xmrig | 6c49366f48980f09c2305499bfea16b89e0ed567c37e244b8f5deda003377765

Analysis

max time kernel
137s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
Size

1.9MB
MD5

0a501b80cb55d5e79d79f7f86813de68
SHA1

527100d8b1276078488ba7f770125441f3a35944
SHA256

6c49366f48980f09c2305499bfea16b89e0ed567c37e244b8f5deda003377765
SHA512

5f36856e0d51fee79ea2ba1517ef19296dde7ae08ea78e5ce0b0c17cf7895abbabc402ef83302c669f40e318fc31a6af385d0025a8b726e706fc35f8bc4d4b0d
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1h:NABw

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral2/memory/4892-19-0x00007FF751420000-0x00007FF751812000-memory.dmp	xmrig
behavioral2/memory/1464-14-0x00007FF671520000-0x00007FF671912000-memory.dmp	xmrig
behavioral2/memory/1676-53-0x00007FF696090000-0x00007FF696482000-memory.dmp	xmrig
behavioral2/memory/4960-49-0x00007FF6650E0000-0x00007FF6654D2000-memory.dmp	xmrig
behavioral2/memory/2028-97-0x00007FF6E6190000-0x00007FF6E6582000-memory.dmp	xmrig
behavioral2/memory/4460-172-0x00007FF6A57F0000-0x00007FF6A5BE2000-memory.dmp	xmrig
behavioral2/memory/4972-178-0x00007FF6C2460000-0x00007FF6C2852000-memory.dmp	xmrig
behavioral2/memory/4712-175-0x00007FF7A0370000-0x00007FF7A0762000-memory.dmp	xmrig
behavioral2/memory/2552-155-0x00007FF6695D0000-0x00007FF6699C2000-memory.dmp	xmrig
behavioral2/memory/4892-796-0x00007FF751420000-0x00007FF751812000-memory.dmp	xmrig
behavioral2/memory/1764-1384-0x00007FF6E4A80000-0x00007FF6E4E72000-memory.dmp	xmrig
behavioral2/memory/2600-1970-0x00007FF79C6D0000-0x00007FF79CAC2000-memory.dmp	xmrig
behavioral2/memory/512-1971-0x00007FF721590000-0x00007FF721982000-memory.dmp	xmrig
behavioral2/memory/3304-1974-0x00007FF70A860000-0x00007FF70AC52000-memory.dmp	xmrig
behavioral2/memory/3076-2258-0x00007FF68D4A0000-0x00007FF68D892000-memory.dmp	xmrig
behavioral2/memory/1328-3001-0x00007FF6A3BB0000-0x00007FF6A3FA2000-memory.dmp	xmrig
behavioral2/memory/3996-3754-0x00007FF7EC280000-0x00007FF7EC672000-memory.dmp	xmrig
behavioral2/memory/448-3756-0x00007FF6F3140000-0x00007FF6F3532000-memory.dmp	xmrig
behavioral2/memory/3768-4111-0x00007FF76BB70000-0x00007FF76BF62000-memory.dmp	xmrig
behavioral2/memory/4712-5371-0x00007FF7A0370000-0x00007FF7A0762000-memory.dmp	xmrig
behavioral2/memory/2552-5384-0x00007FF6695D0000-0x00007FF6699C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1464	CjMCvQJ.exe
4892	doJqSZf.exe
1676	hqLDeTX.exe
2600	TRYMBue.exe
4960	eAeQGHk.exe
3304	wQBLupF.exe
512	CWdFmaR.exe
3076	lYOvHqK.exe
4348	ssfpDtk.exe
4356	NykLWex.exe
1328	wKFYuAE.exe
2028	GcNDMTm.exe
440	RHsMRom.exe
4460	ILURZVr.exe
3996	wRGQxYi.exe
448	QSyDuQu.exe
4712	okIFGLC.exe
636	sGRWQCQ.exe
2552	xJOVGOZ.exe
3768	RnMgFcD.exe
4972	wexFqeq.exe
3772	jxFarMj.exe
4676	chGfItR.exe
1460	ZOXgkiX.exe
2040	dLArvqR.exe
1268	lORfOyw.exe
4500	sZsofqL.exe
2672	tndRQJI.exe
3796	tVqkMEo.exe
3556	lpTTprt.exe
4160	xcZqUMY.exe
3728	kPrgrvI.exe
3140	PpVRnbV.exe
5096	dAPPNbg.exe
3264	qLJaZhn.exe
1196	fFDeRAG.exe
4720	CVUAqHG.exe
4396	KwkIxqd.exe
4380	REwaifb.exe
2240	qNRzFZr.exe
4492	kmchFmb.exe
3224	SkVbLaC.exe
2616	bWjhHAy.exe
1880	SJVtffK.exe
548	bojZXRj.exe
432	TOFTDrH.exe
2788	ZUgpCAp.exe
3748	UpDEOte.exe
4924	mFmCIvQ.exe
4448	VyRsESw.exe
620	VnmSTLd.exe
2320	nuHuAKJ.exe
4244	TeWVhpR.exe
4996	WZDknRr.exe
3640	KcacsSa.exe
2692	XWjBwPS.exe
2828	goRAoFy.exe
3664	kyAGFbF.exe
972	CLAYaDd.exe
1340	GQpMVLa.exe
4012	QueGQIT.exe
2772	bVIRadA.exe
2140	QlNBoNB.exe
3812	XyjQzjQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1764-0-0x00007FF6E4A80000-0x00007FF6E4E72000-memory.dmp	upx
behavioral2/files/0x000b000000023bc2-10.dat	upx
behavioral2/files/0x000a000000023bc6-16.dat	upx
behavioral2/memory/4892-19-0x00007FF751420000-0x00007FF751812000-memory.dmp	upx
behavioral2/memory/1464-14-0x00007FF671520000-0x00007FF671912000-memory.dmp	upx
behavioral2/files/0x000a000000023bc7-31.dat	upx
behavioral2/files/0x000a000000023bca-36.dat	upx
behavioral2/files/0x000a000000023bcb-48.dat	upx
behavioral2/memory/1676-53-0x00007FF696090000-0x00007FF696482000-memory.dmp	upx
behavioral2/files/0x000b000000023bc8-65.dat	upx
behavioral2/memory/4356-68-0x00007FF6637C0000-0x00007FF663BB2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-74.dat	upx
behavioral2/files/0x000a000000023bcc-70.dat	upx
behavioral2/memory/4348-69-0x00007FF68EE60000-0x00007FF68F252000-memory.dmp	upx
behavioral2/memory/3076-67-0x00007FF68D4A0000-0x00007FF68D892000-memory.dmp	upx
behavioral2/memory/3304-60-0x00007FF70A860000-0x00007FF70AC52000-memory.dmp	upx
behavioral2/files/0x000b000000023bc9-55.dat	upx
behavioral2/memory/512-50-0x00007FF721590000-0x00007FF721982000-memory.dmp	upx
behavioral2/memory/4960-49-0x00007FF6650E0000-0x00007FF6654D2000-memory.dmp	upx
behavioral2/memory/2600-42-0x00007FF79C6D0000-0x00007FF79CAC2000-memory.dmp	upx
behavioral2/files/0x0010000000023b7b-9.dat	upx
behavioral2/files/0x000a000000023bce-78.dat	upx
behavioral2/files/0x000a000000023bcf-86.dat	upx
behavioral2/files/0x000b000000023bc3-87.dat	upx
behavioral2/memory/1328-83-0x00007FF6A3BB0000-0x00007FF6A3FA2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd0-102.dat	upx
behavioral2/memory/2028-97-0x00007FF6E6190000-0x00007FF6E6582000-memory.dmp	upx
behavioral2/files/0x000a000000023bd6-115.dat	upx
behavioral2/files/0x000a000000023bda-144.dat	upx
behavioral2/files/0x000a000000023bd8-151.dat	upx
behavioral2/files/0x000a000000023bdb-163.dat	upx
behavioral2/memory/4460-172-0x00007FF6A57F0000-0x00007FF6A5BE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bde-176.dat	upx
behavioral2/memory/4972-178-0x00007FF6C2460000-0x00007FF6C2852000-memory.dmp	upx
behavioral2/files/0x000b000000023bdf-177.dat	upx
behavioral2/memory/4712-175-0x00007FF7A0370000-0x00007FF7A0762000-memory.dmp	upx
behavioral2/files/0x000a000000023bdd-173.dat	upx
behavioral2/files/0x000a000000023bdc-168.dat	upx
behavioral2/memory/3768-165-0x00007FF76BB70000-0x00007FF76BF62000-memory.dmp	upx
behavioral2/memory/2552-155-0x00007FF6695D0000-0x00007FF6699C2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd9-153.dat	upx
behavioral2/files/0x000a000000023bd7-150.dat	upx
behavioral2/memory/636-146-0x00007FF667A00000-0x00007FF667DF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd5-141.dat	upx
behavioral2/files/0x000a000000023bd1-139.dat	upx
behavioral2/files/0x000a000000023bd4-136.dat	upx
behavioral2/memory/448-133-0x00007FF6F3140000-0x00007FF6F3532000-memory.dmp	upx
behavioral2/memory/3996-124-0x00007FF7EC280000-0x00007FF7EC672000-memory.dmp	upx
behavioral2/files/0x000a000000023bd3-123.dat	upx
behavioral2/files/0x000a000000023bd2-119.dat	upx
behavioral2/memory/440-108-0x00007FF73E3D0000-0x00007FF73E7C2000-memory.dmp	upx
behavioral2/files/0x000a000000023be9-187.dat	upx
behavioral2/files/0x000e000000023bf0-190.dat	upx
behavioral2/files/0x000b000000023be0-191.dat	upx
behavioral2/files/0x0008000000023bf9-198.dat	upx
behavioral2/memory/4892-796-0x00007FF751420000-0x00007FF751812000-memory.dmp	upx
behavioral2/memory/1764-1384-0x00007FF6E4A80000-0x00007FF6E4E72000-memory.dmp	upx
behavioral2/memory/2600-1970-0x00007FF79C6D0000-0x00007FF79CAC2000-memory.dmp	upx
behavioral2/memory/512-1971-0x00007FF721590000-0x00007FF721982000-memory.dmp	upx
behavioral2/memory/3304-1974-0x00007FF70A860000-0x00007FF70AC52000-memory.dmp	upx
behavioral2/memory/3076-2258-0x00007FF68D4A0000-0x00007FF68D892000-memory.dmp	upx
behavioral2/memory/1328-3001-0x00007FF6A3BB0000-0x00007FF6A3FA2000-memory.dmp	upx
behavioral2/memory/3996-3754-0x00007FF7EC280000-0x00007FF7EC672000-memory.dmp	upx
behavioral2/memory/448-3756-0x00007FF6F3140000-0x00007FF6F3532000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\knBzgKv.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\qqKOLBm.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\VxvSjRG.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\uFVBqsF.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\dHBRdOG.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\rEMaREt.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\MSnMZLi.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\TNubYTR.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\xHfqGzA.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\tEefHAa.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\IEmZBwG.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\HraSzFZ.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\iqPHFFP.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\mnQZuwy.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\jvMCpYg.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\vIBPKnp.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\kSwUbqQ.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\uyEdzzr.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\TvHqSrK.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\XQUqzQu.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\aSNsZin.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\rofPTKV.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\prHsLDH.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\lytITcq.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\zIFuoGq.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\XerFyAO.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\TPIRJiE.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\dnpeuzx.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\omnYtnx.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\qZYLGXl.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\JypiLaq.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\eRGRQOp.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\SqrffIT.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\WwtwgId.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\zqYRpHL.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\ACUxBba.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\BdPtgya.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\VvCbYSs.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\zGCECzK.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\xFKhfnb.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\drqgdoQ.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\jLeKetO.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\kklcALP.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\preSIio.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\MmJmifY.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\BURQsmj.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\KGcTTmH.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\sMEtYdO.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\GluEVCL.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\kNXPyXg.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\EAjSzDR.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\JCTUVzZ.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\ONVoGDq.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\GiTOWnH.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\ZVTBiwR.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\zLWtTrq.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\HPWkaba.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\YQculKo.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\oLqmvkx.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\PSEHqjn.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\DpasxTH.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\vIhvkpa.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\EJUDNJf.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
File created	C:\Windows\System\YXmUMCA.exe	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
688	powershell.exe
688	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeLockMemoryPrivilege	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 688	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	85
PID 1764 wrote to memory of 688	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	85
PID 1764 wrote to memory of 1464	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	86
PID 1764 wrote to memory of 1464	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	86
PID 1764 wrote to memory of 4892	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	87
PID 1764 wrote to memory of 4892	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	87
PID 1764 wrote to memory of 1676	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	88
PID 1764 wrote to memory of 1676	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	88
PID 1764 wrote to memory of 2600	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	89
PID 1764 wrote to memory of 2600	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	89
PID 1764 wrote to memory of 4960	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	90
PID 1764 wrote to memory of 4960	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	90
PID 1764 wrote to memory of 3304	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	91
PID 1764 wrote to memory of 3304	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	91
PID 1764 wrote to memory of 512	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	92
PID 1764 wrote to memory of 512	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	92
PID 1764 wrote to memory of 3076	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	93
PID 1764 wrote to memory of 3076	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	93
PID 1764 wrote to memory of 4348	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	94
PID 1764 wrote to memory of 4348	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	94
PID 1764 wrote to memory of 4356	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	95
PID 1764 wrote to memory of 4356	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	95
PID 1764 wrote to memory of 1328	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	96
PID 1764 wrote to memory of 1328	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	96
PID 1764 wrote to memory of 2028	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	97
PID 1764 wrote to memory of 2028	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	97
PID 1764 wrote to memory of 440	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	99
PID 1764 wrote to memory of 440	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	99
PID 1764 wrote to memory of 4460	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	100
PID 1764 wrote to memory of 4460	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	100
PID 1764 wrote to memory of 4712	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	101
PID 1764 wrote to memory of 4712	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	101
PID 1764 wrote to memory of 3996	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	102
PID 1764 wrote to memory of 3996	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	102
PID 1764 wrote to memory of 448	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	103
PID 1764 wrote to memory of 448	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	103
PID 1764 wrote to memory of 636	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	104
PID 1764 wrote to memory of 636	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	104
PID 1764 wrote to memory of 2552	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	105
PID 1764 wrote to memory of 2552	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	105
PID 1764 wrote to memory of 3768	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	106
PID 1764 wrote to memory of 3768	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	106
PID 1764 wrote to memory of 4972	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	107
PID 1764 wrote to memory of 4972	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	107
PID 1764 wrote to memory of 3772	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	108
PID 1764 wrote to memory of 3772	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	108
PID 1764 wrote to memory of 4676	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	109
PID 1764 wrote to memory of 4676	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	109
PID 1764 wrote to memory of 1460	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	110
PID 1764 wrote to memory of 1460	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	110
PID 1764 wrote to memory of 2040	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	111
PID 1764 wrote to memory of 2040	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	111
PID 1764 wrote to memory of 1268	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	112
PID 1764 wrote to memory of 1268	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	112
PID 1764 wrote to memory of 4500	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	113
PID 1764 wrote to memory of 4500	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	113
PID 1764 wrote to memory of 2672	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	114
PID 1764 wrote to memory of 2672	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	114
PID 1764 wrote to memory of 3796	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	115
PID 1764 wrote to memory of 3796	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	115
PID 1764 wrote to memory of 3556	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	116
PID 1764 wrote to memory of 3556	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	116
PID 1764 wrote to memory of 4160	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	118
PID 1764 wrote to memory of 4160	1764	0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a501b80cb55d5e79d79f7f86813de68_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\System\CjMCvQJ.exe
  C:\Windows\System\CjMCvQJ.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\doJqSZf.exe
  C:\Windows\System\doJqSZf.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\hqLDeTX.exe
  C:\Windows\System\hqLDeTX.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\TRYMBue.exe
  C:\Windows\System\TRYMBue.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\eAeQGHk.exe
  C:\Windows\System\eAeQGHk.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\wQBLupF.exe
  C:\Windows\System\wQBLupF.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\CWdFmaR.exe
  C:\Windows\System\CWdFmaR.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\lYOvHqK.exe
  C:\Windows\System\lYOvHqK.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\ssfpDtk.exe
  C:\Windows\System\ssfpDtk.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\NykLWex.exe
  C:\Windows\System\NykLWex.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\wKFYuAE.exe
  C:\Windows\System\wKFYuAE.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\GcNDMTm.exe
  C:\Windows\System\GcNDMTm.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\RHsMRom.exe
  C:\Windows\System\RHsMRom.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\ILURZVr.exe
  C:\Windows\System\ILURZVr.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\okIFGLC.exe
  C:\Windows\System\okIFGLC.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\wRGQxYi.exe
  C:\Windows\System\wRGQxYi.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\QSyDuQu.exe
  C:\Windows\System\QSyDuQu.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\sGRWQCQ.exe
  C:\Windows\System\sGRWQCQ.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\xJOVGOZ.exe
  C:\Windows\System\xJOVGOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\RnMgFcD.exe
  C:\Windows\System\RnMgFcD.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\wexFqeq.exe
  C:\Windows\System\wexFqeq.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\jxFarMj.exe
  C:\Windows\System\jxFarMj.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\chGfItR.exe
  C:\Windows\System\chGfItR.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\ZOXgkiX.exe
  C:\Windows\System\ZOXgkiX.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\dLArvqR.exe
  C:\Windows\System\dLArvqR.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\lORfOyw.exe
  C:\Windows\System\lORfOyw.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\sZsofqL.exe
  C:\Windows\System\sZsofqL.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\tndRQJI.exe
  C:\Windows\System\tndRQJI.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\tVqkMEo.exe
  C:\Windows\System\tVqkMEo.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\lpTTprt.exe
  C:\Windows\System\lpTTprt.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\xcZqUMY.exe
  C:\Windows\System\xcZqUMY.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\kPrgrvI.exe
  C:\Windows\System\kPrgrvI.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\PpVRnbV.exe
  C:\Windows\System\PpVRnbV.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\dAPPNbg.exe
  C:\Windows\System\dAPPNbg.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\qLJaZhn.exe
  C:\Windows\System\qLJaZhn.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\fFDeRAG.exe
  C:\Windows\System\fFDeRAG.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\CVUAqHG.exe
  C:\Windows\System\CVUAqHG.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\KwkIxqd.exe
  C:\Windows\System\KwkIxqd.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\REwaifb.exe
  C:\Windows\System\REwaifb.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\qNRzFZr.exe
  C:\Windows\System\qNRzFZr.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\kmchFmb.exe
  C:\Windows\System\kmchFmb.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\SkVbLaC.exe
  C:\Windows\System\SkVbLaC.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\bWjhHAy.exe
  C:\Windows\System\bWjhHAy.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\SJVtffK.exe
  C:\Windows\System\SJVtffK.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\bojZXRj.exe
  C:\Windows\System\bojZXRj.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\TOFTDrH.exe
  C:\Windows\System\TOFTDrH.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\ZUgpCAp.exe
  C:\Windows\System\ZUgpCAp.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\UpDEOte.exe
  C:\Windows\System\UpDEOte.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\mFmCIvQ.exe
  C:\Windows\System\mFmCIvQ.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\VyRsESw.exe
  C:\Windows\System\VyRsESw.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\VnmSTLd.exe
  C:\Windows\System\VnmSTLd.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\nuHuAKJ.exe
  C:\Windows\System\nuHuAKJ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\TeWVhpR.exe
  C:\Windows\System\TeWVhpR.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\WZDknRr.exe
  C:\Windows\System\WZDknRr.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\KcacsSa.exe
  C:\Windows\System\KcacsSa.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\XWjBwPS.exe
  C:\Windows\System\XWjBwPS.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\goRAoFy.exe
  C:\Windows\System\goRAoFy.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\kyAGFbF.exe
  C:\Windows\System\kyAGFbF.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\CLAYaDd.exe
  C:\Windows\System\CLAYaDd.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\GQpMVLa.exe
  C:\Windows\System\GQpMVLa.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\QueGQIT.exe
  C:\Windows\System\QueGQIT.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\QlNBoNB.exe
  C:\Windows\System\QlNBoNB.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\bVIRadA.exe
  C:\Windows\System\bVIRadA.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\XyjQzjQ.exe
  C:\Windows\System\XyjQzjQ.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\flNYjrp.exe
  C:\Windows\System\flNYjrp.exe
  2⤵
  PID:2676
- C:\Windows\System\ccViUcV.exe
  C:\Windows\System\ccViUcV.exe
  2⤵
  PID:2964
- C:\Windows\System\skyvsZW.exe
  C:\Windows\System\skyvsZW.exe
  2⤵
  PID:1056
- C:\Windows\System\yUkEuqt.exe
  C:\Windows\System\yUkEuqt.exe
  2⤵
  PID:4240
- C:\Windows\System\dEwWxZj.exe
  C:\Windows\System\dEwWxZj.exe
  2⤵
  PID:100
- C:\Windows\System\oSSuknM.exe
  C:\Windows\System\oSSuknM.exe
  2⤵
  PID:4600
- C:\Windows\System\yPguygi.exe
  C:\Windows\System\yPguygi.exe
  2⤵
  PID:2612
- C:\Windows\System\VkpcdgB.exe
  C:\Windows\System\VkpcdgB.exe
  2⤵
  PID:1412
- C:\Windows\System\dDZCNRy.exe
  C:\Windows\System\dDZCNRy.exe
  2⤵
  PID:4748
- C:\Windows\System\sLvLtto.exe
  C:\Windows\System\sLvLtto.exe
  2⤵
  PID:1924
- C:\Windows\System\SFUrjNa.exe
  C:\Windows\System\SFUrjNa.exe
  2⤵
  PID:4888
- C:\Windows\System\oLHhAvl.exe
  C:\Windows\System\oLHhAvl.exe
  2⤵
  PID:2684
- C:\Windows\System\VOJZWFj.exe
  C:\Windows\System\VOJZWFj.exe
  2⤵
  PID:1216
- C:\Windows\System\fARmXLc.exe
  C:\Windows\System\fARmXLc.exe
  2⤵
  PID:4172
- C:\Windows\System\rgBWEnQ.exe
  C:\Windows\System\rgBWEnQ.exe
  2⤵
  PID:4652
- C:\Windows\System\RuTzkjK.exe
  C:\Windows\System\RuTzkjK.exe
  2⤵
  PID:3032
- C:\Windows\System\FvfzDFm.exe
  C:\Windows\System\FvfzDFm.exe
  2⤵
  PID:4840
- C:\Windows\System\vAtOLwO.exe
  C:\Windows\System\vAtOLwO.exe
  2⤵
  PID:4732
- C:\Windows\System\IfLHHCz.exe
  C:\Windows\System\IfLHHCz.exe
  2⤵
  PID:2912
- C:\Windows\System\iLmTtqt.exe
  C:\Windows\System\iLmTtqt.exe
  2⤵
  PID:5116
- C:\Windows\System\WXqmmvQ.exe
  C:\Windows\System\WXqmmvQ.exe
  2⤵
  PID:3856
- C:\Windows\System\zReHmwJ.exe
  C:\Windows\System\zReHmwJ.exe
  2⤵
  PID:2452
- C:\Windows\System\dmBSyFX.exe
  C:\Windows\System\dmBSyFX.exe
  2⤵
  PID:2332
- C:\Windows\System\CrDpXQS.exe
  C:\Windows\System\CrDpXQS.exe
  2⤵
  PID:3976
- C:\Windows\System\QeyxDcV.exe
  C:\Windows\System\QeyxDcV.exe
  2⤵
  PID:1332
- C:\Windows\System\GptjsdM.exe
  C:\Windows\System\GptjsdM.exe
  2⤵
  PID:3660
- C:\Windows\System\kugcOlD.exe
  C:\Windows\System\kugcOlD.exe
  2⤵
  PID:2620
- C:\Windows\System\MfEImKp.exe
  C:\Windows\System\MfEImKp.exe
  2⤵
  PID:4376
- C:\Windows\System\CuoIqMB.exe
  C:\Windows\System\CuoIqMB.exe
  2⤵
  PID:712
- C:\Windows\System\xmRftfj.exe
  C:\Windows\System\xmRftfj.exe
  2⤵
  PID:2156
- C:\Windows\System\cwSUwyS.exe
  C:\Windows\System\cwSUwyS.exe
  2⤵
  PID:5124
- C:\Windows\System\pAkBmdT.exe
  C:\Windows\System\pAkBmdT.exe
  2⤵
  PID:5160
- C:\Windows\System\XbPTXUb.exe
  C:\Windows\System\XbPTXUb.exe
  2⤵
  PID:5184
- C:\Windows\System\PltILTF.exe
  C:\Windows\System\PltILTF.exe
  2⤵
  PID:5208
- C:\Windows\System\iaWXfgt.exe
  C:\Windows\System\iaWXfgt.exe
  2⤵
  PID:5232
- C:\Windows\System\IcgKawT.exe
  C:\Windows\System\IcgKawT.exe
  2⤵
  PID:5288
- C:\Windows\System\HHmesVm.exe
  C:\Windows\System\HHmesVm.exe
  2⤵
  PID:5312
- C:\Windows\System\MxSEeFi.exe
  C:\Windows\System\MxSEeFi.exe
  2⤵
  PID:5344
- C:\Windows\System\ajytcrA.exe
  C:\Windows\System\ajytcrA.exe
  2⤵
  PID:5360
- C:\Windows\System\itLdjkB.exe
  C:\Windows\System\itLdjkB.exe
  2⤵
  PID:5380
- C:\Windows\System\TblblVh.exe
  C:\Windows\System\TblblVh.exe
  2⤵
  PID:5412
- C:\Windows\System\DLEyMku.exe
  C:\Windows\System\DLEyMku.exe
  2⤵
  PID:5440
- C:\Windows\System\TrLjvhV.exe
  C:\Windows\System\TrLjvhV.exe
  2⤵
  PID:5468
- C:\Windows\System\oaWphZu.exe
  C:\Windows\System\oaWphZu.exe
  2⤵
  PID:5500
- C:\Windows\System\bQibRom.exe
  C:\Windows\System\bQibRom.exe
  2⤵
  PID:5532
- C:\Windows\System\ftFODzw.exe
  C:\Windows\System\ftFODzw.exe
  2⤵
  PID:5556
- C:\Windows\System\mAiKJNV.exe
  C:\Windows\System\mAiKJNV.exe
  2⤵
  PID:5596
- C:\Windows\System\CZVhbAu.exe
  C:\Windows\System\CZVhbAu.exe
  2⤵
  PID:5632
- C:\Windows\System\qxcllwS.exe
  C:\Windows\System\qxcllwS.exe
  2⤵
  PID:5652
- C:\Windows\System\IIzUMyB.exe
  C:\Windows\System\IIzUMyB.exe
  2⤵
  PID:5700
- C:\Windows\System\UFNsWBG.exe
  C:\Windows\System\UFNsWBG.exe
  2⤵
  PID:5728
- C:\Windows\System\fFdlEZl.exe
  C:\Windows\System\fFdlEZl.exe
  2⤵
  PID:5780
- C:\Windows\System\Pxvlgyc.exe
  C:\Windows\System\Pxvlgyc.exe
  2⤵
  PID:5800
- C:\Windows\System\JNJJqRR.exe
  C:\Windows\System\JNJJqRR.exe
  2⤵
  PID:5824
- C:\Windows\System\cjodcNh.exe
  C:\Windows\System\cjodcNh.exe
  2⤵
  PID:5848
- C:\Windows\System\QHxHkDt.exe
  C:\Windows\System\QHxHkDt.exe
  2⤵
  PID:5880
- C:\Windows\System\IheZBqK.exe
  C:\Windows\System\IheZBqK.exe
  2⤵
  PID:5900
- C:\Windows\System\XLUtpVS.exe
  C:\Windows\System\XLUtpVS.exe
  2⤵
  PID:5928
- C:\Windows\System\wqRnAht.exe
  C:\Windows\System\wqRnAht.exe
  2⤵
  PID:5960
- C:\Windows\System\SBzelbP.exe
  C:\Windows\System\SBzelbP.exe
  2⤵
  PID:5976
- C:\Windows\System\uDqzbSA.exe
  C:\Windows\System\uDqzbSA.exe
  2⤵
  PID:6012
- C:\Windows\System\dUuTRvX.exe
  C:\Windows\System\dUuTRvX.exe
  2⤵
  PID:6032
- C:\Windows\System\pAeDGXQ.exe
  C:\Windows\System\pAeDGXQ.exe
  2⤵
  PID:6096
- C:\Windows\System\NScYkNI.exe
  C:\Windows\System\NScYkNI.exe
  2⤵
  PID:6136
- C:\Windows\System\pmYSHIZ.exe
  C:\Windows\System\pmYSHIZ.exe
  2⤵
  PID:1872
- C:\Windows\System\yaZgfqp.exe
  C:\Windows\System\yaZgfqp.exe
  2⤵
  PID:5176
- C:\Windows\System\DMFWXjE.exe
  C:\Windows\System\DMFWXjE.exe
  2⤵
  PID:5200
- C:\Windows\System\eeXwjGk.exe
  C:\Windows\System\eeXwjGk.exe
  2⤵
  PID:5228
- C:\Windows\System\XqCHGPI.exe
  C:\Windows\System\XqCHGPI.exe
  2⤵
  PID:5280
- C:\Windows\System\BieLpnb.exe
  C:\Windows\System\BieLpnb.exe
  2⤵
  PID:5304
- C:\Windows\System\QgFjdTw.exe
  C:\Windows\System\QgFjdTw.exe
  2⤵
  PID:5356
- C:\Windows\System\tgtTMVm.exe
  C:\Windows\System\tgtTMVm.exe
  2⤵
  PID:5436
- C:\Windows\System\VtFiCup.exe
  C:\Windows\System\VtFiCup.exe
  2⤵
  PID:5528
- C:\Windows\System\zxqQpKh.exe
  C:\Windows\System\zxqQpKh.exe
  2⤵
  PID:5624
- C:\Windows\System\zAEcKay.exe
  C:\Windows\System\zAEcKay.exe
  2⤵
  PID:5696
- C:\Windows\System\muTncvF.exe
  C:\Windows\System\muTncvF.exe
  2⤵
  PID:5840
- C:\Windows\System\tmXHFZu.exe
  C:\Windows\System\tmXHFZu.exe
  2⤵
  PID:5844
- C:\Windows\System\ARkHQZF.exe
  C:\Windows\System\ARkHQZF.exe
  2⤵
  PID:5944
- C:\Windows\System\fAlkThz.exe
  C:\Windows\System\fAlkThz.exe
  2⤵
  PID:5968
- C:\Windows\System\RRivUNk.exe
  C:\Windows\System\RRivUNk.exe
  2⤵
  PID:6004
- C:\Windows\System\YDqmAPL.exe
  C:\Windows\System\YDqmAPL.exe
  2⤵
  PID:6112
- C:\Windows\System\GHCXLGS.exe
  C:\Windows\System\GHCXLGS.exe
  2⤵
  PID:6132
- C:\Windows\System\RiYjqtX.exe
  C:\Windows\System\RiYjqtX.exe
  2⤵
  PID:5168
- C:\Windows\System\pLeahST.exe
  C:\Windows\System\pLeahST.exe
  2⤵
  PID:5220
- C:\Windows\System\hYshjAd.exe
  C:\Windows\System\hYshjAd.exe
  2⤵
  PID:5368
- C:\Windows\System\IYFowIR.exe
  C:\Windows\System\IYFowIR.exe
  2⤵
  PID:5424
- C:\Windows\System\gDTtfKC.exe
  C:\Windows\System\gDTtfKC.exe
  2⤵
  PID:5676
- C:\Windows\System\HMTkYVE.exe
  C:\Windows\System\HMTkYVE.exe
  2⤵
  PID:5648
- C:\Windows\System\xwnYKAl.exe
  C:\Windows\System\xwnYKAl.exe
  2⤵
  PID:5788
- C:\Windows\System\XZddLrv.exe
  C:\Windows\System\XZddLrv.exe
  2⤵
  PID:3620
- C:\Windows\System\oAJGnWR.exe
  C:\Windows\System\oAJGnWR.exe
  2⤵
  PID:2760
- C:\Windows\System\wSNwoFO.exe
  C:\Windows\System\wSNwoFO.exe
  2⤵
  PID:6092
- C:\Windows\System\DnyuTwJ.exe
  C:\Windows\System\DnyuTwJ.exe
  2⤵
  PID:6164
- C:\Windows\System\szVmEEm.exe
  C:\Windows\System\szVmEEm.exe
  2⤵
  PID:6220
- C:\Windows\System\RaJebYJ.exe
  C:\Windows\System\RaJebYJ.exe
  2⤵
  PID:6240
- C:\Windows\System\tfSUrTo.exe
  C:\Windows\System\tfSUrTo.exe
  2⤵
  PID:6264
- C:\Windows\System\gAEdHRm.exe
  C:\Windows\System\gAEdHRm.exe
  2⤵
  PID:6284
- C:\Windows\System\gTcbvbI.exe
  C:\Windows\System\gTcbvbI.exe
  2⤵
  PID:6316
- C:\Windows\System\EejHQoK.exe
  C:\Windows\System\EejHQoK.exe
  2⤵
  PID:6376
- C:\Windows\System\oCoKDhZ.exe
  C:\Windows\System\oCoKDhZ.exe
  2⤵
  PID:6392
- C:\Windows\System\TndJfDR.exe
  C:\Windows\System\TndJfDR.exe
  2⤵
  PID:6416
- C:\Windows\System\kxUxsxf.exe
  C:\Windows\System\kxUxsxf.exe
  2⤵
  PID:6436
- C:\Windows\System\spGRpNK.exe
  C:\Windows\System\spGRpNK.exe
  2⤵
  PID:6484
- C:\Windows\System\NityHfq.exe
  C:\Windows\System\NityHfq.exe
  2⤵
  PID:6508
- C:\Windows\System\DqwqYYB.exe
  C:\Windows\System\DqwqYYB.exe
  2⤵
  PID:6544
- C:\Windows\System\EsEHYJY.exe
  C:\Windows\System\EsEHYJY.exe
  2⤵
  PID:6572
- C:\Windows\System\HZjbEFr.exe
  C:\Windows\System\HZjbEFr.exe
  2⤵
  PID:6588
- C:\Windows\System\TvSJusS.exe
  C:\Windows\System\TvSJusS.exe
  2⤵
  PID:6612
- C:\Windows\System\TpjqlNF.exe
  C:\Windows\System\TpjqlNF.exe
  2⤵
  PID:6628
- C:\Windows\System\JQoNWRe.exe
  C:\Windows\System\JQoNWRe.exe
  2⤵
  PID:6648
- C:\Windows\System\FLDMzTu.exe
  C:\Windows\System\FLDMzTu.exe
  2⤵
  PID:6676
- C:\Windows\System\tmHhbiC.exe
  C:\Windows\System\tmHhbiC.exe
  2⤵
  PID:6716
- C:\Windows\System\gZwoZXs.exe
  C:\Windows\System\gZwoZXs.exe
  2⤵
  PID:6740
- C:\Windows\System\TIujFWx.exe
  C:\Windows\System\TIujFWx.exe
  2⤵
  PID:6756
- C:\Windows\System\BZFJuKq.exe
  C:\Windows\System\BZFJuKq.exe
  2⤵
  PID:6780
- C:\Windows\System\MYrsYmp.exe
  C:\Windows\System\MYrsYmp.exe
  2⤵
  PID:6820
- C:\Windows\System\bFxDUqj.exe
  C:\Windows\System\bFxDUqj.exe
  2⤵
  PID:6844
- C:\Windows\System\xvqekmT.exe
  C:\Windows\System\xvqekmT.exe
  2⤵
  PID:6864
- C:\Windows\System\QxZffxM.exe
  C:\Windows\System\QxZffxM.exe
  2⤵
  PID:6900
- C:\Windows\System\FKsjVmX.exe
  C:\Windows\System\FKsjVmX.exe
  2⤵
  PID:6968
- C:\Windows\System\hIixGEu.exe
  C:\Windows\System\hIixGEu.exe
  2⤵
  PID:7004
- C:\Windows\System\SWNWLDi.exe
  C:\Windows\System\SWNWLDi.exe
  2⤵
  PID:7028
- C:\Windows\System\pjCkUud.exe
  C:\Windows\System\pjCkUud.exe
  2⤵
  PID:7048
- C:\Windows\System\DZDkEFB.exe
  C:\Windows\System\DZDkEFB.exe
  2⤵
  PID:7072
- C:\Windows\System\aNLCIbv.exe
  C:\Windows\System\aNLCIbv.exe
  2⤵
  PID:7116
- C:\Windows\System\pahcLDy.exe
  C:\Windows\System\pahcLDy.exe
  2⤵
  PID:7140
- C:\Windows\System\EezJVqp.exe
  C:\Windows\System\EezJVqp.exe
  2⤵
  PID:7160
- C:\Windows\System\QreCoWv.exe
  C:\Windows\System\QreCoWv.exe
  2⤵
  PID:5152
- C:\Windows\System\uOWQKqa.exe
  C:\Windows\System\uOWQKqa.exe
  2⤵
  PID:6188
- C:\Windows\System\bZyckfn.exe
  C:\Windows\System\bZyckfn.exe
  2⤵
  PID:6276
- C:\Windows\System\CtpGxDp.exe
  C:\Windows\System\CtpGxDp.exe
  2⤵
  PID:6372
- C:\Windows\System\kgcMnch.exe
  C:\Windows\System\kgcMnch.exe
  2⤵
  PID:6404
- C:\Windows\System\RoeBcEA.exe
  C:\Windows\System\RoeBcEA.exe
  2⤵
  PID:6428
- C:\Windows\System\nCcDCLP.exe
  C:\Windows\System\nCcDCLP.exe
  2⤵
  PID:6476
- C:\Windows\System\bfdZsXr.exe
  C:\Windows\System\bfdZsXr.exe
  2⤵
  PID:6568
- C:\Windows\System\IyydleP.exe
  C:\Windows\System\IyydleP.exe
  2⤵
  PID:6656
- C:\Windows\System\KKPHCwB.exe
  C:\Windows\System\KKPHCwB.exe
  2⤵
  PID:6712
- C:\Windows\System\mQKQUTk.exe
  C:\Windows\System\mQKQUTk.exe
  2⤵
  PID:6752
- C:\Windows\System\JxksOOR.exe
  C:\Windows\System\JxksOOR.exe
  2⤵
  PID:6828
- C:\Windows\System\PImpjpS.exe
  C:\Windows\System\PImpjpS.exe
  2⤵
  PID:6812
- C:\Windows\System\RfeQlsj.exe
  C:\Windows\System\RfeQlsj.exe
  2⤵
  PID:6976
- C:\Windows\System\PNqRNtn.exe
  C:\Windows\System\PNqRNtn.exe
  2⤵
  PID:7056
- C:\Windows\System\ZLfFVLa.exe
  C:\Windows\System\ZLfFVLa.exe
  2⤵
  PID:7152
- C:\Windows\System\BkJSqfU.exe
  C:\Windows\System\BkJSqfU.exe
  2⤵
  PID:5680
- C:\Windows\System\EewtRuz.exe
  C:\Windows\System\EewtRuz.exe
  2⤵
  PID:6292
- C:\Windows\System\dzDnGeZ.exe
  C:\Windows\System\dzDnGeZ.exe
  2⤵
  PID:6328
- C:\Windows\System\baaJjPn.exe
  C:\Windows\System\baaJjPn.exe
  2⤵
  PID:6600
- C:\Windows\System\tlYtEbF.exe
  C:\Windows\System\tlYtEbF.exe
  2⤵
  PID:6872
- C:\Windows\System\XzGOOHl.exe
  C:\Windows\System\XzGOOHl.exe
  2⤵
  PID:7044
- C:\Windows\System\zXLpqOx.exe
  C:\Windows\System\zXLpqOx.exe
  2⤵
  PID:7124
- C:\Windows\System\QesVbca.exe
  C:\Windows\System\QesVbca.exe
  2⤵
  PID:6248
- C:\Windows\System\jPYNbFd.exe
  C:\Windows\System\jPYNbFd.exe
  2⤵
  PID:6260
- C:\Windows\System\IpiGwUW.exe
  C:\Windows\System\IpiGwUW.exe
  2⤵
  PID:7172
- C:\Windows\System\ovSJTBo.exe
  C:\Windows\System\ovSJTBo.exe
  2⤵
  PID:7192
- C:\Windows\System\HTnCOHG.exe
  C:\Windows\System\HTnCOHG.exe
  2⤵
  PID:7236
- C:\Windows\System\mYpoRFM.exe
  C:\Windows\System\mYpoRFM.exe
  2⤵
  PID:7256
- C:\Windows\System\oCxKFbD.exe
  C:\Windows\System\oCxKFbD.exe
  2⤵
  PID:7284
- C:\Windows\System\ouEZEul.exe
  C:\Windows\System\ouEZEul.exe
  2⤵
  PID:7304
- C:\Windows\System\jjTtCUZ.exe
  C:\Windows\System\jjTtCUZ.exe
  2⤵
  PID:7384
- C:\Windows\System\RbwZNLd.exe
  C:\Windows\System\RbwZNLd.exe
  2⤵
  PID:7400
- C:\Windows\System\nHjjSfd.exe
  C:\Windows\System\nHjjSfd.exe
  2⤵
  PID:7432
- C:\Windows\System\mHrExxe.exe
  C:\Windows\System\mHrExxe.exe
  2⤵
  PID:7448
- C:\Windows\System\zcGciCC.exe
  C:\Windows\System\zcGciCC.exe
  2⤵
  PID:7548
- C:\Windows\System\UjmiAHI.exe
  C:\Windows\System\UjmiAHI.exe
  2⤵
  PID:7612
- C:\Windows\System\DYwfJrW.exe
  C:\Windows\System\DYwfJrW.exe
  2⤵
  PID:7632
- C:\Windows\System\OwnxkWG.exe
  C:\Windows\System\OwnxkWG.exe
  2⤵
  PID:7652
- C:\Windows\System\cGtUZgN.exe
  C:\Windows\System\cGtUZgN.exe
  2⤵
  PID:7676
- C:\Windows\System\IIocxBt.exe
  C:\Windows\System\IIocxBt.exe
  2⤵
  PID:7700
- C:\Windows\System\FdKJqdV.exe
  C:\Windows\System\FdKJqdV.exe
  2⤵
  PID:7724
- C:\Windows\System\tmUtlJF.exe
  C:\Windows\System\tmUtlJF.exe
  2⤵
  PID:7756
- C:\Windows\System\yEbajsn.exe
  C:\Windows\System\yEbajsn.exe
  2⤵
  PID:7776
- C:\Windows\System\JzwxnlX.exe
  C:\Windows\System\JzwxnlX.exe
  2⤵
  PID:7800
- C:\Windows\System\LqAcida.exe
  C:\Windows\System\LqAcida.exe
  2⤵
  PID:7824
- C:\Windows\System\JNFJNTU.exe
  C:\Windows\System\JNFJNTU.exe
  2⤵
  PID:7844
- C:\Windows\System\CyzJZmM.exe
  C:\Windows\System\CyzJZmM.exe
  2⤵
  PID:7868
- C:\Windows\System\WEfyXvE.exe
  C:\Windows\System\WEfyXvE.exe
  2⤵
  PID:7948
- C:\Windows\System\LDPECXs.exe
  C:\Windows\System\LDPECXs.exe
  2⤵
  PID:7988
- C:\Windows\System\tspwkkz.exe
  C:\Windows\System\tspwkkz.exe
  2⤵
  PID:8020
- C:\Windows\System\yFJgjqN.exe
  C:\Windows\System\yFJgjqN.exe
  2⤵
  PID:8044
- C:\Windows\System\jCPgvXy.exe
  C:\Windows\System\jCPgvXy.exe
  2⤵
  PID:8064
- C:\Windows\System\biUwuJc.exe
  C:\Windows\System\biUwuJc.exe
  2⤵
  PID:8092
- C:\Windows\System\vhFLyIJ.exe
  C:\Windows\System\vhFLyIJ.exe
  2⤵
  PID:8128
- C:\Windows\System\xadcxJI.exe
  C:\Windows\System\xadcxJI.exe
  2⤵
  PID:8152
- C:\Windows\System\tJXpgMf.exe
  C:\Windows\System\tJXpgMf.exe
  2⤵
  PID:8188
- C:\Windows\System\VnYOuEI.exe
  C:\Windows\System\VnYOuEI.exe
  2⤵
  PID:6724
- C:\Windows\System\IyeyLQJ.exe
  C:\Windows\System\IyeyLQJ.exe
  2⤵
  PID:6532
- C:\Windows\System\qcwLRnz.exe
  C:\Windows\System\qcwLRnz.exe
  2⤵
  PID:7208
- C:\Windows\System\xReaHDL.exe
  C:\Windows\System\xReaHDL.exe
  2⤵
  PID:6804
- C:\Windows\System\TYcTvjd.exe
  C:\Windows\System\TYcTvjd.exe
  2⤵
  PID:7272
- C:\Windows\System\tLTyXIN.exe
  C:\Windows\System\tLTyXIN.exe
  2⤵
  PID:7188
- C:\Windows\System\JDCwnmr.exe
  C:\Windows\System\JDCwnmr.exe
  2⤵
  PID:7224
- C:\Windows\System\JRIapaV.exe
  C:\Windows\System\JRIapaV.exe
  2⤵
  PID:7312
- C:\Windows\System\vuTPCBT.exe
  C:\Windows\System\vuTPCBT.exe
  2⤵
  PID:7332
- C:\Windows\System\UNEGaHg.exe
  C:\Windows\System\UNEGaHg.exe
  2⤵
  PID:7396
- C:\Windows\System\EfKtILE.exe
  C:\Windows\System\EfKtILE.exe
  2⤵
  PID:7428
- C:\Windows\System\gQPFoLG.exe
  C:\Windows\System\gQPFoLG.exe
  2⤵
  PID:7516
- C:\Windows\System\nkBSRIP.exe
  C:\Windows\System\nkBSRIP.exe
  2⤵
  PID:7580
- C:\Windows\System\vttPHNY.exe
  C:\Windows\System\vttPHNY.exe
  2⤵
  PID:7592
- C:\Windows\System\PWPayUy.exe
  C:\Windows\System\PWPayUy.exe
  2⤵
  PID:7748
- C:\Windows\System\XgDEstp.exe
  C:\Windows\System\XgDEstp.exe
  2⤵
  PID:7852
- C:\Windows\System\JbErvsh.exe
  C:\Windows\System\JbErvsh.exe
  2⤵
  PID:7896
- C:\Windows\System\VJPGwLf.exe
  C:\Windows\System\VJPGwLf.exe
  2⤵
  PID:7816
- C:\Windows\System\mnZlEJH.exe
  C:\Windows\System\mnZlEJH.exe
  2⤵
  PID:8040
- C:\Windows\System\tuoLKYb.exe
  C:\Windows\System\tuoLKYb.exe
  2⤵
  PID:8104
- C:\Windows\System\MudjwWY.exe
  C:\Windows\System\MudjwWY.exe
  2⤵
  PID:8164
- C:\Windows\System\TQTymeV.exe
  C:\Windows\System\TQTymeV.exe
  2⤵
  PID:7276
- C:\Windows\System\sxQzKfW.exe
  C:\Windows\System\sxQzKfW.exe
  2⤵
  PID:7456
- C:\Windows\System\pVQKKsk.exe
  C:\Windows\System\pVQKKsk.exe
  2⤵
  PID:7220
- C:\Windows\System\LgkFBmV.exe
  C:\Windows\System\LgkFBmV.exe
  2⤵
  PID:7380
- C:\Windows\System\TEdBOKv.exe
  C:\Windows\System\TEdBOKv.exe
  2⤵
  PID:7544
- C:\Windows\System\IHxxtNx.exe
  C:\Windows\System\IHxxtNx.exe
  2⤵
  PID:7596
- C:\Windows\System\HWKVDto.exe
  C:\Windows\System\HWKVDto.exe
  2⤵
  PID:7740
- C:\Windows\System\cLOFXKQ.exe
  C:\Windows\System\cLOFXKQ.exe
  2⤵
  PID:7832
- C:\Windows\System\cQMHQdC.exe
  C:\Windows\System\cQMHQdC.exe
  2⤵
  PID:8084
- C:\Windows\System\OwvcYIq.exe
  C:\Windows\System\OwvcYIq.exe
  2⤵
  PID:7264
- C:\Windows\System\vHhkLxw.exe
  C:\Windows\System\vHhkLxw.exe
  2⤵
  PID:7572
- C:\Windows\System\kFoJbyT.exe
  C:\Windows\System\kFoJbyT.exe
  2⤵
  PID:7420
- C:\Windows\System\kFQgStk.exe
  C:\Windows\System\kFQgStk.exe
  2⤵
  PID:7684
- C:\Windows\System\SvlIqih.exe
  C:\Windows\System\SvlIqih.exe
  2⤵
  PID:6708
- C:\Windows\System\VBDtmOe.exe
  C:\Windows\System\VBDtmOe.exe
  2⤵
  PID:8212
- C:\Windows\System\INAVEIE.exe
  C:\Windows\System\INAVEIE.exe
  2⤵
  PID:8240
- C:\Windows\System\pxBNidw.exe
  C:\Windows\System\pxBNidw.exe
  2⤵
  PID:8268
- C:\Windows\System\HQwHtpB.exe
  C:\Windows\System\HQwHtpB.exe
  2⤵
  PID:8296
- C:\Windows\System\kHngNbE.exe
  C:\Windows\System\kHngNbE.exe
  2⤵
  PID:8324
- C:\Windows\System\XOVWtvk.exe
  C:\Windows\System\XOVWtvk.exe
  2⤵
  PID:8352
- C:\Windows\System\DjzHIXW.exe
  C:\Windows\System\DjzHIXW.exe
  2⤵
  PID:8372
- C:\Windows\System\hOlcujl.exe
  C:\Windows\System\hOlcujl.exe
  2⤵
  PID:8392
- C:\Windows\System\vTnzkHH.exe
  C:\Windows\System\vTnzkHH.exe
  2⤵
  PID:8436
- C:\Windows\System\qqBnEeq.exe
  C:\Windows\System\qqBnEeq.exe
  2⤵
  PID:8460
- C:\Windows\System\xDeBlgp.exe
  C:\Windows\System\xDeBlgp.exe
  2⤵
  PID:8480
- C:\Windows\System\NjvPejw.exe
  C:\Windows\System\NjvPejw.exe
  2⤵
  PID:8508
- C:\Windows\System\TDQNJSz.exe
  C:\Windows\System\TDQNJSz.exe
  2⤵
  PID:8560
- C:\Windows\System\JvzbgrB.exe
  C:\Windows\System\JvzbgrB.exe
  2⤵
  PID:8588
- C:\Windows\System\NxBaUQx.exe
  C:\Windows\System\NxBaUQx.exe
  2⤵
  PID:8612
- C:\Windows\System\wtpygPu.exe
  C:\Windows\System\wtpygPu.exe
  2⤵
  PID:8632
- C:\Windows\System\MmthsCR.exe
  C:\Windows\System\MmthsCR.exe
  2⤵
  PID:8672
- C:\Windows\System\OhpQVtF.exe
  C:\Windows\System\OhpQVtF.exe
  2⤵
  PID:8692
- C:\Windows\System\KVBAEvz.exe
  C:\Windows\System\KVBAEvz.exe
  2⤵
  PID:8716
- C:\Windows\System\AHJzqCK.exe
  C:\Windows\System\AHJzqCK.exe
  2⤵
  PID:8768
- C:\Windows\System\EjeeeYw.exe
  C:\Windows\System\EjeeeYw.exe
  2⤵
  PID:8788
- C:\Windows\System\kVZfxYg.exe
  C:\Windows\System\kVZfxYg.exe
  2⤵
  PID:8812
- C:\Windows\System\zuqrpJd.exe
  C:\Windows\System\zuqrpJd.exe
  2⤵
  PID:8836
- C:\Windows\System\zPqpqpW.exe
  C:\Windows\System\zPqpqpW.exe
  2⤵
  PID:8864
- C:\Windows\System\knhDWCD.exe
  C:\Windows\System\knhDWCD.exe
  2⤵
  PID:8892
- C:\Windows\System\KJfmlHU.exe
  C:\Windows\System\KJfmlHU.exe
  2⤵
  PID:8924
- C:\Windows\System\enrhTUQ.exe
  C:\Windows\System\enrhTUQ.exe
  2⤵
  PID:8948
- C:\Windows\System\EWIlrDA.exe
  C:\Windows\System\EWIlrDA.exe
  2⤵
  PID:8968
- C:\Windows\System\QKWZZEF.exe
  C:\Windows\System\QKWZZEF.exe
  2⤵
  PID:8996
- C:\Windows\System\OJqbuUR.exe
  C:\Windows\System\OJqbuUR.exe
  2⤵
  PID:9036
- C:\Windows\System\mXMvske.exe
  C:\Windows\System\mXMvske.exe
  2⤵
  PID:9064
- C:\Windows\System\LTOUIiE.exe
  C:\Windows\System\LTOUIiE.exe
  2⤵
  PID:9092
- C:\Windows\System\OXcICXK.exe
  C:\Windows\System\OXcICXK.exe
  2⤵
  PID:9136
- C:\Windows\System\vtNbkWx.exe
  C:\Windows\System\vtNbkWx.exe
  2⤵
  PID:9172
- C:\Windows\System\ccYrQaN.exe
  C:\Windows\System\ccYrQaN.exe
  2⤵
  PID:9192
- C:\Windows\System\wTcHuYd.exe
  C:\Windows\System\wTcHuYd.exe
  2⤵
  PID:7928
- C:\Windows\System\jVnIkNd.exe
  C:\Windows\System\jVnIkNd.exe
  2⤵
  PID:6816
- C:\Windows\System\voWlIRF.exe
  C:\Windows\System\voWlIRF.exe
  2⤵
  PID:8292
- C:\Windows\System\xGKrPCw.exe
  C:\Windows\System\xGKrPCw.exe
  2⤵
  PID:8260
- C:\Windows\System\yyzFIKK.exe
  C:\Windows\System\yyzFIKK.exe
  2⤵
  PID:8360
- C:\Windows\System\NkaJkrX.exe
  C:\Windows\System\NkaJkrX.exe
  2⤵
  PID:8408
- C:\Windows\System\ccStOfg.exe
  C:\Windows\System\ccStOfg.exe
  2⤵
  PID:8500
- C:\Windows\System\VTxffDJ.exe
  C:\Windows\System\VTxffDJ.exe
  2⤵
  PID:8556
- C:\Windows\System\hMMcgqV.exe
  C:\Windows\System\hMMcgqV.exe
  2⤵
  PID:8608
- C:\Windows\System\dsdyosz.exe
  C:\Windows\System\dsdyosz.exe
  2⤵
  PID:8700
- C:\Windows\System\hWMozkG.exe
  C:\Windows\System\hWMozkG.exe
  2⤵
  PID:8740
- C:\Windows\System\fWkWNqX.exe
  C:\Windows\System\fWkWNqX.exe
  2⤵
  PID:8784
- C:\Windows\System\iCjRsjg.exe
  C:\Windows\System\iCjRsjg.exe
  2⤵
  PID:8860
- C:\Windows\System\ZSkOdrl.exe
  C:\Windows\System\ZSkOdrl.exe
  2⤵
  PID:8916
- C:\Windows\System\jJFArrz.exe
  C:\Windows\System\jJFArrz.exe
  2⤵
  PID:8960
- C:\Windows\System\liSQnIY.exe
  C:\Windows\System\liSQnIY.exe
  2⤵
  PID:9008
- C:\Windows\System\yaMhoDT.exe
  C:\Windows\System\yaMhoDT.exe
  2⤵
  PID:9128
- C:\Windows\System\YCNxTcu.exe
  C:\Windows\System\YCNxTcu.exe
  2⤵
  PID:9212
- C:\Windows\System\OhLQYkD.exe
  C:\Windows\System\OhLQYkD.exe
  2⤵
  PID:8208
- C:\Windows\System\hiPxzBE.exe
  C:\Windows\System\hiPxzBE.exe
  2⤵
  PID:8264
- C:\Windows\System\xhFDpud.exe
  C:\Windows\System\xhFDpud.exe
  2⤵
  PID:8472
- C:\Windows\System\TLKoaps.exe
  C:\Windows\System\TLKoaps.exe
  2⤵
  PID:8600
- C:\Windows\System\FINXFQN.exe
  C:\Windows\System\FINXFQN.exe
  2⤵
  PID:8744
- C:\Windows\System\mhTMhFz.exe
  C:\Windows\System\mhTMhFz.exe
  2⤵
  PID:8912
- C:\Windows\System\quwQkIL.exe
  C:\Windows\System\quwQkIL.exe
  2⤵
  PID:8992
- C:\Windows\System\iUXpwDW.exe
  C:\Windows\System\iUXpwDW.exe
  2⤵
  PID:9084
- C:\Windows\System\KhJMJFR.exe
  C:\Windows\System\KhJMJFR.exe
  2⤵
  PID:9188
- C:\Windows\System\QNKUilL.exe
  C:\Windows\System\QNKUilL.exe
  2⤵
  PID:4292
- C:\Windows\System\IoYwgpb.exe
  C:\Windows\System\IoYwgpb.exe
  2⤵
  PID:8552
- C:\Windows\System\SRktqUd.exe
  C:\Windows\System\SRktqUd.exe
  2⤵
  PID:8712
- C:\Windows\System\QOQRtFA.exe
  C:\Windows\System\QOQRtFA.exe
  2⤵
  PID:9024
- C:\Windows\System\ZXlZRSY.exe
  C:\Windows\System\ZXlZRSY.exe
  2⤵
  PID:1604
- C:\Windows\System\pAvqrTZ.exe
  C:\Windows\System\pAvqrTZ.exe
  2⤵
  PID:4580
- C:\Windows\System\kpuyndN.exe
  C:\Windows\System\kpuyndN.exe
  2⤵
  PID:2652
- C:\Windows\System\dcaVIQZ.exe
  C:\Windows\System\dcaVIQZ.exe
  2⤵
  PID:2116
- C:\Windows\System\fpEBtgS.exe
  C:\Windows\System\fpEBtgS.exe
  2⤵
  PID:3216
- C:\Windows\System\WaAtfIi.exe
  C:\Windows\System\WaAtfIi.exe
  2⤵
  PID:9256
- C:\Windows\System\TmHgDfD.exe
  C:\Windows\System\TmHgDfD.exe
  2⤵
  PID:9272
- C:\Windows\System\ttiVspp.exe
  C:\Windows\System\ttiVspp.exe
  2⤵
  PID:9292
- C:\Windows\System\dEzaNnA.exe
  C:\Windows\System\dEzaNnA.exe
  2⤵
  PID:9312
- C:\Windows\System\AKzLGIE.exe
  C:\Windows\System\AKzLGIE.exe
  2⤵
  PID:9332
- C:\Windows\System\KgkAKPo.exe
  C:\Windows\System\KgkAKPo.exe
  2⤵
  PID:9356
- C:\Windows\System\qguGWOm.exe
  C:\Windows\System\qguGWOm.exe
  2⤵
  PID:9384
- C:\Windows\System\NdrhQfP.exe
  C:\Windows\System\NdrhQfP.exe
  2⤵
  PID:9444
- C:\Windows\System\fWvReYQ.exe
  C:\Windows\System\fWvReYQ.exe
  2⤵
  PID:9464
- C:\Windows\System\YPlSQsH.exe
  C:\Windows\System\YPlSQsH.exe
  2⤵
  PID:9484
- C:\Windows\System\ZlPqioQ.exe
  C:\Windows\System\ZlPqioQ.exe
  2⤵
  PID:9504
- C:\Windows\System\shEcqLi.exe
  C:\Windows\System\shEcqLi.exe
  2⤵
  PID:9536
- C:\Windows\System\sAaVzPx.exe
  C:\Windows\System\sAaVzPx.exe
  2⤵
  PID:9560
- C:\Windows\System\BHDEuvf.exe
  C:\Windows\System\BHDEuvf.exe
  2⤵
  PID:9592
- C:\Windows\System\KdxDVaM.exe
  C:\Windows\System\KdxDVaM.exe
  2⤵
  PID:9616
- C:\Windows\System\UpKcDao.exe
  C:\Windows\System\UpKcDao.exe
  2⤵
  PID:9636
- C:\Windows\System\cCQxvjq.exe
  C:\Windows\System\cCQxvjq.exe
  2⤵
  PID:9656
- C:\Windows\System\DvXjsml.exe
  C:\Windows\System\DvXjsml.exe
  2⤵
  PID:9688
- C:\Windows\System\ZUnTWVi.exe
  C:\Windows\System\ZUnTWVi.exe
  2⤵
  PID:9712
- C:\Windows\System\zzcCAYU.exe
  C:\Windows\System\zzcCAYU.exe
  2⤵
  PID:9748
- C:\Windows\System\shlrtzR.exe
  C:\Windows\System\shlrtzR.exe
  2⤵
  PID:9796
- C:\Windows\System\IjLYQNH.exe
  C:\Windows\System\IjLYQNH.exe
  2⤵
  PID:9832
- C:\Windows\System\AaSUWtI.exe
  C:\Windows\System\AaSUWtI.exe
  2⤵
  PID:9848
- C:\Windows\System\kKvvbzW.exe
  C:\Windows\System\kKvvbzW.exe
  2⤵
  PID:9872
- C:\Windows\System\rzxfdYP.exe
  C:\Windows\System\rzxfdYP.exe
  2⤵
  PID:9896
- C:\Windows\System\gBcPInV.exe
  C:\Windows\System\gBcPInV.exe
  2⤵
  PID:9912
- C:\Windows\System\DOoMqJg.exe
  C:\Windows\System\DOoMqJg.exe
  2⤵
  PID:9932
- C:\Windows\System\cLXJAli.exe
  C:\Windows\System\cLXJAli.exe
  2⤵
  PID:9952
- C:\Windows\System\wKtSIiE.exe
  C:\Windows\System\wKtSIiE.exe
  2⤵
  PID:9976
- C:\Windows\System\cFLBArA.exe
  C:\Windows\System\cFLBArA.exe
  2⤵
  PID:10000
- C:\Windows\System\kSwUbqQ.exe
  C:\Windows\System\kSwUbqQ.exe
  2⤵
  PID:10024
- C:\Windows\System\SYNVAYb.exe
  C:\Windows\System\SYNVAYb.exe
  2⤵
  PID:10068
- C:\Windows\System\TWBYGAS.exe
  C:\Windows\System\TWBYGAS.exe
  2⤵
  PID:10088
- C:\Windows\System\sXLmDMt.exe
  C:\Windows\System\sXLmDMt.exe
  2⤵
  PID:10180
- C:\Windows\System\BuPCWVs.exe
  C:\Windows\System\BuPCWVs.exe
  2⤵
  PID:10200
- C:\Windows\System\tUTozTL.exe
  C:\Windows\System\tUTozTL.exe
  2⤵
  PID:10224
- C:\Windows\System\VpUdytq.exe
  C:\Windows\System\VpUdytq.exe
  2⤵
  PID:9280
- C:\Windows\System\AVMuyim.exe
  C:\Windows\System\AVMuyim.exe
  2⤵
  PID:9340
- C:\Windows\System\nNjBKeL.exe
  C:\Windows\System\nNjBKeL.exe
  2⤵
  PID:9328
- C:\Windows\System\gdSwsMz.exe
  C:\Windows\System\gdSwsMz.exe
  2⤵
  PID:9456
- C:\Windows\System\aOZXtAH.exe
  C:\Windows\System\aOZXtAH.exe
  2⤵
  PID:9476
- C:\Windows\System\SmrEfkg.exe
  C:\Windows\System\SmrEfkg.exe
  2⤵
  PID:9608
- C:\Windows\System\SSVTdHU.exe
  C:\Windows\System\SSVTdHU.exe
  2⤵
  PID:9652
- C:\Windows\System\EPAOfYE.exe
  C:\Windows\System\EPAOfYE.exe
  2⤵
  PID:9632
- C:\Windows\System\AaaPNZM.exe
  C:\Windows\System\AaaPNZM.exe
  2⤵
  PID:9760
- C:\Windows\System\LJqiCbq.exe
  C:\Windows\System\LJqiCbq.exe
  2⤵
  PID:9744
- C:\Windows\System\YxsMgWK.exe
  C:\Windows\System\YxsMgWK.exe
  2⤵
  PID:9888
- C:\Windows\System\CCvraUv.exe
  C:\Windows\System\CCvraUv.exe
  2⤵
  PID:9984
- C:\Windows\System\ZpFnflc.exe
  C:\Windows\System\ZpFnflc.exe
  2⤵
  PID:10008
- C:\Windows\System\smkYVJg.exe
  C:\Windows\System\smkYVJg.exe
  2⤵
  PID:10048
- C:\Windows\System\OeKOFtc.exe
  C:\Windows\System\OeKOFtc.exe
  2⤵
  PID:10172
- C:\Windows\System\CVhqdOq.exe
  C:\Windows\System\CVhqdOq.exe
  2⤵
  PID:10220
- C:\Windows\System\LrxLfis.exe
  C:\Windows\System\LrxLfis.exe
  2⤵
  PID:10196
- C:\Windows\System\xnORUNH.exe
  C:\Windows\System\xnORUNH.exe
  2⤵
  PID:9364
- C:\Windows\System\JXUTulM.exe
  C:\Windows\System\JXUTulM.exe
  2⤵
  PID:9520
- C:\Windows\System\nSpbPoA.exe
  C:\Windows\System\nSpbPoA.exe
  2⤵
  PID:4792
- C:\Windows\System\ibDyTzk.exe
  C:\Windows\System\ibDyTzk.exe
  2⤵
  PID:9708
- C:\Windows\System\FIsGaUJ.exe
  C:\Windows\System\FIsGaUJ.exe
  2⤵
  PID:9944
- C:\Windows\System\zsFYgBq.exe
  C:\Windows\System\zsFYgBq.exe
  2⤵
  PID:10192
- C:\Windows\System\VYbQDbR.exe
  C:\Windows\System\VYbQDbR.exe
  2⤵
  PID:10212
- C:\Windows\System\kLRdJyL.exe
  C:\Windows\System\kLRdJyL.exe
  2⤵
  PID:9224
- C:\Windows\System\mdqpWvF.exe
  C:\Windows\System\mdqpWvF.exe
  2⤵
  PID:10252
- C:\Windows\System\ZNpHeta.exe
  C:\Windows\System\ZNpHeta.exe
  2⤵
  PID:10272
- C:\Windows\System\svRhgAL.exe
  C:\Windows\System\svRhgAL.exe
  2⤵
  PID:10288
- C:\Windows\System\UCBJCfu.exe
  C:\Windows\System\UCBJCfu.exe
  2⤵
  PID:10304
- C:\Windows\System\NNlozFz.exe
  C:\Windows\System\NNlozFz.exe
  2⤵
  PID:10320
- C:\Windows\System\gCvJzHu.exe
  C:\Windows\System\gCvJzHu.exe
  2⤵
  PID:10336
- C:\Windows\System\sFeetIE.exe
  C:\Windows\System\sFeetIE.exe
  2⤵
  PID:10352
- C:\Windows\System\ZQKGleh.exe
  C:\Windows\System\ZQKGleh.exe
  2⤵
  PID:10372
- C:\Windows\System\UZNVcef.exe
  C:\Windows\System\UZNVcef.exe
  2⤵
  PID:10416
- C:\Windows\System\RlYlcvU.exe
  C:\Windows\System\RlYlcvU.exe
  2⤵
  PID:10436
- C:\Windows\System\cWJTWMA.exe
  C:\Windows\System\cWJTWMA.exe
  2⤵
  PID:10460
- C:\Windows\System\lxtOKNU.exe
  C:\Windows\System\lxtOKNU.exe
  2⤵
  PID:10484
- C:\Windows\System\elnGUsq.exe
  C:\Windows\System\elnGUsq.exe
  2⤵
  PID:10528
- C:\Windows\System\jzGKUOJ.exe
  C:\Windows\System\jzGKUOJ.exe
  2⤵
  PID:10596
- C:\Windows\System\okBEUdu.exe
  C:\Windows\System\okBEUdu.exe
  2⤵
  PID:10644
- C:\Windows\System\CjefAxo.exe
  C:\Windows\System\CjefAxo.exe
  2⤵
  PID:10676
- C:\Windows\System\ihgMTqp.exe
  C:\Windows\System\ihgMTqp.exe
  2⤵
  PID:10716
- C:\Windows\System\XpsXwxp.exe
  C:\Windows\System\XpsXwxp.exe
  2⤵
  PID:10740
- C:\Windows\System\NxobXGD.exe
  C:\Windows\System\NxobXGD.exe
  2⤵
  PID:10760
- C:\Windows\System\MmiWZBc.exe
  C:\Windows\System\MmiWZBc.exe
  2⤵
  PID:10792
- C:\Windows\System\PWXTHXk.exe
  C:\Windows\System\PWXTHXk.exe
  2⤵
  PID:10812
- C:\Windows\System\ENQFttT.exe
  C:\Windows\System\ENQFttT.exe
  2⤵
  PID:10832
- C:\Windows\System\imzghqw.exe
  C:\Windows\System\imzghqw.exe
  2⤵
  PID:10852
- C:\Windows\System\WbExrnf.exe
  C:\Windows\System\WbExrnf.exe
  2⤵
  PID:10880
- C:\Windows\System\ymccIwT.exe
  C:\Windows\System\ymccIwT.exe
  2⤵
  PID:10896
- C:\Windows\System\MKghhcf.exe
  C:\Windows\System\MKghhcf.exe
  2⤵
  PID:10936
- C:\Windows\System\eNGAHSF.exe
  C:\Windows\System\eNGAHSF.exe
  2⤵
  PID:10956
- C:\Windows\System\ngNBjyl.exe
  C:\Windows\System\ngNBjyl.exe
  2⤵
  PID:11000
- C:\Windows\System\jqDBOJx.exe
  C:\Windows\System\jqDBOJx.exe
  2⤵
  PID:11024
- C:\Windows\System\usHgxbB.exe
  C:\Windows\System\usHgxbB.exe
  2⤵
  PID:11048
- C:\Windows\System\FiVzQJf.exe
  C:\Windows\System\FiVzQJf.exe
  2⤵
  PID:11076
- C:\Windows\System\CNQZxKM.exe
  C:\Windows\System\CNQZxKM.exe
  2⤵
  PID:11092
- C:\Windows\System\gjvbPlV.exe
  C:\Windows\System\gjvbPlV.exe
  2⤵
  PID:11112
- C:\Windows\System\KaZXddf.exe
  C:\Windows\System\KaZXddf.exe
  2⤵
  PID:11152
- C:\Windows\System\abZigyw.exe
  C:\Windows\System\abZigyw.exe
  2⤵
  PID:11172
- C:\Windows\System\wPzBiZZ.exe
  C:\Windows\System\wPzBiZZ.exe
  2⤵
  PID:11192
- C:\Windows\System\UpiPiqg.exe
  C:\Windows\System\UpiPiqg.exe
  2⤵
  PID:11216
- C:\Windows\System\iVdhvaL.exe
  C:\Windows\System\iVdhvaL.exe
  2⤵
  PID:11256
- C:\Windows\System\uUUxSYV.exe
  C:\Windows\System\uUUxSYV.exe
  2⤵
  PID:3608
- C:\Windows\System\PJiHLqD.exe
  C:\Windows\System\PJiHLqD.exe
  2⤵
  PID:10284
- C:\Windows\System\xLDkRjl.exe
  C:\Windows\System\xLDkRjl.exe
  2⤵
  PID:10452
- C:\Windows\System\XzwWKVJ.exe
  C:\Windows\System\XzwWKVJ.exe
  2⤵
  PID:10536
- C:\Windows\System\xUcExBh.exe
  C:\Windows\System\xUcExBh.exe
  2⤵
  PID:10588
- C:\Windows\System\GzszLcw.exe
  C:\Windows\System\GzszLcw.exe
  2⤵
  PID:10620
- C:\Windows\System\VkRXNrL.exe
  C:\Windows\System\VkRXNrL.exe
  2⤵
  PID:10700
- C:\Windows\System\oAasYjV.exe
  C:\Windows\System\oAasYjV.exe
  2⤵
  PID:10752
- C:\Windows\System\xHJkqgg.exe
  C:\Windows\System\xHJkqgg.exe
  2⤵
  PID:10264
- C:\Windows\System\xBDlRoS.exe
  C:\Windows\System\xBDlRoS.exe
  2⤵
  PID:10844
- C:\Windows\System\hpDhild.exe
  C:\Windows\System\hpDhild.exe
  2⤵
  PID:10892
- C:\Windows\System\rdRYXSt.exe
  C:\Windows\System\rdRYXSt.exe
  2⤵
  PID:10992
- C:\Windows\System\TKqXrNs.exe
  C:\Windows\System\TKqXrNs.exe
  2⤵
  PID:11044
- C:\Windows\System\BONuKAy.exe
  C:\Windows\System\BONuKAy.exe
  2⤵
  PID:11136
- C:\Windows\System\rVWInOB.exe
  C:\Windows\System\rVWInOB.exe
  2⤵
  PID:11168
- C:\Windows\System\zRroOlL.exe
  C:\Windows\System\zRroOlL.exe
  2⤵
  PID:11208
- C:\Windows\System\MEGougU.exe
  C:\Windows\System\MEGougU.exe
  2⤵
  PID:9452
- C:\Windows\System\aPzvvNS.exe
  C:\Windows\System\aPzvvNS.exe
  2⤵
  PID:9308
- C:\Windows\System\ciFKkqK.exe
  C:\Windows\System\ciFKkqK.exe
  2⤵
  PID:10564
- C:\Windows\System\uJemjeP.exe
  C:\Windows\System\uJemjeP.exe
  2⤵
  PID:10660
- C:\Windows\System\rgVPayQ.exe
  C:\Windows\System\rgVPayQ.exe
  2⤵
  PID:10848
- C:\Windows\System\gaPbsMf.exe
  C:\Windows\System\gaPbsMf.exe
  2⤵
  PID:10920
- C:\Windows\System\FruaOkN.exe
  C:\Windows\System\FruaOkN.exe
  2⤵
  PID:11252
- C:\Windows\System\nzyIZJn.exe
  C:\Windows\System\nzyIZJn.exe
  2⤵
  PID:10124
- C:\Windows\System\AMgAcWf.exe
  C:\Windows\System\AMgAcWf.exe
  2⤵
  PID:10828
- C:\Windows\System\FBxUyWk.exe
  C:\Windows\System\FBxUyWk.exe
  2⤵
  PID:10876
- C:\Windows\System\ZVjHPcI.exe
  C:\Windows\System\ZVjHPcI.exe
  2⤵
  PID:4524
- C:\Windows\System\jVjqMkj.exe
  C:\Windows\System\jVjqMkj.exe
  2⤵
  PID:3624
- C:\Windows\System\InTKkHM.exe
  C:\Windows\System\InTKkHM.exe
  2⤵
  PID:2284
- C:\Windows\System\kcFzjOU.exe
  C:\Windows\System\kcFzjOU.exe
  2⤵
  PID:11164
- C:\Windows\System\ciGZGAg.exe
  C:\Windows\System\ciGZGAg.exe
  2⤵
  PID:10520
- C:\Windows\System\mvdTnoC.exe
  C:\Windows\System\mvdTnoC.exe
  2⤵
  PID:4684
- C:\Windows\System\IZFbgpF.exe
  C:\Windows\System\IZFbgpF.exe
  2⤵
  PID:10984
- C:\Windows\System\LWIqAFy.exe
  C:\Windows\System\LWIqAFy.exe
  2⤵
  PID:11276
- C:\Windows\System\BgqMdxl.exe
  C:\Windows\System\BgqMdxl.exe
  2⤵
  PID:11304
- C:\Windows\System\tgEUVsX.exe
  C:\Windows\System\tgEUVsX.exe
  2⤵
  PID:11324
- C:\Windows\System\zMnKmBD.exe
  C:\Windows\System\zMnKmBD.exe
  2⤵
  PID:11388
- C:\Windows\System\yZkxshL.exe
  C:\Windows\System\yZkxshL.exe
  2⤵
  PID:11408
- C:\Windows\System\OZgnAde.exe
  C:\Windows\System\OZgnAde.exe
  2⤵
  PID:11444
- C:\Windows\System\lVWQcjs.exe
  C:\Windows\System\lVWQcjs.exe
  2⤵
  PID:11480
- C:\Windows\System\OKxYmYb.exe
  C:\Windows\System\OKxYmYb.exe
  2⤵
  PID:11500
- C:\Windows\System\NCEFMxc.exe
  C:\Windows\System\NCEFMxc.exe
  2⤵
  PID:11524
- C:\Windows\System\afGSjXG.exe
  C:\Windows\System\afGSjXG.exe
  2⤵
  PID:11548
- C:\Windows\System\YserHZr.exe
  C:\Windows\System\YserHZr.exe
  2⤵
  PID:11564
- C:\Windows\System\qqqkJNE.exe
  C:\Windows\System\qqqkJNE.exe
  2⤵
  PID:11612
- C:\Windows\System\orJOtVR.exe
  C:\Windows\System\orJOtVR.exe
  2⤵
  PID:11660
- C:\Windows\System\hYxrUNn.exe
  C:\Windows\System\hYxrUNn.exe
  2⤵
  PID:11700
- C:\Windows\System\ySRyJxv.exe
  C:\Windows\System\ySRyJxv.exe
  2⤵
  PID:11716
- C:\Windows\System\GNNRBVN.exe
  C:\Windows\System\GNNRBVN.exe
  2⤵
  PID:11744
- C:\Windows\System\GpmiQsK.exe
  C:\Windows\System\GpmiQsK.exe
  2⤵
  PID:11788
- C:\Windows\System\NKmXGeV.exe
  C:\Windows\System\NKmXGeV.exe
  2⤵
  PID:11812
- C:\Windows\System\qJxaELW.exe
  C:\Windows\System\qJxaELW.exe
  2⤵
  PID:11832
- C:\Windows\System\juewFPG.exe
  C:\Windows\System\juewFPG.exe
  2⤵
  PID:11852
- C:\Windows\System\iCBofui.exe
  C:\Windows\System\iCBofui.exe
  2⤵
  PID:11896
- C:\Windows\System\kyZcbwC.exe
  C:\Windows\System\kyZcbwC.exe
  2⤵
  PID:11916
- C:\Windows\System\NsyeSba.exe
  C:\Windows\System\NsyeSba.exe
  2⤵
  PID:11944
- C:\Windows\System\BvmBPOp.exe
  C:\Windows\System\BvmBPOp.exe
  2⤵
  PID:11972
- C:\Windows\System\GyOsbio.exe
  C:\Windows\System\GyOsbio.exe
  2⤵
  PID:11988
- C:\Windows\System\gugUydC.exe
  C:\Windows\System\gugUydC.exe
  2⤵
  PID:12008
- C:\Windows\System\fSQaqgT.exe
  C:\Windows\System\fSQaqgT.exe
  2⤵
  PID:12024
- C:\Windows\System\NohNhXb.exe
  C:\Windows\System\NohNhXb.exe
  2⤵
  PID:12048
- C:\Windows\System\RGXIYlb.exe
  C:\Windows\System\RGXIYlb.exe
  2⤵
  PID:12104
- C:\Windows\System\XWkYpFM.exe
  C:\Windows\System\XWkYpFM.exe
  2⤵
  PID:12140
- C:\Windows\System\iJDzanY.exe
  C:\Windows\System\iJDzanY.exe
  2⤵
  PID:12160
- C:\Windows\System\xzspxiE.exe
  C:\Windows\System\xzspxiE.exe
  2⤵
  PID:12184
- C:\Windows\System\igvBUsI.exe
  C:\Windows\System\igvBUsI.exe
  2⤵
  PID:12212
- C:\Windows\System\bnXwWvW.exe
  C:\Windows\System\bnXwWvW.exe
  2⤵
  PID:12256
- C:\Windows\System\oEcoQxs.exe
  C:\Windows\System\oEcoQxs.exe
  2⤵
  PID:12284
- C:\Windows\System\GBDLkBq.exe
  C:\Windows\System\GBDLkBq.exe
  2⤵
  PID:11284
- C:\Windows\System\lNjJYQp.exe
  C:\Windows\System\lNjJYQp.exe
  2⤵
  PID:11344
- C:\Windows\System\iGpKGir.exe
  C:\Windows\System\iGpKGir.exe
  2⤵
  PID:11316
- C:\Windows\System\WLULEJv.exe
  C:\Windows\System\WLULEJv.exe
  2⤵
  PID:11452
- C:\Windows\System\gzoyeWN.exe
  C:\Windows\System\gzoyeWN.exe
  2⤵
  PID:11492
- C:\Windows\System\jHKvdsg.exe
  C:\Windows\System\jHKvdsg.exe
  2⤵
  PID:11516
- C:\Windows\System\rWhSAqv.exe
  C:\Windows\System\rWhSAqv.exe
  2⤵
  PID:11644
- C:\Windows\System\PPvkZHy.exe
  C:\Windows\System\PPvkZHy.exe
  2⤵
  PID:11712
- C:\Windows\System\IULmtdN.exe
  C:\Windows\System\IULmtdN.exe
  2⤵
  PID:11764
- C:\Windows\System\lfXOfuu.exe
  C:\Windows\System\lfXOfuu.exe
  2⤵
  PID:11804
- C:\Windows\System\cnBAQtX.exe
  C:\Windows\System\cnBAQtX.exe
  2⤵
  PID:11828
- C:\Windows\System\PJIgFMA.exe
  C:\Windows\System\PJIgFMA.exe
  2⤵
  PID:11928
- C:\Windows\System\XOhdSQg.exe
  C:\Windows\System\XOhdSQg.exe
  2⤵
  PID:11964
- C:\Windows\System\iWNrWhd.exe
  C:\Windows\System\iWNrWhd.exe
  2⤵
  PID:12132
- C:\Windows\System\CbFevJQ.exe
  C:\Windows\System\CbFevJQ.exe
  2⤵
  PID:12176
- C:\Windows\System\pFuFggT.exe
  C:\Windows\System\pFuFggT.exe
  2⤵
  PID:12232
- C:\Windows\System\hLpaznS.exe
  C:\Windows\System\hLpaznS.exe
  2⤵
  PID:2640
- C:\Windows\System\xfEpfgB.exe
  C:\Windows\System\xfEpfgB.exe
  2⤵
  PID:11336
- C:\Windows\System\DQnTxxO.exe
  C:\Windows\System\DQnTxxO.exe
  2⤵
  PID:10840
- C:\Windows\System\NHMfbvu.exe
  C:\Windows\System\NHMfbvu.exe
  2⤵
  PID:11732
- C:\Windows\System\cPMRhiF.exe
  C:\Windows\System\cPMRhiF.exe
  2⤵
  PID:11864
- C:\Windows\System\fyZDnrz.exe
  C:\Windows\System\fyZDnrz.exe
  2⤵
  PID:11936
- C:\Windows\System\zOsiZUS.exe
  C:\Windows\System\zOsiZUS.exe
  2⤵
  PID:12152
- C:\Windows\System\Wtnpdte.exe
  C:\Windows\System\Wtnpdte.exe
  2⤵
  PID:12208
- C:\Windows\System\rUWWCJz.exe
  C:\Windows\System\rUWWCJz.exe
  2⤵
  PID:11468
- C:\Windows\System\VHzrVoB.exe
  C:\Windows\System\VHzrVoB.exe
  2⤵
  PID:12100
- C:\Windows\System\RHeGUji.exe
  C:\Windows\System\RHeGUji.exe
  2⤵
  PID:11268
- C:\Windows\System\kuIfMEl.exe
  C:\Windows\System\kuIfMEl.exe
  2⤵
  PID:12304
- C:\Windows\System\tLGQnYL.exe
  C:\Windows\System\tLGQnYL.exe
  2⤵
  PID:12332
- C:\Windows\System\nDwCXRU.exe
  C:\Windows\System\nDwCXRU.exe
  2⤵
  PID:12364
- C:\Windows\System\icgpjqd.exe
  C:\Windows\System\icgpjqd.exe
  2⤵
  PID:12396
- C:\Windows\System\bufYFai.exe
  C:\Windows\System\bufYFai.exe
  2⤵
  PID:12420
- C:\Windows\System\yfzjbxJ.exe
  C:\Windows\System\yfzjbxJ.exe
  2⤵
  PID:12436
- C:\Windows\System\bxEyrUt.exe
  C:\Windows\System\bxEyrUt.exe
  2⤵
  PID:12456
- C:\Windows\System\HgwPPay.exe
  C:\Windows\System\HgwPPay.exe
  2⤵
  PID:12484
- C:\Windows\System\LxWkVbu.exe
  C:\Windows\System\LxWkVbu.exe
  2⤵
  PID:12512
- C:\Windows\System\qjXgXgA.exe
  C:\Windows\System\qjXgXgA.exe
  2⤵
  PID:12564
- C:\Windows\System\SkJTcJd.exe
  C:\Windows\System\SkJTcJd.exe
  2⤵
  PID:12604
- C:\Windows\System\CvgCcMB.exe
  C:\Windows\System\CvgCcMB.exe
  2⤵
  PID:12628
- C:\Windows\System\YySLZSR.exe
  C:\Windows\System\YySLZSR.exe
  2⤵
  PID:12660
- C:\Windows\System\vMZAkrv.exe
  C:\Windows\System\vMZAkrv.exe
  2⤵
  PID:12676
- C:\Windows\System\LSlffBJ.exe
  C:\Windows\System\LSlffBJ.exe
  2⤵
  PID:12704
- C:\Windows\System\saSziEf.exe
  C:\Windows\System\saSziEf.exe
  2⤵
  PID:12732
- C:\Windows\System\QZfhrDt.exe
  C:\Windows\System\QZfhrDt.exe
  2⤵
  PID:12748
- C:\Windows\System\gayHpVn.exe
  C:\Windows\System\gayHpVn.exe
  2⤵
  PID:12772
- C:\Windows\System\fBDkofx.exe
  C:\Windows\System\fBDkofx.exe
  2⤵
  PID:12828
- C:\Windows\System\DrITlYu.exe
  C:\Windows\System\DrITlYu.exe
  2⤵
  PID:12852
- C:\Windows\System\pfpnLgW.exe
  C:\Windows\System\pfpnLgW.exe
  2⤵
  PID:12872
- C:\Windows\System\TvaSloV.exe
  C:\Windows\System\TvaSloV.exe
  2⤵
  PID:12888
- C:\Windows\System\JNyahyl.exe
  C:\Windows\System\JNyahyl.exe
  2⤵
  PID:12916
- C:\Windows\System\XhBjQUL.exe
  C:\Windows\System\XhBjQUL.exe
  2⤵
  PID:12936
- C:\Windows\System\kVqdBbc.exe
  C:\Windows\System\kVqdBbc.exe
  2⤵
  PID:12968
- C:\Windows\System\mAJvOAT.exe
  C:\Windows\System\mAJvOAT.exe
  2⤵
  PID:13016
- C:\Windows\System\zruzwsV.exe
  C:\Windows\System\zruzwsV.exe
  2⤵
  PID:13044
- C:\Windows\System\siKWMlY.exe
  C:\Windows\System\siKWMlY.exe
  2⤵
  PID:13084
- C:\Windows\System\khiNUhz.exe
  C:\Windows\System\khiNUhz.exe
  2⤵
  PID:13100
- C:\Windows\System\VdSurum.exe
  C:\Windows\System\VdSurum.exe
  2⤵
  PID:13124
- C:\Windows\System\lhmtztT.exe
  C:\Windows\System\lhmtztT.exe
  2⤵
  PID:13160
- C:\Windows\System\mWhprSA.exe
  C:\Windows\System\mWhprSA.exe
  2⤵
  PID:13180
- C:\Windows\System\WCuaWmg.exe
  C:\Windows\System\WCuaWmg.exe
  2⤵
  PID:13212
- C:\Windows\System\ZxyOAmE.exe
  C:\Windows\System\ZxyOAmE.exe
  2⤵
  PID:13240
- C:\Windows\System\uGWTdqK.exe
  C:\Windows\System\uGWTdqK.exe
  2⤵
  PID:13260
- C:\Windows\System\MvXqhGG.exe
  C:\Windows\System\MvXqhGG.exe
  2⤵
  PID:13296
- C:\Windows\System\PEqlzyn.exe
  C:\Windows\System\PEqlzyn.exe
  2⤵
  PID:11848
- C:\Windows\System\vDLTIcR.exe
  C:\Windows\System\vDLTIcR.exe
  2⤵
  PID:12328
- C:\Windows\System\AlnBqyv.exe
  C:\Windows\System\AlnBqyv.exe
  2⤵
  PID:12408
- C:\Windows\System\QjgMviT.exe
  C:\Windows\System\QjgMviT.exe
  2⤵
  PID:12464
- C:\Windows\System\gfGEXrN.exe
  C:\Windows\System\gfGEXrN.exe
  2⤵
  PID:1972
- C:\Windows\System\EZiAVon.exe
  C:\Windows\System\EZiAVon.exe
  2⤵
  PID:12492
- C:\Windows\System\ztcdhFv.exe
  C:\Windows\System\ztcdhFv.exe
  2⤵
  PID:12540
- C:\Windows\System\tpcFIub.exe
  C:\Windows\System\tpcFIub.exe
  2⤵
  PID:12612
- C:\Windows\System\mBxEjlm.exe
  C:\Windows\System\mBxEjlm.exe
  2⤵
  PID:12620
- C:\Windows\System\ALUuZNc.exe
  C:\Windows\System\ALUuZNc.exe
  2⤵
  PID:12696
- C:\Windows\System\oeZVVMx.exe
  C:\Windows\System\oeZVVMx.exe
  2⤵
  PID:12764
- C:\Windows\System\qssElld.exe
  C:\Windows\System\qssElld.exe
  2⤵
  PID:12932
- C:\Windows\System\mbepCHT.exe
  C:\Windows\System\mbepCHT.exe
  2⤵
  PID:13012
- C:\Windows\System\PDzLOgL.exe
  C:\Windows\System\PDzLOgL.exe
  2⤵
  PID:13036
- C:\Windows\System\kcZDMSE.exe
  C:\Windows\System\kcZDMSE.exe
  2⤵
  PID:13120
- C:\Windows\System\sgaMLMM.exe
  C:\Windows\System\sgaMLMM.exe
  2⤵
  PID:13148
- C:\Windows\System\lBFpsXQ.exe
  C:\Windows\System\lBFpsXQ.exe
  2⤵
  PID:13204
- C:\Windows\System\BILHacu.exe
  C:\Windows\System\BILHacu.exe
  2⤵
  PID:12624
- C:\Windows\System\wTlNcGx.exe
  C:\Windows\System\wTlNcGx.exe
  2⤵
  PID:12684
- C:\Windows\System\TiKwixy.exe
  C:\Windows\System\TiKwixy.exe
  2⤵
  PID:12908
- C:\Windows\System\gzsedNZ.exe
  C:\Windows\System\gzsedNZ.exe
  2⤵
  PID:12352
- C:\Windows\System\ilqDbkD.exe
  C:\Windows\System\ilqDbkD.exe
  2⤵
  PID:320
- C:\Windows\System\bAnxJVa.exe
  C:\Windows\System\bAnxJVa.exe
  2⤵
  PID:13208
- C:\Windows\System\docDWwO.exe
  C:\Windows\System\docDWwO.exe
  2⤵
  PID:13220
- C:\Windows\System\QzHHMNS.exe
  C:\Windows\System\QzHHMNS.exe
  2⤵
  PID:2380
- C:\Windows\System\PwdZiUw.exe
  C:\Windows\System\PwdZiUw.exe
  2⤵
  PID:12744
- C:\Windows\System\AairPDv.exe
  C:\Windows\System\AairPDv.exe
  2⤵
  PID:12524
- C:\Windows\System\ZNzNZuk.exe
  C:\Windows\System\ZNzNZuk.exe
  2⤵
  PID:2800
- C:\Windows\System\jXhgUzI.exe
  C:\Windows\System\jXhgUzI.exe
  2⤵
  PID:1784
- C:\Windows\System\wEGpiGq.exe
  C:\Windows\System\wEGpiGq.exe
  2⤵
  PID:3124
- C:\Windows\System\yCZZbPR.exe
  C:\Windows\System\yCZZbPR.exe
  2⤵
  PID:2956
- C:\Windows\System\PrOigYD.exe
  C:\Windows\System\PrOigYD.exe
  2⤵
  PID:232
- C:\Windows\System\ZYTmtlk.exe
  C:\Windows\System\ZYTmtlk.exe
  2⤵
  PID:3832
- C:\Windows\System\mMcigBv.exe
  C:\Windows\System\mMcigBv.exe
  2⤵
  PID:5268
- C:\Windows\System\KWRpnTy.exe
  C:\Windows\System\KWRpnTy.exe
  2⤵
  PID:6120
- C:\Windows\System\mNylYGw.exe
  C:\Windows\System\mNylYGw.exe
  2⤵
  PID:5684
- C:\Windows\System\xvlBcBp.exe
  C:\Windows\System\xvlBcBp.exe
  2⤵
  PID:6424
- C:\Windows\System\ovcJxgJ.exe
  C:\Windows\System\ovcJxgJ.exe
  2⤵
  PID:5988
- C:\Windows\System\xfZjAJO.exe
  C:\Windows\System\xfZjAJO.exe
  2⤵
  PID:1672
- C:\Windows\System\YmolQbG.exe
  C:\Windows\System\YmolQbG.exe
  2⤵
  PID:1776
- C:\Windows\System\MCNpjQT.exe
  C:\Windows\System\MCNpjQT.exe
  2⤵
  PID:3636
- C:\Windows\System\UXoijSx.exe
  C:\Windows\System\UXoijSx.exe
  2⤵
  PID:3912
- C:\Windows\System\QFqlyQu.exe
  C:\Windows\System\QFqlyQu.exe
  2⤵
  PID:7068
- C:\Windows\System\WeKTYEk.exe
  C:\Windows\System\WeKTYEk.exe
  2⤵
  PID:2276
- C:\Windows\System\wzOpyTl.exe
  C:\Windows\System\wzOpyTl.exe
  2⤵
  PID:4028
- C:\Windows\System\tdFTgPn.exe
  C:\Windows\System\tdFTgPn.exe
  2⤵
  PID:12448
- C:\Windows\System\RZlsjxl.exe
  C:\Windows\System\RZlsjxl.exe
  2⤵
  PID:6992
- C:\Windows\System\rwxTlvl.exe
  C:\Windows\System\rwxTlvl.exe
  2⤵
  PID:5668
- C:\Windows\System\QeRqsDp.exe
  C:\Windows\System\QeRqsDp.exe
  2⤵
  PID:2940
- C:\Windows\System\pwPhsRg.exe
  C:\Windows\System\pwPhsRg.exe
  2⤵
  PID:9144
- C:\Windows\System\IJBYAPn.exe
  C:\Windows\System\IJBYAPn.exe
  2⤵
  PID:7812
- C:\Windows\System\XjZAaEi.exe
  C:\Windows\System\XjZAaEi.exe
  2⤵
  PID:7980
- C:\Windows\System\STqbDMj.exe
  C:\Windows\System\STqbDMj.exe
  2⤵
  PID:8004
- C:\Windows\System\yIBQKxp.exe
  C:\Windows\System\yIBQKxp.exe
  2⤵
  PID:3412
- C:\Windows\System\iYgJXmo.exe
  C:\Windows\System\iYgJXmo.exe
  2⤵
  PID:7576
- C:\Windows\System\EmwcDpJ.exe
  C:\Windows\System\EmwcDpJ.exe
  2⤵
  PID:3468
- C:\Windows\System\pMzyRhl.exe
  C:\Windows\System\pMzyRhl.exe
  2⤵
  PID:6408
- C:\Windows\System\kDmoDjB.exe
  C:\Windows\System\kDmoDjB.exe
  2⤵
  PID:1516
- C:\Windows\System\nMQEriw.exe
  C:\Windows\System\nMQEriw.exe
  2⤵
  PID:8664
- C:\Windows\System\LyBUlgq.exe
  C:\Windows\System\LyBUlgq.exe
  2⤵
  PID:2916
- C:\Windows\System\OmJWHCY.exe
  C:\Windows\System\OmJWHCY.exe
  2⤵
  PID:9644
- C:\Windows\System\KkRUjXr.exe
  C:\Windows\System\KkRUjXr.exe
  2⤵
  PID:10560
- C:\Windows\System\tevzvQb.exe
  C:\Windows\System\tevzvQb.exe
  2⤵
  PID:9844
- C:\Windows\System\hohWBjC.exe
  C:\Windows\System\hohWBjC.exe
  2⤵
  PID:2428
- C:\Windows\System\AFDIuBg.exe
  C:\Windows\System\AFDIuBg.exe
  2⤵
  PID:5664
- C:\Windows\System\HRVAJxy.exe
  C:\Windows\System\HRVAJxy.exe
  2⤵
  PID:7764
- C:\Windows\System\BxSepHi.exe
  C:\Windows\System\BxSepHi.exe
  2⤵
  PID:7888
- C:\Windows\System\TcVmUoL.exe
  C:\Windows\System\TcVmUoL.exe
  2⤵
  PID:7964
- C:\Windows\System\FJFSewS.exe
  C:\Windows\System\FJFSewS.exe
  2⤵
  PID:7920
- C:\Windows\System\Uqpjuoo.exe
  C:\Windows\System\Uqpjuoo.exe
  2⤵
  PID:8028
- C:\Windows\System\tyRwLGp.exe
  C:\Windows\System\tyRwLGp.exe
  2⤵
  PID:8904
- C:\Windows\System\mxXMgdn.exe
  C:\Windows\System\mxXMgdn.exe
  2⤵
  PID:8668
- C:\Windows\System\XkLfUbl.exe
  C:\Windows\System\XkLfUbl.exe
  2⤵
  PID:3416
- C:\Windows\System\BxrseBC.exe
  C:\Windows\System\BxrseBC.exe
  2⤵
  PID:4928
- C:\Windows\System\TIBjMnZ.exe
  C:\Windows\System\TIBjMnZ.exe
  2⤵
  PID:3312
- C:\Windows\System\FyloUwr.exe
  C:\Windows\System\FyloUwr.exe
  2⤵
  PID:1824
- C:\Windows\System\uBBopDB.exe
  C:\Windows\System\uBBopDB.exe
  2⤵
  PID:11676
- C:\Windows\System\TwLPWcj.exe
  C:\Windows\System\TwLPWcj.exe
  2⤵
  PID:8872
- C:\Windows\System\QjLhngL.exe
  C:\Windows\System\QjLhngL.exe
  2⤵
  PID:6604
- C:\Windows\System\FtnGxCi.exe
  C:\Windows\System\FtnGxCi.exe
  2⤵
  PID:7508
- C:\Windows\System\gjsxrGU.exe
  C:\Windows\System\gjsxrGU.exe
  2⤵
  PID:5264
- C:\Windows\System\VnxZBsV.exe
  C:\Windows\System\VnxZBsV.exe
  2⤵
  PID:8956
- C:\Windows\System\bApWoey.exe
  C:\Windows\System\bApWoey.exe
  2⤵
  PID:8604
- C:\Windows\System\kOImxir.exe
  C:\Windows\System\kOImxir.exe
  2⤵
  PID:8576
- C:\Windows\System\vzgUPbW.exe
  C:\Windows\System\vzgUPbW.exe
  2⤵
  PID:6236
- C:\Windows\System\xrrAPul.exe
  C:\Windows\System\xrrAPul.exe
  2⤵
  PID:9028
- C:\Windows\System\YXmUMCA.exe
  C:\Windows\System\YXmUMCA.exe
  2⤵
  PID:4312
- C:\Windows\System\SiHEPNG.exe
  C:\Windows\System\SiHEPNG.exe
  2⤵
  PID:10472
- C:\Windows\System\qKMdNFi.exe
  C:\Windows\System\qKMdNFi.exe
  2⤵
  PID:3336
- C:\Windows\System\SUAAutn.exe
  C:\Windows\System\SUAAutn.exe
  2⤵
  PID:864
- C:\Windows\System\RSRCxZW.exe
  C:\Windows\System\RSRCxZW.exe
  2⤵
  PID:10908
- C:\Windows\System\zdPJseT.exe
  C:\Windows\System\zdPJseT.exe
  2⤵
  PID:1988
- C:\Windows\System\PTrQVor.exe
  C:\Windows\System\PTrQVor.exe
  2⤵
  PID:7788
- C:\Windows\System\DglhStK.exe
  C:\Windows\System\DglhStK.exe
  2⤵
  PID:11120
- C:\Windows\System\NcXvtrn.exe
  C:\Windows\System\NcXvtrn.exe
  2⤵
  PID:7976
- C:\Windows\System\yUgdZrm.exe
  C:\Windows\System\yUgdZrm.exe
  2⤵
  PID:8884
- C:\Windows\System\aLhbMRo.exe
  C:\Windows\System\aLhbMRo.exe
  2⤵
  PID:3340
- C:\Windows\System\VOJVaBt.exe
  C:\Windows\System\VOJVaBt.exe
  2⤵
  PID:7936
- C:\Windows\System\SghaQEU.exe
  C:\Windows\System\SghaQEU.exe
  2⤵
  PID:2400
- C:\Windows\System\VMJoFGv.exe
  C:\Windows\System\VMJoFGv.exe
  2⤵
  PID:6952
- C:\Windows\System\OoRPXya.exe
  C:\Windows\System\OoRPXya.exe
  2⤵
  PID:10408
- C:\Windows\System\VwmivCt.exe
  C:\Windows\System\VwmivCt.exe
  2⤵
  PID:4088
- C:\Windows\System\EFahTVv.exe
  C:\Windows\System\EFahTVv.exe
  2⤵
  PID:8456
- C:\Windows\System\AeNmLjl.exe
  C:\Windows\System\AeNmLjl.exe
  2⤵
  PID:4572
- C:\Windows\System\xEUPGbX.exe
  C:\Windows\System\xEUPGbX.exe
  2⤵
  PID:9220
- C:\Windows\System\ZBHWBxa.exe
  C:\Windows\System\ZBHWBxa.exe
  2⤵
  PID:1884
- C:\Windows\System\AcIPnjf.exe
  C:\Windows\System\AcIPnjf.exe
  2⤵
  PID:11416
- C:\Windows\System\hUchrJs.exe
  C:\Windows\System\hUchrJs.exe
  2⤵
  PID:1760
- C:\Windows\System\odoMCgz.exe
  C:\Windows\System\odoMCgz.exe
  2⤵
  PID:4724
- C:\Windows\System\LnOpgfP.exe
  C:\Windows\System\LnOpgfP.exe
  2⤵
  PID:10684
- C:\Windows\System\LMQeMzY.exe
  C:\Windows\System\LMQeMzY.exe
  2⤵
  PID:11756
- C:\Windows\System\YVkzVgk.exe
  C:\Windows\System\YVkzVgk.exe
  2⤵
  PID:7364
- C:\Windows\System\thMRHlG.exe
  C:\Windows\System\thMRHlG.exe
  2⤵
  PID:10692
- C:\Windows\System\AlzFmUh.exe
  C:\Windows\System\AlzFmUh.exe
  2⤵
  PID:10268
- C:\Windows\System\fFCDOpi.exe
  C:\Windows\System\fFCDOpi.exe
  2⤵
  PID:6124
- C:\Windows\System\FAcrebu.exe
  C:\Windows\System\FAcrebu.exe
  2⤵
  PID:9788
- C:\Windows\System\bfmZhKb.exe
  C:\Windows\System\bfmZhKb.exe
  2⤵
  PID:4456
- C:\Windows\System\UObcEpr.exe
  C:\Windows\System\UObcEpr.exe
  2⤵
  PID:2496
- C:\Windows\System\piKDkkh.exe
  C:\Windows\System\piKDkkh.exe
  2⤵
  PID:5488
- C:\Windows\System\yNjJVaE.exe
  C:\Windows\System\yNjJVaE.exe
  2⤵
  PID:3472
- C:\Windows\System\mZcXzHe.exe
  C:\Windows\System\mZcXzHe.exe
  2⤵
  PID:4988
- C:\Windows\System\hBmzfch.exe
  C:\Windows\System\hBmzfch.exe
  2⤵
  PID:5588
- C:\Windows\System\mfRDKVv.exe
  C:\Windows\System\mfRDKVv.exe
  2⤵
  PID:12248
- C:\Windows\System\imLaCwq.exe
  C:\Windows\System\imLaCwq.exe
  2⤵
  PID:9928
- C:\Windows\System\bIHUQHV.exe
  C:\Windows\System\bIHUQHV.exe
  2⤵
  PID:5756
- C:\Windows\System\GglFUuF.exe
  C:\Windows\System\GglFUuF.exe
  2⤵
  PID:8656
- C:\Windows\System\DoLTBgn.exe
  C:\Windows\System\DoLTBgn.exe
  2⤵
  PID:4136
- C:\Windows\System\xohbbBf.exe
  C:\Windows\System\xohbbBf.exe
  2⤵
  PID:11580
- C:\Windows\System\zgIvWrw.exe
  C:\Windows\System\zgIvWrw.exe
  2⤵
  PID:7892
- C:\Windows\System\SLntOWO.exe
  C:\Windows\System\SLntOWO.exe
  2⤵
  PID:11040
- C:\Windows\System\tAqIwvf.exe
  C:\Windows\System\tAqIwvf.exe
  2⤵
  PID:5544
- C:\Windows\System\WDEKEMA.exe
  C:\Windows\System\WDEKEMA.exe
  2⤵
  PID:10328
- C:\Windows\System\iPTiHFE.exe
  C:\Windows\System\iPTiHFE.exe
  2⤵
  PID:12136
- C:\Windows\System\JRQrjNl.exe
  C:\Windows\System\JRQrjNl.exe
  2⤵
  PID:5548
- C:\Windows\System\hQxjuLn.exe
  C:\Windows\System\hQxjuLn.exe
  2⤵
  PID:3056
- C:\Windows\System\BoCGwMp.exe
  C:\Windows\System\BoCGwMp.exe
  2⤵
  PID:11680
- C:\Windows\System\QLyJBlZ.exe
  C:\Windows\System\QLyJBlZ.exe
  2⤵
  PID:11932
- C:\Windows\System\UkiumXD.exe
  C:\Windows\System\UkiumXD.exe
  2⤵
  PID:11472
- C:\Windows\System\YCWaYsb.exe
  C:\Windows\System\YCWaYsb.exe
  2⤵
  PID:8820
- C:\Windows\System\uBJLpJV.exe
  C:\Windows\System\uBJLpJV.exe
  2⤵
  PID:6128
- C:\Windows\System\vdMKONd.exe
  C:\Windows\System\vdMKONd.exe
  2⤵
  PID:5296
- C:\Windows\System\UIEBXUt.exe
  C:\Windows\System\UIEBXUt.exe
  2⤵
  PID:5972
- C:\Windows\System\HeYdETp.exe
  C:\Windows\System\HeYdETp.exe
  2⤵
  PID:6200
- C:\Windows\System\QeSbXgn.exe
  C:\Windows\System\QeSbXgn.exe
  2⤵
  PID:8628
- C:\Windows\System\KzRUTqk.exe
  C:\Windows\System\KzRUTqk.exe
  2⤵
  PID:4560
- C:\Windows\System\ppINUda.exe
  C:\Windows\System\ppINUda.exe
  2⤵
  PID:6356
- C:\Windows\System\FiWxPWR.exe
  C:\Windows\System\FiWxPWR.exe
  2⤵
  PID:11464
- C:\Windows\System\QcxbvIj.exe
  C:\Windows\System\QcxbvIj.exe
  2⤵
  PID:9804
- C:\Windows\System\cjNMUPb.exe
  C:\Windows\System\cjNMUPb.exe
  2⤵
  PID:6368
- C:\Windows\System\QfGIPis.exe
  C:\Windows\System\QfGIPis.exe
  2⤵
  PID:6504
- C:\Windows\System\VzXbohe.exe
  C:\Windows\System\VzXbohe.exe
  2⤵
  PID:12656
- C:\Windows\System\MaWbFHP.exe
  C:\Windows\System\MaWbFHP.exe
  2⤵
  PID:516
- C:\Windows\System\dccpYbD.exe
  C:\Windows\System\dccpYbD.exe
  2⤵
  PID:6608
- C:\Windows\System\kFrjeot.exe
  C:\Windows\System\kFrjeot.exe
  2⤵
  PID:12808
- C:\Windows\System\UMCkTyB.exe
  C:\Windows\System\UMCkTyB.exe
  2⤵
  PID:6668
- C:\Windows\System\bJSWpvE.exe
  C:\Windows\System\bJSWpvE.exe
  2⤵
  PID:9376
- C:\Windows\System\JVzZBDX.exe
  C:\Windows\System\JVzZBDX.exe
  2⤵
  PID:6880
- C:\Windows\System\kWBjyVN.exe
  C:\Windows\System\kWBjyVN.exe
  2⤵
  PID:6796
- C:\Windows\System\coHjBLr.exe
  C:\Windows\System\coHjBLr.exe
  2⤵
  PID:6940
- C:\Windows\System\gvSLJRy.exe
  C:\Windows\System\gvSLJRy.exe
  2⤵
  PID:6920
- C:\Windows\System\oNcsckx.exe
  C:\Windows\System\oNcsckx.exe
  2⤵
  PID:5332
- C:\Windows\System\Lcujqih.exe
  C:\Windows\System\Lcujqih.exe
  2⤵
  PID:9132
- C:\Windows\System\sajcQis.exe
  C:\Windows\System\sajcQis.exe
  2⤵
  PID:6956
- C:\Windows\System\WhWElpS.exe
  C:\Windows\System\WhWElpS.exe
  2⤵
  PID:7080
- C:\Windows\System\yJdZvmX.exe
  C:\Windows\System\yJdZvmX.exe
  2⤵
  PID:5300
- C:\Windows\System\jPZNDPU.exe
  C:\Windows\System\jPZNDPU.exe
  2⤵
  PID:11016
- C:\Windows\System\kljlmri.exe
  C:\Windows\System\kljlmri.exe
  2⤵
  PID:7084
- C:\Windows\System\lxBLxef.exe
  C:\Windows\System\lxBLxef.exe
  2⤵
  PID:5860
- C:\Windows\System\oHJYGca.exe
  C:\Windows\System\oHJYGca.exe
  2⤵
  PID:3972
- C:\Windows\System\lbTmWrF.exe
  C:\Windows\System\lbTmWrF.exe
  2⤵
  PID:12376
- C:\Windows\System\ndUwRpK.exe
  C:\Windows\System\ndUwRpK.exe
  2⤵
  PID:9164
- C:\Windows\System\wseSbBq.exe
  C:\Windows\System\wseSbBq.exe
  2⤵
  PID:6596
- C:\Windows\System\KRZwGQo.exe
  C:\Windows\System\KRZwGQo.exe
  2⤵
  PID:5112
- C:\Windows\System\GHBRPTa.exe
  C:\Windows\System\GHBRPTa.exe
  2⤵
  PID:11912
- C:\Windows\System\YeHKmoR.exe
  C:\Windows\System\YeHKmoR.exe
  2⤵
  PID:6768
- C:\Windows\System\WjDIeMS.exe
  C:\Windows\System\WjDIeMS.exe
  2⤵
  PID:6860
- C:\Windows\System\QJddsFx.exe
  C:\Windows\System\QJddsFx.exe
  2⤵
  PID:5628
- C:\Windows\System\ofwsVMl.exe
  C:\Windows\System\ofwsVMl.exe
  2⤵
  PID:13256
- C:\Windows\System\PHETECi.exe
  C:\Windows\System\PHETECi.exe
  2⤵
  PID:4372
- C:\Windows\System\SRBQCGK.exe
  C:\Windows\System\SRBQCGK.exe
  2⤵
  PID:10728
- C:\Windows\System\bMbbpUp.exe
  C:\Windows\System\bMbbpUp.exe
  2⤵
  PID:5580
- C:\Windows\System\DItvuJa.exe
  C:\Windows\System\DItvuJa.exe
  2⤵
  PID:8568
- C:\Windows\System\VMZhUSG.exe
  C:\Windows\System\VMZhUSG.exe
  2⤵
  PID:13092
- C:\Windows\System\cgRLocx.exe
  C:\Windows\System\cgRLocx.exe
  2⤵
  PID:7496
- C:\Windows\System\vugbdaU.exe
  C:\Windows\System\vugbdaU.exe
  2⤵
  PID:6296
- C:\Windows\System\rWFLiUc.exe
  C:\Windows\System\rWFLiUc.exe
  2⤵
  PID:7528
- C:\Windows\System\GgklNyR.exe
  C:\Windows\System\GgklNyR.exe
  2⤵
  PID:4140
- C:\Windows\System\pcLFXIC.exe
  C:\Windows\System\pcLFXIC.exe
  2⤵
  PID:11772
- C:\Windows\System\dUjFZal.exe
  C:\Windows\System\dUjFZal.exe
  2⤵
  PID:5072
- C:\Windows\System\dLZYMUC.exe
  C:\Windows\System\dLZYMUC.exe
  2⤵
  PID:10516
- C:\Windows\System\ffHsPZA.exe
  C:\Windows\System\ffHsPZA.exe
  2⤵
  PID:5640
- C:\Windows\System\NwAqnhJ.exe
  C:\Windows\System\NwAqnhJ.exe
  2⤵
  PID:6692
- C:\Windows\System\QstzqZP.exe
  C:\Windows\System\QstzqZP.exe
  2⤵
  PID:12812
- C:\Windows\System\bjeOyul.exe
  C:\Windows\System\bjeOyul.exe
  2⤵
  PID:10568
- C:\Windows\System\OyFgPmV.exe
  C:\Windows\System\OyFgPmV.exe
  2⤵
  PID:7628
- C:\Windows\System\JjceKxc.exe
  C:\Windows\System\JjceKxc.exe
  2⤵
  PID:6748
- C:\Windows\System\oKseKMP.exe
  C:\Windows\System\oKseKMP.exe
  2⤵
  PID:6948
- C:\Windows\System\syGggiA.exe
  C:\Windows\System\syGggiA.exe
  2⤵
  PID:5620
- C:\Windows\System\oOUFZll.exe
  C:\Windows\System\oOUFZll.exe
  2⤵
  PID:7200
- C:\Windows\System\WpNULzf.exe
  C:\Windows\System\WpNULzf.exe
  2⤵
  PID:5392
- C:\Windows\System\YOaivEs.exe
  C:\Windows\System\YOaivEs.exe
  2⤵
  PID:8184
- C:\Windows\System\eihLhev.exe
  C:\Windows\System\eihLhev.exe
  2⤵
  PID:12380
- C:\Windows\System\XtCDXKW.exe
  C:\Windows\System\XtCDXKW.exe
  2⤵
  PID:7088
- C:\Windows\System\FPBKZEp.exe
  C:\Windows\System\FPBKZEp.exe
  2⤵
  PID:10924
- C:\Windows\System\EZkuDJW.exe
  C:\Windows\System\EZkuDJW.exe
  2⤵
  PID:7376
- C:\Windows\System\dRUaxZO.exe
  C:\Windows\System\dRUaxZO.exe
  2⤵
  PID:5868
- C:\Windows\System\ZNbuVSm.exe
  C:\Windows\System\ZNbuVSm.exe
  2⤵
  PID:7672
- C:\Windows\System\dlfGzuX.exe
  C:\Windows\System\dlfGzuX.exe
  2⤵
  PID:6644
- C:\Windows\System\juMKMFp.exe
  C:\Windows\System\juMKMFp.exe
  2⤵
  PID:6896
- C:\Windows\System\NheeAwY.exe
  C:\Windows\System\NheeAwY.exe
  2⤵
  PID:4428
- C:\Windows\System\PWceoii.exe
  C:\Windows\System\PWceoii.exe
  2⤵
  PID:13288
- C:\Windows\System\yBesGlY.exe
  C:\Windows\System\yBesGlY.exe
  2⤵
  PID:8032
- C:\Windows\System\GhQfscr.exe
  C:\Windows\System\GhQfscr.exe
  2⤵
  PID:6944
- C:\Windows\System\PVOqumO.exe
  C:\Windows\System\PVOqumO.exe
  2⤵
  PID:11384
- C:\Windows\System\tvgAxnm.exe
  C:\Windows\System\tvgAxnm.exe
  2⤵
  PID:7336
- C:\Windows\System\OYLFyNX.exe
  C:\Windows\System\OYLFyNX.exe
  2⤵
  PID:7352
- C:\Windows\System\XRTFgrx.exe
  C:\Windows\System\XRTFgrx.exe
  2⤵
  PID:4980
- C:\Windows\System\LWVIzhp.exe
  C:\Windows\System\LWVIzhp.exe
  2⤵
  PID:7784
- C:\Windows\System\EAcOoPr.exe
  C:\Windows\System\EAcOoPr.exe
  2⤵
  PID:7536
- C:\Windows\System\yxwfjvT.exe
  C:\Windows\System\yxwfjvT.exe
  2⤵
  PID:12636
- C:\Windows\System\EpFWsOj.exe
  C:\Windows\System\EpFWsOj.exe
  2⤵
  PID:7472
- C:\Windows\System\ZDisVRA.exe
  C:\Windows\System\ZDisVRA.exe
  2⤵
  PID:7660
- C:\Windows\System\ZLCZlxK.exe
  C:\Windows\System\ZLCZlxK.exe
  2⤵
  PID:9048
- C:\Windows\System\WwuUJXl.exe
  C:\Windows\System\WwuUJXl.exe
  2⤵
  PID:7984
- C:\Windows\System\YHbXVBC.exe
  C:\Windows\System\YHbXVBC.exe
  2⤵
  PID:11840
- C:\Windows\System\kWCnXZq.exe
  C:\Windows\System\kWCnXZq.exe
  2⤵
  PID:7732
- C:\Windows\System\GBveRoX.exe
  C:\Windows\System\GBveRoX.exe
  2⤵
  PID:8124
- C:\Windows\System\WyWEGXD.exe
  C:\Windows\System\WyWEGXD.exe
  2⤵
  PID:9740
- C:\Windows\System\SNPSWCv.exe
  C:\Windows\System\SNPSWCv.exe
  2⤵
  PID:13000
- C:\Windows\System\GvuyZEs.exe
  C:\Windows\System\GvuyZEs.exe
  2⤵
  PID:7880
- C:\Windows\System\HBctesn.exe
  C:\Windows\System\HBctesn.exe
  2⤵
  PID:11876
- C:\Windows\System\aNaURVw.exe
  C:\Windows\System\aNaURVw.exe
  2⤵
  PID:7096
- C:\Windows\System\hWSiebJ.exe
  C:\Windows\System\hWSiebJ.exe
  2⤵
  PID:8144
- C:\Windows\System\ZdvkDkG.exe
  C:\Windows\System\ZdvkDkG.exe
  2⤵
  PID:8236
- C:\Windows\System\ifzQxQt.exe
  C:\Windows\System\ifzQxQt.exe
  2⤵
  PID:6912
- C:\Windows\System\xgdccPN.exe
  C:\Windows\System\xgdccPN.exe
  2⤵
  PID:8808
- C:\Windows\System\XIEspAS.exe
  C:\Windows\System\XIEspAS.exe
  2⤵
  PID:6148
- C:\Windows\System\yVGEtPV.exe
  C:\Windows\System\yVGEtPV.exe
  2⤵
  PID:7772
- C:\Windows\System\vtZPEIn.exe
  C:\Windows\System\vtZPEIn.exe
  2⤵
  PID:13116
- C:\Windows\System\wARFeov.exe
  C:\Windows\System\wARFeov.exe
  2⤵
  PID:9304
- C:\Windows\System\VBVLuiV.exe
  C:\Windows\System\VBVLuiV.exe
  2⤵
  PID:7500
- C:\Windows\System\ApwftxH.exe
  C:\Windows\System\ApwftxH.exe
  2⤵
  PID:6776
- C:\Windows\System\oIrKBEu.exe
  C:\Windows\System\oIrKBEu.exe
  2⤵
  PID:8112
- C:\Windows\System\CnuKXop.exe
  C:\Windows\System\CnuKXop.exe
  2⤵
  PID:6728
- C:\Windows\System\XLLogyg.exe
  C:\Windows\System\XLLogyg.exe
  2⤵
  PID:8080
- C:\Windows\System\HGRhyhM.exe
  C:\Windows\System\HGRhyhM.exe
  2⤵
  PID:9420
- C:\Windows\System\kXQkBrZ.exe
  C:\Windows\System\kXQkBrZ.exe
  2⤵
  PID:9516
- C:\Windows\System\SVtJHXV.exe
  C:\Windows\System\SVtJHXV.exe
  2⤵
  PID:6840
- C:\Windows\System\OQjkfCr.exe
  C:\Windows\System\OQjkfCr.exe
  2⤵
  PID:9732
- C:\Windows\System\IgYwCKQ.exe
  C:\Windows\System\IgYwCKQ.exe
  2⤵
  PID:9736
- C:\Windows\System\qLFaLHv.exe
  C:\Windows\System\qLFaLHv.exe
  2⤵
  PID:11652
- C:\Windows\System\IqvdVHE.exe
  C:\Windows\System\IqvdVHE.exe
  2⤵
  PID:6520
- C:\Windows\System\UnMFJWt.exe
  C:\Windows\System\UnMFJWt.exe
  2⤵
  PID:9828
- C:\Windows\System\hRLbuez.exe
  C:\Windows\System\hRLbuez.exe
  2⤵
  PID:9860
- C:\Windows\System\GrKeeMY.exe
  C:\Windows\System\GrKeeMY.exe
  2⤵
  PID:9104
- C:\Windows\System\iyZFquC.exe
  C:\Windows\System\iyZFquC.exe
  2⤵
  PID:10032
- C:\Windows\System\gkClDNw.exe
  C:\Windows\System\gkClDNw.exe
  2⤵
  PID:10144
- C:\Windows\System\EHkorUR.exe
  C:\Windows\System\EHkorUR.exe
  2⤵
  PID:4408
- C:\Windows\System\XLFyAuX.exe
  C:\Windows\System\XLFyAuX.exe
  2⤵
  PID:5736
- C:\Windows\System\KUUbVQy.exe
  C:\Windows\System\KUUbVQy.exe
  2⤵
  PID:8468
- C:\Windows\System\GvnQYed.exe
  C:\Windows\System\GvnQYed.exe
  2⤵
  PID:10136
- C:\Windows\System\bWCRwfH.exe
  C:\Windows\System\bWCRwfH.exe
  2⤵
  PID:8752
- C:\Windows\System\OYjEdAc.exe
  C:\Windows\System\OYjEdAc.exe
  2⤵
  PID:7316
- C:\Windows\System\vVNwsGc.exe
  C:\Windows\System\vVNwsGc.exe
  2⤵
  PID:9400
- C:\Windows\System\bxDIaEd.exe
  C:\Windows\System\bxDIaEd.exe
  2⤵
  PID:9512
- C:\Windows\System\LFtxcAl.exe
  C:\Windows\System\LFtxcAl.exe
  2⤵
  PID:5612
- C:\Windows\System\OejLxRp.exe
  C:\Windows\System\OejLxRp.exe
  2⤵
  PID:9728
- C:\Windows\System\xWVbmiD.exe
  C:\Windows\System\xWVbmiD.exe
  2⤵
  PID:9940
- C:\Windows\System\uitRbtz.exe
  C:\Windows\System\uitRbtz.exe
  2⤵
  PID:10036
- C:\Windows\System\nwtPuvz.exe
  C:\Windows\System\nwtPuvz.exe
  2⤵
  PID:13232
- C:\Windows\System\hTxfJvN.exe
  C:\Windows\System\hTxfJvN.exe
  2⤵
  PID:9424
- C:\Windows\System\SzpdrlS.exe
  C:\Windows\System\SzpdrlS.exe
  2⤵
  PID:9472
- C:\Windows\System\AgqSehk.exe
  C:\Windows\System\AgqSehk.exe
  2⤵
  PID:10116
- C:\Windows\System\kdAcEkt.exe
  C:\Windows\System\kdAcEkt.exe
  2⤵
  PID:12296
- C:\Windows\System\fjUrkOg.exe
  C:\Windows\System\fjUrkOg.exe
  2⤵
  PID:9408
- C:\Windows\System\zvnWBfj.exe
  C:\Windows\System\zvnWBfj.exe
  2⤵
  PID:9960
- C:\Windows\System\hqEeCUn.exe
  C:\Windows\System\hqEeCUn.exe
  2⤵
  PID:7648
- C:\Windows\System\rVVgnbc.exe
  C:\Windows\System\rVVgnbc.exe
  2⤵
  PID:10444
- C:\Windows\System\PXBBSPk.exe
  C:\Windows\System\PXBBSPk.exe
  2⤵
  PID:8088
- C:\Windows\System\ZwmGaoT.exe
  C:\Windows\System\ZwmGaoT.exe
  2⤵
  PID:10624
- C:\Windows\System\XITXZJl.exe
  C:\Windows\System\XITXZJl.exe
  2⤵
  PID:10672
- C:\Windows\System\CPAZRwy.exe
  C:\Windows\System\CPAZRwy.exe
  2⤵
  PID:9524
- C:\Windows\System\MZjaAlY.exe
  C:\Windows\System\MZjaAlY.exe
  2⤵
  PID:10628
- C:\Windows\System\ziiWRdM.exe
  C:\Windows\System\ziiWRdM.exe
  2⤵
  PID:9352
- C:\Windows\System\bPZKtVT.exe
  C:\Windows\System\bPZKtVT.exe
  2⤵
  PID:8076
- C:\Windows\System\XdJtzZL.exe
  C:\Windows\System\XdJtzZL.exe
  2⤵
  PID:9676
- C:\Windows\System\hnFIaem.exe
  C:\Windows\System\hnFIaem.exe
  2⤵
  PID:8344
- C:\Windows\System\hPcZPSU.exe
  C:\Windows\System\hPcZPSU.exe
  2⤵
  PID:8320
- C:\Windows\System\HuJXWwO.exe
  C:\Windows\System\HuJXWwO.exe
  2⤵
  PID:10860
- C:\Windows\System\rIKvEix.exe
  C:\Windows\System\rIKvEix.exe
  2⤵
  PID:10540
- C:\Windows\System\WvomSGX.exe
  C:\Windows\System\WvomSGX.exe
  2⤵
  PID:10656
- C:\Windows\System\pDZuUDJ.exe
  C:\Windows\System\pDZuUDJ.exe
  2⤵
  PID:10688
- C:\Windows\System\WPzinjz.exe
  C:\Windows\System\WPzinjz.exe
  2⤵
  PID:11128
- C:\Windows\System\tGJSCCe.exe
  C:\Windows\System\tGJSCCe.exe
  2⤵
  PID:10788
- C:\Windows\System\IOdviWx.exe
  C:\Windows\System\IOdviWx.exe
  2⤵
  PID:10972
- C:\Windows\System\AoxIogd.exe
  C:\Windows\System\AoxIogd.exe
  2⤵
  PID:1400
- C:\Windows\System\ShKdPpD.exe
  C:\Windows\System\ShKdPpD.exe
  2⤵
  PID:10312
- C:\Windows\System\XsGXBGU.exe
  C:\Windows\System\XsGXBGU.exe
  2⤵
  PID:8224
- C:\Windows\System\hXPcoew.exe
  C:\Windows\System\hXPcoew.exe
  2⤵
  PID:11228
- C:\Windows\System\RkerRwm.exe
  C:\Windows\System\RkerRwm.exe
  2⤵
  PID:11240
- C:\Windows\System\CYYHaEq.exe
  C:\Windows\System\CYYHaEq.exe
  2⤵
  PID:13340
- C:\Windows\System\eloupPP.exe
  C:\Windows\System\eloupPP.exe
  2⤵
  PID:13368
- C:\Windows\System\hvjtYiC.exe
  C:\Windows\System\hvjtYiC.exe
  2⤵
  PID:13404
- C:\Windows\System\kSkRddI.exe
  C:\Windows\System\kSkRddI.exe
  2⤵
  PID:13440
- C:\Windows\System\QOKVRiP.exe
  C:\Windows\System\QOKVRiP.exe
  2⤵
  PID:13484
- C:\Windows\System\GEwglda.exe
  C:\Windows\System\GEwglda.exe
  2⤵
  PID:13520
- C:\Windows\System\GLLMUSN.exe
  C:\Windows\System\GLLMUSN.exe
  2⤵
  PID:13548
- C:\Windows\System\cZSZdTE.exe
  C:\Windows\System\cZSZdTE.exe
  2⤵
  PID:13708
- C:\Windows\System\jlAcalR.exe
  C:\Windows\System\jlAcalR.exe
  2⤵
  PID:13752
- C:\Windows\System\gBiapGS.exe
  C:\Windows\System\gBiapGS.exe
  2⤵
  PID:13804
- C:\Windows\System\OpnsniR.exe
  C:\Windows\System\OpnsniR.exe
  2⤵
  PID:13840
- C:\Windows\System\ZcOJvJh.exe
  C:\Windows\System\ZcOJvJh.exe
  2⤵
  PID:13856
- C:\Windows\System\sPmGyJw.exe
  C:\Windows\System\sPmGyJw.exe
  2⤵
  PID:13872
- C:\Windows\System\kZOmeau.exe
  C:\Windows\System\kZOmeau.exe
  2⤵
  PID:13888
- C:\Windows\System\vAraoUw.exe
  C:\Windows\System\vAraoUw.exe
  2⤵
  PID:13912
- C:\Windows\System\AInrXFP.exe
  C:\Windows\System\AInrXFP.exe
  2⤵
  PID:13952
- C:\Windows\System\IgGxYVx.exe
  C:\Windows\System\IgGxYVx.exe
  2⤵
  PID:13972
- C:\Windows\System\tUKRfok.exe
  C:\Windows\System\tUKRfok.exe
  2⤵
  PID:14028
- C:\Windows\System\rapRJGR.exe
  C:\Windows\System\rapRJGR.exe
  2⤵
  PID:14052
- C:\Windows\System\AWDbvSr.exe
  C:\Windows\System\AWDbvSr.exe
  2⤵
  PID:14072
- C:\Windows\System\KMWXhLa.exe
  C:\Windows\System\KMWXhLa.exe
  2⤵
  PID:14104
- C:\Windows\System\KfifEcL.exe
  C:\Windows\System\KfifEcL.exe
  2⤵
  PID:14152
- C:\Windows\System\MxjYETU.exe
  C:\Windows\System\MxjYETU.exe
  2⤵
  PID:14180
- C:\Windows\System\OFbJltF.exe
  C:\Windows\System\OFbJltF.exe
  2⤵
  PID:14204
- C:\Windows\System\VGgCgBq.exe
  C:\Windows\System\VGgCgBq.exe
  2⤵
  PID:14248
- C:\Windows\System\iXnhjcm.exe
  C:\Windows\System\iXnhjcm.exe
  2⤵
  PID:14284
- C:\Windows\System\HyVZWCx.exe
  C:\Windows\System\HyVZWCx.exe
  2⤵
  PID:14316
- C:\Windows\System\aWXTFZQ.exe
  C:\Windows\System\aWXTFZQ.exe
  2⤵
  PID:10736
- C:\Windows\System\FEDMBOP.exe
  C:\Windows\System\FEDMBOP.exe
  2⤵
  PID:11180
- C:\Windows\System\abwxpAg.exe
  C:\Windows\System\abwxpAg.exe
  2⤵
  PID:10480
- C:\Windows\System\yOaiezz.exe
  C:\Windows\System\yOaiezz.exe
  2⤵
  PID:13320
- C:\Windows\System\BURQsmj.exe
  C:\Windows\System\BURQsmj.exe
  2⤵
  PID:13328
- C:\Windows\System\FtkktOH.exe
  C:\Windows\System\FtkktOH.exe
  2⤵
  PID:13356
- C:\Windows\System\JGsORBH.exe
  C:\Windows\System\JGsORBH.exe
  2⤵
  PID:3628
- C:\Windows\System\MmeuLqN.exe
  C:\Windows\System\MmeuLqN.exe
  2⤵
  PID:13468
- C:\Windows\System\jCRGtLd.exe
  C:\Windows\System\jCRGtLd.exe
  2⤵
  PID:13556
- C:\Windows\System\jigvtsF.exe
  C:\Windows\System\jigvtsF.exe
  2⤵
  PID:13448
- C:\Windows\System\aVqjcvT.exe
  C:\Windows\System\aVqjcvT.exe
  2⤵
  PID:13540
- C:\Windows\System\aMdGGCt.exe
  C:\Windows\System\aMdGGCt.exe
  2⤵
  PID:13656
- C:\Windows\System\mJMCRYo.exe
  C:\Windows\System\mJMCRYo.exe
  2⤵
  PID:1084
- C:\Windows\System\ckuTHVr.exe
  C:\Windows\System\ckuTHVr.exe
  2⤵
  PID:13732
- C:\Windows\System\UgVpvfJ.exe
  C:\Windows\System\UgVpvfJ.exe
  2⤵
  PID:11428
- C:\Windows\System\wgRoUlX.exe
  C:\Windows\System\wgRoUlX.exe
  2⤵
  PID:11312
- C:\Windows\System\cOeCgCK.exe
  C:\Windows\System\cOeCgCK.exe
  2⤵
  PID:11576
- C:\Windows\System\DCmSSAH.exe
  C:\Windows\System\DCmSSAH.exe
  2⤵
  PID:13948
- C:\Windows\System\fNOAjlg.exe
  C:\Windows\System\fNOAjlg.exe
  2⤵
  PID:13696
- C:\Windows\System\ZiMCmCG.exe
  C:\Windows\System\ZiMCmCG.exe
  2⤵
  PID:13748
- C:\Windows\System\rmjuQdO.exe
  C:\Windows\System\rmjuQdO.exe
  2⤵
  PID:13932
- C:\Windows\System\XnPqttq.exe
  C:\Windows\System\XnPqttq.exe
  2⤵
  PID:13852
- C:\Windows\System\CyxsjFR.exe
  C:\Windows\System\CyxsjFR.exe
  2⤵
  PID:14044
- C:\Windows\System\oKEwAws.exe
  C:\Windows\System\oKEwAws.exe
  2⤵
  PID:14100
- C:\Windows\System\Nozszon.exe
  C:\Windows\System\Nozszon.exe
  2⤵
  PID:14068
- C:\Windows\System\tgEBoSH.exe
  C:\Windows\System\tgEBoSH.exe
  2⤵
  PID:11952
- C:\Windows\System\NqSdZpK.exe
  C:\Windows\System\NqSdZpK.exe
  2⤵
  PID:14280
- C:\Windows\System\mKOhlIW.exe
  C:\Windows\System\mKOhlIW.exe
  2⤵
  PID:12148
- C:\Windows\System\GoxNWat.exe
  C:\Windows\System\GoxNWat.exe
  2⤵
  PID:12092
- C:\Windows\System\HTxNuUf.exe
  C:\Windows\System\HTxNuUf.exe
  2⤵
  PID:14196
- C:\Windows\System\lPlOSfR.exe
  C:\Windows\System\lPlOSfR.exe
  2⤵
  PID:13352
- C:\Windows\System\DKpmzPA.exe
  C:\Windows\System\DKpmzPA.exe
  2⤵
  PID:11556
- C:\Windows\System\fMaPSoR.exe
  C:\Windows\System\fMaPSoR.exe
  2⤵
  PID:10980
- C:\Windows\System\IFmdUoG.exe
  C:\Windows\System\IFmdUoG.exe
  2⤵
  PID:13528
- C:\Windows\System\sSJjkLI.exe
  C:\Windows\System\sSJjkLI.exe
  2⤵
  PID:9320
- C:\Windows\System\GqkyegO.exe
  C:\Windows\System\GqkyegO.exe
  2⤵
  PID:11400
- C:\Windows\System\ENkXnjZ.exe
  C:\Windows\System\ENkXnjZ.exe
  2⤵
  PID:13668
- C:\Windows\System\hzypJJK.exe
  C:\Windows\System\hzypJJK.exe
  2⤵
  PID:13884
- C:\Windows\System\mfTvQDB.exe
  C:\Windows\System\mfTvQDB.exe
  2⤵
  PID:11496
- C:\Windows\System\hyElrCH.exe
  C:\Windows\System\hyElrCH.exe
  2⤵
  PID:13676
- C:\Windows\System\QzMoqth.exe
  C:\Windows\System\QzMoqth.exe
  2⤵
  PID:13924
- C:\Windows\System\TquAogr.exe
  C:\Windows\System\TquAogr.exe
  2⤵
  PID:11588
- C:\Windows\System\XGfamDT.exe
  C:\Windows\System\XGfamDT.exe
  2⤵
  PID:12244
- C:\Windows\System\cQVdCpE.exe
  C:\Windows\System\cQVdCpE.exe
  2⤵
  PID:12496
- C:\Windows\System\FrHdHxm.exe
  C:\Windows\System\FrHdHxm.exe
  2⤵
  PID:14220
- C:\Windows\System\VMHHKwT.exe
  C:\Windows\System\VMHHKwT.exe
  2⤵
  PID:11232
- C:\Windows\System\pSpDaSH.exe
  C:\Windows\System\pSpDaSH.exe
  2⤵
  PID:14120
- C:\Windows\System\WrBxxsn.exe
  C:\Windows\System\WrBxxsn.exe
  2⤵
  PID:14332
- C:\Windows\System\BihlTTo.exe
  C:\Windows\System\BihlTTo.exe
  2⤵
  PID:9668
- C:\Windows\System\wZVZtWm.exe
  C:\Windows\System\wZVZtWm.exe
  2⤵
  PID:12584
- C:\Windows\System\CnDhOhF.exe
  C:\Windows\System\CnDhOhF.exe
  2⤵
  PID:13400
- C:\Windows\System\MbnCEOF.exe
  C:\Windows\System\MbnCEOF.exe
  2⤵
  PID:12944
- C:\Windows\System\MLjViYU.exe
  C:\Windows\System\MLjViYU.exe
  2⤵
  PID:12728
- C:\Windows\System\wXTYFcA.exe
  C:\Windows\System\wXTYFcA.exe
  2⤵
  PID:11544
- C:\Windows\System\yWgyaGg.exe
  C:\Windows\System\yWgyaGg.exe
  2⤵
  PID:11248
- C:\Windows\System\DqLaZxj.exe
  C:\Windows\System\DqLaZxj.exe
  2⤵
  PID:11536
- C:\Windows\System\GYzcfPw.exe
  C:\Windows\System\GYzcfPw.exe
  2⤵
  PID:13136
- C:\Windows\System\DduTjIq.exe
  C:\Windows\System\DduTjIq.exe
  2⤵
  PID:12316
- C:\Windows\System\YjDfjGu.exe
  C:\Windows\System\YjDfjGu.exe
  2⤵
  PID:12128
- C:\Windows\System\SKiRqDp.exe
  C:\Windows\System\SKiRqDp.exe
  2⤵
  PID:13416
- C:\Windows\System\AXyRiwm.exe
  C:\Windows\System\AXyRiwm.exe
  2⤵
  PID:13816
- C:\Windows\System\pvKTjfI.exe
  C:\Windows\System\pvKTjfI.exe
  2⤵
  PID:11236
- C:\Windows\System\qLaUISM.exe
  C:\Windows\System\qLaUISM.exe
  2⤵
  PID:11108
- C:\Windows\System\GtzKvFT.exe
  C:\Windows\System\GtzKvFT.exe
  2⤵
  PID:2700
- C:\Windows\System\ZyKiYJB.exe
  C:\Windows\System\ZyKiYJB.exe
  2⤵
  PID:13776
- C:\Windows\System\hHOYAbj.exe
  C:\Windows\System\hHOYAbj.exe
  2⤵
  PID:12392
- C:\Windows\System\AOadKNR.exe
  C:\Windows\System\AOadKNR.exe
  2⤵
  PID:12124
- C:\Windows\System\XMCAxmF.exe
  C:\Windows\System\XMCAxmF.exe
  2⤵
  PID:13512
- C:\Windows\System\vKELuHc.exe
  C:\Windows\System\vKELuHc.exe
  2⤵
  PID:14260
- C:\Windows\System\knJNCiH.exe
  C:\Windows\System\knJNCiH.exe
  2⤵
  PID:13908
- C:\Windows\System\RpZJrgn.exe
  C:\Windows\System\RpZJrgn.exe
  2⤵
  PID:12672
- C:\Windows\System\qooOpHb.exe
  C:\Windows\System\qooOpHb.exe
  2⤵
  PID:13680
- C:\Windows\System\BUqjpqT.exe
  C:\Windows\System\BUqjpqT.exe
  2⤵
  PID:11620
- C:\Windows\System\oJOJRND.exe
  C:\Windows\System\oJOJRND.exe
  2⤵
  PID:13268
- C:\Windows\System\WGzUtsT.exe
  C:\Windows\System\WGzUtsT.exe
  2⤵
  PID:13248
- C:\Windows\System\POwZfaS.exe
  C:\Windows\System\POwZfaS.exe
  2⤵
  PID:13868
- C:\Windows\System\kMfKWfy.exe
  C:\Windows\System\kMfKWfy.exe
  2⤵
  PID:12948
- C:\Windows\System\btukDSW.exe
  C:\Windows\System\btukDSW.exe
  2⤵
  PID:10504
- C:\Windows\System\uoKtCfe.exe
  C:\Windows\System\uoKtCfe.exe
  2⤵
  PID:12044
- C:\Windows\System\koxzexI.exe
  C:\Windows\System\koxzexI.exe
  2⤵
  PID:14360
- C:\Windows\System\MWXBcUi.exe
  C:\Windows\System\MWXBcUi.exe
  2⤵
  PID:14380
- C:\Windows\System\wIwCsXO.exe
  C:\Windows\System\wIwCsXO.exe
  2⤵
  PID:14416
- C:\Windows\System\GzHUGFF.exe
  C:\Windows\System\GzHUGFF.exe
  2⤵
  PID:14456
- C:\Windows\System\XgzZeLz.exe
  C:\Windows\System\XgzZeLz.exe
  2⤵
  PID:14484
- C:\Windows\System\ySVDLgd.exe
  C:\Windows\System\ySVDLgd.exe
  2⤵
  PID:14516
- C:\Windows\System\LlKEsEt.exe
  C:\Windows\System\LlKEsEt.exe
  2⤵
  PID:14548
- C:\Windows\System\pFvPqhr.exe
  C:\Windows\System\pFvPqhr.exe
  2⤵
  PID:14568
- C:\Windows\System\tySpaNv.exe
  C:\Windows\System\tySpaNv.exe
  2⤵
  PID:14608
- C:\Windows\System\NDHOvDV.exe
  C:\Windows\System\NDHOvDV.exe
  2⤵
  PID:14648
- C:\Windows\System\tzJTnZa.exe
  C:\Windows\System\tzJTnZa.exe
  2⤵
  PID:14680
- C:\Windows\System\qFdnwro.exe
  C:\Windows\System\qFdnwro.exe
  2⤵
  PID:14708
- C:\Windows\System\CIjIjOU.exe
  C:\Windows\System\CIjIjOU.exe
  2⤵
  PID:14736
- C:\Windows\System\VhzNNev.exe
  C:\Windows\System\VhzNNev.exe
  2⤵
  PID:14760
- C:\Windows\System\JxsUgca.exe
  C:\Windows\System\JxsUgca.exe
  2⤵
  PID:14784
- C:\Windows\System\KZDloJP.exe
  C:\Windows\System\KZDloJP.exe
  2⤵
  PID:14820
- C:\Windows\System\mvJqNha.exe
  C:\Windows\System\mvJqNha.exe
  2⤵
  PID:14836
- C:\Windows\System\aDIdSPu.exe
  C:\Windows\System\aDIdSPu.exe
  2⤵
  PID:14856
- C:\Windows\System\uEFGSef.exe
  C:\Windows\System\uEFGSef.exe
  2⤵
  PID:14888
- C:\Windows\System\vNIYbKG.exe
  C:\Windows\System\vNIYbKG.exe
  2⤵
  PID:14920
- C:\Windows\System\DPEUGrI.exe
  C:\Windows\System\DPEUGrI.exe
  2⤵
  PID:14956
- C:\Windows\System\VxRkmPx.exe
  C:\Windows\System\VxRkmPx.exe
  2⤵
  PID:14976
- C:\Windows\System\EDBmsFi.exe
  C:\Windows\System\EDBmsFi.exe
  2⤵
  PID:14992
- C:\Windows\System\QHtolHn.exe
  C:\Windows\System\QHtolHn.exe
  2⤵
  PID:15032
- C:\Windows\System\QtxRAVO.exe
  C:\Windows\System\QtxRAVO.exe
  2⤵
  PID:15068
- C:\Windows\System\UmOiOmd.exe
  C:\Windows\System\UmOiOmd.exe
  2⤵
  PID:15088
- C:\Windows\System\creNAUQ.exe
  C:\Windows\System\creNAUQ.exe
  2⤵
  PID:15104
- C:\Windows\System\qQCxLLK.exe
  C:\Windows\System\qQCxLLK.exe
  2⤵
  PID:15136
- C:\Windows\System\vEFWCja.exe
  C:\Windows\System\vEFWCja.exe
  2⤵
  PID:15168
- C:\Windows\System\QuKOKpx.exe
  C:\Windows\System\QuKOKpx.exe
  2⤵
  PID:15208
- C:\Windows\System\jujRNyE.exe
  C:\Windows\System\jujRNyE.exe
  2⤵
  PID:15232
- C:\Windows\System\LphymDE.exe
  C:\Windows\System\LphymDE.exe
  2⤵
  PID:15264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s2cis5lm.avj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CWdFmaR.exe

Filesize
1.9MB

MD5
47b0a8fa6df1b07d7bd68e7aad5d440d

SHA1
1b3dad7c7a4c004ecb1eaa904e23b123de9b6257

SHA256
d9519d54898a8dd1a52f121afeb71631edeb49ee245180fec76589632a8e93d1

SHA512
45debcfc881f1c9f36016b600f67ffd36502d38d73d6b59692abff7cd1ec300a1c3c415dafcd5c6107162757d5c2382a73a459026c6dfbfcbe088325702bfc4d

Download Submit
C:\Windows\System\CjMCvQJ.exe

Filesize
1.9MB

MD5
340928e4bcf2b7fae4f041c90e1ab89d

SHA1
d8dc0c45eddf9fc7e3a745d59ea83d0311d98999

SHA256
d8a22f7230df6b711c89c5e0d87afa836b71ab3440cd4203f5a038f1dcf84d55

SHA512
cea5561b5f54e4e77c959f4f788b5389ffa7736a9a83558e93225cf671df50fdfdb5e675aab27d940a7870fb0fb8899d53926c1f7361d78723e8309a61459001

Download Submit
C:\Windows\System\GcNDMTm.exe

Filesize
1.9MB

MD5
bc04444df3a7f95e1d27760e04796938

SHA1
8e62d8042e1f54242a6f9da1eca56c8adf843559

SHA256
e8433f9c28307b9a19037d0e052bf515732ce732280045f905378e167647cea4

SHA512
74e52b2f92f904241a7fda72c6ddfb0edb49f4b939c809a3fdb94f4980626605e7d77745dae9de2c27ffc08c9dbea9391642d1a60343f352a4682957cb9cc0b1

Download Submit
C:\Windows\System\ILURZVr.exe

Filesize
1.9MB

MD5
549ddcc074b98c315cf83ff004105d05

SHA1
bef05eccca43d502a5c2bec9eea0c12c6aee0b3b

SHA256
30e07b0db53884f3bcbbccdf277701f1a491f647a77c92edf7850a96d8297571

SHA512
0feb726a6319bed4dcb81e99527ec3b6fa2a64874bae4c4291d0bb17f6c49ca5f5644b392fd0fcce895c3397db5b3cea91409ef86ec016d58db13cc5fdae615d

Download Submit
C:\Windows\System\NykLWex.exe

Filesize
1.9MB

MD5
35dabbd3fd7272cd088b2731d628a6e2

SHA1
ff898f1cd3b667af43a07588353decb9d1d4cfaf

SHA256
8ef35d0e5ae0a30de5f327c6c02deaaac8b846f4abaee6a09474e40e77b8b4ed

SHA512
78a5977e3bb412ec0b84f039410b592f41ee8b1601a5219f4cd3339869f8ecb6844131dba5ef2120440e3fa07e74e04f8f42b832a5c8e5524dd3ede56a89703f

Download Submit
C:\Windows\System\PpVRnbV.exe

Filesize
1.9MB

MD5
8d4f789ee39971919b3fcb7781b1e09e

SHA1
08c6df185b7684bd7110a430060062c10ae1452c

SHA256
6eb16c1c2dc003fd5432a0daf5c2c5755db14a8ae97d68d92e8bf412dde65a9a

SHA512
d111afdb024e6b7515923862642e4ed0501400c1c6c3146268b086d85d242f6330492b1def8808182c5984254bfa733e41e759cd8e8b53c6d2c457c2abda5df4

Download Submit
C:\Windows\System\QSyDuQu.exe

Filesize
1.9MB

MD5
5afa9be3ecda0532e31b0c8759a31aa4

SHA1
7671e97056552e93deff466213549ad6186ce40a

SHA256
9bc58b63d8a86e3321e9c999fd85bf994f105c1750b07e7888399889a4db2958

SHA512
8b9c1f5d31b644809d4f81b4bca4ea637989eec4bc19f4d0f2edb329019720cdd1519b667c23d6caa75d6cd8f0dfb0b10982713474ff90f375346e62562b9888

Download Submit
C:\Windows\System\RHsMRom.exe

Filesize
1.9MB

MD5
adcb013b2c40828a4e6b4177bd55c010

SHA1
8863f7e60cbd454684821653ee875c82af1e504a

SHA256
dfbbad4090845322f022f0a062a32fb67bbad51539afade34308f4d6c9f5d99b

SHA512
43b0b1bbbfce42d8a0f29d0404fb6e76f9bd0f7a76115ab89a3a78cd4ab4e07de1417315c3f2380fabc170aeae39c080f4afaa6eaef8faaf88ee857c84a4cd30

Download Submit
C:\Windows\System\RnMgFcD.exe

Filesize
1.9MB

MD5
e10cbc51af10c96c89a3ecfb2b2599f5

SHA1
0fc6bcf71a14c18febff73739d00b4cfd138ca55

SHA256
b4449346e1bd65d91d06cd1b7471600483d6e8a9dcceb44f68cc77f2761d078d

SHA512
000e198e34783c7f2a0f2ccce879e244f616e1f95b6fd6c74eedaa9caff7c1af1fe219f6767c8432ef961a37ef48642d59157fb07cb8bbbd3b909b2afa6a58ee

Download Submit
C:\Windows\System\TRYMBue.exe

Filesize
1.9MB

MD5
2e355b570b28d45dfce839e8bfc5f9b0

SHA1
6c9539716e54e033a15f9a76d041f9d61b8133b0

SHA256
339c404ba165aea23f789379c072fc7ed7d23f2b5ef09fd641432d0115b4ad8b

SHA512
3edbc9e22ea107880ce14fade02e6de6c19ae6d74387e0aed529e79088e158cb8f3669947cfce78eafea0f606b599341b763058d246b2ed9e6cf37e8164edd6f

Download Submit
C:\Windows\System\ZOXgkiX.exe

Filesize
1.9MB

MD5
c5fb74f80a0791c8e05de285e0644ebc

SHA1
02144a070284a069cc2ad554654c1085fdd0e6f6

SHA256
c69beee91f523204af35077e6dad87c1d287cdd0fda56bdc6d59e0889adc0b0f

SHA512
42d6647bfaf90ecdf96672f574ee2e40057d20d609f3b72eb863701f4cea2904e98096e072b70c0f069bef736c3b71774e34a9b2f436e2f8ead9f977ff7aef75

Download Submit
C:\Windows\System\chGfItR.exe

Filesize
1.9MB

MD5
e52c165b13c9d5d6a5b465f9ca6b53d3

SHA1
30e221028e6919a7a63c330ef826979df3d36547

SHA256
41025672cc739a9a56917ef32682e728b2d79a2be4ce0b3ca6ab63882aa651d3

SHA512
ee06df506a1038e324ec933af8bc356f7737efe03609e47e1683a52572333dd7f7950b2c3ae6845acd27fc4af9a46c229cbc28a7f5f41529406b40e0cb37dd61

Download Submit
C:\Windows\System\dLArvqR.exe

Filesize
1.9MB

MD5
4b234fc445d6b3721ac06cd106b48195

SHA1
94dcc210c579b52ff83f3d2bf34f05071ceecdf4

SHA256
87a64d4c2f1f15d2a78482917d70a09f2c510a661dd27f4a4e366137c0210a4c

SHA512
3edff95abf29c3c84317cd88bfa6f051f2b1f189d79c7c23128f08755ca0a41c5b060b9db361b898eba62d9fab169d1b2fde584d62f6c7b48343c05ad2f6719b

Download Submit
C:\Windows\System\doJqSZf.exe

Filesize
1.9MB

MD5
2c8cbcb7b12a18d830ca492bdba7d238

SHA1
6b1953a2b6f43a314b990d5859fdd83c1108042d

SHA256
f84fe153976aa6dde567ba72c69a526a8b39a938680ae8fafd50ddaf6bb429be

SHA512
b2627c3aaa86f306596869414d90f7f541737137da23df3139462dbe5a0413c022ba3ee2713ac0954519ba4984781b95e56efcacf8723a6160dbeabd7a6bca0e

Download Submit
C:\Windows\System\eAeQGHk.exe

Filesize
1.9MB

MD5
9d4d8a23f3145ad1013769a5386c5752

SHA1
8105d9b4e99ce6ba0ade4fedcec978b3007e661f

SHA256
8b28035f2695831939dc8c0b9214a7bd04d10c514aff0ac1a43018d1ed4616ea

SHA512
467ecc481db69dc92cbfbc0a229a5153e130abcaa951e07887d84ee041cd5817ff58904044d6ee70336bcf2a4ebe96b6cc67cb96a60b5185697de9cb8d994970

Download Submit
C:\Windows\System\hqLDeTX.exe

Filesize
1.9MB

MD5
af847e81075b1235088bb0f900e75d7b

SHA1
d060fe8eab32c85ea212f9a4ba1e7a44c1236cfe

SHA256
8a7d1afd4251d5d83443596c8feb86b9c440adbe27e0960eb49cc075757f2db3

SHA512
2dbcba2a58fc55f686399720f12f22cbf032bc17fed323c427f908cc2df7c531bf19ad62261df587aa7294467aae248c5f15e49b67032e4b2118c48b22a93d09

Download Submit
C:\Windows\System\jxFarMj.exe

Filesize
1.9MB

MD5
f8e55e6376705c572bead04aee0de320

SHA1
9b4c97d64bae62a3cf02defd1b4671b33acb68db

SHA256
8462252ac56c32c94dcfd3c68dfae9a74e712042d26a07781d74effc36b5f219

SHA512
eb7993de11b1b2900efeb9b5f65a21fd33d1b3bee4eff6ded02e61e223231097029569d993421124926e4570c07dc92a076e2047064afbbce8d38f23b5ec0aa4

Download Submit
C:\Windows\System\kPrgrvI.exe

Filesize
1.9MB

MD5
227b48ba9b54adc57a547afd951d52a8

SHA1
5804905e79672334ab7c86920d1b64fd9f111968

SHA256
e748966c1623e33dd54f102840a86654a23a58340b2fca4ba4de44a574dd3449

SHA512
22bfb1138e6aae4cd0afb8b1ae4cdf9030e32068813b5f8691b789f3ef62f3d776b865b77c6c0d6d7807051dee4aae938982788dcbe74921ee0e0e990739fe30

Download Submit
C:\Windows\System\lORfOyw.exe

Filesize
1.9MB

MD5
4eae907a3884e3d6d8b666ad53fdca52

SHA1
f0ed4cb50fbd8fc07c9da21a1874e0352f201127

SHA256
cf24e19ba8b1a6719e912f774aa3dc43ea06f74d7e2eaa2bf84feff05f0ec1e9

SHA512
3a0cd034e6a272aa5707be3f6795f495d9d9e2a0d6f01d3ea123484d4252abdf40bd235eb7633cf2831798fa2685c98aacbf0297868d9c48c1c405270499cc16

Download Submit
C:\Windows\System\lYOvHqK.exe

Filesize
1.9MB

MD5
b40414792746b04cbfa1f27e7de9acdd

SHA1
23e1c68491793d5ded2e24000cc7c76801235e18

SHA256
a43830dcac08a56c8d431617aa15e0256d027fa567111f72350882ceb2d3a201

SHA512
f67fc1f824faaf4090f451e8edb725d5d8aac7da09829933b59d612a7b418e20b69930cf4f80bf74a674ef89be2411b8d91af01b09a696a3e60f8cbe4d24b65e

Download Submit
C:\Windows\System\lpTTprt.exe

Filesize
1.9MB

MD5
f5976ace24f6bbfdcc152ff2900bb421

SHA1
8637ad450ddccaab2a39270a8e88f28c27bc9117

SHA256
0fb811af6e92400c36dc4fd9b1a5aceb6ed8af9cbc7be7b27e3f1d792c55c58c

SHA512
6a4df9644b06a85cd67ea492a5e85fbf6ba03afd9c1354a68dc62884332636ddefa8a3bcc94cc30c3df752e8cc0aafa36dd8fecd935db6e3c99e0efb977b19ea

Download Submit
C:\Windows\System\okIFGLC.exe

Filesize
1.9MB

MD5
d4bc98eff3101766b21036e01163725c

SHA1
e91a4704ef3f5854c8dd74c0db108f4d7d77adf1

SHA256
fd02068fd1d62af2eae92cc5dc07b3478b7eae161bf1b32454559a32947f88a5

SHA512
331e7457f20afbf12851f91c1b563e140127b1280c0da16ae4b56ae87af1400714d3f3b7e313af503334a9227e07d26bb599989ef15b3e4f316d0b6cafadb730

Download Submit
C:\Windows\System\sGRWQCQ.exe

Filesize
1.9MB

MD5
5b6025c641d18aa3fb564ba53e9cf477

SHA1
83e3fa6704a162a1148132862cd041d783ce9198

SHA256
64951b59f6261388b3431679e0d632a875b8bb7fe09d440af699077f1ab32925

SHA512
416a2f0c2a348d4b1b30503fbce872e86ba5e0523b9029641d2086ebb6412b39ed0cd1a5df1ad38dbfb20cbdc9fbf0b9cf0af5275cc40fb70627e9af483c69d9

Download Submit
C:\Windows\System\sZsofqL.exe

Filesize
1.9MB

MD5
57d6f1ae242908f22dcfcc86139b70d6

SHA1
d598d4d31639fc4495460a93b7b28988aea19c05

SHA256
0dab9155baeb1690fcb908ecc3fb138a412f51033b1ecc2a94b81cd31e89c4c0

SHA512
65ced08cae8ee902759ebf8ce72b9efa93e601746bd8c2ef0d104815a8ef7d6295eb88f84dba48a142dfc981770be1321554836bc84f35d7acd297b945189231

Download Submit
C:\Windows\System\ssfpDtk.exe

Filesize
1.9MB

MD5
2e486dae97e2415e9b98797e088982d1

SHA1
56bae48e719fcd60747e85ace55cfe3f519a9882

SHA256
b1c0f267252a997802a9f5f765aac18ec71999d6877985ed76c4f66b9f06df3b

SHA512
e73de684dd2f4a567d7367ce97a5d75a2e7b6e9d01a2622a9eddae4a049a665632e26c51cb960a6bb55542a0c458728d79d783be0e4e79374737c4d2640b9047

Download Submit
C:\Windows\System\tVqkMEo.exe

Filesize
1.9MB

MD5
f212c53b8eb0e697dc7164855f9bf190

SHA1
2c2e1fc417631893a46b5f0c1da7f112918d0abf

SHA256
d2a42ac22007531fabaa6dd9277c619d0203e310e41de9e2d4b3cafd43bb7b2a

SHA512
620025fd1778ed8c01cf74dc26e7959cda2882adb9d3f18d2337991180040a55544bbad851fab31b070897955866c1542924315ecca92668e879992d4dd29d0c

Download Submit
C:\Windows\System\tndRQJI.exe

Filesize
1.9MB

MD5
5215435b0a5359ee51bf1e67850cb8e6

SHA1
63dc3907c386b388627e8c31969144309a39b4eb

SHA256
54cabb9f63a454a0505b48d5eefbc1e381b614de41d07f0bf7fb17231bda134f

SHA512
a8655e9066464f341c81589c8851b260956e9a6d4debe2c3eeb1fb3cf216ebddd67f7422b41b4a31a9d88c4770fbe163bafbccca43662c30dfc50f400ccf28e2

Download Submit
C:\Windows\System\uNirOKz.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\wKFYuAE.exe

Filesize
1.9MB

MD5
22378a28c165b9107aa68c79b9fef736

SHA1
ca0ba587c0bf7ff7a0c84dcd2364f666914a86fc

SHA256
d02fcedc33aa3fd5c0da51e58c46b7917ce095c34d88cb95ad1091440e4047b0

SHA512
a9a6a35d09ab9e70b089fbbc1dcecc4092c39f6c21cc9cf6b6864af3464c7a93ae4021ccfb1a8d12061ed570bd1a66c25b2d172dbcd0caac346bcb4b1605a2c9

Download Submit
C:\Windows\System\wQBLupF.exe

Filesize
1.9MB

MD5
960b1ea9c23460ed7edfc87d40ebfb13

SHA1
fc629b42c24c8bcd363f0fe73ed5221618d3d713

SHA256
27fd44df075e89af98077ec8bf5fdb836c4f17f0c16883f35beb6011747e7307

SHA512
241a8a735f954ac1289cfcad894461b30ab33cdf3ec6928d12bb3213fc1360aa0e47d6f6e270c74d7d55e6201084a1db8314fdf41be8df8dc1bd37f842386bf0

Download Submit
C:\Windows\System\wRGQxYi.exe

Filesize
1.9MB

MD5
747f552a3faa83170e92629df10e07af

SHA1
4c6f9cdd13e97b09908058066baa7bbfad43a0d2

SHA256
1b4c56fceebfad1771e64308e0ee0022d9348b06b3ce659cefa9c1edeb5bd4b7

SHA512
b3d934465538a7657b8e2c243070752dbccb3fd560ad18266e56b587d988994fb60140c97e824f913ea1f18b814c6ef8a3b2bfa3dd2423a4b00bdc17211f6ddc

Download Submit
C:\Windows\System\wexFqeq.exe

Filesize
1.9MB

MD5
03ac79798d83c39dfc8e7c810e1d8ec9

SHA1
2d0a1ce923184aac66fc58c2c8f274758af0e8a6

SHA256
0c4aa220b1ecad238176660da17ba953be75a62cb52d9209ad8a0e74ee8e90c5

SHA512
aa63ebb3a07429b529be0e7a363bac45c7d6abb21a1823cf55b58378b4883d9a5d71cff98fe0c8c7a5bd663264549c41ae652bf05a46649033561982f7649369

Download Submit
C:\Windows\System\xJOVGOZ.exe

Filesize
1.9MB

MD5
5df12938478b6cabe09c999f43cd0382

SHA1
2e7f0bd5b1529eb90e024cb3891cb97d311312f3

SHA256
05e4cce5598ba918de17d84a73fe43162259c4dc8ea9f3d555cebb3e2a7f180a

SHA512
d7868ec68679142b8d17bce0e760d00e2be080d1dfec6ece62dc3a2b9c9cba6afe2d57bd356db57355d09f0d21b64dafa59b016541590417d6b8dae8bb8b8101

Download Submit
C:\Windows\System\xcZqUMY.exe

Filesize
1.9MB

MD5
95fd98f5f32314e70ab737f784accd43

SHA1
038a18273b7ff5b6bf777e598280f5414750025c

SHA256
11cca8325cd939e3754c0b8e5654a370e2a776e4e34695e7c08cb9a261ffc4c3

SHA512
e8cc5772cad47b5fc3b2c60882e517bfcc4ab4d84387cf77f8fb735550cb50337468c90b00f59b81adaaa8b9b35839ed3a911157f6924c8fb3d99b45ae3020b1

Download Submit
C:\Windows\System\yhyixWM.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
memory/440-108-0x00007FF73E3D0000-0x00007FF73E7C2000-memory.dmp

Filesize
3.9MB

Download
memory/448-133-0x00007FF6F3140000-0x00007FF6F3532000-memory.dmp

Filesize
3.9MB

Download
memory/448-3756-0x00007FF6F3140000-0x00007FF6F3532000-memory.dmp

Filesize
3.9MB

Download
memory/512-50-0x00007FF721590000-0x00007FF721982000-memory.dmp

Filesize
3.9MB

Download
memory/512-1971-0x00007FF721590000-0x00007FF721982000-memory.dmp

Filesize
3.9MB

Download
memory/636-146-0x00007FF667A00000-0x00007FF667DF2000-memory.dmp

Filesize
3.9MB

Download
memory/688-1566-0x00007FFF27C80000-0x00007FFF28741000-memory.dmp

Filesize
10.8MB

Download
memory/688-38-0x00000243E99D0000-0x00000243E99E0000-memory.dmp

Filesize
64KB

Download
memory/688-54-0x00000243E99D0000-0x00000243E99E0000-memory.dmp

Filesize
64KB

Download
memory/688-1396-0x00007FFF27C80000-0x00007FFF28741000-memory.dmp

Filesize
10.8MB

Download
memory/688-45-0x00000243E9F00000-0x00000243E9F22000-memory.dmp

Filesize
136KB

Download
memory/688-34-0x00007FFF27C80000-0x00007FFF28741000-memory.dmp

Filesize
10.8MB

Download
memory/1328-83-0x00007FF6A3BB0000-0x00007FF6A3FA2000-memory.dmp

Filesize
3.9MB

Download
memory/1328-3001-0x00007FF6A3BB0000-0x00007FF6A3FA2000-memory.dmp

Filesize
3.9MB

Download
memory/1464-14-0x00007FF671520000-0x00007FF671912000-memory.dmp

Filesize
3.9MB

Download
memory/1676-53-0x00007FF696090000-0x00007FF696482000-memory.dmp

Filesize
3.9MB

Download
memory/1764-1384-0x00007FF6E4A80000-0x00007FF6E4E72000-memory.dmp

Filesize
3.9MB

Download
memory/1764-1-0x000001EA92BD0000-0x000001EA92BE0000-memory.dmp

Filesize
64KB

Download
memory/1764-0-0x00007FF6E4A80000-0x00007FF6E4E72000-memory.dmp

Filesize
3.9MB

Download
memory/2028-97-0x00007FF6E6190000-0x00007FF6E6582000-memory.dmp

Filesize
3.9MB

Download
memory/2552-155-0x00007FF6695D0000-0x00007FF6699C2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-5384-0x00007FF6695D0000-0x00007FF6699C2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-1970-0x00007FF79C6D0000-0x00007FF79CAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-42-0x00007FF79C6D0000-0x00007FF79CAC2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-67-0x00007FF68D4A0000-0x00007FF68D892000-memory.dmp

Filesize
3.9MB

Download
memory/3076-2258-0x00007FF68D4A0000-0x00007FF68D892000-memory.dmp

Filesize
3.9MB

Download
memory/3304-1974-0x00007FF70A860000-0x00007FF70AC52000-memory.dmp

Filesize
3.9MB

Download
memory/3304-60-0x00007FF70A860000-0x00007FF70AC52000-memory.dmp

Filesize
3.9MB

Download
memory/3768-4111-0x00007FF76BB70000-0x00007FF76BF62000-memory.dmp

Filesize
3.9MB

Download
memory/3768-165-0x00007FF76BB70000-0x00007FF76BF62000-memory.dmp

Filesize
3.9MB

Download
memory/3996-124-0x00007FF7EC280000-0x00007FF7EC672000-memory.dmp

Filesize
3.9MB

Download
memory/3996-3754-0x00007FF7EC280000-0x00007FF7EC672000-memory.dmp

Filesize
3.9MB

Download
memory/4348-69-0x00007FF68EE60000-0x00007FF68F252000-memory.dmp

Filesize
3.9MB

Download
memory/4356-68-0x00007FF6637C0000-0x00007FF663BB2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-172-0x00007FF6A57F0000-0x00007FF6A5BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-175-0x00007FF7A0370000-0x00007FF7A0762000-memory.dmp

Filesize
3.9MB

Download
memory/4712-5371-0x00007FF7A0370000-0x00007FF7A0762000-memory.dmp

Filesize
3.9MB

Download
memory/4892-19-0x00007FF751420000-0x00007FF751812000-memory.dmp

Filesize
3.9MB

Download
memory/4892-796-0x00007FF751420000-0x00007FF751812000-memory.dmp

Filesize
3.9MB

Download
memory/4960-49-0x00007FF6650E0000-0x00007FF6654D2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-178-0x00007FF6C2460000-0x00007FF6C2852000-memory.dmp

Filesize
3.9MB

Download