xmrig | 679bb31e004b5a0ab73e7143d3b011c3f739cde38815daf69299b31e1f65cb1b

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
Size

2.8MB
MD5

0beb6d1d884c9a459cb6b04bf2dcc19e
SHA1

5d9d221491586a351a249988644272b7b410709d
SHA256

679bb31e004b5a0ab73e7143d3b011c3f739cde38815daf69299b31e1f65cb1b
SHA512

6d05eb348328f27e4cb3d347177f46d59b43dfbfa5435040354dee3057aee34d91662aa27b84f8764b288c649f7877edb479bdda96e707c65fdea9621c0337fd
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5I/jaM:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/2060-121-0x00007FF6CB5F0000-0x00007FF6CB9E2000-memory.dmp	xmrig
behavioral2/memory/1612-202-0x00007FF6DC540000-0x00007FF6DC932000-memory.dmp	xmrig
behavioral2/memory/3048-221-0x00007FF6CC0F0000-0x00007FF6CC4E2000-memory.dmp	xmrig
behavioral2/memory/3884-233-0x00007FF762BA0000-0x00007FF762F92000-memory.dmp	xmrig
behavioral2/memory/3892-235-0x00007FF7E5080000-0x00007FF7E5472000-memory.dmp	xmrig
behavioral2/memory/1220-234-0x00007FF7E4A40000-0x00007FF7E4E32000-memory.dmp	xmrig
behavioral2/memory/4120-232-0x00007FF64E0D0000-0x00007FF64E4C2000-memory.dmp	xmrig
behavioral2/memory/748-231-0x00007FF6B1860000-0x00007FF6B1C52000-memory.dmp	xmrig
behavioral2/memory/2172-222-0x00007FF60C830000-0x00007FF60CC22000-memory.dmp	xmrig
behavioral2/memory/2220-217-0x00007FF782EA0000-0x00007FF783292000-memory.dmp	xmrig
behavioral2/memory/4288-183-0x00007FF770230000-0x00007FF770622000-memory.dmp	xmrig
behavioral2/memory/4388-172-0x00007FF63ECC0000-0x00007FF63F0B2000-memory.dmp	xmrig
behavioral2/memory/2716-157-0x00007FF7D7790000-0x00007FF7D7B82000-memory.dmp	xmrig
behavioral2/memory/4848-122-0x00007FF6AC130000-0x00007FF6AC522000-memory.dmp	xmrig
behavioral2/memory/3412-112-0x00007FF748670000-0x00007FF748A62000-memory.dmp	xmrig
behavioral2/memory/4380-3637-0x00007FF736470000-0x00007FF736862000-memory.dmp	xmrig
behavioral2/memory/224-3642-0x00007FF65C7E0000-0x00007FF65CBD2000-memory.dmp	xmrig
behavioral2/memory/3884-3658-0x00007FF762BA0000-0x00007FF762F92000-memory.dmp	xmrig
behavioral2/memory/2060-3670-0x00007FF6CB5F0000-0x00007FF6CB9E2000-memory.dmp	xmrig
behavioral2/memory/2716-3679-0x00007FF7D7790000-0x00007FF7D7B82000-memory.dmp	xmrig
behavioral2/memory/4848-3683-0x00007FF6AC130000-0x00007FF6AC522000-memory.dmp	xmrig
behavioral2/memory/1220-3688-0x00007FF7E4A40000-0x00007FF7E4E32000-memory.dmp	xmrig
behavioral2/memory/2172-3710-0x00007FF60C830000-0x00007FF60CC22000-memory.dmp	xmrig
behavioral2/memory/3048-3717-0x00007FF6CC0F0000-0x00007FF6CC4E2000-memory.dmp	xmrig
behavioral2/memory/2220-3713-0x00007FF782EA0000-0x00007FF783292000-memory.dmp	xmrig
behavioral2/memory/3892-3695-0x00007FF7E5080000-0x00007FF7E5472000-memory.dmp	xmrig
behavioral2/memory/4388-3690-0x00007FF63ECC0000-0x00007FF63F0B2000-memory.dmp	xmrig
behavioral2/memory/3412-3673-0x00007FF748670000-0x00007FF748A62000-memory.dmp	xmrig
behavioral2/memory/1612-3668-0x00007FF6DC540000-0x00007FF6DC932000-memory.dmp	xmrig
behavioral2/memory/2788-3663-0x00007FF68CA70000-0x00007FF68CE62000-memory.dmp	xmrig
behavioral2/memory/4288-3662-0x00007FF770230000-0x00007FF770622000-memory.dmp	xmrig
behavioral2/memory/748-3650-0x00007FF6B1860000-0x00007FF6B1C52000-memory.dmp	xmrig
behavioral2/memory/4120-3654-0x00007FF64E0D0000-0x00007FF64E4C2000-memory.dmp	xmrig
behavioral2/memory/1848-3918-0x00007FF7FC830000-0x00007FF7FCC22000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2704	IhSyEGG.exe
4068	zwIeoKS.exe
2684	VuuOYHD.exe
4380	WXooBKq.exe
224	MGslZGQ.exe
748	DnZFTys.exe
2788	eOMGAFC.exe
3412	LGuWueb.exe
4120	YzBlXHK.exe
3884	PcwkuMI.exe
2060	AKKbBGA.exe
4848	FFqfbrp.exe
2716	VfgTtQW.exe
1220	UuJKfHB.exe
4388	HTaIsDe.exe
4288	oSsydqe.exe
1612	ZZOMOcy.exe
3892	wSCtMHi.exe
2220	AlqOvBw.exe
3048	cFaEIkt.exe
2172	iLmTbiI.exe
2372	MwzbDSL.exe
4132	NhNTXFx.exe
784	tIelSmG.exe
1788	QpxlOZx.exe
2428	XgxgaBh.exe
3648	AqhXFof.exe
4616	AOUogwv.exe
1776	rlGZaAo.exe
2644	ttcWOgZ.exe
3724	acPHZuN.exe
3552	gjSCxHl.exe
4888	yUzYBFN.exe
4420	gVFTfLI.exe
2068	OQlRFCb.exe
3944	kuVSJqn.exe
1924	uuVRWAh.exe
3896	TCXyuwu.exe
4048	TZgqcbN.exe
2012	blDGVfe.exe
4916	oomwCcJ.exe
2876	XKylNNi.exe
3672	rqCJfmq.exe
4560	lUVErLN.exe
464	QyhGLNH.exe
2344	XFCndeU.exe
4524	kRQSgNj.exe
2040	WzGijID.exe
548	rGtpHbP.exe
4976	BPhXOcM.exe
708	CRhcpxj.exe
3656	XnaTIzF.exe
2056	NAiJtWC.exe
4248	mMTXVoB.exe
3968	uXZkbXy.exe
2888	RjmkJCV.exe
4236	LMGTMLe.exe
2280	gXHpxdl.exe
1980	EYgMaON.exe
60	epZIQhI.exe
400	XbEcyAh.exe
972	vrcWDFW.exe
2312	sIKYdoG.exe
2264	aphyIwe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1848-0-0x00007FF7FC830000-0x00007FF7FCC22000-memory.dmp	upx
behavioral2/files/0x000b000000023bac-5.dat	upx
behavioral2/memory/2684-28-0x00007FF75CAD0000-0x00007FF75CEC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb6-40.dat	upx
behavioral2/files/0x000a000000023bb4-59.dat	upx
behavioral2/files/0x000a000000023bbf-87.dat	upx
behavioral2/files/0x000a000000023bc6-111.dat	upx
behavioral2/memory/2060-121-0x00007FF6CB5F0000-0x00007FF6CB9E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-185.dat	upx
behavioral2/memory/1612-202-0x00007FF6DC540000-0x00007FF6DC932000-memory.dmp	upx
behavioral2/memory/3048-221-0x00007FF6CC0F0000-0x00007FF6CC4E2000-memory.dmp	upx
behavioral2/memory/3884-233-0x00007FF762BA0000-0x00007FF762F92000-memory.dmp	upx
behavioral2/memory/3892-235-0x00007FF7E5080000-0x00007FF7E5472000-memory.dmp	upx
behavioral2/memory/1220-234-0x00007FF7E4A40000-0x00007FF7E4E32000-memory.dmp	upx
behavioral2/memory/4120-232-0x00007FF64E0D0000-0x00007FF64E4C2000-memory.dmp	upx
behavioral2/memory/748-231-0x00007FF6B1860000-0x00007FF6B1C52000-memory.dmp	upx
behavioral2/memory/2172-222-0x00007FF60C830000-0x00007FF60CC22000-memory.dmp	upx
behavioral2/memory/2220-217-0x00007FF782EA0000-0x00007FF783292000-memory.dmp	upx
behavioral2/files/0x000a000000023bc8-176.dat	upx
behavioral2/files/0x000a000000023bc7-174.dat	upx
behavioral2/memory/4288-183-0x00007FF770230000-0x00007FF770622000-memory.dmp	upx
behavioral2/memory/4388-172-0x00007FF63ECC0000-0x00007FF63F0B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd0-171.dat	upx
behavioral2/files/0x000a000000023bcf-170.dat	upx
behavioral2/files/0x000a000000023bce-169.dat	upx
behavioral2/files/0x000a000000023bcd-168.dat	upx
behavioral2/files/0x000a000000023bcc-167.dat	upx
behavioral2/files/0x000a000000023bcb-165.dat	upx
behavioral2/files/0x000a000000023bc4-162.dat	upx
behavioral2/files/0x000b000000023bad-161.dat	upx
behavioral2/memory/2716-157-0x00007FF7D7790000-0x00007FF7D7B82000-memory.dmp	upx
behavioral2/files/0x000a000000023bd1-173.dat	upx
behavioral2/files/0x000a000000023bc0-144.dat	upx
behavioral2/files/0x000a000000023bc5-140.dat	upx
behavioral2/files/0x000a000000023bc9-137.dat	upx
behavioral2/files/0x000a000000023bc3-136.dat	upx
behavioral2/files/0x000a000000023bc2-135.dat	upx
behavioral2/files/0x000a000000023bc1-130.dat	upx
behavioral2/files/0x0031000000023bbd-125.dat	upx
behavioral2/memory/4848-122-0x00007FF6AC130000-0x00007FF6AC522000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-113.dat	upx
behavioral2/memory/3412-112-0x00007FF748670000-0x00007FF748A62000-memory.dmp	upx
behavioral2/files/0x0031000000023bbc-106.dat	upx
behavioral2/files/0x000a000000023bbb-115.dat	upx
behavioral2/memory/2788-99-0x00007FF68CA70000-0x00007FF68CE62000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-94.dat	upx
behavioral2/files/0x000a000000023bb5-81.dat	upx
behavioral2/files/0x0031000000023bbe-79.dat	upx
behavioral2/files/0x000a000000023bb9-75.dat	upx
behavioral2/files/0x000a000000023bb7-61.dat	upx
behavioral2/files/0x000a000000023bb3-53.dat	upx
behavioral2/memory/224-69-0x00007FF65C7E0000-0x00007FF65CBD2000-memory.dmp	upx
behavioral2/memory/4380-48-0x00007FF736470000-0x00007FF736862000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-44.dat	upx
behavioral2/files/0x000a000000023bb2-51.dat	upx
behavioral2/memory/4068-24-0x00007FF6C9760000-0x00007FF6C9B52000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-32.dat	upx
behavioral2/memory/2704-11-0x00007FF765080000-0x00007FF765472000-memory.dmp	upx
behavioral2/memory/4380-3637-0x00007FF736470000-0x00007FF736862000-memory.dmp	upx
behavioral2/memory/224-3642-0x00007FF65C7E0000-0x00007FF65CBD2000-memory.dmp	upx
behavioral2/memory/3884-3658-0x00007FF762BA0000-0x00007FF762F92000-memory.dmp	upx
behavioral2/memory/2060-3670-0x00007FF6CB5F0000-0x00007FF6CB9E2000-memory.dmp	upx
behavioral2/memory/2716-3679-0x00007FF7D7790000-0x00007FF7D7B82000-memory.dmp	upx
behavioral2/memory/4848-3683-0x00007FF6AC130000-0x00007FF6AC522000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FSyhceJ.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\RKmmqTY.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\JZJAdpM.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\qBzbrdR.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\bYxHGGW.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\hspUBCC.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\fPClDux.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\wDBhARw.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\DUKKEhC.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\IdCDctA.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\VtbDdUw.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\pxofcDK.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\lcOyONh.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\QlhrAfT.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\pSBbxIs.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\XZUEVpg.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\CRBknEE.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\pQGxpgB.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\cGlQLYa.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\XaxzgKY.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\WBpXDLX.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\LyxOuVX.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\uVqrreT.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\HFNGuZL.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\FnzjDiG.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\iKAqFWr.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\yvnmfZf.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\yiTzQvG.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\OWRDbbk.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\NKXJKxx.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\SlkGpTS.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\ePwXqyD.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\uHZEilX.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\swKxqZV.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\GdTgZEk.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\fXERAZB.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\bGDmqsW.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\jGaLPIN.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\nbaBoLw.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\juaQJbS.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\BKYoGqD.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\QEyLenO.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\lJzhpZt.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\NPokEHD.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\IizNkgr.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\vsCLPsK.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\uOrmOKQ.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\azDrMOp.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\nalqMGG.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\SgZtSQz.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\LnBOUav.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\fZFIFDe.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\BXcYaKH.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\RmnlTZF.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\btzfdvx.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\WKIeoeC.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\jZqqSef.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\reVYzvL.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\WrjUGLE.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\WpVlRHd.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\lPwnVoa.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\wzQOTOq.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\OdQrSst.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\InKNqoy.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3100	powershell.exe
3100	powershell.exe
3100	powershell.exe
3100	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeLockMemoryPrivilege	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3100	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	84
PID 1848 wrote to memory of 3100	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	84
PID 1848 wrote to memory of 2704	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	85
PID 1848 wrote to memory of 2704	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	85
PID 1848 wrote to memory of 4068	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	86
PID 1848 wrote to memory of 4068	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	86
PID 1848 wrote to memory of 2684	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	87
PID 1848 wrote to memory of 2684	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	87
PID 1848 wrote to memory of 4380	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	88
PID 1848 wrote to memory of 4380	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	88
PID 1848 wrote to memory of 224	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	89
PID 1848 wrote to memory of 224	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	89
PID 1848 wrote to memory of 748	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	90
PID 1848 wrote to memory of 748	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	90
PID 1848 wrote to memory of 2788	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	91
PID 1848 wrote to memory of 2788	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	91
PID 1848 wrote to memory of 3412	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	92
PID 1848 wrote to memory of 3412	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	92
PID 1848 wrote to memory of 4120	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	93
PID 1848 wrote to memory of 4120	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	93
PID 1848 wrote to memory of 1220	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	94
PID 1848 wrote to memory of 1220	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	94
PID 1848 wrote to memory of 3884	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	95
PID 1848 wrote to memory of 3884	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	95
PID 1848 wrote to memory of 2060	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	96
PID 1848 wrote to memory of 2060	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	96
PID 1848 wrote to memory of 4848	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	97
PID 1848 wrote to memory of 4848	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	97
PID 1848 wrote to memory of 2716	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	98
PID 1848 wrote to memory of 2716	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	98
PID 1848 wrote to memory of 4388	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	99
PID 1848 wrote to memory of 4388	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	99
PID 1848 wrote to memory of 4288	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	100
PID 1848 wrote to memory of 4288	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	100
PID 1848 wrote to memory of 1612	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	101
PID 1848 wrote to memory of 1612	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	101
PID 1848 wrote to memory of 4132	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	102
PID 1848 wrote to memory of 4132	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	102
PID 1848 wrote to memory of 3892	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	103
PID 1848 wrote to memory of 3892	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	103
PID 1848 wrote to memory of 2220	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	104
PID 1848 wrote to memory of 2220	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	104
PID 1848 wrote to memory of 3048	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	105
PID 1848 wrote to memory of 3048	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	105
PID 1848 wrote to memory of 2172	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	106
PID 1848 wrote to memory of 2172	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	106
PID 1848 wrote to memory of 2372	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	107
PID 1848 wrote to memory of 2372	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	107
PID 1848 wrote to memory of 784	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	108
PID 1848 wrote to memory of 784	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	108
PID 1848 wrote to memory of 1788	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	109
PID 1848 wrote to memory of 1788	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	109
PID 1848 wrote to memory of 2428	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	110
PID 1848 wrote to memory of 2428	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	110
PID 1848 wrote to memory of 3648	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	111
PID 1848 wrote to memory of 3648	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	111
PID 1848 wrote to memory of 4616	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	112
PID 1848 wrote to memory of 4616	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	112
PID 1848 wrote to memory of 1776	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	113
PID 1848 wrote to memory of 1776	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	113
PID 1848 wrote to memory of 2644	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	114
PID 1848 wrote to memory of 2644	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	114
PID 1848 wrote to memory of 3724	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	115
PID 1848 wrote to memory of 3724	1848	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3100
- C:\Windows\System\IhSyEGG.exe
  C:\Windows\System\IhSyEGG.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\zwIeoKS.exe
  C:\Windows\System\zwIeoKS.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\VuuOYHD.exe
  C:\Windows\System\VuuOYHD.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\WXooBKq.exe
  C:\Windows\System\WXooBKq.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\MGslZGQ.exe
  C:\Windows\System\MGslZGQ.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\DnZFTys.exe
  C:\Windows\System\DnZFTys.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\eOMGAFC.exe
  C:\Windows\System\eOMGAFC.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\LGuWueb.exe
  C:\Windows\System\LGuWueb.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\YzBlXHK.exe
  C:\Windows\System\YzBlXHK.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\UuJKfHB.exe
  C:\Windows\System\UuJKfHB.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\PcwkuMI.exe
  C:\Windows\System\PcwkuMI.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\AKKbBGA.exe
  C:\Windows\System\AKKbBGA.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\FFqfbrp.exe
  C:\Windows\System\FFqfbrp.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\VfgTtQW.exe
  C:\Windows\System\VfgTtQW.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\HTaIsDe.exe
  C:\Windows\System\HTaIsDe.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\oSsydqe.exe
  C:\Windows\System\oSsydqe.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\ZZOMOcy.exe
  C:\Windows\System\ZZOMOcy.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\NhNTXFx.exe
  C:\Windows\System\NhNTXFx.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\wSCtMHi.exe
  C:\Windows\System\wSCtMHi.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\AlqOvBw.exe
  C:\Windows\System\AlqOvBw.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\cFaEIkt.exe
  C:\Windows\System\cFaEIkt.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\iLmTbiI.exe
  C:\Windows\System\iLmTbiI.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\MwzbDSL.exe
  C:\Windows\System\MwzbDSL.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\tIelSmG.exe
  C:\Windows\System\tIelSmG.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\QpxlOZx.exe
  C:\Windows\System\QpxlOZx.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\XgxgaBh.exe
  C:\Windows\System\XgxgaBh.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\AqhXFof.exe
  C:\Windows\System\AqhXFof.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\AOUogwv.exe
  C:\Windows\System\AOUogwv.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\rlGZaAo.exe
  C:\Windows\System\rlGZaAo.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\ttcWOgZ.exe
  C:\Windows\System\ttcWOgZ.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\acPHZuN.exe
  C:\Windows\System\acPHZuN.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\gjSCxHl.exe
  C:\Windows\System\gjSCxHl.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\yUzYBFN.exe
  C:\Windows\System\yUzYBFN.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\gVFTfLI.exe
  C:\Windows\System\gVFTfLI.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\OQlRFCb.exe
  C:\Windows\System\OQlRFCb.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\kuVSJqn.exe
  C:\Windows\System\kuVSJqn.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\uuVRWAh.exe
  C:\Windows\System\uuVRWAh.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\TCXyuwu.exe
  C:\Windows\System\TCXyuwu.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\TZgqcbN.exe
  C:\Windows\System\TZgqcbN.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\blDGVfe.exe
  C:\Windows\System\blDGVfe.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\oomwCcJ.exe
  C:\Windows\System\oomwCcJ.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\XKylNNi.exe
  C:\Windows\System\XKylNNi.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\rqCJfmq.exe
  C:\Windows\System\rqCJfmq.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\lUVErLN.exe
  C:\Windows\System\lUVErLN.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\QyhGLNH.exe
  C:\Windows\System\QyhGLNH.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\XFCndeU.exe
  C:\Windows\System\XFCndeU.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\kRQSgNj.exe
  C:\Windows\System\kRQSgNj.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\WzGijID.exe
  C:\Windows\System\WzGijID.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\rGtpHbP.exe
  C:\Windows\System\rGtpHbP.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\BPhXOcM.exe
  C:\Windows\System\BPhXOcM.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\CRhcpxj.exe
  C:\Windows\System\CRhcpxj.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\XnaTIzF.exe
  C:\Windows\System\XnaTIzF.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\NAiJtWC.exe
  C:\Windows\System\NAiJtWC.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\mMTXVoB.exe
  C:\Windows\System\mMTXVoB.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\uXZkbXy.exe
  C:\Windows\System\uXZkbXy.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\RjmkJCV.exe
  C:\Windows\System\RjmkJCV.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\LMGTMLe.exe
  C:\Windows\System\LMGTMLe.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\EYgMaON.exe
  C:\Windows\System\EYgMaON.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\epZIQhI.exe
  C:\Windows\System\epZIQhI.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\gXHpxdl.exe
  C:\Windows\System\gXHpxdl.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\XbEcyAh.exe
  C:\Windows\System\XbEcyAh.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\vrcWDFW.exe
  C:\Windows\System\vrcWDFW.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\sIKYdoG.exe
  C:\Windows\System\sIKYdoG.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\aphyIwe.exe
  C:\Windows\System\aphyIwe.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\hIhBoJC.exe
  C:\Windows\System\hIhBoJC.exe
  2⤵
  PID:5024
- C:\Windows\System\FAhqCFw.exe
  C:\Windows\System\FAhqCFw.exe
  2⤵
  PID:4244
- C:\Windows\System\IQjvNrh.exe
  C:\Windows\System\IQjvNrh.exe
  2⤵
  PID:2512
- C:\Windows\System\QmWVeoY.exe
  C:\Windows\System\QmWVeoY.exe
  2⤵
  PID:2508
- C:\Windows\System\gXRYeTi.exe
  C:\Windows\System\gXRYeTi.exe
  2⤵
  PID:4968
- C:\Windows\System\ROzaeno.exe
  C:\Windows\System\ROzaeno.exe
  2⤵
  PID:1268
- C:\Windows\System\pUfSLJS.exe
  C:\Windows\System\pUfSLJS.exe
  2⤵
  PID:8
- C:\Windows\System\VbBnDEA.exe
  C:\Windows\System\VbBnDEA.exe
  2⤵
  PID:1700
- C:\Windows\System\fDcSvwM.exe
  C:\Windows\System\fDcSvwM.exe
  2⤵
  PID:4904
- C:\Windows\System\bkwlpDS.exe
  C:\Windows\System\bkwlpDS.exe
  2⤵
  PID:2024
- C:\Windows\System\PhaZTOQ.exe
  C:\Windows\System\PhaZTOQ.exe
  2⤵
  PID:4080
- C:\Windows\System\brUAKwn.exe
  C:\Windows\System\brUAKwn.exe
  2⤵
  PID:2180
- C:\Windows\System\BcgJLhJ.exe
  C:\Windows\System\BcgJLhJ.exe
  2⤵
  PID:3612
- C:\Windows\System\sRpVvqi.exe
  C:\Windows\System\sRpVvqi.exe
  2⤵
  PID:3392
- C:\Windows\System\SnMwaPq.exe
  C:\Windows\System\SnMwaPq.exe
  2⤵
  PID:4704
- C:\Windows\System\zqTJMAT.exe
  C:\Windows\System\zqTJMAT.exe
  2⤵
  PID:440
- C:\Windows\System\ZCqPDhK.exe
  C:\Windows\System\ZCqPDhK.exe
  2⤵
  PID:5084
- C:\Windows\System\NjGAhDq.exe
  C:\Windows\System\NjGAhDq.exe
  2⤵
  PID:3080
- C:\Windows\System\CsxkTYQ.exe
  C:\Windows\System\CsxkTYQ.exe
  2⤵
  PID:3644
- C:\Windows\System\HlApIkf.exe
  C:\Windows\System\HlApIkf.exe
  2⤵
  PID:2972
- C:\Windows\System\pMaeqXZ.exe
  C:\Windows\System\pMaeqXZ.exe
  2⤵
  PID:656
- C:\Windows\System\PMiTbOo.exe
  C:\Windows\System\PMiTbOo.exe
  2⤵
  PID:4240
- C:\Windows\System\cwhktWI.exe
  C:\Windows\System\cwhktWI.exe
  2⤵
  PID:4800
- C:\Windows\System\dghiHEp.exe
  C:\Windows\System\dghiHEp.exe
  2⤵
  PID:1688
- C:\Windows\System\DneDtGp.exe
  C:\Windows\System\DneDtGp.exe
  2⤵
  PID:1852
- C:\Windows\System\NhKRVBu.exe
  C:\Windows\System\NhKRVBu.exe
  2⤵
  PID:2356
- C:\Windows\System\uXkBLFL.exe
  C:\Windows\System\uXkBLFL.exe
  2⤵
  PID:2420
- C:\Windows\System\HykZkFL.exe
  C:\Windows\System\HykZkFL.exe
  2⤵
  PID:2700
- C:\Windows\System\VwPczse.exe
  C:\Windows\System\VwPczse.exe
  2⤵
  PID:4196
- C:\Windows\System\XmgYAeO.exe
  C:\Windows\System\XmgYAeO.exe
  2⤵
  PID:556
- C:\Windows\System\YVWDxll.exe
  C:\Windows\System\YVWDxll.exe
  2⤵
  PID:4280
- C:\Windows\System\EMrUanI.exe
  C:\Windows\System\EMrUanI.exe
  2⤵
  PID:1812
- C:\Windows\System\vebADjf.exe
  C:\Windows\System\vebADjf.exe
  2⤵
  PID:552
- C:\Windows\System\QoBBIWp.exe
  C:\Windows\System\QoBBIWp.exe
  2⤵
  PID:3224
- C:\Windows\System\bNDAwGo.exe
  C:\Windows\System\bNDAwGo.exe
  2⤵
  PID:3828
- C:\Windows\System\zgjHccj.exe
  C:\Windows\System\zgjHccj.exe
  2⤵
  PID:3888
- C:\Windows\System\SYqFtXM.exe
  C:\Windows\System\SYqFtXM.exe
  2⤵
  PID:4748
- C:\Windows\System\qDGvDAk.exe
  C:\Windows\System\qDGvDAk.exe
  2⤵
  PID:2668
- C:\Windows\System\AnyhPEK.exe
  C:\Windows\System\AnyhPEK.exe
  2⤵
  PID:5140
- C:\Windows\System\euklpli.exe
  C:\Windows\System\euklpli.exe
  2⤵
  PID:5164
- C:\Windows\System\BbUIuKD.exe
  C:\Windows\System\BbUIuKD.exe
  2⤵
  PID:5188
- C:\Windows\System\FMeQIvN.exe
  C:\Windows\System\FMeQIvN.exe
  2⤵
  PID:5216
- C:\Windows\System\mYwfIWo.exe
  C:\Windows\System\mYwfIWo.exe
  2⤵
  PID:5244
- C:\Windows\System\itOQwCU.exe
  C:\Windows\System\itOQwCU.exe
  2⤵
  PID:5264
- C:\Windows\System\pFpDyXS.exe
  C:\Windows\System\pFpDyXS.exe
  2⤵
  PID:5288
- C:\Windows\System\AjinHRR.exe
  C:\Windows\System\AjinHRR.exe
  2⤵
  PID:5308
- C:\Windows\System\bDnrHBK.exe
  C:\Windows\System\bDnrHBK.exe
  2⤵
  PID:5348
- C:\Windows\System\pHwFeoJ.exe
  C:\Windows\System\pHwFeoJ.exe
  2⤵
  PID:5376
- C:\Windows\System\gmKgCvS.exe
  C:\Windows\System\gmKgCvS.exe
  2⤵
  PID:5396
- C:\Windows\System\fUBdDaL.exe
  C:\Windows\System\fUBdDaL.exe
  2⤵
  PID:5416
- C:\Windows\System\qzydnel.exe
  C:\Windows\System\qzydnel.exe
  2⤵
  PID:5440
- C:\Windows\System\vhgGiZz.exe
  C:\Windows\System\vhgGiZz.exe
  2⤵
  PID:5468
- C:\Windows\System\SIusjrn.exe
  C:\Windows\System\SIusjrn.exe
  2⤵
  PID:5492
- C:\Windows\System\MYrXjfj.exe
  C:\Windows\System\MYrXjfj.exe
  2⤵
  PID:5520
- C:\Windows\System\wouEBYj.exe
  C:\Windows\System\wouEBYj.exe
  2⤵
  PID:5540
- C:\Windows\System\dzrfdsb.exe
  C:\Windows\System\dzrfdsb.exe
  2⤵
  PID:5564
- C:\Windows\System\IWycbVJ.exe
  C:\Windows\System\IWycbVJ.exe
  2⤵
  PID:5592
- C:\Windows\System\RuFXWIf.exe
  C:\Windows\System\RuFXWIf.exe
  2⤵
  PID:5620
- C:\Windows\System\zTfaOFl.exe
  C:\Windows\System\zTfaOFl.exe
  2⤵
  PID:5640
- C:\Windows\System\hTOldTV.exe
  C:\Windows\System\hTOldTV.exe
  2⤵
  PID:5664
- C:\Windows\System\SwLQxdz.exe
  C:\Windows\System\SwLQxdz.exe
  2⤵
  PID:5692
- C:\Windows\System\NhHLoos.exe
  C:\Windows\System\NhHLoos.exe
  2⤵
  PID:5720
- C:\Windows\System\uQvdWiQ.exe
  C:\Windows\System\uQvdWiQ.exe
  2⤵
  PID:5748
- C:\Windows\System\GbnEXPq.exe
  C:\Windows\System\GbnEXPq.exe
  2⤵
  PID:5776
- C:\Windows\System\sMNCDKf.exe
  C:\Windows\System\sMNCDKf.exe
  2⤵
  PID:5796
- C:\Windows\System\KSHixpI.exe
  C:\Windows\System\KSHixpI.exe
  2⤵
  PID:5824
- C:\Windows\System\zMvIDjl.exe
  C:\Windows\System\zMvIDjl.exe
  2⤵
  PID:5844
- C:\Windows\System\wCNYWRu.exe
  C:\Windows\System\wCNYWRu.exe
  2⤵
  PID:5868
- C:\Windows\System\ojCXuEf.exe
  C:\Windows\System\ojCXuEf.exe
  2⤵
  PID:5892
- C:\Windows\System\FOqAkrg.exe
  C:\Windows\System\FOqAkrg.exe
  2⤵
  PID:5916
- C:\Windows\System\xuBoeEf.exe
  C:\Windows\System\xuBoeEf.exe
  2⤵
  PID:5936
- C:\Windows\System\JLsIJLz.exe
  C:\Windows\System\JLsIJLz.exe
  2⤵
  PID:5956
- C:\Windows\System\GWOpbbf.exe
  C:\Windows\System\GWOpbbf.exe
  2⤵
  PID:5980
- C:\Windows\System\pQkcgXJ.exe
  C:\Windows\System\pQkcgXJ.exe
  2⤵
  PID:6012
- C:\Windows\System\RNXKYgD.exe
  C:\Windows\System\RNXKYgD.exe
  2⤵
  PID:6036
- C:\Windows\System\focWyIm.exe
  C:\Windows\System\focWyIm.exe
  2⤵
  PID:6064
- C:\Windows\System\XXdsFbk.exe
  C:\Windows\System\XXdsFbk.exe
  2⤵
  PID:6084
- C:\Windows\System\swtsVLr.exe
  C:\Windows\System\swtsVLr.exe
  2⤵
  PID:6108
- C:\Windows\System\ZjsnrWm.exe
  C:\Windows\System\ZjsnrWm.exe
  2⤵
  PID:6140
- C:\Windows\System\mPNoEPK.exe
  C:\Windows\System\mPNoEPK.exe
  2⤵
  PID:4440
- C:\Windows\System\HgdyUpb.exe
  C:\Windows\System\HgdyUpb.exe
  2⤵
  PID:3868
- C:\Windows\System\AkcchmN.exe
  C:\Windows\System\AkcchmN.exe
  2⤵
  PID:1528
- C:\Windows\System\oVHrUJB.exe
  C:\Windows\System\oVHrUJB.exe
  2⤵
  PID:5172
- C:\Windows\System\ExnEMdj.exe
  C:\Windows\System\ExnEMdj.exe
  2⤵
  PID:5040
- C:\Windows\System\RWqBQjv.exe
  C:\Windows\System\RWqBQjv.exe
  2⤵
  PID:5184
- C:\Windows\System\ayzMPAI.exe
  C:\Windows\System\ayzMPAI.exe
  2⤵
  PID:5256
- C:\Windows\System\oCNvToy.exe
  C:\Windows\System\oCNvToy.exe
  2⤵
  PID:5316
- C:\Windows\System\jjQuCaS.exe
  C:\Windows\System\jjQuCaS.exe
  2⤵
  PID:5464
- C:\Windows\System\reKWMFk.exe
  C:\Windows\System\reKWMFk.exe
  2⤵
  PID:5580
- C:\Windows\System\NwWYdJF.exe
  C:\Windows\System\NwWYdJF.exe
  2⤵
  PID:5628
- C:\Windows\System\rmPDKMJ.exe
  C:\Windows\System\rmPDKMJ.exe
  2⤵
  PID:5672
- C:\Windows\System\ziaActr.exe
  C:\Windows\System\ziaActr.exe
  2⤵
  PID:5680
- C:\Windows\System\ZBkqImz.exe
  C:\Windows\System\ZBkqImz.exe
  2⤵
  PID:5700
- C:\Windows\System\HgCswro.exe
  C:\Windows\System\HgCswro.exe
  2⤵
  PID:5728
- C:\Windows\System\uEIhwSu.exe
  C:\Windows\System\uEIhwSu.exe
  2⤵
  PID:5708
- C:\Windows\System\TjotFoc.exe
  C:\Windows\System\TjotFoc.exe
  2⤵
  PID:6128
- C:\Windows\System\CkkJTry.exe
  C:\Windows\System\CkkJTry.exe
  2⤵
  PID:5056
- C:\Windows\System\GdMXqyd.exe
  C:\Windows\System\GdMXqyd.exe
  2⤵
  PID:6028
- C:\Windows\System\jgefBmX.exe
  C:\Windows\System\jgefBmX.exe
  2⤵
  PID:2152
- C:\Windows\System\LGIiCfH.exe
  C:\Windows\System\LGIiCfH.exe
  2⤵
  PID:5156
- C:\Windows\System\FqYAhrG.exe
  C:\Windows\System\FqYAhrG.exe
  2⤵
  PID:5928
- C:\Windows\System\SSXmqku.exe
  C:\Windows\System\SSXmqku.exe
  2⤵
  PID:5124
- C:\Windows\System\vSTCtMG.exe
  C:\Windows\System\vSTCtMG.exe
  2⤵
  PID:5224
- C:\Windows\System\cJpruVz.exe
  C:\Windows\System\cJpruVz.exe
  2⤵
  PID:6168
- C:\Windows\System\jLoiOHy.exe
  C:\Windows\System\jLoiOHy.exe
  2⤵
  PID:6196
- C:\Windows\System\nqBHcVV.exe
  C:\Windows\System\nqBHcVV.exe
  2⤵
  PID:6216
- C:\Windows\System\IpNrmmz.exe
  C:\Windows\System\IpNrmmz.exe
  2⤵
  PID:6244
- C:\Windows\System\NDdtoDL.exe
  C:\Windows\System\NDdtoDL.exe
  2⤵
  PID:6268
- C:\Windows\System\yXQzmpT.exe
  C:\Windows\System\yXQzmpT.exe
  2⤵
  PID:6300
- C:\Windows\System\GmRRsci.exe
  C:\Windows\System\GmRRsci.exe
  2⤵
  PID:6320
- C:\Windows\System\rSwjSvY.exe
  C:\Windows\System\rSwjSvY.exe
  2⤵
  PID:6344
- C:\Windows\System\ACGfihi.exe
  C:\Windows\System\ACGfihi.exe
  2⤵
  PID:6372
- C:\Windows\System\aadBZfJ.exe
  C:\Windows\System\aadBZfJ.exe
  2⤵
  PID:6396
- C:\Windows\System\nsZrZdt.exe
  C:\Windows\System\nsZrZdt.exe
  2⤵
  PID:6424
- C:\Windows\System\JPqFqAE.exe
  C:\Windows\System\JPqFqAE.exe
  2⤵
  PID:6440
- C:\Windows\System\orAvAlJ.exe
  C:\Windows\System\orAvAlJ.exe
  2⤵
  PID:6460
- C:\Windows\System\qimhSRC.exe
  C:\Windows\System\qimhSRC.exe
  2⤵
  PID:6484
- C:\Windows\System\XYdeZhx.exe
  C:\Windows\System\XYdeZhx.exe
  2⤵
  PID:6504
- C:\Windows\System\LetpuPx.exe
  C:\Windows\System\LetpuPx.exe
  2⤵
  PID:6524
- C:\Windows\System\VZwVeir.exe
  C:\Windows\System\VZwVeir.exe
  2⤵
  PID:6548
- C:\Windows\System\fepqRdp.exe
  C:\Windows\System\fepqRdp.exe
  2⤵
  PID:6576
- C:\Windows\System\VbmPDXz.exe
  C:\Windows\System\VbmPDXz.exe
  2⤵
  PID:6600
- C:\Windows\System\AcqwOFI.exe
  C:\Windows\System\AcqwOFI.exe
  2⤵
  PID:6628
- C:\Windows\System\EPsDYBx.exe
  C:\Windows\System\EPsDYBx.exe
  2⤵
  PID:6656
- C:\Windows\System\oBvEFSz.exe
  C:\Windows\System\oBvEFSz.exe
  2⤵
  PID:6672
- C:\Windows\System\XjsuciC.exe
  C:\Windows\System\XjsuciC.exe
  2⤵
  PID:6700
- C:\Windows\System\RkBjvTj.exe
  C:\Windows\System\RkBjvTj.exe
  2⤵
  PID:6728
- C:\Windows\System\oQItuin.exe
  C:\Windows\System\oQItuin.exe
  2⤵
  PID:6752
- C:\Windows\System\ntYchCk.exe
  C:\Windows\System\ntYchCk.exe
  2⤵
  PID:6780
- C:\Windows\System\fCtmiRH.exe
  C:\Windows\System\fCtmiRH.exe
  2⤵
  PID:6800
- C:\Windows\System\cOoImQX.exe
  C:\Windows\System\cOoImQX.exe
  2⤵
  PID:6824
- C:\Windows\System\YXTMeUv.exe
  C:\Windows\System\YXTMeUv.exe
  2⤵
  PID:6856
- C:\Windows\System\eFbCmCW.exe
  C:\Windows\System\eFbCmCW.exe
  2⤵
  PID:6876
- C:\Windows\System\pCQPlyc.exe
  C:\Windows\System\pCQPlyc.exe
  2⤵
  PID:6900
- C:\Windows\System\GxUsQlc.exe
  C:\Windows\System\GxUsQlc.exe
  2⤵
  PID:6920
- C:\Windows\System\ZenAgWc.exe
  C:\Windows\System\ZenAgWc.exe
  2⤵
  PID:6944
- C:\Windows\System\jjVaKlZ.exe
  C:\Windows\System\jjVaKlZ.exe
  2⤵
  PID:6980
- C:\Windows\System\KCbOgTP.exe
  C:\Windows\System\KCbOgTP.exe
  2⤵
  PID:7000
- C:\Windows\System\WLVrTeY.exe
  C:\Windows\System\WLVrTeY.exe
  2⤵
  PID:7024
- C:\Windows\System\EayKmXZ.exe
  C:\Windows\System\EayKmXZ.exe
  2⤵
  PID:7052
- C:\Windows\System\FYTifis.exe
  C:\Windows\System\FYTifis.exe
  2⤵
  PID:7076
- C:\Windows\System\EPudxLc.exe
  C:\Windows\System\EPudxLc.exe
  2⤵
  PID:7100
- C:\Windows\System\qIOfEPz.exe
  C:\Windows\System\qIOfEPz.exe
  2⤵
  PID:7124
- C:\Windows\System\TEbecKb.exe
  C:\Windows\System\TEbecKb.exe
  2⤵
  PID:7140
- C:\Windows\System\tjREoAE.exe
  C:\Windows\System\tjREoAE.exe
  2⤵
  PID:5272
- C:\Windows\System\qzybehi.exe
  C:\Windows\System\qzybehi.exe
  2⤵
  PID:5768
- C:\Windows\System\RYqFtHQ.exe
  C:\Windows\System\RYqFtHQ.exe
  2⤵
  PID:3632
- C:\Windows\System\tdsGbNv.exe
  C:\Windows\System\tdsGbNv.exe
  2⤵
  PID:5600
- C:\Windows\System\xGCGHHU.exe
  C:\Windows\System\xGCGHHU.exe
  2⤵
  PID:5208
- C:\Windows\System\dVbPuWI.exe
  C:\Windows\System\dVbPuWI.exe
  2⤵
  PID:6000
- C:\Windows\System\NMjrHds.exe
  C:\Windows\System\NMjrHds.exe
  2⤵
  PID:5180
- C:\Windows\System\EsnmVtm.exe
  C:\Windows\System\EsnmVtm.exe
  2⤵
  PID:5412
- C:\Windows\System\UxkfpCA.exe
  C:\Windows\System\UxkfpCA.exe
  2⤵
  PID:6184
- C:\Windows\System\xizEjiy.exe
  C:\Windows\System\xizEjiy.exe
  2⤵
  PID:5876
- C:\Windows\System\vEeNiiK.exe
  C:\Windows\System\vEeNiiK.exe
  2⤵
  PID:6212
- C:\Windows\System\VziEmjr.exe
  C:\Windows\System\VziEmjr.exe
  2⤵
  PID:6556
- C:\Windows\System\NwikjIS.exe
  C:\Windows\System\NwikjIS.exe
  2⤵
  PID:6080
- C:\Windows\System\oeKxDeC.exe
  C:\Windows\System\oeKxDeC.exe
  2⤵
  PID:6316
- C:\Windows\System\mKHEuGC.exe
  C:\Windows\System\mKHEuGC.exe
  2⤵
  PID:6712
- C:\Windows\System\qdOWFtj.exe
  C:\Windows\System\qdOWFtj.exe
  2⤵
  PID:6808
- C:\Windows\System\SLQcPbV.exe
  C:\Windows\System\SLQcPbV.exe
  2⤵
  PID:6340
- C:\Windows\System\UxwkRvi.exe
  C:\Windows\System\UxwkRvi.exe
  2⤵
  PID:6388
- C:\Windows\System\OGhFrTJ.exe
  C:\Windows\System\OGhFrTJ.exe
  2⤵
  PID:6664
- C:\Windows\System\wxfvfif.exe
  C:\Windows\System\wxfvfif.exe
  2⤵
  PID:6500
- C:\Windows\System\vVpadbu.exe
  C:\Windows\System\vVpadbu.exe
  2⤵
  PID:6532
- C:\Windows\System\XsWeNlM.exe
  C:\Windows\System\XsWeNlM.exe
  2⤵
  PID:7156
- C:\Windows\System\flSISPb.exe
  C:\Windows\System\flSISPb.exe
  2⤵
  PID:6872
- C:\Windows\System\hvmhQRn.exe
  C:\Windows\System\hvmhQRn.exe
  2⤵
  PID:7172
- C:\Windows\System\eQXZMOY.exe
  C:\Windows\System\eQXZMOY.exe
  2⤵
  PID:7192
- C:\Windows\System\jCtRhor.exe
  C:\Windows\System\jCtRhor.exe
  2⤵
  PID:7216
- C:\Windows\System\dRHoSDR.exe
  C:\Windows\System\dRHoSDR.exe
  2⤵
  PID:7240
- C:\Windows\System\FpCMPDq.exe
  C:\Windows\System\FpCMPDq.exe
  2⤵
  PID:7264
- C:\Windows\System\pzwPjQK.exe
  C:\Windows\System\pzwPjQK.exe
  2⤵
  PID:7292
- C:\Windows\System\eylhwUa.exe
  C:\Windows\System\eylhwUa.exe
  2⤵
  PID:7312
- C:\Windows\System\IJLvcDv.exe
  C:\Windows\System\IJLvcDv.exe
  2⤵
  PID:7336
- C:\Windows\System\xoRpHTo.exe
  C:\Windows\System\xoRpHTo.exe
  2⤵
  PID:7364
- C:\Windows\System\ZbbfuZL.exe
  C:\Windows\System\ZbbfuZL.exe
  2⤵
  PID:7396
- C:\Windows\System\jeNgQxt.exe
  C:\Windows\System\jeNgQxt.exe
  2⤵
  PID:7416
- C:\Windows\System\EpXSCKi.exe
  C:\Windows\System\EpXSCKi.exe
  2⤵
  PID:7440
- C:\Windows\System\qyLJJMf.exe
  C:\Windows\System\qyLJJMf.exe
  2⤵
  PID:7472
- C:\Windows\System\ZkOzifk.exe
  C:\Windows\System\ZkOzifk.exe
  2⤵
  PID:7496
- C:\Windows\System\jhuRxeQ.exe
  C:\Windows\System\jhuRxeQ.exe
  2⤵
  PID:7520
- C:\Windows\System\XIScuGr.exe
  C:\Windows\System\XIScuGr.exe
  2⤵
  PID:7536
- C:\Windows\System\AKSfktS.exe
  C:\Windows\System\AKSfktS.exe
  2⤵
  PID:7560
- C:\Windows\System\adySGYw.exe
  C:\Windows\System\adySGYw.exe
  2⤵
  PID:7588
- C:\Windows\System\dLOGpSB.exe
  C:\Windows\System\dLOGpSB.exe
  2⤵
  PID:7620
- C:\Windows\System\srlBeiV.exe
  C:\Windows\System\srlBeiV.exe
  2⤵
  PID:7644
- C:\Windows\System\cxzCqEx.exe
  C:\Windows\System\cxzCqEx.exe
  2⤵
  PID:7672
- C:\Windows\System\Roycfpw.exe
  C:\Windows\System\Roycfpw.exe
  2⤵
  PID:7692
- C:\Windows\System\PiPqHDg.exe
  C:\Windows\System\PiPqHDg.exe
  2⤵
  PID:7716
- C:\Windows\System\OOyAbqN.exe
  C:\Windows\System\OOyAbqN.exe
  2⤵
  PID:7740
- C:\Windows\System\zrtiLqb.exe
  C:\Windows\System\zrtiLqb.exe
  2⤵
  PID:7764
- C:\Windows\System\Ditfmll.exe
  C:\Windows\System\Ditfmll.exe
  2⤵
  PID:7792
- C:\Windows\System\OlLNriv.exe
  C:\Windows\System\OlLNriv.exe
  2⤵
  PID:7816
- C:\Windows\System\EvlASRY.exe
  C:\Windows\System\EvlASRY.exe
  2⤵
  PID:7836
- C:\Windows\System\pQvlIaR.exe
  C:\Windows\System\pQvlIaR.exe
  2⤵
  PID:7864
- C:\Windows\System\cGJEvJv.exe
  C:\Windows\System\cGJEvJv.exe
  2⤵
  PID:7896
- C:\Windows\System\CQJghLU.exe
  C:\Windows\System\CQJghLU.exe
  2⤵
  PID:7916
- C:\Windows\System\oZilhFZ.exe
  C:\Windows\System\oZilhFZ.exe
  2⤵
  PID:7940
- C:\Windows\System\rcPPVXe.exe
  C:\Windows\System\rcPPVXe.exe
  2⤵
  PID:7968
- C:\Windows\System\JwGAACo.exe
  C:\Windows\System\JwGAACo.exe
  2⤵
  PID:7992
- C:\Windows\System\iEzYlxW.exe
  C:\Windows\System\iEzYlxW.exe
  2⤵
  PID:8016
- C:\Windows\System\HTPXHZP.exe
  C:\Windows\System\HTPXHZP.exe
  2⤵
  PID:8040
- C:\Windows\System\bEWTNsZ.exe
  C:\Windows\System\bEWTNsZ.exe
  2⤵
  PID:8064
- C:\Windows\System\OLUPPdu.exe
  C:\Windows\System\OLUPPdu.exe
  2⤵
  PID:8088
- C:\Windows\System\OPewxlp.exe
  C:\Windows\System\OPewxlp.exe
  2⤵
  PID:8116
- C:\Windows\System\jdegTTk.exe
  C:\Windows\System\jdegTTk.exe
  2⤵
  PID:8140
- C:\Windows\System\UDKYSOj.exe
  C:\Windows\System\UDKYSOj.exe
  2⤵
  PID:8164
- C:\Windows\System\BmXnXNU.exe
  C:\Windows\System\BmXnXNU.exe
  2⤵
  PID:6744
- C:\Windows\System\zFAqjJB.exe
  C:\Windows\System\zFAqjJB.exe
  2⤵
  PID:6992
- C:\Windows\System\CqFzARY.exe
  C:\Windows\System\CqFzARY.exe
  2⤵
  PID:7032
- C:\Windows\System\QrMRpTr.exe
  C:\Windows\System\QrMRpTr.exe
  2⤵
  PID:6480
- C:\Windows\System\jJijUPi.exe
  C:\Windows\System\jJijUPi.exe
  2⤵
  PID:7132
- C:\Windows\System\qIokjZQ.exe
  C:\Windows\System\qIokjZQ.exe
  2⤵
  PID:5584
- C:\Windows\System\MXXQzBW.exe
  C:\Windows\System\MXXQzBW.exe
  2⤵
  PID:5488
- C:\Windows\System\ppjimwz.exe
  C:\Windows\System\ppjimwz.exe
  2⤵
  PID:6896
- C:\Windows\System\KCMSCfL.exe
  C:\Windows\System\KCMSCfL.exe
  2⤵
  PID:5832
- C:\Windows\System\gDECOXR.exe
  C:\Windows\System\gDECOXR.exe
  2⤵
  PID:7016
- C:\Windows\System\OUROjqM.exe
  C:\Windows\System\OUROjqM.exe
  2⤵
  PID:7096
- C:\Windows\System\vtpWfYn.exe
  C:\Windows\System\vtpWfYn.exe
  2⤵
  PID:7344
- C:\Windows\System\gXIZLCL.exe
  C:\Windows\System\gXIZLCL.exe
  2⤵
  PID:6364
- C:\Windows\System\SKAkakM.exe
  C:\Windows\System\SKAkakM.exe
  2⤵
  PID:6956
- C:\Windows\System\LyZhwdL.exe
  C:\Windows\System\LyZhwdL.exe
  2⤵
  PID:6148
- C:\Windows\System\byTPqYQ.exe
  C:\Windows\System\byTPqYQ.exe
  2⤵
  PID:5804
- C:\Windows\System\TeSdyEw.exe
  C:\Windows\System\TeSdyEw.exe
  2⤵
  PID:7628
- C:\Windows\System\ZPJaJAS.exe
  C:\Windows\System\ZPJaJAS.exe
  2⤵
  PID:7236
- C:\Windows\System\EHgTJZc.exe
  C:\Windows\System\EHgTJZc.exe
  2⤵
  PID:6296
- C:\Windows\System\iYUuXfH.exe
  C:\Windows\System\iYUuXfH.exe
  2⤵
  PID:7372
- C:\Windows\System\RsOsnEs.exe
  C:\Windows\System\RsOsnEs.exe
  2⤵
  PID:6568
- C:\Windows\System\ZcHomGb.exe
  C:\Windows\System\ZcHomGb.exe
  2⤵
  PID:6468
- C:\Windows\System\TtWIPYE.exe
  C:\Windows\System\TtWIPYE.exe
  2⤵
  PID:7532
- C:\Windows\System\BwwqnRh.exe
  C:\Windows\System\BwwqnRh.exe
  2⤵
  PID:5792
- C:\Windows\System\XRHGmQH.exe
  C:\Windows\System\XRHGmQH.exe
  2⤵
  PID:6596
- C:\Windows\System\LMhHCAs.exe
  C:\Windows\System\LMhHCAs.exe
  2⤵
  PID:6256
- C:\Windows\System\VfikexN.exe
  C:\Windows\System\VfikexN.exe
  2⤵
  PID:7008
- C:\Windows\System\GMxMmmt.exe
  C:\Windows\System\GMxMmmt.exe
  2⤵
  PID:3976
- C:\Windows\System\MOIieEY.exe
  C:\Windows\System\MOIieEY.exe
  2⤵
  PID:7392
- C:\Windows\System\eygmQEg.exe
  C:\Windows\System\eygmQEg.exe
  2⤵
  PID:8096
- C:\Windows\System\DkgaxmN.exe
  C:\Windows\System\DkgaxmN.exe
  2⤵
  PID:8212
- C:\Windows\System\hgfLJZs.exe
  C:\Windows\System\hgfLJZs.exe
  2⤵
  PID:8236
- C:\Windows\System\BBeTPNa.exe
  C:\Windows\System\BBeTPNa.exe
  2⤵
  PID:8264
- C:\Windows\System\KTRBsKT.exe
  C:\Windows\System\KTRBsKT.exe
  2⤵
  PID:8284
- C:\Windows\System\quchTJu.exe
  C:\Windows\System\quchTJu.exe
  2⤵
  PID:8320
- C:\Windows\System\OOzxJKN.exe
  C:\Windows\System\OOzxJKN.exe
  2⤵
  PID:8340
- C:\Windows\System\HwDQfuf.exe
  C:\Windows\System\HwDQfuf.exe
  2⤵
  PID:8372
- C:\Windows\System\VHRrdJS.exe
  C:\Windows\System\VHRrdJS.exe
  2⤵
  PID:8416
- C:\Windows\System\MDRINCR.exe
  C:\Windows\System\MDRINCR.exe
  2⤵
  PID:8444
- C:\Windows\System\GhXwDNm.exe
  C:\Windows\System\GhXwDNm.exe
  2⤵
  PID:8464
- C:\Windows\System\PahvKSk.exe
  C:\Windows\System\PahvKSk.exe
  2⤵
  PID:8496
- C:\Windows\System\rhzVIiF.exe
  C:\Windows\System\rhzVIiF.exe
  2⤵
  PID:8532
- C:\Windows\System\vJxKIMl.exe
  C:\Windows\System\vJxKIMl.exe
  2⤵
  PID:8548
- C:\Windows\System\qvxPLbS.exe
  C:\Windows\System\qvxPLbS.exe
  2⤵
  PID:8580
- C:\Windows\System\dVOzpQQ.exe
  C:\Windows\System\dVOzpQQ.exe
  2⤵
  PID:8604
- C:\Windows\System\HNBoJKe.exe
  C:\Windows\System\HNBoJKe.exe
  2⤵
  PID:8628
- C:\Windows\System\DARiNAA.exe
  C:\Windows\System\DARiNAA.exe
  2⤵
  PID:8656
- C:\Windows\System\YVnfQGd.exe
  C:\Windows\System\YVnfQGd.exe
  2⤵
  PID:8680
- C:\Windows\System\ZUUVXyO.exe
  C:\Windows\System\ZUUVXyO.exe
  2⤵
  PID:8712
- C:\Windows\System\BHJseUK.exe
  C:\Windows\System\BHJseUK.exe
  2⤵
  PID:8748
- C:\Windows\System\EfKUcvy.exe
  C:\Windows\System\EfKUcvy.exe
  2⤵
  PID:8768
- C:\Windows\System\QKZZCqk.exe
  C:\Windows\System\QKZZCqk.exe
  2⤵
  PID:8792
- C:\Windows\System\VqKmaAS.exe
  C:\Windows\System\VqKmaAS.exe
  2⤵
  PID:8812
- C:\Windows\System\VRHvMKE.exe
  C:\Windows\System\VRHvMKE.exe
  2⤵
  PID:8840
- C:\Windows\System\gpacNzy.exe
  C:\Windows\System\gpacNzy.exe
  2⤵
  PID:8872
- C:\Windows\System\lUiTWHE.exe
  C:\Windows\System\lUiTWHE.exe
  2⤵
  PID:8896
- C:\Windows\System\wRSUdBj.exe
  C:\Windows\System\wRSUdBj.exe
  2⤵
  PID:8920
- C:\Windows\System\FbvCUvI.exe
  C:\Windows\System\FbvCUvI.exe
  2⤵
  PID:8940
- C:\Windows\System\LzafMhE.exe
  C:\Windows\System\LzafMhE.exe
  2⤵
  PID:8964
- C:\Windows\System\WnEXWMM.exe
  C:\Windows\System\WnEXWMM.exe
  2⤵
  PID:8984
- C:\Windows\System\CCKQYBD.exe
  C:\Windows\System\CCKQYBD.exe
  2⤵
  PID:9004
- C:\Windows\System\JAoggyq.exe
  C:\Windows\System\JAoggyq.exe
  2⤵
  PID:9036
- C:\Windows\System\WXZseSE.exe
  C:\Windows\System\WXZseSE.exe
  2⤵
  PID:9052
- C:\Windows\System\IwFCxrF.exe
  C:\Windows\System\IwFCxrF.exe
  2⤵
  PID:9068
- C:\Windows\System\mugARZZ.exe
  C:\Windows\System\mugARZZ.exe
  2⤵
  PID:9092
- C:\Windows\System\vtWhKea.exe
  C:\Windows\System\vtWhKea.exe
  2⤵
  PID:9116
- C:\Windows\System\tnERshP.exe
  C:\Windows\System\tnERshP.exe
  2⤵
  PID:9144
- C:\Windows\System\gpBOHZf.exe
  C:\Windows\System\gpBOHZf.exe
  2⤵
  PID:9164
- C:\Windows\System\tyjEKBj.exe
  C:\Windows\System\tyjEKBj.exe
  2⤵
  PID:9192
- C:\Windows\System\IoQmEQl.exe
  C:\Windows\System\IoQmEQl.exe
  2⤵
  PID:8104
- C:\Windows\System\ESRnWHc.exe
  C:\Windows\System\ESRnWHc.exe
  2⤵
  PID:6680
- C:\Windows\System\YfmlwIv.exe
  C:\Windows\System\YfmlwIv.exe
  2⤵
  PID:7308
- C:\Windows\System\BGGSGOL.exe
  C:\Windows\System\BGGSGOL.exe
  2⤵
  PID:3548
- C:\Windows\System\izxFxVi.exe
  C:\Windows\System\izxFxVi.exe
  2⤵
  PID:7596
- C:\Windows\System\pfgbhew.exe
  C:\Windows\System\pfgbhew.exe
  2⤵
  PID:7612
- C:\Windows\System\LHmOgIU.exe
  C:\Windows\System\LHmOgIU.exe
  2⤵
  PID:8228
- C:\Windows\System\tklicVi.exe
  C:\Windows\System\tklicVi.exe
  2⤵
  PID:8308
- C:\Windows\System\atwBAwC.exe
  C:\Windows\System\atwBAwC.exe
  2⤵
  PID:6792
- C:\Windows\System\tuRwEqg.exe
  C:\Windows\System\tuRwEqg.exe
  2⤵
  PID:8432
- C:\Windows\System\kJtAZiT.exe
  C:\Windows\System\kJtAZiT.exe
  2⤵
  PID:8472
- C:\Windows\System\xKWLkVX.exe
  C:\Windows\System\xKWLkVX.exe
  2⤵
  PID:4112
- C:\Windows\System\tglmKCY.exe
  C:\Windows\System\tglmKCY.exe
  2⤵
  PID:7828
- C:\Windows\System\VKjUSTG.exe
  C:\Windows\System\VKjUSTG.exe
  2⤵
  PID:8612
- C:\Windows\System\hczSKjv.exe
  C:\Windows\System\hczSKjv.exe
  2⤵
  PID:8648
- C:\Windows\System\xdwOKpY.exe
  C:\Windows\System\xdwOKpY.exe
  2⤵
  PID:8248
- C:\Windows\System\kULQzhF.exe
  C:\Windows\System\kULQzhF.exe
  2⤵
  PID:2924
- C:\Windows\System\tyNCaEZ.exe
  C:\Windows\System\tyNCaEZ.exe
  2⤵
  PID:8912
- C:\Windows\System\ojVIjeh.exe
  C:\Windows\System\ojVIjeh.exe
  2⤵
  PID:8948
- C:\Windows\System\YjGNSxO.exe
  C:\Windows\System\YjGNSxO.exe
  2⤵
  PID:8980
- C:\Windows\System\WNRVyon.exe
  C:\Windows\System\WNRVyon.exe
  2⤵
  PID:9032
- C:\Windows\System\wIYkvHL.exe
  C:\Windows\System\wIYkvHL.exe
  2⤵
  PID:8540
- C:\Windows\System\gzeajXZ.exe
  C:\Windows\System\gzeajXZ.exe
  2⤵
  PID:9160
- C:\Windows\System\xLDNNkA.exe
  C:\Windows\System\xLDNNkA.exe
  2⤵
  PID:8668
- C:\Windows\System\sjBZqaB.exe
  C:\Windows\System\sjBZqaB.exe
  2⤵
  PID:8736
- C:\Windows\System\yhISxok.exe
  C:\Windows\System\yhISxok.exe
  2⤵
  PID:8300
- C:\Windows\System\dPmcdkL.exe
  C:\Windows\System\dPmcdkL.exe
  2⤵
  PID:8760
- C:\Windows\System\PrAdrYa.exe
  C:\Windows\System\PrAdrYa.exe
  2⤵
  PID:8820
- C:\Windows\System\cjtGiLk.exe
  C:\Windows\System\cjtGiLk.exe
  2⤵
  PID:8880
- C:\Windows\System\vyxlxQk.exe
  C:\Windows\System\vyxlxQk.exe
  2⤵
  PID:7804
- C:\Windows\System\uOufsvv.exe
  C:\Windows\System\uOufsvv.exe
  2⤵
  PID:9224
- C:\Windows\System\ZPHxJSl.exe
  C:\Windows\System\ZPHxJSl.exe
  2⤵
  PID:9248
- C:\Windows\System\rtqGDyQ.exe
  C:\Windows\System\rtqGDyQ.exe
  2⤵
  PID:9276
- C:\Windows\System\uPbCUiP.exe
  C:\Windows\System\uPbCUiP.exe
  2⤵
  PID:9304
- C:\Windows\System\fXERAZB.exe
  C:\Windows\System\fXERAZB.exe
  2⤵
  PID:9328
- C:\Windows\System\RLueeWg.exe
  C:\Windows\System\RLueeWg.exe
  2⤵
  PID:9348
- C:\Windows\System\NCcLBWf.exe
  C:\Windows\System\NCcLBWf.exe
  2⤵
  PID:9372
- C:\Windows\System\RZkLequ.exe
  C:\Windows\System\RZkLequ.exe
  2⤵
  PID:9400
- C:\Windows\System\QZchjkG.exe
  C:\Windows\System\QZchjkG.exe
  2⤵
  PID:9424
- C:\Windows\System\ouqSVvz.exe
  C:\Windows\System\ouqSVvz.exe
  2⤵
  PID:9460
- C:\Windows\System\llwzKbQ.exe
  C:\Windows\System\llwzKbQ.exe
  2⤵
  PID:9480
- C:\Windows\System\WKWRvVX.exe
  C:\Windows\System\WKWRvVX.exe
  2⤵
  PID:9496
- C:\Windows\System\UaZnvrq.exe
  C:\Windows\System\UaZnvrq.exe
  2⤵
  PID:9520
- C:\Windows\System\kWZgqWf.exe
  C:\Windows\System\kWZgqWf.exe
  2⤵
  PID:9552
- C:\Windows\System\fnwXaez.exe
  C:\Windows\System\fnwXaez.exe
  2⤵
  PID:9572
- C:\Windows\System\SaXvPSD.exe
  C:\Windows\System\SaXvPSD.exe
  2⤵
  PID:9592
- C:\Windows\System\UMxFLpu.exe
  C:\Windows\System\UMxFLpu.exe
  2⤵
  PID:9620
- C:\Windows\System\RQkoxEn.exe
  C:\Windows\System\RQkoxEn.exe
  2⤵
  PID:9644
- C:\Windows\System\FMjTPBF.exe
  C:\Windows\System\FMjTPBF.exe
  2⤵
  PID:9664
- C:\Windows\System\AiYRgxL.exe
  C:\Windows\System\AiYRgxL.exe
  2⤵
  PID:9700
- C:\Windows\System\yipylBn.exe
  C:\Windows\System\yipylBn.exe
  2⤵
  PID:9728
- C:\Windows\System\UkENhjl.exe
  C:\Windows\System\UkENhjl.exe
  2⤵
  PID:9752
- C:\Windows\System\cOPDIJk.exe
  C:\Windows\System\cOPDIJk.exe
  2⤵
  PID:9776
- C:\Windows\System\pdAKquj.exe
  C:\Windows\System\pdAKquj.exe
  2⤵
  PID:9800
- C:\Windows\System\TbUEvHw.exe
  C:\Windows\System\TbUEvHw.exe
  2⤵
  PID:9828
- C:\Windows\System\BXsJaiO.exe
  C:\Windows\System\BXsJaiO.exe
  2⤵
  PID:9860
- C:\Windows\System\VFMCqlT.exe
  C:\Windows\System\VFMCqlT.exe
  2⤵
  PID:9880
- C:\Windows\System\SKZpQbF.exe
  C:\Windows\System\SKZpQbF.exe
  2⤵
  PID:9908
- C:\Windows\System\jdnTlAg.exe
  C:\Windows\System\jdnTlAg.exe
  2⤵
  PID:9928
- C:\Windows\System\IXHWjXX.exe
  C:\Windows\System\IXHWjXX.exe
  2⤵
  PID:9960
- C:\Windows\System\bsxsOvd.exe
  C:\Windows\System\bsxsOvd.exe
  2⤵
  PID:9976
- C:\Windows\System\DerOYcd.exe
  C:\Windows\System\DerOYcd.exe
  2⤵
  PID:10000
- C:\Windows\System\VPRAXoo.exe
  C:\Windows\System\VPRAXoo.exe
  2⤵
  PID:10032
- C:\Windows\System\mGUBZDJ.exe
  C:\Windows\System\mGUBZDJ.exe
  2⤵
  PID:10060
- C:\Windows\System\jlmONlR.exe
  C:\Windows\System\jlmONlR.exe
  2⤵
  PID:10084
- C:\Windows\System\hWikAkm.exe
  C:\Windows\System\hWikAkm.exe
  2⤵
  PID:10112
- C:\Windows\System\HtiIPNN.exe
  C:\Windows\System\HtiIPNN.exe
  2⤵
  PID:10140
- C:\Windows\System\CICIJfL.exe
  C:\Windows\System\CICIJfL.exe
  2⤵
  PID:10164
- C:\Windows\System\zhmzuMl.exe
  C:\Windows\System\zhmzuMl.exe
  2⤵
  PID:10192
- C:\Windows\System\SxcjcKT.exe
  C:\Windows\System\SxcjcKT.exe
  2⤵
  PID:10208
- C:\Windows\System\kSgTwWE.exe
  C:\Windows\System\kSgTwWE.exe
  2⤵
  PID:10228
- C:\Windows\System\iDLzDVn.exe
  C:\Windows\System\iDLzDVn.exe
  2⤵
  PID:8636
- C:\Windows\System\GSrrErk.exe
  C:\Windows\System\GSrrErk.exe
  2⤵
  PID:8888
- C:\Windows\System\tjjAwyt.exe
  C:\Windows\System\tjjAwyt.exe
  2⤵
  PID:9140
- C:\Windows\System\sLLUMaJ.exe
  C:\Windows\System\sLLUMaJ.exe
  2⤵
  PID:7060
- C:\Windows\System\QXFvJQq.exe
  C:\Windows\System\QXFvJQq.exe
  2⤵
  PID:7912
- C:\Windows\System\JIFrYhH.exe
  C:\Windows\System\JIFrYhH.exe
  2⤵
  PID:9240
- C:\Windows\System\pbqNDCF.exe
  C:\Windows\System\pbqNDCF.exe
  2⤵
  PID:9256
- C:\Windows\System\FZYvwlz.exe
  C:\Windows\System\FZYvwlz.exe
  2⤵
  PID:9336
- C:\Windows\System\BUugKzm.exe
  C:\Windows\System\BUugKzm.exe
  2⤵
  PID:9416
- C:\Windows\System\oloBzyM.exe
  C:\Windows\System\oloBzyM.exe
  2⤵
  PID:9536
- C:\Windows\System\lLipZSK.exe
  C:\Windows\System\lLipZSK.exe
  2⤵
  PID:9608
- C:\Windows\System\nxHcQkY.exe
  C:\Windows\System\nxHcQkY.exe
  2⤵
  PID:9152
- C:\Windows\System\LKrxmgN.exe
  C:\Windows\System\LKrxmgN.exe
  2⤵
  PID:7980
- C:\Windows\System\DxVCuxY.exe
  C:\Windows\System\DxVCuxY.exe
  2⤵
  PID:9844
- C:\Windows\System\LLODumP.exe
  C:\Windows\System\LLODumP.exe
  2⤵
  PID:5948
- C:\Windows\System\vzRygbQ.exe
  C:\Windows\System\vzRygbQ.exe
  2⤵
  PID:9872
- C:\Windows\System\WIvcSRF.exe
  C:\Windows\System\WIvcSRF.exe
  2⤵
  PID:9952
- C:\Windows\System\CNoGgbu.exe
  C:\Windows\System\CNoGgbu.exe
  2⤵
  PID:10068
- C:\Windows\System\TGlMFFf.exe
  C:\Windows\System\TGlMFFf.exe
  2⤵
  PID:10256
- C:\Windows\System\jJRpyYs.exe
  C:\Windows\System\jJRpyYs.exe
  2⤵
  PID:10272
- C:\Windows\System\xqggSOl.exe
  C:\Windows\System\xqggSOl.exe
  2⤵
  PID:10288
- C:\Windows\System\JNRSoUe.exe
  C:\Windows\System\JNRSoUe.exe
  2⤵
  PID:10308
- C:\Windows\System\HNGgBhI.exe
  C:\Windows\System\HNGgBhI.exe
  2⤵
  PID:10324
- C:\Windows\System\QjTuCGN.exe
  C:\Windows\System\QjTuCGN.exe
  2⤵
  PID:10340
- C:\Windows\System\FwoxNyZ.exe
  C:\Windows\System\FwoxNyZ.exe
  2⤵
  PID:10368
- C:\Windows\System\LkxGlzX.exe
  C:\Windows\System\LkxGlzX.exe
  2⤵
  PID:10392
- C:\Windows\System\aDbeNUh.exe
  C:\Windows\System\aDbeNUh.exe
  2⤵
  PID:10420
- C:\Windows\System\DwqSJWu.exe
  C:\Windows\System\DwqSJWu.exe
  2⤵
  PID:10444
- C:\Windows\System\IdCDctA.exe
  C:\Windows\System\IdCDctA.exe
  2⤵
  PID:10480
- C:\Windows\System\Rxilazk.exe
  C:\Windows\System\Rxilazk.exe
  2⤵
  PID:10500
- C:\Windows\System\qcbHKVG.exe
  C:\Windows\System\qcbHKVG.exe
  2⤵
  PID:10524
- C:\Windows\System\LFuZaHb.exe
  C:\Windows\System\LFuZaHb.exe
  2⤵
  PID:10548
- C:\Windows\System\LIGNazv.exe
  C:\Windows\System\LIGNazv.exe
  2⤵
  PID:10568
- C:\Windows\System\suhwmIn.exe
  C:\Windows\System\suhwmIn.exe
  2⤵
  PID:10592
- C:\Windows\System\adRmxkO.exe
  C:\Windows\System\adRmxkO.exe
  2⤵
  PID:10616
- C:\Windows\System\jZvvPlk.exe
  C:\Windows\System\jZvvPlk.exe
  2⤵
  PID:10640
- C:\Windows\System\DhFIpgs.exe
  C:\Windows\System\DhFIpgs.exe
  2⤵
  PID:10664
- C:\Windows\System\jSKBHVe.exe
  C:\Windows\System\jSKBHVe.exe
  2⤵
  PID:10688
- C:\Windows\System\QDAWihl.exe
  C:\Windows\System\QDAWihl.exe
  2⤵
  PID:10712
- C:\Windows\System\wvEoTbA.exe
  C:\Windows\System\wvEoTbA.exe
  2⤵
  PID:10736
- C:\Windows\System\wJlpSke.exe
  C:\Windows\System\wJlpSke.exe
  2⤵
  PID:10756
- C:\Windows\System\WPSpQiO.exe
  C:\Windows\System\WPSpQiO.exe
  2⤵
  PID:10960
- C:\Windows\System\WwAnmkM.exe
  C:\Windows\System\WwAnmkM.exe
  2⤵
  PID:11008
- C:\Windows\System\eQhIBnM.exe
  C:\Windows\System\eQhIBnM.exe
  2⤵
  PID:11032
- C:\Windows\System\BDfIlgs.exe
  C:\Windows\System\BDfIlgs.exe
  2⤵
  PID:11052
- C:\Windows\System\RPvAUca.exe
  C:\Windows\System\RPvAUca.exe
  2⤵
  PID:11076
- C:\Windows\System\XSipNTM.exe
  C:\Windows\System\XSipNTM.exe
  2⤵
  PID:11100
- C:\Windows\System\UMKaQIn.exe
  C:\Windows\System\UMKaQIn.exe
  2⤵
  PID:11124
- C:\Windows\System\kaeiVru.exe
  C:\Windows\System\kaeiVru.exe
  2⤵
  PID:11152
- C:\Windows\System\CvONrvZ.exe
  C:\Windows\System\CvONrvZ.exe
  2⤵
  PID:11172
- C:\Windows\System\DJUfhPu.exe
  C:\Windows\System\DJUfhPu.exe
  2⤵
  PID:11188
- C:\Windows\System\JbCbqCe.exe
  C:\Windows\System\JbCbqCe.exe
  2⤵
  PID:11216
- C:\Windows\System\zUDiLkU.exe
  C:\Windows\System\zUDiLkU.exe
  2⤵
  PID:11240
- C:\Windows\System\xOvKoNP.exe
  C:\Windows\System\xOvKoNP.exe
  2⤵
  PID:9380
- C:\Windows\System\NPuLupo.exe
  C:\Windows\System\NPuLupo.exe
  2⤵
  PID:9448
- C:\Windows\System\PTzILXQ.exe
  C:\Windows\System\PTzILXQ.exe
  2⤵
  PID:10148
- C:\Windows\System\GggZFJi.exe
  C:\Windows\System\GggZFJi.exe
  2⤵
  PID:9492
- C:\Windows\System\DaKPYgK.exe
  C:\Windows\System\DaKPYgK.exe
  2⤵
  PID:10176
- C:\Windows\System\uTpTtbg.exe
  C:\Windows\System\uTpTtbg.exe
  2⤵
  PID:8936
- C:\Windows\System\BIhjnWg.exe
  C:\Windows\System\BIhjnWg.exe
  2⤵
  PID:8696
- C:\Windows\System\jKhTTnD.exe
  C:\Windows\System\jKhTTnD.exe
  2⤵
  PID:8976
- C:\Windows\System\vOHFYfn.exe
  C:\Windows\System\vOHFYfn.exe
  2⤵
  PID:7328
- C:\Windows\System\PtDjNYg.exe
  C:\Windows\System\PtDjNYg.exe
  2⤵
  PID:7068
- C:\Windows\System\WqBWTzJ.exe
  C:\Windows\System\WqBWTzJ.exe
  2⤵
  PID:9808
- C:\Windows\System\qRRjCZW.exe
  C:\Windows\System\qRRjCZW.exe
  2⤵
  PID:9900
- C:\Windows\System\QffvgJb.exe
  C:\Windows\System\QffvgJb.exe
  2⤵
  PID:10008
- C:\Windows\System\JUPamIy.exe
  C:\Windows\System\JUPamIy.exe
  2⤵
  PID:9408
- C:\Windows\System\PAJDtuQ.exe
  C:\Windows\System\PAJDtuQ.exe
  2⤵
  PID:9600
- C:\Windows\System\JJpMdOh.exe
  C:\Windows\System\JJpMdOh.exe
  2⤵
  PID:9320
- C:\Windows\System\fWKbYEJ.exe
  C:\Windows\System\fWKbYEJ.exe
  2⤵
  PID:10560
- C:\Windows\System\IExGRij.exe
  C:\Windows\System\IExGRij.exe
  2⤵
  PID:9820
- C:\Windows\System\OvsHGeE.exe
  C:\Windows\System\OvsHGeE.exe
  2⤵
  PID:9796
- C:\Windows\System\suzBgej.exe
  C:\Windows\System\suzBgej.exe
  2⤵
  PID:10092
- C:\Windows\System\BSMEafS.exe
  C:\Windows\System\BSMEafS.exe
  2⤵
  PID:10236
- C:\Windows\System\VESyzHU.exe
  C:\Windows\System\VESyzHU.exe
  2⤵
  PID:10576
- C:\Windows\System\cGRNquY.exe
  C:\Windows\System\cGRNquY.exe
  2⤵
  PID:7708
- C:\Windows\System\CBKrRiM.exe
  C:\Windows\System\CBKrRiM.exe
  2⤵
  PID:10720
- C:\Windows\System\RIauPLL.exe
  C:\Windows\System\RIauPLL.exe
  2⤵
  PID:10632
- C:\Windows\System\URleepl.exe
  C:\Windows\System\URleepl.exe
  2⤵
  PID:11020
- C:\Windows\System\PYDHHOA.exe
  C:\Windows\System\PYDHHOA.exe
  2⤵
  PID:11108
- C:\Windows\System\KmvGTDZ.exe
  C:\Windows\System\KmvGTDZ.exe
  2⤵
  PID:11208
- C:\Windows\System\qDhkAuU.exe
  C:\Windows\System\qDhkAuU.exe
  2⤵
  PID:9444
- C:\Windows\System\Abhvbcu.exe
  C:\Windows\System\Abhvbcu.exe
  2⤵
  PID:11268
- C:\Windows\System\RVsePof.exe
  C:\Windows\System\RVsePof.exe
  2⤵
  PID:11308
- C:\Windows\System\JlmBsWg.exe
  C:\Windows\System\JlmBsWg.exe
  2⤵
  PID:11324
- C:\Windows\System\xGqyUbP.exe
  C:\Windows\System\xGqyUbP.exe
  2⤵
  PID:11348
- C:\Windows\System\yiAmZZr.exe
  C:\Windows\System\yiAmZZr.exe
  2⤵
  PID:11376
- C:\Windows\System\GhiqPvw.exe
  C:\Windows\System\GhiqPvw.exe
  2⤵
  PID:11404
- C:\Windows\System\MsVNxja.exe
  C:\Windows\System\MsVNxja.exe
  2⤵
  PID:11432
- C:\Windows\System\LTOgCuu.exe
  C:\Windows\System\LTOgCuu.exe
  2⤵
  PID:11460
- C:\Windows\System\WwoHCRA.exe
  C:\Windows\System\WwoHCRA.exe
  2⤵
  PID:11484
- C:\Windows\System\nfkyEsl.exe
  C:\Windows\System\nfkyEsl.exe
  2⤵
  PID:11516
- C:\Windows\System\ArjlyaM.exe
  C:\Windows\System\ArjlyaM.exe
  2⤵
  PID:11536
- C:\Windows\System\JfvrlNi.exe
  C:\Windows\System\JfvrlNi.exe
  2⤵
  PID:11560
- C:\Windows\System\eOfHLtc.exe
  C:\Windows\System\eOfHLtc.exe
  2⤵
  PID:11588
- C:\Windows\System\spiXVCM.exe
  C:\Windows\System\spiXVCM.exe
  2⤵
  PID:11612
- C:\Windows\System\RqmbwIN.exe
  C:\Windows\System\RqmbwIN.exe
  2⤵
  PID:11636
- C:\Windows\System\ITtbinl.exe
  C:\Windows\System\ITtbinl.exe
  2⤵
  PID:11656
- C:\Windows\System\DdGdlSx.exe
  C:\Windows\System\DdGdlSx.exe
  2⤵
  PID:11688
- C:\Windows\System\uHVusIc.exe
  C:\Windows\System\uHVusIc.exe
  2⤵
  PID:11704
- C:\Windows\System\AlubHxN.exe
  C:\Windows\System\AlubHxN.exe
  2⤵
  PID:11720
- C:\Windows\System\bwwrlZn.exe
  C:\Windows\System\bwwrlZn.exe
  2⤵
  PID:11736
- C:\Windows\System\dHdFnhG.exe
  C:\Windows\System\dHdFnhG.exe
  2⤵
  PID:11752
- C:\Windows\System\KHUkuDT.exe
  C:\Windows\System\KHUkuDT.exe
  2⤵
  PID:11776
- C:\Windows\System\vhLSkJc.exe
  C:\Windows\System\vhLSkJc.exe
  2⤵
  PID:11796
- C:\Windows\System\bOaxlJi.exe
  C:\Windows\System\bOaxlJi.exe
  2⤵
  PID:11820
- C:\Windows\System\BCearbB.exe
  C:\Windows\System\BCearbB.exe
  2⤵
  PID:11844
- C:\Windows\System\pwVammI.exe
  C:\Windows\System\pwVammI.exe
  2⤵
  PID:11868
- C:\Windows\System\ryFhLXY.exe
  C:\Windows\System\ryFhLXY.exe
  2⤵
  PID:11896
- C:\Windows\System\GzcxWQm.exe
  C:\Windows\System\GzcxWQm.exe
  2⤵
  PID:11916
- C:\Windows\System\MdNcBpL.exe
  C:\Windows\System\MdNcBpL.exe
  2⤵
  PID:11940
- C:\Windows\System\vhzCDon.exe
  C:\Windows\System\vhzCDon.exe
  2⤵
  PID:11972
- C:\Windows\System\RcYaFhV.exe
  C:\Windows\System\RcYaFhV.exe
  2⤵
  PID:11996
- C:\Windows\System\hNWjXIq.exe
  C:\Windows\System\hNWjXIq.exe
  2⤵
  PID:12020
- C:\Windows\System\xBRbhhz.exe
  C:\Windows\System\xBRbhhz.exe
  2⤵
  PID:12044
- C:\Windows\System\btREZla.exe
  C:\Windows\System\btREZla.exe
  2⤵
  PID:12068
- C:\Windows\System\DaeUnop.exe
  C:\Windows\System\DaeUnop.exe
  2⤵
  PID:12092
- C:\Windows\System\faqUOcC.exe
  C:\Windows\System\faqUOcC.exe
  2⤵
  PID:12112
- C:\Windows\System\WEWHqmh.exe
  C:\Windows\System\WEWHqmh.exe
  2⤵
  PID:12136
- C:\Windows\System\CWnNCgI.exe
  C:\Windows\System\CWnNCgI.exe
  2⤵
  PID:12156
- C:\Windows\System\FmNxiwd.exe
  C:\Windows\System\FmNxiwd.exe
  2⤵
  PID:12180
- C:\Windows\System\AAwSqfv.exe
  C:\Windows\System\AAwSqfv.exe
  2⤵
  PID:12212
- C:\Windows\System\iYpzZNT.exe
  C:\Windows\System\iYpzZNT.exe
  2⤵
  PID:12076
- C:\Windows\System\izFNIIa.exe
  C:\Windows\System\izFNIIa.exe
  2⤵
  PID:12128
- C:\Windows\System\GpFAMub.exe
  C:\Windows\System\GpFAMub.exe
  2⤵
  PID:12164
- C:\Windows\System\zNFugvy.exe
  C:\Windows\System\zNFugvy.exe
  2⤵
  PID:10204
- C:\Windows\System\fALvyNT.exe
  C:\Windows\System\fALvyNT.exe
  2⤵
  PID:12220
- C:\Windows\System\hyEHFHK.exe
  C:\Windows\System\hyEHFHK.exe
  2⤵
  PID:9636
- C:\Windows\System\qqgfeeg.exe
  C:\Windows\System\qqgfeeg.exe
  2⤵
  PID:11392
- C:\Windows\System\mAesvJR.exe
  C:\Windows\System\mAesvJR.exe
  2⤵
  PID:428
- C:\Windows\System\mDymkJX.exe
  C:\Windows\System\mDymkJX.exe
  2⤵
  PID:9064
- C:\Windows\System\NPDjKeF.exe
  C:\Windows\System\NPDjKeF.exe
  2⤵
  PID:10076
- C:\Windows\System\ejfTVKZ.exe
  C:\Windows\System\ejfTVKZ.exe
  2⤵
  PID:12036
- C:\Windows\System\MjGKIAK.exe
  C:\Windows\System\MjGKIAK.exe
  2⤵
  PID:11064
- C:\Windows\System\zvAmMCH.exe
  C:\Windows\System\zvAmMCH.exe
  2⤵
  PID:12308
- C:\Windows\System\FlJULux.exe
  C:\Windows\System\FlJULux.exe
  2⤵
  PID:12332
- C:\Windows\System\SjNyuRV.exe
  C:\Windows\System\SjNyuRV.exe
  2⤵
  PID:12372
- C:\Windows\System\wgRAImZ.exe
  C:\Windows\System\wgRAImZ.exe
  2⤵
  PID:12392
- C:\Windows\System\SjncoLV.exe
  C:\Windows\System\SjncoLV.exe
  2⤵
  PID:12412
- C:\Windows\System\BVWpOxT.exe
  C:\Windows\System\BVWpOxT.exe
  2⤵
  PID:12432
- C:\Windows\System\nFTmXWz.exe
  C:\Windows\System\nFTmXWz.exe
  2⤵
  PID:12452
- C:\Windows\System\ddqPipU.exe
  C:\Windows\System\ddqPipU.exe
  2⤵
  PID:12480
- C:\Windows\System\JOTMXpS.exe
  C:\Windows\System\JOTMXpS.exe
  2⤵
  PID:12496
- C:\Windows\System\xNqWunw.exe
  C:\Windows\System\xNqWunw.exe
  2⤵
  PID:12520
- C:\Windows\System\doAMyxz.exe
  C:\Windows\System\doAMyxz.exe
  2⤵
  PID:12548
- C:\Windows\System\fiwQgQd.exe
  C:\Windows\System\fiwQgQd.exe
  2⤵
  PID:12568
- C:\Windows\System\XmDklWu.exe
  C:\Windows\System\XmDklWu.exe
  2⤵
  PID:12588
- C:\Windows\System\uInSyBQ.exe
  C:\Windows\System\uInSyBQ.exe
  2⤵
  PID:12628
- C:\Windows\System\aCCztlQ.exe
  C:\Windows\System\aCCztlQ.exe
  2⤵
  PID:12652
- C:\Windows\System\EuTGRSJ.exe
  C:\Windows\System\EuTGRSJ.exe
  2⤵
  PID:12680
- C:\Windows\System\EVRJbHb.exe
  C:\Windows\System\EVRJbHb.exe
  2⤵
  PID:12700
- C:\Windows\System\qDvNzAO.exe
  C:\Windows\System\qDvNzAO.exe
  2⤵
  PID:12728
- C:\Windows\System\biOlTNG.exe
  C:\Windows\System\biOlTNG.exe
  2⤵
  PID:12756
- C:\Windows\System\JntUKTR.exe
  C:\Windows\System\JntUKTR.exe
  2⤵
  PID:12780
- C:\Windows\System\UGsaaYm.exe
  C:\Windows\System\UGsaaYm.exe
  2⤵
  PID:12808
- C:\Windows\System\VNOawmu.exe
  C:\Windows\System\VNOawmu.exe
  2⤵
  PID:12828
- C:\Windows\System\hybZbOg.exe
  C:\Windows\System\hybZbOg.exe
  2⤵
  PID:12856
- C:\Windows\System\wwwMxTz.exe
  C:\Windows\System\wwwMxTz.exe
  2⤵
  PID:12880
- C:\Windows\System\xyneNtU.exe
  C:\Windows\System\xyneNtU.exe
  2⤵
  PID:12908
- C:\Windows\System\JdYiaqk.exe
  C:\Windows\System\JdYiaqk.exe
  2⤵
  PID:12928
- C:\Windows\System\CeCdzle.exe
  C:\Windows\System\CeCdzle.exe
  2⤵
  PID:12956
- C:\Windows\System\VtbDdUw.exe
  C:\Windows\System\VtbDdUw.exe
  2⤵
  PID:12976
- C:\Windows\System\lNqJoWo.exe
  C:\Windows\System\lNqJoWo.exe
  2⤵
  PID:13000
- C:\Windows\System\gfLdurj.exe
  C:\Windows\System\gfLdurj.exe
  2⤵
  PID:13024
- C:\Windows\System\WNqagdj.exe
  C:\Windows\System\WNqagdj.exe
  2⤵
  PID:13048
- C:\Windows\System\mobdAxm.exe
  C:\Windows\System\mobdAxm.exe
  2⤵
  PID:13068
- C:\Windows\System\FlfPFZd.exe
  C:\Windows\System\FlfPFZd.exe
  2⤵
  PID:13084
- C:\Windows\System\FrDGYyR.exe
  C:\Windows\System\FrDGYyR.exe
  2⤵
  PID:13100
- C:\Windows\System\kHxPnnf.exe
  C:\Windows\System\kHxPnnf.exe
  2⤵
  PID:13132
- C:\Windows\System\LLRepQv.exe
  C:\Windows\System\LLRepQv.exe
  2⤵
  PID:13152
- C:\Windows\System\lcPQAkj.exe
  C:\Windows\System\lcPQAkj.exe
  2⤵
  PID:13180
- C:\Windows\System\wKVkgVh.exe
  C:\Windows\System\wKVkgVh.exe
  2⤵
  PID:13208
- C:\Windows\System\zOdzRdH.exe
  C:\Windows\System\zOdzRdH.exe
  2⤵
  PID:13236
- C:\Windows\System\JJkBNpQ.exe
  C:\Windows\System\JJkBNpQ.exe
  2⤵
  PID:13260
- C:\Windows\System\ckAzimf.exe
  C:\Windows\System\ckAzimf.exe
  2⤵
  PID:13044
- C:\Windows\System\lepyPbt.exe
  C:\Windows\System\lepyPbt.exe
  2⤵
  PID:13108
- C:\Windows\System\GDJxEgc.exe
  C:\Windows\System\GDJxEgc.exe
  2⤵
  PID:11744
- C:\Windows\System\XtsJtRb.exe
  C:\Windows\System\XtsJtRb.exe
  2⤵
  PID:11524
- C:\Windows\System\sluAiUU.exe
  C:\Windows\System\sluAiUU.exe
  2⤵
  PID:11808
- C:\Windows\System\BiDPoUV.exe
  C:\Windows\System\BiDPoUV.exe
  2⤵
  PID:12296
- C:\Windows\System\mdHyWgf.exe
  C:\Windows\System\mdHyWgf.exe
  2⤵
  PID:11784
- C:\Windows\System\YXeDcWp.exe
  C:\Windows\System\YXeDcWp.exe
  2⤵
  PID:11948
- C:\Windows\System\WaDAHRb.exe
  C:\Windows\System\WaDAHRb.exe
  2⤵
  PID:11060
- C:\Windows\System\ydLffnY.exe
  C:\Windows\System\ydLffnY.exe
  2⤵
  PID:9628
- C:\Windows\System\yKIIRGq.exe
  C:\Windows\System\yKIIRGq.exe
  2⤵
  PID:11456
- C:\Windows\System\VcvKuOx.exe
  C:\Windows\System\VcvKuOx.exe
  2⤵
  PID:10316
- C:\Windows\System\YMaxnav.exe
  C:\Windows\System\YMaxnav.exe
  2⤵
  PID:12676
- C:\Windows\System\XZEjrOq.exe
  C:\Windows\System\XZEjrOq.exe
  2⤵
  PID:12924
- C:\Windows\System\ykwbofP.exe
  C:\Windows\System\ykwbofP.exe
  2⤵
  PID:12964
- C:\Windows\System\ZIotYdv.exe
  C:\Windows\System\ZIotYdv.exe
  2⤵
  PID:13040
- C:\Windows\System\BpXuciu.exe
  C:\Windows\System\BpXuciu.exe
  2⤵
  PID:13168
- C:\Windows\System\VxMUWsY.exe
  C:\Windows\System\VxMUWsY.exe
  2⤵
  PID:12576
- C:\Windows\System\eWzerrz.exe
  C:\Windows\System\eWzerrz.exe
  2⤵
  PID:13036
- C:\Windows\System\fBniDdL.exe
  C:\Windows\System\fBniDdL.exe
  2⤵
  PID:11444
- C:\Windows\System\VXDBPau.exe
  C:\Windows\System\VXDBPau.exe
  2⤵
  PID:9568
- C:\Windows\System\APgQZHj.exe
  C:\Windows\System\APgQZHj.exe
  2⤵
  PID:13268
- C:\Windows\System\OOkGUio.exe
  C:\Windows\System\OOkGUio.exe
  2⤵
  PID:12404
- C:\Windows\System\hlVoDrA.exe
  C:\Windows\System\hlVoDrA.exe
  2⤵
  PID:11504
- C:\Windows\System\mhsimCO.exe
  C:\Windows\System\mhsimCO.exe
  2⤵
  PID:11580
- C:\Windows\System\guyqxqk.exe
  C:\Windows\System\guyqxqk.exe
  2⤵
  PID:12876
- C:\Windows\System\AMuUfqY.exe
  C:\Windows\System\AMuUfqY.exe
  2⤵
  PID:12820
- C:\Windows\System\XDYFPni.exe
  C:\Windows\System\XDYFPni.exe
  2⤵
  PID:12988
- C:\Windows\System\DnZKcED.exe
  C:\Windows\System\DnZKcED.exe
  2⤵
  PID:12276
- C:\Windows\System\RmrwUQq.exe
  C:\Windows\System\RmrwUQq.exe
  2⤵
  PID:11620
- C:\Windows\System\OBOvptv.exe
  C:\Windows\System\OBOvptv.exe
  2⤵
  PID:11980
- C:\Windows\System\gJiTBtb.exe
  C:\Windows\System\gJiTBtb.exe
  2⤵
  PID:1276
- C:\Windows\System\caQTFBF.exe
  C:\Windows\System\caQTFBF.exe
  2⤵
  PID:12468
- C:\Windows\System\pLygTZh.exe
  C:\Windows\System\pLygTZh.exe
  2⤵
  PID:13064
- C:\Windows\System\iwnUFcr.exe
  C:\Windows\System\iwnUFcr.exe
  2⤵
  PID:13224
- C:\Windows\System\GJemolu.exe
  C:\Windows\System\GJemolu.exe
  2⤵
  PID:12696
- C:\Windows\System\jKPPezA.exe
  C:\Windows\System\jKPPezA.exe
  2⤵
  PID:12620
- C:\Windows\System\gOwfzxh.exe
  C:\Windows\System\gOwfzxh.exe
  2⤵
  PID:11552
- C:\Windows\System\idYjAKi.exe
  C:\Windows\System\idYjAKi.exe
  2⤵
  PID:13192
- C:\Windows\System\NkPJpIV.exe
  C:\Windows\System\NkPJpIV.exe
  2⤵
  PID:10356
- C:\Windows\System\djdpGIC.exe
  C:\Windows\System\djdpGIC.exe
  2⤵
  PID:2360
- C:\Windows\System\TRCVmrW.exe
  C:\Windows\System\TRCVmrW.exe
  2⤵
  PID:12736
- C:\Windows\System\zbZDZNA.exe
  C:\Windows\System\zbZDZNA.exe
  2⤵
  PID:10648
- C:\Windows\System\bXxasXf.exe
  C:\Windows\System\bXxasXf.exe
  2⤵
  PID:11932
- C:\Windows\System\iDpzyIV.exe
  C:\Windows\System\iDpzyIV.exe
  2⤵
  PID:10284
- C:\Windows\System\KtkBEKy.exe
  C:\Windows\System\KtkBEKy.exe
  2⤵
  PID:3836
- C:\Windows\System\kfHchHs.exe
  C:\Windows\System\kfHchHs.exe
  2⤵
  PID:10404
- C:\Windows\System\iIMKEYE.exe
  C:\Windows\System\iIMKEYE.exe
  2⤵
  PID:13008
- C:\Windows\System\cSAoJov.exe
  C:\Windows\System\cSAoJov.exe
  2⤵
  PID:3972
- C:\Windows\System\pURmgmG.exe
  C:\Windows\System\pURmgmG.exe
  2⤵
  PID:5096
- C:\Windows\System\rndTKqL.exe
  C:\Windows\System\rndTKqL.exe
  2⤵
  PID:8596
- C:\Windows\System\oFHFUss.exe
  C:\Windows\System\oFHFUss.exe
  2⤵
  PID:3476
- C:\Windows\System\wXpIuJW.exe
  C:\Windows\System\wXpIuJW.exe
  2⤵
  PID:3816
- C:\Windows\System\UkQVjbv.exe
  C:\Windows\System\UkQVjbv.exe
  2⤵
  PID:212
- C:\Windows\System\SvlWGTd.exe
  C:\Windows\System\SvlWGTd.exe
  2⤵
  PID:9184
- C:\Windows\System\TseVtlq.exe
  C:\Windows\System\TseVtlq.exe
  2⤵
  PID:13228
- C:\Windows\System\wuxZkfI.exe
  C:\Windows\System\wuxZkfI.exe
  2⤵
  PID:1944
- C:\Windows\System\WmCeEys.exe
  C:\Windows\System\WmCeEys.exe
  2⤵
  PID:3604
- C:\Windows\System\wxqVxFi.exe
  C:\Windows\System\wxqVxFi.exe
  2⤵
  PID:4780
- C:\Windows\System\DznWlvs.exe
  C:\Windows\System\DznWlvs.exe
  2⤵
  PID:2720
- C:\Windows\System\ffnonlf.exe
  C:\Windows\System\ffnonlf.exe
  2⤵
  PID:10268
- C:\Windows\System\SxueXrf.exe
  C:\Windows\System\SxueXrf.exe
  2⤵
  PID:404
- C:\Windows\System\dXVpNcr.exe
  C:\Windows\System\dXVpNcr.exe
  2⤵
  PID:976
- C:\Windows\System\kTGdpbb.exe
  C:\Windows\System\kTGdpbb.exe
  2⤵
  PID:4276
- C:\Windows\System\GbTkEdx.exe
  C:\Windows\System\GbTkEdx.exe
  2⤵
  PID:3916
- C:\Windows\System\gJFIwsy.exe
  C:\Windows\System\gJFIwsy.exe
  2⤵
  PID:944
- C:\Windows\System\mCaEcHo.exe
  C:\Windows\System\mCaEcHo.exe
  2⤵
  PID:1344
- C:\Windows\System\MZTdsZo.exe
  C:\Windows\System\MZTdsZo.exe
  2⤵
  PID:11368
- C:\Windows\System\fTyTiuu.exe
  C:\Windows\System\fTyTiuu.exe
  2⤵
  PID:1028
- C:\Windows\System\mXAOQnb.exe
  C:\Windows\System\mXAOQnb.exe
  2⤵
  PID:4600
- C:\Windows\System\DcidGCi.exe
  C:\Windows\System\DcidGCi.exe
  2⤵
  PID:5004
- C:\Windows\System\kAAHZCq.exe
  C:\Windows\System\kAAHZCq.exe
  2⤵
  PID:4972
- C:\Windows\System\QduIxoj.exe
  C:\Windows\System\QduIxoj.exe
  2⤵
  PID:4676
- C:\Windows\System\vccASoy.exe
  C:\Windows\System\vccASoy.exe
  2⤵
  PID:4368
- C:\Windows\System\XQllXpt.exe
  C:\Windows\System\XQllXpt.exe
  2⤵
  PID:3504
- C:\Windows\System\dRweGMk.exe
  C:\Windows\System\dRweGMk.exe
  2⤵
  PID:3628
- C:\Windows\System\mNXDdww.exe
  C:\Windows\System\mNXDdww.exe
  2⤵
  PID:4404
- C:\Windows\System\ABwLGqz.exe
  C:\Windows\System\ABwLGqz.exe
  2⤵
  PID:2456
- C:\Windows\System\tTnojQN.exe
  C:\Windows\System\tTnojQN.exe
  2⤵
  PID:2976
- C:\Windows\System\ULbrXSp.exe
  C:\Windows\System\ULbrXSp.exe
  2⤵
  PID:3228
- C:\Windows\System\xcaqPtu.exe
  C:\Windows\System\xcaqPtu.exe
  2⤵
  PID:1672
- C:\Windows\System\rBnpKFx.exe
  C:\Windows\System\rBnpKFx.exe
  2⤵
  PID:1292
- C:\Windows\System\cTSuMou.exe
  C:\Windows\System\cTSuMou.exe
  2⤵
  PID:4932
- C:\Windows\System\PULDOxh.exe
  C:\Windows\System\PULDOxh.exe
  2⤵
  PID:5228
- C:\Windows\System\ZOaFytr.exe
  C:\Windows\System\ZOaFytr.exe
  2⤵
  PID:5360
- C:\Windows\System\TCorWZA.exe
  C:\Windows\System\TCorWZA.exe
  2⤵
  PID:5404
- C:\Windows\System\OZYVDYv.exe
  C:\Windows\System\OZYVDYv.exe
  2⤵
  PID:5652
- C:\Windows\System\vniQryD.exe
  C:\Windows\System\vniQryD.exe
  2⤵
  PID:5812
- C:\Windows\System\WsfhjSZ.exe
  C:\Windows\System\WsfhjSZ.exe
  2⤵
  PID:4480
- C:\Windows\System\JMHYntm.exe
  C:\Windows\System\JMHYntm.exe
  2⤵
  PID:2920
- C:\Windows\System\koWMuap.exe
  C:\Windows\System\koWMuap.exe
  2⤵
  PID:5548
- C:\Windows\System\aXHWAiK.exe
  C:\Windows\System\aXHWAiK.exe
  2⤵
  PID:5304
- C:\Windows\System\AOltSGp.exe
  C:\Windows\System\AOltSGp.exe
  2⤵
  PID:4456
- C:\Windows\System\UkmGBdd.exe
  C:\Windows\System\UkmGBdd.exe
  2⤵
  PID:5028
- C:\Windows\System\SlwleCT.exe
  C:\Windows\System\SlwleCT.exe
  2⤵
  PID:2836
- C:\Windows\System\mibWjGg.exe
  C:\Windows\System\mibWjGg.exe
  2⤵
  PID:716
- C:\Windows\System\gfBXPBI.exe
  C:\Windows\System\gfBXPBI.exe
  2⤵
  PID:5076
- C:\Windows\System\wyXWyUk.exe
  C:\Windows\System\wyXWyUk.exe
  2⤵
  PID:1172
- C:\Windows\System\gNqosIo.exe
  C:\Windows\System\gNqosIo.exe
  2⤵
  PID:2116
- C:\Windows\System\bpmoDSX.exe
  C:\Windows\System\bpmoDSX.exe
  2⤵
  PID:2884
- C:\Windows\System\rzjrCOn.exe
  C:\Windows\System\rzjrCOn.exe
  2⤵
  PID:12596
- C:\Windows\System\XJWpRUD.exe
  C:\Windows\System\XJWpRUD.exe
  2⤵
  PID:844
- C:\Windows\System\LQCQXQb.exe
  C:\Windows\System\LQCQXQb.exe
  2⤵
  PID:1212
- C:\Windows\System\DKRUWWF.exe
  C:\Windows\System\DKRUWWF.exe
  2⤵
  PID:5052
- C:\Windows\System\uFMydLi.exe
  C:\Windows\System\uFMydLi.exe
  2⤵
  PID:5328
- C:\Windows\System\EvdjgYz.exe
  C:\Windows\System\EvdjgYz.exe
  2⤵
  PID:5456
- C:\Windows\System\Voslcyp.exe
  C:\Windows\System\Voslcyp.exe
  2⤵
  PID:5880
- C:\Windows\System\cjLZQHk.exe
  C:\Windows\System\cjLZQHk.exe
  2⤵
  PID:5176
- C:\Windows\System\bWCSsDZ.exe
  C:\Windows\System\bWCSsDZ.exe
  2⤵
  PID:2744
- C:\Windows\System\CSfIjlL.exe
  C:\Windows\System\CSfIjlL.exe
  2⤵
  PID:4552
- C:\Windows\System\KSiUyxg.exe
  C:\Windows\System\KSiUyxg.exe
  2⤵
  PID:3588
- C:\Windows\System\XICOmFg.exe
  C:\Windows\System\XICOmFg.exe
  2⤵
  PID:3368
- C:\Windows\System\YufNxYe.exe
  C:\Windows\System\YufNxYe.exe
  2⤵
  PID:5108
- C:\Windows\System\tgDYXHq.exe
  C:\Windows\System\tgDYXHq.exe
  2⤵
  PID:2628
- C:\Windows\System\Ifrkiwi.exe
  C:\Windows\System\Ifrkiwi.exe
  2⤵
  PID:3144
- C:\Windows\System\TqFdWho.exe
  C:\Windows\System\TqFdWho.exe
  2⤵
  PID:1204
- C:\Windows\System\zESxkAj.exe
  C:\Windows\System\zESxkAj.exe
  2⤵
  PID:4792
- C:\Windows\System\PNGlbeJ.exe
  C:\Windows\System\PNGlbeJ.exe
  2⤵
  PID:1536
- C:\Windows\System\OGVBbJu.exe
  C:\Windows\System\OGVBbJu.exe
  2⤵
  PID:1492
- C:\Windows\System\nryfISM.exe
  C:\Windows\System\nryfISM.exe
  2⤵
  PID:5516
- C:\Windows\System\KmInmMc.exe
  C:\Windows\System\KmInmMc.exe
  2⤵
  PID:5280
- C:\Windows\System\JLYTPjI.exe
  C:\Windows\System\JLYTPjI.exe
  2⤵
  PID:10848
- C:\Windows\System\RmnEqNR.exe
  C:\Windows\System\RmnEqNR.exe
  2⤵
  PID:13324
- C:\Windows\System\YoCHyzB.exe
  C:\Windows\System\YoCHyzB.exe
  2⤵
  PID:13392
- C:\Windows\System\YOvSnlH.exe
  C:\Windows\System\YOvSnlH.exe
  2⤵
  PID:13524
- C:\Windows\System\lRjNRQO.exe
  C:\Windows\System\lRjNRQO.exe
  2⤵
  PID:13540
- C:\Windows\System\sWluZPS.exe
  C:\Windows\System\sWluZPS.exe
  2⤵
  PID:13580
- C:\Windows\System\pqqmMPN.exe
  C:\Windows\System\pqqmMPN.exe
  2⤵
  PID:13612
- C:\Windows\System\mqgDvXz.exe
  C:\Windows\System\mqgDvXz.exe
  2⤵
  PID:13636
- C:\Windows\System\OMIERjR.exe
  C:\Windows\System\OMIERjR.exe
  2⤵
  PID:13668
- C:\Windows\System\aKqBgbf.exe
  C:\Windows\System\aKqBgbf.exe
  2⤵
  PID:13728
- C:\Windows\System\QtGwjMD.exe
  C:\Windows\System\QtGwjMD.exe
  2⤵
  PID:13768
- C:\Windows\System\QQUGhKB.exe
  C:\Windows\System\QQUGhKB.exe
  2⤵
  PID:13796
- C:\Windows\System\HfGOUSe.exe
  C:\Windows\System\HfGOUSe.exe
  2⤵
  PID:13884
- C:\Windows\System\qpxggGp.exe
  C:\Windows\System\qpxggGp.exe
  2⤵
  PID:13908
- C:\Windows\System\AIIgOgG.exe
  C:\Windows\System\AIIgOgG.exe
  2⤵
  PID:13932
- C:\Windows\System\OkDxjMp.exe
  C:\Windows\System\OkDxjMp.exe
  2⤵
  PID:13968
- C:\Windows\System\dMBuDIz.exe
  C:\Windows\System\dMBuDIz.exe
  2⤵
  PID:14004
- C:\Windows\System\IaoIJnu.exe
  C:\Windows\System\IaoIJnu.exe
  2⤵
  PID:14036
- C:\Windows\System\pOvFNCY.exe
  C:\Windows\System\pOvFNCY.exe
  2⤵
  PID:14064
- C:\Windows\System\ggdeVjO.exe
  C:\Windows\System\ggdeVjO.exe
  2⤵
  PID:14092
- C:\Windows\System\rUJsDXQ.exe
  C:\Windows\System\rUJsDXQ.exe
  2⤵
  PID:14108
- C:\Windows\System\thiobUx.exe
  C:\Windows\System\thiobUx.exe
  2⤵
  PID:14128
- C:\Windows\System\ldbmnFE.exe
  C:\Windows\System\ldbmnFE.exe
  2⤵
  PID:14180
- C:\Windows\System\XzUuhHF.exe
  C:\Windows\System\XzUuhHF.exe
  2⤵
  PID:14200
- C:\Windows\System\RcvoNiC.exe
  C:\Windows\System\RcvoNiC.exe
  2⤵
  PID:14248
- C:\Windows\System\YXJmsUO.exe
  C:\Windows\System\YXJmsUO.exe
  2⤵
  PID:14280
- C:\Windows\System\xjvXDSn.exe
  C:\Windows\System\xjvXDSn.exe
  2⤵
  PID:14300
- C:\Windows\System\OZWkMnm.exe
  C:\Windows\System\OZWkMnm.exe
  2⤵
  PID:14316
- C:\Windows\System\elbFexo.exe
  C:\Windows\System\elbFexo.exe
  2⤵
  PID:2580
- C:\Windows\System\MhZgxQG.exe
  C:\Windows\System\MhZgxQG.exe
  2⤵
  PID:13564
- C:\Windows\System\vZLbwHy.exe
  C:\Windows\System\vZLbwHy.exe
  2⤵
  PID:13572
- C:\Windows\System\ZSQpdDy.exe
  C:\Windows\System\ZSQpdDy.exe
  2⤵
  PID:13664
- C:\Windows\System\nJnWNKm.exe
  C:\Windows\System\nJnWNKm.exe
  2⤵
  PID:13780
- C:\Windows\System\TeHPNcK.exe
  C:\Windows\System\TeHPNcK.exe
  2⤵
  PID:13848
- C:\Windows\System\jwGMJsI.exe
  C:\Windows\System\jwGMJsI.exe
  2⤵
  PID:13868
- C:\Windows\System\fxDozzB.exe
  C:\Windows\System\fxDozzB.exe
  2⤵
  PID:13700
- C:\Windows\System\gMuRZom.exe
  C:\Windows\System\gMuRZom.exe
  2⤵
  PID:13760
- C:\Windows\System\tSNRMqo.exe
  C:\Windows\System\tSNRMqo.exe
  2⤵
  PID:13812
- C:\Windows\System\RfBMmBX.exe
  C:\Windows\System\RfBMmBX.exe
  2⤵
  PID:14028
- C:\Windows\System\WdeTezB.exe
  C:\Windows\System\WdeTezB.exe
  2⤵
  PID:13948
- C:\Windows\System\LVQnRUz.exe
  C:\Windows\System\LVQnRUz.exe
  2⤵
  PID:13988
- C:\Windows\System\FTtpMwf.exe
  C:\Windows\System\FTtpMwf.exe
  2⤵
  PID:14020
- C:\Windows\System\gEZfCwi.exe
  C:\Windows\System\gEZfCwi.exe
  2⤵
  PID:14216
- C:\Windows\System\sRHlCcR.exe
  C:\Windows\System\sRHlCcR.exe
  2⤵
  PID:14296
- C:\Windows\System\ZFmcvUr.exe
  C:\Windows\System\ZFmcvUr.exe
  2⤵
  PID:372
- C:\Windows\System\TVCudPY.exe
  C:\Windows\System\TVCudPY.exe
  2⤵
  PID:14244
- C:\Windows\System\LFPqQNM.exe
  C:\Windows\System\LFPqQNM.exe
  2⤵
  PID:13420
- C:\Windows\System\RBMkYkR.exe
  C:\Windows\System\RBMkYkR.exe
  2⤵
  PID:13740
- C:\Windows\System\amQsrWn.exe
  C:\Windows\System\amQsrWn.exe
  2⤵
  PID:5808
- C:\Windows\System\fLWohvJ.exe
  C:\Windows\System\fLWohvJ.exe
  2⤵
  PID:14268
- C:\Windows\System\JAtVkKb.exe
  C:\Windows\System\JAtVkKb.exe
  2⤵
  PID:13492
- C:\Windows\System\zUmaOEV.exe
  C:\Windows\System\zUmaOEV.exe
  2⤵
  PID:5888
- C:\Windows\System\NqiHtAp.exe
  C:\Windows\System\NqiHtAp.exe
  2⤵
  PID:14024
- C:\Windows\System\bhkCWYR.exe
  C:\Windows\System\bhkCWYR.exe
  2⤵
  PID:14156
- C:\Windows\System\TFaFJpU.exe
  C:\Windows\System\TFaFJpU.exe
  2⤵
  PID:3052
- C:\Windows\System\vsmshcg.exe
  C:\Windows\System\vsmshcg.exe
  2⤵
  PID:5284
- C:\Windows\System\MiHhiMg.exe
  C:\Windows\System\MiHhiMg.exe
  2⤵
  PID:14000
- C:\Windows\System\SlkGpTS.exe
  C:\Windows\System\SlkGpTS.exe
  2⤵
  PID:6456
- C:\Windows\System\mogFWMB.exe
  C:\Windows\System\mogFWMB.exe
  2⤵
  PID:6044
- C:\Windows\System\BjBPHtn.exe
  C:\Windows\System\BjBPHtn.exe
  2⤵
  PID:5532
- C:\Windows\System\lpJWYTO.exe
  C:\Windows\System\lpJWYTO.exe
  2⤵
  PID:13944
- C:\Windows\System\IDfTiwM.exe
  C:\Windows\System\IDfTiwM.exe
  2⤵
  PID:13764
- C:\Windows\System\xdSQkGp.exe
  C:\Windows\System\xdSQkGp.exe
  2⤵
  PID:5460
- C:\Windows\System\CTSyWnl.exe
  C:\Windows\System\CTSyWnl.exe
  2⤵
  PID:6024
- C:\Windows\System\GQmPwJB.exe
  C:\Windows\System\GQmPwJB.exe
  2⤵
  PID:5132
- C:\Windows\System\gpHBCpX.exe
  C:\Windows\System\gpHBCpX.exe
  2⤵
  PID:6204
- C:\Windows\System\BWUmxQR.exe
  C:\Windows\System\BWUmxQR.exe
  2⤵
  PID:14240
- C:\Windows\System\QEaOJWU.exe
  C:\Windows\System\QEaOJWU.exe
  2⤵
  PID:7036
- C:\Windows\System\ltLpKdf.exe
  C:\Windows\System\ltLpKdf.exe
  2⤵
  PID:6476
- C:\Windows\System\WeFeyVj.exe
  C:\Windows\System\WeFeyVj.exe
  2⤵
  PID:13696
- C:\Windows\System\iArWwcX.exe
  C:\Windows\System\iArWwcX.exe
  2⤵
  PID:6008
- C:\Windows\System\YtTrmKt.exe
  C:\Windows\System\YtTrmKt.exe
  2⤵
  PID:13596
- C:\Windows\System\auDIOsW.exe
  C:\Windows\System\auDIOsW.exe
  2⤵
  PID:13856
- C:\Windows\System\pBfAfFO.exe
  C:\Windows\System\pBfAfFO.exe
  2⤵
  PID:7092
- C:\Windows\System\wlRPgoP.exe
  C:\Windows\System\wlRPgoP.exe
  2⤵
  PID:13676
- C:\Windows\System\KHHOpQL.exe
  C:\Windows\System\KHHOpQL.exe
  2⤵
  PID:14072
- C:\Windows\System\rcQslmF.exe
  C:\Windows\System\rcQslmF.exe
  2⤵
  PID:13828
- C:\Windows\System\ACcJsMg.exe
  C:\Windows\System\ACcJsMg.exe
  2⤵
  PID:7276
- C:\Windows\System\zzizcYN.exe
  C:\Windows\System\zzizcYN.exe
  2⤵
  PID:6960
- C:\Windows\System\vObdaFl.exe
  C:\Windows\System\vObdaFl.exe
  2⤵
  PID:13716
- C:\Windows\System\OJIxzTA.exe
  C:\Windows\System\OJIxzTA.exe
  2⤵
  PID:5992
- C:\Windows\System\emDtJWb.exe
  C:\Windows\System\emDtJWb.exe
  2⤵
  PID:14208
- C:\Windows\System\nuAawPF.exe
  C:\Windows\System\nuAawPF.exe
  2⤵
  PID:7164
- C:\Windows\System\jmXkiHF.exe
  C:\Windows\System\jmXkiHF.exe
  2⤵
  PID:6240
- C:\Windows\System\PJaDzFx.exe
  C:\Windows\System\PJaDzFx.exe
  2⤵
  PID:13808
- C:\Windows\System\UftBQyL.exe
  C:\Windows\System\UftBQyL.exe
  2⤵
  PID:6516
- C:\Windows\System\VYPsGNH.exe
  C:\Windows\System\VYPsGNH.exe
  2⤵
  PID:6056
- C:\Windows\System\RlKOYzD.exe
  C:\Windows\System\RlKOYzD.exe
  2⤵
  PID:12848
- C:\Windows\System\dWthfkq.exe
  C:\Windows\System\dWthfkq.exe
  2⤵
  PID:5424
- C:\Windows\System\wkyNvfV.exe
  C:\Windows\System\wkyNvfV.exe
  2⤵
  PID:7668
- C:\Windows\System\VxiWQCM.exe
  C:\Windows\System\VxiWQCM.exe
  2⤵
  PID:14236
- C:\Windows\System\OrJkdRN.exe
  C:\Windows\System\OrJkdRN.exe
  2⤵
  PID:13880
- C:\Windows\System\XfHsmFk.exe
  C:\Windows\System\XfHsmFk.exe
  2⤵
  PID:7204
- C:\Windows\System\REIuMCH.exe
  C:\Windows\System\REIuMCH.exe
  2⤵
  PID:6936
- C:\Windows\System\KLIAxtD.exe
  C:\Windows\System\KLIAxtD.exe
  2⤵
  PID:13840
- C:\Windows\System\tWFMCzx.exe
  C:\Windows\System\tWFMCzx.exe
  2⤵
  PID:13956
- C:\Windows\System\CTfMaHl.exe
  C:\Windows\System\CTfMaHl.exe
  2⤵
  PID:6180
- C:\Windows\System\XlSnPiq.exe
  C:\Windows\System\XlSnPiq.exe
  2⤵
  PID:6592
- C:\Windows\System\CsoFNAn.exe
  C:\Windows\System\CsoFNAn.exe
  2⤵
  PID:13724
- C:\Windows\System\vpFBarH.exe
  C:\Windows\System\vpFBarH.exe
  2⤵
  PID:5864
- C:\Windows\System\JEHeiof.exe
  C:\Windows\System\JEHeiof.exe
  2⤵
  PID:13472
- C:\Windows\System\moqFjBC.exe
  C:\Windows\System\moqFjBC.exe
  2⤵
  PID:6560
- C:\Windows\System\WEljPEU.exe
  C:\Windows\System\WEljPEU.exe
  2⤵
  PID:5788
- C:\Windows\System\nVFzQqG.exe
  C:\Windows\System\nVFzQqG.exe
  2⤵
  PID:7300
- C:\Windows\System\DGECoYC.exe
  C:\Windows\System\DGECoYC.exe
  2⤵
  PID:5740
- C:\Windows\System\OyXzCkG.exe
  C:\Windows\System\OyXzCkG.exe
  2⤵
  PID:720
- C:\Windows\System\IPbalsn.exe
  C:\Windows\System\IPbalsn.exe
  2⤵
  PID:6968
- C:\Windows\System\OulfEtI.exe
  C:\Windows\System\OulfEtI.exe
  2⤵
  PID:14188
- C:\Windows\System\IOTazIG.exe
  C:\Windows\System\IOTazIG.exe
  2⤵
  PID:13756
- C:\Windows\System\HWZeGQl.exe
  C:\Windows\System\HWZeGQl.exe
  2⤵
  PID:13864
- C:\Windows\System\SeipbHw.exe
  C:\Windows\System\SeipbHw.exe
  2⤵
  PID:14272
- C:\Windows\System\MgNJFWt.exe
  C:\Windows\System\MgNJFWt.exe
  2⤵
  PID:7504
- C:\Windows\System\viDpaoO.exe
  C:\Windows\System\viDpaoO.exe
  2⤵
  PID:3456
- C:\Windows\System\yhPUwGh.exe
  C:\Windows\System\yhPUwGh.exe
  2⤵
  PID:7572
- C:\Windows\System\MPCuAvM.exe
  C:\Windows\System\MPCuAvM.exe
  2⤵
  PID:5648
- C:\Windows\System\mvMeuzy.exe
  C:\Windows\System\mvMeuzy.exe
  2⤵
  PID:4812
- C:\Windows\System\InJRHJW.exe
  C:\Windows\System\InJRHJW.exe
  2⤵
  PID:6328
- C:\Windows\System\MDNHNoQ.exe
  C:\Windows\System\MDNHNoQ.exe
  2⤵
  PID:6120
- C:\Windows\System\bXfJRYj.exe
  C:\Windows\System\bXfJRYj.exe
  2⤵
  PID:7412
- C:\Windows\System\DLdTYvp.exe
  C:\Windows\System\DLdTYvp.exe
  2⤵
  PID:7432
- C:\Windows\System\VPmdwUh.exe
  C:\Windows\System\VPmdwUh.exe
  2⤵
  PID:6852
- C:\Windows\System\VhEygXM.exe
  C:\Windows\System\VhEygXM.exe
  2⤵
  PID:6156
- C:\Windows\System\cBHERTu.exe
  C:\Windows\System\cBHERTu.exe
  2⤵
  PID:14352
- C:\Windows\System\vSFMtJQ.exe
  C:\Windows\System\vSFMtJQ.exe
  2⤵
  PID:14492
- C:\Windows\System\CrXLSNW.exe
  C:\Windows\System\CrXLSNW.exe
  2⤵
  PID:14516
- C:\Windows\System\FDzuSLx.exe
  C:\Windows\System\FDzuSLx.exe
  2⤵
  PID:14540
- C:\Windows\System\VEUJPVN.exe
  C:\Windows\System\VEUJPVN.exe
  2⤵
  PID:14556
- C:\Windows\System\KmMvbpI.exe
  C:\Windows\System\KmMvbpI.exe
  2⤵
  PID:14576
- C:\Windows\System\bseMdvI.exe
  C:\Windows\System\bseMdvI.exe
  2⤵
  PID:14592
- C:\Windows\System\ufSbnVo.exe
  C:\Windows\System\ufSbnVo.exe
  2⤵
  PID:14616
- C:\Windows\System\uVLMxSP.exe
  C:\Windows\System\uVLMxSP.exe
  2⤵
  PID:14652
- C:\Windows\System\RUEanSU.exe
  C:\Windows\System\RUEanSU.exe
  2⤵
  PID:14672
- C:\Windows\System\cNnoGjG.exe
  C:\Windows\System\cNnoGjG.exe
  2⤵
  PID:14712
- C:\Windows\System\KReqIUE.exe
  C:\Windows\System\KReqIUE.exe
  2⤵
  PID:14736
- C:\Windows\System\ERUnBuy.exe
  C:\Windows\System\ERUnBuy.exe
  2⤵
  PID:14788
- C:\Windows\System\jHjJVBq.exe
  C:\Windows\System\jHjJVBq.exe
  2⤵
  PID:14824
- C:\Windows\System\fWolDVx.exe
  C:\Windows\System\fWolDVx.exe
  2⤵
  PID:14864
- C:\Windows\System\LmokQHF.exe
  C:\Windows\System\LmokQHF.exe
  2⤵
  PID:14896
- C:\Windows\System\VDhyAff.exe
  C:\Windows\System\VDhyAff.exe
  2⤵
  PID:14940
- C:\Windows\System\szHURgr.exe
  C:\Windows\System\szHURgr.exe
  2⤵
  PID:14968
- C:\Windows\System\ZUqCLdn.exe
  C:\Windows\System\ZUqCLdn.exe
  2⤵
  PID:14992
- C:\Windows\System\dKiybXn.exe
  C:\Windows\System\dKiybXn.exe
  2⤵
  PID:15020
- C:\Windows\System\URycNlv.exe
  C:\Windows\System\URycNlv.exe
  2⤵
  PID:15056
- C:\Windows\System\xCaOoWw.exe
  C:\Windows\System\xCaOoWw.exe
  2⤵
  PID:15084
- C:\Windows\System\qiZzjvX.exe
  C:\Windows\System\qiZzjvX.exe
  2⤵
  PID:15116
- C:\Windows\System\aeDIGPF.exe
  C:\Windows\System\aeDIGPF.exe
  2⤵
  PID:15152
- C:\Windows\System\COLAtne.exe
  C:\Windows\System\COLAtne.exe
  2⤵
  PID:15168
- C:\Windows\System\mRtwhfM.exe
  C:\Windows\System\mRtwhfM.exe
  2⤵
  PID:15232
- C:\Windows\System\FYiYHSI.exe
  C:\Windows\System\FYiYHSI.exe
  2⤵
  PID:15264
- C:\Windows\System\xvYBrCh.exe
  C:\Windows\System\xvYBrCh.exe
  2⤵
  PID:15300
- C:\Windows\System\XQSWaXU.exe
  C:\Windows\System\XQSWaXU.exe
  2⤵
  PID:15340
- C:\Windows\System\nmEkqBx.exe
  C:\Windows\System\nmEkqBx.exe
  2⤵
  PID:5820
- C:\Windows\System\mdkLUdM.exe
  C:\Windows\System\mdkLUdM.exe
  2⤵
  PID:7652
- C:\Windows\System\iibYsYb.exe
  C:\Windows\System\iibYsYb.exe
  2⤵
  PID:7288
- C:\Windows\System\aeNRgKm.exe
  C:\Windows\System\aeNRgKm.exe
  2⤵
  PID:7544
- C:\Windows\System\OPHWyBM.exe
  C:\Windows\System\OPHWyBM.exe
  2⤵
  PID:6952
- C:\Windows\System\cuzwanY.exe
  C:\Windows\System\cuzwanY.exe
  2⤵
  PID:4924
- C:\Windows\System\RXZGTRL.exe
  C:\Windows\System\RXZGTRL.exe
  2⤵
  PID:6772
- C:\Windows\System\nyvhtad.exe
  C:\Windows\System\nyvhtad.exe
  2⤵
  PID:8012
- C:\Windows\System\DePCJdt.exe
  C:\Windows\System\DePCJdt.exe
  2⤵
  PID:8396
- C:\Windows\System\XkvqOTG.exe
  C:\Windows\System\XkvqOTG.exe
  2⤵
  PID:7948
- C:\Windows\System\OIsZAZn.exe
  C:\Windows\System\OIsZAZn.exe
  2⤵
  PID:8400
- C:\Windows\System\hjfBUAl.exe
  C:\Windows\System\hjfBUAl.exe
  2⤵
  PID:8720
- C:\Windows\System\xxwmODt.exe
  C:\Windows\System\xxwmODt.exe
  2⤵
  PID:13452
- C:\Windows\System\tkUGOoi.exe
  C:\Windows\System\tkUGOoi.exe
  2⤵
  PID:7280
- C:\Windows\System\nujxEAR.exe
  C:\Windows\System\nujxEAR.exe
  2⤵
  PID:7084
- C:\Windows\System\hJkHdXk.exe
  C:\Windows\System\hJkHdXk.exe
  2⤵
  PID:8564
- C:\Windows\System\RfLYBBU.exe
  C:\Windows\System\RfLYBBU.exe
  2⤵
  PID:3308
- C:\Windows\System\bhvIHiY.exe
  C:\Windows\System\bhvIHiY.exe
  2⤵
  PID:14552
- C:\Windows\System\MPQsPnv.exe
  C:\Windows\System\MPQsPnv.exe
  2⤵
  PID:14568
- C:\Windows\System\pcrPbUg.exe
  C:\Windows\System\pcrPbUg.exe
  2⤵
  PID:8484
- C:\Windows\System\YFYSTAE.exe
  C:\Windows\System\YFYSTAE.exe
  2⤵
  PID:7304
- C:\Windows\System\EMXBpjD.exe
  C:\Windows\System\EMXBpjD.exe
  2⤵
  PID:6708
- C:\Windows\System\ACAtXQR.exe
  C:\Windows\System\ACAtXQR.exe
  2⤵
  PID:14700
- C:\Windows\System\TJGuQed.exe
  C:\Windows\System\TJGuQed.exe
  2⤵
  PID:14380
- C:\Windows\System\yUxozvb.exe
  C:\Windows\System\yUxozvb.exe
  2⤵
  PID:14384
- C:\Windows\System\QbmpvsX.exe
  C:\Windows\System\QbmpvsX.exe
  2⤵
  PID:14800
- C:\Windows\System\ZpkkLIO.exe
  C:\Windows\System\ZpkkLIO.exe
  2⤵
  PID:14832
- C:\Windows\System\QwgFVaU.exe
  C:\Windows\System\QwgFVaU.exe
  2⤵
  PID:14452
- C:\Windows\System\ibrFZGi.exe
  C:\Windows\System\ibrFZGi.exe
  2⤵
  PID:14880
- C:\Windows\System\rVLuJdb.exe
  C:\Windows\System\rVLuJdb.exe
  2⤵
  PID:7800
- C:\Windows\System\bwcokxn.exe
  C:\Windows\System\bwcokxn.exe
  2⤵
  PID:14960
- C:\Windows\System\nyFtyhs.exe
  C:\Windows\System\nyFtyhs.exe
  2⤵
  PID:7616
- C:\Windows\System\LnBOUav.exe
  C:\Windows\System\LnBOUav.exe
  2⤵
  PID:14988
- C:\Windows\System\GJlioNT.exe
  C:\Windows\System\GJlioNT.exe
  2⤵
  PID:7784
- C:\Windows\System\LHqpLzf.exe
  C:\Windows\System\LHqpLzf.exe
  2⤵
  PID:15032
- C:\Windows\System\yTBMDdT.exe
  C:\Windows\System\yTBMDdT.exe
  2⤵
  PID:14684
- C:\Windows\System\rsRWkUl.exe
  C:\Windows\System\rsRWkUl.exe
  2⤵
  PID:7860
- C:\Windows\System\TCLgUNr.exe
  C:\Windows\System\TCLgUNr.exe
  2⤵
  PID:1048
- C:\Windows\System\nxRVvqQ.exe
  C:\Windows\System\nxRVvqQ.exe
  2⤵
  PID:7984
- C:\Windows\System\NsMqmgM.exe
  C:\Windows\System\NsMqmgM.exe
  2⤵
  PID:8916
- C:\Windows\System\PRVTcPC.exe
  C:\Windows\System\PRVTcPC.exe
  2⤵
  PID:9824
- C:\Windows\System\GyLszHP.exe
  C:\Windows\System\GyLszHP.exe
  2⤵
  PID:9944
- C:\Windows\System\qZNgCsG.exe
  C:\Windows\System\qZNgCsG.exe
  2⤵
  PID:8224
- C:\Windows\System\MCmkFYM.exe
  C:\Windows\System\MCmkFYM.exe
  2⤵
  PID:8180
- C:\Windows\System\AYQoRWi.exe
  C:\Windows\System\AYQoRWi.exe
  2⤵
  PID:9540
- C:\Windows\System\vzsjbAx.exe
  C:\Windows\System\vzsjbAx.exe
  2⤵
  PID:7760
- C:\Windows\System\fwrQUnF.exe
  C:\Windows\System\fwrQUnF.exe
  2⤵
  PID:6544
- C:\Windows\System\BxnmtQu.exe
  C:\Windows\System\BxnmtQu.exe
  2⤵
  PID:7108
- C:\Windows\System\TBYQoiB.exe
  C:\Windows\System\TBYQoiB.exe
  2⤵
  PID:14884
- C:\Windows\System\eZkrCmd.exe
  C:\Windows\System\eZkrCmd.exe
  2⤵
  PID:7492
- C:\Windows\System\qOojnPS.exe
  C:\Windows\System\qOojnPS.exe
  2⤵
  PID:8864
- C:\Windows\System\nmaucne.exe
  C:\Windows\System\nmaucne.exe
  2⤵
  PID:13512
- C:\Windows\System\cscQFwg.exe
  C:\Windows\System\cscQFwg.exe
  2⤵
  PID:15316
- C:\Windows\System\JfKBWwf.exe
  C:\Windows\System\JfKBWwf.exe
  2⤵
  PID:9384
- C:\Windows\System\vlilcai.exe
  C:\Windows\System\vlilcai.exe
  2⤵
  PID:8700
- C:\Windows\System\oiZIEfp.exe
  C:\Windows\System\oiZIEfp.exe
  2⤵
  PID:10248
- C:\Windows\System\yopUkaU.exe
  C:\Windows\System\yopUkaU.exe
  2⤵
  PID:10416
- C:\Windows\System\oEcGwaM.exe
  C:\Windows\System\oEcGwaM.exe
  2⤵
  PID:11000
- C:\Windows\System\HVqRXaw.exe
  C:\Windows\System\HVqRXaw.exe
  2⤵
  PID:9396
- C:\Windows\System\VfaKnEl.exe
  C:\Windows\System\VfaKnEl.exe
  2⤵
  PID:10792
- C:\Windows\System\VirlgUK.exe
  C:\Windows\System\VirlgUK.exe
  2⤵
  PID:10532
- C:\Windows\System\fQJosND.exe
  C:\Windows\System\fQJosND.exe
  2⤵
  PID:13460
- C:\Windows\System\bFklUSG.exe
  C:\Windows\System\bFklUSG.exe
  2⤵
  PID:14780
- C:\Windows\System\ZxFEYxV.exe
  C:\Windows\System\ZxFEYxV.exe
  2⤵
  PID:9208
- C:\Windows\System\UmCTPza.exe
  C:\Windows\System\UmCTPza.exe
  2⤵
  PID:6972
- C:\Windows\System\uMhnhbi.exe
  C:\Windows\System\uMhnhbi.exe
  2⤵
  PID:6312
- C:\Windows\System\ucHfVNK.exe
  C:\Windows\System\ucHfVNK.exe
  2⤵
  PID:10724
- C:\Windows\System\KNYnbRv.exe
  C:\Windows\System\KNYnbRv.exe
  2⤵
  PID:7048
- C:\Windows\System\hpZNhpb.exe
  C:\Windows\System\hpZNhpb.exe
  2⤵
  PID:14808
- C:\Windows\System\uvQEkru.exe
  C:\Windows\System\uvQEkru.exe
  2⤵
  PID:10836
- C:\Windows\System\oXurWCX.exe
  C:\Windows\System\oXurWCX.exe
  2⤵
  PID:10856
- C:\Windows\System\pSDlqJR.exe
  C:\Windows\System\pSDlqJR.exe
  2⤵
  PID:8276
- C:\Windows\System\AhyrzVe.exe
  C:\Windows\System\AhyrzVe.exe
  2⤵
  PID:14928
- C:\Windows\System\pNCVdTQ.exe
  C:\Windows\System\pNCVdTQ.exe
  2⤵
  PID:11132
- C:\Windows\System\aeZbcNp.exe
  C:\Windows\System\aeZbcNp.exe
  2⤵
  PID:11200
- C:\Windows\System\gZwwrFn.exe
  C:\Windows\System\gZwwrFn.exe
  2⤵
  PID:15188
- C:\Windows\System\wqbSmKU.exe
  C:\Windows\System\wqbSmKU.exe
  2⤵
  PID:14404
- C:\Windows\System\pukalQJ.exe
  C:\Windows\System\pukalQJ.exe
  2⤵
  PID:8404
- C:\Windows\System\XRBLQHI.exe
  C:\Windows\System\XRBLQHI.exe
  2⤵
  PID:6768
- C:\Windows\System\ypFHejc.exe
  C:\Windows\System\ypFHejc.exe
  2⤵
  PID:8208
- C:\Windows\System\rvQequR.exe
  C:\Windows\System\rvQequR.exe
  2⤵
  PID:5656
- C:\Windows\System\jKvZXNt.exe
  C:\Windows\System\jKvZXNt.exe
  2⤵
  PID:10696
- C:\Windows\System\tybdBbK.exe
  C:\Windows\System\tybdBbK.exe
  2⤵
  PID:9236
- C:\Windows\System\SvCuHcF.exe
  C:\Windows\System\SvCuHcF.exe
  2⤵
  PID:3752
- C:\Windows\System\fNOVWZk.exe
  C:\Windows\System\fNOVWZk.exe
  2⤵
  PID:14952
- C:\Windows\System\qyrrzud.exe
  C:\Windows\System\qyrrzud.exe
  2⤵
  PID:10880
- C:\Windows\System\KDYmJtM.exe
  C:\Windows\System\KDYmJtM.exe
  2⤵
  PID:11360
- C:\Windows\System\NxRNloF.exe
  C:\Windows\System\NxRNloF.exe
  2⤵
  PID:9564
- C:\Windows\System\HmHwvmH.exe
  C:\Windows\System\HmHwvmH.exe
  2⤵
  PID:11628
- C:\Windows\System\hJKYAXm.exe
  C:\Windows\System\hJKYAXm.exe
  2⤵
  PID:8348
- C:\Windows\System\eoZehIg.exe
  C:\Windows\System\eoZehIg.exe
  2⤵
  PID:10872
- C:\Windows\System\BiiSRdf.exe
  C:\Windows\System\BiiSRdf.exe
  2⤵
  PID:9772
- C:\Windows\System\hOBkClY.exe
  C:\Windows\System\hOBkClY.exe
  2⤵
  PID:9076
- C:\Windows\System\tStjHql.exe
  C:\Windows\System\tStjHql.exe
  2⤵
  PID:6832
- C:\Windows\System\UmKXeCO.exe
  C:\Windows\System\UmKXeCO.exe
  2⤵
  PID:13476
- C:\Windows\System\hXbAFMs.exe
  C:\Windows\System\hXbAFMs.exe
  2⤵
  PID:7712
- C:\Windows\System\KyPIwEC.exe
  C:\Windows\System\KyPIwEC.exe
  2⤵
  PID:13508
- C:\Windows\System\XdBNqbZ.exe
  C:\Windows\System\XdBNqbZ.exe
  2⤵
  PID:10932
- C:\Windows\System\pgTHzQI.exe
  C:\Windows\System\pgTHzQI.exe
  2⤵
  PID:5204
- C:\Windows\System\demfWsS.exe
  C:\Windows\System\demfWsS.exe
  2⤵
  PID:11256
- C:\Windows\System\IBBZzcT.exe
  C:\Windows\System\IBBZzcT.exe
  2⤵
  PID:9936
- C:\Windows\System\mCVDUgu.exe
  C:\Windows\System\mCVDUgu.exe
  2⤵
  PID:11292
- C:\Windows\System\jRlUPZM.exe
  C:\Windows\System\jRlUPZM.exe
  2⤵
  PID:11112
- C:\Windows\System\ImAZuTJ.exe
  C:\Windows\System\ImAZuTJ.exe
  2⤵
  PID:9488
- C:\Windows\System\RpfyCCq.exe
  C:\Windows\System\RpfyCCq.exe
  2⤵
  PID:11684
- C:\Windows\System\XSrfeHX.exe
  C:\Windows\System\XSrfeHX.exe
  2⤵
  PID:12284
- C:\Windows\System\dbIEryj.exe
  C:\Windows\System\dbIEryj.exe
  2⤵
  PID:11992
- C:\Windows\System\IXntpQz.exe
  C:\Windows\System\IXntpQz.exe
  2⤵
  PID:7688
- C:\Windows\System\RDuRYXJ.exe
  C:\Windows\System\RDuRYXJ.exe
  2⤵
  PID:7976
- C:\Windows\System\CpDwrRo.exe
  C:\Windows\System\CpDwrRo.exe
  2⤵
  PID:10864
- C:\Windows\System\DjayYcW.exe
  C:\Windows\System\DjayYcW.exe
  2⤵
  PID:8784
- C:\Windows\System\KJLHfwh.exe
  C:\Windows\System\KJLHfwh.exe
  2⤵
  PID:10200
- C:\Windows\System\msRRsbH.exe
  C:\Windows\System\msRRsbH.exe
  2⤵
  PID:12224
- C:\Windows\System\aHnhEvn.exe
  C:\Windows\System\aHnhEvn.exe
  2⤵
  PID:14872
- C:\Windows\System\BjDbzzy.exe
  C:\Windows\System\BjDbzzy.exe
  2⤵
  PID:13200
- C:\Windows\System\CrKxnnu.exe
  C:\Windows\System\CrKxnnu.exe
  2⤵
  PID:8488
- C:\Windows\System\pcbTsuW.exe
  C:\Windows\System\pcbTsuW.exe
  2⤵
  PID:10808
- C:\Windows\System\pELfmqi.exe
  C:\Windows\System\pELfmqi.exe
  2⤵
  PID:11028
- C:\Windows\System\mYVMwhd.exe
  C:\Windows\System\mYVMwhd.exe
  2⤵
  PID:10844
- C:\Windows\System\nUMdNtC.exe
  C:\Windows\System\nUMdNtC.exe
  2⤵
  PID:14724
- C:\Windows\System\abhoFOn.exe
  C:\Windows\System\abhoFOn.exe
  2⤵
  PID:12648
- C:\Windows\System\nyJMWGS.exe
  C:\Windows\System\nyJMWGS.exe
  2⤵
  PID:4344
- C:\Windows\System\fZFIFDe.exe
  C:\Windows\System\fZFIFDe.exe
  2⤵
  PID:11168
- C:\Windows\System\jHIFdms.exe
  C:\Windows\System\jHIFdms.exe
  2⤵
  PID:12868
- C:\Windows\System\hTVPKZk.exe
  C:\Windows\System\hTVPKZk.exe
  2⤵
  PID:8664
- C:\Windows\System\NWuXjgc.exe
  C:\Windows\System\NWuXjgc.exe
  2⤵
  PID:14432
- C:\Windows\System\DagktwQ.exe
  C:\Windows\System\DagktwQ.exe
  2⤵
  PID:15224
- C:\Windows\System\rbtNIlw.exe
  C:\Windows\System\rbtNIlw.exe
  2⤵
  PID:8572
- C:\Windows\System\lXBZKkC.exe
  C:\Windows\System\lXBZKkC.exe
  2⤵
  PID:12464
- C:\Windows\System\MOBMEjZ.exe
  C:\Windows\System\MOBMEjZ.exe
  2⤵
  PID:9088
- C:\Windows\System\DvgsohE.exe
  C:\Windows\System\DvgsohE.exe
  2⤵
  PID:13056
- C:\Windows\System\bcqGRBF.exe
  C:\Windows\System\bcqGRBF.exe
  2⤵
  PID:9368
- C:\Windows\System\pJpvLmb.exe
  C:\Windows\System\pJpvLmb.exe
  2⤵
  PID:10180
- C:\Windows\System\sWmCWKH.exe
  C:\Windows\System\sWmCWKH.exe
  2⤵
  PID:10044
- C:\Windows\System\ctKtkEv.exe
  C:\Windows\System\ctKtkEv.exe
  2⤵
  PID:6692
- C:\Windows\System\marrNHU.exe
  C:\Windows\System\marrNHU.exe
  2⤵
  PID:13112
- C:\Windows\System\JGaPllO.exe
  C:\Windows\System\JGaPllO.exe
  2⤵
  PID:11680
- C:\Windows\System\RJDVLUO.exe
  C:\Windows\System\RJDVLUO.exe
  2⤵
  PID:10748
- C:\Windows\System\hZKjuRN.exe
  C:\Windows\System\hZKjuRN.exe
  2⤵
  PID:10828
- C:\Windows\System\UvRiYkW.exe
  C:\Windows\System\UvRiYkW.exe
  2⤵
  PID:11528
- C:\Windows\System\OChBLGb.exe
  C:\Windows\System\OChBLGb.exe
  2⤵
  PID:10348
- C:\Windows\System\vVcMFmb.exe
  C:\Windows\System\vVcMFmb.exe
  2⤵
  PID:6452
- C:\Windows\System\iKuCYcL.exe
  C:\Windows\System\iKuCYcL.exe
  2⤵
  PID:14600
- C:\Windows\System\LCbdNxe.exe
  C:\Windows\System\LCbdNxe.exe
  2⤵
  PID:12724
- C:\Windows\System\AlFZphU.exe
  C:\Windows\System\AlFZphU.exe
  2⤵
  PID:10580
- C:\Windows\System\gONVTZn.exe
  C:\Windows\System\gONVTZn.exe
  2⤵
  PID:10948
- C:\Windows\System\qRotAqX.exe
  C:\Windows\System\qRotAqX.exe
  2⤵
  PID:9792
- C:\Windows\System\IoLKuVH.exe
  C:\Windows\System\IoLKuVH.exe
  2⤵
  PID:10464
- C:\Windows\System\TxqhmPQ.exe
  C:\Windows\System\TxqhmPQ.exe
  2⤵
  PID:15040
- C:\Windows\System\zlQwGcB.exe
  C:\Windows\System\zlQwGcB.exe
  2⤵
  PID:12788
- C:\Windows\System\inSMnXT.exe
  C:\Windows\System\inSMnXT.exe
  2⤵
  PID:10332
- C:\Windows\System\iJUxptH.exe
  C:\Windows\System\iJUxptH.exe
  2⤵
  PID:11088
- C:\Windows\System\zvxxWvB.exe
  C:\Windows\System\zvxxWvB.exe
  2⤵
  PID:9972
- C:\Windows\System\bSBrJnL.exe
  C:\Windows\System\bSBrJnL.exe
  2⤵
  PID:12008
- C:\Windows\System\SMmqsLd.exe
  C:\Windows\System\SMmqsLd.exe
  2⤵
  PID:8424
- C:\Windows\System\fMneJaf.exe
  C:\Windows\System\fMneJaf.exe
  2⤵
  PID:11748
- C:\Windows\System\eIeYyVX.exe
  C:\Windows\System\eIeYyVX.exe
  2⤵
  PID:9588
- C:\Windows\System\TcMqOjV.exe
  C:\Windows\System\TcMqOjV.exe
  2⤵
  PID:13164
- C:\Windows\System\naWmSQy.exe
  C:\Windows\System\naWmSQy.exe
  2⤵
  PID:10360
- C:\Windows\System\eBFeJzX.exe
  C:\Windows\System\eBFeJzX.exe
  2⤵
  PID:9244
- C:\Windows\System\NimNhgb.exe
  C:\Windows\System\NimNhgb.exe
  2⤵
  PID:12720
- C:\Windows\System\uJckMFs.exe
  C:\Windows\System\uJckMFs.exe
  2⤵
  PID:10904
- C:\Windows\System\PpAjBUv.exe
  C:\Windows\System\PpAjBUv.exe
  2⤵
  PID:11508
- C:\Windows\System\tsJZAVj.exe
  C:\Windows\System\tsJZAVj.exe
  2⤵
  PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ly3b4xe.e10.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AKKbBGA.exe

Filesize
2.8MB

MD5
30321f7bff593d535006d2e3a8716408

SHA1
567724e9c18d4164bf51adb9c3dfcbea2b7c996f

SHA256
afac48cb1f41e065d98d9693f883ce108edf5fb912b718c9b800f105d62ba20e

SHA512
adf3226a35a774e5148b4cec24cd42cc78d43a8e496b5ccec6bd9b27f516e9080dc1a0ba75fa46dbe2624d3222d1f439a87aa20f9f31565303117f2095ad5f71

Download Submit
C:\Windows\System\AOUogwv.exe

Filesize
2.8MB

MD5
0a9a45b68905c14e44397da0a1d64d88

SHA1
69fa14872e319e5e275afd0d8cd350a82dddceda

SHA256
dadb6f2adcc9a58acf4c4078f20552cc0f5d240fd9a005c1c857c7cbf58ddd34

SHA512
cd49b7d4d33aaf6734c3e24a11364baa73e2d70fd3050cf8cd1a550f1f66839714a4c7f758335c8b51b06101ad70fd4d07ae9b1702944bd6c135152f7173fcfa

Download Submit
C:\Windows\System\AlqOvBw.exe

Filesize
2.8MB

MD5
81af677cebd82488c7ca28d729fc5139

SHA1
6198764e3e32493e46e8c6eecb6cd6e34ca74199

SHA256
729a05950c2392cf033a28d4971e76419e6c4172e28333e01f7f8b0b7b394d93

SHA512
945c7c782e412130b792b81b8c90b3c57e7895faee6e7ffccb548f5208c13c7ea156f95a1ab9fb22b7d581543fd368097693a329b211e923378d60ca451fd9c9

Download Submit
C:\Windows\System\AqhXFof.exe

Filesize
2.8MB

MD5
8931471cc056d2c783ca55d5d9fcd9d8

SHA1
6e922d72948b5d2bba65a59f18793de5a8944a88

SHA256
0f158ffc4ff6989a4f09f9154091b877ce737443b2b39c77f59fae460393e3fc

SHA512
4fe38ffa9305d0721bb6dc3218687a4ae84859d87617537424677fee2471a64bc9c664491d35e792e9b106265270e2e1a9222d7e0960c3054ae45b307e67f1e8

Download Submit
C:\Windows\System\DnZFTys.exe

Filesize
2.8MB

MD5
71aa3193d5c3c4696b90baeec7edcb8d

SHA1
1409cec44afd58bf35ea65707acfd221d0148665

SHA256
1d7171e48df136925f0158faf11d656f5f08a45638df02cf14d75e2968d6c12a

SHA512
a0c41c7f662e9b9d3b235715cf62b5ca1e59236b313739be9b5bd607b36363a9ef811164b8c5b2cd75c73f23f1ac5029f482315b93412079b53328f847bed4a7

Download Submit
C:\Windows\System\FFqfbrp.exe

Filesize
2.8MB

MD5
51f55028004939f2590e7f6fda8d8425

SHA1
08f6dbf6472bb7ad732c24856755bc74b2e56c43

SHA256
e82d9a1dab479c0dc83d89ab5e4fec8db674c56a47961600a174768aa30d398e

SHA512
f08b36b366c0b268e4fef4c9f5f94a69a9be2120965a7a88cb9eadd8e9a88d9a349c65ac5a9ae22d9fb71670c760446c7afcf1437f16f8a7eb15d19965278d2c

Download Submit
C:\Windows\System\HTaIsDe.exe

Filesize
2.8MB

MD5
bebaed24fa2da718790b1458d4978c65

SHA1
5964ad8d6874ed42e7582de4d19f51da3e56103c

SHA256
51381c1424174eb2724f225155bc08cb5e265efd417ce88a62901e55725c2a8f

SHA512
40439018b2ebe2d74d807a7baa605e966da71f46bfc6abaf2def9f8c23893af898a8d48b0beaa01fb4f7928ef28441d317afd977f3e1e402719260e03d7f6d81

Download Submit
C:\Windows\System\IhSyEGG.exe

Filesize
2.8MB

MD5
b19af3c24f907792293a3d43179f7169

SHA1
eaacb83bf6521f749a19a40f81085b961ceffc90

SHA256
18af7ca8e48d82786dc1a00edc3df6d6bd3e1236e1afd2d41ba0d295758aeca1

SHA512
0a21ecdd4b721a29fb89c9ae2eaaec25b3e060b0f5c028add96b985c66c20b420a602253cd0bf77dfa87fc8f21159581a6af31bdf0b41eb6b84642a738852233

Download Submit
C:\Windows\System\LGuWueb.exe

Filesize
2.8MB

MD5
b0ddb4585855e9fdc4adba4990192691

SHA1
fafb26b0211b5b9b4d5e6055a74b5096f5d74960

SHA256
c06bf21bd5daeba9f0f2ec00674c8f6768585ac7304dd64f9081ba6598c45267

SHA512
2340db08f79804f914a5dc92dc17ce82c1f267d64d61758eceff4f1d69ada228c893f4431a3def6f689cfcb1eb6a87ef4ca66898a77c52ddbb1a02d06f2d250b

Download Submit
C:\Windows\System\MGslZGQ.exe

Filesize
2.8MB

MD5
969e3b21afbbf96c36cd7d2921259666

SHA1
a55b339911834200200571030e9b16017fce363b

SHA256
901a8bd361b2ecf1de620d0e0a25ba70ab2b9b60a41208c90b0a732c1bd1f68f

SHA512
303076eb2c4543df8a654a43be12ccb389ae357c69b6e52a995e21cfd364f00b7dc1b0583af211b583ccf12c6a42d4876fd71259007dd9394bb77abe31579edc

Download Submit
C:\Windows\System\MwzbDSL.exe

Filesize
2.8MB

MD5
0741a2587a5112266a77b4b34abc068d

SHA1
b6bc00c81a2022ffe4aa2ba11e09d2021013ec37

SHA256
1ff7758451f36b018ea5248530a19afe46f136c8704bd1d71fdf26cd5a9c2e28

SHA512
5bc6bec290d2eb6d429cb650804520e13c402c6715111cff5042c40e1005ecd360fadca1f8c709c7bbe5e738c61ec10f358326b12fad8d2288b4960d817f15d6

Download Submit
C:\Windows\System\NhNTXFx.exe

Filesize
2.8MB

MD5
c1488f540be33a2672e97b5286c33861

SHA1
45e77b7b391b8a4625102fad7f16d78296644ccb

SHA256
a6c946f72af3427f65565f27c89ae2a852d545f7032d61b741b15d525ea9a64c

SHA512
e7b4b14aae16524c3863a19c120966e50e8814a31fdf17a15086358e05bbcc72e07bb6f2a5c7e2f6ae9773f7de062805a1b501a67cc0004f4cc505abca702084

Download Submit
C:\Windows\System\OQlRFCb.exe

Filesize
2.8MB

MD5
059ded4d0e79492374cb48ba061e9794

SHA1
0c017cc75e2a36d135d707213cacfbb3f7e67d24

SHA256
9b62ec6b6def4f78925b2ae15358c518e9392fa4fe131c6382226d2cd82ae3ae

SHA512
89687bbbcb3c520ecb5d2b88b1aef190e4d001e7702e1e714fac8c5a317c00c9842b3a10bcbb2c7fc5508cc3e076a86e058aeef6a5c59e87e91718a0cc31626e

Download Submit
C:\Windows\System\PcwkuMI.exe

Filesize
2.8MB

MD5
4ec872bb873ed6e5a42c0a9cab04fac1

SHA1
134a67ccfa5f9ce91786ec43b52a4c30b900eb82

SHA256
60f58a628f18893e84ce29ebe7d7cae3bb135a0f9325c1576ca1a1f1951f4272

SHA512
e34c4fc8f8f76b62288660e8f501240df38b183af4bdbf22d1676aee0b2d25b8f17ede5ae89b56bea55a9da12e8c08cb37162c93465c090f07c04706dc627b50

Download Submit
C:\Windows\System\QpxlOZx.exe

Filesize
2.8MB

MD5
3bde93f6ba76f9a0cfb51fca7e74565c

SHA1
64d73b44ac4afd59424560c25a6ea32db7e243e4

SHA256
f594c07884f6a8e78c396d0b56f20db8a41048e1be9becf55684362fc913fc88

SHA512
ac6f5fe22321b89b50ef854b2c1da22ef1664dcc8eb279a4f134d749f6c11749f41bd7f3ae0f34560de38474cf5327b1e834fdec300e8687213ac0436814af3e

Download Submit
C:\Windows\System\UuJKfHB.exe

Filesize
2.8MB

MD5
365663ec148551c497f4cd8957b9bcab

SHA1
ca2787ddaf0a8ad0570d8f7c48d62c3e5ecdd1a9

SHA256
f7c20fbff6a91599403864f9dd5b40188288538630cae715af48baf42e5378c8

SHA512
290c12856e3883ce987e7281a3776b0714582632f186013f658cf2c4e2f87f0b14db39d6a5d6d77483fe0e2ac2be2984242db9191bcc5525616ae6d5d8398cdc

Download Submit
C:\Windows\System\VfgTtQW.exe

Filesize
2.8MB

MD5
0df2b4cdd79cea37e59388c74ce80bcb

SHA1
ac36d673d57e502eda7b9ff4e9be38780b3d0533

SHA256
bfad63681241883c53d08f3fb4a1d18e44f03182de6937004c5c5b9f20bc9742

SHA512
a3151e525e40341c2703ccec50f7dbacf0f82a41db912a87696721b993de3d56b29f276a1727d91b5d07eee57a56364abe6b0a98686a4df485bb57707ce3109c

Download Submit
C:\Windows\System\VuuOYHD.exe

Filesize
2.8MB

MD5
d5a5d01e5c7a561fe06783ef488b6d33

SHA1
e9cbb475b5534df7c28f3baf9e48270fde76ed46

SHA256
51b5742c594ad8bf9391a7974cb448fef2823f3a630588ef89a23d8cd3fb220f

SHA512
cca11e6b7e05dfde1eb83ceb0ca21201bf8420ba7993463bf9ee35aa7547de7fe526b9b302316f82edf52a8826e073bbefd3a4c77794fca3c073e224cae308d1

Download Submit
C:\Windows\System\WXooBKq.exe

Filesize
2.8MB

MD5
4ecad874f81292bdfb3d38fee27a6bb0

SHA1
01d6b8bf8ecf1a085b9a49db5d8f298a9fe88906

SHA256
04e77061d06d88537e6a92b82a8a3241b89c8a319737bb6ad3c7c1ed49ef5216

SHA512
45e01cb1e479ff3bfd6bda88510c5c7e9e68dc6c6810b2f2452549ba847fde4ee3d3238831b3f21bb648f7f15ddf3ceaf0c24fd5a4437aad2e81f65f166078a9

Download Submit
C:\Windows\System\XgxgaBh.exe

Filesize
2.8MB

MD5
bf66ecf52c3e04c2e5e0d9c2305e9855

SHA1
4ea0c13128a0f3ecb27a08d282b61621788a96f4

SHA256
828f2fd0a073df1f613add96b0f9c44b633cd3030c9fce4a22b679cf4fbfc4f7

SHA512
962234daaf5bc7e9792aaa9602274beac0126d14be02872e0ea1e5a0c933c91c9672abccc2a2dac66d71c895749a3d628b97213ec8cc8a772c8d1fafd0c8b05b

Download Submit
C:\Windows\System\YzBlXHK.exe

Filesize
2.8MB

MD5
76f7c38095e11397d673196703a048fb

SHA1
f0c8c338b33ffe9ec82987a09148ae262189a259

SHA256
47c859d78009a4e86875b287fcb2c7364478818f2681ff1a07edb892d1ee5f20

SHA512
a4f9695d070a5121715a38e56146d41cfa35c105a667c45cbe8dc36c9d8b17bfada9c09d2fa39320ef54d7fe831543d21b955bb5275b86d54c0cbcb8c584e17f

Download Submit
C:\Windows\System\ZZOMOcy.exe

Filesize
2.8MB

MD5
1ddfb2d671b43709c56632d081d50160

SHA1
b43e549d4bfa926b569ecf680a07f44c4f06458f

SHA256
4d8eebdabcccdd17dc624c07bd29f717828e814e8eb3f00098aef478b116fa37

SHA512
25e9af5172f710f42c167c64c86b04932a54326ace938f6c22ca5ed9452723a634aeec2dfb75b0d369d20555da72cf696bdce0d6f163dca56af0b4ae62a96af9

Download Submit
C:\Windows\System\acPHZuN.exe

Filesize
2.8MB

MD5
8286b0893dc8aa69bb726cc35e88b9ad

SHA1
7f008035ede06988f5826dd17cecd22719ee8742

SHA256
2087f79a0e60e780440813d4da5fd858b231bb16028796bf6f7c400d93948f58

SHA512
5cb78ce9d05901a78ac46373db1396d971a787430252b9509d2b3b46d4b81df13e6414b2e68b23276874431e45b7ed62fb4587cc2c959b547ce329d3955d67a2

Download Submit
C:\Windows\System\cFaEIkt.exe

Filesize
2.8MB

MD5
75d96b4416b85c92e0c0e98215a794b2

SHA1
e468868082733ac65793394fcb94f9d6944a5fd1

SHA256
25b36341dc310acf3fef3000c1122ca859a594a28496b6c60d56bc6229bb96e5

SHA512
f18a193b1baea6163c4ba908464676015a10050f3916ed1ef586b505c082211224fb299002314996f0efb963df9e9da3409fe615b50d29f4047bf553451c3e8f

Download Submit
C:\Windows\System\eOMGAFC.exe

Filesize
2.8MB

MD5
17de9b485d2766b63dc1907efabc13d6

SHA1
7a19108b3986c1ac0ee65e21dcc5b689a03511fd

SHA256
8148fb0b59e06a569bf385a4dae87a92e69b57c7d031f9eec0a136f00d440e49

SHA512
088d8a896b44e0a6f723c5f6a8fbb0d6f1be2a2498a24cefb072c74d42cac0bd7ab790c2eeabe1865df07bc2bfd6e7976aadbecc3858e0da345f6ea39a01c2ff

Download Submit
C:\Windows\System\gVFTfLI.exe

Filesize
2.8MB

MD5
2d4ccd4562d522d74bb9a5587e43c918

SHA1
9e962d8bcfa8461cae340d03f7c8e310a6d7200c

SHA256
55e7ecdfbbf6e98dde0af0978a60b9d3a5026a88c55e4750f65248ab025ec6a8

SHA512
fe6a6fdbb04a4192727bf1a5d93c00eea7d5ac8c6d8b93d835fb05916fa7161bf5c4627f1e805c5edd572c8e2ed74b6c91c25b5fecfe832925a5039934610049

Download Submit
C:\Windows\System\gjSCxHl.exe

Filesize
2.8MB

MD5
1a57c9abb75ddd993753b945af0e5b06

SHA1
52383014dd365ef27475b21cd16fccffb163e5af

SHA256
f5ef8c9867018cad4043cb4717bab0dc4559c070dcbcd547fcb60a661fc00b14

SHA512
e99fb703f73f62e480164a0f66836b15e2c6eba41e1089e587657f35ac8174763bd62f3e278593a624543be886a26d20f21c02a450b10d9f1fea64b5c90c41d7

Download Submit
C:\Windows\System\iLmTbiI.exe

Filesize
2.8MB

MD5
a05eb4b5fdb54a8118b54771ab00252b

SHA1
5ce8236b3c00d5255b677930c6b2002872af5323

SHA256
7e69694ba76d7cba39cc5a2c3ef9f52c95a206da0e9cb88dc3714b176b743621

SHA512
d0e4de6a863ace14241bda106bfc731e55fa034ea2334b313d6fe0675e8ba5b7a999980f11bb28723aca77cb0def20ff5471b804f40be5ea53d5a5b2a9de62a7

Download Submit
C:\Windows\System\kuVSJqn.exe

Filesize
2.8MB

MD5
a787096f07a1ed570583fdb23fe4e88c

SHA1
5b66d52e41c68dee93f49db2713b005710ad3b46

SHA256
ca34d6236d05301c65df7f680684d5a1a75d799354203c4d6e92e0ef04e07466

SHA512
22a769209c34bfa57ccf51ce959d9044b941c3e60f6f06f9e9ba9fc1e6e30c942c7923d72fbeeefa29e4d48929f61ba6eeb6ea237219d056657c2880bca98a9a

Download Submit
C:\Windows\System\oSsydqe.exe

Filesize
2.8MB

MD5
fb39047dc14345096334507d720cc22e

SHA1
e9ad32261ab162a97222bc4a213cb62e06732151

SHA256
ee5457e20977cf9452a7cb4d0aa4a70889106362a66f2a02dc53df49aa2f25c5

SHA512
6e693e898d1ae4d03525762210b2cf46d621a71d6efca08012afa01f30701224cb22f0dd4df684c35e78556f91d56d85e7d6ab5a6a7d4cd64700a4355dbb6a89

Download Submit
C:\Windows\System\ocOGfGP.exe

Filesize
18B

MD5
3df17311bc0795afa0f8baedb284b58e

SHA1
0e0e1e2966fd4f257a0a87ec1a94371ddcd65ab3

SHA256
7becc7f3a33a815bbf562f45d6cd1323eaaebcf2da88329df7e1d872ff16449f

SHA512
5f0916962f1c38b0f4d4cb584d30e7922e57ace79f1075d3fc18f674694248abb3d97308dfdc428b10b4d414e7e5d4ac9774fecee2f966264fd982310698e5e2

Download Submit
C:\Windows\System\rlGZaAo.exe

Filesize
2.8MB

MD5
59a94b267ba25656bee084f84f20a81c

SHA1
2f19daff64bb0fa2f7d98de2aaa0e185955ac60a

SHA256
3752a15891f2779b906cf83736842980d3b1d04027fd00ee357ec9ea6b63a599

SHA512
8c48b2f33fec115490a501fdfa1447aaf945093d16d47bf5291d08abf72b08e86806867c0f9c8507f5530f730303a3016e47d3024a532911b378c580d18220df

Download Submit
C:\Windows\System\tIelSmG.exe

Filesize
2.8MB

MD5
e7260fd03a28858a787a65c4abed4fc3

SHA1
5e640ee170861f1bb79e8c57c64d0402afac77bc

SHA256
37d47db32cdba76ec0a0fd8fb3ad19ce7867f35ad7775a3818a16de89c3f053b

SHA512
1b4a18808eea023db210b7ed026d8d7e5561d70c28d76f1e121a3a7d7da710a8c68ad2cdce2bf81704c9fb52e4862806a3ad2825fa2067ce4ac8f6649590b66e

Download Submit
C:\Windows\System\ttcWOgZ.exe

Filesize
2.8MB

MD5
ef0df8ee7b472077ec99bd08e32a7997

SHA1
4c55562f2d700426a8a9e47e7a60e5a71b83980b

SHA256
ca0494d2c8f263e40446ca1bd336979d9860d356e68ac969e552c1204e37c31e

SHA512
ca4ff9a626d2ab7effe57ba1961a8a86031530711edd5067460cee8f96bb6d3e5d378d77213c87b093c9adf4ad60bb423f0bb4f3b972e64e73530554fa0f159d

Download Submit
C:\Windows\System\wSCtMHi.exe

Filesize
2.8MB

MD5
f41c6cb1a9a3e636de5037f1f007cab8

SHA1
b8600b15fb9d83d6c536c3a067e1d6a738753ad4

SHA256
f1ddf3d313249510ae1bd87485a990f92316c039736f750d063c351b29b88c06

SHA512
7f5379508873f4d6eda23ffa901293dcadbaf3fe07276ae1d2940403dcb3fad4e2bcdc1104f3853acc04e72585dbecffdd25d922bd812493fe943232dc4c1018

Download Submit
C:\Windows\System\yUzYBFN.exe

Filesize
2.8MB

MD5
1eb06dd8aa8fa8e1d299018107cbd8d3

SHA1
620d0d708e470a00068ef9002e5fdd79e16a67b7

SHA256
eb9ca311b209924d8502473ad15980743dc89f335684362472fdfcba2381bdf8

SHA512
daf756fafff42bbbf58402cadba5560be5dc5981004c12edbfe530b5c4c4d1b16ace01fb20b094abaab5d955712400b26e777aa9465cb1efeee1376d1a37111c

Download Submit
C:\Windows\System\zwIeoKS.exe

Filesize
2.8MB

MD5
21f207981e9c7cc343ccac471bcc86d7

SHA1
2dd62e81d205189180d71d7d555c05959883035b

SHA256
0d6aa3ba074bb2679a9e6fb1ec9270789ecb7d0f2d1f35ea517490b583937567

SHA512
e75d505781544c4180a56ce916ae42a672844957ab7ab5cbd82bcf48b2b6f47c6822c1500f8c0f8c39a88d4c7b1c65abef4d64a2b01b31c7d4b0a2e1511d08d5

Download Submit
memory/224-3642-0x00007FF65C7E0000-0x00007FF65CBD2000-memory.dmp

Filesize
3.9MB

Download
memory/224-69-0x00007FF65C7E0000-0x00007FF65CBD2000-memory.dmp

Filesize
3.9MB

Download
memory/748-231-0x00007FF6B1860000-0x00007FF6B1C52000-memory.dmp

Filesize
3.9MB

Download
memory/748-3650-0x00007FF6B1860000-0x00007FF6B1C52000-memory.dmp

Filesize
3.9MB

Download
memory/1220-234-0x00007FF7E4A40000-0x00007FF7E4E32000-memory.dmp

Filesize
3.9MB

Download
memory/1220-3688-0x00007FF7E4A40000-0x00007FF7E4E32000-memory.dmp

Filesize
3.9MB

Download
memory/1612-3668-0x00007FF6DC540000-0x00007FF6DC932000-memory.dmp

Filesize
3.9MB

Download
memory/1612-202-0x00007FF6DC540000-0x00007FF6DC932000-memory.dmp

Filesize
3.9MB

Download
memory/1848-0-0x00007FF7FC830000-0x00007FF7FCC22000-memory.dmp

Filesize
3.9MB

Download
memory/1848-3918-0x00007FF7FC830000-0x00007FF7FCC22000-memory.dmp

Filesize
3.9MB

Download
memory/1848-1-0x00000250CD0C0000-0x00000250CD0D0000-memory.dmp

Filesize
64KB

Download
memory/2060-121-0x00007FF6CB5F0000-0x00007FF6CB9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2060-3670-0x00007FF6CB5F0000-0x00007FF6CB9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-222-0x00007FF60C830000-0x00007FF60CC22000-memory.dmp

Filesize
3.9MB

Download
memory/2172-3710-0x00007FF60C830000-0x00007FF60CC22000-memory.dmp

Filesize
3.9MB

Download
memory/2220-3713-0x00007FF782EA0000-0x00007FF783292000-memory.dmp

Filesize
3.9MB

Download
memory/2220-217-0x00007FF782EA0000-0x00007FF783292000-memory.dmp

Filesize
3.9MB

Download
memory/2684-28-0x00007FF75CAD0000-0x00007FF75CEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-11-0x00007FF765080000-0x00007FF765472000-memory.dmp

Filesize
3.9MB

Download
memory/2716-3679-0x00007FF7D7790000-0x00007FF7D7B82000-memory.dmp

Filesize
3.9MB

Download
memory/2716-157-0x00007FF7D7790000-0x00007FF7D7B82000-memory.dmp

Filesize
3.9MB

Download
memory/2788-99-0x00007FF68CA70000-0x00007FF68CE62000-memory.dmp

Filesize
3.9MB

Download
memory/2788-3663-0x00007FF68CA70000-0x00007FF68CE62000-memory.dmp

Filesize
3.9MB

Download
memory/3048-3717-0x00007FF6CC0F0000-0x00007FF6CC4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-221-0x00007FF6CC0F0000-0x00007FF6CC4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3100-25-0x0000021AF6340000-0x0000021AF6350000-memory.dmp

Filesize
64KB

Download
memory/3100-230-0x00007FF8FD300000-0x00007FF8FDDC1000-memory.dmp

Filesize
10.8MB

Download
memory/3100-229-0x0000021AF6DA0000-0x0000021AF6DC2000-memory.dmp

Filesize
136KB

Download
memory/3100-70-0x0000021AF6340000-0x0000021AF6350000-memory.dmp

Filesize
64KB

Download
memory/3412-112-0x00007FF748670000-0x00007FF748A62000-memory.dmp

Filesize
3.9MB

Download
memory/3412-3673-0x00007FF748670000-0x00007FF748A62000-memory.dmp

Filesize
3.9MB

Download
memory/3884-233-0x00007FF762BA0000-0x00007FF762F92000-memory.dmp

Filesize
3.9MB

Download
memory/3884-3658-0x00007FF762BA0000-0x00007FF762F92000-memory.dmp

Filesize
3.9MB

Download
memory/3892-235-0x00007FF7E5080000-0x00007FF7E5472000-memory.dmp

Filesize
3.9MB

Download
memory/3892-3695-0x00007FF7E5080000-0x00007FF7E5472000-memory.dmp

Filesize
3.9MB

Download
memory/4068-24-0x00007FF6C9760000-0x00007FF6C9B52000-memory.dmp

Filesize
3.9MB

Download
memory/4120-232-0x00007FF64E0D0000-0x00007FF64E4C2000-memory.dmp

Filesize
3.9MB

Download
memory/4120-3654-0x00007FF64E0D0000-0x00007FF64E4C2000-memory.dmp

Filesize
3.9MB

Download
memory/4288-3662-0x00007FF770230000-0x00007FF770622000-memory.dmp

Filesize
3.9MB

Download
memory/4288-183-0x00007FF770230000-0x00007FF770622000-memory.dmp

Filesize
3.9MB

Download
memory/4380-48-0x00007FF736470000-0x00007FF736862000-memory.dmp

Filesize
3.9MB

Download
memory/4380-3637-0x00007FF736470000-0x00007FF736862000-memory.dmp

Filesize
3.9MB

Download
memory/4388-3690-0x00007FF63ECC0000-0x00007FF63F0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4388-172-0x00007FF63ECC0000-0x00007FF63F0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-3683-0x00007FF6AC130000-0x00007FF6AC522000-memory.dmp

Filesize
3.9MB

Download
memory/4848-122-0x00007FF6AC130000-0x00007FF6AC522000-memory.dmp

Filesize
3.9MB

Download