PID:14912
- C:\Windows\System\cGLMeYL.exe
  C:\Windows\System\cGLMeYL.exe
  2⤵
  PID:14932
- C:\Windows\System\iXTbNgi.exe
  C:\Windows\System\iXTbNgi.exe
  2⤵
  PID:14956
- C:\Windows\System\gcvzrgI.exe
  C:\Windows\System\gcvzrgI.exe
  2⤵
  PID:14976
- C:\Windows\System\YzKtjsH.exe
  C:\Windows\System\YzKtjsH.exe
  2⤵
  PID:14992
- C:\Windows\System\OcFGDgk.exe
  C:\Windows\System\OcFGDgk.exe
  2⤵
  PID:15020
- C:\Windows\System\rVzIupQ.exe
  C:\Windows\System\rVzIupQ.exe
  2⤵
  PID:15040
- C:\Windows\System\ntlxkMO.exe
  C:\Windows\System\ntlxkMO.exe
  2⤵
  PID:15060
- C:\Windows\System\lIoWkjt.exe
  C:\Windows\System\lIoWkjt.exe
  2⤵
  PID:15080
- C:\Windows\System\PKkUtIf.exe
  C:\Windows\System\PKkUtIf.exe
  2⤵
  PID:15104
- C:\Windows\System\WfADHNN.exe
  C:\Windows\System\WfADHNN.exe
  2⤵
  PID:15132
- C:\Windows\System\zHIyQCW.exe
  C:\Windows\System\zHIyQCW.exe
  2⤵
  PID:15152
- C:\Windows\System\WTqpXPQ.exe
  C:\Windows\System\WTqpXPQ.exe
  2⤵
  PID:15172
- C:\Windows\System\OGNzCQT.exe
  C:\Windows\System\OGNzCQT.exe
  2⤵
  PID:15188
- C:\Windows\System\KAWtrSa.exe
  C:\Windows\System\KAWtrSa.exe
  2⤵
  PID:15204
- C:\Windows\System\tQxSQRe.exe
  C:\Windows\System\tQxSQRe.exe
  2⤵
  PID:15224
- C:\Windows\System\YSePvZo.exe
  C:\Windows\System\YSePvZo.exe
  2⤵
  PID:15240
- C:\Windows\System\sjmZneq.exe
  C:\Windows\System\sjmZneq.exe
  2⤵
  PID:15260
- C:\Windows\System\mHeWKgt.exe
  C:\Windows\System\mHeWKgt.exe
  2⤵
  PID:15276
- C:\Windows\System\NCoMxHd.exe
  C:\Windows\System\NCoMxHd.exe
  2⤵
  PID:15292
- C:\Windows\System\aVxJbBL.exe
  C:\Windows\System\aVxJbBL.exe
  2⤵
  PID:15340
- C:\Windows\System\lSAIiHL.exe
  C:\Windows\System\lSAIiHL.exe
  2⤵
  PID:15356
- C:\Windows\System\RYNCrNO.exe
  C:\Windows\System\RYNCrNO.exe
  2⤵
  PID:9616
- C:\Windows\System\ASNPxOz.exe
  C:\Windows\System\ASNPxOz.exe
  2⤵
  PID:9632
- C:\Windows\System\GLckPII.exe
  C:\Windows\System\GLckPII.exe
  2⤵
  PID:7000
- C:\Windows\System\zxeRDJT.exe
  C:\Windows\System\zxeRDJT.exe
  2⤵
  PID:9376
- C:\Windows\System\sXQlewZ.exe
  C:\Windows\System\sXQlewZ.exe
  2⤵
  PID:4328
- C:\Windows\System\hyvmmlm.exe
  C:\Windows\System\hyvmmlm.exe
  2⤵
  PID:6988
- C:\Windows\System\cKjaXEf.exe
  C:\Windows\System\cKjaXEf.exe
  2⤵
  PID:6092
- C:\Windows\System\BHnsDbY.exe
  C:\Windows\System\BHnsDbY.exe
  2⤵
  PID:6844
- C:\Windows\System\dHpVDzU.exe
  C:\Windows\System\dHpVDzU.exe
  2⤵
  PID:6544
- C:\Windows\System\oQLwdwu.exe
  C:\Windows\System\oQLwdwu.exe
  2⤵
  PID:9620
- C:\Windows\System\tgSVlew.exe
  C:\Windows\System\tgSVlew.exe
  2⤵
  PID:6768
- C:\Windows\System\tSCowca.exe
  C:\Windows\System\tSCowca.exe
  2⤵
  PID:14440
- C:\Windows\System\TtVZEWB.exe
  C:\Windows\System\TtVZEWB.exe
  2⤵
  PID:6280
- C:\Windows\System\WbfFFAL.exe
  C:\Windows\System\WbfFFAL.exe
  2⤵
  PID:9496
- C:\Windows\System\ZXPXbWM.exe
  C:\Windows\System\ZXPXbWM.exe
  2⤵
  PID:5756
- C:\Windows\System\dbsKsWs.exe
  C:\Windows\System\dbsKsWs.exe
  2⤵
  PID:14964
- C:\Windows\System\MqVXWpa.exe
  C:\Windows\System\MqVXWpa.exe
  2⤵
  PID:14604
- C:\Windows\System\wZdKLhU.exe
  C:\Windows\System\wZdKLhU.exe
  2⤵
  PID:5076
- C:\Windows\System\jxpqudI.exe
  C:\Windows\System\jxpqudI.exe
  2⤵
  PID:15328
- C:\Windows\System\bCEzwPq.exe
  C:\Windows\System\bCEzwPq.exe
  2⤵
  PID:6968
- C:\Windows\System\pWdSDGF.exe
  C:\Windows\System\pWdSDGF.exe
  2⤵
  PID:6072
- C:\Windows\System\uNhMkmj.exe
  C:\Windows\System\uNhMkmj.exe
  2⤵
  PID:7364
- C:\Windows\System\FEWZCOf.exe
  C:\Windows\System\FEWZCOf.exe
  2⤵
  PID:8172
- C:\Windows\System\GwNdibV.exe
  C:\Windows\System\GwNdibV.exe
  2⤵
  PID:15300
- C:\Windows\System\FVOmivD.exe
  C:\Windows\System\FVOmivD.exe
  2⤵
  PID:14908
- C:\Windows\System\mklUQZc.exe
  C:\Windows\System\mklUQZc.exe
  2⤵
  PID:15016
- C:\Windows\System\XBYaMuu.exe
  C:\Windows\System\XBYaMuu.exe
  2⤵
  PID:15068
- C:\Windows\System\ygArnxl.exe
  C:\Windows\System\ygArnxl.exe
  2⤵
  PID:6788
- C:\Windows\System\AoGabTL.exe
  C:\Windows\System\AoGabTL.exe
  2⤵
  PID:6776
- C:\Windows\System\miucJaf.exe
  C:\Windows\System\miucJaf.exe
  2⤵
  PID:15184
- C:\Windows\System\bgAQqlx.exe
  C:\Windows\System\bgAQqlx.exe
  2⤵
  PID:15236
- C:\Windows\System\WuDtaUy.exe
  C:\Windows\System\WuDtaUy.exe
  2⤵
  PID:14776
- C:\Windows\System\ySWAuxQ.exe
  C:\Windows\System\ySWAuxQ.exe
  2⤵
  PID:7272
- C:\Windows\System\KweBIDW.exe
  C:\Windows\System\KweBIDW.exe
  2⤵
  PID:7020
- C:\Windows\System\IfMKCva.exe
  C:\Windows\System\IfMKCva.exe
  2⤵
  PID:8808
- C:\Windows\System\RaRjJtO.exe
  C:\Windows\System\RaRjJtO.exe
  2⤵
  PID:7468
- C:\Windows\System\VYwYUzV.exe
  C:\Windows\System\VYwYUzV.exe
  2⤵
  PID:8920
- C:\Windows\System\kYzZoQC.exe
  C:\Windows\System\kYzZoQC.exe
  2⤵
  PID:7636
- C:\Windows\System\gmQLxIh.exe
  C:\Windows\System\gmQLxIh.exe
  2⤵
  PID:7620
- C:\Windows\System\RanBzDr.exe
  C:\Windows\System\RanBzDr.exe
  2⤵
  PID:8436
- C:\Windows\System\tmOCmAy.exe
  C:\Windows\System\tmOCmAy.exe
  2⤵
  PID:8928
- C:\Windows\System\LtmJZcj.exe
  C:\Windows\System\LtmJZcj.exe
  2⤵
  PID:7256
- C:\Windows\System\SINiZYL.exe
  C:\Windows\System\SINiZYL.exe
  2⤵
  PID:8872
- C:\Windows\System\BinRSYn.exe
  C:\Windows\System\BinRSYn.exe
  2⤵
  PID:6596
- C:\Windows\System\IkGNVLI.exe
  C:\Windows\System\IkGNVLI.exe
  2⤵
  PID:14708
- C:\Windows\System\dolCKSF.exe
  C:\Windows\System\dolCKSF.exe
  2⤵
  PID:6756
- C:\Windows\System\xnGGthj.exe
  C:\Windows\System\xnGGthj.exe
  2⤵
  PID:7260
- C:\Windows\System\ceEGHOY.exe
  C:\Windows\System\ceEGHOY.exe
  2⤵
  PID:8856
- C:\Windows\System\DWAcfET.exe
  C:\Windows\System\DWAcfET.exe
  2⤵
  PID:14056
- C:\Windows\System\HYDHicN.exe
  C:\Windows\System\HYDHicN.exe
  2⤵
  PID:5788
- C:\Windows\System\Yyqozab.exe
  C:\Windows\System\Yyqozab.exe
  2⤵
  PID:7504
- C:\Windows\System\NKDWNAm.exe
  C:\Windows\System\NKDWNAm.exe
  2⤵
  PID:7852
- C:\Windows\System\unyRAGC.exe
  C:\Windows\System\unyRAGC.exe
  2⤵
  PID:8208
- C:\Windows\System\XJsJZdW.exe
  C:\Windows\System\XJsJZdW.exe
  2⤵
  PID:8556
- C:\Windows\System\tbFnjEG.exe
  C:\Windows\System\tbFnjEG.exe
  2⤵
  PID:14668
- C:\Windows\System\mibEyPg.exe
  C:\Windows\System\mibEyPg.exe
  2⤵
  PID:8224
- C:\Windows\System\SahSErc.exe
  C:\Windows\System\SahSErc.exe
  2⤵
  PID:8812
- C:\Windows\System\pxCnSzD.exe
  C:\Windows\System\pxCnSzD.exe
  2⤵
  PID:9152
- C:\Windows\System\cyQwFLF.exe
  C:\Windows\System\cyQwFLF.exe
  2⤵
  PID:14732
- C:\Windows\System\NnDQoaj.exe
  C:\Windows\System\NnDQoaj.exe
  2⤵
  PID:7424
- C:\Windows\System\ntYFvUT.exe
  C:\Windows\System\ntYFvUT.exe
  2⤵
  PID:7848
- C:\Windows\System\gZzJNoe.exe
  C:\Windows\System\gZzJNoe.exe
  2⤵
  PID:7520
- C:\Windows\System\fbIeppP.exe
  C:\Windows\System\fbIeppP.exe
  2⤵
  PID:7252
- C:\Windows\System\rFBFfkh.exe
  C:\Windows\System\rFBFfkh.exe
  2⤵
  PID:8772
- C:\Windows\System\svQUcQz.exe
  C:\Windows\System\svQUcQz.exe
  2⤵
  PID:9196
- C:\Windows\System\gfYRtaY.exe
  C:\Windows\System\gfYRtaY.exe
  2⤵
  PID:8912
- C:\Windows\System\PAfCvzi.exe
  C:\Windows\System\PAfCvzi.exe
  2⤵
  PID:8888
- C:\Windows\System\MskOpuw.exe
  C:\Windows\System\MskOpuw.exe
  2⤵
  PID:8204
- C:\Windows\System\NIEvsGn.exe
  C:\Windows\System\NIEvsGn.exe
  2⤵
  PID:7916
- C:\Windows\System\KkdSeAW.exe
  C:\Windows\System\KkdSeAW.exe
  2⤵
  PID:7140
- C:\Windows\System\TDVViCX.exe
  C:\Windows\System\TDVViCX.exe
  2⤵
  PID:15252
- C:\Windows\System\nomlFZh.exe
  C:\Windows\System\nomlFZh.exe
  2⤵
  PID:8404
- C:\Windows\System\UGlhraJ.exe
  C:\Windows\System\UGlhraJ.exe
  2⤵
  PID:9000
- C:\Windows\System\sAEvFmV.exe
  C:\Windows\System\sAEvFmV.exe
  2⤵
  PID:8464
- C:\Windows\System\MXWDRCS.exe
  C:\Windows\System\MXWDRCS.exe
  2⤵
  PID:15216
- C:\Windows\System\mwxTAfP.exe
  C:\Windows\System\mwxTAfP.exe
  2⤵
  PID:8848
- C:\Windows\System\xaBZijD.exe
  C:\Windows\System\xaBZijD.exe
  2⤵
  PID:14904
- C:\Windows\System\SADgvvQ.exe
  C:\Windows\System\SADgvvQ.exe
  2⤵
  PID:8504
- C:\Windows\System\qfYxKwi.exe
  C:\Windows\System\qfYxKwi.exe
  2⤵
  PID:9688
- C:\Windows\System\IRVHbwQ.exe
  C:\Windows\System\IRVHbwQ.exe
  2⤵
  PID:8976
- C:\Windows\System\olahoEB.exe
  C:\Windows\System\olahoEB.exe
  2⤵
  PID:6308
- C:\Windows\System\ITYVNLc.exe
  C:\Windows\System\ITYVNLc.exe
  2⤵
  PID:10332
- C:\Windows\System\YSSoSKp.exe
  C:\Windows\System\YSSoSKp.exe
  2⤵
  PID:10328
- C:\Windows\System\ZRJWOgJ.exe
  C:\Windows\System\ZRJWOgJ.exe
  2⤵
  PID:9920
- C:\Windows\System\eTqZJZq.exe
  C:\Windows\System\eTqZJZq.exe
  2⤵
  PID:10468
- C:\Windows\System\vTifVWE.exe
  C:\Windows\System\vTifVWE.exe
  2⤵
  PID:9088
- C:\Windows\System\XLywDtH.exe
  C:\Windows\System\XLywDtH.exe
  2⤵
  PID:10404
- C:\Windows\System\RnbVpDg.exe
  C:\Windows\System\RnbVpDg.exe
  2⤵
  PID:8704
- C:\Windows\System\AGksgtO.exe
  C:\Windows\System\AGksgtO.exe
  2⤵
  PID:9612
- C:\Windows\System\dvKhJEj.exe
  C:\Windows\System\dvKhJEj.exe
  2⤵
  PID:8340
- C:\Windows\System\nKZHrKu.exe
  C:\Windows\System\nKZHrKu.exe
  2⤵
  PID:10356
- C:\Windows\System\qbobAGk.exe
  C:\Windows\System\qbobAGk.exe
  2⤵
  PID:13792
- C:\Windows\System\LrCXPQq.exe
  C:\Windows\System\LrCXPQq.exe
  2⤵
  PID:14508
- C:\Windows\System\vkrAeCK.exe
  C:\Windows\System\vkrAeCK.exe
  2⤵
  PID:8104
- C:\Windows\System\kLYjisV.exe
  C:\Windows\System\kLYjisV.exe
  2⤵
  PID:7556
- C:\Windows\System\eKzlSIV.exe
  C:\Windows\System\eKzlSIV.exe
  2⤵
  PID:8372
- C:\Windows\System\oVLWEYo.exe
  C:\Windows\System\oVLWEYo.exe
  2⤵
  PID:7672
- C:\Windows\System\gUoCkqQ.exe
  C:\Windows\System\gUoCkqQ.exe
  2⤵
  PID:10420
- C:\Windows\System\IXPSeta.exe
  C:\Windows\System\IXPSeta.exe
  2⤵
  PID:10620
- C:\Windows\System\htoACJY.exe
  C:\Windows\System\htoACJY.exe
  2⤵
  PID:8752
- C:\Windows\System\CxYVaVW.exe
  C:\Windows\System\CxYVaVW.exe
  2⤵
  PID:11284
- C:\Windows\System\ZQIpeCf.exe
  C:\Windows\System\ZQIpeCf.exe
  2⤵
  PID:8252
- C:\Windows\System\LuZANaZ.exe
  C:\Windows\System\LuZANaZ.exe
  2⤵
  PID:7856
- C:\Windows\System\EOUsXib.exe
  C:\Windows\System\EOUsXib.exe
  2⤵
  PID:11272
- C:\Windows\System\xTVyGgu.exe
  C:\Windows\System\xTVyGgu.exe
  2⤵
  PID:10400
- C:\Windows\System\MOAKonP.exe
  C:\Windows\System\MOAKonP.exe
  2⤵
  PID:10060
- C:\Windows\System\DfDXHcR.exe
  C:\Windows\System\DfDXHcR.exe
  2⤵
  PID:6816
- C:\Windows\System\PprXMnz.exe
  C:\Windows\System\PprXMnz.exe
  2⤵
  PID:7216
- C:\Windows\System\YlGtOsU.exe
  C:\Windows\System\YlGtOsU.exe
  2⤵
  PID:3292
- C:\Windows\System\ztfUOLJ.exe
  C:\Windows\System\ztfUOLJ.exe
  2⤵
  PID:10252
- C:\Windows\System\mYBDuwI.exe
  C:\Windows\System\mYBDuwI.exe
  2⤵
  PID:14772
- C:\Windows\System\brjdTJn.exe
  C:\Windows\System\brjdTJn.exe
  2⤵
  PID:11312
- C:\Windows\System\gGeFcLe.exe
  C:\Windows\System\gGeFcLe.exe
  2⤵
  PID:7280
- C:\Windows\System\QPAdFoK.exe
  C:\Windows\System\QPAdFoK.exe
  2⤵
  PID:14752
- C:\Windows\System\tbFbIUL.exe
  C:\Windows\System\tbFbIUL.exe
  2⤵
  PID:9648
- C:\Windows\System\xJulXhD.exe
  C:\Windows\System\xJulXhD.exe
  2⤵
  PID:10364
- C:\Windows\System\JarTxVN.exe
  C:\Windows\System\JarTxVN.exe
  2⤵
  PID:9504
- C:\Windows\System\iurwpWN.exe
  C:\Windows\System\iurwpWN.exe
  2⤵
  PID:10452
- C:\Windows\System\QwhgCqt.exe
  C:\Windows\System\QwhgCqt.exe
  2⤵
  PID:10320
- C:\Windows\System\ZCvhdkm.exe
  C:\Windows\System\ZCvhdkm.exe
  2⤵
  PID:10556
- C:\Windows\System\CVCnEQb.exe
  C:\Windows\System\CVCnEQb.exe
  2⤵
  PID:9600
- C:\Windows\System\GezuJMv.exe
  C:\Windows\System\GezuJMv.exe
  2⤵
  PID:9712
- C:\Windows\System\GlVYXSS.exe
  C:\Windows\System\GlVYXSS.exe
  2⤵
  PID:9188
- C:\Windows\System\qISeHRr.exe
  C:\Windows\System\qISeHRr.exe
  2⤵
  PID:7444
- C:\Windows\System\euejwvJ.exe
  C:\Windows\System\euejwvJ.exe
  2⤵
  PID:11296
- C:\Windows\System\uETrEqx.exe
  C:\Windows\System\uETrEqx.exe
  2⤵
  PID:15384
- C:\Windows\System\GhkCuMZ.exe
  C:\Windows\System\GhkCuMZ.exe
  2⤵
  PID:15408
- C:\Windows\System\BVxdioi.exe
  C:\Windows\System\BVxdioi.exe
  2⤵
  PID:15432
- C:\Windows\System\FyuWOgC.exe
  C:\Windows\System\FyuWOgC.exe
  2⤵
  PID:15460
- C:\Windows\System\iHJDKqy.exe
  C:\Windows\System\iHJDKqy.exe
  2⤵
  PID:15480
- C:\Windows\System\LwkCbTZ.exe
  C:\Windows\System\LwkCbTZ.exe
  2⤵
  PID:15500
- C:\Windows\System\fHFYCbY.exe
  C:\Windows\System\fHFYCbY.exe
  2⤵
  PID:15516
- C:\Windows\System\UEQzxnh.exe
  C:\Windows\System\UEQzxnh.exe
  2⤵
  PID:15532
- C:\Windows\System\qEXagKa.exe
  C:\Windows\System\qEXagKa.exe
  2⤵
  PID:15548
- C:\Windows\System\jHFwUzv.exe
  C:\Windows\System\jHFwUzv.exe
  2⤵
  PID:15564
- C:\Windows\System\OQSZiiw.exe
  C:\Windows\System\OQSZiiw.exe
  2⤵
  PID:15580
- C:\Windows\System\ElWbgSd.exe
  C:\Windows\System\ElWbgSd.exe
  2⤵
  PID:15596
- C:\Windows\System\OwmPfZX.exe
  C:\Windows\System\OwmPfZX.exe
  2⤵
  PID:15644
- C:\Windows\System\EEBoCqc.exe
  C:\Windows\System\EEBoCqc.exe
  2⤵
  PID:15672
- C:\Windows\System\IgNARQQ.exe
  C:\Windows\System\IgNARQQ.exe
  2⤵
  PID:15692
- C:\Windows\System\hLYasNu.exe
  C:\Windows\System\hLYasNu.exe
  2⤵
  PID:15716
- C:\Windows\System\FfhUEzg.exe
  C:\Windows\System\FfhUEzg.exe
  2⤵
  PID:15912
- C:\Windows\System\BAIFrII.exe
  C:\Windows\System\BAIFrII.exe
  2⤵
  PID:15936
- C:\Windows\System\ZQIZyIB.exe
  C:\Windows\System\ZQIZyIB.exe
  2⤵
  PID:15960
- C:\Windows\System\XpqZMTO.exe
  C:\Windows\System\XpqZMTO.exe
  2⤵
  PID:15988
- C:\Windows\System\VfTsygA.exe
  C:\Windows\System\VfTsygA.exe
  2⤵
  PID:16012
- C:\Windows\System\VYToPlt.exe
  C:\Windows\System\VYToPlt.exe
  2⤵
  PID:16036
- C:\Windows\System\gKSkgqc.exe
  C:\Windows\System\gKSkgqc.exe
  2⤵
  PID:16060
- C:\Windows\System\ztPeAju.exe
  C:\Windows\System\ztPeAju.exe
  2⤵
  PID:16084
- C:\Windows\System\JjOJOnZ.exe
  C:\Windows\System\JjOJOnZ.exe
  2⤵
  PID:16104
- C:\Windows\System\iNFLMea.exe
  C:\Windows\System\iNFLMea.exe
  2⤵
  PID:16124
- C:\Windows\System\fXJmNSh.exe
  C:\Windows\System\fXJmNSh.exe
  2⤵
  PID:10580
- C:\Windows\System\cPQTRRJ.exe
  C:\Windows\System\cPQTRRJ.exe
  2⤵
  PID:8188
- C:\Windows\System\IfcjDZA.exe
  C:\Windows\System\IfcjDZA.exe
  2⤵
  PID:10780
- C:\Windows\System\zrvSHMJ.exe
  C:\Windows\System\zrvSHMJ.exe
  2⤵
  PID:8792
- C:\Windows\System\ANqgpcc.exe
  C:\Windows\System\ANqgpcc.exe
  2⤵
  PID:10544
- C:\Windows\System\hIemcxs.exe
  C:\Windows\System\hIemcxs.exe
  2⤵
  PID:11180
- C:\Windows\System\JozsDPR.exe
  C:\Windows\System\JozsDPR.exe
  2⤵
  PID:5432
- C:\Windows\System\qEtCfna.exe
  C:\Windows\System\qEtCfna.exe
  2⤵
  PID:11024
- C:\Windows\System\pcfAjUP.exe
  C:\Windows\System\pcfAjUP.exe
  2⤵
  PID:10424
- C:\Windows\System\rrncVlp.exe
  C:\Windows\System\rrncVlp.exe
  2⤵
  PID:8908
- C:\Windows\System\DFvoevx.exe
  C:\Windows\System\DFvoevx.exe
  2⤵
  PID:15448
- C:\Windows\System\QQDAvWR.exe
  C:\Windows\System\QQDAvWR.exe
  2⤵
  PID:15528
- C:\Windows\System\TUqyLbJ.exe
  C:\Windows\System\TUqyLbJ.exe
  2⤵
  PID:14796
- C:\Windows\System\zvEVKyJ.exe
  C:\Windows\System\zvEVKyJ.exe
  2⤵
  PID:8348
- C:\Windows\System\ErEtwQF.exe
  C:\Windows\System\ErEtwQF.exe
  2⤵
  PID:15324
- C:\Windows\System\EkdRENS.exe
  C:\Windows\System\EkdRENS.exe
  2⤵
  PID:7836
- C:\Windows\System\QnWRFxR.exe
  C:\Windows\System\QnWRFxR.exe
  2⤵
  PID:10456
- C:\Windows\System\ywmruWS.exe
  C:\Windows\System\ywmruWS.exe
  2⤵
  PID:7388
- C:\Windows\System\UBHxche.exe
  C:\Windows\System\UBHxche.exe
  2⤵
  PID:11388
- C:\Windows\System\VXGrOsd.exe
  C:\Windows\System\VXGrOsd.exe
  2⤵
  PID:8416
- C:\Windows\System\ObeRzzI.exe
  C:\Windows\System\ObeRzzI.exe
  2⤵
  PID:6492
- C:\Windows\System\oTrsBMi.exe
  C:\Windows\System\oTrsBMi.exe
  2⤵
  PID:11412
- C:\Windows\System\aGoCceR.exe
  C:\Windows\System\aGoCceR.exe
  2⤵
  PID:10648
- C:\Windows\System\llKbMRE.exe
  C:\Windows\System\llKbMRE.exe
  2⤵
  PID:11848
- C:\Windows\System\GNiLcwJ.exe
  C:\Windows\System\GNiLcwJ.exe
  2⤵
  PID:15920
- C:\Windows\System\VJAqQfZ.exe
  C:\Windows\System\VJAqQfZ.exe
  2⤵
  PID:15772
- C:\Windows\System\SjNtnbW.exe
  C:\Windows\System\SjNtnbW.exe
  2⤵
  PID:16160
- C:\Windows\System\dNwInRq.exe
  C:\Windows\System\dNwInRq.exe
  2⤵
  PID:15804
- C:\Windows\System\XWgwJYF.exe
  C:\Windows\System\XWgwJYF.exe
  2⤵
  PID:11224
- C:\Windows\System\Malzjry.exe
  C:\Windows\System\Malzjry.exe
  2⤵
  PID:15576
- C:\Windows\System\DyAPGkd.exe
  C:\Windows\System\DyAPGkd.exe
  2⤵
  PID:15592
- C:\Windows\System\IkHqxCt.exe
  C:\Windows\System\IkHqxCt.exe
  2⤵
  PID:15624
- C:\Windows\System\PSvYHoy.exe
  C:\Windows\System\PSvYHoy.exe
  2⤵
  PID:15896
- C:\Windows\System\ubKQgvH.exe
  C:\Windows\System\ubKQgvH.exe
  2⤵
  PID:16328
- C:\Windows\System\OxxUChO.exe
  C:\Windows\System\OxxUChO.exe
  2⤵
  PID:15752
- C:\Windows\System\LJPaPsO.exe
  C:\Windows\System\LJPaPsO.exe
  2⤵
  PID:12452
- C:\Windows\System\gccIlSD.exe
  C:\Windows\System\gccIlSD.exe
  2⤵
  PID:15768
- C:\Windows\System\NLBzela.exe
  C:\Windows\System\NLBzela.exe
  2⤵
  PID:14748
- C:\Windows\System\RXOuXhl.exe
  C:\Windows\System\RXOuXhl.exe
  2⤵
  PID:7428
- C:\Windows\System\oHXVuEE.exe
  C:\Windows\System\oHXVuEE.exe
  2⤵
  PID:5172
- C:\Windows\System\ehlvKIB.exe
  C:\Windows\System\ehlvKIB.exe
  2⤵
  PID:9852
- C:\Windows\System\nkrITNl.exe
  C:\Windows\System\nkrITNl.exe
  2⤵
  PID:15444
- C:\Windows\System\MtOedli.exe
  C:\Windows\System\MtOedli.exe
  2⤵
  PID:13004
- C:\Windows\System\PqCdZir.exe
  C:\Windows\System\PqCdZir.exe
  2⤵
  PID:16208
- C:\Windows\System\DBkiuls.exe
  C:\Windows\System\DBkiuls.exe
  2⤵
  PID:16228
- C:\Windows\System\XwYyAgK.exe
  C:\Windows\System\XwYyAgK.exe
  2⤵
  PID:15496
- C:\Windows\System\cqNSpxy.exe
  C:\Windows\System\cqNSpxy.exe
  2⤵
  PID:15512
- C:\Windows\System\ZHorRtx.exe
  C:\Windows\System\ZHorRtx.exe
  2⤵
  PID:10120
- C:\Windows\System\lCSkBGp.exe
  C:\Windows\System\lCSkBGp.exe
  2⤵
  PID:16356
- C:\Windows\System\ajjriWC.exe
  C:\Windows\System\ajjriWC.exe
  2⤵
  PID:16032
- C:\Windows\System\ZpJVCHL.exe
  C:\Windows\System\ZpJVCHL.exe
  2⤵
  PID:11120
- C:\Windows\System\jXcGHRi.exe
  C:\Windows\System\jXcGHRi.exe
  2⤵
  PID:16092
- C:\Windows\System\govAVrx.exe
  C:\Windows\System\govAVrx.exe
  2⤵
  PID:13224
- C:\Windows\System\EdvWULQ.exe
  C:\Windows\System\EdvWULQ.exe
  2⤵
  PID:11116
- C:\Windows\System\CpIAcNl.exe
  C:\Windows\System\CpIAcNl.exe
  2⤵
  PID:11072
- C:\Windows\System\rsntEao.exe
  C:\Windows\System\rsntEao.exe
  2⤵
  PID:8988
- C:\Windows\System\CljmCWj.exe
  C:\Windows\System\CljmCWj.exe
  2⤵
  PID:16164
- C:\Windows\System\XsAisvf.exe
  C:\Windows\System\XsAisvf.exe
  2⤵
  PID:10992
- C:\Windows\System\uPqxIFf.exe
  C:\Windows\System\uPqxIFf.exe
  2⤵
  PID:6884
- C:\Windows\System\CrpnTQw.exe
  C:\Windows\System\CrpnTQw.exe
  2⤵
  PID:13180
- C:\Windows\System\xfwDhdE.exe
  C:\Windows\System\xfwDhdE.exe
  2⤵
  PID:13268
- C:\Windows\System\MDgltAt.exe
  C:\Windows\System\MDgltAt.exe
  2⤵
  PID:11160
- C:\Windows\System\xvNZSZw.exe
  C:\Windows\System\xvNZSZw.exe
  2⤵
  PID:13256
- C:\Windows\System\vLjPRYr.exe
  C:\Windows\System\vLjPRYr.exe
  2⤵
  PID:4320
- C:\Windows\System\JorevcZ.exe
  C:\Windows\System\JorevcZ.exe
  2⤵
  PID:12908
- C:\Windows\System\xvPeLyN.exe
  C:\Windows\System\xvPeLyN.exe
  2⤵
  PID:11332
- C:\Windows\System\iYmQKhY.exe
  C:\Windows\System\iYmQKhY.exe
  2⤵
  PID:11888
- C:\Windows\System\GWNItii.exe
  C:\Windows\System\GWNItii.exe
  2⤵
  PID:11496
- C:\Windows\System\nrTodvM.exe
  C:\Windows\System\nrTodvM.exe
  2⤵
  PID:12968
- C:\Windows\System\seLrHAE.exe
  C:\Windows\System\seLrHAE.exe
  2⤵
  PID:12400
- C:\Windows\System\lYpQMEh.exe
  C:\Windows\System\lYpQMEh.exe
  2⤵
  PID:12000
- C:\Windows\System\KBKqfrH.exe
  C:\Windows\System\KBKqfrH.exe
  2⤵
  PID:12984
- C:\Windows\System\EzkdyjQ.exe
  C:\Windows\System\EzkdyjQ.exe
  2⤵
  PID:10704
- C:\Windows\System\YVVCmvK.exe
  C:\Windows\System\YVVCmvK.exe
  2⤵
  PID:11664
- C:\Windows\System\krLVuEh.exe
  C:\Windows\System\krLVuEh.exe
  2⤵
  PID:12516
- C:\Windows\System\oenApzS.exe
  C:\Windows\System\oenApzS.exe
  2⤵
  PID:11648
- C:\Windows\System\WFXfrNo.exe
  C:\Windows\System\WFXfrNo.exe
  2⤵
  PID:12660
- C:\Windows\System\HbhSPmk.exe
  C:\Windows\System\HbhSPmk.exe
  2⤵
  PID:12932
- C:\Windows\System\AtCpdYY.exe
  C:\Windows\System\AtCpdYY.exe
  2⤵
  PID:10560
- C:\Windows\System\ipbaSSr.exe
  C:\Windows\System\ipbaSSr.exe
  2⤵
  PID:11872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w3dsuizm.j0v.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\HSlKYYB.exe

Filesize
1.9MB

MD5
5a6f8dbbc930d66910a5ff8e939241a8

SHA1
532102f4cb772fec0d7abcf8e0cb52561fe728e6

SHA256
2f5cc00d89c3d04696a1dfe40640102c60a8b7d9d2a3cda26ae5aea524104287

SHA512
0debb05ff8247523ad11186d0f2c3c67f038d6a61f25aa7836001a1a17c689fd0ca5efb77abe7c02403d510b3e65395f76ca5bff67b3432c22a24f724372aba6

Download Submit
C:\Windows\System\JlJEUdR.exe

Filesize
1.9MB

MD5
e305e08d1de4d208ba48e22649c9d48d

SHA1
752e9179d181bc53c55bf2cc524a02beff941fbb

SHA256
8bc7ec5610cc68be7d593ede2b59c80bbb1f5a0056ca22803e54e8d45d8d0eae

SHA512
1a545bd23213e8db20b4a8e0023a253e91bcd164c0f7a7ef8106655688fa1c6cb1b725d62e132d78cae20acd367296d3fd8af243585a9b686e81e62d71e804e4

Download Submit
C:\Windows\System\JqLDZXy.exe

Filesize
1.9MB

MD5
a8b291bbd9c7d48c79f0393447785309

SHA1
2d96e5d5365eff5c9b59cb4436dd8200f8a53264

SHA256
98690cd6b7f3e81125c154e3e3ed8c8f3d83cc2e382ef721cbd335b6170441b9

SHA512
468f7f28306c249811df2e9e36cbb85beb338cf1300ac0d474281dd7140fa6ecf265fa1409312c9a997151bbce2951ea8a1c17eb5e34f2590a4af262c24fb54d

Download Submit
C:\Windows\System\JqhDMxX.exe

Filesize
1.9MB

MD5
2f8103463d36194dd46fb7394cd75d45

SHA1
332f1fa7e1430877dfeffa9b5ec5f171da5bfda8

SHA256
b0536ee1377dad281c7bf4e05f1a8589285fcce94e22c0e164f85fa14ccc2f6f

SHA512
8cbfcfa107e4efb48868e71649aa9aa32a12525a9968d343444e8566f0e5fa6e3bec8cd0eec20a7bea3228000de1874e007c8a3a10c348d56321b6728e593a91

Download Submit
C:\Windows\System\KvBbiCw.exe

Filesize
1.9MB

MD5
7d6b7544a1442be98d4adcc3a55d2837

SHA1
82e4a6d0b63e4376dbe50c2d0da38251c482136c

SHA256
8255c919b7e5e5602197eff85ecf150489e8ce0e0742f238758fe7f80c7046d8

SHA512
310cb25e41e8c7cd3f74b2a068e582721e7d1c890a28a8c6d4564db05e2cfee57548ce0f1cd530fea32447ccce72a0ec3679734e55f5451b25bb3995d3b746fc

Download Submit
C:\Windows\System\NMjxZLj.exe

Filesize
1.9MB

MD5
47186a92e893b29b5d2bf07601f7a431

SHA1
c4e541890d07e0750c38063f7abeee88eb366b79

SHA256
2db4f138ef3b378b495bba3309acc035fa187545044e92aec60c3121d72606d6

SHA512
22233b297910b5bb71271cc2401f8980a75a60b7a0e6f432831ec92384908e4f273bef4737e401ba2f4e36e90f0e4ca65564c4eb38bc7e38674400ebd92868ff

Download Submit
C:\Windows\System\NcbSLCO.exe

Filesize
1.9MB

MD5
b474c8d0f43144b8d40d2eee93d46e43

SHA1
0e1fad0b30c6f4b0db1b6d34e0c29ba8c5455eea

SHA256
1f9c415e1d8ee08613990fd77f01d1609de4e3d1e66c5f1508ad60171fcbac0d

SHA512
e0cf2fcef2cc8845e75332e48c719a3e3a3c98abbd3fe60af73f1c7b31701aa27e8ae4747354db7c1192d29014501f4778cc0a81eaa183677cdebeda9a84efd0

Download Submit
C:\Windows\System\NmjuxsF.exe

Filesize
1.9MB

MD5
9ec271e1c084ecb58c27d3656e3b1774

SHA1
d4f9358d32a5bfafa45d07d3a544147c470fb829

SHA256
61f1ec365a15b4748f04c91563cd3848e8820c4cc4d3c8dff9a52d16c24b2a53

SHA512
56376e4bb5fdeab159023171321c82f9c77bd590734beb78470076acc3f97bdf26c20d4b465ce89d89faddc1bf98e4da1ba08d7c56b02d68340e0e7fa4a5558a

Download Submit
C:\Windows\System\OYcugqh.exe

Filesize
1.9MB

MD5
519e139ca1ce2854a3f649d57ffee617

SHA1
07c672f0afbbc850d3f515d244426cd1c119f126

SHA256
ae3ba51dccc2f0d2cc84cf969d587d996e72c8dffcaaff0a9fb0ad08c06ff153

SHA512
d2f70eee4f5c8c8de903b770d244a7361078b9e61ce84160171ea83e061be4e6792c8bcb3875e2fbbf43c35245869c1a7998f37ac0c302cbcc2337d5bbcebc7f

Download Submit
C:\Windows\System\OaGwYoG.exe

Filesize
1.9MB

MD5
087bd832832a397b3d34381c55977d48

SHA1
059b020fe9012505c0adc0b140f38a7aa3d0034b

SHA256
1f9a1ca82d02a17bf3be826670ebc5ad3ed7110f40be00bf9693e507e7241dcb

SHA512
a27777f8b6d09b173fbf45998ff2d0cf81a0767bfefdbe26626314f2034b8f846220e44deb4325738513f111e4082f26961971eae54a51f6a079f34a8b4d6aef

Download Submit
C:\Windows\System\OtYPGIe.exe

Filesize
1.9MB

MD5
197d5bcbce776166d86f21c3574ae83b

SHA1
24da69adab7945506c1c6855a3fa35d489a7d240

SHA256
b008049242f964dfeec79908603ec3c6f9261c19d23fd1a7087a88d4c241f8f7

SHA512
fc89f1850ea6ef5a9400b1ff23ecc7aacf56e14aa9c2c3bda62f2e3666722a3b977d5705b0afc8c19cbfd63d03eab74d4dc5aeddf8d71c02225a8a11ca202860

Download Submit
C:\Windows\System\QMJRpdp.exe

Filesize
1.9MB

MD5
2d7d9f4a682f6e86135ac4c7d8e09909

SHA1
dd5b60aa867c62f4b6d247aade687b1c3439eb46

SHA256
d15f7586f83342a8dc5148bb5d1da662a15aa3a0e183c17fb5c4f90ad7d0c06d

SHA512
b1056265eece691f117403cace2df0f790783e421b6b943713294f55dc4255680423dad143e9a1ff16f8f5dbdbf5ee7f4dd57b7e402c6e1d471785a6f53fc70e

Download Submit
C:\Windows\System\UUGzRlG.exe

Filesize
1.9MB

MD5
0ffb83f87134e8ddc442c8ace219b7c4

SHA1
f1d7bde477415cc68a81a806620e17ab3dc76d96

SHA256
754c3d961586b482c2da2670c8e39284e71eb444a034955231f2d754057b15e2

SHA512
500d01814bc39da1fb1417c4883ea8736b0267dec8c5a9826da12928e0f676f7e4b1e81fe2891e18f648b7613d94cf4ffa14c44d9d585c535a6d75c12fd5a923

Download Submit
C:\Windows\System\WTaDNpD.exe

Filesize
1.9MB

MD5
7f735a5983a45d6ae4e76a82b9b027ae

SHA1
de6a54d5e8d985eb5bd14dd90ea02ee4d4d54a87

SHA256
78d8b6ba39c996c9779c9f732421691cb9f753062e612aae7cda2fd8fdae6b06

SHA512
2e76cf347f50e4d0517d53b2b07f8cca7be858c4b22a27b1339529a1f19c0bb5ddd4575f71ffe9b14d9405ccde6590b1564061f53b9180fa08ba6592fa1205fe

Download Submit
C:\Windows\System\YAmrBhf.exe

Filesize
1.9MB

MD5
37ec0636e0fdeca710beccf39eb3d581

SHA1
5cd5b8ff077ccbb7519930241165d7aa472c392e

SHA256
dadef452056561ce0db409c7c5d5408180cf6aa3d9d35ea8ff91590468d4aa42

SHA512
9d4028b11d2406fa291b26de2ba949a54605063e3b09db8116697c8a990bed02de4abf0d80f22bcf421aa8117d8616786fe65811bc9abe48b60ad2d4f6135e58

Download Submit
C:\Windows\System\YaatFSI.exe

Filesize
1.9MB

MD5
ec0eebf8d7753ecb7de6c19d332888d7

SHA1
11d68b3ca35fd03e23be9aa4b2f3ae363139fab7

SHA256
bffe9b56b8778b525a6f04418e36a83049ce6b9dd4a497cf613798e2f6ec0a5d

SHA512
8a3261f50decc217316e9df8aa660fbac4e718715e6e0ad760d1c63c64c18c7ce8cd89541acfc3ada2d0b922902da123880b79bcb5b456b74b6ce176b606fe1f

Download Submit
C:\Windows\System\ZtASUEW.exe

Filesize
1.9MB

MD5
61f89390ced06119c736c9b202246122

SHA1
d4caaf795cd695926513fa783375a9ac7b9775d2

SHA256
ceb700010c73d9b74b017183d5f16104c3b740a518c4d20972d526f38ed59a2d

SHA512
a2ec2634b0debae16ee65dd142ddba900b77e6cbaf8e8badbcebd558070bfb5cc1223dd0071b88c4fc4a00b632a7aa7fad0c4a0b84247300d3b5f01494abd37b

Download Submit
C:\Windows\System\ZtEfgFF.exe

Filesize
1.9MB

MD5
ead3e00fe708cb7c899f9bfc38b54c44

SHA1
07d6fbe144a27f066d43b23fd31f2b5bdf2fa8f7

SHA256
d542ac91d137f71d64ceb4b6e716bcb45f513d00fa8ae2ba4e793280105a6bdf

SHA512
c24621c29a9ef78ad5c48583f390f4d96c373863e741e328d5be47999067f1b36b984d3e9fceb7c42c7b9ada85cdbd45acd527ccf7a729a3a4b03068156d4c8d

Download Submit
C:\Windows\System\bEpesMj.exe

Filesize
1.9MB

MD5
663e6318dfae6333b611894158d4f7e1

SHA1
9658495f15674665175bed9060bfbdda7297a5e8

SHA256
33bdef50dfb0b0f339c29279cdb24f57f97261792c854961e9b6b571fdb24e08

SHA512
5ab28f681bdf8446178688004dbf5316b9c8e23fe751ef4d8981f4628b277e341ff535854fe173b9df1aef0af964477a6b76d850e47fd3e49dd90109b06c87b7

Download Submit
C:\Windows\System\djhqaGk.exe

Filesize
1.9MB

MD5
7245638e65bb0354ac641e9608312d69

SHA1
6beba02445d637d2856c930c6ab5f3a8e00203ca

SHA256
651c724e05cd9ed717636ce6488f3d22b9dd68972e3566bab3734678b9c97613

SHA512
4e7ea61f0697dc123155df0bc12b3d80285f421810b4439097e567f6780f8cb983e6c67bc959d66e15db6f90a53051ca8b242c19b52cb9ef450b3041a5179c50

Download Submit
C:\Windows\System\hVXiMyl.exe

Filesize
1.9MB

MD5
185e0752dfc8a21e391987a149bab143

SHA1
39e0e81586ceb28fc5fbdd32525d6ed123885f7d

SHA256
bbb5277d269c682b778d0dafb3af5a212b8f132bd77af35c1588e248df3106c9

SHA512
5d5d30df0079c46d25853cb419bb71f0f23b8c957239deac108374bb8a0559549630178bfb3f446fda7c923f3daf67f90a048d3074aa67c9f07577026c7006c1

Download Submit
C:\Windows\System\hVzEGZS.exe

Filesize
1.9MB

MD5
f477ec72ac607ffb125175dc9b27ef2b

SHA1
fcb82e844ab32ce674fc976fa5e9ab82f87a646e

SHA256
5cd7f9d16d980112ce17b5c6da694e25d735a074558172cdbd24c834116f92a9

SHA512
886441d41898344bf7342723e8df362366ee86259850a2540092bec587b959c4b45139a1f67f01761e6b238699a797695e63994704c4f95a43cc28bd80d94bbc

Download Submit
C:\Windows\System\jbkSdJh.exe

Filesize
1.9MB

MD5
981652bb01c7da8f12a003b36e750751

SHA1
f6b0dd94e5fd04691bdd4bf628aa6650457c2ff8

SHA256
c0074350ecb95e2725b58abf52c5dfaa1e9c822b8947e4eb417ac660e1596c76

SHA512
2bc296d25f156906789d7a3c78ff53eaaed83d1a5d6d578a183f4c0944d19d758cb4c6d0b9b88fe2e6e27dcb271fbee9d909343b4ee0226c1a58f602fbf8a6e2

Download Submit
C:\Windows\System\mkMASPk.exe

Filesize
1.9MB

MD5
327bb4f7ee078df20d611d528ba2bb4d

SHA1
332e599087807387e903bffe46263c467f4d4a21

SHA256
412c63f4746bd140491416ef2f4ae1aceeeaef12aac0d24b45f51d35b35236c2

SHA512
51b6328d98e1b522b89d065dcaa986ee61e97b988640bbd63c991e7758efcee6284ce00affed2e7585a569dd48b63667e721b610e17c0f7f24f620cb44927b41

Download Submit
C:\Windows\System\nVBoGxK.exe

Filesize
1.9MB

MD5
4be6f5d34c0c11d67fda7921fee5896a

SHA1
e1d195e7785aa855948430da422e888332e4c622

SHA256
f1ab795f0386021173c72e5f364e8a4ea8140290d580f61cea22f962ef83f241

SHA512
31ab329184d3c9a5402bce836e1070e74e1b5fef10d26fa8e74f25bdbeddaee3056408e775227ddcdf7a36ae65a2c79be15fb28d631b9ca1b9e5f68bfe63de92

Download Submit
C:\Windows\System\oKOvsYA.exe

Filesize
1.9MB

MD5
0ee582cf1dfbc1775fedb61238330f05

SHA1
54ae7f35eaf7f1aa233bb71c3201665832d6e185

SHA256
8b6400b41b7144f60cd9c8a03f6dc7e438a8fa135d3769769c722a86a146734e

SHA512
29f62a6c71806e1f8859478652df8aff4994bc96ba8dec366be8c73ae3264667dbf541cb63f7b1d85f5d4c75b275781bf73b2610d33517d693a30be9034ce9da

Download Submit
C:\Windows\System\rfbfEUQ.exe

Filesize
1.9MB

MD5
d3d2c822955a85aa25ee85dc35e7d22e

SHA1
1eb5df54f4c0a5b4a0f2c0538a736c2ca8af59d9

SHA256
fb7b5ef5c84b4767e4a739da08b0461ec3624fbb5a3375dceee30e69f1ad483f

SHA512
cb5fb7ecf2ec7d1095923527a69a9fbe9456f1edfe330b4e02dc4875000a10b586f393fe244b1e47ffeaf8f6bfb2729be1a34338d7d2031a0a6c9b6f627e76da

Download Submit
C:\Windows\System\tDiNuLf.exe

Filesize
1.9MB

MD5
47e9beafc4a6cfb0c2a0048f7161b0da

SHA1
5a87d066d2c45d8640708916a4b32f9da960fc37

SHA256
5c294130f9052dfedfdbded74a7ae1bf94a830d373ef82ec588d2b4244358744

SHA512
501d0d28a7e5c101ce41da004a0d00753108bc2d2dfe4043955c493105ca2bf543be17bf936b4a424540f573b60ee3fdf22570d7e7e3f3f1f27f628f75a16dbf

Download Submit
C:\Windows\System\vWhZENC.exe

Filesize
1.9MB

MD5
c44c4e06c65e38bded1bcf797e2adf45

SHA1
b8f343fedf8aa00860923c7ad493ec63152c4f64

SHA256
a325282968cf78db894eb2b91699d4fff0cc6773198545832c8b772b25069e40

SHA512
99249c39430a3f76b8f4b944b489f27a3fff953d96490ab5d0276f9c7bf33390460bceb4028fcd9a0a40b716cda45fedf112187f6e4d48b1af7dd6dc897f4f45

Download Submit
C:\Windows\System\vwtyTSu.exe

Filesize
1.9MB

MD5
30d0d5496485732cb752e4f34f87e7d6

SHA1
0ffa28ec9c803b0bb279ad231ee623ab6e163b2d

SHA256
abbded1d8f600637b164068e318e7eb43e33296a6f8288706351273d5791b33c

SHA512
36a1e18c0ce369bf1c768c0762d10ab0ad68acdb2648fb757996203a5e32d0211cd7b31d6f669f488e84d264775b7f6dfadd0d6d9843342b23a4953bef98a376

Download Submit
C:\Windows\System\xdhjZDd.exe

Filesize
1.9MB

MD5
93456f003dc4698d04a04613e7cef237

SHA1
7b174f584d52e5ee7b4f5ece10686cc568f9e2f3

SHA256
1495f34cd9d3c05d74a31783810b43124036f02ef23a2d596324f47177443dcb

SHA512
59ff970949ddd6b9ff5431d673db9c01707b27e208dfc5c87f7f24ba75c9b476d3acc7e29319688f797fa7129d4e21b4ff490ae9cc8ab24f4469305966ab9cae

Download Submit
C:\Windows\System\xnZzAuu.exe

Filesize
1.9MB

MD5
2926dfd562f475876ee333e7a9509b75

SHA1
b80816c2a6b89da02e3e55c2434524e453fb8f21

SHA256
26cd9f303f47510dd2d6603b487d3c6e4f4f250a08e31daa0a1b936340cb521a

SHA512
29413ac305e9e3f2d3f854a258a30576b7d2c51e79d4f7f383866d6cf2a0dacc367e886858ddba6e3bef7f6502afa7c7c9fff5982976af57af057c7c9b8e4856

Download Submit
C:\Windows\System\zqrqHHN.exe

Filesize
1.9MB

MD5
ffa68cc81bb84f40a404eb6aa31965f8

SHA1
4ba95e538c11f200cc67fb1bf84fcfa5ea4adf49

SHA256
ec978e344f651edc256f44d227606713ca957428db0c415e988f3e1126b5b75a

SHA512
0b079f4f8a9748af314ceb7216dd1c7cb4f9f653fece3d93c31e426f82cc8240f1f7875cf5899a18fb4d2bc241d224b6b5d45471fb486637d9fc8ee61830a6c4

Download Submit
memory/544-2241-0x00007FF7210E0000-0x00007FF7214D2000-memory.dmp

Filesize
3.9MB

Download
memory/544-1272-0x00007FF7210E0000-0x00007FF7214D2000-memory.dmp

Filesize
3.9MB

Download
memory/548-1052-0x00007FF6EB750000-0x00007FF6EBB42000-memory.dmp

Filesize
3.9MB

Download
memory/740-2164-0x00007FF60F1E0000-0x00007FF60F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/740-1051-0x00007FF60F1E0000-0x00007FF60F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1056-2239-0x00007FF6857F0000-0x00007FF685BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1056-1119-0x00007FF6857F0000-0x00007FF685BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1572-2057-0x00007FF6A06F0000-0x00007FF6A0AE2000-memory.dmp

Filesize
3.9MB

Download
memory/1572-12-0x00007FF6A06F0000-0x00007FF6A0AE2000-memory.dmp

Filesize
3.9MB

Download
memory/1596-15-0x0000021B38000000-0x0000021B38010000-memory.dmp

Filesize
64KB

Download
memory/1596-45-0x0000021B37FA0000-0x0000021B37FC2000-memory.dmp

Filesize
136KB

Download
memory/1596-71-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

Filesize
10.8MB

Download
memory/1596-258-0x0000021B39650000-0x0000021B39DF6000-memory.dmp

Filesize
7.6MB

Download
memory/1596-401-0x0000021B38000000-0x0000021B38010000-memory.dmp

Filesize
64KB

Download
memory/1768-1286-0x00007FF647990000-0x00007FF647D82000-memory.dmp

Filesize
3.9MB

Download
memory/1768-2238-0x00007FF647990000-0x00007FF647D82000-memory.dmp

Filesize
3.9MB

Download
memory/2188-1447-0x00007FF696590000-0x00007FF696982000-memory.dmp

Filesize
3.9MB

Download
memory/2728-422-0x00007FF734D60000-0x00007FF735152000-memory.dmp

Filesize
3.9MB

Download
memory/2728-2216-0x00007FF734D60000-0x00007FF735152000-memory.dmp

Filesize
3.9MB

Download
memory/2940-2172-0x00007FF7C9890000-0x00007FF7C9C82000-memory.dmp

Filesize
3.9MB

Download
memory/2940-1022-0x00007FF7C9890000-0x00007FF7C9C82000-memory.dmp

Filesize
3.9MB

Download
memory/3152-0-0x00007FF69DC40000-0x00007FF69E032000-memory.dmp

Filesize
3.9MB

Download
memory/3152-1-0x00000195DD460000-0x00000195DD470000-memory.dmp

Filesize
64KB

Download
memory/3468-1047-0x00007FF7C3AA0000-0x00007FF7C3E92000-memory.dmp

Filesize
3.9MB

Download
memory/3468-2217-0x00007FF7C3AA0000-0x00007FF7C3E92000-memory.dmp

Filesize
3.9MB

Download
memory/3624-2244-0x00007FF69B8F0000-0x00007FF69BCE2000-memory.dmp

Filesize
3.9MB

Download
memory/3624-1390-0x00007FF69B8F0000-0x00007FF69BCE2000-memory.dmp

Filesize
3.9MB

Download
memory/3692-2240-0x00007FF6AE5A0000-0x00007FF6AE992000-memory.dmp

Filesize
3.9MB

Download
memory/3692-1280-0x00007FF6AE5A0000-0x00007FF6AE992000-memory.dmp

Filesize
3.9MB

Download
memory/3780-2237-0x00007FF724E40000-0x00007FF725232000-memory.dmp

Filesize
3.9MB

Download
memory/3780-1289-0x00007FF724E40000-0x00007FF725232000-memory.dmp

Filesize
3.9MB

Download
memory/3876-14-0x00007FF7B74F0000-0x00007FF7B78E2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-2065-0x00007FF7B74F0000-0x00007FF7B78E2000-memory.dmp

Filesize
3.9MB

Download
memory/4024-2211-0x00007FF7C1890000-0x00007FF7C1C82000-memory.dmp

Filesize
3.9MB

Download
memory/4024-1069-0x00007FF7C1890000-0x00007FF7C1C82000-memory.dmp

Filesize
3.9MB

Download
memory/4056-2112-0x00007FF6DD100000-0x00007FF6DD4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-437-0x00007FF6DD100000-0x00007FF6DD4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4076-1097-0x00007FF7EF250000-0x00007FF7EF642000-memory.dmp

Filesize
3.9MB

Download
memory/4076-2208-0x00007FF7EF250000-0x00007FF7EF642000-memory.dmp

Filesize
3.9MB

Download
memory/4836-2242-0x00007FF7E17E0000-0x00007FF7E1BD2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-1233-0x00007FF7E17E0000-0x00007FF7E1BD2000-memory.dmp

Filesize
3.9MB

Download
memory/4924-2243-0x00007FF6F0950000-0x00007FF6F0D42000-memory.dmp

Filesize
3.9MB

Download
memory/4924-1143-0x00007FF6F0950000-0x00007FF6F0D42000-memory.dmp

Filesize
3.9MB

Download
memory/4972-2191-0x00007FF7EE4C0000-0x00007FF7EE8B2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-1162-0x00007FF7EE4C0000-0x00007FF7EE8B2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-1078-0x00007FF744820000-0x00007FF744C12000-memory.dmp

Filesize
3.9MB

Download