xmrig | 32330a0543d91d97e1f599dc49450aea23989c5f0d549ea30c5d903b1ca94a1c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
Size

2.1MB
MD5

228c570fd2cd4cc6295cc1d395ba3765
SHA1

2046c882a61ce16ca3e5c6eeb2805c215fa7349a
SHA256

32330a0543d91d97e1f599dc49450aea23989c5f0d549ea30c5d903b1ca94a1c
SHA512

95eac896dbc170b0295b2f895e09814eb881a9c5f2b99e5948b367ab787f40e29dde775ae3d707bd1fd5638383f15c534a1fae504b7e3e708c0fe9fb3eb3756d
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM42:NABx

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/2800-97-0x00007FF7A3290000-0x00007FF7A3682000-memory.dmp	xmrig
behavioral2/memory/2924-209-0x00007FF69EE40000-0x00007FF69F232000-memory.dmp	xmrig
behavioral2/memory/3980-172-0x00007FF6C20E0000-0x00007FF6C24D2000-memory.dmp	xmrig
behavioral2/memory/3740-356-0x00007FF6285A0000-0x00007FF628992000-memory.dmp	xmrig
behavioral2/memory/4064-303-0x00007FF70A530000-0x00007FF70A922000-memory.dmp	xmrig
behavioral2/memory/3752-309-0x00007FF706470000-0x00007FF706862000-memory.dmp	xmrig
behavioral2/memory/3436-359-0x00007FF79C030000-0x00007FF79C422000-memory.dmp	xmrig
behavioral2/memory/3112-392-0x00007FF700D20000-0x00007FF701112000-memory.dmp	xmrig
behavioral2/memory/4864-394-0x00007FF73FE90000-0x00007FF740282000-memory.dmp	xmrig
behavioral2/memory/3024-395-0x00007FF6DC470000-0x00007FF6DC862000-memory.dmp	xmrig
behavioral2/memory/2236-398-0x00007FF755820000-0x00007FF755C12000-memory.dmp	xmrig
behavioral2/memory/852-400-0x00007FF633470000-0x00007FF633862000-memory.dmp	xmrig
behavioral2/memory/796-399-0x00007FF758360000-0x00007FF758752000-memory.dmp	xmrig
behavioral2/memory/3396-397-0x00007FF63A170000-0x00007FF63A562000-memory.dmp	xmrig
behavioral2/memory/1152-393-0x00007FF7C4BF0000-0x00007FF7C4FE2000-memory.dmp	xmrig
behavioral2/memory/1776-391-0x00007FF7480E0000-0x00007FF7484D2000-memory.dmp	xmrig
behavioral2/memory/2000-274-0x00007FF69DC70000-0x00007FF69E062000-memory.dmp	xmrig
behavioral2/memory/3236-241-0x00007FF743F10000-0x00007FF744302000-memory.dmp	xmrig
behavioral2/memory/1360-158-0x00007FF69A720000-0x00007FF69AB12000-memory.dmp	xmrig
behavioral2/memory/884-122-0x00007FF6D6F10000-0x00007FF6D7302000-memory.dmp	xmrig
behavioral2/memory/2164-121-0x00007FF73E7C0000-0x00007FF73EBB2000-memory.dmp	xmrig
behavioral2/memory/5028-67-0x00007FF6A2920000-0x00007FF6A2D12000-memory.dmp	xmrig
behavioral2/memory/556-4971-0x00007FF6F5B00000-0x00007FF6F5EF2000-memory.dmp	xmrig
behavioral2/memory/2036-5749-0x00007FF796FA0000-0x00007FF797392000-memory.dmp	xmrig
behavioral2/memory/3396-6806-0x00007FF63A170000-0x00007FF63A562000-memory.dmp	xmrig
behavioral2/memory/5028-6858-0x00007FF6A2920000-0x00007FF6A2D12000-memory.dmp	xmrig
behavioral2/memory/2800-6845-0x00007FF7A3290000-0x00007FF7A3682000-memory.dmp	xmrig
behavioral2/memory/884-6865-0x00007FF6D6F10000-0x00007FF6D7302000-memory.dmp	xmrig
behavioral2/memory/796-7114-0x00007FF758360000-0x00007FF758752000-memory.dmp	xmrig
behavioral2/memory/3236-7153-0x00007FF743F10000-0x00007FF744302000-memory.dmp	xmrig
behavioral2/memory/3436-7152-0x00007FF79C030000-0x00007FF79C422000-memory.dmp	xmrig
behavioral2/memory/3752-7200-0x00007FF706470000-0x00007FF706862000-memory.dmp	xmrig
behavioral2/memory/2236-7066-0x00007FF755820000-0x00007FF755C12000-memory.dmp	xmrig
behavioral2/memory/1896-7023-0x00007FF6A3B20000-0x00007FF6A3F12000-memory.dmp	xmrig
behavioral2/memory/2164-6899-0x00007FF73E7C0000-0x00007FF73EBB2000-memory.dmp	xmrig
behavioral2/memory/3024-7320-0x00007FF6DC470000-0x00007FF6DC862000-memory.dmp	xmrig
behavioral2/memory/1152-7231-0x00007FF7C4BF0000-0x00007FF7C4FE2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3412	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2036	eZLPOmz.exe
5028	ldsggle.exe
3396	QbFGPEb.exe
1896	QsYNFsg.exe
2800	aHrTZcq.exe
2164	fNwRTOT.exe
884	EYmhKuQ.exe
1360	VDBfPjx.exe
3980	ZXzneAl.exe
2236	JVsoBtj.exe
2924	sdLsMJf.exe
3236	Itbyisz.exe
796	dJFpIhq.exe
2000	CFHbgMb.exe
4064	mocdmzU.exe
3752	hOwLdnA.exe
3740	opRDUMr.exe
3436	PMoqPrx.exe
1776	kEeYgcg.exe
3112	ECzbtJS.exe
852	OvlMbsR.exe
1152	vKlhnMA.exe
4864	OdvNpyn.exe
3024	bZvZCJq.exe
2500	oeXeoKy.exe
988	SoNZIGk.exe
4936	toLXdYZ.exe
3528	aLaRVqE.exe
8	aohUyCW.exe
4808	sIWfKIH.exe
3972	sQEJAWT.exe
3124	ktCiyYO.exe
2324	kNtPHMC.exe
4848	HRsdZjW.exe
4524	gcZDWrd.exe
1716	hIgjKzq.exe
4996	AXtXjes.exe
1564	BLaVlCJ.exe
1252	eRxNTSg.exe
4456	PdoLBEC.exe
4436	BnUTnVf.exe
4900	pcpQbzH.exe
4340	RbmVTmX.exe
3360	oXSfcci.exe
4588	pHqTovK.exe
1184	TBGjcqH.exe
5108	kMOsrnR.exe
1508	oMKjlll.exe
4364	qdxYYcp.exe
4032	gOjNyGO.exe
2972	ubHwVyf.exe
3032	ujdAOmf.exe
1668	VxyJDaw.exe
4156	lklYkua.exe
1792	tdxZGVR.exe
2636	UxSDMwJ.exe
2136	uozPYZV.exe
4740	esVVuvj.exe
1972	hXHEOGO.exe
228	PnPkJQj.exe
4180	NejIWWm.exe
2496	UZlWpXi.exe
664	teRsxDw.exe
4168	TRGgqPb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/556-0-0x00007FF6F5B00000-0x00007FF6F5EF2000-memory.dmp	upx
behavioral2/files/0x000600000002327c-7.dat	upx
behavioral2/files/0x00070000000233fd-13.dat	upx
behavioral2/files/0x0007000000023401-34.dat	upx
behavioral2/files/0x0007000000023402-59.dat	upx
behavioral2/files/0x0007000000023405-62.dat	upx
behavioral2/files/0x000700000002340f-101.dat	upx
behavioral2/memory/2800-97-0x00007FF7A3290000-0x00007FF7A3682000-memory.dmp	upx
behavioral2/files/0x0007000000023406-95.dat	upx
behavioral2/files/0x0007000000023415-120.dat	upx
behavioral2/files/0x0007000000023414-119.dat	upx
behavioral2/files/0x000700000002340e-91.dat	upx
behavioral2/files/0x000700000002340d-87.dat	upx
behavioral2/files/0x000700000002340c-86.dat	upx
behavioral2/files/0x0007000000023408-85.dat	upx
behavioral2/files/0x000700000002340b-82.dat	upx
behavioral2/files/0x0007000000023410-113.dat	upx
behavioral2/memory/2924-209-0x00007FF69EE40000-0x00007FF69F232000-memory.dmp	upx
behavioral2/memory/3980-172-0x00007FF6C20E0000-0x00007FF6C24D2000-memory.dmp	upx
behavioral2/files/0x0007000000023420-196.dat	upx
behavioral2/files/0x0007000000023419-195.dat	upx
behavioral2/files/0x000700000002341d-183.dat	upx
behavioral2/memory/3740-356-0x00007FF6285A0000-0x00007FF628992000-memory.dmp	upx
behavioral2/memory/4064-303-0x00007FF70A530000-0x00007FF70A922000-memory.dmp	upx
behavioral2/memory/3752-309-0x00007FF706470000-0x00007FF706862000-memory.dmp	upx
behavioral2/memory/3436-359-0x00007FF79C030000-0x00007FF79C422000-memory.dmp	upx
behavioral2/memory/3112-392-0x00007FF700D20000-0x00007FF701112000-memory.dmp	upx
behavioral2/memory/4864-394-0x00007FF73FE90000-0x00007FF740282000-memory.dmp	upx
behavioral2/memory/3024-395-0x00007FF6DC470000-0x00007FF6DC862000-memory.dmp	upx
behavioral2/memory/2236-398-0x00007FF755820000-0x00007FF755C12000-memory.dmp	upx
behavioral2/memory/852-400-0x00007FF633470000-0x00007FF633862000-memory.dmp	upx
behavioral2/memory/796-399-0x00007FF758360000-0x00007FF758752000-memory.dmp	upx
behavioral2/memory/3396-397-0x00007FF63A170000-0x00007FF63A562000-memory.dmp	upx
behavioral2/memory/1152-393-0x00007FF7C4BF0000-0x00007FF7C4FE2000-memory.dmp	upx
behavioral2/memory/1776-391-0x00007FF7480E0000-0x00007FF7484D2000-memory.dmp	upx
behavioral2/memory/2000-274-0x00007FF69DC70000-0x00007FF69E062000-memory.dmp	upx
behavioral2/memory/3236-241-0x00007FF743F10000-0x00007FF744302000-memory.dmp	upx
behavioral2/files/0x000700000002341f-193.dat	upx
behavioral2/files/0x0007000000023412-187.dat	upx
behavioral2/files/0x000700000002341e-184.dat	upx
behavioral2/files/0x000700000002341c-182.dat	upx
behavioral2/files/0x000700000002341b-179.dat	upx
behavioral2/files/0x000700000002341a-178.dat	upx
behavioral2/files/0x0007000000023418-128.dat	upx
behavioral2/files/0x000700000002340a-125.dat	upx
behavioral2/files/0x0007000000023417-124.dat	upx
behavioral2/files/0x0007000000023416-123.dat	upx
behavioral2/memory/1360-158-0x00007FF69A720000-0x00007FF69AB12000-memory.dmp	upx
behavioral2/memory/884-122-0x00007FF6D6F10000-0x00007FF6D7302000-memory.dmp	upx
behavioral2/memory/2164-121-0x00007FF73E7C0000-0x00007FF73EBB2000-memory.dmp	upx
behavioral2/files/0x0007000000023413-154.dat	upx
behavioral2/files/0x0007000000023411-152.dat	upx
behavioral2/files/0x0007000000023407-108.dat	upx
behavioral2/files/0x0007000000023409-105.dat	upx
behavioral2/memory/1896-71-0x00007FF6A3B20000-0x00007FF6A3F12000-memory.dmp	upx
behavioral2/files/0x0007000000023403-70.dat	upx
behavioral2/memory/5028-67-0x00007FF6A2920000-0x00007FF6A2D12000-memory.dmp	upx
behavioral2/files/0x0007000000023404-51.dat	upx
behavioral2/files/0x00070000000233ff-49.dat	upx
behavioral2/files/0x0007000000023400-29.dat	upx
behavioral2/files/0x00070000000233fe-16.dat	upx
behavioral2/memory/2036-14-0x00007FF796FA0000-0x00007FF797392000-memory.dmp	upx
behavioral2/memory/556-4971-0x00007FF6F5B00000-0x00007FF6F5EF2000-memory.dmp	upx
behavioral2/memory/2036-5749-0x00007FF796FA0000-0x00007FF797392000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lbBQWai.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\doQhaFG.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\jLYOqiQ.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\QGTzzZe.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\yUrsKBU.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\GMiTpgi.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\vtJLhay.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\gGAZZKb.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\XOANkfa.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\TuvCzWG.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\ENqWagX.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\WyLpnqV.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\JNDtzNs.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\evqoXWH.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\MsILfhj.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\hSpTDCM.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\AGiUGXf.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\TvWVzAG.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\MqtiLEj.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\QnuWrhf.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\LFhQvhF.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\IuLWkeS.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\nIVPIAV.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\StehGjy.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\PNxtsjV.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\aodSutc.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\SaoYSet.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\EXRVkLH.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\VdnjEGp.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\vwrzmOO.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\yluyagt.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\knUkVJO.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\zscttGP.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\sjVBONJ.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\OKCszzV.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\TCWjddq.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\RhEqzwL.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\slwGVyl.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\gHGdjQi.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\IEHTzqi.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\cljvbhH.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\ciHZXJZ.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\RErCGKN.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\Rawxcmj.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\XrkaUdl.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\wSIzjsV.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\UTizNce.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\uRzAlrW.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\fxljAfL.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\zXfeIHF.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\EMdIsBE.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\ZINMtfz.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\CdnmBGg.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\uomnmfE.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\xBhbMvK.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\dazIFAm.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\MIhQnYs.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\qcKdZoE.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\MmJguvT.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\FdgXOwg.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\CXumxGV.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\EgNiPcr.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\CFtcxfC.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\FtoTzLP.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3412	powershell.exe
3412	powershell.exe
3412	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
Token: SeDebugPrivilege	3412	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 3412	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	85
PID 556 wrote to memory of 3412	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	85
PID 556 wrote to memory of 2036	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	86
PID 556 wrote to memory of 2036	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	86
PID 556 wrote to memory of 5028	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	87
PID 556 wrote to memory of 5028	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	87
PID 556 wrote to memory of 3396	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	88
PID 556 wrote to memory of 3396	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	88
PID 556 wrote to memory of 1896	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	89
PID 556 wrote to memory of 1896	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	89
PID 556 wrote to memory of 2800	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	90
PID 556 wrote to memory of 2800	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	90
PID 556 wrote to memory of 2164	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	91
PID 556 wrote to memory of 2164	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	91
PID 556 wrote to memory of 884	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	92
PID 556 wrote to memory of 884	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	92
PID 556 wrote to memory of 1360	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	93
PID 556 wrote to memory of 1360	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	93
PID 556 wrote to memory of 3980	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	94
PID 556 wrote to memory of 3980	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	94
PID 556 wrote to memory of 3236	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	95
PID 556 wrote to memory of 3236	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	95
PID 556 wrote to memory of 2236	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	96
PID 556 wrote to memory of 2236	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	96
PID 556 wrote to memory of 2924	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	97
PID 556 wrote to memory of 2924	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	97
PID 556 wrote to memory of 3752	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	98
PID 556 wrote to memory of 3752	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	98
PID 556 wrote to memory of 796	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	99
PID 556 wrote to memory of 796	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	99
PID 556 wrote to memory of 2000	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	100
PID 556 wrote to memory of 2000	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	100
PID 556 wrote to memory of 4064	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	101
PID 556 wrote to memory of 4064	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	101
PID 556 wrote to memory of 3740	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	102
PID 556 wrote to memory of 3740	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	102
PID 556 wrote to memory of 3436	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	103
PID 556 wrote to memory of 3436	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	103
PID 556 wrote to memory of 1776	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	104
PID 556 wrote to memory of 1776	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	104
PID 556 wrote to memory of 3112	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	105
PID 556 wrote to memory of 3112	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	105
PID 556 wrote to memory of 852	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	106
PID 556 wrote to memory of 852	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	106
PID 556 wrote to memory of 4808	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	107
PID 556 wrote to memory of 4808	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	107
PID 556 wrote to memory of 1152	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	108
PID 556 wrote to memory of 1152	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	108
PID 556 wrote to memory of 4864	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	109
PID 556 wrote to memory of 4864	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	109
PID 556 wrote to memory of 3024	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	110
PID 556 wrote to memory of 3024	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	110
PID 556 wrote to memory of 2500	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	111
PID 556 wrote to memory of 2500	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	111
PID 556 wrote to memory of 988	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	112
PID 556 wrote to memory of 988	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	112
PID 556 wrote to memory of 4936	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	113
PID 556 wrote to memory of 4936	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	113
PID 556 wrote to memory of 3528	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	114
PID 556 wrote to memory of 3528	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	114
PID 556 wrote to memory of 8	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	115
PID 556 wrote to memory of 8	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	115
PID 556 wrote to memory of 3972	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	116
PID 556 wrote to memory of 3972	556	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3412
- C:\Windows\System\eZLPOmz.exe
  C:\Windows\System\eZLPOmz.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\ldsggle.exe
  C:\Windows\System\ldsggle.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\QbFGPEb.exe
  C:\Windows\System\QbFGPEb.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\QsYNFsg.exe
  C:\Windows\System\QsYNFsg.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\aHrTZcq.exe
  C:\Windows\System\aHrTZcq.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\fNwRTOT.exe
  C:\Windows\System\fNwRTOT.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\EYmhKuQ.exe
  C:\Windows\System\EYmhKuQ.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\VDBfPjx.exe
  C:\Windows\System\VDBfPjx.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ZXzneAl.exe
  C:\Windows\System\ZXzneAl.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\Itbyisz.exe
  C:\Windows\System\Itbyisz.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\JVsoBtj.exe
  C:\Windows\System\JVsoBtj.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\sdLsMJf.exe
  C:\Windows\System\sdLsMJf.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\hOwLdnA.exe
  C:\Windows\System\hOwLdnA.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\dJFpIhq.exe
  C:\Windows\System\dJFpIhq.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\CFHbgMb.exe
  C:\Windows\System\CFHbgMb.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\mocdmzU.exe
  C:\Windows\System\mocdmzU.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\opRDUMr.exe
  C:\Windows\System\opRDUMr.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\PMoqPrx.exe
  C:\Windows\System\PMoqPrx.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\kEeYgcg.exe
  C:\Windows\System\kEeYgcg.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\ECzbtJS.exe
  C:\Windows\System\ECzbtJS.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\OvlMbsR.exe
  C:\Windows\System\OvlMbsR.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\sIWfKIH.exe
  C:\Windows\System\sIWfKIH.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\vKlhnMA.exe
  C:\Windows\System\vKlhnMA.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\OdvNpyn.exe
  C:\Windows\System\OdvNpyn.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\bZvZCJq.exe
  C:\Windows\System\bZvZCJq.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\oeXeoKy.exe
  C:\Windows\System\oeXeoKy.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\SoNZIGk.exe
  C:\Windows\System\SoNZIGk.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\toLXdYZ.exe
  C:\Windows\System\toLXdYZ.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\aLaRVqE.exe
  C:\Windows\System\aLaRVqE.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\aohUyCW.exe
  C:\Windows\System\aohUyCW.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\sQEJAWT.exe
  C:\Windows\System\sQEJAWT.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\ktCiyYO.exe
  C:\Windows\System\ktCiyYO.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\kNtPHMC.exe
  C:\Windows\System\kNtPHMC.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\HRsdZjW.exe
  C:\Windows\System\HRsdZjW.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\gcZDWrd.exe
  C:\Windows\System\gcZDWrd.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\hIgjKzq.exe
  C:\Windows\System\hIgjKzq.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\AXtXjes.exe
  C:\Windows\System\AXtXjes.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\BLaVlCJ.exe
  C:\Windows\System\BLaVlCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\PdoLBEC.exe
  C:\Windows\System\PdoLBEC.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\eRxNTSg.exe
  C:\Windows\System\eRxNTSg.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\BnUTnVf.exe
  C:\Windows\System\BnUTnVf.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\pcpQbzH.exe
  C:\Windows\System\pcpQbzH.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\RbmVTmX.exe
  C:\Windows\System\RbmVTmX.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\oXSfcci.exe
  C:\Windows\System\oXSfcci.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\pHqTovK.exe
  C:\Windows\System\pHqTovK.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\TBGjcqH.exe
  C:\Windows\System\TBGjcqH.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\kMOsrnR.exe
  C:\Windows\System\kMOsrnR.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\oMKjlll.exe
  C:\Windows\System\oMKjlll.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\qdxYYcp.exe
  C:\Windows\System\qdxYYcp.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\gOjNyGO.exe
  C:\Windows\System\gOjNyGO.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\PnPkJQj.exe
  C:\Windows\System\PnPkJQj.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\ubHwVyf.exe
  C:\Windows\System\ubHwVyf.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\ujdAOmf.exe
  C:\Windows\System\ujdAOmf.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\VxyJDaw.exe
  C:\Windows\System\VxyJDaw.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\lklYkua.exe
  C:\Windows\System\lklYkua.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\tdxZGVR.exe
  C:\Windows\System\tdxZGVR.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\UxSDMwJ.exe
  C:\Windows\System\UxSDMwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\uozPYZV.exe
  C:\Windows\System\uozPYZV.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\esVVuvj.exe
  C:\Windows\System\esVVuvj.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\hXHEOGO.exe
  C:\Windows\System\hXHEOGO.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\NejIWWm.exe
  C:\Windows\System\NejIWWm.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\UZlWpXi.exe
  C:\Windows\System\UZlWpXi.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\teRsxDw.exe
  C:\Windows\System\teRsxDw.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\TRGgqPb.exe
  C:\Windows\System\TRGgqPb.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\ZRkXiGR.exe
  C:\Windows\System\ZRkXiGR.exe
  2⤵
  PID:548
- C:\Windows\System\KVTAvyZ.exe
  C:\Windows\System\KVTAvyZ.exe
  2⤵
  PID:4892
- C:\Windows\System\JiOVZnm.exe
  C:\Windows\System\JiOVZnm.exe
  2⤵
  PID:5032
- C:\Windows\System\JYSuXmr.exe
  C:\Windows\System\JYSuXmr.exe
  2⤵
  PID:4912
- C:\Windows\System\DuJnAPz.exe
  C:\Windows\System\DuJnAPz.exe
  2⤵
  PID:3984
- C:\Windows\System\VYEJNTz.exe
  C:\Windows\System\VYEJNTz.exe
  2⤵
  PID:4028
- C:\Windows\System\jIBGHZi.exe
  C:\Windows\System\jIBGHZi.exe
  2⤵
  PID:4268
- C:\Windows\System\ahlBYzm.exe
  C:\Windows\System\ahlBYzm.exe
  2⤵
  PID:1164
- C:\Windows\System\YYAhygJ.exe
  C:\Windows\System\YYAhygJ.exe
  2⤵
  PID:5160
- C:\Windows\System\kwAAzLu.exe
  C:\Windows\System\kwAAzLu.exe
  2⤵
  PID:5180
- C:\Windows\System\tAaXVHs.exe
  C:\Windows\System\tAaXVHs.exe
  2⤵
  PID:5204
- C:\Windows\System\pQpdpzz.exe
  C:\Windows\System\pQpdpzz.exe
  2⤵
  PID:5228
- C:\Windows\System\bFzkkvD.exe
  C:\Windows\System\bFzkkvD.exe
  2⤵
  PID:5248
- C:\Windows\System\GVBDXlM.exe
  C:\Windows\System\GVBDXlM.exe
  2⤵
  PID:5328
- C:\Windows\System\aBZMelR.exe
  C:\Windows\System\aBZMelR.exe
  2⤵
  PID:5344
- C:\Windows\System\vaTMyQp.exe
  C:\Windows\System\vaTMyQp.exe
  2⤵
  PID:5364
- C:\Windows\System\oqAlPWN.exe
  C:\Windows\System\oqAlPWN.exe
  2⤵
  PID:5384
- C:\Windows\System\HFoEraT.exe
  C:\Windows\System\HFoEraT.exe
  2⤵
  PID:5404
- C:\Windows\System\OFlsVXn.exe
  C:\Windows\System\OFlsVXn.exe
  2⤵
  PID:5432
- C:\Windows\System\AWBswmz.exe
  C:\Windows\System\AWBswmz.exe
  2⤵
  PID:5456
- C:\Windows\System\ofHlNLs.exe
  C:\Windows\System\ofHlNLs.exe
  2⤵
  PID:5480
- C:\Windows\System\GEAKOqr.exe
  C:\Windows\System\GEAKOqr.exe
  2⤵
  PID:5500
- C:\Windows\System\DInxANo.exe
  C:\Windows\System\DInxANo.exe
  2⤵
  PID:5524
- C:\Windows\System\eNrmiQe.exe
  C:\Windows\System\eNrmiQe.exe
  2⤵
  PID:5544
- C:\Windows\System\CYwNFjz.exe
  C:\Windows\System\CYwNFjz.exe
  2⤵
  PID:5564
- C:\Windows\System\QwaIukM.exe
  C:\Windows\System\QwaIukM.exe
  2⤵
  PID:5604
- C:\Windows\System\VltjCDJ.exe
  C:\Windows\System\VltjCDJ.exe
  2⤵
  PID:5624
- C:\Windows\System\CNUfhZe.exe
  C:\Windows\System\CNUfhZe.exe
  2⤵
  PID:5644
- C:\Windows\System\nDSpFkp.exe
  C:\Windows\System\nDSpFkp.exe
  2⤵
  PID:5684
- C:\Windows\System\DFUFZQx.exe
  C:\Windows\System\DFUFZQx.exe
  2⤵
  PID:5704
- C:\Windows\System\NgPQMkN.exe
  C:\Windows\System\NgPQMkN.exe
  2⤵
  PID:5736
- C:\Windows\System\SLUbOJd.exe
  C:\Windows\System\SLUbOJd.exe
  2⤵
  PID:5752
- C:\Windows\System\lBwYylf.exe
  C:\Windows\System\lBwYylf.exe
  2⤵
  PID:5768
- C:\Windows\System\rxakoOK.exe
  C:\Windows\System\rxakoOK.exe
  2⤵
  PID:5784
- C:\Windows\System\sjqxEAI.exe
  C:\Windows\System\sjqxEAI.exe
  2⤵
  PID:5804
- C:\Windows\System\gowLrpL.exe
  C:\Windows\System\gowLrpL.exe
  2⤵
  PID:5820
- C:\Windows\System\mpYnjXH.exe
  C:\Windows\System\mpYnjXH.exe
  2⤵
  PID:5840
- C:\Windows\System\wqgzlYg.exe
  C:\Windows\System\wqgzlYg.exe
  2⤵
  PID:5864
- C:\Windows\System\OmHsSNZ.exe
  C:\Windows\System\OmHsSNZ.exe
  2⤵
  PID:5880
- C:\Windows\System\WkTGvnc.exe
  C:\Windows\System\WkTGvnc.exe
  2⤵
  PID:5904
- C:\Windows\System\vFaAvgU.exe
  C:\Windows\System\vFaAvgU.exe
  2⤵
  PID:5920
- C:\Windows\System\yqfXBRo.exe
  C:\Windows\System\yqfXBRo.exe
  2⤵
  PID:5948
- C:\Windows\System\JBKdFEu.exe
  C:\Windows\System\JBKdFEu.exe
  2⤵
  PID:5972
- C:\Windows\System\kwkPCtz.exe
  C:\Windows\System\kwkPCtz.exe
  2⤵
  PID:5988
- C:\Windows\System\ubUHrtx.exe
  C:\Windows\System\ubUHrtx.exe
  2⤵
  PID:6016
- C:\Windows\System\QKGEQch.exe
  C:\Windows\System\QKGEQch.exe
  2⤵
  PID:6052
- C:\Windows\System\ajevsQL.exe
  C:\Windows\System\ajevsQL.exe
  2⤵
  PID:6076
- C:\Windows\System\JAicvJc.exe
  C:\Windows\System\JAicvJc.exe
  2⤵
  PID:6092
- C:\Windows\System\jEKgFaj.exe
  C:\Windows\System\jEKgFaj.exe
  2⤵
  PID:2092
- C:\Windows\System\OriblOp.exe
  C:\Windows\System\OriblOp.exe
  2⤵
  PID:368
- C:\Windows\System\PZGzCUj.exe
  C:\Windows\System\PZGzCUj.exe
  2⤵
  PID:1628
- C:\Windows\System\CimLzsn.exe
  C:\Windows\System\CimLzsn.exe
  2⤵
  PID:5356
- C:\Windows\System\pEkteNs.exe
  C:\Windows\System\pEkteNs.exe
  2⤵
  PID:1176
- C:\Windows\System\YlORRZg.exe
  C:\Windows\System\YlORRZg.exe
  2⤵
  PID:6072
- C:\Windows\System\NYHwlyf.exe
  C:\Windows\System\NYHwlyf.exe
  2⤵
  PID:5964
- C:\Windows\System\vJogfgp.exe
  C:\Windows\System\vJogfgp.exe
  2⤵
  PID:5916
- C:\Windows\System\bFOsnNk.exe
  C:\Windows\System\bFOsnNk.exe
  2⤵
  PID:5764
- C:\Windows\System\DXnlYWh.exe
  C:\Windows\System\DXnlYWh.exe
  2⤵
  PID:5640
- C:\Windows\System\mYOgKgn.exe
  C:\Windows\System\mYOgKgn.exe
  2⤵
  PID:5540
- C:\Windows\System\jpHwDNo.exe
  C:\Windows\System\jpHwDNo.exe
  2⤵
  PID:5468
- C:\Windows\System\sjWPStw.exe
  C:\Windows\System\sjWPStw.exe
  2⤵
  PID:5380
- C:\Windows\System\pMgvULK.exe
  C:\Windows\System\pMgvULK.exe
  2⤵
  PID:5320
- C:\Windows\System\gFTZUFe.exe
  C:\Windows\System\gFTZUFe.exe
  2⤵
  PID:5244
- C:\Windows\System\iQyesHg.exe
  C:\Windows\System\iQyesHg.exe
  2⤵
  PID:5192
- C:\Windows\System\ssxjIUl.exe
  C:\Windows\System\ssxjIUl.exe
  2⤵
  PID:5152
- C:\Windows\System\BOoeIqd.exe
  C:\Windows\System\BOoeIqd.exe
  2⤵
  PID:5744
- C:\Windows\System\sBpyjpc.exe
  C:\Windows\System\sBpyjpc.exe
  2⤵
  PID:6168
- C:\Windows\System\aQXobYn.exe
  C:\Windows\System\aQXobYn.exe
  2⤵
  PID:6280
- C:\Windows\System\diKoOUl.exe
  C:\Windows\System\diKoOUl.exe
  2⤵
  PID:6304
- C:\Windows\System\WzxaHBZ.exe
  C:\Windows\System\WzxaHBZ.exe
  2⤵
  PID:6320
- C:\Windows\System\KrxrWhD.exe
  C:\Windows\System\KrxrWhD.exe
  2⤵
  PID:6344
- C:\Windows\System\IYHpslO.exe
  C:\Windows\System\IYHpslO.exe
  2⤵
  PID:6368
- C:\Windows\System\WDqmSlP.exe
  C:\Windows\System\WDqmSlP.exe
  2⤵
  PID:6388
- C:\Windows\System\ykfMDxN.exe
  C:\Windows\System\ykfMDxN.exe
  2⤵
  PID:6404
- C:\Windows\System\CcDvUwG.exe
  C:\Windows\System\CcDvUwG.exe
  2⤵
  PID:6420
- C:\Windows\System\hSryzCB.exe
  C:\Windows\System\hSryzCB.exe
  2⤵
  PID:6492
- C:\Windows\System\XhEYyne.exe
  C:\Windows\System\XhEYyne.exe
  2⤵
  PID:6516
- C:\Windows\System\JEJMjRb.exe
  C:\Windows\System\JEJMjRb.exe
  2⤵
  PID:6540
- C:\Windows\System\DnLdBOi.exe
  C:\Windows\System\DnLdBOi.exe
  2⤵
  PID:6564
- C:\Windows\System\qwFCdAG.exe
  C:\Windows\System\qwFCdAG.exe
  2⤵
  PID:6580
- C:\Windows\System\elPiPlC.exe
  C:\Windows\System\elPiPlC.exe
  2⤵
  PID:6604
- C:\Windows\System\lbtVBYG.exe
  C:\Windows\System\lbtVBYG.exe
  2⤵
  PID:6628
- C:\Windows\System\cPfJhYv.exe
  C:\Windows\System\cPfJhYv.exe
  2⤵
  PID:6652
- C:\Windows\System\ukidovF.exe
  C:\Windows\System\ukidovF.exe
  2⤵
  PID:6672
- C:\Windows\System\IXHXztb.exe
  C:\Windows\System\IXHXztb.exe
  2⤵
  PID:6692
- C:\Windows\System\jPbMTNi.exe
  C:\Windows\System\jPbMTNi.exe
  2⤵
  PID:6716
- C:\Windows\System\yAxNBjK.exe
  C:\Windows\System\yAxNBjK.exe
  2⤵
  PID:6740
- C:\Windows\System\yBxYvop.exe
  C:\Windows\System\yBxYvop.exe
  2⤵
  PID:6760
- C:\Windows\System\OhZmVCj.exe
  C:\Windows\System\OhZmVCj.exe
  2⤵
  PID:6780
- C:\Windows\System\RejnkkT.exe
  C:\Windows\System\RejnkkT.exe
  2⤵
  PID:6800
- C:\Windows\System\pjEXfWz.exe
  C:\Windows\System\pjEXfWz.exe
  2⤵
  PID:6816
- C:\Windows\System\ftJeLKe.exe
  C:\Windows\System\ftJeLKe.exe
  2⤵
  PID:6836
- C:\Windows\System\xoUrERH.exe
  C:\Windows\System\xoUrERH.exe
  2⤵
  PID:6860
- C:\Windows\System\UdMIYKq.exe
  C:\Windows\System\UdMIYKq.exe
  2⤵
  PID:6884
- C:\Windows\System\xXPSRCb.exe
  C:\Windows\System\xXPSRCb.exe
  2⤵
  PID:6904
- C:\Windows\System\exxaBpM.exe
  C:\Windows\System\exxaBpM.exe
  2⤵
  PID:6924
- C:\Windows\System\WiHKnza.exe
  C:\Windows\System\WiHKnza.exe
  2⤵
  PID:6944
- C:\Windows\System\ximBFjZ.exe
  C:\Windows\System\ximBFjZ.exe
  2⤵
  PID:7072
- C:\Windows\System\BvQZdXf.exe
  C:\Windows\System\BvQZdXf.exe
  2⤵
  PID:7092
- C:\Windows\System\SjDSpDm.exe
  C:\Windows\System\SjDSpDm.exe
  2⤵
  PID:7112
- C:\Windows\System\gbyZfEz.exe
  C:\Windows\System\gbyZfEz.exe
  2⤵
  PID:7136
- C:\Windows\System\rYmxDeK.exe
  C:\Windows\System\rYmxDeK.exe
  2⤵
  PID:7160
- C:\Windows\System\ELGpdQH.exe
  C:\Windows\System\ELGpdQH.exe
  2⤵
  PID:6060
- C:\Windows\System\OfEAijI.exe
  C:\Windows\System\OfEAijI.exe
  2⤵
  PID:5956
- C:\Windows\System\hWkFAfP.exe
  C:\Windows\System\hWkFAfP.exe
  2⤵
  PID:5776
- C:\Windows\System\EIXciCN.exe
  C:\Windows\System\EIXciCN.exe
  2⤵
  PID:5692
- C:\Windows\System\DzHGusi.exe
  C:\Windows\System\DzHGusi.exe
  2⤵
  PID:4624
- C:\Windows\System\YPFolrK.exe
  C:\Windows\System\YPFolrK.exe
  2⤵
  PID:1504
- C:\Windows\System\kDcaBVo.exe
  C:\Windows\System\kDcaBVo.exe
  2⤵
  PID:1604
- C:\Windows\System\HWyFtvW.exe
  C:\Windows\System\HWyFtvW.exe
  2⤵
  PID:1028
- C:\Windows\System\EYmhmeK.exe
  C:\Windows\System\EYmhmeK.exe
  2⤵
  PID:6100
- C:\Windows\System\hEcacUj.exe
  C:\Windows\System\hEcacUj.exe
  2⤵
  PID:5944
- C:\Windows\System\HHHUIdv.exe
  C:\Windows\System\HHHUIdv.exe
  2⤵
  PID:5696
- C:\Windows\System\SZHmzRj.exe
  C:\Windows\System\SZHmzRj.exe
  2⤵
  PID:5496
- C:\Windows\System\VQiPirL.exe
  C:\Windows\System\VQiPirL.exe
  2⤵
  PID:5324
- C:\Windows\System\PrRixVh.exe
  C:\Windows\System\PrRixVh.exe
  2⤵
  PID:5236
- C:\Windows\System\lXScByd.exe
  C:\Windows\System\lXScByd.exe
  2⤵
  PID:6084
- C:\Windows\System\ejGSwIy.exe
  C:\Windows\System\ejGSwIy.exe
  2⤵
  PID:6264
- C:\Windows\System\jmxbzqa.exe
  C:\Windows\System\jmxbzqa.exe
  2⤵
  PID:6300
- C:\Windows\System\CeORnFw.exe
  C:\Windows\System\CeORnFw.exe
  2⤵
  PID:6336
- C:\Windows\System\SULUriF.exe
  C:\Windows\System\SULUriF.exe
  2⤵
  PID:6376
- C:\Windows\System\ooRlfOu.exe
  C:\Windows\System\ooRlfOu.exe
  2⤵
  PID:6416
- C:\Windows\System\OUeNIry.exe
  C:\Windows\System\OUeNIry.exe
  2⤵
  PID:6472
- C:\Windows\System\rOkbFlA.exe
  C:\Windows\System\rOkbFlA.exe
  2⤵
  PID:7188
- C:\Windows\System\gYbDAnX.exe
  C:\Windows\System\gYbDAnX.exe
  2⤵
  PID:7204
- C:\Windows\System\VCfidgI.exe
  C:\Windows\System\VCfidgI.exe
  2⤵
  PID:7228
- C:\Windows\System\pkNBEYq.exe
  C:\Windows\System\pkNBEYq.exe
  2⤵
  PID:7356
- C:\Windows\System\WVTWFTp.exe
  C:\Windows\System\WVTWFTp.exe
  2⤵
  PID:7376
- C:\Windows\System\mhCWXaH.exe
  C:\Windows\System\mhCWXaH.exe
  2⤵
  PID:7392
- C:\Windows\System\BHYKpFc.exe
  C:\Windows\System\BHYKpFc.exe
  2⤵
  PID:7412
- C:\Windows\System\HBKdPmX.exe
  C:\Windows\System\HBKdPmX.exe
  2⤵
  PID:7436
- C:\Windows\System\CiQckXB.exe
  C:\Windows\System\CiQckXB.exe
  2⤵
  PID:7460
- C:\Windows\System\kTUKbnO.exe
  C:\Windows\System\kTUKbnO.exe
  2⤵
  PID:7480
- C:\Windows\System\boBOzDy.exe
  C:\Windows\System\boBOzDy.exe
  2⤵
  PID:7504
- C:\Windows\System\npUPFSN.exe
  C:\Windows\System\npUPFSN.exe
  2⤵
  PID:7520
- C:\Windows\System\jEDHiar.exe
  C:\Windows\System\jEDHiar.exe
  2⤵
  PID:7540
- C:\Windows\System\EKsXAWc.exe
  C:\Windows\System\EKsXAWc.exe
  2⤵
  PID:7560
- C:\Windows\System\xVgSmlI.exe
  C:\Windows\System\xVgSmlI.exe
  2⤵
  PID:7636
- C:\Windows\System\MhWhSYP.exe
  C:\Windows\System\MhWhSYP.exe
  2⤵
  PID:7660
- C:\Windows\System\IrYKyuB.exe
  C:\Windows\System\IrYKyuB.exe
  2⤵
  PID:7680
- C:\Windows\System\LhftcsZ.exe
  C:\Windows\System\LhftcsZ.exe
  2⤵
  PID:7700
- C:\Windows\System\YRZAZFl.exe
  C:\Windows\System\YRZAZFl.exe
  2⤵
  PID:7716
- C:\Windows\System\eYlBpoA.exe
  C:\Windows\System\eYlBpoA.exe
  2⤵
  PID:7736
- C:\Windows\System\Rawxcmj.exe
  C:\Windows\System\Rawxcmj.exe
  2⤵
  PID:7792
- C:\Windows\System\QHWkwYN.exe
  C:\Windows\System\QHWkwYN.exe
  2⤵
  PID:7812
- C:\Windows\System\rqFnHcx.exe
  C:\Windows\System\rqFnHcx.exe
  2⤵
  PID:7832
- C:\Windows\System\geXwNdn.exe
  C:\Windows\System\geXwNdn.exe
  2⤵
  PID:7856
- C:\Windows\System\YUwqlOS.exe
  C:\Windows\System\YUwqlOS.exe
  2⤵
  PID:7872
- C:\Windows\System\QUtrjVb.exe
  C:\Windows\System\QUtrjVb.exe
  2⤵
  PID:7980
- C:\Windows\System\ndZmBhD.exe
  C:\Windows\System\ndZmBhD.exe
  2⤵
  PID:8016
- C:\Windows\System\RgMIcGS.exe
  C:\Windows\System\RgMIcGS.exe
  2⤵
  PID:8032
- C:\Windows\System\wySUXTt.exe
  C:\Windows\System\wySUXTt.exe
  2⤵
  PID:8048
- C:\Windows\System\MxeCeJx.exe
  C:\Windows\System\MxeCeJx.exe
  2⤵
  PID:8072
- C:\Windows\System\flKUNTC.exe
  C:\Windows\System\flKUNTC.exe
  2⤵
  PID:8096
- C:\Windows\System\auAhLMF.exe
  C:\Windows\System\auAhLMF.exe
  2⤵
  PID:8124
- C:\Windows\System\DnqBhMD.exe
  C:\Windows\System\DnqBhMD.exe
  2⤵
  PID:8152
- C:\Windows\System\UqHHLUe.exe
  C:\Windows\System\UqHHLUe.exe
  2⤵
  PID:8172
- C:\Windows\System\jsvchpB.exe
  C:\Windows\System\jsvchpB.exe
  2⤵
  PID:6508
- C:\Windows\System\kkYAwqS.exe
  C:\Windows\System\kkYAwqS.exe
  2⤵
  PID:6552
- C:\Windows\System\nwMCbwf.exe
  C:\Windows\System\nwMCbwf.exe
  2⤵
  PID:6600
- C:\Windows\System\xvSLYJA.exe
  C:\Windows\System\xvSLYJA.exe
  2⤵
  PID:6624
- C:\Windows\System\TgNgBbh.exe
  C:\Windows\System\TgNgBbh.exe
  2⤵
  PID:6668
- C:\Windows\System\DPcWBFu.exe
  C:\Windows\System\DPcWBFu.exe
  2⤵
  PID:6724
- C:\Windows\System\EEvkoLc.exe
  C:\Windows\System\EEvkoLc.exe
  2⤵
  PID:6756
- C:\Windows\System\ACKkhjm.exe
  C:\Windows\System\ACKkhjm.exe
  2⤵
  PID:6796
- C:\Windows\System\hwtzxIZ.exe
  C:\Windows\System\hwtzxIZ.exe
  2⤵
  PID:6828
- C:\Windows\System\ByShxTi.exe
  C:\Windows\System\ByShxTi.exe
  2⤵
  PID:6876
- C:\Windows\System\cfTNBpt.exe
  C:\Windows\System\cfTNBpt.exe
  2⤵
  PID:6920
- C:\Windows\System\uyOCSPM.exe
  C:\Windows\System\uyOCSPM.exe
  2⤵
  PID:6328
- C:\Windows\System\kDWWPiG.exe
  C:\Windows\System\kDWWPiG.exe
  2⤵
  PID:7236
- C:\Windows\System\dqDRtnm.exe
  C:\Windows\System\dqDRtnm.exe
  2⤵
  PID:7088
- C:\Windows\System\SJPkEJf.exe
  C:\Windows\System\SJPkEJf.exe
  2⤵
  PID:7108
- C:\Windows\System\QLeBGoX.exe
  C:\Windows\System\QLeBGoX.exe
  2⤵
  PID:7148
- C:\Windows\System\lkHSDFE.exe
  C:\Windows\System\lkHSDFE.exe
  2⤵
  PID:6008
- C:\Windows\System\tMLfows.exe
  C:\Windows\System\tMLfows.exe
  2⤵
  PID:3560
- C:\Windows\System\JNVmYVb.exe
  C:\Windows\System\JNVmYVb.exe
  2⤵
  PID:7536
- C:\Windows\System\KkIOzlU.exe
  C:\Windows\System\KkIOzlU.exe
  2⤵
  PID:3348
- C:\Windows\System\PsWjFKG.exe
  C:\Windows\System\PsWjFKG.exe
  2⤵
  PID:4516
- C:\Windows\System\HzZJxZv.exe
  C:\Windows\System\HzZJxZv.exe
  2⤵
  PID:1944
- C:\Windows\System\STVJRsF.exe
  C:\Windows\System\STVJRsF.exe
  2⤵
  PID:5620
- C:\Windows\System\uGptzCH.exe
  C:\Windows\System\uGptzCH.exe
  2⤵
  PID:5336
- C:\Windows\System\EwbhNnq.exe
  C:\Windows\System\EwbhNnq.exe
  2⤵
  PID:336
- C:\Windows\System\BeUievP.exe
  C:\Windows\System\BeUievP.exe
  2⤵
  PID:4600
- C:\Windows\System\yTFoqhU.exe
  C:\Windows\System\yTFoqhU.exe
  2⤵
  PID:7172
- C:\Windows\System\wdsbVQn.exe
  C:\Windows\System\wdsbVQn.exe
  2⤵
  PID:7220
- C:\Windows\System\LxRnWQP.exe
  C:\Windows\System\LxRnWQP.exe
  2⤵
  PID:7332
- C:\Windows\System\YxjPqUy.exe
  C:\Windows\System\YxjPqUy.exe
  2⤵
  PID:7408
- C:\Windows\System\yhVmstD.exe
  C:\Windows\System\yhVmstD.exe
  2⤵
  PID:7880
- C:\Windows\System\yiNxecl.exe
  C:\Windows\System\yiNxecl.exe
  2⤵
  PID:7708
- C:\Windows\System\EOXGuZs.exe
  C:\Windows\System\EOXGuZs.exe
  2⤵
  PID:7676
- C:\Windows\System\yMzJhHx.exe
  C:\Windows\System\yMzJhHx.exe
  2⤵
  PID:7512
- C:\Windows\System\kSwfcNX.exe
  C:\Windows\System\kSwfcNX.exe
  2⤵
  PID:7604
- C:\Windows\System\vNIhjpc.exe
  C:\Windows\System\vNIhjpc.exe
  2⤵
  PID:7960
- C:\Windows\System\fJVzlaU.exe
  C:\Windows\System\fJVzlaU.exe
  2⤵
  PID:7768
- C:\Windows\System\gtiRbVK.exe
  C:\Windows\System\gtiRbVK.exe
  2⤵
  PID:7784
- C:\Windows\System\FOyFivS.exe
  C:\Windows\System\FOyFivS.exe
  2⤵
  PID:7840
- C:\Windows\System\NIZObSz.exe
  C:\Windows\System\NIZObSz.exe
  2⤵
  PID:7968
- C:\Windows\System\ODGtsik.exe
  C:\Windows\System\ODGtsik.exe
  2⤵
  PID:1548
- C:\Windows\System\UVTbxvW.exe
  C:\Windows\System\UVTbxvW.exe
  2⤵
  PID:6700
- C:\Windows\System\AllGgqP.exe
  C:\Windows\System\AllGgqP.exe
  2⤵
  PID:6812
- C:\Windows\System\ESyrPwy.exe
  C:\Windows\System\ESyrPwy.exe
  2⤵
  PID:6856
- C:\Windows\System\ZWUhpEH.exe
  C:\Windows\System\ZWUhpEH.exe
  2⤵
  PID:6104
- C:\Windows\System\vyHhMOF.exe
  C:\Windows\System\vyHhMOF.exe
  2⤵
  PID:7940
- C:\Windows\System\SGaRnDv.exe
  C:\Windows\System\SGaRnDv.exe
  2⤵
  PID:7556
- C:\Windows\System\RGwXhJs.exe
  C:\Windows\System\RGwXhJs.exe
  2⤵
  PID:2904
- C:\Windows\System\WcyFYfI.exe
  C:\Windows\System\WcyFYfI.exe
  2⤵
  PID:5340
- C:\Windows\System\wLLVLXJ.exe
  C:\Windows\System\wLLVLXJ.exe
  2⤵
  PID:6536
- C:\Windows\System\mqOVNqh.exe
  C:\Windows\System\mqOVNqh.exe
  2⤵
  PID:3712
- C:\Windows\System\AfNUWkK.exe
  C:\Windows\System\AfNUWkK.exe
  2⤵
  PID:3956
- C:\Windows\System\OlDmsXM.exe
  C:\Windows\System\OlDmsXM.exe
  2⤵
  PID:7824
- C:\Windows\System\hmFRjPr.exe
  C:\Windows\System\hmFRjPr.exe
  2⤵
  PID:7628
- C:\Windows\System\EMBiXEe.exe
  C:\Windows\System\EMBiXEe.exe
  2⤵
  PID:4080
- C:\Windows\System\KNRlzcG.exe
  C:\Windows\System\KNRlzcG.exe
  2⤵
  PID:7828
- C:\Windows\System\elUzwlv.exe
  C:\Windows\System\elUzwlv.exe
  2⤵
  PID:8116
- C:\Windows\System\iWuPzpM.exe
  C:\Windows\System\iWuPzpM.exe
  2⤵
  PID:8204
- C:\Windows\System\iUoKpAV.exe
  C:\Windows\System\iUoKpAV.exe
  2⤵
  PID:8228
- C:\Windows\System\tIHVgiY.exe
  C:\Windows\System\tIHVgiY.exe
  2⤵
  PID:8256
- C:\Windows\System\rZneJcV.exe
  C:\Windows\System\rZneJcV.exe
  2⤵
  PID:8284
- C:\Windows\System\IdOcaRW.exe
  C:\Windows\System\IdOcaRW.exe
  2⤵
  PID:8304
- C:\Windows\System\VkWItTD.exe
  C:\Windows\System\VkWItTD.exe
  2⤵
  PID:8336
- C:\Windows\System\cUJMUPU.exe
  C:\Windows\System\cUJMUPU.exe
  2⤵
  PID:8356
- C:\Windows\System\yeCzjcy.exe
  C:\Windows\System\yeCzjcy.exe
  2⤵
  PID:8372
- C:\Windows\System\qEUOnRf.exe
  C:\Windows\System\qEUOnRf.exe
  2⤵
  PID:8388
- C:\Windows\System\BbNwJdj.exe
  C:\Windows\System\BbNwJdj.exe
  2⤵
  PID:8404
- C:\Windows\System\raKkqEb.exe
  C:\Windows\System\raKkqEb.exe
  2⤵
  PID:8420
- C:\Windows\System\zitPlVZ.exe
  C:\Windows\System\zitPlVZ.exe
  2⤵
  PID:8440
- C:\Windows\System\GDrJhel.exe
  C:\Windows\System\GDrJhel.exe
  2⤵
  PID:8464
- C:\Windows\System\QsvXJnU.exe
  C:\Windows\System\QsvXJnU.exe
  2⤵
  PID:8492
- C:\Windows\System\pOTpbUK.exe
  C:\Windows\System\pOTpbUK.exe
  2⤵
  PID:8508
- C:\Windows\System\KfUoQcb.exe
  C:\Windows\System\KfUoQcb.exe
  2⤵
  PID:8532
- C:\Windows\System\VXRBaas.exe
  C:\Windows\System\VXRBaas.exe
  2⤵
  PID:8556
- C:\Windows\System\bApPWCe.exe
  C:\Windows\System\bApPWCe.exe
  2⤵
  PID:8576
- C:\Windows\System\CUQPGTo.exe
  C:\Windows\System\CUQPGTo.exe
  2⤵
  PID:8592
- C:\Windows\System\ZLSCncv.exe
  C:\Windows\System\ZLSCncv.exe
  2⤵
  PID:8624
- C:\Windows\System\BNVRwAF.exe
  C:\Windows\System\BNVRwAF.exe
  2⤵
  PID:8656
- C:\Windows\System\kxVHFce.exe
  C:\Windows\System\kxVHFce.exe
  2⤵
  PID:8680
- C:\Windows\System\clybjSn.exe
  C:\Windows\System\clybjSn.exe
  2⤵
  PID:8896
- C:\Windows\System\rhzevJp.exe
  C:\Windows\System\rhzevJp.exe
  2⤵
  PID:8916
- C:\Windows\System\hLTlIHQ.exe
  C:\Windows\System\hLTlIHQ.exe
  2⤵
  PID:8944
- C:\Windows\System\qzQjHVy.exe
  C:\Windows\System\qzQjHVy.exe
  2⤵
  PID:8968
- C:\Windows\System\kMlNsFs.exe
  C:\Windows\System\kMlNsFs.exe
  2⤵
  PID:8992
- C:\Windows\System\xcPhlLN.exe
  C:\Windows\System\xcPhlLN.exe
  2⤵
  PID:9020
- C:\Windows\System\vXWMDtr.exe
  C:\Windows\System\vXWMDtr.exe
  2⤵
  PID:9048
- C:\Windows\System\UKZXOXT.exe
  C:\Windows\System\UKZXOXT.exe
  2⤵
  PID:9072
- C:\Windows\System\smCbIAg.exe
  C:\Windows\System\smCbIAg.exe
  2⤵
  PID:9088
- C:\Windows\System\cEkEPYc.exe
  C:\Windows\System\cEkEPYc.exe
  2⤵
  PID:9116
- C:\Windows\System\yuGJDVu.exe
  C:\Windows\System\yuGJDVu.exe
  2⤵
  PID:9140
- C:\Windows\System\HdzdoDQ.exe
  C:\Windows\System\HdzdoDQ.exe
  2⤵
  PID:9156
- C:\Windows\System\ABZDkbI.exe
  C:\Windows\System\ABZDkbI.exe
  2⤵
  PID:9184
- C:\Windows\System\DDbanMt.exe
  C:\Windows\System\DDbanMt.exe
  2⤵
  PID:9204
- C:\Windows\System\DzPbbIa.exe
  C:\Windows\System\DzPbbIa.exe
  2⤵
  PID:6964
- C:\Windows\System\pLawIuM.exe
  C:\Windows\System\pLawIuM.exe
  2⤵
  PID:5212
- C:\Windows\System\JYGBfUn.exe
  C:\Windows\System\JYGBfUn.exe
  2⤵
  PID:8768
- C:\Windows\System\qgONhOX.exe
  C:\Windows\System\qgONhOX.exe
  2⤵
  PID:8784
- C:\Windows\System\pMGgznx.exe
  C:\Windows\System\pMGgznx.exe
  2⤵
  PID:8808
- C:\Windows\System\uQWKjRg.exe
  C:\Windows\System\uQWKjRg.exe
  2⤵
  PID:8828
- C:\Windows\System\PLhLcAm.exe
  C:\Windows\System\PLhLcAm.exe
  2⤵
  PID:8852
- C:\Windows\System\RUpaxOo.exe
  C:\Windows\System\RUpaxOo.exe
  2⤵
  PID:8868
- C:\Windows\System\ayPLubC.exe
  C:\Windows\System\ayPLubC.exe
  2⤵
  PID:8144
- C:\Windows\System\HGYRhzd.exe
  C:\Windows\System\HGYRhzd.exe
  2⤵
  PID:9012
- C:\Windows\System\eWAcSrt.exe
  C:\Windows\System\eWAcSrt.exe
  2⤵
  PID:9032
- C:\Windows\System\IejsGid.exe
  C:\Windows\System\IejsGid.exe
  2⤵
  PID:8276
- C:\Windows\System\sAffjlV.exe
  C:\Windows\System\sAffjlV.exe
  2⤵
  PID:6748
- C:\Windows\System\xadnaYY.exe
  C:\Windows\System\xadnaYY.exe
  2⤵
  PID:6360
- C:\Windows\System\cOgMPjW.exe
  C:\Windows\System\cOgMPjW.exe
  2⤵
  PID:5448
- C:\Windows\System\SkxSKVC.exe
  C:\Windows\System\SkxSKVC.exe
  2⤵
  PID:8516
- C:\Windows\System\DICSQXr.exe
  C:\Windows\System\DICSQXr.exe
  2⤵
  PID:6028
- C:\Windows\System\jggRYkT.exe
  C:\Windows\System\jggRYkT.exe
  2⤵
  PID:7692
- C:\Windows\System\QogMdwH.exe
  C:\Windows\System\QogMdwH.exe
  2⤵
  PID:8044
- C:\Windows\System\TnyQsFq.exe
  C:\Windows\System\TnyQsFq.exe
  2⤵
  PID:4520
- C:\Windows\System\OtmMJOQ.exe
  C:\Windows\System\OtmMJOQ.exe
  2⤵
  PID:1064
- C:\Windows\System\YdKoeWG.exe
  C:\Windows\System\YdKoeWG.exe
  2⤵
  PID:9244
- C:\Windows\System\AqlBJsw.exe
  C:\Windows\System\AqlBJsw.exe
  2⤵
  PID:9260
- C:\Windows\System\zdTnAdT.exe
  C:\Windows\System\zdTnAdT.exe
  2⤵
  PID:9284
- C:\Windows\System\naFThRn.exe
  C:\Windows\System\naFThRn.exe
  2⤵
  PID:9308
- C:\Windows\System\QJTCHsD.exe
  C:\Windows\System\QJTCHsD.exe
  2⤵
  PID:9332
- C:\Windows\System\NPUEOqa.exe
  C:\Windows\System\NPUEOqa.exe
  2⤵
  PID:9356
- C:\Windows\System\AkLkEtE.exe
  C:\Windows\System\AkLkEtE.exe
  2⤵
  PID:9392
- C:\Windows\System\XiFNctV.exe
  C:\Windows\System\XiFNctV.exe
  2⤵
  PID:9428
- C:\Windows\System\KGBdXYl.exe
  C:\Windows\System\KGBdXYl.exe
  2⤵
  PID:9464
- C:\Windows\System\GxsYrzC.exe
  C:\Windows\System\GxsYrzC.exe
  2⤵
  PID:9488
- C:\Windows\System\jBKugEp.exe
  C:\Windows\System\jBKugEp.exe
  2⤵
  PID:9512
- C:\Windows\System\MZrVYVg.exe
  C:\Windows\System\MZrVYVg.exe
  2⤵
  PID:9528
- C:\Windows\System\ToIKpil.exe
  C:\Windows\System\ToIKpil.exe
  2⤵
  PID:9564
- C:\Windows\System\VXlOhXm.exe
  C:\Windows\System\VXlOhXm.exe
  2⤵
  PID:9584
- C:\Windows\System\UyayCcO.exe
  C:\Windows\System\UyayCcO.exe
  2⤵
  PID:9608
- C:\Windows\System\rLUbUiy.exe
  C:\Windows\System\rLUbUiy.exe
  2⤵
  PID:9628
- C:\Windows\System\YzVUNNW.exe
  C:\Windows\System\YzVUNNW.exe
  2⤵
  PID:9648
- C:\Windows\System\FEBsqQQ.exe
  C:\Windows\System\FEBsqQQ.exe
  2⤵
  PID:9672
- C:\Windows\System\IhUtIrx.exe
  C:\Windows\System\IhUtIrx.exe
  2⤵
  PID:9696
- C:\Windows\System\DpnmPRc.exe
  C:\Windows\System\DpnmPRc.exe
  2⤵
  PID:9720
- C:\Windows\System\QHmNSzN.exe
  C:\Windows\System\QHmNSzN.exe
  2⤵
  PID:9748
- C:\Windows\System\HCLQIpl.exe
  C:\Windows\System\HCLQIpl.exe
  2⤵
  PID:9772
- C:\Windows\System\CwTdRQj.exe
  C:\Windows\System\CwTdRQj.exe
  2⤵
  PID:9788
- C:\Windows\System\AUZcIeA.exe
  C:\Windows\System\AUZcIeA.exe
  2⤵
  PID:9808
- C:\Windows\System\vWIKHtD.exe
  C:\Windows\System\vWIKHtD.exe
  2⤵
  PID:9828
- C:\Windows\System\adqzWUR.exe
  C:\Windows\System\adqzWUR.exe
  2⤵
  PID:9848
- C:\Windows\System\uvdMqwo.exe
  C:\Windows\System\uvdMqwo.exe
  2⤵
  PID:9872
- C:\Windows\System\WdNUjlW.exe
  C:\Windows\System\WdNUjlW.exe
  2⤵
  PID:9892
- C:\Windows\System\hJjOjPP.exe
  C:\Windows\System\hJjOjPP.exe
  2⤵
  PID:9920
- C:\Windows\System\iDtuOeW.exe
  C:\Windows\System\iDtuOeW.exe
  2⤵
  PID:9940
- C:\Windows\System\vxMNjtM.exe
  C:\Windows\System\vxMNjtM.exe
  2⤵
  PID:9964
- C:\Windows\System\gtPCFXm.exe
  C:\Windows\System\gtPCFXm.exe
  2⤵
  PID:9988
- C:\Windows\System\IpIOGMy.exe
  C:\Windows\System\IpIOGMy.exe
  2⤵
  PID:10012
- C:\Windows\System\RyDXquW.exe
  C:\Windows\System\RyDXquW.exe
  2⤵
  PID:10036
- C:\Windows\System\UkilNxI.exe
  C:\Windows\System\UkilNxI.exe
  2⤵
  PID:10060
- C:\Windows\System\rPhJcUc.exe
  C:\Windows\System\rPhJcUc.exe
  2⤵
  PID:10080
- C:\Windows\System\dbdJPrQ.exe
  C:\Windows\System\dbdJPrQ.exe
  2⤵
  PID:10112
- C:\Windows\System\cGqHxxy.exe
  C:\Windows\System\cGqHxxy.exe
  2⤵
  PID:10136
- C:\Windows\System\ouNbZJx.exe
  C:\Windows\System\ouNbZJx.exe
  2⤵
  PID:10156
- C:\Windows\System\zcJQwfY.exe
  C:\Windows\System\zcJQwfY.exe
  2⤵
  PID:10180
- C:\Windows\System\WsvnmRQ.exe
  C:\Windows\System\WsvnmRQ.exe
  2⤵
  PID:10208
- C:\Windows\System\kPLOniL.exe
  C:\Windows\System\kPLOniL.exe
  2⤵
  PID:10232
- C:\Windows\System\MJHXwEi.exe
  C:\Windows\System\MJHXwEi.exe
  2⤵
  PID:9176
- C:\Windows\System\npUxDja.exe
  C:\Windows\System\npUxDja.exe
  2⤵
  PID:8384
- C:\Windows\System\yknmlEG.exe
  C:\Windows\System\yknmlEG.exe
  2⤵
  PID:8544
- C:\Windows\System\YkVTUKC.exe
  C:\Windows\System\YkVTUKC.exe
  2⤵
  PID:8584
- C:\Windows\System\otSXAdH.exe
  C:\Windows\System\otSXAdH.exe
  2⤵
  PID:8636
- C:\Windows\System\wmEvyAD.exe
  C:\Windows\System\wmEvyAD.exe
  2⤵
  PID:2660
- C:\Windows\System\mqOuZtO.exe
  C:\Windows\System\mqOuZtO.exe
  2⤵
  PID:8692
- C:\Windows\System\icSReUa.exe
  C:\Windows\System\icSReUa.exe
  2⤵
  PID:8792
- C:\Windows\System\UPKmHEU.exe
  C:\Windows\System\UPKmHEU.exe
  2⤵
  PID:8864
- C:\Windows\System\pEDmIPR.exe
  C:\Windows\System\pEDmIPR.exe
  2⤵
  PID:8236
- C:\Windows\System\QTqNBkR.exe
  C:\Windows\System\QTqNBkR.exe
  2⤵
  PID:8412
- C:\Windows\System\JNJjQmv.exe
  C:\Windows\System\JNJjQmv.exe
  2⤵
  PID:7372
- C:\Windows\System\OTofxCo.exe
  C:\Windows\System\OTofxCo.exe
  2⤵
  PID:8952
- C:\Windows\System\DSjKOTG.exe
  C:\Windows\System\DSjKOTG.exe
  2⤵
  PID:9084
- C:\Windows\System\QXUByVd.exe
  C:\Windows\System\QXUByVd.exe
  2⤵
  PID:8980
- C:\Windows\System\zMaHEuJ.exe
  C:\Windows\System\zMaHEuJ.exe
  2⤵
  PID:4236
- C:\Windows\System\BHVgixK.exe
  C:\Windows\System\BHVgixK.exe
  2⤵
  PID:9300
- C:\Windows\System\EmPJAKd.exe
  C:\Windows\System\EmPJAKd.exe
  2⤵
  PID:6512
- C:\Windows\System\AsmArOC.exe
  C:\Windows\System\AsmArOC.exe
  2⤵
  PID:2632
- C:\Windows\System\YalRviz.exe
  C:\Windows\System\YalRviz.exe
  2⤵
  PID:6868
- C:\Windows\System\jQfwZzq.exe
  C:\Windows\System\jQfwZzq.exe
  2⤵
  PID:9636
- C:\Windows\System\mKwPZuF.exe
  C:\Windows\System\mKwPZuF.exe
  2⤵
  PID:8820
- C:\Windows\System\nWgUWws.exe
  C:\Windows\System\nWgUWws.exe
  2⤵
  PID:7488
- C:\Windows\System\TwIhGdK.exe
  C:\Windows\System\TwIhGdK.exe
  2⤵
  PID:9844
- C:\Windows\System\pZWOTNS.exe
  C:\Windows\System\pZWOTNS.exe
  2⤵
  PID:9908
- C:\Windows\System\vLLHaFs.exe
  C:\Windows\System\vLLHaFs.exe
  2⤵
  PID:9956
- C:\Windows\System\vmlGHQi.exe
  C:\Windows\System\vmlGHQi.exe
  2⤵
  PID:10020
- C:\Windows\System\VOAlIqK.exe
  C:\Windows\System\VOAlIqK.exe
  2⤵
  PID:9240
- C:\Windows\System\JeaBGvL.exe
  C:\Windows\System\JeaBGvL.exe
  2⤵
  PID:9340
- C:\Windows\System\OqoEeWn.exe
  C:\Windows\System\OqoEeWn.exe
  2⤵
  PID:10132
- C:\Windows\System\XNcqoeF.exe
  C:\Windows\System\XNcqoeF.exe
  2⤵
  PID:10224
- C:\Windows\System\dtZDwQb.exe
  C:\Windows\System\dtZDwQb.exe
  2⤵
  PID:8476
- C:\Windows\System\hBzUyjM.exe
  C:\Windows\System\hBzUyjM.exe
  2⤵
  PID:9576
- C:\Windows\System\NmCbyzC.exe
  C:\Windows\System\NmCbyzC.exe
  2⤵
  PID:10252
- C:\Windows\System\RKhgTqd.exe
  C:\Windows\System\RKhgTqd.exe
  2⤵
  PID:10268
- C:\Windows\System\PWzfUvh.exe
  C:\Windows\System\PWzfUvh.exe
  2⤵
  PID:10288
- C:\Windows\System\VYSwTpv.exe
  C:\Windows\System\VYSwTpv.exe
  2⤵
  PID:10304
- C:\Windows\System\AgtQKzU.exe
  C:\Windows\System\AgtQKzU.exe
  2⤵
  PID:10328
- C:\Windows\System\wAKVdQu.exe
  C:\Windows\System\wAKVdQu.exe
  2⤵
  PID:10352
- C:\Windows\System\OAZYjUc.exe
  C:\Windows\System\OAZYjUc.exe
  2⤵
  PID:10376
- C:\Windows\System\qNUkWKx.exe
  C:\Windows\System\qNUkWKx.exe
  2⤵
  PID:10396
- C:\Windows\System\YDWgZqI.exe
  C:\Windows\System\YDWgZqI.exe
  2⤵
  PID:10416
- C:\Windows\System\PcWuVMh.exe
  C:\Windows\System\PcWuVMh.exe
  2⤵
  PID:10440
- C:\Windows\System\bTpcMMF.exe
  C:\Windows\System\bTpcMMF.exe
  2⤵
  PID:10464
- C:\Windows\System\ZQquiQB.exe
  C:\Windows\System\ZQquiQB.exe
  2⤵
  PID:10484
- C:\Windows\System\vTVMzTG.exe
  C:\Windows\System\vTVMzTG.exe
  2⤵
  PID:10504
- C:\Windows\System\cwtMzIw.exe
  C:\Windows\System\cwtMzIw.exe
  2⤵
  PID:10528
- C:\Windows\System\YEkKAyZ.exe
  C:\Windows\System\YEkKAyZ.exe
  2⤵
  PID:10552
- C:\Windows\System\FAKPoEK.exe
  C:\Windows\System\FAKPoEK.exe
  2⤵
  PID:10580
- C:\Windows\System\biszcvW.exe
  C:\Windows\System\biszcvW.exe
  2⤵
  PID:10600
- C:\Windows\System\IqGFeHz.exe
  C:\Windows\System\IqGFeHz.exe
  2⤵
  PID:10620
- C:\Windows\System\IdlqRJq.exe
  C:\Windows\System\IdlqRJq.exe
  2⤵
  PID:10644
- C:\Windows\System\TvsBJuB.exe
  C:\Windows\System\TvsBJuB.exe
  2⤵
  PID:10672
- C:\Windows\System\aVYjbzS.exe
  C:\Windows\System\aVYjbzS.exe
  2⤵
  PID:10700
- C:\Windows\System\EoDXbhd.exe
  C:\Windows\System\EoDXbhd.exe
  2⤵
  PID:10720
- C:\Windows\System\irIlFPq.exe
  C:\Windows\System\irIlFPq.exe
  2⤵
  PID:10740
- C:\Windows\System\cpDPHff.exe
  C:\Windows\System\cpDPHff.exe
  2⤵
  PID:10764
- C:\Windows\System\FsfQJlk.exe
  C:\Windows\System\FsfQJlk.exe
  2⤵
  PID:10784
- C:\Windows\System\SLlGGDG.exe
  C:\Windows\System\SLlGGDG.exe
  2⤵
  PID:10804
- C:\Windows\System\AzDJBQw.exe
  C:\Windows\System\AzDJBQw.exe
  2⤵
  PID:10828
- C:\Windows\System\PTaqRDX.exe
  C:\Windows\System\PTaqRDX.exe
  2⤵
  PID:10852
- C:\Windows\System\yEAWjKj.exe
  C:\Windows\System\yEAWjKj.exe
  2⤵
  PID:10876
- C:\Windows\System\FrFmKQc.exe
  C:\Windows\System\FrFmKQc.exe
  2⤵
  PID:10904
- C:\Windows\System\YMQschM.exe
  C:\Windows\System\YMQschM.exe
  2⤵
  PID:10928
- C:\Windows\System\KpdiUSP.exe
  C:\Windows\System\KpdiUSP.exe
  2⤵
  PID:10948
- C:\Windows\System\MEgsmZa.exe
  C:\Windows\System\MEgsmZa.exe
  2⤵
  PID:10972
- C:\Windows\System\vQUQkKn.exe
  C:\Windows\System\vQUQkKn.exe
  2⤵
  PID:10996
- C:\Windows\System\lHGiruM.exe
  C:\Windows\System\lHGiruM.exe
  2⤵
  PID:11012
- C:\Windows\System\ABuFJEm.exe
  C:\Windows\System\ABuFJEm.exe
  2⤵
  PID:11028
- C:\Windows\System\qWbOzBE.exe
  C:\Windows\System\qWbOzBE.exe
  2⤵
  PID:11044
- C:\Windows\System\ThBNPzA.exe
  C:\Windows\System\ThBNPzA.exe
  2⤵
  PID:11060
- C:\Windows\System\IkEbZRN.exe
  C:\Windows\System\IkEbZRN.exe
  2⤵
  PID:11076
- C:\Windows\System\RvmgEJU.exe
  C:\Windows\System\RvmgEJU.exe
  2⤵
  PID:11096
- C:\Windows\System\RWBjhWM.exe
  C:\Windows\System\RWBjhWM.exe
  2⤵
  PID:11112
- C:\Windows\System\gwgcnxU.exe
  C:\Windows\System\gwgcnxU.exe
  2⤵
  PID:11128
- C:\Windows\System\NYURitx.exe
  C:\Windows\System\NYURitx.exe
  2⤵
  PID:11152
- C:\Windows\System\GyhSRDh.exe
  C:\Windows\System\GyhSRDh.exe
  2⤵
  PID:11172
- C:\Windows\System\dWDVtyB.exe
  C:\Windows\System\dWDVtyB.exe
  2⤵
  PID:11192
- C:\Windows\System\gaodhxm.exe
  C:\Windows\System\gaodhxm.exe
  2⤵
  PID:11220
- C:\Windows\System\ZdgjOGt.exe
  C:\Windows\System\ZdgjOGt.exe
  2⤵
  PID:11244
- C:\Windows\System\QSncGwJ.exe
  C:\Windows\System\QSncGwJ.exe
  2⤵
  PID:8748
- C:\Windows\System\flaejQD.exe
  C:\Windows\System\flaejQD.exe
  2⤵
  PID:9640
- C:\Windows\System\PPNuice.exe
  C:\Windows\System\PPNuice.exe
  2⤵
  PID:8912
- C:\Windows\System\JZZtuqj.exe
  C:\Windows\System\JZZtuqj.exe
  2⤵
  PID:3792
- C:\Windows\System\XDkXvWk.exe
  C:\Windows\System\XDkXvWk.exe
  2⤵
  PID:9816
- C:\Windows\System\GlDSpyQ.exe
  C:\Windows\System\GlDSpyQ.exe
  2⤵
  PID:9280
- C:\Windows\System\fvQZhwi.exe
  C:\Windows\System\fvQZhwi.exe
  2⤵
  PID:964
- C:\Windows\System\NUccPnl.exe
  C:\Windows\System\NUccPnl.exe
  2⤵
  PID:9936
- C:\Windows\System\oqebFoR.exe
  C:\Windows\System\oqebFoR.exe
  2⤵
  PID:8064
- C:\Windows\System\jYwIewQ.exe
  C:\Windows\System\jYwIewQ.exe
  2⤵
  PID:9400
- C:\Windows\System\VhfFRtM.exe
  C:\Windows\System\VhfFRtM.exe
  2⤵
  PID:9416
- C:\Windows\System\iRvLClR.exe
  C:\Windows\System\iRvLClR.exe
  2⤵
  PID:9152
- C:\Windows\System\eGthoJB.exe
  C:\Windows\System\eGthoJB.exe
  2⤵
  PID:9496
- C:\Windows\System\xviRZPQ.exe
  C:\Windows\System\xviRZPQ.exe
  2⤵
  PID:9556
- C:\Windows\System\VVxUwnt.exe
  C:\Windows\System\VVxUwnt.exe
  2⤵
  PID:9472
- C:\Windows\System\ALfllOJ.exe
  C:\Windows\System\ALfllOJ.exe
  2⤵
  PID:8924
- C:\Windows\System\sLuoAAs.exe
  C:\Windows\System\sLuoAAs.exe
  2⤵
  PID:8212
- C:\Windows\System\eDHrWYV.exe
  C:\Windows\System\eDHrWYV.exe
  2⤵
  PID:6576
- C:\Windows\System\xiiGSbD.exe
  C:\Windows\System\xiiGSbD.exe
  2⤵
  PID:9080
- C:\Windows\System\nvDELJv.exe
  C:\Windows\System\nvDELJv.exe
  2⤵
  PID:11284
- C:\Windows\System\NJJKkuP.exe
  C:\Windows\System\NJJKkuP.exe
  2⤵
  PID:11308
- C:\Windows\System\HgutZAA.exe
  C:\Windows\System\HgutZAA.exe
  2⤵
  PID:11332
- C:\Windows\System\KVucbJe.exe
  C:\Windows\System\KVucbJe.exe
  2⤵
  PID:11352
- C:\Windows\System\mjgzxtO.exe
  C:\Windows\System\mjgzxtO.exe
  2⤵
  PID:11372
- C:\Windows\System\pRzVPVl.exe
  C:\Windows\System\pRzVPVl.exe
  2⤵
  PID:11396
- C:\Windows\System\zxvkRbX.exe
  C:\Windows\System\zxvkRbX.exe
  2⤵
  PID:11412
- C:\Windows\System\RAazdWv.exe
  C:\Windows\System\RAazdWv.exe
  2⤵
  PID:11440
- C:\Windows\System\vAayDlx.exe
  C:\Windows\System\vAayDlx.exe
  2⤵
  PID:11460
- C:\Windows\System\PfViFJl.exe
  C:\Windows\System\PfViFJl.exe
  2⤵
  PID:11484
- C:\Windows\System\pgxaUVG.exe
  C:\Windows\System\pgxaUVG.exe
  2⤵
  PID:11508
- C:\Windows\System\aeZCBwx.exe
  C:\Windows\System\aeZCBwx.exe
  2⤵
  PID:11536
- C:\Windows\System\tertqUD.exe
  C:\Windows\System\tertqUD.exe
  2⤵
  PID:11560
- C:\Windows\System\ZBRnJKn.exe
  C:\Windows\System\ZBRnJKn.exe
  2⤵
  PID:11580
- C:\Windows\System\rHANMda.exe
  C:\Windows\System\rHANMda.exe
  2⤵
  PID:11604
- C:\Windows\System\HLwbfoo.exe
  C:\Windows\System\HLwbfoo.exe
  2⤵
  PID:11628
- C:\Windows\System\sVURyTR.exe
  C:\Windows\System\sVURyTR.exe
  2⤵
  PID:11656
- C:\Windows\System\eMJsfkY.exe
  C:\Windows\System\eMJsfkY.exe
  2⤵
  PID:11676
- C:\Windows\System\HzVTOzg.exe
  C:\Windows\System\HzVTOzg.exe
  2⤵
  PID:11696
- C:\Windows\System\tUgBoVV.exe
  C:\Windows\System\tUgBoVV.exe
  2⤵
  PID:11720
- C:\Windows\System\JrOHhdt.exe
  C:\Windows\System\JrOHhdt.exe
  2⤵
  PID:11740
- C:\Windows\System\yavWVXH.exe
  C:\Windows\System\yavWVXH.exe
  2⤵
  PID:11764
- C:\Windows\System\geKsExY.exe
  C:\Windows\System\geKsExY.exe
  2⤵
  PID:11788
- C:\Windows\System\WxFPPcD.exe
  C:\Windows\System\WxFPPcD.exe
  2⤵
  PID:11816
- C:\Windows\System\KxLsPjW.exe
  C:\Windows\System\KxLsPjW.exe
  2⤵
  PID:11836
- C:\Windows\System\hXrgulQ.exe
  C:\Windows\System\hXrgulQ.exe
  2⤵
  PID:11856
- C:\Windows\System\sXLXmKZ.exe
  C:\Windows\System\sXLXmKZ.exe
  2⤵
  PID:11876
- C:\Windows\System\OrFUGvs.exe
  C:\Windows\System\OrFUGvs.exe
  2⤵
  PID:11904
- C:\Windows\System\uQlCqaI.exe
  C:\Windows\System\uQlCqaI.exe
  2⤵
  PID:11928
- C:\Windows\System\poyebXR.exe
  C:\Windows\System\poyebXR.exe
  2⤵
  PID:11944
- C:\Windows\System\HUepwpa.exe
  C:\Windows\System\HUepwpa.exe
  2⤵
  PID:11960
- C:\Windows\System\zCeJXRu.exe
  C:\Windows\System\zCeJXRu.exe
  2⤵
  PID:11976
- C:\Windows\System\rEWuFZL.exe
  C:\Windows\System\rEWuFZL.exe
  2⤵
  PID:11992
- C:\Windows\System\YctXPnS.exe
  C:\Windows\System\YctXPnS.exe
  2⤵
  PID:12008
- C:\Windows\System\jOpwgbj.exe
  C:\Windows\System\jOpwgbj.exe
  2⤵
  PID:12024
- C:\Windows\System\JFtkfbl.exe
  C:\Windows\System\JFtkfbl.exe
  2⤵
  PID:12040
- C:\Windows\System\mOaURiW.exe
  C:\Windows\System\mOaURiW.exe
  2⤵
  PID:12056
- C:\Windows\System\efoQFZV.exe
  C:\Windows\System\efoQFZV.exe
  2⤵
  PID:12080
- C:\Windows\System\CplOlAo.exe
  C:\Windows\System\CplOlAo.exe
  2⤵
  PID:12096
- C:\Windows\System\EnmPBby.exe
  C:\Windows\System\EnmPBby.exe
  2⤵
  PID:12120
- C:\Windows\System\pLeDKBj.exe
  C:\Windows\System\pLeDKBj.exe
  2⤵
  PID:12144
- C:\Windows\System\OAeQLsA.exe
  C:\Windows\System\OAeQLsA.exe
  2⤵
  PID:12172
- C:\Windows\System\mJHYGay.exe
  C:\Windows\System\mJHYGay.exe
  2⤵
  PID:12192
- C:\Windows\System\YdnzwLv.exe
  C:\Windows\System\YdnzwLv.exe
  2⤵
  PID:12220
- C:\Windows\System\ygbWpnA.exe
  C:\Windows\System\ygbWpnA.exe
  2⤵
  PID:12240
- C:\Windows\System\JOjxBFF.exe
  C:\Windows\System\JOjxBFF.exe
  2⤵
  PID:12264
- C:\Windows\System\uhYoYtu.exe
  C:\Windows\System\uhYoYtu.exe
  2⤵
  PID:10512
- C:\Windows\System\eNXhbfR.exe
  C:\Windows\System\eNXhbfR.exe
  2⤵
  PID:10544
- C:\Windows\System\YlrevFq.exe
  C:\Windows\System\YlrevFq.exe
  2⤵
  PID:10616
- C:\Windows\System\RhNymac.exe
  C:\Windows\System\RhNymac.exe
  2⤵
  PID:9200
- C:\Windows\System\pLWQrPd.exe
  C:\Windows\System\pLWQrPd.exe
  2⤵
  PID:10712
- C:\Windows\System\ENKwjfM.exe
  C:\Windows\System\ENKwjfM.exe
  2⤵
  PID:10796
- C:\Windows\System\WHDgaGS.exe
  C:\Windows\System\WHDgaGS.exe
  2⤵
  PID:10872
- C:\Windows\System\rUBhvJM.exe
  C:\Windows\System\rUBhvJM.exe
  2⤵
  PID:9692
- C:\Windows\System\oWeTBFd.exe
  C:\Windows\System\oWeTBFd.exe
  2⤵
  PID:10988
- C:\Windows\System\PPREECH.exe
  C:\Windows\System\PPREECH.exe
  2⤵
  PID:10152
- C:\Windows\System\EtoHmmh.exe
  C:\Windows\System\EtoHmmh.exe
  2⤵
  PID:9952
- C:\Windows\System\NdYpYjs.exe
  C:\Windows\System\NdYpYjs.exe
  2⤵
  PID:9276
- C:\Windows\System\rAhvhND.exe
  C:\Windows\System\rAhvhND.exe
  2⤵
  PID:10196
- C:\Windows\System\cVkMQXd.exe
  C:\Windows\System\cVkMQXd.exe
  2⤵
  PID:8840
- C:\Windows\System\uYYTMhV.exe
  C:\Windows\System\uYYTMhV.exe
  2⤵
  PID:8780
- C:\Windows\System\jVAhAgH.exe
  C:\Windows\System\jVAhAgH.exe
  2⤵
  PID:10048
- C:\Windows\System\VFeRSLr.exe
  C:\Windows\System\VFeRSLr.exe
  2⤵
  PID:10028
- C:\Windows\System\IawnCEz.exe
  C:\Windows\System\IawnCEz.exe
  2⤵
  PID:5872
- C:\Windows\System\LnmAllW.exe
  C:\Windows\System\LnmAllW.exe
  2⤵
  PID:9548
- C:\Windows\System\AFBEPAI.exe
  C:\Windows\System\AFBEPAI.exe
  2⤵
  PID:10432
- C:\Windows\System\mXWVVih.exe
  C:\Windows\System\mXWVVih.exe
  2⤵
  PID:10520
- C:\Windows\System\MHrVZFK.exe
  C:\Windows\System\MHrVZFK.exe
  2⤵
  PID:10588
- C:\Windows\System\AMorAvC.exe
  C:\Windows\System\AMorAvC.exe
  2⤵
  PID:11344
- C:\Windows\System\pGAUnuW.exe
  C:\Windows\System\pGAUnuW.exe
  2⤵
  PID:11408
- C:\Windows\System\XECmpWH.exe
  C:\Windows\System\XECmpWH.exe
  2⤵
  PID:10772
- C:\Windows\System\CmrwWhr.exe
  C:\Windows\System\CmrwWhr.exe
  2⤵
  PID:12308
- C:\Windows\System\oGMRJNJ.exe
  C:\Windows\System\oGMRJNJ.exe
  2⤵
  PID:12332
- C:\Windows\System\UBMGVPH.exe
  C:\Windows\System\UBMGVPH.exe
  2⤵
  PID:12356
- C:\Windows\System\hQRNBXZ.exe
  C:\Windows\System\hQRNBXZ.exe
  2⤵
  PID:12376
- C:\Windows\System\qeSrHkW.exe
  C:\Windows\System\qeSrHkW.exe
  2⤵
  PID:12404
- C:\Windows\System\qHhIWfW.exe
  C:\Windows\System\qHhIWfW.exe
  2⤵
  PID:12428
- C:\Windows\System\qcCGNut.exe
  C:\Windows\System\qcCGNut.exe
  2⤵
  PID:12444
- C:\Windows\System\zpucsVK.exe
  C:\Windows\System\zpucsVK.exe
  2⤵
  PID:12472
- C:\Windows\System\OGqCAxI.exe
  C:\Windows\System\OGqCAxI.exe
  2⤵
  PID:12496
- C:\Windows\System\FpldXvR.exe
  C:\Windows\System\FpldXvR.exe
  2⤵
  PID:12512
- C:\Windows\System\cwOCTyN.exe
  C:\Windows\System\cwOCTyN.exe
  2⤵
  PID:12536
- C:\Windows\System\AcRfThs.exe
  C:\Windows\System\AcRfThs.exe
  2⤵
  PID:12564
- C:\Windows\System\CQoBrLp.exe
  C:\Windows\System\CQoBrLp.exe
  2⤵
  PID:12584
- C:\Windows\System\ApEsCEx.exe
  C:\Windows\System\ApEsCEx.exe
  2⤵
  PID:12608
- C:\Windows\System\QIobOSm.exe
  C:\Windows\System\QIobOSm.exe
  2⤵
  PID:12632
- C:\Windows\System\AokqHQh.exe
  C:\Windows\System\AokqHQh.exe
  2⤵
  PID:12648
- C:\Windows\System\haRUIGJ.exe
  C:\Windows\System\haRUIGJ.exe
  2⤵
  PID:12672
- C:\Windows\System\tHFVJTw.exe
  C:\Windows\System\tHFVJTw.exe
  2⤵
  PID:12696
- C:\Windows\System\GxAatIf.exe
  C:\Windows\System\GxAatIf.exe
  2⤵
  PID:12716
- C:\Windows\System\SlKgvOB.exe
  C:\Windows\System\SlKgvOB.exe
  2⤵
  PID:12736
- C:\Windows\System\LTHqtYU.exe
  C:\Windows\System\LTHqtYU.exe
  2⤵
  PID:12752
- C:\Windows\System\wOZBOvh.exe
  C:\Windows\System\wOZBOvh.exe
  2⤵
  PID:11120
- C:\Windows\System\xKYMJYm.exe
  C:\Windows\System\xKYMJYm.exe
  2⤵
  PID:8400
- C:\Windows\System\ACxEqRq.exe
  C:\Windows\System\ACxEqRq.exe
  2⤵
  PID:8736
- C:\Windows\System\pciAsbV.exe
  C:\Windows\System\pciAsbV.exe
  2⤵
  PID:11888
- C:\Windows\System\MdZjpHo.exe
  C:\Windows\System\MdZjpHo.exe
  2⤵
  PID:11936
- C:\Windows\System\KDmrVaH.exe
  C:\Windows\System\KDmrVaH.exe
  2⤵
  PID:12952
- C:\Windows\System\gpAYjzT.exe
  C:\Windows\System\gpAYjzT.exe
  2⤵
  PID:12384
- C:\Windows\System\cmsoADV.exe
  C:\Windows\System\cmsoADV.exe
  2⤵
  PID:10760
- C:\Windows\System\zpnWnMF.exe
  C:\Windows\System\zpnWnMF.exe
  2⤵
  PID:10372
- C:\Windows\System\quekQeg.exe
  C:\Windows\System\quekQeg.exe
  2⤵
  PID:9380
- C:\Windows\System\cXJwJom.exe
  C:\Windows\System\cXJwJom.exe
  2⤵
  PID:10944
- C:\Windows\System\SdGRWOj.exe
  C:\Windows\System\SdGRWOj.exe
  2⤵
  PID:13088
- C:\Windows\System\rFqiFuf.exe
  C:\Windows\System\rFqiFuf.exe
  2⤵
  PID:12644
- C:\Windows\System\ECQJCxv.exe
  C:\Windows\System\ECQJCxv.exe
  2⤵
  PID:13032
- C:\Windows\System\xFgaufL.exe
  C:\Windows\System\xFgaufL.exe
  2⤵
  PID:12860
- C:\Windows\System\LmilrNV.exe
  C:\Windows\System\LmilrNV.exe
  2⤵
  PID:10320
- C:\Windows\System\BthgTFB.exe
  C:\Windows\System\BthgTFB.exe
  2⤵
  PID:9664
- C:\Windows\System\jQyXgjS.exe
  C:\Windows\System\jQyXgjS.exe
  2⤵
  PID:11756
- C:\Windows\System\EjJXFDU.exe
  C:\Windows\System\EjJXFDU.exe
  2⤵
  PID:12748
- C:\Windows\System\gUlgSsg.exe
  C:\Windows\System\gUlgSsg.exe
  2⤵
  PID:12232
- C:\Windows\System\yUWqjXa.exe
  C:\Windows\System\yUWqjXa.exe
  2⤵
  PID:12016
- C:\Windows\System\slpcCLK.exe
  C:\Windows\System\slpcCLK.exe
  2⤵
  PID:12104
- C:\Windows\System\LmERMgo.exe
  C:\Windows\System\LmERMgo.exe
  2⤵
  PID:12128
- C:\Windows\System\tatTNLT.exe
  C:\Windows\System\tatTNLT.exe
  2⤵
  PID:12180
- C:\Windows\System\qRePmeG.exe
  C:\Windows\System\qRePmeG.exe
  2⤵
  PID:10612
- C:\Windows\System\UbIlkgI.exe
  C:\Windows\System\UbIlkgI.exe
  2⤵
  PID:11772
- C:\Windows\System\KepxymZ.exe
  C:\Windows\System\KepxymZ.exe
  2⤵
  PID:9784
- C:\Windows\System\LmlVKcg.exe
  C:\Windows\System\LmlVKcg.exe
  2⤵
  PID:11956
- C:\Windows\System\izDDMmB.exe
  C:\Windows\System\izDDMmB.exe
  2⤵
  PID:10920
- C:\Windows\System\TazUtNV.exe
  C:\Windows\System\TazUtNV.exe
  2⤵
  PID:13240
- C:\Windows\System\OWgYNqM.exe
  C:\Windows\System\OWgYNqM.exe
  2⤵
  PID:12964
- C:\Windows\System\KzXEqfp.exe
  C:\Windows\System\KzXEqfp.exe
  2⤵
  PID:12088
- C:\Windows\System\mSTzNhF.exe
  C:\Windows\System\mSTzNhF.exe
  2⤵
  PID:10472
- C:\Windows\System\TrJvjos.exe
  C:\Windows\System\TrJvjos.exe
  2⤵
  PID:2992
- C:\Windows\System\ALnzxQK.exe
  C:\Windows\System\ALnzxQK.exe
  2⤵
  PID:12936
- C:\Windows\System\TojqBFl.exe
  C:\Windows\System\TojqBFl.exe
  2⤵
  PID:12480
- C:\Windows\System\DcucWOh.exe
  C:\Windows\System\DcucWOh.exe
  2⤵
  PID:12420
- C:\Windows\System\FmMLTSn.exe
  C:\Windows\System\FmMLTSn.exe
  2⤵
  PID:10596
- C:\Windows\System\zKcKBkT.exe
  C:\Windows\System\zKcKBkT.exe
  2⤵
  PID:12848
- C:\Windows\System\IIzXERf.exe
  C:\Windows\System\IIzXERf.exe
  2⤵
  PID:680
- C:\Windows\System\eZKteqn.exe
  C:\Windows\System\eZKteqn.exe
  2⤵
  PID:3888
- C:\Windows\System\ZRJfGKs.exe
  C:\Windows\System\ZRJfGKs.exe
  2⤵
  PID:7592
- C:\Windows\System\dIvHYsk.exe
  C:\Windows\System\dIvHYsk.exe
  2⤵
  PID:12812
- C:\Windows\System\QviOdEc.exe
  C:\Windows\System\QviOdEc.exe
  2⤵
  PID:12020
- C:\Windows\System\iPFhKOU.exe
  C:\Windows\System\iPFhKOU.exe
  2⤵
  PID:9112
- C:\Windows\System\vtZyzKq.exe
  C:\Windows\System\vtZyzKq.exe
  2⤵
  PID:12208
- C:\Windows\System\QIgrwrt.exe
  C:\Windows\System\QIgrwrt.exe
  2⤵
  PID:12256
- C:\Windows\System\sPJjICY.exe
  C:\Windows\System\sPJjICY.exe
  2⤵
  PID:12260
- C:\Windows\System\TNJKvoA.exe
  C:\Windows\System\TNJKvoA.exe
  2⤵
  PID:12248
- C:\Windows\System\YDzFAvY.exe
  C:\Windows\System\YDzFAvY.exe
  2⤵
  PID:3012
- C:\Windows\System\vDTIsZx.exe
  C:\Windows\System\vDTIsZx.exe
  2⤵
  PID:12996
- C:\Windows\System\EXwjklW.exe
  C:\Windows\System\EXwjklW.exe
  2⤵
  PID:5668
- C:\Windows\System\jrZOAux.exe
  C:\Windows\System\jrZOAux.exe
  2⤵
  PID:11912
- C:\Windows\System\ttFWqYO.exe
  C:\Windows\System\ttFWqYO.exe
  2⤵
  PID:12364
- C:\Windows\System\DWthgBG.exe
  C:\Windows\System\DWthgBG.exe
  2⤵
  PID:9004
- C:\Windows\System\SQprxBo.exe
  C:\Windows\System\SQprxBo.exe
  2⤵
  PID:12032
- C:\Windows\System\EdVCOPS.exe
  C:\Windows\System\EdVCOPS.exe
  2⤵
  PID:12864
- C:\Windows\System\ASbGGXW.exe
  C:\Windows\System\ASbGGXW.exe
  2⤵
  PID:13184
- C:\Windows\System\LxINBCU.exe
  C:\Windows\System\LxINBCU.exe
  2⤵
  PID:4172
- C:\Windows\System\DKfKhLi.exe
  C:\Windows\System\DKfKhLi.exe
  2⤵
  PID:4576
- C:\Windows\System\TyrDbMx.exe
  C:\Windows\System\TyrDbMx.exe
  2⤵
  PID:5888
- C:\Windows\System\nAXwTag.exe
  C:\Windows\System\nAXwTag.exe
  2⤵
  PID:2356
- C:\Windows\System\OFTAAug.exe
  C:\Windows\System\OFTAAug.exe
  2⤵
  PID:13268
- C:\Windows\System\sXlSKGr.exe
  C:\Windows\System\sXlSKGr.exe
  2⤵
  PID:3544
- C:\Windows\System\lFhEhQe.exe
  C:\Windows\System\lFhEhQe.exe
  2⤵
  PID:4868
- C:\Windows\System\usKvIOw.exe
  C:\Windows\System\usKvIOw.exe
  2⤵
  PID:4476
- C:\Windows\System\MKkaaZZ.exe
  C:\Windows\System\MKkaaZZ.exe
  2⤵
  PID:2412
- C:\Windows\System\uPKdsJh.exe
  C:\Windows\System\uPKdsJh.exe
  2⤵
  PID:2692
- C:\Windows\System\DQttEhG.exe
  C:\Windows\System\DQttEhG.exe
  2⤵
  PID:2736
- C:\Windows\System\GKAXnlD.exe
  C:\Windows\System\GKAXnlD.exe
  2⤵
  PID:216
- C:\Windows\System\BPVkEya.exe
  C:\Windows\System\BPVkEya.exe
  2⤵
  PID:1772
- C:\Windows\System\ddxUBdK.exe
  C:\Windows\System\ddxUBdK.exe
  2⤵
  PID:392
- C:\Windows\System\MLWbgJX.exe
  C:\Windows\System\MLWbgJX.exe
  2⤵
  PID:1300
- C:\Windows\System\HcdNOJO.exe
  C:\Windows\System\HcdNOJO.exe
  2⤵
  PID:4512
- C:\Windows\System\GIgOerX.exe
  C:\Windows\System\GIgOerX.exe
  2⤵
  PID:4220
- C:\Windows\System\YHFhwyf.exe
  C:\Windows\System\YHFhwyf.exe
  2⤵
  PID:2560
- C:\Windows\System\shtMCPi.exe
  C:\Windows\System\shtMCPi.exe
  2⤵
  PID:10748
- C:\Windows\System\VaYAugy.exe
  C:\Windows\System\VaYAugy.exe
  2⤵
  PID:2752
- C:\Windows\System\dspFeJX.exe
  C:\Windows\System\dspFeJX.exe
  2⤵
  PID:2188
- C:\Windows\System\FvefPwt.exe
  C:\Windows\System\FvefPwt.exe
  2⤵
  PID:3252
- C:\Windows\System\VqXIIRd.exe
  C:\Windows\System\VqXIIRd.exe
  2⤵
  PID:3168
- C:\Windows\System\jTWoiSp.exe
  C:\Windows\System\jTWoiSp.exe
  2⤵
  PID:2400
- C:\Windows\System\LbhssTN.exe
  C:\Windows\System\LbhssTN.exe
  2⤵
  PID:1660
- C:\Windows\System\PFSbMwg.exe
  C:\Windows\System\PFSbMwg.exe
  2⤵
  PID:13344
- C:\Windows\System\aYJiLul.exe
  C:\Windows\System\aYJiLul.exe
  2⤵
  PID:13780
- C:\Windows\System\fmstFvB.exe
  C:\Windows\System\fmstFvB.exe
  2⤵
  PID:14180
- C:\Windows\System\BYgsWxR.exe
  C:\Windows\System\BYgsWxR.exe
  2⤵
  PID:14256
- C:\Windows\System\AZsDNZL.exe
  C:\Windows\System\AZsDNZL.exe
  2⤵
  PID:13432
- C:\Windows\System\EJEiJox.exe
  C:\Windows\System\EJEiJox.exe
  2⤵
  PID:1712
- C:\Windows\System\vHdBJBd.exe
  C:\Windows\System\vHdBJBd.exe
  2⤵
  PID:13960
- C:\Windows\System\rhiqDfa.exe
  C:\Windows\System\rhiqDfa.exe
  2⤵
  PID:13996
- C:\Windows\System\JfYYQmU.exe
  C:\Windows\System\JfYYQmU.exe
  2⤵
  PID:13408
- C:\Windows\System\CNSjZdo.exe
  C:\Windows\System\CNSjZdo.exe
  2⤵
  PID:13648
- C:\Windows\System\TWBJNrh.exe
  C:\Windows\System\TWBJNrh.exe
  2⤵
  PID:13704
- C:\Windows\System\fGjIdgs.exe
  C:\Windows\System\fGjIdgs.exe
  2⤵
  PID:13684
- C:\Windows\System\nMugkCe.exe
  C:\Windows\System\nMugkCe.exe
  2⤵
  PID:13820
- C:\Windows\System\fwyMGrH.exe
  C:\Windows\System\fwyMGrH.exe
  2⤵
  PID:13884
- C:\Windows\System\KqkcqLY.exe
  C:\Windows\System\KqkcqLY.exe
  2⤵
  PID:14020
- C:\Windows\System\SEqdVrG.exe
  C:\Windows\System\SEqdVrG.exe
  2⤵
  PID:13972
- C:\Windows\System\bxtJIua.exe
  C:\Windows\System\bxtJIua.exe
  2⤵
  PID:888
- C:\Windows\System\qcsmtgo.exe
  C:\Windows\System\qcsmtgo.exe
  2⤵
  PID:14080
- C:\Windows\System\NAcXruF.exe
  C:\Windows\System\NAcXruF.exe
  2⤵
  PID:14092
- C:\Windows\System\GMTZEib.exe
  C:\Windows\System\GMTZEib.exe
  2⤵
  PID:4872
- C:\Windows\System\RuzRHpi.exe
  C:\Windows\System\RuzRHpi.exe
  2⤵
  PID:14136
- C:\Windows\System\wxYWGQG.exe
  C:\Windows\System\wxYWGQG.exe
  2⤵
  PID:1940
- C:\Windows\System\wtqsPYl.exe
  C:\Windows\System\wtqsPYl.exe
  2⤵
  PID:13404
- C:\Windows\System\FfQcTBd.exe
  C:\Windows\System\FfQcTBd.exe
  2⤵
  PID:13516
- C:\Windows\System\bjDcgCW.exe
  C:\Windows\System\bjDcgCW.exe
  2⤵
  PID:14332
- C:\Windows\System\jRwTTGV.exe
  C:\Windows\System\jRwTTGV.exe
  2⤵
  PID:3324
- C:\Windows\System\iHXGGXP.exe
  C:\Windows\System\iHXGGXP.exe
  2⤵
  PID:13580
- C:\Windows\System\GEEiXGs.exe
  C:\Windows\System\GEEiXGs.exe
  2⤵
  PID:13640
- C:\Windows\System\ryTdOuN.exe
  C:\Windows\System\ryTdOuN.exe
  2⤵
  PID:13788
- C:\Windows\System\PlVZgom.exe
  C:\Windows\System\PlVZgom.exe
  2⤵
  PID:13680
- C:\Windows\System\sOQeglK.exe
  C:\Windows\System\sOQeglK.exe
  2⤵
  PID:13732
- C:\Windows\System\uRlGWIf.exe
  C:\Windows\System\uRlGWIf.exe
  2⤵
  PID:3664
- C:\Windows\System\IWYBBmr.exe
  C:\Windows\System\IWYBBmr.exe
  2⤵
  PID:13848
- C:\Windows\System\ieqyHLk.exe
  C:\Windows\System\ieqyHLk.exe
  2⤵
  PID:14032
- C:\Windows\System\ZMMASJF.exe
  C:\Windows\System\ZMMASJF.exe
  2⤵
  PID:14068
- C:\Windows\System\pyVdNGj.exe
  C:\Windows\System\pyVdNGj.exe
  2⤵
  PID:1676
- C:\Windows\System\NPldKki.exe
  C:\Windows\System\NPldKki.exe
  2⤵
  PID:14224
- C:\Windows\System\wOmAcNp.exe
  C:\Windows\System\wOmAcNp.exe
  2⤵
  PID:14168
- C:\Windows\System\tJGmPCn.exe
  C:\Windows\System\tJGmPCn.exe
  2⤵
  PID:14292
- C:\Windows\System\nsEUWiL.exe
  C:\Windows\System\nsEUWiL.exe
  2⤵
  PID:2376
- C:\Windows\System\trCESfO.exe
  C:\Windows\System\trCESfO.exe
  2⤵
  PID:13352
- C:\Windows\System\lyuaaQU.exe
  C:\Windows\System\lyuaaQU.exe
  2⤵
  PID:2880
- C:\Windows\System\JvtHnDp.exe
  C:\Windows\System\JvtHnDp.exe
  2⤵
  PID:3784
- C:\Windows\System\SqAaqdu.exe
  C:\Windows\System\SqAaqdu.exe
  2⤵
  PID:13512
- C:\Windows\System\rvouquN.exe
  C:\Windows\System\rvouquN.exe
  2⤵
  PID:13480
- C:\Windows\System\MssmMSA.exe
  C:\Windows\System\MssmMSA.exe
  2⤵
  PID:5148
- C:\Windows\System\McfKeiT.exe
  C:\Windows\System\McfKeiT.exe
  2⤵
  PID:5572
- C:\Windows\System\IQLYBEM.exe
  C:\Windows\System\IQLYBEM.exe
  2⤵
  PID:5288
- C:\Windows\System\VUlhPPC.exe
  C:\Windows\System\VUlhPPC.exe
  2⤵
  PID:13608
- C:\Windows\System\jkTGyxp.exe
  C:\Windows\System\jkTGyxp.exe
  2⤵
  PID:5940
- C:\Windows\System\nEyLDsp.exe
  C:\Windows\System\nEyLDsp.exe
  2⤵
  PID:13776
- C:\Windows\System\rjBAOje.exe
  C:\Windows\System\rjBAOje.exe
  2⤵
  PID:4568
- C:\Windows\System\HSSpEfk.exe
  C:\Windows\System\HSSpEfk.exe
  2⤵
  PID:13772
- C:\Windows\System\UNPWeTR.exe
  C:\Windows\System\UNPWeTR.exe
  2⤵
  PID:6040
- C:\Windows\System\lmMfrIf.exe
  C:\Windows\System\lmMfrIf.exe
  2⤵
  PID:2016
- C:\Windows\System\LQdPfeK.exe
  C:\Windows\System\LQdPfeK.exe
  2⤵
  PID:13932
- C:\Windows\System\CascEMv.exe
  C:\Windows\System\CascEMv.exe
  2⤵
  PID:1536
- C:\Windows\System\MmxWfoY.exe
  C:\Windows\System\MmxWfoY.exe
  2⤵
  PID:2816
- C:\Windows\System\atHYvuT.exe
  C:\Windows\System\atHYvuT.exe
  2⤵
  PID:14112
- C:\Windows\System\TUXJlbO.exe
  C:\Windows\System\TUXJlbO.exe
  2⤵
  PID:628
- C:\Windows\System\mnzGRwU.exe
  C:\Windows\System\mnzGRwU.exe
  2⤵
  PID:5444
- C:\Windows\System\HeiWjMP.exe
  C:\Windows\System\HeiWjMP.exe
  2⤵
  PID:716
- C:\Windows\System\zxTOajR.exe
  C:\Windows\System\zxTOajR.exe
  2⤵
  PID:2436
- C:\Windows\System\fcQcGwF.exe
  C:\Windows\System\fcQcGwF.exe
  2⤵
  PID:1728
- C:\Windows\System\TQxpszk.exe
  C:\Windows\System\TQxpszk.exe
  2⤵
  PID:13444
- C:\Windows\System\xohbgpG.exe
  C:\Windows\System\xohbgpG.exe
  2⤵
  PID:4904
- C:\Windows\System\tlvbQSs.exe
  C:\Windows\System\tlvbQSs.exe
  2⤵
  PID:5128
- C:\Windows\System\KPqsyus.exe
  C:\Windows\System\KPqsyus.exe
  2⤵
  PID:6332
- C:\Windows\System\QocPbnw.exe
  C:\Windows\System\QocPbnw.exe
  2⤵
  PID:14004
- C:\Windows\System\HbYwYvB.exe
  C:\Windows\System\HbYwYvB.exe
  2⤵
  PID:6476
- C:\Windows\System\uAkkrEn.exe
  C:\Windows\System\uAkkrEn.exe
  2⤵
  PID:5536
- C:\Windows\System\qQfmqaw.exe
  C:\Windows\System\qQfmqaw.exe
  2⤵
  PID:7008
- C:\Windows\System\bryKYQe.exe
  C:\Windows\System\bryKYQe.exe
  2⤵
  PID:7012
- C:\Windows\System\jPmJuGx.exe
  C:\Windows\System\jPmJuGx.exe
  2⤵
  PID:13424
- C:\Windows\System\Tnsnxxa.exe
  C:\Windows\System\Tnsnxxa.exe
  2⤵
  PID:5308
- C:\Windows\System\EnPXNOW.exe
  C:\Windows\System\EnPXNOW.exe
  2⤵
  PID:13620
- C:\Windows\System\zBCbOPB.exe
  C:\Windows\System\zBCbOPB.exe
  2⤵
  PID:7064
- C:\Windows\System\JdrSgxQ.exe
  C:\Windows\System\JdrSgxQ.exe
  2⤵
  PID:13708
- C:\Windows\System\fkqbIvc.exe
  C:\Windows\System\fkqbIvc.exe
  2⤵
  PID:4852
- C:\Windows\System\DDuosMZ.exe
  C:\Windows\System\DDuosMZ.exe
  2⤵
  PID:3824
- C:\Windows\System\snaInwn.exe
  C:\Windows\System\snaInwn.exe
  2⤵
  PID:13888
- C:\Windows\System\nebHlGW.exe
  C:\Windows\System\nebHlGW.exe
  2⤵
  PID:7292
- C:\Windows\System\vYDMtWK.exe
  C:\Windows\System\vYDMtWK.exe
  2⤵
  PID:1528
- C:\Windows\System\tjHYJra.exe
  C:\Windows\System\tjHYJra.exe
  2⤵
  PID:10636
- C:\Windows\System\jSFkLUU.exe
  C:\Windows\System\jSFkLUU.exe
  2⤵
  PID:7548
- C:\Windows\System\bPGFSQd.exe
  C:\Windows\System\bPGFSQd.exe
  2⤵
  PID:7312
- C:\Windows\System\ybSnkaE.exe
  C:\Windows\System\ybSnkaE.exe
  2⤵
  PID:5612
- C:\Windows\System\bMDwotU.exe
  C:\Windows\System\bMDwotU.exe
  2⤵
  PID:6032
- C:\Windows\System\wzzZOTh.exe
  C:\Windows\System\wzzZOTh.exe
  2⤵
  PID:7624
- C:\Windows\System\lHIiPUu.exe
  C:\Windows\System\lHIiPUu.exe
  2⤵
  PID:4012
- C:\Windows\System\OMEdmEZ.exe
  C:\Windows\System\OMEdmEZ.exe
  2⤵
  PID:7920
- C:\Windows\System\TgnppJe.exe
  C:\Windows\System\TgnppJe.exe
  2⤵
  PID:8120
- C:\Windows\System\dSheEhH.exe
  C:\Windows\System\dSheEhH.exe
  2⤵
  PID:8108
- C:\Windows\System\LiuUmMC.exe
  C:\Windows\System\LiuUmMC.exe
  2⤵
  PID:6164
- C:\Windows\System\poworuD.exe
  C:\Windows\System\poworuD.exe
  2⤵
  PID:2712
- C:\Windows\System\uTgABMJ.exe
  C:\Windows\System\uTgABMJ.exe
  2⤵
  PID:14264
- C:\Windows\System\xxprHZZ.exe
  C:\Windows\System\xxprHZZ.exe
  2⤵
  PID:836
- C:\Windows\System\hJswgkO.exe
  C:\Windows\System\hJswgkO.exe
  2⤵
  PID:5796
- C:\Windows\System\bDAMUpQ.exe
  C:\Windows\System\bDAMUpQ.exe
  2⤵
  PID:7084
- C:\Windows\System\LAmZgSh.exe
  C:\Windows\System\LAmZgSh.exe
  2⤵
  PID:2252
- C:\Windows\System\HbTVMPC.exe
  C:\Windows\System\HbTVMPC.exe
  2⤵
  PID:5396
- C:\Windows\System\UpPKDwo.exe
  C:\Windows\System\UpPKDwo.exe
  2⤵
  PID:4820
- C:\Windows\System\qGYHaSM.exe
  C:\Windows\System\qGYHaSM.exe
  2⤵
  PID:5216
- C:\Windows\System\cGZEmJk.exe
  C:\Windows\System\cGZEmJk.exe
  2⤵
  PID:2272
- C:\Windows\System\NjkfLpT.exe
  C:\Windows\System\NjkfLpT.exe
  2⤵
  PID:5144
- C:\Windows\System\hyShgLm.exe
  C:\Windows\System\hyShgLm.exe
  2⤵
  PID:8652
- C:\Windows\System\qXnoQrk.exe
  C:\Windows\System\qXnoQrk.exe
  2⤵
  PID:6976
- C:\Windows\System\bKmMhjc.exe
  C:\Windows\System\bKmMhjc.exe
  2⤵
  PID:8452
- C:\Windows\System\FKqxcCb.exe
  C:\Windows\System\FKqxcCb.exe
  2⤵
  PID:7020
- C:\Windows\System\qJuwSOm.exe
  C:\Windows\System\qJuwSOm.exe
  2⤵
  PID:7036
- C:\Windows\System\GEZoMQS.exe
  C:\Windows\System\GEZoMQS.exe
  2⤵
  PID:9136
- C:\Windows\System\PMRGwVS.exe
  C:\Windows\System\PMRGwVS.exe
  2⤵
  PID:7744
- C:\Windows\System\tsMiVQQ.exe
  C:\Windows\System\tsMiVQQ.exe
  2⤵
  PID:6000
- C:\Windows\System\PARfYST.exe
  C:\Windows\System\PARfYST.exe
  2⤵
  PID:8756
- C:\Windows\System\WeSUOlT.exe
  C:\Windows\System\WeSUOlT.exe
  2⤵
  PID:8472
- C:\Windows\System\umeQazJ.exe
  C:\Windows\System\umeQazJ.exe
  2⤵
  PID:9480
- C:\Windows\System\qTdWxVe.exe
  C:\Windows\System\qTdWxVe.exe
  2⤵
  PID:8028
- C:\Windows\System\SQwiLkM.exe
  C:\Windows\System\SQwiLkM.exe
  2⤵
  PID:9172
- C:\Windows\System\rUDLMwk.exe
  C:\Windows\System\rUDLMwk.exe
  2⤵
  PID:8964
- C:\Windows\System\owJnUWz.exe
  C:\Windows\System\owJnUWz.exe
  2⤵
  PID:8604
- C:\Windows\System\rTqCnud.exe
  C:\Windows\System\rTqCnud.exe
  2⤵
  PID:9600
- C:\Windows\System\QzlruBu.exe
  C:\Windows\System\QzlruBu.exe
  2⤵
  PID:9796
- C:\Windows\System\fnIxwGV.exe
  C:\Windows\System\fnIxwGV.exe
  2⤵
  PID:4656
- C:\Windows\System\iTaXRFh.exe
  C:\Windows\System\iTaXRFh.exe
  2⤵
  PID:9624
- C:\Windows\System\yayrefA.exe
  C:\Windows\System\yayrefA.exe
  2⤵
  PID:13984
- C:\Windows\System\OPEZJlx.exe
  C:\Windows\System\OPEZJlx.exe
  2⤵
  PID:13368
- C:\Windows\System\BFYXYAr.exe
  C:\Windows\System\BFYXYAr.exe
  2⤵
  PID:7468
- C:\Windows\System\ToGYmXb.exe
  C:\Windows\System\ToGYmXb.exe
  2⤵
  PID:14144
- C:\Windows\System\NtGjBhU.exe
  C:\Windows\System\NtGjBhU.exe
  2⤵
  PID:14268
- C:\Windows\System\UjdamoT.exe
  C:\Windows\System\UjdamoT.exe
  2⤵
  PID:14304
- C:\Windows\System\HQdPKGN.exe
  C:\Windows\System\HQdPKGN.exe
  2⤵
  PID:7576
- C:\Windows\System\AVuxGki.exe
  C:\Windows\System\AVuxGki.exe
  2⤵
  PID:11148
- C:\Windows\System\DaicTZt.exe
  C:\Windows\System\DaicTZt.exe
  2⤵
  PID:11216
- C:\Windows\System\EAQkNAQ.exe
  C:\Windows\System\EAQkNAQ.exe
  2⤵
  PID:7848
- C:\Windows\System\fSdGkCT.exe
  C:\Windows\System\fSdGkCT.exe
  2⤵
  PID:7908
- C:\Windows\System\FuFtClz.exe
  C:\Windows\System\FuFtClz.exe
  2⤵
  PID:512
- C:\Windows\System\DTWWfhj.exe
  C:\Windows\System\DTWWfhj.exe
  2⤵
  PID:7788
- C:\Windows\System\VvXHfkk.exe
  C:\Windows\System\VvXHfkk.exe
  2⤵
  PID:5420
- C:\Windows\System\RROqUzZ.exe
  C:\Windows\System\RROqUzZ.exe
  2⤵
  PID:10900
- C:\Windows\System\buesKcx.exe
  C:\Windows\System\buesKcx.exe
  2⤵
  PID:7972
- C:\Windows\System\IjVdxkt.exe
  C:\Windows\System\IjVdxkt.exe
  2⤵
  PID:11832
- C:\Windows\System\KOSEKZR.exe
  C:\Windows\System\KOSEKZR.exe
  2⤵
  PID:9656
- C:\Windows\System\DiERxBE.exe
  C:\Windows\System\DiERxBE.exe
  2⤵
  PID:12216
- C:\Windows\System\HlQhlXK.exe
  C:\Windows\System\HlQhlXK.exe
  2⤵
  PID:6752
- C:\Windows\System\SFuUUxi.exe
  C:\Windows\System\SFuUUxi.exe
  2⤵
  PID:4800
- C:\Windows\System\XfTtgxM.exe
  C:\Windows\System\XfTtgxM.exe
  2⤵
  PID:10848
- C:\Windows\System\pOAYofH.exe
  C:\Windows\System\pOAYofH.exe
  2⤵
  PID:7672
- C:\Windows\System\QzbMmwt.exe
  C:\Windows\System\QzbMmwt.exe
  2⤵
  PID:10148
- C:\Windows\System\rtsoKMS.exe
  C:\Windows\System\rtsoKMS.exe
  2⤵
  PID:5140
- C:\Windows\System\pUqEBcQ.exe
  C:\Windows\System\pUqEBcQ.exe
  2⤵
  PID:13900
- C:\Windows\System\oGHRuYp.exe
  C:\Windows\System\oGHRuYp.exe
  2⤵
  PID:11544
- C:\Windows\System\vBMwGxA.exe
  C:\Windows\System\vBMwGxA.exe
  2⤵
  PID:13448
- C:\Windows\System\glzIKXX.exe
  C:\Windows\System\glzIKXX.exe
  2⤵
  PID:6240
- C:\Windows\System\OCMeMRp.exe
  C:\Windows\System\OCMeMRp.exe
  2⤵
  PID:13592
- C:\Windows\System\jbgcRTH.exe
  C:\Windows\System\jbgcRTH.exe
  2⤵
  PID:6256
- C:\Windows\System\EdvOlrT.exe
  C:\Windows\System\EdvOlrT.exe
  2⤵
  PID:7864
- C:\Windows\System\HFOwBxh.exe
  C:\Windows\System\HFOwBxh.exe
  2⤵
  PID:6572
- C:\Windows\System\odJfEGL.exe
  C:\Windows\System\odJfEGL.exe
  2⤵
  PID:12888
- C:\Windows\System\NGBYEba.exe
  C:\Windows\System\NGBYEba.exe
  2⤵
  PID:9180
- C:\Windows\System\vJGvHpQ.exe
  C:\Windows\System\vJGvHpQ.exe
  2⤵
  PID:8988
- C:\Windows\System\UVZgmOR.exe
  C:\Windows\System\UVZgmOR.exe
  2⤵
  PID:8488
- C:\Windows\System\YgzQThm.exe
  C:\Windows\System\YgzQThm.exe
  2⤵
  PID:4596
- C:\Windows\System\wFmjmyH.exe
  C:\Windows\System\wFmjmyH.exe
  2⤵
  PID:6504
- C:\Windows\System\JHgDAlC.exe
  C:\Windows\System\JHgDAlC.exe
  2⤵
  PID:12344
- C:\Windows\System\foEdPsP.exe
  C:\Windows\System\foEdPsP.exe
  2⤵
  PID:11648
- C:\Windows\System\eLadCDj.exe
  C:\Windows\System\eLadCDj.exe
  2⤵
  PID:8552
- C:\Windows\System\SEnyIav.exe
  C:\Windows\System\SEnyIav.exe
  2⤵
  PID:12488
- C:\Windows\System\mTQvWJi.exe
  C:\Windows\System\mTQvWJi.exe
  2⤵
  PID:5592
- C:\Windows\System\ssafefz.exe
  C:\Windows\System\ssafefz.exe
  2⤵
  PID:12596
- C:\Windows\System\ZYrNAVT.exe
  C:\Windows\System\ZYrNAVT.exe
  2⤵
  PID:8956
- C:\Windows\System\VKMVhgj.exe
  C:\Windows\System\VKMVhgj.exe
  2⤵
  PID:1208
- C:\Windows\System\gnpXYIE.exe
  C:\Windows\System\gnpXYIE.exe
  2⤵
  PID:9100
- C:\Windows\System\EAGLLPZ.exe
  C:\Windows\System\EAGLLPZ.exe
  2⤵
  PID:13852
- C:\Windows\System\OKnGnLh.exe
  C:\Windows\System\OKnGnLh.exe
  2⤵
  PID:13212
- C:\Windows\System\MBzNDGv.exe
  C:\Windows\System\MBzNDGv.exe
  2⤵
  PID:11552
- C:\Windows\System\fsWlOyD.exe
  C:\Windows\System\fsWlOyD.exe
  2⤵
  PID:13052
- C:\Windows\System\QssVoJk.exe
  C:\Windows\System\QssVoJk.exe
  2⤵
  PID:12412
- C:\Windows\System\fWseYSc.exe
  C:\Windows\System\fWseYSc.exe
  2⤵
  PID:8732
- C:\Windows\System\nXAZZzq.exe
  C:\Windows\System\nXAZZzq.exe
  2⤵
  PID:12436
- C:\Windows\System\RSRZgua.exe
  C:\Windows\System\RSRZgua.exe
  2⤵
  PID:10964
- C:\Windows\System\njzQBro.exe
  C:\Windows\System\njzQBro.exe
  2⤵
  PID:12528
- C:\Windows\System\FqUvUSR.exe
  C:\Windows\System\FqUvUSR.exe
  2⤵
  PID:11084
- C:\Windows\System\IcOhLbR.exe
  C:\Windows\System\IcOhLbR.exe
  2⤵
  PID:8960
- C:\Windows\System\nMsUtPS.exe
  C:\Windows\System\nMsUtPS.exe
  2⤵
  PID:3836
- C:\Windows\System\vNxyAYC.exe
  C:\Windows\System\vNxyAYC.exe
  2⤵
  PID:7124
- C:\Windows\System\ftFLSGT.exe
  C:\Windows\System\ftFLSGT.exe
  2⤵
  PID:11052
- C:\Windows\System\xbXrNHM.exe
  C:\Windows\System\xbXrNHM.exe
  2⤵
  PID:4968
- C:\Windows\System\tmSHwLL.exe
  C:\Windows\System\tmSHwLL.exe
  2⤵
  PID:6136
- C:\Windows\System\cdAQIXR.exe
  C:\Windows\System\cdAQIXR.exe
  2⤵
  PID:13260
- C:\Windows\System\emloLgM.exe
  C:\Windows\System\emloLgM.exe
  2⤵
  PID:9404
- C:\Windows\System\nXtPwoQ.exe
  C:\Windows\System\nXtPwoQ.exe
  2⤵
  PID:5800
- C:\Windows\System\tPzpzfG.exe
  C:\Windows\System\tPzpzfG.exe
  2⤵
  PID:11392
- C:\Windows\System\zQHDXWG.exe
  C:\Windows\System\zQHDXWG.exe
  2⤵
  PID:7240
- C:\Windows\System\WwiHZbr.exe
  C:\Windows\System\WwiHZbr.exe
  2⤵
  PID:9448
- C:\Windows\System\SKJuwMa.exe
  C:\Windows\System\SKJuwMa.exe
  2⤵
  PID:10448
- C:\Windows\System\eROAPVu.exe
  C:\Windows\System\eROAPVu.exe
  2⤵
  PID:9552
- C:\Windows\System\HcHiksy.exe
  C:\Windows\System\HcHiksy.exe
  2⤵
  PID:6984
- C:\Windows\System\vUCBWyX.exe
  C:\Windows\System\vUCBWyX.exe
  2⤵
  PID:12532
- C:\Windows\System\DJmuyPG.exe
  C:\Windows\System\DJmuyPG.exe
  2⤵
  PID:12816
- C:\Windows\System\vPVpuWg.exe
  C:\Windows\System\vPVpuWg.exe
  2⤵
  PID:5168
- C:\Windows\System\uFKLTAL.exe
  C:\Windows\System\uFKLTAL.exe
  2⤵
  PID:12396
- C:\Windows\System\yLkLFdf.exe
  C:\Windows\System\yLkLFdf.exe
  2⤵
  PID:12704
- C:\Windows\System\ZpWCjiZ.exe
  C:\Windows\System\ZpWCjiZ.exe
  2⤵
  PID:9864
- C:\Windows\System\mmFigUH.exe
  C:\Windows\System\mmFigUH.exe
  2⤵
  PID:10824
- C:\Windows\System\WcfHaFG.exe
  C:\Windows\System\WcfHaFG.exe
  2⤵
  PID:10716
- C:\Windows\System\NOoNuLe.exe
  C:\Windows\System\NOoNuLe.exe
  2⤵
  PID:10088
- C:\Windows\System\vaSRDCT.exe
  C:\Windows\System\vaSRDCT.exe
  2⤵
  PID:10560
- C:\Windows\System\kZEqxvZ.exe
  C:\Windows\System\kZEqxvZ.exe
  2⤵
  PID:10172
- C:\Windows\System\MMDqCtb.exe
  C:\Windows\System\MMDqCtb.exe
  2⤵
  PID:9900
- C:\Windows\System\DxRGhHs.exe
  C:\Windows\System\DxRGhHs.exe
  2⤵
  PID:9272
- C:\Windows\System\tHvxraF.exe
  C:\Windows\System\tHvxraF.exe
  2⤵
  PID:11796
- C:\Windows\System\XTQjFpW.exe
  C:\Windows\System\XTQjFpW.exe
  2⤵
  PID:13176
- C:\Windows\System\WqdzsFI.exe
  C:\Windows\System\WqdzsFI.exe
  2⤵
  PID:11124
- C:\Windows\System\RbqnwFR.exe
  C:\Windows\System\RbqnwFR.exe
  2⤵
  PID:13112
- C:\Windows\System\xSEIhBI.exe
  C:\Windows\System\xSEIhBI.exe
  2⤵
  PID:5400
- C:\Windows\System\xsYhmbc.exe
  C:\Windows\System\xsYhmbc.exe
  2⤵
  PID:13060
- C:\Windows\System\UksJIWP.exe
  C:\Windows\System\UksJIWP.exe
  2⤵
  PID:12576
- C:\Windows\System\svopPlT.exe
  C:\Windows\System\svopPlT.exe
  2⤵
  PID:6196
- C:\Windows\System\ydXknyC.exe
  C:\Windows\System\ydXknyC.exe
  2⤵
  PID:9616
- C:\Windows\System\hToJycG.exe
  C:\Windows\System\hToJycG.exe
  2⤵
  PID:3136
- C:\Windows\System\kLxpeOw.exe
  C:\Windows\System\kLxpeOw.exe
  2⤵
  PID:5080
- C:\Windows\System\zkTdWpw.exe
  C:\Windows\System\zkTdWpw.exe
  2⤵
  PID:7176
- C:\Windows\System\tCrvrLY.exe
  C:\Windows\System\tCrvrLY.exe
  2⤵
  PID:10344
- C:\Windows\System\pqDyRUb.exe
  C:\Windows\System\pqDyRUb.exe
  2⤵
  PID:11480
- C:\Windows\System\oePPrfV.exe
  C:\Windows\System\oePPrfV.exe
  2⤵
  PID:14096
- C:\Windows\System\PhrqHhF.exe
  C:\Windows\System\PhrqHhF.exe
  2⤵
  PID:388
- C:\Windows\System\ajHPYoi.exe
  C:\Windows\System\ajHPYoi.exe
  2⤵
  PID:7688
- C:\Windows\System\znLLrLC.exe
  C:\Windows\System\znLLrLC.exe
  2⤵
  PID:14076
- C:\Windows\System\cXkQBVZ.exe
  C:\Windows\System\cXkQBVZ.exe
  2⤵
  PID:11884
- C:\Windows\System\WpcAUMu.exe
  C:\Windows\System\WpcAUMu.exe
  2⤵
  PID:12204
- C:\Windows\System\eTWPjgm.exe
  C:\Windows\System\eTWPjgm.exe
  2⤵
  PID:9452
- C:\Windows\System\KUxTuPU.exe
  C:\Windows\System\KUxTuPU.exe
  2⤵
  PID:4604
- C:\Windows\System\TGlWrIm.exe
  C:\Windows\System\TGlWrIm.exe
  2⤵
  PID:11204
- C:\Windows\System\gDFNdOL.exe
  C:\Windows\System\gDFNdOL.exe
  2⤵
  PID:10572
- C:\Windows\System\JYXjKqH.exe
  C:\Windows\System\JYXjKqH.exe
  2⤵
  PID:12188
- C:\Windows\System\dNltKAe.exe
  C:\Windows\System\dNltKAe.exe
  2⤵
  PID:3944
- C:\Windows\System\xoJKkpY.exe
  C:\Windows\System\xoJKkpY.exe
  2⤵
  PID:13076
- C:\Windows\System\YtrvMio.exe
  C:\Windows\System\YtrvMio.exe
  2⤵
  PID:13100
- C:\Windows\System\GISwQOn.exe
  C:\Windows\System\GISwQOn.exe
  2⤵
  PID:1224
- C:\Windows\System\ZyFQkNi.exe
  C:\Windows\System\ZyFQkNi.exe
  2⤵
  PID:1012
- C:\Windows\System\UuRHScP.exe
  C:\Windows\System\UuRHScP.exe
  2⤵
  PID:3260
- C:\Windows\System\eEUkeWc.exe
  C:\Windows\System\eEUkeWc.exe
  2⤵
  PID:448
- C:\Windows\System\ZYRuMue.exe
  C:\Windows\System\ZYRuMue.exe
  2⤵
  PID:6132
- C:\Windows\System\jfcRggX.exe
  C:\Windows\System\jfcRggX.exe
  2⤵
  PID:10728
- C:\Windows\System\eGAyFzf.exe
  C:\Windows\System\eGAyFzf.exe
  2⤵
  PID:10792
- C:\Windows\System\GfTXEtR.exe
  C:\Windows\System\GfTXEtR.exe
  2⤵
  PID:11320
- C:\Windows\System\BwCxApw.exe
  C:\Windows\System\BwCxApw.exe
  2⤵
  PID:11520
- C:\Windows\System\EnhwWyo.exe
  C:\Windows\System\EnhwWyo.exe
  2⤵
  PID:2616
- C:\Windows\System\HNYNepJ.exe
  C:\Windows\System\HNYNepJ.exe
  2⤵
  PID:12064
- C:\Windows\System\vEGkHuO.exe
  C:\Windows\System\vEGkHuO.exe
  2⤵
  PID:9980
- C:\Windows\System\hfhIpND.exe
  C:\Windows\System\hfhIpND.exe
  2⤵
  PID:10684
- C:\Windows\System\ITntvTP.exe
  C:\Windows\System\ITntvTP.exe
  2⤵
  PID:7932
- C:\Windows\System\zmVmwlS.exe
  C:\Windows\System\zmVmwlS.exe
  2⤵
  PID:5352
- C:\Windows\System\YUczBDs.exe
  C:\Windows\System\YUczBDs.exe
  2⤵
  PID:11708
- C:\Windows\System\lZnctTI.exe
  C:\Windows\System\lZnctTI.exe
  2⤵
  PID:12820
- C:\Windows\System\MVnWOcu.exe
  C:\Windows\System\MVnWOcu.exe
  2⤵
  PID:2528
- C:\Windows\System\YMNFnui.exe
  C:\Windows\System\YMNFnui.exe
  2⤵
  PID:5224
- C:\Windows\System\JVQezol.exe
  C:\Windows\System\JVQezol.exe
  2⤵
  PID:3192
- C:\Windows\System\fjTyeyE.exe
  C:\Windows\System\fjTyeyE.exe
  2⤵
  PID:6844
- C:\Windows\System\nlbdiQB.exe
  C:\Windows\System\nlbdiQB.exe
  2⤵
  PID:8332
- C:\Windows\System\OwywbPU.exe
  C:\Windows\System\OwywbPU.exe
  2⤵
  PID:8428
- C:\Windows\System\Pjsyqun.exe
  C:\Windows\System\Pjsyqun.exe
  2⤵
  PID:8180
- C:\Windows\System\vkgkuHL.exe
  C:\Windows\System\vkgkuHL.exe
  2⤵
  PID:12980
- C:\Windows\System\NecFegF.exe
  C:\Windows\System\NecFegF.exe
  2⤵
  PID:10360
- C:\Windows\System\pkjTASB.exe
  C:\Windows\System\pkjTASB.exe
  2⤵
  PID:8632
- C:\Windows\System\PAiZduA.exe
  C:\Windows\System\PAiZduA.exe
  2⤵
  PID:8928
- C:\Windows\System\SlYptip.exe
  C:\Windows\System\SlYptip.exe
  2⤵
  PID:13188
- C:\Windows\System\VnNrFMP.exe
  C:\Windows\System\VnNrFMP.exe
  2⤵
  PID:13560
- C:\Windows\System\txzqUgU.exe
  C:\Windows\System\txzqUgU.exe
  2⤵
  PID:2448
- C:\Windows\System\dVFnjCI.exe
  C:\Windows\System\dVFnjCI.exe
  2⤵
  PID:8744
- C:\Windows\System\OzRTHWA.exe
  C:\Windows\System\OzRTHWA.exe
  2⤵
  PID:10980
- C:\Windows\System\HpKPUUX.exe
  C:\Windows\System\HpKPUUX.exe
  2⤵
  PID:11004
- C:\Windows\System\pYInWYv.exe
  C:\Windows\System\pYInWYv.exe
  2⤵
  PID:11784
- C:\Windows\System\abXNkAL.exe
  C:\Windows\System\abXNkAL.exe
  2⤵
  PID:10844
- C:\Windows\System\WWhutmL.exe
  C:\Windows\System\WWhutmL.exe
  2⤵
  PID:10412
- C:\Windows\System\hRZABgB.exe
  C:\Windows\System\hRZABgB.exe
  2⤵
  PID:3724
- C:\Windows\System\hTZvino.exe
  C:\Windows\System\hTZvino.exe
  2⤵
  PID:8568
- C:\Windows\System\TqgteKG.exe
  C:\Windows\System\TqgteKG.exe
  2⤵
  PID:11596
- C:\Windows\System\qfuhzAy.exe
  C:\Windows\System\qfuhzAy.exe
  2⤵
  PID:9456
- C:\Windows\System\gLHSjvd.exe
  C:\Windows\System\gLHSjvd.exe
  2⤵
  PID:3096
- C:\Windows\System\kMpNfgO.exe
  C:\Windows\System\kMpNfgO.exe
  2⤵
  PID:10576
- C:\Windows\System\JBCpDwY.exe
  C:\Windows\System\JBCpDwY.exe
  2⤵
  PID:8564
- C:\Windows\System\DqAgqbS.exe
  C:\Windows\System\DqAgqbS.exe
  2⤵
  PID:11232
- C:\Windows\System\aSdTFZT.exe
  C:\Windows\System\aSdTFZT.exe
  2⤵
  PID:12708
- C:\Windows\System\OMDnGoH.exe
  C:\Windows\System\OMDnGoH.exe
  2⤵
  PID:11188
- C:\Windows\System\QKkEgKW.exe
  C:\Windows\System\QKkEgKW.exe
  2⤵
  PID:9960
- C:\Windows\System\EnavDyd.exe
  C:\Windows\System\EnavDyd.exe
  2⤵
  PID:4344
- C:\Windows\System\VZyRXff.exe
  C:\Windows\System\VZyRXff.exe
  2⤵
  PID:400
- C:\Windows\System\rdxkqbv.exe
  C:\Windows\System\rdxkqbv.exe
  2⤵
  PID:440
- C:\Windows\System\xMDiRof.exe
  C:\Windows\System\xMDiRof.exe
  2⤵
  PID:13924
- C:\Windows\System\lTPzqDD.exe
  C:\Windows\System\lTPzqDD.exe
  2⤵
  PID:12392
- C:\Windows\System\QwXpqcM.exe
  C:\Windows\System\QwXpqcM.exe
  2⤵
  PID:7308
- C:\Windows\System\HBDAnzI.exe
  C:\Windows\System\HBDAnzI.exe
  2⤵
  PID:13196
- C:\Windows\System\XNlmySr.exe
  C:\Windows\System\XNlmySr.exe
  2⤵
  PID:9716
- C:\Windows\System\yYzNDKL.exe
  C:\Windows\System\yYzNDKL.exe
  2⤵
  PID:9412
- C:\Windows\System\EzmeZlo.exe
  C:\Windows\System\EzmeZlo.exe
  2⤵
  PID:10128
- C:\Windows\System\SBZnukk.exe
  C:\Windows\System\SBZnukk.exe
  2⤵
  PID:13988
- C:\Windows\System\HTsSMCp.exe
  C:\Windows\System\HTsSMCp.exe
  2⤵
  PID:3204
- C:\Windows\System\HlVJWkA.exe
  C:\Windows\System\HlVJWkA.exe
  2⤵
  PID:11872
- C:\Windows\System\LHwLiRh.exe
  C:\Windows\System\LHwLiRh.exe
  2⤵
  PID:11688
- C:\Windows\System\gwxKVVH.exe
  C:\Windows\System\gwxKVVH.exe
  2⤵
  PID:11804
- C:\Windows\System\rcJWYdT.exe
  C:\Windows\System\rcJWYdT.exe
  2⤵
  PID:5488
- C:\Windows\System\nDybOMP.exe
  C:\Windows\System\nDybOMP.exe
  2⤵
  PID:5672
- C:\Windows\System\sCrIvXu.exe
  C:\Windows\System\sCrIvXu.exe
  2⤵
  PID:12484
- C:\Windows\System\YHkboLS.exe
  C:\Windows\System\YHkboLS.exe
  2⤵
  PID:9904
- C:\Windows\System\AiHdZnr.exe
  C:\Windows\System\AiHdZnr.exe
  2⤵
  PID:3708
- C:\Windows\System\vDLsIEC.exe
  C:\Windows\System\vDLsIEC.exe
  2⤵
  PID:7756
- C:\Windows\System\fLAKZvt.exe
  C:\Windows\System\fLAKZvt.exe
  2⤵
  PID:10892
- C:\Windows\System\YkqyzTA.exe
  C:\Windows\System\YkqyzTA.exe
  2⤵
  PID:13740
- C:\Windows\System\XswJSCz.exe
  C:\Windows\System\XswJSCz.exe
  2⤵
  PID:6644
- C:\Windows\System\NFaqckI.exe
  C:\Windows\System\NFaqckI.exe
  2⤵
  PID:12544
- C:\Windows\System\CdMkpPk.exe
  C:\Windows\System\CdMkpPk.exe
  2⤵
  PID:2184
- C:\Windows\System\SsvmXaF.exe
  C:\Windows\System\SsvmXaF.exe
  2⤵
  PID:10888
- C:\Windows\System\KEGRykq.exe
  C:\Windows\System\KEGRykq.exe
  2⤵
  PID:5428
- C:\Windows\System\PhFJbXC.exe
  C:\Windows\System\PhFJbXC.exe
  2⤵
  PID:4928
- C:\Windows\System\RAJctpe.exe
  C:\Windows\System\RAJctpe.exe
  2⤵
  PID:5508
- C:\Windows\System\qXtUOke.exe
  C:\Windows\System\qXtUOke.exe
  2⤵
  PID:636
- C:\Windows\System\mHDpUuU.exe
  C:\Windows\System\mHDpUuU.exe
  2⤵
  PID:14312
- C:\Windows\System\rdKWjEH.exe
  C:\Windows\System\rdKWjEH.exe
  2⤵
  PID:13916
- C:\Windows\System\kzuBalC.exe
  C:\Windows\System\kzuBalC.exe
  2⤵
  PID:14120
- C:\Windows\System\XDbcsCn.exe
  C:\Windows\System\XDbcsCn.exe
  2⤵
  PID:7844
- C:\Windows\System\KsHcRwl.exe
  C:\Windows\System\KsHcRwl.exe
  2⤵
  PID:13864
- C:\Windows\System\JqxbRtA.exe
  C:\Windows\System\JqxbRtA.exe
  2⤵
  PID:13308
- C:\Windows\System\xUwUAoF.exe
  C:\Windows\System\xUwUAoF.exe
  2⤵
  PID:11892
- C:\Windows\System\QBZCavA.exe
  C:\Windows\System\QBZCavA.exe
  2⤵
  PID:13616
- C:\Windows\System\hXzonUp.exe
  C:\Windows\System\hXzonUp.exe
  2⤵
  PID:6528
- C:\Windows\System\gxxVzLy.exe
  C:\Windows\System\gxxVzLy.exe
  2⤵
  PID:6556
- C:\Windows\System\PAZWBcI.exe
  C:\Windows\System\PAZWBcI.exe
  2⤵
  PID:9520
- C:\Windows\System\xjffasu.exe
  C:\Windows\System\xjffasu.exe
  2⤵
  PID:6156
- C:\Windows\System\pLITNVv.exe
  C:\Windows\System\pLITNVv.exe
  2⤵
  PID:3504
- C:\Windows\System\HLCGgsP.exe
  C:\Windows\System\HLCGgsP.exe
  2⤵
  PID:5832
- C:\Windows\System\XbJsUKf.exe
  C:\Windows\System\XbJsUKf.exe
  2⤵
  PID:6044
- C:\Windows\System\fmdYFKc.exe
  C:\Windows\System\fmdYFKc.exe
  2⤵
  PID:4392
- C:\Windows\System\xsgRnzO.exe
  C:\Windows\System\xsgRnzO.exe
  2⤵
  PID:3900
- C:\Windows\System\MTLNxmZ.exe
  C:\Windows\System\MTLNxmZ.exe
  2⤵
  PID:13928
- C:\Windows\System\usEReBx.exe
  C:\Windows\System\usEReBx.exe
  2⤵
  PID:3648
- C:\Windows\System\REfESoe.exe
  C:\Windows\System\REfESoe.exe
  2⤵
  PID:2460
- C:\Windows\System\XgvSkxj.exe
  C:\Windows\System\XgvSkxj.exe
  2⤵
  PID:13676
- C:\Windows\System\xoLPWBx.exe
  C:\Windows\System\xoLPWBx.exe
  2⤵
  PID:11516
- C:\Windows\System\doMSjcS.exe
  C:\Windows\System\doMSjcS.exe
  2⤵
  PID:8880
- C:\Windows\System\TJJZcGO.exe
  C:\Windows\System\TJJZcGO.exe
  2⤵
  PID:11472
- C:\Windows\System\ROYjpOb.exe
  C:\Windows\System\ROYjpOb.exe
  2⤵
  PID:3976
- C:\Windows\System\mcmSHOd.exe
  C:\Windows\System\mcmSHOd.exe
  2⤵
  PID:14288
- C:\Windows\System\rfHjSMn.exe
  C:\Windows\System\rfHjSMn.exe
  2⤵
  PID:10780
- C:\Windows\System\dOuFZSW.exe
  C:\Windows\System\dOuFZSW.exe
  2⤵
  PID:5912
- C:\Windows\System\GzXIJwP.exe
  C:\Windows\System\GzXIJwP.exe
  2⤵
  PID:11952
- C:\Windows\System\YkvuxfU.exe
  C:\Windows\System\YkvuxfU.exe
  2⤵
  PID:7028
- C:\Windows\System\TtwgUOA.exe
  C:\Windows\System\TtwgUOA.exe
  2⤵
  PID:6232
- C:\Windows\System\MznDpQi.exe
  C:\Windows\System\MznDpQi.exe
  2⤵
  PID:7428
- C:\Windows\System\cZiRafS.exe
  C:\Windows\System\cZiRafS.exe
  2⤵
  PID:6148
- C:\Windows\System\CCUEByo.exe
  C:\Windows\System\CCUEByo.exe
  2⤵
  PID:6244
- C:\Windows\System\ljwRozt.exe
  C:\Windows\System\ljwRozt.exe
  2⤵
  PID:14248
- C:\Windows\System\TACJFLg.exe
  C:\Windows\System\TACJFLg.exe
  2⤵
  PID:11020
- C:\Windows\System\xmfcfeK.exe
  C:\Windows\System\xmfcfeK.exe
  2⤵
  PID:3500
- C:\Windows\System\zREKzOi.exe
  C:\Windows\System\zREKzOi.exe
  2⤵
  PID:5392
- C:\Windows\System\UzOpHjT.exe
  C:\Windows\System\UzOpHjT.exe
  2⤵
  PID:12784
- C:\Windows\System\hVCJecv.exe
  C:\Windows\System\hVCJecv.exe
  2⤵
  PID:1108
- C:\Windows\System\IPpxLwY.exe
  C:\Windows\System\IPpxLwY.exe
  2⤵
  PID:7648
- C:\Windows\System\ETQeqCm.exe
  C:\Windows\System\ETQeqCm.exe
  2⤵
  PID:13328
- C:\Windows\System\ByhguNi.exe
  C:\Windows\System\ByhguNi.exe
  2⤵
  PID:13748
- C:\Windows\System\YYqaQUk.exe
  C:\Windows\System\YYqaQUk.exe
  2⤵
  PID:5552
- C:\Windows\System\yWaRFDA.exe
  C:\Windows\System\yWaRFDA.exe
  2⤵
  PID:10340
- C:\Windows\System\QlBuHBP.exe
  C:\Windows\System\QlBuHBP.exe
  2⤵
  PID:4976
- C:\Windows\System\ZeSsAYH.exe
  C:\Windows\System\ZeSsAYH.exe
  2⤵
  PID:14176
- C:\Windows\System\hjfxkzM.exe
  C:\Windows\System\hjfxkzM.exe
  2⤵
  PID:6068
- C:\Windows\System\tgCLWvO.exe
  C:\Windows\System\tgCLWvO.exe
  2⤵
  PID:10452
- C:\Windows\System\YefEhVV.exe
  C:\Windows\System\YefEhVV.exe
  2⤵
  PID:6736
- C:\Windows\System\aMLHZfE.exe
  C:\Windows\System\aMLHZfE.exe
  2⤵
  PID:7364
- C:\Windows\System\MaEISBN.exe
  C:\Windows\System\MaEISBN.exe
  2⤵
  PID:12780
- C:\Windows\System\CGGnJiu.exe
  C:\Windows\System\CGGnJiu.exe
  2⤵
  PID:9880
- C:\Windows\System\aCiPXiJ.exe
  C:\Windows\System\aCiPXiJ.exe
  2⤵
  PID:10816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hrlqih0o.mew.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AXtXjes.exe

Filesize
2.1MB

MD5
777bf99dd638d8ef59a4a8fed18eed9f

SHA1
9123ccc8e257eb5c67c30c7418f041bdcec5b3cf

SHA256
350c48651e75919d313f40b1cd31ae20e5b77b1e50c6e952d5cd66d02e51d89a

SHA512
24d6a905496e0999439ac218e10d4100d7185bb8a4c2725c117671960c5ae4cd7544021b62d93d580b24154e92ed8e08f967b6d63f42895eb8c49b0f33b9d845

Download Submit
C:\Windows\System\CFHbgMb.exe

Filesize
2.1MB

MD5
078d1af08893c11d410d55414c275c5a

SHA1
d161d06cc3c7819514350575a42f909da14e367f

SHA256
bd035687c8e79822f614e0e961ad4e4f14c78cc1b4851e83f4ae74b1ade80515

SHA512
d8eebb6200cae5f3d015145214670543c51c028205a7728331a3a822875784a205c3143071922a1b958e2addf6231aa2fb153f3047a8ea658542e33cca1838c0

Download Submit
C:\Windows\System\ECzbtJS.exe

Filesize
2.1MB

MD5
6a00ce471435af104e98ec9b55f49113

SHA1
94911868e1b07ee1071e61b09bdf9431159f0c83

SHA256
235d24a552466a707c5acca5ad2a27c87f0ba5f8df66ecf8b7c29dc22a6d900a

SHA512
ee35ba468ad41147448f0e95cebb63dd14a7e22d8bef4f0486cebd47474eacb05ce572a3ff38fcba64aa6eca502c5d8c78529386653e5d7cd92167169e19d3e5

Download Submit
C:\Windows\System\EYmhKuQ.exe

Filesize
2.1MB

MD5
33c473b96889b2b07305397f7dbaf4f9

SHA1
915a9b39f68dbe2f772e137afdb6abbe024cb2d9

SHA256
4ebae247bf5e1545713fcbd6a4b99ade131912c908e6bc04d940443313e911b3

SHA512
8e3b6ccf95814951be039d90abc604c0d0683a4c9c3fafdd1649fca8eb2d95e44544e6304042a20121a6d945ae4988495ced797319ff9e8fbaebeefa694b9d26

Download Submit
C:\Windows\System\HRsdZjW.exe

Filesize
2.1MB

MD5
1e50aa6dad934b740aa84a7546add78e

SHA1
871ef175e32a49a414fe8d8f4455d29ae06e7cc4

SHA256
66e60bbb103387f43c158b0b91b022791b724fe34c5aab1e40470bf435595295

SHA512
cf99d9c005469a83cde8a09e226d9abb62c811722fa9a447aa110862a028fc570c1176e4d2ae67792607d7da6d5097405b4f2edcc1a033dba5a6d7cd4906ed04

Download Submit
C:\Windows\System\Itbyisz.exe

Filesize
2.1MB

MD5
4cea1e476edd877a4c1068352c531985

SHA1
7434f5d34d26593f4c06060048df2d7ed6650bf3

SHA256
a2baa5644eb40758cf27e0ca3e4ea3eb30a40fcef79f6eb094f5f2bda199a2da

SHA512
4bcde9ac9fd047128558e0b8c37fdf628848217f04d45e66ca87b7844d7f7798ac1e97ae14aa632ef43eca3290910e91a0713fe0dee45242dc75207f0530c83e

Download Submit
C:\Windows\System\JVsoBtj.exe

Filesize
2.1MB

MD5
e0a7ee21e5ab05202d847e3487d4d4b5

SHA1
21dca18f4e63ef1e2ce0d7f83ce60303df1c39ee

SHA256
93db094c044682edfb10d559025fc55065302094f702d1fec5f70d1f000abbf8

SHA512
580213a1401e65b23720e264fc534b3576aebbe5f60b82e4a1a6909e5fdec9322437eac01b3b842a38178d339380d52f839c388e5a56a608cf24c0a66d93604f

Download Submit
C:\Windows\System\OdvNpyn.exe

Filesize
2.1MB

MD5
57824c669e25aad7b60cc8ca10a11d0e

SHA1
1a36c3a6a3a8a3f1518d0abe62139b02f886f345

SHA256
4888a32e8be9d252809710d1dfe13fd4e3fb9e903ac397cb4cd20b4d1bdad6b7

SHA512
74cafb2adbbd97429ca44956d8dd49b8e485f5548e59f93aa9b42d4f8d0add546253495e0c12d16c2c0af32027cbcac7d69012b9eff9641647bae3af40ead6c9

Download Submit
C:\Windows\System\OvlMbsR.exe

Filesize
2.1MB

MD5
b5c9dc763c689774cfb1277c789c591e

SHA1
afd6e339ddcdb6c2d77072b3ec4f296d298b66c8

SHA256
b4e30ae5a046385e60b24e2714215b124cea91894786f436609060f322253e0d

SHA512
fef3c853c08b410075229da473196d116020907c0e1613af7ce7eb718091a9d0e3ee0dc4232a1556d4a0fe74bde6e7de0ddc5200efb8d1dbf9b05063dc335a6b

Download Submit
C:\Windows\System\PMoqPrx.exe

Filesize
2.1MB

MD5
50754f3dd761642668e4275edfff7814

SHA1
970d19432e2c3172a98f4af5f0636c49a1a1f6f9

SHA256
f76aad3c749c295bab4e8d2ffc331b5e72eda928de2ac88aa9e591edbefc4f05

SHA512
4db75c6da2a574971467baa5207c3ba91b540810bf1054d0d9b609f06361b51094814da2b4a551553b9fa05aa07b7750e0c8cebfc552258b9511e2e45fb36291

Download Submit
C:\Windows\System\QbFGPEb.exe

Filesize
2.1MB

MD5
90f3d0f69416e9093d3370ff56841f47

SHA1
d0bcca2ca804881cf507d1d53303a974d5bf17ce

SHA256
099ee5500044651db4fc4734b78ad5272e2ac63cd8193aa90e763ddcc501b7f6

SHA512
43053ca276d05523ab05658cce8904e492fef4f43198fe01509bf29a2ce4045e06fb2de547c82e07db78352d97c85c1d6a8cfd51adbc21570a09fa991b4e6321

Download Submit
C:\Windows\System\QsYNFsg.exe

Filesize
2.1MB

MD5
ac7918e1f8d2d34570abb93b53c8a658

SHA1
7874af3eed3786a5b8bce594030b7cf04766a205

SHA256
8e3ac590286cdfd04008ec18fa4fcbf6207e58f9304f0af71db0f01fef778dfe

SHA512
95ae94ec805e88ca27f6c56cd49cdcfecc3bdcd2037da2c74c82de89ad1ba1caa97657a37b6ee465b8c6867c6583eef70d196f8b14bd98e449e31b0f709961d5

Download Submit
C:\Windows\System\SoNZIGk.exe

Filesize
2.1MB

MD5
27ab97ad841f3462927f67567a4c1fc8

SHA1
2bba9f494bb4deb2710d05205499f991997e0108

SHA256
877b1c3b2e925355f8291af9c0949484cecec37030c9a4db898a27dbad4f4a7e

SHA512
7236e8a9f1e46657a99c19745731368fc27535484c61b98043338be3ae7fe91ffb3a637c3aadc28e71da634bbad448ed95ffe7b7882fc2af25f2d5eb4acd792e

Download Submit
C:\Windows\System\VDBfPjx.exe

Filesize
2.1MB

MD5
4316e45280da25d501ab1ba8ad06bb22

SHA1
4d13381b52c46abe54bd5975f7879d20be9e9caf

SHA256
b16290f6e9caf825ec93aa30c538aa92a8dc8f4107aa9552542f8c77208cb0f2

SHA512
0fab75db01e44cd82347584d960ddf06160ac7e2821a454e5684e498f7da47f02e8d80f5de7ddaa47e47cd1db60ce4d4242735882542359a30158f53db4dd0c2

Download Submit
C:\Windows\System\ZXzneAl.exe

Filesize
2.1MB

MD5
fc2d24556023224be6f34c7072e7d2a3

SHA1
e037fcd83463a2dd566386a4ee8a6e88829b8963

SHA256
e69d9491a2651519290a4ae96059457e3d9c36d2bc7702ec39d30e5df362d24f

SHA512
576e20576acfabb24d70facacf0296b441bbd62ed920c64596a37658e9a41692e2dcb1eb432d031196d40ddbe0f48fc6506a726576d7fda88a20c8c20721dea0

Download Submit
C:\Windows\System\aHrTZcq.exe

Filesize
2.1MB

MD5
4d5ae8f2df635b79bf8e877e0eab938a

SHA1
f9e37cec21f42c38294de2c811bf64c813c436af

SHA256
b6b0b19c836de41195a41751cf4315b9b4b91528d09a10d6f74b19b247581cf6

SHA512
cf650a6ab1f1dceed2f005657ed11af1bc724d5cb70077af38c854550e14129263c4dad60e403784103656476bbb83184949cf1046eccac9aa90413bf81aa73d

Download Submit
C:\Windows\System\aLaRVqE.exe

Filesize
2.1MB

MD5
6d387fc1f5eeeda56895231d153b1da3

SHA1
8804e28e1409082fa49d550fdf75c6bdd1261f99

SHA256
70925389c3732156b64b98de9ba51284916629daf21ad162b8b8d65e7e5adc52

SHA512
73661548368f13e370074533ee7bf13d96e0e0c38ae0b196853c9970813981079c5f738ddece9eab7473bc793f94edd4cdb3003339dc5ad4d4294a6159106bb2

Download Submit
C:\Windows\System\aohUyCW.exe

Filesize
2.1MB

MD5
6128470d056563903b1acb753b89d84e

SHA1
f4239e47dd702527acb66175fdf565d239467760

SHA256
8a32cc02d7bf7831d55349b8fb8dcaa25c9cd4145fae3c3cd22b1293e9dfb6e6

SHA512
aebe0e7935f9f0c9c3ac3d2c9f1c09f820d9f040cc50e44b4e65973989adf0edf655ea5eeac8083f073a8386bd283277a0c84181d5d82e68af5f27776e216b63

Download Submit
C:\Windows\System\bZvZCJq.exe

Filesize
2.1MB

MD5
e71a4a5a2ae1eb82b721b09bfcae01e3

SHA1
30caf38d64ac72db15bbb83f884bade3f1f8f259

SHA256
65cf926dce03db75301b94966ca7568b54b51da46dd7d19bfbe371d8750511fd

SHA512
54eefe0d95c3e9f145b864eb208d4dbbd0a6a80aba56ab31802af2baef8af9e8409790c99b0b02697dbb6aeb53b2fc0ca7b42bd73be828bf8a255e9498ec50ac

Download Submit
C:\Windows\System\bzNJFRS.exe

Filesize
8B

MD5
56dfc2f514c29abc0f7637c9a955b7d2

SHA1
ae4f9772e45bb1dee2f545529ca3e5d6bdd4dd65

SHA256
d458636957a00bb0d8a9759a3052bcc3b71650d32d60b24077d53884f0b19279

SHA512
cb24ecc705f756ecdc58fd78c8b8a6aa84beaf9becae76712e53e91e62d5881964bb4ebaee88647166240726139e4de421aa46f8ca7ebc7aaa10589a7d82f3d7

Download Submit
C:\Windows\System\dJFpIhq.exe

Filesize
2.1MB

MD5
648245db9f637fa40fb767f7812720f9

SHA1
817836ccc5e1f9bb397684c6e5853e75e5b0a6e6

SHA256
b228ee4bd75a5b8d35b6c92cd93b37edefae5941b55a509175085d35c5be9a29

SHA512
e63ec8ab5bd3e94ed0ecdbaed865801eb7cea229cb8b7a51666ab45493f9dc28fc89c73b73388ec529e6609669a7a1e17fe4508a8811307120a21a14fae404d9

Download Submit
C:\Windows\System\eZLPOmz.exe

Filesize
2.1MB

MD5
e5832e91579b60f815299d2d602f1723

SHA1
36e21375236ee6ef94965bbcd34f31cbdeb0da28

SHA256
4e437a2e3aaa66250705c0be562f58b88cfebeacc7fb6446891137aa73ab2728

SHA512
58479a7ea7458a012812332f9b523301d55400f73ba26a928a987e0129f4675d12a155a219e67c3519a112b6130167ae5d0f0ad7db6c978699c4e053e9e01ddd

Download Submit
C:\Windows\System\fNwRTOT.exe

Filesize
2.1MB

MD5
56feb2f226227d643de0bff7b1b3a270

SHA1
8d5356ac3bb08360b78043182a320a10ef0b11ba

SHA256
09617dba0cf5a6f3b04563513212f685a026bd57d2151cf6043bc6be7687b602

SHA512
4fe9c27c8761e95dc7a034caaf4ae7858e701254a74f60a3d63085b8b0f472861f92693d75dddfa60a208d3edd7f8299f7725d3acdb3ea9c1301560b485985b7

Download Submit
C:\Windows\System\fVhxptv.exe

Filesize
18B

MD5
bdb60bd93c09286d92fee75873d90482

SHA1
3b9209eb300e600c89b6bdd90cdcdd1ebbdc6f8f

SHA256
cde9626dea0f5fea46e58fc393d798225ae2a62c635207a80d6d2b3e72aa1e14

SHA512
d97e0db61378ed98d959231114f4252cc90db179c7aedf2ba42033bb324841bd8c9626b8633aff8efe6f010e8c4405bf8da473288d5f329b9af7de9768cef3b7

Download Submit
C:\Windows\System\gcZDWrd.exe

Filesize
2.1MB

MD5
1241d12cbc21870359100e6948982c47

SHA1
a92b5fdcda1bd73cf855784a5424418561d19a56

SHA256
35fa231ce198771bd8cad1cd75c383f7d193c7d608b0a1db975d7c2b672c230f

SHA512
2771b585a019918d2e55d6e56ca4e053f9c0425dc8c940804097f2456bdd6acc858da5757d7df352515dd4e7308e928f7b1b503a7666fd12015860ea06e19a02

Download Submit
C:\Windows\System\hIgjKzq.exe

Filesize
2.1MB

MD5
d28b207b33ea7c59e538f833a8efedf6

SHA1
aa1642ac6f21751c1ad311f1d27d121b75ea801a

SHA256
9ff0d8bb414486672d60f09d18f2895283db136796ddf9bc4c2d5b908a2b5aaf

SHA512
5d20c5468cfba0eeb1ae1ec4bdcce3acf14c7fc60a1c45adddc4f6865914de9ee073637a6523a73ab79d4828fed3e6f5cc0927d4cb1a66defb81c6484ffc88a2

Download Submit
C:\Windows\System\hOwLdnA.exe

Filesize
2.1MB

MD5
3ac04f53d0854122bbc675b3862a72aa

SHA1
ac448899d0d422b35d94779686bbd7e79d5ab117

SHA256
ad8a9d8703a10263650412b04b58ed0a1779fa71aa91088ed6dee4e1d8976bdf

SHA512
f341b14817171b665279f2d2bd7817381ecbc4836e59cc02973d36a38aa522285f247fda26174921b65d834cfb7f30b76cc03e3436712b5c9023e1e4d2d60f67

Download Submit
C:\Windows\System\kEeYgcg.exe

Filesize
2.1MB

MD5
593ffe5d2feee9d8961b669ce0d5d7e4

SHA1
70ffec0dca90caefa19bda4f50bceea8167ef1a2

SHA256
51dda1cf607f11f993c0b21d872c7fe0593c1a6b390082bf62370b39d0205bd3

SHA512
ec1378ac467a02a4222e1a8eb786a868943f71867fdfb58960d7ea8b4d1907a64a7c7ce57be952bb3ad7b2ff1ba3cff1953cd1fb68e3e3286f15d2a7e0d72134

Download Submit
C:\Windows\System\kNtPHMC.exe

Filesize
2.1MB

MD5
7076944eb7e232a8707e437e977ce97e

SHA1
13fa186c205b6d49b67929a1af50e80a99265e76

SHA256
94a2bf21a5e2eb4b6e3c8da9f5bf274c8a1e1c427791365a8297ddfe48703d66

SHA512
7f0c8522ef29fc327d112236adca2825ed149989b30c2a7a464e9506b828f3701173d9ef35bbf229aca3392432d6b7a6651366a85fb6c94ffe43fb7e73acc794

Download Submit
C:\Windows\System\ktCiyYO.exe

Filesize
2.1MB

MD5
d3c0e001f0e52fe38a8b82fd8ad4766f

SHA1
ec362c22f76690dff7c906b291cd1b04fd43654b

SHA256
e459de07c41f765cc4247e7e6fe1cb55d83c679ac432f6bf10a9109281437df2

SHA512
da741c343a8393a99e001e30d5506a91778a4c6c9c7edd499e3135eab5313851415865a1469db97c3b608b9e9ae5d8bf67fe18c61bbf5e3d2642506ea8a9ff5d

Download Submit
C:\Windows\System\ldsggle.exe

Filesize
2.1MB

MD5
08b1339fc7baacee38627075675c5500

SHA1
1c851267f9695f4f98eca9c2c0a93cd1a797b590

SHA256
14fddae3d33f0e5a844c2dd7fc039ed3e82b5d064c11c9d20cf9a5572b796bbc

SHA512
ca82627ed3e87ee268a6f60bfcecaf82ee46bb1d60081acf9fdf29699d8949a64a2c446d46581d527c4b13a5549f701f75cfcc2344735e59bcc253e7ed15c76d

Download Submit
C:\Windows\System\mocdmzU.exe

Filesize
2.1MB

MD5
35b434fea1e0e5bd7752bc7fe97f531b

SHA1
fd4894b818cb2096c48baaabfd84bc34815208e2

SHA256
792a00c763ebcb6e8f538ae66e82f0972a01b76f710e82daafe8d9dcc30c1d09

SHA512
4097f1a29b7ab89a46208e4ae0781c84fb6c09bce9fd50f94ca212ec8d8483004eaf93f4b6e59284016b57d2b6ec62b0bb6599aaae9f9e8ea6e42b27c419fa89

Download Submit
C:\Windows\System\oeXeoKy.exe

Filesize
2.1MB

MD5
fc76e3b68162884cbd4895b62a299863

SHA1
12e050ed000bd4d9df84d5153e92d85339d815e2

SHA256
370a28849f1b2949932ec8d91c124f8cef0488f1efd1147603db08a294ab267b

SHA512
cd9306674648ab2f1f3ca5a8d3fd1f0a9167a124c4a19f9786f52abf190cc8a86fc4a9e27d013f0f8aff1a142adf2919af3e878c4eb14e0041f8cd8c9f8d1f7c

Download Submit
C:\Windows\System\opRDUMr.exe

Filesize
2.1MB

MD5
1308e99f1e02d16a0394cd64aa6a3a94

SHA1
7963c6eb865d81777cf10b0d886e9ade9a574162

SHA256
97418fcba1a42f21dd8fdd0734ffb0e2b66bc78f2cda1bf4e5afc3bc04677f9e

SHA512
99623d7f099c2b321334ea895e7bb1511b4cc6cf954e5b59c40bef7d1b9ec99635057fe4df60917fef62af6d57868940b72ab3d91a5c73bbcba5210476e14dec

Download Submit
C:\Windows\System\sIWfKIH.exe

Filesize
2.1MB

MD5
2757df372886496df63472619289e1c5

SHA1
97bfcd1e29ab865984740ecd7c466f1f2c5c8ead

SHA256
d7f7862b6771baac6ceb4fc4e9c033f94067a760d554c1f1bea2c2d6d87d9f52

SHA512
0f5ee65c50a7738ec08ba48b898e8dddac7dc6ba4667efa92638d00c355b74b413413aaacca7912e84dc3c825db7759f8ae66c0ce9408d28f070477fded955c6

Download Submit
C:\Windows\System\sQEJAWT.exe

Filesize
2.1MB

MD5
9346a4c2147cabb615c8e20440fe20fc

SHA1
0cf6d7e85aa6a35d10d25c12a3ac1e9016db29c6

SHA256
8954039b60d6059bf5ff8788d285e4bb073e84afb2ec925e9029b0bf383264a0

SHA512
f434a84209f1c14f2496cad2aacd7c7e4a1872e5025e79c9a302f6ec30dfd784e4fe8386ced2167189067537a3e7ca5e2e4bbd339bdfe93b5bfd6068d834e40d

Download Submit
C:\Windows\System\sdLsMJf.exe

Filesize
2.1MB

MD5
f0f4e8c07dd0625cb9f611887e1e5f2c

SHA1
8ada8dc39b5e60cdd90dd8abbc2085dabfd6e9c2

SHA256
42881b2db1db8edcc9a90217d8007869244a21db2740a725526526b2334d4247

SHA512
c8f2d1d3ad46046e21013110a84836900f9ecb0680bd4c88e178cc736103a72bf80f4fdc6bf0036e18135ea921b76cf74661a2b1a6952bfa6ba9ee95a854933b

Download Submit
C:\Windows\System\toLXdYZ.exe

Filesize
2.1MB

MD5
ee41d30a0883429874eac37fb1f1e70a

SHA1
cdd7885f785c212f1e0b083b5e52bee5614db794

SHA256
2928ea3012da549eb7806bf48c6b2b12db1b5d56292c7301514ed9f4f81a2bce

SHA512
ab8b64991d68227ab2d9827382685461054f954aa067b7ea9f26eb66040d33fc6172a133252df5f65cc57e7596fa7e650d7a9a40cf6e5812745108ff30ac89e8

Download Submit
C:\Windows\System\vKlhnMA.exe

Filesize
2.1MB

MD5
a59d30220cbd2ea69f1b8608e8b113a6

SHA1
3eb914d3ccecbc04861217a51d149b931c06e0ce

SHA256
5c0cf9fdd2dcb44b8a22409f611f159c5fa654b4f9644d99ced1a4f5a6fa8b4e

SHA512
2726cc0f05e41dda883fa3f1a0080fa20fe9c91facbbb835b80c206dd0867750a2a24ff7ba3ab94e63a2433789189c6a66c47bbff08ae7a7b425ca7d2ba6214d

Download Submit
memory/556-0-0x00007FF6F5B00000-0x00007FF6F5EF2000-memory.dmp

Filesize
3.9MB

Download
memory/556-1-0x0000022C7BCF0000-0x0000022C7BD00000-memory.dmp

Filesize
64KB

Download
memory/556-4971-0x00007FF6F5B00000-0x00007FF6F5EF2000-memory.dmp

Filesize
3.9MB

Download
memory/796-399-0x00007FF758360000-0x00007FF758752000-memory.dmp

Filesize
3.9MB

Download
memory/796-7114-0x00007FF758360000-0x00007FF758752000-memory.dmp

Filesize
3.9MB

Download
memory/852-400-0x00007FF633470000-0x00007FF633862000-memory.dmp

Filesize
3.9MB

Download
memory/884-6865-0x00007FF6D6F10000-0x00007FF6D7302000-memory.dmp

Filesize
3.9MB

Download
memory/884-122-0x00007FF6D6F10000-0x00007FF6D7302000-memory.dmp

Filesize
3.9MB

Download
memory/1152-393-0x00007FF7C4BF0000-0x00007FF7C4FE2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-7231-0x00007FF7C4BF0000-0x00007FF7C4FE2000-memory.dmp

Filesize
3.9MB

Download
memory/1360-158-0x00007FF69A720000-0x00007FF69AB12000-memory.dmp

Filesize
3.9MB

Download
memory/1776-391-0x00007FF7480E0000-0x00007FF7484D2000-memory.dmp

Filesize
3.9MB

Download
memory/1896-7023-0x00007FF6A3B20000-0x00007FF6A3F12000-memory.dmp

Filesize
3.9MB

Download
memory/1896-71-0x00007FF6A3B20000-0x00007FF6A3F12000-memory.dmp

Filesize
3.9MB

Download
memory/2000-274-0x00007FF69DC70000-0x00007FF69E062000-memory.dmp

Filesize
3.9MB

Download
memory/2036-5749-0x00007FF796FA0000-0x00007FF797392000-memory.dmp

Filesize
3.9MB

Download
memory/2036-14-0x00007FF796FA0000-0x00007FF797392000-memory.dmp

Filesize
3.9MB

Download
memory/2164-6899-0x00007FF73E7C0000-0x00007FF73EBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-121-0x00007FF73E7C0000-0x00007FF73EBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2236-7066-0x00007FF755820000-0x00007FF755C12000-memory.dmp

Filesize
3.9MB

Download
memory/2236-398-0x00007FF755820000-0x00007FF755C12000-memory.dmp

Filesize
3.9MB

Download
memory/2800-97-0x00007FF7A3290000-0x00007FF7A3682000-memory.dmp

Filesize
3.9MB

Download
memory/2800-6845-0x00007FF7A3290000-0x00007FF7A3682000-memory.dmp

Filesize
3.9MB

Download
memory/2924-209-0x00007FF69EE40000-0x00007FF69F232000-memory.dmp

Filesize
3.9MB

Download
memory/3024-395-0x00007FF6DC470000-0x00007FF6DC862000-memory.dmp

Filesize
3.9MB

Download
memory/3024-7320-0x00007FF6DC470000-0x00007FF6DC862000-memory.dmp

Filesize
3.9MB

Download
memory/3112-392-0x00007FF700D20000-0x00007FF701112000-memory.dmp

Filesize
3.9MB

Download
memory/3236-241-0x00007FF743F10000-0x00007FF744302000-memory.dmp

Filesize
3.9MB

Download
memory/3236-7153-0x00007FF743F10000-0x00007FF744302000-memory.dmp

Filesize
3.9MB

Download
memory/3396-397-0x00007FF63A170000-0x00007FF63A562000-memory.dmp

Filesize
3.9MB

Download
memory/3396-6806-0x00007FF63A170000-0x00007FF63A562000-memory.dmp

Filesize
3.9MB

Download
memory/3412-46-0x00007FFFEC4F0000-0x00007FFFECFB1000-memory.dmp

Filesize
10.8MB

Download
memory/3412-3-0x00007FFFEC4F3000-0x00007FFFEC4F5000-memory.dmp

Filesize
8KB

Download
memory/3412-174-0x000001F6F79C0000-0x000001F6F79E2000-memory.dmp

Filesize
136KB

Download
memory/3412-396-0x00007FFFEC4F0000-0x00007FFFECFB1000-memory.dmp

Filesize
10.8MB

Download
memory/3436-359-0x00007FF79C030000-0x00007FF79C422000-memory.dmp

Filesize
3.9MB

Download
memory/3436-7152-0x00007FF79C030000-0x00007FF79C422000-memory.dmp

Filesize
3.9MB

Download
memory/3740-356-0x00007FF6285A0000-0x00007FF628992000-memory.dmp

Filesize
3.9MB

Download
memory/3752-7200-0x00007FF706470000-0x00007FF706862000-memory.dmp

Filesize
3.9MB

Download
memory/3752-309-0x00007FF706470000-0x00007FF706862000-memory.dmp

Filesize
3.9MB

Download
memory/3980-172-0x00007FF6C20E0000-0x00007FF6C24D2000-memory.dmp

Filesize
3.9MB

Download
memory/4064-303-0x00007FF70A530000-0x00007FF70A922000-memory.dmp

Filesize
3.9MB

Download
memory/4864-394-0x00007FF73FE90000-0x00007FF740282000-memory.dmp

Filesize
3.9MB

Download
memory/5028-67-0x00007FF6A2920000-0x00007FF6A2D12000-memory.dmp

Filesize
3.9MB

Download
memory/5028-6858-0x00007FF6A2920000-0x00007FF6A2D12000-memory.dmp

Filesize
3.9MB

Download