xmrig | 039d04a9eada472f78eeb9105ac6e5c8ba046834ca0e850abf308ce9920fc504

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
Size

2.1MB
MD5

018385d3e5bcb7a4b61f574d951cf603
SHA1

aa5a371fe4f27f73f52b705b1e18e97c2e4c13aa
SHA256

039d04a9eada472f78eeb9105ac6e5c8ba046834ca0e850abf308ce9920fc504
SHA512

42948a1789f37c578771359cf7832bfa904bfd70118f448ecf91e60a3cc3fa358bbb9c35d24020c8a0dbd026da2366bbb71d5397e4eae1955fc567341d133ade
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qro:NABN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/2824-71-0x00007FF6A7BA0000-0x00007FF6A7F92000-memory.dmp	xmrig
behavioral2/memory/4008-72-0x00007FF6AD0B0000-0x00007FF6AD4A2000-memory.dmp	xmrig
behavioral2/memory/2672-64-0x00007FF72E020000-0x00007FF72E412000-memory.dmp	xmrig
behavioral2/memory/3812-59-0x00007FF6C03C0000-0x00007FF6C07B2000-memory.dmp	xmrig
behavioral2/memory/448-50-0x00007FF7D9590000-0x00007FF7D9982000-memory.dmp	xmrig
behavioral2/memory/3652-47-0x00007FF7C6400000-0x00007FF7C67F2000-memory.dmp	xmrig
behavioral2/memory/2432-76-0x00007FF66E1D0000-0x00007FF66E5C2000-memory.dmp	xmrig
behavioral2/memory/4296-84-0x00007FF6227B0000-0x00007FF622BA2000-memory.dmp	xmrig
behavioral2/memory/3244-110-0x00007FF754890000-0x00007FF754C82000-memory.dmp	xmrig
behavioral2/memory/1028-149-0x00007FF7D97B0000-0x00007FF7D9BA2000-memory.dmp	xmrig
behavioral2/memory/4496-147-0x00007FF6C3F60000-0x00007FF6C4352000-memory.dmp	xmrig
behavioral2/memory/3108-144-0x00007FF7DFCA0000-0x00007FF7E0092000-memory.dmp	xmrig
behavioral2/memory/2348-143-0x00007FF6EAD70000-0x00007FF6EB162000-memory.dmp	xmrig
behavioral2/memory/4356-131-0x00007FF7B9980000-0x00007FF7B9D72000-memory.dmp	xmrig
behavioral2/memory/4060-128-0x00007FF62D1B0000-0x00007FF62D5A2000-memory.dmp	xmrig
behavioral2/memory/3896-113-0x00007FF60E220000-0x00007FF60E612000-memory.dmp	xmrig
behavioral2/memory/1624-106-0x00007FF69C4A0000-0x00007FF69C892000-memory.dmp	xmrig
behavioral2/memory/1536-100-0x00007FF65FFD0000-0x00007FF6603C2000-memory.dmp	xmrig
behavioral2/memory/3876-81-0x00007FF6805C0000-0x00007FF6809B2000-memory.dmp	xmrig
behavioral2/memory/4708-1776-0x00007FF696560000-0x00007FF696952000-memory.dmp	xmrig
behavioral2/memory/3876-1977-0x00007FF6805C0000-0x00007FF6809B2000-memory.dmp	xmrig
behavioral2/memory/4296-1992-0x00007FF6227B0000-0x00007FF622BA2000-memory.dmp	xmrig
behavioral2/memory/2432-1976-0x00007FF66E1D0000-0x00007FF66E5C2000-memory.dmp	xmrig
behavioral2/memory/4008-1974-0x00007FF6AD0B0000-0x00007FF6AD4A2000-memory.dmp	xmrig
behavioral2/memory/2672-1971-0x00007FF72E020000-0x00007FF72E412000-memory.dmp	xmrig
behavioral2/memory/448-1961-0x00007FF7D9590000-0x00007FF7D9982000-memory.dmp	xmrig
behavioral2/memory/3812-1952-0x00007FF6C03C0000-0x00007FF6C07B2000-memory.dmp	xmrig
behavioral2/memory/4268-1963-0x00007FF7840A0000-0x00007FF784492000-memory.dmp	xmrig
behavioral2/memory/2824-1953-0x00007FF6A7BA0000-0x00007FF6A7F92000-memory.dmp	xmrig
behavioral2/memory/4708-1296-0x00007FF696560000-0x00007FF696952000-memory.dmp	xmrig
behavioral2/memory/3148-2081-0x00007FF6DF530000-0x00007FF6DF922000-memory.dmp	xmrig
behavioral2/memory/4496-2146-0x00007FF6C3F60000-0x00007FF6C4352000-memory.dmp	xmrig
behavioral2/memory/1536-2097-0x00007FF65FFD0000-0x00007FF6603C2000-memory.dmp	xmrig
behavioral2/memory/1624-2117-0x00007FF69C4A0000-0x00007FF69C892000-memory.dmp	xmrig
behavioral2/memory/1028-2136-0x00007FF7D97B0000-0x00007FF7D9BA2000-memory.dmp	xmrig
behavioral2/memory/2348-2247-0x00007FF6EAD70000-0x00007FF6EB162000-memory.dmp	xmrig
behavioral2/memory/3244-2123-0x00007FF754890000-0x00007FF754C82000-memory.dmp	xmrig
behavioral2/memory/3896-2075-0x00007FF60E220000-0x00007FF60E612000-memory.dmp	xmrig
behavioral2/memory/4060-2089-0x00007FF62D1B0000-0x00007FF62D5A2000-memory.dmp	xmrig
behavioral2/memory/4356-2073-0x00007FF7B9980000-0x00007FF7B9D72000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	4916	powershell.exe
11	4916	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4708	rvlHjTO.exe
4268	EDZTADa.exe
3652	aEiAokW.exe
448	yrvOCFq.exe
3812	doKQvtq.exe
2672	IFIednq.exe
2824	RChVjjJ.exe
4008	DberaMB.exe
2432	vBeqBsF.exe
3876	GgYfcjT.exe
4296	OaFXmiC.exe
1536	lMOTxMV.exe
1624	mEcxfjP.exe
3244	RZNCEpw.exe
3896	ugkuNsR.exe
3148	HymRzJH.exe
4060	lmZNlZR.exe
4356	ZaEAUNP.exe
4496	DtDBwHf.exe
2348	dNjARvp.exe
1028	Bsvubpq.exe
3768	FtDXxcl.exe
1588	jsgzytf.exe
4760	lECJisu.exe
2484	jsclpFV.exe
4696	grLOSmI.exe
348	EJVczrR.exe
3476	ilxlNQI.exe
3732	VwUHoTT.exe
400	VIazTaz.exe
3588	CYQROED.exe
3212	HVoITPc.exe
3972	PZkKoBR.exe
3564	zAfpdCv.exe
968	dglPORl.exe
2352	CoiOrDU.exe
4360	PUAEwNk.exe
4484	uiLPGjM.exe
3644	JqbaeKA.exe
4380	HeWqsnm.exe
4960	WIDcxYT.exe
3528	YKtxAPd.exe
4736	AdieMOJ.exe
452	FjaOdpk.exe
2332	CUaVPuP.exe
3968	VQHTXMF.exe
5128	eoCnpzN.exe
5164	rGsFWUh.exe
5188	upTJHaw.exe
5220	sWVnPRU.exe
5248	OwOWnve.exe
5276	lzKsLYF.exe
5312	ToIRbMM.exe
5332	wqhyyfD.exe
5360	REBXCSF.exe
5428	WmmuocM.exe
5456	lsiYLdc.exe
5484	BUGCjrB.exe
5504	JbLNPhP.exe
5520	RxhBwlS.exe
5544	JXNggzo.exe
5620	TfKgeLc.exe
5644	IMkHiCN.exe
5664	bpibeka.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3108-0-0x00007FF7DFCA0000-0x00007FF7E0092000-memory.dmp	upx
behavioral2/files/0x0008000000023251-5.dat	upx
behavioral2/memory/4708-8-0x00007FF696560000-0x00007FF696952000-memory.dmp	upx
behavioral2/memory/4268-14-0x00007FF7840A0000-0x00007FF784492000-memory.dmp	upx
behavioral2/files/0x0008000000023254-12.dat	upx
behavioral2/files/0x0008000000023255-10.dat	upx
behavioral2/files/0x0008000000023257-27.dat	upx
behavioral2/files/0x000700000002325b-36.dat	upx
behavioral2/files/0x000800000002325a-42.dat	upx
behavioral2/files/0x000700000002325d-61.dat	upx
behavioral2/memory/2824-71-0x00007FF6A7BA0000-0x00007FF6A7F92000-memory.dmp	upx
behavioral2/files/0x0007000000023260-74.dat	upx
behavioral2/memory/4008-72-0x00007FF6AD0B0000-0x00007FF6AD4A2000-memory.dmp	upx
behavioral2/files/0x000700000002325e-73.dat	upx
behavioral2/files/0x000700000002325f-68.dat	upx
behavioral2/memory/2672-64-0x00007FF72E020000-0x00007FF72E412000-memory.dmp	upx
behavioral2/memory/3812-59-0x00007FF6C03C0000-0x00007FF6C07B2000-memory.dmp	upx
behavioral2/files/0x0009000000023259-54.dat	upx
behavioral2/memory/448-50-0x00007FF7D9590000-0x00007FF7D9982000-memory.dmp	upx
behavioral2/memory/3652-47-0x00007FF7C6400000-0x00007FF7C67F2000-memory.dmp	upx
behavioral2/memory/2432-76-0x00007FF66E1D0000-0x00007FF66E5C2000-memory.dmp	upx
behavioral2/memory/4296-84-0x00007FF6227B0000-0x00007FF622BA2000-memory.dmp	upx
behavioral2/files/0x0007000000023262-87.dat	upx
behavioral2/files/0x0007000000023263-98.dat	upx
behavioral2/files/0x0007000000023264-101.dat	upx
behavioral2/files/0x0007000000023265-104.dat	upx
behavioral2/files/0x0007000000023266-109.dat	upx
behavioral2/memory/3244-110-0x00007FF754890000-0x00007FF754C82000-memory.dmp	upx
behavioral2/memory/3148-119-0x00007FF6DF530000-0x00007FF6DF922000-memory.dmp	upx
behavioral2/files/0x0007000000023268-137.dat	upx
behavioral2/files/0x000700000002326a-145.dat	upx
behavioral2/files/0x000700000002326d-152.dat	upx
behavioral2/files/0x000700000002326e-161.dat	upx
behavioral2/files/0x0007000000023270-170.dat	upx
behavioral2/files/0x0007000000023272-178.dat	upx
behavioral2/files/0x0007000000023276-197.dat	upx
behavioral2/files/0x0007000000023275-193.dat	upx
behavioral2/files/0x0007000000023274-188.dat	upx
behavioral2/files/0x0007000000023273-183.dat	upx
behavioral2/files/0x0007000000023271-176.dat	upx
behavioral2/files/0x000700000002326f-166.dat	upx
behavioral2/memory/1028-149-0x00007FF7D97B0000-0x00007FF7D9BA2000-memory.dmp	upx
behavioral2/files/0x000700000002326c-148.dat	upx
behavioral2/memory/4496-147-0x00007FF6C3F60000-0x00007FF6C4352000-memory.dmp	upx
behavioral2/memory/3108-144-0x00007FF7DFCA0000-0x00007FF7E0092000-memory.dmp	upx
behavioral2/memory/2348-143-0x00007FF6EAD70000-0x00007FF6EB162000-memory.dmp	upx
behavioral2/files/0x000700000002326b-141.dat	upx
behavioral2/files/0x0007000000023269-133.dat	upx
behavioral2/memory/4356-131-0x00007FF7B9980000-0x00007FF7B9D72000-memory.dmp	upx
behavioral2/memory/4060-128-0x00007FF62D1B0000-0x00007FF62D5A2000-memory.dmp	upx
behavioral2/files/0x0007000000023267-124.dat	upx
behavioral2/memory/3896-113-0x00007FF60E220000-0x00007FF60E612000-memory.dmp	upx
behavioral2/memory/1624-106-0x00007FF69C4A0000-0x00007FF69C892000-memory.dmp	upx
behavioral2/memory/1536-100-0x00007FF65FFD0000-0x00007FF6603C2000-memory.dmp	upx
behavioral2/files/0x0007000000023261-88.dat	upx
behavioral2/memory/3876-81-0x00007FF6805C0000-0x00007FF6809B2000-memory.dmp	upx
behavioral2/memory/4708-1776-0x00007FF696560000-0x00007FF696952000-memory.dmp	upx
behavioral2/memory/3876-1977-0x00007FF6805C0000-0x00007FF6809B2000-memory.dmp	upx
behavioral2/memory/4296-1992-0x00007FF6227B0000-0x00007FF622BA2000-memory.dmp	upx
behavioral2/memory/2432-1976-0x00007FF66E1D0000-0x00007FF66E5C2000-memory.dmp	upx
behavioral2/memory/4008-1974-0x00007FF6AD0B0000-0x00007FF6AD4A2000-memory.dmp	upx
behavioral2/memory/2672-1971-0x00007FF72E020000-0x00007FF72E412000-memory.dmp	upx
behavioral2/memory/448-1961-0x00007FF7D9590000-0x00007FF7D9982000-memory.dmp	upx
behavioral2/memory/3812-1952-0x00007FF6C03C0000-0x00007FF6C07B2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GtGLYmr.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\jrWcQyt.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\QwLEleK.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\PpcemRh.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\LMEsSTh.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\kQymask.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\StHMAud.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\pJlJkJc.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\RkMGFZW.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\skvEsAt.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\uhFlFUF.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\UQKMdgH.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\yZhhYOU.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\KwjZoGK.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\CLyonch.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\LMDFkpj.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\LlDCPTH.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\MGhSKfQ.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\SKlgiHT.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\ugkuNsR.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\ThjrkTR.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\aTwyiNQ.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\VAYkdnf.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\SjFIPXv.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\YPUPCWt.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\jsgzytf.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\QFiJozl.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\qIzlRxE.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\BgMzuqk.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\USqEDWj.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\WkqdYHk.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\AcJacQT.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\VKlbhjU.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\XQVcAaR.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\OmHfFkN.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\ywVeHZP.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\bemnCOT.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\WAjrFKZ.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\XNBzemp.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\CMdwRUi.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\IDymGwh.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\kdPhpUG.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\DtDBwHf.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\zAfpdCv.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\tEvEJiP.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\MCFZchN.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\wJuTILd.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\jJwgaRP.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\XyLMiXQ.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\JKdssea.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\wNcygUF.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\oTonnUm.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\vHlXhLQ.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\NnGnbmO.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\pPMkukP.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\lFgLWwV.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\EKJrEWy.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\JycKYKC.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\UKtbClT.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\ljMSBPQ.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\DaObzeE.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\KmesqDO.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\aHCMzEx.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
File created	C:\Windows\System\uvJGsjp.exe	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4916	powershell.exe
4916	powershell.exe
4916	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeLockMemoryPrivilege	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4916	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	93
PID 3108 wrote to memory of 4916	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	93
PID 3108 wrote to memory of 4708	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	94
PID 3108 wrote to memory of 4708	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	94
PID 3108 wrote to memory of 4268	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	95
PID 3108 wrote to memory of 4268	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	95
PID 3108 wrote to memory of 3652	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	96
PID 3108 wrote to memory of 3652	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	96
PID 3108 wrote to memory of 448	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	97
PID 3108 wrote to memory of 448	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	97
PID 3108 wrote to memory of 3812	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	98
PID 3108 wrote to memory of 3812	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	98
PID 3108 wrote to memory of 2672	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	99
PID 3108 wrote to memory of 2672	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	99
PID 3108 wrote to memory of 2824	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	100
PID 3108 wrote to memory of 2824	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	100
PID 3108 wrote to memory of 4008	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	101
PID 3108 wrote to memory of 4008	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	101
PID 3108 wrote to memory of 2432	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	102
PID 3108 wrote to memory of 2432	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	102
PID 3108 wrote to memory of 3876	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	103
PID 3108 wrote to memory of 3876	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	103
PID 3108 wrote to memory of 4296	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	104
PID 3108 wrote to memory of 4296	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	104
PID 3108 wrote to memory of 1536	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	105
PID 3108 wrote to memory of 1536	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	105
PID 3108 wrote to memory of 1624	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	106
PID 3108 wrote to memory of 1624	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	106
PID 3108 wrote to memory of 3244	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	107
PID 3108 wrote to memory of 3244	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	107
PID 3108 wrote to memory of 3896	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	108
PID 3108 wrote to memory of 3896	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	108
PID 3108 wrote to memory of 3148	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	109
PID 3108 wrote to memory of 3148	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	109
PID 3108 wrote to memory of 4060	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	110
PID 3108 wrote to memory of 4060	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	110
PID 3108 wrote to memory of 4356	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	111
PID 3108 wrote to memory of 4356	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	111
PID 3108 wrote to memory of 2348	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	112
PID 3108 wrote to memory of 2348	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	112
PID 3108 wrote to memory of 4496	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	113
PID 3108 wrote to memory of 4496	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	113
PID 3108 wrote to memory of 1028	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	114
PID 3108 wrote to memory of 1028	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	114
PID 3108 wrote to memory of 3768	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	115
PID 3108 wrote to memory of 3768	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	115
PID 3108 wrote to memory of 1588	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	116
PID 3108 wrote to memory of 1588	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	116
PID 3108 wrote to memory of 4760	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	117
PID 3108 wrote to memory of 4760	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	117
PID 3108 wrote to memory of 2484	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	118
PID 3108 wrote to memory of 2484	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	118
PID 3108 wrote to memory of 4696	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	119
PID 3108 wrote to memory of 4696	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	119
PID 3108 wrote to memory of 348	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	120
PID 3108 wrote to memory of 348	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	120
PID 3108 wrote to memory of 3476	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	121
PID 3108 wrote to memory of 3476	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	121
PID 3108 wrote to memory of 3732	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	122
PID 3108 wrote to memory of 3732	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	122
PID 3108 wrote to memory of 400	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	123
PID 3108 wrote to memory of 400	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	123
PID 3108 wrote to memory of 3588	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	124
PID 3108 wrote to memory of 3588	3108	018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe	124

C:\Users\Admin\AppData\Local\Temp\018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\018385d3e5bcb7a4b61f574d951cf603_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4916
- C:\Windows\System\rvlHjTO.exe
  C:\Windows\System\rvlHjTO.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\EDZTADa.exe
  C:\Windows\System\EDZTADa.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\aEiAokW.exe
  C:\Windows\System\aEiAokW.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\yrvOCFq.exe
  C:\Windows\System\yrvOCFq.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\doKQvtq.exe
  C:\Windows\System\doKQvtq.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\IFIednq.exe
  C:\Windows\System\IFIednq.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\RChVjjJ.exe
  C:\Windows\System\RChVjjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\DberaMB.exe
  C:\Windows\System\DberaMB.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\vBeqBsF.exe
  C:\Windows\System\vBeqBsF.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\GgYfcjT.exe
  C:\Windows\System\GgYfcjT.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\OaFXmiC.exe
  C:\Windows\System\OaFXmiC.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\lMOTxMV.exe
  C:\Windows\System\lMOTxMV.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\mEcxfjP.exe
  C:\Windows\System\mEcxfjP.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\RZNCEpw.exe
  C:\Windows\System\RZNCEpw.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\ugkuNsR.exe
  C:\Windows\System\ugkuNsR.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\HymRzJH.exe
  C:\Windows\System\HymRzJH.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\lmZNlZR.exe
  C:\Windows\System\lmZNlZR.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\ZaEAUNP.exe
  C:\Windows\System\ZaEAUNP.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\dNjARvp.exe
  C:\Windows\System\dNjARvp.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\DtDBwHf.exe
  C:\Windows\System\DtDBwHf.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\Bsvubpq.exe
  C:\Windows\System\Bsvubpq.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\FtDXxcl.exe
  C:\Windows\System\FtDXxcl.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\jsgzytf.exe
  C:\Windows\System\jsgzytf.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\lECJisu.exe
  C:\Windows\System\lECJisu.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\jsclpFV.exe
  C:\Windows\System\jsclpFV.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\grLOSmI.exe
  C:\Windows\System\grLOSmI.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\EJVczrR.exe
  C:\Windows\System\EJVczrR.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\ilxlNQI.exe
  C:\Windows\System\ilxlNQI.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\VwUHoTT.exe
  C:\Windows\System\VwUHoTT.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\VIazTaz.exe
  C:\Windows\System\VIazTaz.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\CYQROED.exe
  C:\Windows\System\CYQROED.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\HVoITPc.exe
  C:\Windows\System\HVoITPc.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\PZkKoBR.exe
  C:\Windows\System\PZkKoBR.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\zAfpdCv.exe
  C:\Windows\System\zAfpdCv.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\dglPORl.exe
  C:\Windows\System\dglPORl.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\CoiOrDU.exe
  C:\Windows\System\CoiOrDU.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\PUAEwNk.exe
  C:\Windows\System\PUAEwNk.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\uiLPGjM.exe
  C:\Windows\System\uiLPGjM.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\JqbaeKA.exe
  C:\Windows\System\JqbaeKA.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\HeWqsnm.exe
  C:\Windows\System\HeWqsnm.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\WIDcxYT.exe
  C:\Windows\System\WIDcxYT.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\YKtxAPd.exe
  C:\Windows\System\YKtxAPd.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\AdieMOJ.exe
  C:\Windows\System\AdieMOJ.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\FjaOdpk.exe
  C:\Windows\System\FjaOdpk.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\CUaVPuP.exe
  C:\Windows\System\CUaVPuP.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\VQHTXMF.exe
  C:\Windows\System\VQHTXMF.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\eoCnpzN.exe
  C:\Windows\System\eoCnpzN.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\rGsFWUh.exe
  C:\Windows\System\rGsFWUh.exe
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Windows\System\upTJHaw.exe
  C:\Windows\System\upTJHaw.exe
  2⤵
  - Executes dropped EXE
  PID:5188
- C:\Windows\System\sWVnPRU.exe
  C:\Windows\System\sWVnPRU.exe
  2⤵
  - Executes dropped EXE
  PID:5220
- C:\Windows\System\OwOWnve.exe
  C:\Windows\System\OwOWnve.exe
  2⤵
  - Executes dropped EXE
  PID:5248
- C:\Windows\System\lzKsLYF.exe
  C:\Windows\System\lzKsLYF.exe
  2⤵
  - Executes dropped EXE
  PID:5276
- C:\Windows\System\ToIRbMM.exe
  C:\Windows\System\ToIRbMM.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\wqhyyfD.exe
  C:\Windows\System\wqhyyfD.exe
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Windows\System\REBXCSF.exe
  C:\Windows\System\REBXCSF.exe
  2⤵
  - Executes dropped EXE
  PID:5360
- C:\Windows\System\WmmuocM.exe
  C:\Windows\System\WmmuocM.exe
  2⤵
  - Executes dropped EXE
  PID:5428
- C:\Windows\System\lsiYLdc.exe
  C:\Windows\System\lsiYLdc.exe
  2⤵
  - Executes dropped EXE
  PID:5456
- C:\Windows\System\BUGCjrB.exe
  C:\Windows\System\BUGCjrB.exe
  2⤵
  - Executes dropped EXE
  PID:5484
- C:\Windows\System\JbLNPhP.exe
  C:\Windows\System\JbLNPhP.exe
  2⤵
  - Executes dropped EXE
  PID:5504
- C:\Windows\System\RxhBwlS.exe
  C:\Windows\System\RxhBwlS.exe
  2⤵
  - Executes dropped EXE
  PID:5520
- C:\Windows\System\JXNggzo.exe
  C:\Windows\System\JXNggzo.exe
  2⤵
  - Executes dropped EXE
  PID:5544
- C:\Windows\System\TfKgeLc.exe
  C:\Windows\System\TfKgeLc.exe
  2⤵
  - Executes dropped EXE
  PID:5620
- C:\Windows\System\IMkHiCN.exe
  C:\Windows\System\IMkHiCN.exe
  2⤵
  - Executes dropped EXE
  PID:5644
- C:\Windows\System\bpibeka.exe
  C:\Windows\System\bpibeka.exe
  2⤵
  - Executes dropped EXE
  PID:5664
- C:\Windows\System\yZhhYOU.exe
  C:\Windows\System\yZhhYOU.exe
  2⤵
  PID:5684
- C:\Windows\System\QLmWhEB.exe
  C:\Windows\System\QLmWhEB.exe
  2⤵
  PID:5700
- C:\Windows\System\rVAKXqH.exe
  C:\Windows\System\rVAKXqH.exe
  2⤵
  PID:5728
- C:\Windows\System\qLTHGvW.exe
  C:\Windows\System\qLTHGvW.exe
  2⤵
  PID:5752
- C:\Windows\System\OqlvZYD.exe
  C:\Windows\System\OqlvZYD.exe
  2⤵
  PID:5768
- C:\Windows\System\DOdEUyz.exe
  C:\Windows\System\DOdEUyz.exe
  2⤵
  PID:5796
- C:\Windows\System\ogeNqXh.exe
  C:\Windows\System\ogeNqXh.exe
  2⤵
  PID:5832
- C:\Windows\System\wiUINLU.exe
  C:\Windows\System\wiUINLU.exe
  2⤵
  PID:5880
- C:\Windows\System\lqvSEES.exe
  C:\Windows\System\lqvSEES.exe
  2⤵
  PID:5908
- C:\Windows\System\QwLEleK.exe
  C:\Windows\System\QwLEleK.exe
  2⤵
  PID:5936
- C:\Windows\System\bdNPxUG.exe
  C:\Windows\System\bdNPxUG.exe
  2⤵
  PID:5984
- C:\Windows\System\iInDysX.exe
  C:\Windows\System\iInDysX.exe
  2⤵
  PID:6008
- C:\Windows\System\ofgVTxi.exe
  C:\Windows\System\ofgVTxi.exe
  2⤵
  PID:6028
- C:\Windows\System\xDSpgkb.exe
  C:\Windows\System\xDSpgkb.exe
  2⤵
  PID:6052
- C:\Windows\System\oToGsPK.exe
  C:\Windows\System\oToGsPK.exe
  2⤵
  PID:6076
- C:\Windows\System\aCjOPCP.exe
  C:\Windows\System\aCjOPCP.exe
  2⤵
  PID:6108
- C:\Windows\System\pIcoEAQ.exe
  C:\Windows\System\pIcoEAQ.exe
  2⤵
  PID:6136
- C:\Windows\System\cKRZJtW.exe
  C:\Windows\System\cKRZJtW.exe
  2⤵
  PID:1688
- C:\Windows\System\jsMxDYc.exe
  C:\Windows\System\jsMxDYc.exe
  2⤵
  PID:5148
- C:\Windows\System\ASUQNeq.exe
  C:\Windows\System\ASUQNeq.exe
  2⤵
  PID:5216
- C:\Windows\System\QFiJozl.exe
  C:\Windows\System\QFiJozl.exe
  2⤵
  PID:5272
- C:\Windows\System\kViGnvj.exe
  C:\Windows\System\kViGnvj.exe
  2⤵
  PID:1504
- C:\Windows\System\XrEQdCx.exe
  C:\Windows\System\XrEQdCx.exe
  2⤵
  PID:5348
- C:\Windows\System\VKlbhjU.exe
  C:\Windows\System\VKlbhjU.exe
  2⤵
  PID:5396
- C:\Windows\System\qJhmPmT.exe
  C:\Windows\System\qJhmPmT.exe
  2⤵
  PID:5408
- C:\Windows\System\egEllSn.exe
  C:\Windows\System\egEllSn.exe
  2⤵
  PID:5448
- C:\Windows\System\wJuTILd.exe
  C:\Windows\System\wJuTILd.exe
  2⤵
  PID:2940
- C:\Windows\System\ExpuSIg.exe
  C:\Windows\System\ExpuSIg.exe
  2⤵
  PID:688
- C:\Windows\System\FfYkNRi.exe
  C:\Windows\System\FfYkNRi.exe
  2⤵
  PID:5496
- C:\Windows\System\bemnCOT.exe
  C:\Windows\System\bemnCOT.exe
  2⤵
  PID:3920
- C:\Windows\System\NaiUoiM.exe
  C:\Windows\System\NaiUoiM.exe
  2⤵
  PID:612
- C:\Windows\System\gzWlYry.exe
  C:\Windows\System\gzWlYry.exe
  2⤵
  PID:4556
- C:\Windows\System\tEvEJiP.exe
  C:\Windows\System\tEvEJiP.exe
  2⤵
  PID:3252
- C:\Windows\System\jJwgaRP.exe
  C:\Windows\System\jJwgaRP.exe
  2⤵
  PID:2248
- C:\Windows\System\WOWlxCk.exe
  C:\Windows\System\WOWlxCk.exe
  2⤵
  PID:5152
- C:\Windows\System\EEZiXtY.exe
  C:\Windows\System\EEZiXtY.exe
  2⤵
  PID:2180
- C:\Windows\System\iBNcQQT.exe
  C:\Windows\System\iBNcQQT.exe
  2⤵
  PID:3256
- C:\Windows\System\DfjplYZ.exe
  C:\Windows\System\DfjplYZ.exe
  2⤵
  PID:3016
- C:\Windows\System\RnVjHqS.exe
  C:\Windows\System\RnVjHqS.exe
  2⤵
  PID:5736
- C:\Windows\System\oTonnUm.exe
  C:\Windows\System\oTonnUm.exe
  2⤵
  PID:4548
- C:\Windows\System\YcdklXR.exe
  C:\Windows\System\YcdklXR.exe
  2⤵
  PID:5868
- C:\Windows\System\jSmYvSi.exe
  C:\Windows\System\jSmYvSi.exe
  2⤵
  PID:2936
- C:\Windows\System\rvTMNFJ.exe
  C:\Windows\System\rvTMNFJ.exe
  2⤵
  PID:4800
- C:\Windows\System\uFUqIco.exe
  C:\Windows\System\uFUqIco.exe
  2⤵
  PID:6016
- C:\Windows\System\PYmFgPz.exe
  C:\Windows\System\PYmFgPz.exe
  2⤵
  PID:6048
- C:\Windows\System\FphbsnJ.exe
  C:\Windows\System\FphbsnJ.exe
  2⤵
  PID:6100
- C:\Windows\System\nPFunzZ.exe
  C:\Windows\System\nPFunzZ.exe
  2⤵
  PID:1148
- C:\Windows\System\MZrIFpR.exe
  C:\Windows\System\MZrIFpR.exe
  2⤵
  PID:3720
- C:\Windows\System\xTUXiWT.exe
  C:\Windows\System\xTUXiWT.exe
  2⤵
  PID:5328
- C:\Windows\System\XyLMiXQ.exe
  C:\Windows\System\XyLMiXQ.exe
  2⤵
  PID:5372
- C:\Windows\System\fsbDxeq.exe
  C:\Windows\System\fsbDxeq.exe
  2⤵
  PID:1404
- C:\Windows\System\BEWefNc.exe
  C:\Windows\System\BEWefNc.exe
  2⤵
  PID:5480
- C:\Windows\System\YkINLSG.exe
  C:\Windows\System\YkINLSG.exe
  2⤵
  PID:884
- C:\Windows\System\GLbQUcl.exe
  C:\Windows\System\GLbQUcl.exe
  2⤵
  PID:3868
- C:\Windows\System\OtGKLKR.exe
  C:\Windows\System\OtGKLKR.exe
  2⤵
  PID:5096
- C:\Windows\System\pmJHUxA.exe
  C:\Windows\System\pmJHUxA.exe
  2⤵
  PID:4136
- C:\Windows\System\JIEuzdF.exe
  C:\Windows\System\JIEuzdF.exe
  2⤵
  PID:5784
- C:\Windows\System\kBhnZkn.exe
  C:\Windows\System\kBhnZkn.exe
  2⤵
  PID:5864
- C:\Windows\System\bGyhflL.exe
  C:\Windows\System\bGyhflL.exe
  2⤵
  PID:6000
- C:\Windows\System\HPTDaQz.exe
  C:\Windows\System\HPTDaQz.exe
  2⤵
  PID:1476
- C:\Windows\System\crKlGMr.exe
  C:\Windows\System\crKlGMr.exe
  2⤵
  PID:5344
- C:\Windows\System\wvfBTnm.exe
  C:\Windows\System\wvfBTnm.exe
  2⤵
  PID:4376
- C:\Windows\System\lyhxPln.exe
  C:\Windows\System\lyhxPln.exe
  2⤵
  PID:5676
- C:\Windows\System\mfRKNsQ.exe
  C:\Windows\System\mfRKNsQ.exe
  2⤵
  PID:5628
- C:\Windows\System\jxfZIoP.exe
  C:\Windows\System\jxfZIoP.exe
  2⤵
  PID:5860
- C:\Windows\System\gtOOORS.exe
  C:\Windows\System\gtOOORS.exe
  2⤵
  PID:6124
- C:\Windows\System\GNlYDpz.exe
  C:\Windows\System\GNlYDpz.exe
  2⤵
  PID:5436
- C:\Windows\System\eQRitSe.exe
  C:\Windows\System\eQRitSe.exe
  2⤵
  PID:5604
- C:\Windows\System\TaIxfbF.exe
  C:\Windows\System\TaIxfbF.exe
  2⤵
  PID:2236
- C:\Windows\System\rvcdLIA.exe
  C:\Windows\System\rvcdLIA.exe
  2⤵
  PID:6156
- C:\Windows\System\AgpnVKN.exe
  C:\Windows\System\AgpnVKN.exe
  2⤵
  PID:6176
- C:\Windows\System\XQVcAaR.exe
  C:\Windows\System\XQVcAaR.exe
  2⤵
  PID:6236
- C:\Windows\System\EguftWC.exe
  C:\Windows\System\EguftWC.exe
  2⤵
  PID:6280
- C:\Windows\System\hzaAHue.exe
  C:\Windows\System\hzaAHue.exe
  2⤵
  PID:6304
- C:\Windows\System\EbEwoEp.exe
  C:\Windows\System\EbEwoEp.exe
  2⤵
  PID:6324
- C:\Windows\System\ocxQOKJ.exe
  C:\Windows\System\ocxQOKJ.exe
  2⤵
  PID:6344
- C:\Windows\System\sYjhJwG.exe
  C:\Windows\System\sYjhJwG.exe
  2⤵
  PID:6380
- C:\Windows\System\SGlhKOd.exe
  C:\Windows\System\SGlhKOd.exe
  2⤵
  PID:6420
- C:\Windows\System\kndfyca.exe
  C:\Windows\System\kndfyca.exe
  2⤵
  PID:6444
- C:\Windows\System\dAhrwMm.exe
  C:\Windows\System\dAhrwMm.exe
  2⤵
  PID:6460
- C:\Windows\System\iDwwzqT.exe
  C:\Windows\System\iDwwzqT.exe
  2⤵
  PID:6488
- C:\Windows\System\KwjZoGK.exe
  C:\Windows\System\KwjZoGK.exe
  2⤵
  PID:6512
- C:\Windows\System\PpcemRh.exe
  C:\Windows\System\PpcemRh.exe
  2⤵
  PID:6536
- C:\Windows\System\HbPqFwl.exe
  C:\Windows\System\HbPqFwl.exe
  2⤵
  PID:6592
- C:\Windows\System\yMcXTlv.exe
  C:\Windows\System\yMcXTlv.exe
  2⤵
  PID:6620
- C:\Windows\System\pVsrUNB.exe
  C:\Windows\System\pVsrUNB.exe
  2⤵
  PID:6640
- C:\Windows\System\USqEDWj.exe
  C:\Windows\System\USqEDWj.exe
  2⤵
  PID:6660
- C:\Windows\System\LMEsSTh.exe
  C:\Windows\System\LMEsSTh.exe
  2⤵
  PID:6688
- C:\Windows\System\yTkcAFq.exe
  C:\Windows\System\yTkcAFq.exe
  2⤵
  PID:6708
- C:\Windows\System\vHlXhLQ.exe
  C:\Windows\System\vHlXhLQ.exe
  2⤵
  PID:6728
- C:\Windows\System\QDMxuTA.exe
  C:\Windows\System\QDMxuTA.exe
  2⤵
  PID:6780
- C:\Windows\System\jlvIejQ.exe
  C:\Windows\System\jlvIejQ.exe
  2⤵
  PID:6800
- C:\Windows\System\oURYIUe.exe
  C:\Windows\System\oURYIUe.exe
  2⤵
  PID:6820
- C:\Windows\System\pJlJkJc.exe
  C:\Windows\System\pJlJkJc.exe
  2⤵
  PID:6856
- C:\Windows\System\REuOIbV.exe
  C:\Windows\System\REuOIbV.exe
  2⤵
  PID:6896
- C:\Windows\System\JYjSZoL.exe
  C:\Windows\System\JYjSZoL.exe
  2⤵
  PID:6916
- C:\Windows\System\RkMGFZW.exe
  C:\Windows\System\RkMGFZW.exe
  2⤵
  PID:6940
- C:\Windows\System\DExzgId.exe
  C:\Windows\System\DExzgId.exe
  2⤵
  PID:6960
- C:\Windows\System\ljMSBPQ.exe
  C:\Windows\System\ljMSBPQ.exe
  2⤵
  PID:6984
- C:\Windows\System\rZeoOqg.exe
  C:\Windows\System\rZeoOqg.exe
  2⤵
  PID:7004
- C:\Windows\System\MVWkVEN.exe
  C:\Windows\System\MVWkVEN.exe
  2⤵
  PID:7024
- C:\Windows\System\GVhofLa.exe
  C:\Windows\System\GVhofLa.exe
  2⤵
  PID:7040
- C:\Windows\System\dZJeXwA.exe
  C:\Windows\System\dZJeXwA.exe
  2⤵
  PID:7064
- C:\Windows\System\jGtLjuZ.exe
  C:\Windows\System\jGtLjuZ.exe
  2⤵
  PID:7080
- C:\Windows\System\oolGApY.exe
  C:\Windows\System\oolGApY.exe
  2⤵
  PID:7100
- C:\Windows\System\xcrqUSa.exe
  C:\Windows\System\xcrqUSa.exe
  2⤵
  PID:7128
- C:\Windows\System\hkguXhS.exe
  C:\Windows\System\hkguXhS.exe
  2⤵
  PID:7148
- C:\Windows\System\swXQVhY.exe
  C:\Windows\System\swXQVhY.exe
  2⤵
  PID:4412
- C:\Windows\System\fbtkSAk.exe
  C:\Windows\System\fbtkSAk.exe
  2⤵
  PID:6164
- C:\Windows\System\fqFscAd.exe
  C:\Windows\System\fqFscAd.exe
  2⤵
  PID:6152
- C:\Windows\System\unepoqW.exe
  C:\Windows\System\unepoqW.exe
  2⤵
  PID:6212
- C:\Windows\System\wSrjRbi.exe
  C:\Windows\System\wSrjRbi.exe
  2⤵
  PID:6288
- C:\Windows\System\RmEzgNG.exe
  C:\Windows\System\RmEzgNG.exe
  2⤵
  PID:6320
- C:\Windows\System\RGxgBHN.exe
  C:\Windows\System\RGxgBHN.exe
  2⤵
  PID:6372
- C:\Windows\System\nXAfFFs.exe
  C:\Windows\System\nXAfFFs.exe
  2⤵
  PID:6436
- C:\Windows\System\WyfmfLw.exe
  C:\Windows\System\WyfmfLw.exe
  2⤵
  PID:6440
- C:\Windows\System\cntxgFj.exe
  C:\Windows\System\cntxgFj.exe
  2⤵
  PID:6524
- C:\Windows\System\VAYkdnf.exe
  C:\Windows\System\VAYkdnf.exe
  2⤵
  PID:6556
- C:\Windows\System\zfdCfNW.exe
  C:\Windows\System\zfdCfNW.exe
  2⤵
  PID:6628
- C:\Windows\System\XFzMlXV.exe
  C:\Windows\System\XFzMlXV.exe
  2⤵
  PID:6760
- C:\Windows\System\ZAAFBcx.exe
  C:\Windows\System\ZAAFBcx.exe
  2⤵
  PID:6696
- C:\Windows\System\yPovgBP.exe
  C:\Windows\System\yPovgBP.exe
  2⤵
  PID:6816
- C:\Windows\System\toyZHuh.exe
  C:\Windows\System\toyZHuh.exe
  2⤵
  PID:6844
- C:\Windows\System\PGqmcCl.exe
  C:\Windows\System\PGqmcCl.exe
  2⤵
  PID:6972
- C:\Windows\System\HyOyltF.exe
  C:\Windows\System\HyOyltF.exe
  2⤵
  PID:6948
- C:\Windows\System\bRDvLMU.exe
  C:\Windows\System\bRDvLMU.exe
  2⤵
  PID:7072
- C:\Windows\System\AxdBHsU.exe
  C:\Windows\System\AxdBHsU.exe
  2⤵
  PID:7020
- C:\Windows\System\USZZJdY.exe
  C:\Windows\System\USZZJdY.exe
  2⤵
  PID:7056
- C:\Windows\System\ulPXjhx.exe
  C:\Windows\System\ulPXjhx.exe
  2⤵
  PID:6292
- C:\Windows\System\PuPplul.exe
  C:\Windows\System\PuPplul.exe
  2⤵
  PID:7164
- C:\Windows\System\NfnRsNE.exe
  C:\Windows\System\NfnRsNE.exe
  2⤵
  PID:5556
- C:\Windows\System\jJtuwxm.exe
  C:\Windows\System\jJtuwxm.exe
  2⤵
  PID:7108
- C:\Windows\System\XePSXne.exe
  C:\Windows\System\XePSXne.exe
  2⤵
  PID:6192
- C:\Windows\System\YZJPQdt.exe
  C:\Windows\System\YZJPQdt.exe
  2⤵
  PID:7184
- C:\Windows\System\ZzGrXnS.exe
  C:\Windows\System\ZzGrXnS.exe
  2⤵
  PID:7204
- C:\Windows\System\WAjrFKZ.exe
  C:\Windows\System\WAjrFKZ.exe
  2⤵
  PID:7232
- C:\Windows\System\MSnxtXD.exe
  C:\Windows\System\MSnxtXD.exe
  2⤵
  PID:7256
- C:\Windows\System\JMJJSKd.exe
  C:\Windows\System\JMJJSKd.exe
  2⤵
  PID:7296
- C:\Windows\System\fTUcJcJ.exe
  C:\Windows\System\fTUcJcJ.exe
  2⤵
  PID:7316
- C:\Windows\System\rtGrZif.exe
  C:\Windows\System\rtGrZif.exe
  2⤵
  PID:7336
- C:\Windows\System\XJfonnh.exe
  C:\Windows\System\XJfonnh.exe
  2⤵
  PID:7356
- C:\Windows\System\IFHvgSL.exe
  C:\Windows\System\IFHvgSL.exe
  2⤵
  PID:7376
- C:\Windows\System\dXRBfwz.exe
  C:\Windows\System\dXRBfwz.exe
  2⤵
  PID:7400
- C:\Windows\System\SQWLPCG.exe
  C:\Windows\System\SQWLPCG.exe
  2⤵
  PID:7428
- C:\Windows\System\QGfyVmP.exe
  C:\Windows\System\QGfyVmP.exe
  2⤵
  PID:7448
- C:\Windows\System\scdpsQN.exe
  C:\Windows\System\scdpsQN.exe
  2⤵
  PID:7468
- C:\Windows\System\fBRSefA.exe
  C:\Windows\System\fBRSefA.exe
  2⤵
  PID:7492
- C:\Windows\System\jxAwwEw.exe
  C:\Windows\System\jxAwwEw.exe
  2⤵
  PID:7508
- C:\Windows\System\wiTgPoC.exe
  C:\Windows\System\wiTgPoC.exe
  2⤵
  PID:7528
- C:\Windows\System\qKDBRab.exe
  C:\Windows\System\qKDBRab.exe
  2⤵
  PID:7556
- C:\Windows\System\SKTZNkh.exe
  C:\Windows\System\SKTZNkh.exe
  2⤵
  PID:7580
- C:\Windows\System\pQjsQPQ.exe
  C:\Windows\System\pQjsQPQ.exe
  2⤵
  PID:7596
- C:\Windows\System\XeUVcTc.exe
  C:\Windows\System\XeUVcTc.exe
  2⤵
  PID:7616
- C:\Windows\System\SReVSFH.exe
  C:\Windows\System\SReVSFH.exe
  2⤵
  PID:7640
- C:\Windows\System\MgxjRYp.exe
  C:\Windows\System\MgxjRYp.exe
  2⤵
  PID:7668
- C:\Windows\System\HOoFIsk.exe
  C:\Windows\System\HOoFIsk.exe
  2⤵
  PID:7688
- C:\Windows\System\WkqdYHk.exe
  C:\Windows\System\WkqdYHk.exe
  2⤵
  PID:7712
- C:\Windows\System\wBSAuKk.exe
  C:\Windows\System\wBSAuKk.exe
  2⤵
  PID:7740
- C:\Windows\System\yohxYLL.exe
  C:\Windows\System\yohxYLL.exe
  2⤵
  PID:7756
- C:\Windows\System\QbdmcJS.exe
  C:\Windows\System\QbdmcJS.exe
  2⤵
  PID:7776
- C:\Windows\System\eooPsLA.exe
  C:\Windows\System\eooPsLA.exe
  2⤵
  PID:7792
- C:\Windows\System\FTCOnzF.exe
  C:\Windows\System\FTCOnzF.exe
  2⤵
  PID:7812
- C:\Windows\System\PmyTbBv.exe
  C:\Windows\System\PmyTbBv.exe
  2⤵
  PID:7836
- C:\Windows\System\DaObzeE.exe
  C:\Windows\System\DaObzeE.exe
  2⤵
  PID:7876
- C:\Windows\System\SoDMTAZ.exe
  C:\Windows\System\SoDMTAZ.exe
  2⤵
  PID:7892
- C:\Windows\System\JgSpYav.exe
  C:\Windows\System\JgSpYav.exe
  2⤵
  PID:7908
- C:\Windows\System\uXfiHpG.exe
  C:\Windows\System\uXfiHpG.exe
  2⤵
  PID:7156
- C:\Windows\System\eAfSIIZ.exe
  C:\Windows\System\eAfSIIZ.exe
  2⤵
  PID:7460
- C:\Windows\System\YsopyKr.exe
  C:\Windows\System\YsopyKr.exe
  2⤵
  PID:7488
- C:\Windows\System\zVIgxzX.exe
  C:\Windows\System\zVIgxzX.exe
  2⤵
  PID:7408
- C:\Windows\System\CEiAPpG.exe
  C:\Windows\System\CEiAPpG.exe
  2⤵
  PID:7604
- C:\Windows\System\sbloOhY.exe
  C:\Windows\System\sbloOhY.exe
  2⤵
  PID:7704
- C:\Windows\System\uphEpBA.exe
  C:\Windows\System\uphEpBA.exe
  2⤵
  PID:7772
- C:\Windows\System\dQbzfUi.exe
  C:\Windows\System\dQbzfUi.exe
  2⤵
  PID:7324
- C:\Windows\System\tbVnVDa.exe
  C:\Windows\System\tbVnVDa.exe
  2⤵
  PID:8032
- C:\Windows\System\jSTViaJ.exe
  C:\Windows\System\jSTViaJ.exe
  2⤵
  PID:7476
- C:\Windows\System\KmesqDO.exe
  C:\Windows\System\KmesqDO.exe
  2⤵
  PID:7564
- C:\Windows\System\fnXHuPB.exe
  C:\Windows\System\fnXHuPB.exe
  2⤵
  PID:7592
- C:\Windows\System\eExrulQ.exe
  C:\Windows\System\eExrulQ.exe
  2⤵
  PID:7648
- C:\Windows\System\gpDglxz.exe
  C:\Windows\System\gpDglxz.exe
  2⤵
  PID:8128
- C:\Windows\System\vsyMnAl.exe
  C:\Windows\System\vsyMnAl.exe
  2⤵
  PID:8072
- C:\Windows\System\ltWpJhN.exe
  C:\Windows\System\ltWpJhN.exe
  2⤵
  PID:4880
- C:\Windows\System\ORrwGmu.exe
  C:\Windows\System\ORrwGmu.exe
  2⤵
  PID:8116
- C:\Windows\System\ZeukjGV.exe
  C:\Windows\System\ZeukjGV.exe
  2⤵
  PID:7120
- C:\Windows\System\npeyXRy.exe
  C:\Windows\System\npeyXRy.exe
  2⤵
  PID:6680
- C:\Windows\System\ThjrkTR.exe
  C:\Windows\System\ThjrkTR.exe
  2⤵
  PID:7928
- C:\Windows\System\Zcalhvp.exe
  C:\Windows\System\Zcalhvp.exe
  2⤵
  PID:7368
- C:\Windows\System\EloTwuL.exe
  C:\Windows\System\EloTwuL.exe
  2⤵
  PID:7884
- C:\Windows\System\trLCZSQ.exe
  C:\Windows\System\trLCZSQ.exe
  2⤵
  PID:7536
- C:\Windows\System\LSVDiFX.exe
  C:\Windows\System\LSVDiFX.exe
  2⤵
  PID:7684
- C:\Windows\System\blWHWle.exe
  C:\Windows\System\blWHWle.exe
  2⤵
  PID:7516
- C:\Windows\System\NZtPCDC.exe
  C:\Windows\System\NZtPCDC.exe
  2⤵
  PID:7420
- C:\Windows\System\BySyOoA.exe
  C:\Windows\System\BySyOoA.exe
  2⤵
  PID:7568
- C:\Windows\System\lykrdkT.exe
  C:\Windows\System\lykrdkT.exe
  2⤵
  PID:8088
- C:\Windows\System\fIBOOxE.exe
  C:\Windows\System\fIBOOxE.exe
  2⤵
  PID:8008
- C:\Windows\System\masYtWn.exe
  C:\Windows\System\masYtWn.exe
  2⤵
  PID:5976
- C:\Windows\System\CLyonch.exe
  C:\Windows\System\CLyonch.exe
  2⤵
  PID:8212
- C:\Windows\System\GwwuZRG.exe
  C:\Windows\System\GwwuZRG.exe
  2⤵
  PID:8236
- C:\Windows\System\Xspocnm.exe
  C:\Windows\System\Xspocnm.exe
  2⤵
  PID:8252
- C:\Windows\System\tMJjmne.exe
  C:\Windows\System\tMJjmne.exe
  2⤵
  PID:8268
- C:\Windows\System\plvCFrI.exe
  C:\Windows\System\plvCFrI.exe
  2⤵
  PID:8284
- C:\Windows\System\MZMUmHl.exe
  C:\Windows\System\MZMUmHl.exe
  2⤵
  PID:8300
- C:\Windows\System\amjzHoY.exe
  C:\Windows\System\amjzHoY.exe
  2⤵
  PID:8316
- C:\Windows\System\PWtcrxR.exe
  C:\Windows\System\PWtcrxR.exe
  2⤵
  PID:8340
- C:\Windows\System\izLrbPG.exe
  C:\Windows\System\izLrbPG.exe
  2⤵
  PID:8372
- C:\Windows\System\HNSDptB.exe
  C:\Windows\System\HNSDptB.exe
  2⤵
  PID:8396
- C:\Windows\System\OoclLDs.exe
  C:\Windows\System\OoclLDs.exe
  2⤵
  PID:8424
- C:\Windows\System\LzUfats.exe
  C:\Windows\System\LzUfats.exe
  2⤵
  PID:8444
- C:\Windows\System\wScaTpf.exe
  C:\Windows\System\wScaTpf.exe
  2⤵
  PID:8464
- C:\Windows\System\FfnEhCi.exe
  C:\Windows\System\FfnEhCi.exe
  2⤵
  PID:8484
- C:\Windows\System\lAuafRV.exe
  C:\Windows\System\lAuafRV.exe
  2⤵
  PID:8508
- C:\Windows\System\zoTlCjb.exe
  C:\Windows\System\zoTlCjb.exe
  2⤵
  PID:8524
- C:\Windows\System\sqHpAsP.exe
  C:\Windows\System\sqHpAsP.exe
  2⤵
  PID:8548
- C:\Windows\System\kIZaIRx.exe
  C:\Windows\System\kIZaIRx.exe
  2⤵
  PID:8568
- C:\Windows\System\KLqXCwE.exe
  C:\Windows\System\KLqXCwE.exe
  2⤵
  PID:8592
- C:\Windows\System\aHCMzEx.exe
  C:\Windows\System\aHCMzEx.exe
  2⤵
  PID:8612
- C:\Windows\System\yFDmbkj.exe
  C:\Windows\System\yFDmbkj.exe
  2⤵
  PID:8632
- C:\Windows\System\NmIPRPB.exe
  C:\Windows\System\NmIPRPB.exe
  2⤵
  PID:8660
- C:\Windows\System\mYnUmCd.exe
  C:\Windows\System\mYnUmCd.exe
  2⤵
  PID:8680
- C:\Windows\System\kQymask.exe
  C:\Windows\System\kQymask.exe
  2⤵
  PID:8700
- C:\Windows\System\HPHphfs.exe
  C:\Windows\System\HPHphfs.exe
  2⤵
  PID:8716
- C:\Windows\System\gFNJzlY.exe
  C:\Windows\System\gFNJzlY.exe
  2⤵
  PID:8732
- C:\Windows\System\cQCNXhZ.exe
  C:\Windows\System\cQCNXhZ.exe
  2⤵
  PID:8748
- C:\Windows\System\LlDCPTH.exe
  C:\Windows\System\LlDCPTH.exe
  2⤵
  PID:8764
- C:\Windows\System\vpZVFYP.exe
  C:\Windows\System\vpZVFYP.exe
  2⤵
  PID:8780
- C:\Windows\System\nnDErEP.exe
  C:\Windows\System\nnDErEP.exe
  2⤵
  PID:8796
- C:\Windows\System\FoEUJUD.exe
  C:\Windows\System\FoEUJUD.exe
  2⤵
  PID:8812
- C:\Windows\System\skvEsAt.exe
  C:\Windows\System\skvEsAt.exe
  2⤵
  PID:8844
- C:\Windows\System\uRUPuxr.exe
  C:\Windows\System\uRUPuxr.exe
  2⤵
  PID:8860
- C:\Windows\System\eHgvsKJ.exe
  C:\Windows\System\eHgvsKJ.exe
  2⤵
  PID:8880
- C:\Windows\System\ZSLUhcV.exe
  C:\Windows\System\ZSLUhcV.exe
  2⤵
  PID:8900
- C:\Windows\System\fUyhqLY.exe
  C:\Windows\System\fUyhqLY.exe
  2⤵
  PID:8916
- C:\Windows\System\WeIGfZu.exe
  C:\Windows\System\WeIGfZu.exe
  2⤵
  PID:8944
- C:\Windows\System\AcJacQT.exe
  C:\Windows\System\AcJacQT.exe
  2⤵
  PID:8964
- C:\Windows\System\CasNXKz.exe
  C:\Windows\System\CasNXKz.exe
  2⤵
  PID:8984
- C:\Windows\System\MfyRRTo.exe
  C:\Windows\System\MfyRRTo.exe
  2⤵
  PID:9004
- C:\Windows\System\ABRidDu.exe
  C:\Windows\System\ABRidDu.exe
  2⤵
  PID:9032
- C:\Windows\System\RirDFKq.exe
  C:\Windows\System\RirDFKq.exe
  2⤵
  PID:9056
- C:\Windows\System\FICSArX.exe
  C:\Windows\System\FICSArX.exe
  2⤵
  PID:9076
- C:\Windows\System\tBDPstP.exe
  C:\Windows\System\tBDPstP.exe
  2⤵
  PID:9096
- C:\Windows\System\UaOSHvx.exe
  C:\Windows\System\UaOSHvx.exe
  2⤵
  PID:9116
- C:\Windows\System\jcVjDnj.exe
  C:\Windows\System\jcVjDnj.exe
  2⤵
  PID:9140
- C:\Windows\System\ogmODCm.exe
  C:\Windows\System\ogmODCm.exe
  2⤵
  PID:9156
- C:\Windows\System\sUanvVe.exe
  C:\Windows\System\sUanvVe.exe
  2⤵
  PID:9172
- C:\Windows\System\pIMXGkN.exe
  C:\Windows\System\pIMXGkN.exe
  2⤵
  PID:9192
- C:\Windows\System\qwzkoZD.exe
  C:\Windows\System\qwzkoZD.exe
  2⤵
  PID:9212
- C:\Windows\System\aUPvsWb.exe
  C:\Windows\System\aUPvsWb.exe
  2⤵
  PID:7748
- C:\Windows\System\liGkHVP.exe
  C:\Windows\System\liGkHVP.exe
  2⤵
  PID:6588
- C:\Windows\System\mKudUlX.exe
  C:\Windows\System\mKudUlX.exe
  2⤵
  PID:8012
- C:\Windows\System\AxfeRpd.exe
  C:\Windows\System\AxfeRpd.exe
  2⤵
  PID:7268
- C:\Windows\System\FvNkAlU.exe
  C:\Windows\System\FvNkAlU.exe
  2⤵
  PID:8112
- C:\Windows\System\xtfiLZx.exe
  C:\Windows\System\xtfiLZx.exe
  2⤵
  PID:7200
- C:\Windows\System\yHEpedF.exe
  C:\Windows\System\yHEpedF.exe
  2⤵
  PID:7312
- C:\Windows\System\ERddkwZ.exe
  C:\Windows\System\ERddkwZ.exe
  2⤵
  PID:8324
- C:\Windows\System\INODBUg.exe
  C:\Windows\System\INODBUg.exe
  2⤵
  PID:6704
- C:\Windows\System\JKdssea.exe
  C:\Windows\System\JKdssea.exe
  2⤵
  PID:8520
- C:\Windows\System\NnGnbmO.exe
  C:\Windows\System\NnGnbmO.exe
  2⤵
  PID:8624
- C:\Windows\System\aoVJSbW.exe
  C:\Windows\System\aoVJSbW.exe
  2⤵
  PID:8712
- C:\Windows\System\UIbqRCW.exe
  C:\Windows\System\UIbqRCW.exe
  2⤵
  PID:8832
- C:\Windows\System\alsMmKD.exe
  C:\Windows\System\alsMmKD.exe
  2⤵
  PID:8924
- C:\Windows\System\oUpBdRu.exe
  C:\Windows\System\oUpBdRu.exe
  2⤵
  PID:9228
- C:\Windows\System\dbyrZTz.exe
  C:\Windows\System\dbyrZTz.exe
  2⤵
  PID:9248
- C:\Windows\System\GtGLYmr.exe
  C:\Windows\System\GtGLYmr.exe
  2⤵
  PID:9268
- C:\Windows\System\SFgSFAy.exe
  C:\Windows\System\SFgSFAy.exe
  2⤵
  PID:10012
- C:\Windows\System\jVUATmB.exe
  C:\Windows\System\jVUATmB.exe
  2⤵
  PID:10028
- C:\Windows\System\qPIsflI.exe
  C:\Windows\System\qPIsflI.exe
  2⤵
  PID:10052
- C:\Windows\System\bYbSCSd.exe
  C:\Windows\System\bYbSCSd.exe
  2⤵
  PID:10076
- C:\Windows\System\gIOKYDT.exe
  C:\Windows\System\gIOKYDT.exe
  2⤵
  PID:10092
- C:\Windows\System\ntTWXft.exe
  C:\Windows\System\ntTWXft.exe
  2⤵
  PID:10116
- C:\Windows\System\zOTMNbY.exe
  C:\Windows\System\zOTMNbY.exe
  2⤵
  PID:10136
- C:\Windows\System\lFgLWwV.exe
  C:\Windows\System\lFgLWwV.exe
  2⤵
  PID:10160
- C:\Windows\System\fdSPjpR.exe
  C:\Windows\System\fdSPjpR.exe
  2⤵
  PID:10176
- C:\Windows\System\RCLjbmW.exe
  C:\Windows\System\RCLjbmW.exe
  2⤵
  PID:10208
- C:\Windows\System\NxZjnJp.exe
  C:\Windows\System\NxZjnJp.exe
  2⤵
  PID:8976
- C:\Windows\System\XBzJqQU.exe
  C:\Windows\System\XBzJqQU.exe
  2⤵
  PID:8560
- C:\Windows\System\ZIgLwwz.exe
  C:\Windows\System\ZIgLwwz.exe
  2⤵
  PID:8676
- C:\Windows\System\clGaCoL.exe
  C:\Windows\System\clGaCoL.exe
  2⤵
  PID:8264
- C:\Windows\System\kftLHrr.exe
  C:\Windows\System\kftLHrr.exe
  2⤵
  PID:9168
- C:\Windows\System\akWwxAP.exe
  C:\Windows\System\akWwxAP.exe
  2⤵
  PID:8772
- C:\Windows\System\iYFQfJw.exe
  C:\Windows\System\iYFQfJw.exe
  2⤵
  PID:6924
- C:\Windows\System\JBMWWru.exe
  C:\Windows\System\JBMWWru.exe
  2⤵
  PID:8852
- C:\Windows\System\PxpkcNs.exe
  C:\Windows\System\PxpkcNs.exe
  2⤵
  PID:8360
- C:\Windows\System\HKVhHxu.exe
  C:\Windows\System\HKVhHxu.exe
  2⤵
  PID:8912
- C:\Windows\System\nqjGjWQ.exe
  C:\Windows\System\nqjGjWQ.exe
  2⤵
  PID:8960
- C:\Windows\System\wgkYLQn.exe
  C:\Windows\System\wgkYLQn.exe
  2⤵
  PID:8788
- C:\Windows\System\quyIGYR.exe
  C:\Windows\System\quyIGYR.exe
  2⤵
  PID:7804
- C:\Windows\System\bUQLlSn.exe
  C:\Windows\System\bUQLlSn.exe
  2⤵
  PID:7732
- C:\Windows\System\EpBWkKa.exe
  C:\Windows\System\EpBWkKa.exe
  2⤵
  PID:8888
- C:\Windows\System\azJBvbO.exe
  C:\Windows\System\azJBvbO.exe
  2⤵
  PID:9556
- C:\Windows\System\XDYKRtP.exe
  C:\Windows\System\XDYKRtP.exe
  2⤵
  PID:9016
- C:\Windows\System\tNScxzu.exe
  C:\Windows\System\tNScxzu.exe
  2⤵
  PID:9088
- C:\Windows\System\bvbGFdB.exe
  C:\Windows\System\bvbGFdB.exe
  2⤵
  PID:9648
- C:\Windows\System\mEZhzXP.exe
  C:\Windows\System\mEZhzXP.exe
  2⤵
  PID:9164
- C:\Windows\System\EKJrEWy.exe
  C:\Windows\System\EKJrEWy.exe
  2⤵
  PID:9204
- C:\Windows\System\xBdMvOg.exe
  C:\Windows\System\xBdMvOg.exe
  2⤵
  PID:8200
- C:\Windows\System\cDgkKng.exe
  C:\Windows\System\cDgkKng.exe
  2⤵
  PID:9764
- C:\Windows\System\Jsrdnzd.exe
  C:\Windows\System\Jsrdnzd.exe
  2⤵
  PID:8476
- C:\Windows\System\QObfICV.exe
  C:\Windows\System\QObfICV.exe
  2⤵
  PID:9788
- C:\Windows\System\ljCqBnr.exe
  C:\Windows\System\ljCqBnr.exe
  2⤵
  PID:9816
- C:\Windows\System\GPsoEIo.exe
  C:\Windows\System\GPsoEIo.exe
  2⤵
  PID:9284
- C:\Windows\System\NMRNSee.exe
  C:\Windows\System\NMRNSee.exe
  2⤵
  PID:9624
- C:\Windows\System\SZyFnjb.exe
  C:\Windows\System\SZyFnjb.exe
  2⤵
  PID:9672
- C:\Windows\System\XWJSXlY.exe
  C:\Windows\System\XWJSXlY.exe
  2⤵
  PID:9412
- C:\Windows\System\rWrIPJL.exe
  C:\Windows\System\rWrIPJL.exe
  2⤵
  PID:8076
- C:\Windows\System\frISLqh.exe
  C:\Windows\System\frISLqh.exe
  2⤵
  PID:9524
- C:\Windows\System\WDPGqAn.exe
  C:\Windows\System\WDPGqAn.exe
  2⤵
  PID:10036
- C:\Windows\System\GOLdPIb.exe
  C:\Windows\System\GOLdPIb.exe
  2⤵
  PID:10084
- C:\Windows\System\AcCMkMS.exe
  C:\Windows\System\AcCMkMS.exe
  2⤵
  PID:10112
- C:\Windows\System\SaJKPJk.exe
  C:\Windows\System\SaJKPJk.exe
  2⤵
  PID:10168
- C:\Windows\System\MaKwGkJ.exe
  C:\Windows\System\MaKwGkJ.exe
  2⤵
  PID:9952
- C:\Windows\System\TUQgRVf.exe
  C:\Windows\System\TUQgRVf.exe
  2⤵
  PID:8292
- C:\Windows\System\xdlkjRU.exe
  C:\Windows\System\xdlkjRU.exe
  2⤵
  PID:8364
- C:\Windows\System\uEoZYPg.exe
  C:\Windows\System\uEoZYPg.exe
  2⤵
  PID:9944
- C:\Windows\System\zIeZnAQ.exe
  C:\Windows\System\zIeZnAQ.exe
  2⤵
  PID:8296
- C:\Windows\System\EZtLAwc.exe
  C:\Windows\System\EZtLAwc.exe
  2⤵
  PID:9964
- C:\Windows\System\MGhSKfQ.exe
  C:\Windows\System\MGhSKfQ.exe
  2⤵
  PID:9992
- C:\Windows\System\uhFlFUF.exe
  C:\Windows\System\uhFlFUF.exe
  2⤵
  PID:9372
- C:\Windows\System\qIzlRxE.exe
  C:\Windows\System\qIzlRxE.exe
  2⤵
  PID:8248
- C:\Windows\System\KiIUWuy.exe
  C:\Windows\System\KiIUWuy.exe
  2⤵
  PID:9960
- C:\Windows\System\gqReslw.exe
  C:\Windows\System\gqReslw.exe
  2⤵
  PID:9132
- C:\Windows\System\LRxCUTF.exe
  C:\Windows\System\LRxCUTF.exe
  2⤵
  PID:8644
- C:\Windows\System\qsrbQif.exe
  C:\Windows\System\qsrbQif.exe
  2⤵
  PID:9484
- C:\Windows\System\YyhyFri.exe
  C:\Windows\System\YyhyFri.exe
  2⤵
  PID:9800
- C:\Windows\System\fLfVhYw.exe
  C:\Windows\System\fLfVhYw.exe
  2⤵
  PID:10260
- C:\Windows\System\lfgZgHR.exe
  C:\Windows\System\lfgZgHR.exe
  2⤵
  PID:10276
- C:\Windows\System\uvJGsjp.exe
  C:\Windows\System\uvJGsjp.exe
  2⤵
  PID:10292
- C:\Windows\System\SjFIPXv.exe
  C:\Windows\System\SjFIPXv.exe
  2⤵
  PID:10320
- C:\Windows\System\OKiwxKE.exe
  C:\Windows\System\OKiwxKE.exe
  2⤵
  PID:10344
- C:\Windows\System\TNYvdnG.exe
  C:\Windows\System\TNYvdnG.exe
  2⤵
  PID:10364
- C:\Windows\System\ItrDOTF.exe
  C:\Windows\System\ItrDOTF.exe
  2⤵
  PID:10392
- C:\Windows\System\UUDBbLb.exe
  C:\Windows\System\UUDBbLb.exe
  2⤵
  PID:10412
- C:\Windows\System\qfaRJXJ.exe
  C:\Windows\System\qfaRJXJ.exe
  2⤵
  PID:10432
- C:\Windows\System\ABvYFIi.exe
  C:\Windows\System\ABvYFIi.exe
  2⤵
  PID:10456
- C:\Windows\System\xTPfsDr.exe
  C:\Windows\System\xTPfsDr.exe
  2⤵
  PID:10480
- C:\Windows\System\efqLYQi.exe
  C:\Windows\System\efqLYQi.exe
  2⤵
  PID:10592
- C:\Windows\System\aisuoxo.exe
  C:\Windows\System\aisuoxo.exe
  2⤵
  PID:10608
- C:\Windows\System\CYIveTS.exe
  C:\Windows\System\CYIveTS.exe
  2⤵
  PID:10628
- C:\Windows\System\kyHGLBS.exe
  C:\Windows\System\kyHGLBS.exe
  2⤵
  PID:10648
- C:\Windows\System\klcQFQq.exe
  C:\Windows\System\klcQFQq.exe
  2⤵
  PID:10668
- C:\Windows\System\FAHSckL.exe
  C:\Windows\System\FAHSckL.exe
  2⤵
  PID:10692
- C:\Windows\System\TXRXtBZ.exe
  C:\Windows\System\TXRXtBZ.exe
  2⤵
  PID:10716
- C:\Windows\System\RmHaYTe.exe
  C:\Windows\System\RmHaYTe.exe
  2⤵
  PID:10736
- C:\Windows\System\MCFZchN.exe
  C:\Windows\System\MCFZchN.exe
  2⤵
  PID:10756
- C:\Windows\System\hgNkIza.exe
  C:\Windows\System\hgNkIza.exe
  2⤵
  PID:10776
- C:\Windows\System\iVEjTBN.exe
  C:\Windows\System\iVEjTBN.exe
  2⤵
  PID:10792
- C:\Windows\System\cDuZFBR.exe
  C:\Windows\System\cDuZFBR.exe
  2⤵
  PID:10812
- C:\Windows\System\YXLyVsB.exe
  C:\Windows\System\YXLyVsB.exe
  2⤵
  PID:10832
- C:\Windows\System\aNivXjI.exe
  C:\Windows\System\aNivXjI.exe
  2⤵
  PID:10860
- C:\Windows\System\bEVviBo.exe
  C:\Windows\System\bEVviBo.exe
  2⤵
  PID:10876
- C:\Windows\System\pLtkhRS.exe
  C:\Windows\System\pLtkhRS.exe
  2⤵
  PID:10900
- C:\Windows\System\MJdDShh.exe
  C:\Windows\System\MJdDShh.exe
  2⤵
  PID:10920
- C:\Windows\System\hgHxOen.exe
  C:\Windows\System\hgHxOen.exe
  2⤵
  PID:10940
- C:\Windows\System\qdimnZB.exe
  C:\Windows\System\qdimnZB.exe
  2⤵
  PID:10960
- C:\Windows\System\LdlELzO.exe
  C:\Windows\System\LdlELzO.exe
  2⤵
  PID:10976
- C:\Windows\System\ZZsQirf.exe
  C:\Windows\System\ZZsQirf.exe
  2⤵
  PID:10992
- C:\Windows\System\yWJXgtW.exe
  C:\Windows\System\yWJXgtW.exe
  2⤵
  PID:11008
- C:\Windows\System\ovOEshB.exe
  C:\Windows\System\ovOEshB.exe
  2⤵
  PID:11028
- C:\Windows\System\DPvZmoT.exe
  C:\Windows\System\DPvZmoT.exe
  2⤵
  PID:11052
- C:\Windows\System\KlyJXrC.exe
  C:\Windows\System\KlyJXrC.exe
  2⤵
  PID:11072
- C:\Windows\System\kBGCebT.exe
  C:\Windows\System\kBGCebT.exe
  2⤵
  PID:11104
- C:\Windows\System\NuoeOPk.exe
  C:\Windows\System\NuoeOPk.exe
  2⤵
  PID:11128
- C:\Windows\System\uDEkhEB.exe
  C:\Windows\System\uDEkhEB.exe
  2⤵
  PID:11152
- C:\Windows\System\AnknQyx.exe
  C:\Windows\System\AnknQyx.exe
  2⤵
  PID:11168
- C:\Windows\System\tEklGoZ.exe
  C:\Windows\System\tEklGoZ.exe
  2⤵
  PID:11188
- C:\Windows\System\hxZnFCw.exe
  C:\Windows\System\hxZnFCw.exe
  2⤵
  PID:11208
- C:\Windows\System\MBnVUrQ.exe
  C:\Windows\System\MBnVUrQ.exe
  2⤵
  PID:11228
- C:\Windows\System\mIvUBrJ.exe
  C:\Windows\System\mIvUBrJ.exe
  2⤵
  PID:11252
- C:\Windows\System\gtXlPSt.exe
  C:\Windows\System\gtXlPSt.exe
  2⤵
  PID:9836
- C:\Windows\System\bgIoywR.exe
  C:\Windows\System\bgIoywR.exe
  2⤵
  PID:9332
- C:\Windows\System\FhBIumd.exe
  C:\Windows\System\FhBIumd.exe
  2⤵
  PID:9428
- C:\Windows\System\uPUMLap.exe
  C:\Windows\System\uPUMLap.exe
  2⤵
  PID:1792
- C:\Windows\System\SIMCsJp.exe
  C:\Windows\System\SIMCsJp.exe
  2⤵
  PID:9108
- C:\Windows\System\jrWcQyt.exe
  C:\Windows\System\jrWcQyt.exe
  2⤵
  PID:8356
- C:\Windows\System\rWTeTyw.exe
  C:\Windows\System\rWTeTyw.exe
  2⤵
  PID:9260
- C:\Windows\System\BgMzuqk.exe
  C:\Windows\System\BgMzuqk.exe
  2⤵
  PID:10380
- C:\Windows\System\AiwXBFy.exe
  C:\Windows\System\AiwXBFy.exe
  2⤵
  PID:10072
- C:\Windows\System\sLkXjgp.exe
  C:\Windows\System\sLkXjgp.exe
  2⤵
  PID:9808
- C:\Windows\System\SBSYCoI.exe
  C:\Windows\System\SBSYCoI.exe
  2⤵
  PID:10524
- C:\Windows\System\mdVZJHW.exe
  C:\Windows\System\mdVZJHW.exe
  2⤵
  PID:10232
- C:\Windows\System\FjFwwfW.exe
  C:\Windows\System\FjFwwfW.exe
  2⤵
  PID:7680
- C:\Windows\System\liiUdXn.exe
  C:\Windows\System\liiUdXn.exe
  2⤵
  PID:11064
- C:\Windows\System\NIbySpf.exe
  C:\Windows\System\NIbySpf.exe
  2⤵
  PID:9500
- C:\Windows\System\lXUufHk.exe
  C:\Windows\System\lXUufHk.exe
  2⤵
  PID:11224
- C:\Windows\System\zAxnQBo.exe
  C:\Windows\System\zAxnQBo.exe
  2⤵
  PID:10784
- C:\Windows\System\lDuyQqA.exe
  C:\Windows\System\lDuyQqA.exe
  2⤵
  PID:11100
- C:\Windows\System\agwRvuz.exe
  C:\Windows\System\agwRvuz.exe
  2⤵
  PID:11144
- C:\Windows\System\byzGLaQ.exe
  C:\Windows\System\byzGLaQ.exe
  2⤵
  PID:11220
- C:\Windows\System\hTUwwVY.exe
  C:\Windows\System\hTUwwVY.exe
  2⤵
  PID:10312
- C:\Windows\System\ZVgZIRG.exe
  C:\Windows\System\ZVgZIRG.exe
  2⤵
  PID:8696
- C:\Windows\System\QMTDODK.exe
  C:\Windows\System\QMTDODK.exe
  2⤵
  PID:9184
- C:\Windows\System\PFHCdzI.exe
  C:\Windows\System\PFHCdzI.exe
  2⤵
  PID:9708
- C:\Windows\System\GVsyGxv.exe
  C:\Windows\System\GVsyGxv.exe
  2⤵
  PID:11284
- C:\Windows\System\XKmsabz.exe
  C:\Windows\System\XKmsabz.exe
  2⤵
  PID:11304
- C:\Windows\System\kZbJhOU.exe
  C:\Windows\System\kZbJhOU.exe
  2⤵
  PID:11328
- C:\Windows\System\ojnvAap.exe
  C:\Windows\System\ojnvAap.exe
  2⤵
  PID:11352
- C:\Windows\System\JPHTUKI.exe
  C:\Windows\System\JPHTUKI.exe
  2⤵
  PID:11372
- C:\Windows\System\MQTKYGx.exe
  C:\Windows\System\MQTKYGx.exe
  2⤵
  PID:11396
- C:\Windows\System\XNBzemp.exe
  C:\Windows\System\XNBzemp.exe
  2⤵
  PID:11420
- C:\Windows\System\XSDEdmz.exe
  C:\Windows\System\XSDEdmz.exe
  2⤵
  PID:11444
- C:\Windows\System\UVuhPCx.exe
  C:\Windows\System\UVuhPCx.exe
  2⤵
  PID:11472
- C:\Windows\System\pRrvNCC.exe
  C:\Windows\System\pRrvNCC.exe
  2⤵
  PID:11488
- C:\Windows\System\SBmcLdZ.exe
  C:\Windows\System\SBmcLdZ.exe
  2⤵
  PID:11508
- C:\Windows\System\IDymGwh.exe
  C:\Windows\System\IDymGwh.exe
  2⤵
  PID:11532
- C:\Windows\System\lMBswqK.exe
  C:\Windows\System\lMBswqK.exe
  2⤵
  PID:11556
- C:\Windows\System\FDpvlvg.exe
  C:\Windows\System\FDpvlvg.exe
  2⤵
  PID:11584
- C:\Windows\System\nePLRWo.exe
  C:\Windows\System\nePLRWo.exe
  2⤵
  PID:11612
- C:\Windows\System\WtCpGOU.exe
  C:\Windows\System\WtCpGOU.exe
  2⤵
  PID:11628
- C:\Windows\System\YPUPCWt.exe
  C:\Windows\System\YPUPCWt.exe
  2⤵
  PID:11648
- C:\Windows\System\EGpFkhJ.exe
  C:\Windows\System\EGpFkhJ.exe
  2⤵
  PID:11664
- C:\Windows\System\ZcIGvtJ.exe
  C:\Windows\System\ZcIGvtJ.exe
  2⤵
  PID:11680
- C:\Windows\System\wKNeFHr.exe
  C:\Windows\System\wKNeFHr.exe
  2⤵
  PID:11700
- C:\Windows\System\DUWavzF.exe
  C:\Windows\System\DUWavzF.exe
  2⤵
  PID:11716
- C:\Windows\System\auiKCLX.exe
  C:\Windows\System\auiKCLX.exe
  2⤵
  PID:11748
- C:\Windows\System\EWOOXIn.exe
  C:\Windows\System\EWOOXIn.exe
  2⤵
  PID:11792
- C:\Windows\System\lvgZKvH.exe
  C:\Windows\System\lvgZKvH.exe
  2⤵
  PID:11812
- C:\Windows\System\xuxciOr.exe
  C:\Windows\System\xuxciOr.exe
  2⤵
  PID:11836
- C:\Windows\System\sUWlKlU.exe
  C:\Windows\System\sUWlKlU.exe
  2⤵
  PID:11856
- C:\Windows\System\GevRPlH.exe
  C:\Windows\System\GevRPlH.exe
  2⤵
  PID:11884
- C:\Windows\System\InGcUDK.exe
  C:\Windows\System\InGcUDK.exe
  2⤵
  PID:11900
- C:\Windows\System\SKlgiHT.exe
  C:\Windows\System\SKlgiHT.exe
  2⤵
  PID:11924
- C:\Windows\System\eksGbzB.exe
  C:\Windows\System\eksGbzB.exe
  2⤵
  PID:11948
- C:\Windows\System\DgQogIl.exe
  C:\Windows\System\DgQogIl.exe
  2⤵
  PID:11968
- C:\Windows\System\fmccrGN.exe
  C:\Windows\System\fmccrGN.exe
  2⤵
  PID:11992
- C:\Windows\System\rxJEUsg.exe
  C:\Windows\System\rxJEUsg.exe
  2⤵
  PID:12012
- C:\Windows\System\CmmMliT.exe
  C:\Windows\System\CmmMliT.exe
  2⤵
  PID:12028
- C:\Windows\System\JueYDTP.exe
  C:\Windows\System\JueYDTP.exe
  2⤵
  PID:12044
- C:\Windows\System\tVWLXEF.exe
  C:\Windows\System\tVWLXEF.exe
  2⤵
  PID:12064
- C:\Windows\System\duuHfyh.exe
  C:\Windows\System\duuHfyh.exe
  2⤵
  PID:12088
- C:\Windows\System\JFJBsqB.exe
  C:\Windows\System\JFJBsqB.exe
  2⤵
  PID:12108
- C:\Windows\System\jdlifdk.exe
  C:\Windows\System\jdlifdk.exe
  2⤵
  PID:12132
- C:\Windows\System\tjqoSyO.exe
  C:\Windows\System\tjqoSyO.exe
  2⤵
  PID:12148
- C:\Windows\System\TUTGNrY.exe
  C:\Windows\System\TUTGNrY.exe
  2⤵
  PID:12168
- C:\Windows\System\lOGMkUR.exe
  C:\Windows\System\lOGMkUR.exe
  2⤵
  PID:12188
- C:\Windows\System\HlUmPFF.exe
  C:\Windows\System\HlUmPFF.exe
  2⤵
  PID:12208
- C:\Windows\System\inJPwkm.exe
  C:\Windows\System\inJPwkm.exe
  2⤵
  PID:12224
- C:\Windows\System\pRxLXZN.exe
  C:\Windows\System\pRxLXZN.exe
  2⤵
  PID:12240
- C:\Windows\System\WXMCvAI.exe
  C:\Windows\System\WXMCvAI.exe
  2⤵
  PID:12256
- C:\Windows\System\wuvWvSL.exe
  C:\Windows\System\wuvWvSL.exe
  2⤵
  PID:12276
- C:\Windows\System\gVuPZel.exe
  C:\Windows\System\gVuPZel.exe
  2⤵
  PID:10824
- C:\Windows\System\JycKYKC.exe
  C:\Windows\System\JycKYKC.exe
  2⤵
  PID:10268
- C:\Windows\System\CLSGJEn.exe
  C:\Windows\System\CLSGJEn.exe
  2⤵
  PID:10956
- C:\Windows\System\AJBbbIL.exe
  C:\Windows\System\AJBbbIL.exe
  2⤵
  PID:10984
- C:\Windows\System\MQpsvjH.exe
  C:\Windows\System\MQpsvjH.exe
  2⤵
  PID:11120
- C:\Windows\System\StHMAud.exe
  C:\Windows\System\StHMAud.exe
  2⤵
  PID:9504
- C:\Windows\System\nuUulfb.exe
  C:\Windows\System\nuUulfb.exe
  2⤵
  PID:10492
- C:\Windows\System\CMdwRUi.exe
  C:\Windows\System\CMdwRUi.exe
  2⤵
  PID:11360
- C:\Windows\System\Rdyuqje.exe
  C:\Windows\System\Rdyuqje.exe
  2⤵
  PID:10808
- C:\Windows\System\UKtbClT.exe
  C:\Windows\System\UKtbClT.exe
  2⤵
  PID:11436
- C:\Windows\System\pPMkukP.exe
  C:\Windows\System\pPMkukP.exe
  2⤵
  PID:11596
- C:\Windows\System\IGtyHbB.exe
  C:\Windows\System\IGtyHbB.exe
  2⤵
  PID:10684
- C:\Windows\System\aOKxhAE.exe
  C:\Windows\System\aOKxhAE.exe
  2⤵
  PID:12304
- C:\Windows\System\oDfYOIx.exe
  C:\Windows\System\oDfYOIx.exe
  2⤵
  PID:12328
- C:\Windows\System\kdPhpUG.exe
  C:\Windows\System\kdPhpUG.exe
  2⤵
  PID:12344
- C:\Windows\System\ipbRnBQ.exe
  C:\Windows\System\ipbRnBQ.exe
  2⤵
  PID:12372
- C:\Windows\System\OYqdOip.exe
  C:\Windows\System\OYqdOip.exe
  2⤵
  PID:12388
- C:\Windows\System\EefQMMh.exe
  C:\Windows\System\EefQMMh.exe
  2⤵
  PID:12408
- C:\Windows\System\NAOjedg.exe
  C:\Windows\System\NAOjedg.exe
  2⤵
  PID:12428
- C:\Windows\System\YXvQiFK.exe
  C:\Windows\System\YXvQiFK.exe
  2⤵
  PID:12448
- C:\Windows\System\PsTVutQ.exe
  C:\Windows\System\PsTVutQ.exe
  2⤵
  PID:12464
- C:\Windows\System\WTTuHMm.exe
  C:\Windows\System\WTTuHMm.exe
  2⤵
  PID:12656
- C:\Windows\System\LVzfIMv.exe
  C:\Windows\System\LVzfIMv.exe
  2⤵
  PID:12676
- C:\Windows\System\zUcNvHA.exe
  C:\Windows\System\zUcNvHA.exe
  2⤵
  PID:12708
- C:\Windows\System\pRZSmjk.exe
  C:\Windows\System\pRZSmjk.exe
  2⤵
  PID:12728
- C:\Windows\System\xLloLIw.exe
  C:\Windows\System\xLloLIw.exe
  2⤵
  PID:12748
- C:\Windows\System\FcZBDXu.exe
  C:\Windows\System\FcZBDXu.exe
  2⤵
  PID:12772
- C:\Windows\System\bSkudaq.exe
  C:\Windows\System\bSkudaq.exe
  2⤵
  PID:12796
- C:\Windows\System\LMDFkpj.exe
  C:\Windows\System\LMDFkpj.exe
  2⤵
  PID:12820
- C:\Windows\System\OegLnwm.exe
  C:\Windows\System\OegLnwm.exe
  2⤵
  PID:13000
- C:\Windows\System\qWIivpC.exe
  C:\Windows\System\qWIivpC.exe
  2⤵
  PID:13020
- C:\Windows\System\OuWilTH.exe
  C:\Windows\System\OuWilTH.exe
  2⤵
  PID:13040
- C:\Windows\System\ywVeHZP.exe
  C:\Windows\System\ywVeHZP.exe
  2⤵
  PID:13064
- C:\Windows\System\JcYhqxy.exe
  C:\Windows\System\JcYhqxy.exe
  2⤵
  PID:13084
- C:\Windows\System\bAMlUUw.exe
  C:\Windows\System\bAMlUUw.exe
  2⤵
  PID:13104
- C:\Windows\System\oPCiqZb.exe
  C:\Windows\System\oPCiqZb.exe
  2⤵
  PID:13128
- C:\Windows\System\yoLuGLz.exe
  C:\Windows\System\yoLuGLz.exe
  2⤵
  PID:13148
- C:\Windows\System\RQhCpJl.exe
  C:\Windows\System\RQhCpJl.exe
  2⤵
  PID:13164
- C:\Windows\System\gLDkrFr.exe
  C:\Windows\System\gLDkrFr.exe
  2⤵
  PID:13184
- C:\Windows\System\FARtYOk.exe
  C:\Windows\System\FARtYOk.exe
  2⤵
  PID:13200
- C:\Windows\System\MCRkxQp.exe
  C:\Windows\System\MCRkxQp.exe
  2⤵
  PID:13216
- C:\Windows\System\kLIuuyA.exe
  C:\Windows\System\kLIuuyA.exe
  2⤵
  PID:13236
- C:\Windows\System\OgIihFz.exe
  C:\Windows\System\OgIihFz.exe
  2⤵
  PID:13252
- C:\Windows\System\wNcygUF.exe
  C:\Windows\System\wNcygUF.exe
  2⤵
  PID:13268
- C:\Windows\System\avtLLkk.exe
  C:\Windows\System\avtLLkk.exe
  2⤵
  PID:13288
- C:\Windows\System\IyDMAwk.exe
  C:\Windows\System\IyDMAwk.exe
  2⤵
  PID:13304
- C:\Windows\System\nDxPnfI.exe
  C:\Windows\System\nDxPnfI.exe
  2⤵
  PID:11844
- C:\Windows\System\FJvpMwr.exe
  C:\Windows\System\FJvpMwr.exe
  2⤵
  PID:11896
- C:\Windows\System\vbdJKkI.exe
  C:\Windows\System\vbdJKkI.exe
  2⤵
  PID:11940
- C:\Windows\System\Zgrqedf.exe
  C:\Windows\System\Zgrqedf.exe
  2⤵
  PID:12020
- C:\Windows\System\EBnfeYy.exe
  C:\Windows\System\EBnfeYy.exe
  2⤵
  PID:8352
- C:\Windows\System\eEkUWHP.exe
  C:\Windows\System\eEkUWHP.exe
  2⤵
  PID:10580
- C:\Windows\System\mSIzdoM.exe
  C:\Windows\System\mSIzdoM.exe
  2⤵
  PID:2540
- C:\Windows\System\ywvPzXG.exe
  C:\Windows\System\ywvPzXG.exe
  2⤵
  PID:12340
- C:\Windows\System\LkymNyD.exe
  C:\Windows\System\LkymNyD.exe
  2⤵
  PID:11320
- C:\Windows\System\DCadmeJ.exe
  C:\Windows\System\DCadmeJ.exe
  2⤵
  PID:3500
- C:\Windows\System\aTwyiNQ.exe
  C:\Windows\System\aTwyiNQ.exe
  2⤵
  PID:11640
- C:\Windows\System\CJDOzRr.exe
  C:\Windows\System\CJDOzRr.exe
  2⤵
  PID:1708
- C:\Windows\System\jhjltPJ.exe
  C:\Windows\System\jhjltPJ.exe
  2⤵
  PID:11744
- C:\Windows\System\UQKMdgH.exe
  C:\Windows\System\UQKMdgH.exe
  2⤵
  PID:2068
- C:\Windows\System\YuLFKTN.exe
  C:\Windows\System\YuLFKTN.exe
  2⤵
  PID:11876
- C:\Windows\System\TlKGQDC.exe
  C:\Windows\System\TlKGQDC.exe
  2⤵
  PID:13028
- C:\Windows\System\EjAQbqj.exe
  C:\Windows\System\EjAQbqj.exe
  2⤵
  PID:13224
- C:\Windows\System\jVDbArS.exe
  C:\Windows\System\jVDbArS.exe
  2⤵
  PID:2944
- C:\Windows\System\MvtcwuD.exe
  C:\Windows\System\MvtcwuD.exe
  2⤵
  PID:11624
- C:\Windows\System\hswmhlC.exe
  C:\Windows\System\hswmhlC.exe
  2⤵
  PID:12756
- C:\Windows\System\ldGOZtO.exe
  C:\Windows\System\ldGOZtO.exe
  2⤵
  PID:11636
- C:\Windows\System\ULVCWNi.exe
  C:\Windows\System\ULVCWNi.exe
  2⤵
  PID:12424
- C:\Windows\System\QDuMcac.exe
  C:\Windows\System\QDuMcac.exe
  2⤵
  PID:992
- C:\Windows\System\xzLJWJG.exe
  C:\Windows\System\xzLJWJG.exe
  2⤵
  PID:12404
- C:\Windows\System\QvZrlzG.exe
  C:\Windows\System\QvZrlzG.exe
  2⤵
  PID:12904
- C:\Windows\System\YiIDFTq.exe
  C:\Windows\System\YiIDFTq.exe
  2⤵
  PID:13116
- C:\Windows\System\PFISJCk.exe
  C:\Windows\System\PFISJCk.exe
  2⤵
  PID:12524
- C:\Windows\System\FwiqqAR.exe
  C:\Windows\System\FwiqqAR.exe
  2⤵
  PID:11808
- C:\Windows\System\ZfTjzPF.exe
  C:\Windows\System\ZfTjzPF.exe
  2⤵
  PID:13264
- C:\Windows\System\kAKJsuv.exe
  C:\Windows\System\kAKJsuv.exe
  2⤵
  PID:11824
- C:\Windows\System\ALuKiIz.exe
  C:\Windows\System\ALuKiIz.exe
  2⤵
  PID:12380
- C:\Windows\System\OQVmIhL.exe
  C:\Windows\System\OQVmIhL.exe
  2⤵
  PID:12024
- C:\Windows\System\eBxOBBo.exe
  C:\Windows\System\eBxOBBo.exe
  2⤵
  PID:12100
- C:\Windows\System\gvtXvMJ.exe
  C:\Windows\System\gvtXvMJ.exe
  2⤵
  PID:11060
- C:\Windows\System\ZVRNQHY.exe
  C:\Windows\System\ZVRNQHY.exe
  2⤵
  PID:12104
- C:\Windows\System\yNwVjaN.exe
  C:\Windows\System\yNwVjaN.exe
  2⤵
  PID:12312
- C:\Windows\System\wXVApym.exe
  C:\Windows\System\wXVApym.exe
  2⤵
  PID:2460
- C:\Windows\System\iuPkgmZ.exe
  C:\Windows\System\iuPkgmZ.exe
  2⤵
  PID:12780
- C:\Windows\System\JeYavOe.exe
  C:\Windows\System\JeYavOe.exe
  2⤵
  PID:12620
- C:\Windows\System\bunNYFv.exe
  C:\Windows\System\bunNYFv.exe
  2⤵
  PID:13276
- C:\Windows\System\ilKDuFl.exe
  C:\Windows\System\ilKDuFl.exe
  2⤵
  PID:3228
- C:\Windows\System\BTgSspI.exe
  C:\Windows\System\BTgSspI.exe
  2⤵
  PID:11804
- C:\Windows\System\BUPCMDJ.exe
  C:\Windows\System\BUPCMDJ.exe
  2⤵
  PID:13328
- C:\Windows\System\DzENpNg.exe
  C:\Windows\System\DzENpNg.exe
  2⤵
  PID:13352
- C:\Windows\System\UTzQbnx.exe
  C:\Windows\System\UTzQbnx.exe
  2⤵
  PID:13548
- C:\Windows\System\hbPCStA.exe
  C:\Windows\System\hbPCStA.exe
  2⤵
  PID:13576
- C:\Windows\System\MPbTpwC.exe
  C:\Windows\System\MPbTpwC.exe
  2⤵
  PID:13664
- C:\Windows\System\JtcbIVP.exe
  C:\Windows\System\JtcbIVP.exe
  2⤵
  PID:13712
- C:\Windows\System\fAARSuL.exe
  C:\Windows\System\fAARSuL.exe
  2⤵
  PID:13732
- C:\Windows\System\IodXCfh.exe
  C:\Windows\System\IodXCfh.exe
  2⤵
  PID:13748
- C:\Windows\System\fMzUoGo.exe
  C:\Windows\System\fMzUoGo.exe
  2⤵
  PID:13764
- C:\Windows\System\YICtfLB.exe
  C:\Windows\System\YICtfLB.exe
  2⤵
  PID:13780
- C:\Windows\System\nNsDiZG.exe
  C:\Windows\System\nNsDiZG.exe
  2⤵
  PID:13800
- C:\Windows\System\toCMixu.exe
  C:\Windows\System\toCMixu.exe
  2⤵
  PID:13816
- C:\Windows\System\JmogSTe.exe
  C:\Windows\System\JmogSTe.exe
  2⤵
  PID:13852
- C:\Windows\System\NjfrlOZ.exe
  C:\Windows\System\NjfrlOZ.exe
  2⤵
  PID:13876
- C:\Windows\System\gzxaDMB.exe
  C:\Windows\System\gzxaDMB.exe
  2⤵
  PID:13916
- C:\Windows\System\fRAirAN.exe
  C:\Windows\System\fRAirAN.exe
  2⤵
  PID:13936
- C:\Windows\System\zftEDCW.exe
  C:\Windows\System\zftEDCW.exe
  2⤵
  PID:13956
- C:\Windows\System\EcHQBaL.exe
  C:\Windows\System\EcHQBaL.exe
  2⤵
  PID:13976
- C:\Windows\System\OXkRYVO.exe
  C:\Windows\System\OXkRYVO.exe
  2⤵
  PID:14008
- C:\Windows\System\oKRWQEb.exe
  C:\Windows\System\oKRWQEb.exe
  2⤵
  PID:14080
- C:\Windows\System\NxlzKaO.exe
  C:\Windows\System\NxlzKaO.exe
  2⤵
  PID:14108
- C:\Windows\System\GhkDlCL.exe
  C:\Windows\System\GhkDlCL.exe
  2⤵
  PID:14132
- C:\Windows\System\IfzneDu.exe
  C:\Windows\System\IfzneDu.exe
  2⤵
  PID:14148
- C:\Windows\System\sPHyvxe.exe
  C:\Windows\System\sPHyvxe.exe
  2⤵
  PID:14180
- C:\Windows\System\ptUpWlg.exe
  C:\Windows\System\ptUpWlg.exe
  2⤵
  PID:14208
- C:\Windows\System\aWOdFBO.exe
  C:\Windows\System\aWOdFBO.exe
  2⤵
  PID:14224
- C:\Windows\System\PAfTcvt.exe
  C:\Windows\System\PAfTcvt.exe
  2⤵
  PID:14240
- C:\Windows\System\YYIJAgU.exe
  C:\Windows\System\YYIJAgU.exe
  2⤵
  PID:14272
- C:\Windows\System\jiwCXYl.exe
  C:\Windows\System\jiwCXYl.exe
  2⤵
  PID:14288
- C:\Windows\System\JDvBfQz.exe
  C:\Windows\System\JDvBfQz.exe
  2⤵
  PID:13112
- C:\Windows\System\nvurBJO.exe
  C:\Windows\System\nvurBJO.exe
  2⤵
  PID:10688
- C:\Windows\System\UFEbLWs.exe
  C:\Windows\System\UFEbLWs.exe
  2⤵
  PID:13156
- C:\Windows\System\mnKmlAw.exe
  C:\Windows\System\mnKmlAw.exe
  2⤵
  PID:13848
- C:\Windows\System\fhSOHZb.exe
  C:\Windows\System\fhSOHZb.exe
  2⤵
  PID:13720
- C:\Windows\System\sngJeEV.exe
  C:\Windows\System\sngJeEV.exe
  2⤵
  PID:14076
- C:\Windows\System\UJozasY.exe
  C:\Windows\System\UJozasY.exe
  2⤵
  PID:13864
- C:\Windows\System\UROKlPG.exe
  C:\Windows\System\UROKlPG.exe
  2⤵
  PID:13928
- C:\Windows\System\ooKFVOB.exe
  C:\Windows\System\ooKFVOB.exe
  2⤵
  PID:14024
- C:\Windows\System\peEESVF.exe
  C:\Windows\System\peEESVF.exe
  2⤵
  PID:14040
- C:\Windows\System\qTKtHOu.exe
  C:\Windows\System\qTKtHOu.exe
  2⤵
  PID:1512
- C:\Windows\System\TPRDbxc.exe
  C:\Windows\System\TPRDbxc.exe
  2⤵
  PID:14100
- C:\Windows\System\MnfGccv.exe
  C:\Windows\System\MnfGccv.exe
  2⤵
  PID:14104
- C:\Windows\System\RWtHVoV.exe
  C:\Windows\System\RWtHVoV.exe
  2⤵
  PID:776
- C:\Windows\System\vYkcLrM.exe
  C:\Windows\System\vYkcLrM.exe
  2⤵
  PID:13948
- C:\Windows\System\sXQyykD.exe
  C:\Windows\System\sXQyykD.exe
  2⤵
  PID:2016
- C:\Windows\System\AlSXEAw.exe
  C:\Windows\System\AlSXEAw.exe
  2⤵
  PID:2524
- C:\Windows\System\XBWQPuC.exe
  C:\Windows\System\XBWQPuC.exe
  2⤵
  PID:3900
- C:\Windows\System\xkvbkHP.exe
  C:\Windows\System\xkvbkHP.exe
  2⤵
  PID:14312
- C:\Windows\System\cqZVzsu.exe
  C:\Windows\System\cqZVzsu.exe
  2⤵
  PID:6476
- C:\Windows\System\gNEkRxP.exe
  C:\Windows\System\gNEkRxP.exe
  2⤵
  PID:4908
- C:\Windows\System\ktzGGfj.exe
  C:\Windows\System\ktzGGfj.exe
  2⤵
  PID:12456
- C:\Windows\System\nYQtVPK.exe
  C:\Windows\System\nYQtVPK.exe
  2⤵
  PID:2448
- C:\Windows\System\DnaCSyI.exe
  C:\Windows\System\DnaCSyI.exe
  2⤵
  PID:13336
- C:\Windows\System\EMPeQYL.exe
  C:\Windows\System\EMPeQYL.exe
  2⤵
  PID:11296
- C:\Windows\System\YLEVCAZ.exe
  C:\Windows\System\YLEVCAZ.exe
  2⤵
  PID:12668
- C:\Windows\System\btmiAgQ.exe
  C:\Windows\System\btmiAgQ.exe
  2⤵
  PID:6872
- C:\Windows\System\oIzxNEr.exe
  C:\Windows\System\oIzxNEr.exe
  2⤵
  PID:14156
- C:\Windows\System\RHbnvAD.exe
  C:\Windows\System\RHbnvAD.exe
  2⤵
  PID:4508
- C:\Windows\System\CyTZuZM.exe
  C:\Windows\System\CyTZuZM.exe
  2⤵
  PID:12684
- C:\Windows\System\MrZbYlB.exe
  C:\Windows\System\MrZbYlB.exe
  2⤵
  PID:13556
- C:\Windows\System\VzPzAXm.exe
  C:\Windows\System\VzPzAXm.exe
  2⤵
  PID:4456
- C:\Windows\System\oIFNsTj.exe
  C:\Windows\System\oIFNsTj.exe
  2⤵
  PID:13616
- C:\Windows\System\MvrsPPk.exe
  C:\Windows\System\MvrsPPk.exe
  2⤵
  PID:2168
- C:\Windows\System\JrOqtSd.exe
  C:\Windows\System\JrOqtSd.exe
  2⤵
  PID:4944
- C:\Windows\System\UkCMqJh.exe
  C:\Windows\System\UkCMqJh.exe
  2⤵
  PID:13740
- C:\Windows\System\pMkeTnp.exe
  C:\Windows\System\pMkeTnp.exe
  2⤵
  PID:4664
- C:\Windows\System\axQgvrZ.exe
  C:\Windows\System\axQgvrZ.exe
  2⤵
  PID:14188
- C:\Windows\System\myptphz.exe
  C:\Windows\System\myptphz.exe
  2⤵
  PID:4160
- C:\Windows\System\TECBVMP.exe
  C:\Windows\System\TECBVMP.exe
  2⤵
  PID:6224
- C:\Windows\System\qFcAylH.exe
  C:\Windows\System\qFcAylH.exe
  2⤵
  PID:14204
- C:\Windows\System\NFZoXNP.exe
  C:\Windows\System\NFZoXNP.exe
  2⤵
  PID:13828
- C:\Windows\System\qkaGIhv.exe
  C:\Windows\System\qkaGIhv.exe
  2⤵
  PID:5268
- C:\Windows\System\KeHOwvW.exe
  C:\Windows\System\KeHOwvW.exe
  2⤵
  PID:14308
- C:\Windows\System\GkdBcbY.exe
  C:\Windows\System\GkdBcbY.exe
  2⤵
  PID:2280
- C:\Windows\System\TlvQiyZ.exe
  C:\Windows\System\TlvQiyZ.exe
  2⤵
  PID:6716
- C:\Windows\System\aFKdzul.exe
  C:\Windows\System\aFKdzul.exe
  2⤵
  PID:13596
- C:\Windows\System\RoKtwFa.exe
  C:\Windows\System\RoKtwFa.exe
  2⤵
  PID:1692
- C:\Windows\System\QGxLUtB.exe
  C:\Windows\System\QGxLUtB.exe
  2⤵
  PID:13988
- C:\Windows\System\tvjgqzQ.exe
  C:\Windows\System\tvjgqzQ.exe
  2⤵
  PID:4628
- C:\Windows\System\nvSQogj.exe
  C:\Windows\System\nvSQogj.exe
  2⤵
  PID:7344
- C:\Windows\System\qyKySfc.exe
  C:\Windows\System\qyKySfc.exe
  2⤵
  PID:2804
- C:\Windows\System\JGjEEpY.exe
  C:\Windows\System\JGjEEpY.exe
  2⤵
  PID:1812
- C:\Windows\System\jRwyKUl.exe
  C:\Windows\System\jRwyKUl.exe
  2⤵
  PID:7632
- C:\Windows\System\DlTfILM.exe
  C:\Windows\System\DlTfILM.exe
  2⤵
  PID:13824
- C:\Windows\System\dapVUsP.exe
  C:\Windows\System\dapVUsP.exe
  2⤵
  PID:14140
- C:\Windows\System\SXuCQRK.exe
  C:\Windows\System\SXuCQRK.exe
  2⤵
  PID:13744
- C:\Windows\System\NlTRUou.exe
  C:\Windows\System\NlTRUou.exe
  2⤵
  PID:14096
- C:\Windows\System\HzmCtPb.exe
  C:\Windows\System\HzmCtPb.exe
  2⤵
  PID:8176
- C:\Windows\System\VURJsSw.exe
  C:\Windows\System\VURJsSw.exe
  2⤵
  PID:13776
- C:\Windows\System\ObPpkBR.exe
  C:\Windows\System\ObPpkBR.exe
  2⤵
  PID:14092
- C:\Windows\System\ywKMLiw.exe
  C:\Windows\System\ywKMLiw.exe
  2⤵
  PID:6616
- C:\Windows\System\ziyNSIv.exe
  C:\Windows\System\ziyNSIv.exe
  2⤵
  PID:4704
- C:\Windows\System\WggbVjb.exe
  C:\Windows\System\WggbVjb.exe
  2⤵
  PID:11528
- C:\Windows\System\KgtZSNH.exe
  C:\Windows\System\KgtZSNH.exe
  2⤵
  PID:8064
- C:\Windows\System\Lreyjdv.exe
  C:\Windows\System\Lreyjdv.exe
  2⤵
  PID:12888
- C:\Windows\System\IbBsTBI.exe
  C:\Windows\System\IbBsTBI.exe
  2⤵
  PID:5776
- C:\Windows\System\voRCfZB.exe
  C:\Windows\System\voRCfZB.exe
  2⤵
  PID:6852
- C:\Windows\System\qbDTdoR.exe
  C:\Windows\System\qbDTdoR.exe
  2⤵
  PID:3584
- C:\Windows\System\kQzNXpu.exe
  C:\Windows\System\kQzNXpu.exe
  2⤵
  PID:9616
- C:\Windows\System\qbfdsKC.exe
  C:\Windows\System\qbfdsKC.exe
  2⤵
  PID:4928
- C:\Windows\System\zLkzDpv.exe
  C:\Windows\System\zLkzDpv.exe
  2⤵
  PID:5840
- C:\Windows\System\iEEouQy.exe
  C:\Windows\System\iEEouQy.exe
  2⤵
  PID:5228
- C:\Windows\System\oJTQIfA.exe
  C:\Windows\System\oJTQIfA.exe
  2⤵
  PID:13964
- C:\Windows\System\LoNDhte.exe
  C:\Windows\System\LoNDhte.exe
  2⤵
  PID:5780
- C:\Windows\System\CmYFUrJ.exe
  C:\Windows\System\CmYFUrJ.exe
  2⤵
  PID:13300
- C:\Windows\System\oJxhXNe.exe
  C:\Windows\System\oJxhXNe.exe
  2⤵
  PID:5492
- C:\Windows\System\kEimHrC.exe
  C:\Windows\System\kEimHrC.exe
  2⤵
  PID:3772
- C:\Windows\System\FJmEsEd.exe
  C:\Windows\System\FJmEsEd.exe
  2⤵
  PID:13992
- C:\Windows\System\PCkPVqL.exe
  C:\Windows\System\PCkPVqL.exe
  2⤵
  PID:2104
- C:\Windows\System\mnTnCKx.exe
  C:\Windows\System\mnTnCKx.exe
  2⤵
  PID:5160
- C:\Windows\System\PAQWLPI.exe
  C:\Windows\System\PAQWLPI.exe
  2⤵
  PID:4644
- C:\Windows\System\ARMswJE.exe
  C:\Windows\System\ARMswJE.exe
  2⤵
  PID:5308
- C:\Windows\System\tncpVUx.exe
  C:\Windows\System\tncpVUx.exe
  2⤵
  PID:6768
- C:\Windows\System\IpVtUZL.exe
  C:\Windows\System\IpVtUZL.exe
  2⤵
  PID:14284
- C:\Windows\System\TwlRGMu.exe
  C:\Windows\System\TwlRGMu.exe
  2⤵
  PID:4784
- C:\Windows\System\GFydPTx.exe
  C:\Windows\System\GFydPTx.exe
  2⤵
  PID:4384
- C:\Windows\System\rWcjQKB.exe
  C:\Windows\System\rWcjQKB.exe
  2⤵
  PID:9704
- C:\Windows\System\ZyWthmm.exe
  C:\Windows\System\ZyWthmm.exe
  2⤵
  PID:9812
- C:\Windows\System\MaGdXfG.exe
  C:\Windows\System\MaGdXfG.exe
  2⤵
  PID:5452
- C:\Windows\System\VirOXBX.exe
  C:\Windows\System\VirOXBX.exe
  2⤵
  PID:13932
- C:\Windows\System\xFIlZXA.exe
  C:\Windows\System\xFIlZXA.exe
  2⤵
  PID:1904
- C:\Windows\System\JobtBuC.exe
  C:\Windows\System\JobtBuC.exe
  2⤵
  PID:6312
- C:\Windows\System\XvhYJvB.exe
  C:\Windows\System\XvhYJvB.exe
  2⤵
  PID:7076
- C:\Windows\System\DJQvTot.exe
  C:\Windows\System\DJQvTot.exe
  2⤵
  PID:14252
- C:\Windows\System\IwyebTA.exe
  C:\Windows\System\IwyebTA.exe
  2⤵
  PID:5764
- C:\Windows\System\fSSvAeu.exe
  C:\Windows\System\fSSvAeu.exe
  2⤵
  PID:5528
- C:\Windows\System\Neqoqwv.exe
  C:\Windows\System\Neqoqwv.exe
  2⤵
  PID:6084
- C:\Windows\System\AsABYMM.exe
  C:\Windows\System\AsABYMM.exe
  2⤵
  PID:7228
- C:\Windows\System\FEjXanj.exe
  C:\Windows\System\FEjXanj.exe
  2⤵
  PID:14116
- C:\Windows\System\QxecmNm.exe
  C:\Windows\System\QxecmNm.exe
  2⤵
  PID:6040
- C:\Windows\System\TuwISnz.exe
  C:\Windows\System\TuwISnz.exe
  2⤵
  PID:14060
- C:\Windows\System\gBEycBm.exe
  C:\Windows\System\gBEycBm.exe
  2⤵
  PID:6892
- C:\Windows\System\NTuBLNG.exe
  C:\Windows\System\NTuBLNG.exe
  2⤵
  PID:116
- C:\Windows\System\vKgLTIF.exe
  C:\Windows\System\vKgLTIF.exe
  2⤵
  PID:13348
- C:\Windows\System\LcMMKZQ.exe
  C:\Windows\System\LcMMKZQ.exe
  2⤵
  PID:5212
- C:\Windows\System\RjMwSCZ.exe
  C:\Windows\System\RjMwSCZ.exe
  2⤵
  PID:5680
- C:\Windows\System\otBvzmo.exe
  C:\Windows\System\otBvzmo.exe
  2⤵
  PID:7112
- C:\Windows\System\SvtzSIC.exe
  C:\Windows\System\SvtzSIC.exe
  2⤵
  PID:6884
- C:\Windows\System\vqtnPmi.exe
  C:\Windows\System\vqtnPmi.exe
  2⤵
  PID:4700
- C:\Windows\System\DYpKwUK.exe
  C:\Windows\System\DYpKwUK.exe
  2⤵
  PID:6452
- C:\Windows\System\YDEVSVW.exe
  C:\Windows\System\YDEVSVW.exe
  2⤵
  PID:6876
- C:\Windows\System\uIKJuNx.exe
  C:\Windows\System\uIKJuNx.exe
  2⤵
  PID:6368
- C:\Windows\System\zknUVnq.exe
  C:\Windows\System\zknUVnq.exe
  2⤵
  PID:6188
- C:\Windows\System\tNTNNkk.exe
  C:\Windows\System\tNTNNkk.exe
  2⤵
  PID:7992
- C:\Windows\System\UIWCyjc.exe
  C:\Windows\System\UIWCyjc.exe
  2⤵
  PID:6840
- C:\Windows\System\plnimkT.exe
  C:\Windows\System\plnimkT.exe
  2⤵
  PID:5712
- C:\Windows\System\BTWowzY.exe
  C:\Windows\System\BTWowzY.exe
  2⤵
  PID:5692
- C:\Windows\System\xaUmNzx.exe
  C:\Windows\System\xaUmNzx.exe
  2⤵
  PID:6672
- C:\Windows\System\GMsBhNs.exe
  C:\Windows\System\GMsBhNs.exe
  2⤵
  PID:6120
- C:\Windows\System\PuglXqf.exe
  C:\Windows\System\PuglXqf.exe
  2⤵
  PID:7116
- C:\Windows\System\fZPfQPF.exe
  C:\Windows\System\fZPfQPF.exe
  2⤵
  PID:6408
- C:\Windows\System\hVkYZVv.exe
  C:\Windows\System\hVkYZVv.exe
  2⤵
  PID:6200
- C:\Windows\System\IgcXDso.exe
  C:\Windows\System\IgcXDso.exe
  2⤵
  PID:1544
- C:\Windows\System\uGXnrQx.exe
  C:\Windows\System\uGXnrQx.exe
  2⤵
  PID:5244
- C:\Windows\System\FPDreuP.exe
  C:\Windows\System\FPDreuP.exe
  2⤵
  PID:3172
- C:\Windows\System\FFjzYVK.exe
  C:\Windows\System\FFjzYVK.exe
  2⤵
  PID:12584
- C:\Windows\System\keTMEOn.exe
  C:\Windows\System\keTMEOn.exe
  2⤵
  PID:6208
- C:\Windows\System\PtuSeNb.exe
  C:\Windows\System\PtuSeNb.exe
  2⤵
  PID:5420
- C:\Windows\System\oxfkbNm.exe
  C:\Windows\System\oxfkbNm.exe
  2⤵
  PID:624
- C:\Windows\System\DSECuPC.exe
  C:\Windows\System\DSECuPC.exe
  2⤵
  PID:5948
- C:\Windows\System\Nciyvwj.exe
  C:\Windows\System\Nciyvwj.exe
  2⤵
  PID:7388
- C:\Windows\System\UEJgrKs.exe
  C:\Windows\System\UEJgrKs.exe
  2⤵
  PID:5964
- C:\Windows\System\emGjJlw.exe
  C:\Windows\System\emGjJlw.exe
  2⤵
  PID:404
- C:\Windows\System\JVpbnLG.exe
  C:\Windows\System\JVpbnLG.exe
  2⤵
  PID:5384
- C:\Windows\System\RIFuvJw.exe
  C:\Windows\System\RIFuvJw.exe
  2⤵
  PID:4072
- C:\Windows\System\OevptCw.exe
  C:\Windows\System\OevptCw.exe
  2⤵
  PID:13656
- C:\Windows\System\zjQHncb.exe
  C:\Windows\System\zjQHncb.exe
  2⤵
  PID:5656
- C:\Windows\System\PbOuehw.exe
  C:\Windows\System\PbOuehw.exe
  2⤵
  PID:7700
- C:\Windows\System\rdlypxN.exe
  C:\Windows\System\rdlypxN.exe
  2⤵
  PID:7852
- C:\Windows\System\WuqDnqD.exe
  C:\Windows\System\WuqDnqD.exe
  2⤵
  PID:13904
- C:\Windows\System\yAbyLoe.exe
  C:\Windows\System\yAbyLoe.exe
  2⤵
  PID:13640
- C:\Windows\System\mrJSUzd.exe
  C:\Windows\System\mrJSUzd.exe
  2⤵
  PID:7932
- C:\Windows\System\eGwRMgi.exe
  C:\Windows\System\eGwRMgi.exe
  2⤵
  PID:6168
- C:\Windows\System\iLUriFp.exe
  C:\Windows\System\iLUriFp.exe
  2⤵
  PID:14300
- C:\Windows\System\ASCbWaJ.exe
  C:\Windows\System\ASCbWaJ.exe
  2⤵
  PID:9852
- C:\Windows\System\nXlMSYR.exe
  C:\Windows\System\nXlMSYR.exe
  2⤵
  PID:3848
- C:\Windows\System\JPYSXJx.exe
  C:\Windows\System\JPYSXJx.exe
  2⤵
  PID:5516
- C:\Windows\System\MnGaGKH.exe
  C:\Windows\System\MnGaGKH.exe
  2⤵
  PID:6580
- C:\Windows\System\ghjEFRI.exe
  C:\Windows\System\ghjEFRI.exe
  2⤵
  PID:7212
- C:\Windows\System\NRBfOvi.exe
  C:\Windows\System\NRBfOvi.exe
  2⤵
  PID:14068
- C:\Windows\System\CGHURgs.exe
  C:\Windows\System\CGHURgs.exe
  2⤵
  PID:6396
- C:\Windows\System\GgbcYJr.exe
  C:\Windows\System\GgbcYJr.exe
  2⤵
  PID:14352
- C:\Windows\System\NmtVDtE.exe
  C:\Windows\System\NmtVDtE.exe
  2⤵
  PID:14372
- C:\Windows\System\rCdaMIJ.exe
  C:\Windows\System\rCdaMIJ.exe
  2⤵
  PID:14392
- C:\Windows\System\HkgdQqk.exe
  C:\Windows\System\HkgdQqk.exe
  2⤵
  PID:14420
- C:\Windows\System\lpobmon.exe
  C:\Windows\System\lpobmon.exe
  2⤵
  PID:14436
- C:\Windows\System\ivDHHNR.exe
  C:\Windows\System\ivDHHNR.exe
  2⤵
  PID:14456
- C:\Windows\System\hBNBojd.exe
  C:\Windows\System\hBNBojd.exe
  2⤵
  PID:14476
- C:\Windows\System\QJlRSET.exe
  C:\Windows\System\QJlRSET.exe
  2⤵
  PID:14492
- C:\Windows\System\tStcfOG.exe
  C:\Windows\System\tStcfOG.exe
  2⤵
  PID:14508
- C:\Windows\System\OHqpiOe.exe
  C:\Windows\System\OHqpiOe.exe
  2⤵
  PID:14528
- C:\Windows\System\AlRcKnA.exe
  C:\Windows\System\AlRcKnA.exe
  2⤵
  PID:14548
- C:\Windows\System\FNXTPmk.exe
  C:\Windows\System\FNXTPmk.exe
  2⤵
  PID:14572
- C:\Windows\System\uEgrcEF.exe
  C:\Windows\System\uEgrcEF.exe
  2⤵
  PID:14588
- C:\Windows\System\KXvsiAZ.exe
  C:\Windows\System\KXvsiAZ.exe
  2⤵
  PID:14608
- C:\Windows\System\hJrGfyd.exe
  C:\Windows\System\hJrGfyd.exe
  2⤵
  PID:14624
- C:\Windows\System\ImDhReh.exe
  C:\Windows\System\ImDhReh.exe
  2⤵
  PID:14644
- C:\Windows\System\wWosBKL.exe
  C:\Windows\System\wWosBKL.exe
  2⤵
  PID:14668
- C:\Windows\System\cDuYVjL.exe
  C:\Windows\System\cDuYVjL.exe
  2⤵
  PID:14692
- C:\Windows\System\OyPKgdP.exe
  C:\Windows\System\OyPKgdP.exe
  2⤵
  PID:14712
- C:\Windows\System\txORIVp.exe
  C:\Windows\System\txORIVp.exe
  2⤵
  PID:14732
- C:\Windows\System\nEyfPrF.exe
  C:\Windows\System\nEyfPrF.exe
  2⤵
  PID:14748
- C:\Windows\System\yfMkHoe.exe
  C:\Windows\System\yfMkHoe.exe
  2⤵
  PID:14764
- C:\Windows\System\LVrGmMB.exe
  C:\Windows\System\LVrGmMB.exe
  2⤵
  PID:14780
- C:\Windows\System\RFrSuvJ.exe
  C:\Windows\System\RFrSuvJ.exe
  2⤵
  PID:14800
- C:\Windows\System\gBfZAWF.exe
  C:\Windows\System\gBfZAWF.exe
  2⤵
  PID:14816
- C:\Windows\System\WdeFdWH.exe
  C:\Windows\System\WdeFdWH.exe
  2⤵
  PID:14844
- C:\Windows\System\tneqyrA.exe
  C:\Windows\System\tneqyrA.exe
  2⤵
  PID:14860
- C:\Windows\System\jpTvUTZ.exe
  C:\Windows\System\jpTvUTZ.exe
  2⤵
  PID:14876
- C:\Windows\System\TTvFzCz.exe
  C:\Windows\System\TTvFzCz.exe
  2⤵
  PID:15096
- C:\Windows\System\JNTnvaf.exe
  C:\Windows\System\JNTnvaf.exe
  2⤵
  PID:15112
- C:\Windows\System\BsZhmWc.exe
  C:\Windows\System\BsZhmWc.exe
  2⤵
  PID:15132
- C:\Windows\System\GjlyLOt.exe
  C:\Windows\System\GjlyLOt.exe
  2⤵
  PID:15152
- C:\Windows\System\UVNTTkR.exe
  C:\Windows\System\UVNTTkR.exe
  2⤵
  PID:15180
- C:\Windows\System\qeheXCP.exe
  C:\Windows\System\qeheXCP.exe
  2⤵
  PID:15212
- C:\Windows\System\mJOFuiT.exe
  C:\Windows\System\mJOFuiT.exe
  2⤵
  PID:15236
- C:\Windows\System\SiuOAXH.exe
  C:\Windows\System\SiuOAXH.exe
  2⤵
  PID:15260
- C:\Windows\System\uZVKiGo.exe
  C:\Windows\System\uZVKiGo.exe
  2⤵
  PID:15284
- C:\Windows\System\SiTrecq.exe
  C:\Windows\System\SiTrecq.exe
  2⤵
  PID:8188
- C:\Windows\System\BSvUEJa.exe
  C:\Windows\System\BSvUEJa.exe
  2⤵
  PID:7984
- C:\Windows\System\avEuusr.exe
  C:\Windows\System\avEuusr.exe
  2⤵
  PID:7940
- C:\Windows\System\TVvVohG.exe
  C:\Windows\System\TVvVohG.exe
  2⤵
  PID:7952
- C:\Windows\System\iBTlICz.exe
  C:\Windows\System\iBTlICz.exe
  2⤵
  PID:8124
- C:\Windows\System\BLTvfCg.exe
  C:\Windows\System\BLTvfCg.exe
  2⤵
  PID:8000
- C:\Windows\System\JTWRtOS.exe
  C:\Windows\System\JTWRtOS.exe
  2⤵
  PID:8140
- C:\Windows\System\RvOmNaA.exe
  C:\Windows\System\RvOmNaA.exe
  2⤵
  PID:2072
- C:\Windows\System\hAJXqUq.exe
  C:\Windows\System\hAJXqUq.exe
  2⤵
  PID:13400
- C:\Windows\System\LDFssik.exe
  C:\Windows\System\LDFssik.exe
  2⤵
  PID:8164
- C:\Windows\System\FBjifFx.exe
  C:\Windows\System\FBjifFx.exe
  2⤵
  PID:13412
- C:\Windows\System\jfHmEaj.exe
  C:\Windows\System\jfHmEaj.exe
  2⤵
  PID:13812
- C:\Windows\System\KTlWany.exe
  C:\Windows\System\KTlWany.exe
  2⤵
  PID:7976
- C:\Windows\System\cDdENOb.exe
  C:\Windows\System\cDdENOb.exe
  2⤵
  PID:7920
- C:\Windows\System\tkEqdeE.exe
  C:\Windows\System\tkEqdeE.exe
  2⤵
  PID:7088
- C:\Windows\System\QdMfVsM.exe
  C:\Windows\System\QdMfVsM.exe
  2⤵
  PID:6788
- C:\Windows\System\fPkUxLh.exe
  C:\Windows\System\fPkUxLh.exe
  2⤵
  PID:6244
- C:\Windows\System\sOSShgg.exe
  C:\Windows\System\sOSShgg.exe
  2⤵
  PID:6132
- C:\Windows\System\GgOlobh.exe
  C:\Windows\System\GgOlobh.exe
  2⤵
  PID:14524
- C:\Windows\System\BXTMCnx.exe
  C:\Windows\System\BXTMCnx.exe
  2⤵
  PID:5876
- C:\Windows\System\rWrpUnI.exe
  C:\Windows\System\rWrpUnI.exe
  2⤵
  PID:4796
- C:\Windows\System\YYCSNNY.exe
  C:\Windows\System\YYCSNNY.exe
  2⤵
  PID:14992
- C:\Windows\System\vmhXGPk.exe
  C:\Windows\System\vmhXGPk.exe
  2⤵
  PID:14304
- C:\Windows\System\hBqQKaQ.exe
  C:\Windows\System\hBqQKaQ.exe
  2⤵
  PID:14824
- C:\Windows\System\sxQfmOE.exe
  C:\Windows\System\sxQfmOE.exe
  2⤵
  PID:6880
- C:\Windows\System\tivYBFo.exe
  C:\Windows\System\tivYBFo.exe
  2⤵
  PID:15088
- C:\Windows\System\XrdNQon.exe
  C:\Windows\System\XrdNQon.exe
  2⤵
  PID:8536
- C:\Windows\System\fpQiFWm.exe
  C:\Windows\System\fpQiFWm.exe
  2⤵
  PID:8232
- C:\Windows\System\rHPiieS.exe
  C:\Windows\System\rHPiieS.exe
  2⤵
  PID:9656
- C:\Windows\System\Qsjjqfy.exe
  C:\Windows\System\Qsjjqfy.exe
  2⤵
  PID:216
- C:\Windows\System\nebFzef.exe
  C:\Windows\System\nebFzef.exe
  2⤵
  PID:15308
- C:\Windows\System\SKrDOFA.exe
  C:\Windows\System\SKrDOFA.exe
  2⤵
  PID:9404
- C:\Windows\System\hdsxKnH.exe
  C:\Windows\System\hdsxKnH.exe
  2⤵
  PID:8004
- C:\Windows\System\nrMVQwR.exe
  C:\Windows\System\nrMVQwR.exe
  2⤵
  PID:7016
- C:\Windows\System\wGtOpXW.exe
  C:\Windows\System\wGtOpXW.exe
  2⤵
  PID:9768
- C:\Windows\System\ONYxzOI.exe
  C:\Windows\System\ONYxzOI.exe
  2⤵
  PID:7424
- C:\Windows\System\dSvOxaV.exe
  C:\Windows\System\dSvOxaV.exe
  2⤵
  PID:11384
- C:\Windows\System\IkiDFyp.exe
  C:\Windows\System\IkiDFyp.exe
  2⤵
  PID:12252
- C:\Windows\System\kKuyNmU.exe
  C:\Windows\System\kKuyNmU.exe
  2⤵
  PID:15140
- C:\Windows\System\NfsnRtU.exe
  C:\Windows\System\NfsnRtU.exe
  2⤵
  PID:15204
- C:\Windows\System\cmZEUCE.exe
  C:\Windows\System\cmZEUCE.exe
  2⤵
  PID:7144
- C:\Windows\System\iesAZct.exe
  C:\Windows\System\iesAZct.exe
  2⤵
  PID:14020
- C:\Windows\System\sZjuitI.exe
  C:\Windows\System\sZjuitI.exe
  2⤵
  PID:9328
- C:\Windows\System\JoMyRoI.exe
  C:\Windows\System\JoMyRoI.exe
  2⤵
  PID:9680
- C:\Windows\System\iHvenMS.exe
  C:\Windows\System\iHvenMS.exe
  2⤵
  PID:4632
- C:\Windows\System\mUJrPtP.exe
  C:\Windows\System\mUJrPtP.exe
  2⤵
  PID:15328
- C:\Windows\System\dzkAais.exe
  C:\Windows\System\dzkAais.exe
  2⤵
  PID:9688
- C:\Windows\System\OiVIfZc.exe
  C:\Windows\System\OiVIfZc.exe
  2⤵
  PID:9392
- C:\Windows\System\NSAzskg.exe
  C:\Windows\System\NSAzskg.exe
  2⤵
  PID:3620
- C:\Windows\System\AYStDTE.exe
  C:\Windows\System\AYStDTE.exe
  2⤵
  PID:9780
- C:\Windows\System\szBNhEH.exe
  C:\Windows\System\szBNhEH.exe
  2⤵
  PID:9796
- C:\Windows\System\cAskuso.exe
  C:\Windows\System\cAskuso.exe
  2⤵
  PID:14520
- C:\Windows\System\KIXIgfp.exe
  C:\Windows\System\KIXIgfp.exe
  2⤵
  PID:7052
- C:\Windows\System\UnZGPEa.exe
  C:\Windows\System\UnZGPEa.exe
  2⤵
  PID:14888
- C:\Windows\System\tZrbUbl.exe
  C:\Windows\System\tZrbUbl.exe
  2⤵
  PID:9844
- C:\Windows\System\LSqfzkc.exe
  C:\Windows\System\LSqfzkc.exe
  2⤵
  PID:9584
- C:\Windows\System\EDQWIeo.exe
  C:\Windows\System\EDQWIeo.exe
  2⤵
  PID:6600
- C:\Windows\System\qvYmSDI.exe
  C:\Windows\System\qvYmSDI.exe
  2⤵
  PID:9668
- C:\Windows\System\beTdIeO.exe
  C:\Windows\System\beTdIeO.exe
  2⤵
  PID:9744
- C:\Windows\System\XrOtkmR.exe
  C:\Windows\System\XrOtkmR.exe
  2⤵
  PID:9452
- C:\Windows\System\CPaaSsB.exe
  C:\Windows\System\CPaaSsB.exe
  2⤵
  PID:9636
- C:\Windows\System\zxERtgh.exe
  C:\Windows\System\zxERtgh.exe
  2⤵
  PID:14428
- C:\Windows\System\cbXcSSk.exe
  C:\Windows\System\cbXcSSk.exe
  2⤵
  PID:7724
- C:\Windows\System\kYqysOH.exe
  C:\Windows\System\kYqysOH.exe
  2⤵
  PID:9564
- C:\Windows\System\rMLvHTf.exe
  C:\Windows\System\rMLvHTf.exe
  2⤵
  PID:9244
- C:\Windows\System\fstXQrS.exe
  C:\Windows\System\fstXQrS.exe
  2⤵
  PID:6912
- C:\Windows\System\ZoQlIoC.exe
  C:\Windows\System\ZoQlIoC.exe
  2⤵
  PID:15044
- C:\Windows\System\hbHEvVI.exe
  C:\Windows\System\hbHEvVI.exe
  2⤵
  PID:9620
- C:\Windows\System\FJSMpqI.exe
  C:\Windows\System\FJSMpqI.exe
  2⤵
  PID:8244
- C:\Windows\System\RNagtiV.exe
  C:\Windows\System\RNagtiV.exe
  2⤵
  PID:10800
- C:\Windows\System\YdFJDAr.exe
  C:\Windows\System\YdFJDAr.exe
  2⤵
  PID:6968
- C:\Windows\System\bQqueRH.exe
  C:\Windows\System\bQqueRH.exe
  2⤵
  PID:12040
- C:\Windows\System\jBTjgwL.exe
  C:\Windows\System\jBTjgwL.exe
  2⤵
  PID:12724
- C:\Windows\System\BebiEoN.exe
  C:\Windows\System\BebiEoN.exe
  2⤵
  PID:12384
- C:\Windows\System\RqHgKbW.exe
  C:\Windows\System\RqHgKbW.exe
  2⤵
  PID:8972
- C:\Windows\System\QzTPIvR.exe
  C:\Windows\System\QzTPIvR.exe
  2⤵
  PID:14464
- C:\Windows\System\vQIvrtB.exe
  C:\Windows\System\vQIvrtB.exe
  2⤵
  PID:9696
- C:\Windows\System\XSwtVgI.exe
  C:\Windows\System\XSwtVgI.exe
  2⤵
  PID:8992
- C:\Windows\System\vaMWhmC.exe
  C:\Windows\System\vaMWhmC.exe
  2⤵
  PID:8160
- C:\Windows\System\oJYNLhp.exe
  C:\Windows\System\oJYNLhp.exe
  2⤵
  PID:9996
- C:\Windows\System\LiWSFXK.exe
  C:\Windows\System\LiWSFXK.exe
  2⤵
  PID:9552
- C:\Windows\System\HVtTSsM.exe
  C:\Windows\System\HVtTSsM.exe
  2⤵
  PID:15344
- C:\Windows\System\jvCjehv.exe
  C:\Windows\System\jvCjehv.exe
  2⤵
  PID:14788
- C:\Windows\System\vamBElv.exe
  C:\Windows\System\vamBElv.exe
  2⤵
  PID:7576
- C:\Windows\System\knttEMI.exe
  C:\Windows\System\knttEMI.exe
  2⤵
  PID:9608
- C:\Windows\System\FAbxhNt.exe
  C:\Windows\System\FAbxhNt.exe
  2⤵
  PID:8432
- C:\Windows\System\JjCjOuQ.exe
  C:\Windows\System\JjCjOuQ.exe
  2⤵
  PID:6412
- C:\Windows\System\fMMEuYc.exe
  C:\Windows\System\fMMEuYc.exe
  2⤵
  PID:12500
- C:\Windows\System\CDNFnoO.exe
  C:\Windows\System\CDNFnoO.exe
  2⤵
  PID:8368
- C:\Windows\System\zzDWmFR.exe
  C:\Windows\System\zzDWmFR.exe
  2⤵
  PID:1652
- C:\Windows\System\UJFFaPC.exe
  C:\Windows\System\UJFFaPC.exe
  2⤵
  PID:11576
- C:\Windows\System\KUhcWSL.exe
  C:\Windows\System\KUhcWSL.exe
  2⤵
  PID:5052
- C:\Windows\System\exzacqs.exe
  C:\Windows\System\exzacqs.exe
  2⤵
  PID:9432
- C:\Windows\System\YgMrdrp.exe
  C:\Windows\System\YgMrdrp.exe
  2⤵
  PID:8132
- C:\Windows\System\aajxAqr.exe
  C:\Windows\System\aajxAqr.exe
  2⤵
  PID:9356
- C:\Windows\System\ZUZUqJt.exe
  C:\Windows\System\ZUZUqJt.exe
  2⤵
  PID:10540
- C:\Windows\System\HOeiqqS.exe
  C:\Windows\System\HOeiqqS.exe
  2⤵
  PID:9528
- C:\Windows\System\HpNWQQV.exe
  C:\Windows\System\HpNWQQV.exe
  2⤵
  PID:14868
- C:\Windows\System\ZAIYqgC.exe
  C:\Windows\System\ZAIYqgC.exe
  2⤵
  PID:7956
- C:\Windows\System\KTaKFvV.exe
  C:\Windows\System\KTaKFvV.exe
  2⤵
  PID:9888
- C:\Windows\System\ZFvmElF.exe
  C:\Windows\System\ZFvmElF.exe
  2⤵
  PID:9908
- C:\Windows\System\qmbVmSg.exe
  C:\Windows\System\qmbVmSg.exe
  2⤵
  PID:6808
- C:\Windows\System\HBOdwXK.exe
  C:\Windows\System\HBOdwXK.exe
  2⤵
  PID:14488
- C:\Windows\System\KEXyGRs.exe
  C:\Windows\System\KEXyGRs.exe
  2⤵
  PID:10352
- C:\Windows\System\mIzzGUS.exe
  C:\Windows\System\mIzzGUS.exe
  2⤵
  PID:15364
- C:\Windows\System\tMvDzGs.exe
  C:\Windows\System\tMvDzGs.exe
  2⤵
  PID:15388
- C:\Windows\System\JgkwejD.exe
  C:\Windows\System\JgkwejD.exe
  2⤵
  PID:15408
- C:\Windows\System\COoyqfr.exe
  C:\Windows\System\COoyqfr.exe
  2⤵
  PID:15424
- C:\Windows\System\NkRSkXS.exe
  C:\Windows\System\NkRSkXS.exe
  2⤵
  PID:15444
- C:\Windows\System\dUkUwlC.exe
  C:\Windows\System\dUkUwlC.exe
  2⤵
  PID:15464
- C:\Windows\System\MsRVNfx.exe
  C:\Windows\System\MsRVNfx.exe
  2⤵
  PID:15488
- C:\Windows\System\mkVfORb.exe
  C:\Windows\System\mkVfORb.exe
  2⤵
  PID:15504
- C:\Windows\System\uPLPSMt.exe
  C:\Windows\System\uPLPSMt.exe
  2⤵
  PID:15536
- C:\Windows\System\WDwELYn.exe
  C:\Windows\System\WDwELYn.exe
  2⤵
  PID:15556
- C:\Windows\System\gCUafrp.exe
  C:\Windows\System\gCUafrp.exe
  2⤵
  PID:15576
- C:\Windows\System\YzdayKp.exe
  C:\Windows\System\YzdayKp.exe
  2⤵
  PID:15596
- C:\Windows\System\bnbBSHK.exe
  C:\Windows\System\bnbBSHK.exe
  2⤵
  PID:15616
- C:\Windows\System\TGYWSFa.exe
  C:\Windows\System\TGYWSFa.exe
  2⤵
  PID:15636
- C:\Windows\System\zIwjwQS.exe
  C:\Windows\System\zIwjwQS.exe
  2⤵
  PID:15660
- C:\Windows\System\zljRvjo.exe
  C:\Windows\System\zljRvjo.exe
  2⤵
  PID:15680
- C:\Windows\System\yKmYGKz.exe
  C:\Windows\System\yKmYGKz.exe
  2⤵
  PID:15704
- C:\Windows\System\cmVllzb.exe
  C:\Windows\System\cmVllzb.exe
  2⤵
  PID:15728
- C:\Windows\System\tOgVEkD.exe
  C:\Windows\System\tOgVEkD.exe
  2⤵
  PID:15744
- C:\Windows\System\ekHPCJw.exe
  C:\Windows\System\ekHPCJw.exe
  2⤵
  PID:15760
- C:\Windows\System\IRZVkJP.exe
  C:\Windows\System\IRZVkJP.exe
  2⤵
  PID:15780
- C:\Windows\System\LyppZWN.exe
  C:\Windows\System\LyppZWN.exe
  2⤵
  PID:15804
- C:\Windows\System\JDlaSXM.exe
  C:\Windows\System\JDlaSXM.exe
  2⤵
  PID:15832
- C:\Windows\System\TZgMdBi.exe
  C:\Windows\System\TZgMdBi.exe
  2⤵
  PID:16156
- C:\Windows\System\WsaSRGt.exe
  C:\Windows\System\WsaSRGt.exe
  2⤵
  PID:16188
- C:\Windows\System\luxHLIq.exe
  C:\Windows\System\luxHLIq.exe
  2⤵
  PID:16208
- C:\Windows\System\hjGqSnN.exe
  C:\Windows\System\hjGqSnN.exe
  2⤵
  PID:16228
- C:\Windows\System\jUsrjzP.exe
  C:\Windows\System\jUsrjzP.exe
  2⤵
  PID:16256
- C:\Windows\System\dbLgxoq.exe
  C:\Windows\System\dbLgxoq.exe
  2⤵
  PID:16276
- C:\Windows\System\lrVwouY.exe
  C:\Windows\System\lrVwouY.exe
  2⤵
  PID:16296
- C:\Windows\System\mlBYLbm.exe
  C:\Windows\System\mlBYLbm.exe
  2⤵
  PID:16312
- C:\Windows\System\CEDriCz.exe
  C:\Windows\System\CEDriCz.exe
  2⤵
  PID:16328
- C:\Windows\System\wECqnJS.exe
  C:\Windows\System\wECqnJS.exe
  2⤵
  PID:16348
- C:\Windows\System\kSYyvpz.exe
  C:\Windows\System\kSYyvpz.exe
  2⤵
  PID:16368
- C:\Windows\System\qcZfDgH.exe
  C:\Windows\System\qcZfDgH.exe
  2⤵
  PID:9520
- C:\Windows\System\PprUaEJ.exe
  C:\Windows\System\PprUaEJ.exe
  2⤵
  PID:9736
- C:\Windows\System\NJlKgRk.exe
  C:\Windows\System\NJlKgRk.exe
  2⤵
  PID:14808
- C:\Windows\System\GzviKHE.exe
  C:\Windows\System\GzviKHE.exe
  2⤵
  PID:15164
- C:\Windows\System\ImfOjoL.exe
  C:\Windows\System\ImfOjoL.exe
  2⤵
  PID:8308
- C:\Windows\System\AaStXYu.exe
  C:\Windows\System\AaStXYu.exe
  2⤵
  PID:9664
- C:\Windows\System\qPQnKnF.exe
  C:\Windows\System\qPQnKnF.exe
  2⤵
  PID:6980
- C:\Windows\System\IIZtdbv.exe
  C:\Windows\System\IIZtdbv.exe
  2⤵
  PID:9988
- C:\Windows\System\VCVDgWV.exe
  C:\Windows\System\VCVDgWV.exe
  2⤵
  PID:7304
- C:\Windows\System\MjhNaXz.exe
  C:\Windows\System\MjhNaXz.exe
  2⤵
  PID:9012
- C:\Windows\System\JotPgTD.exe
  C:\Windows\System\JotPgTD.exe
  2⤵
  PID:9760
- C:\Windows\System\JuMPSTA.exe
  C:\Windows\System\JuMPSTA.exe
  2⤵
  PID:1120
- C:\Windows\System\aLbjDpb.exe
  C:\Windows\System\aLbjDpb.exe
  2⤵
  PID:9364
- C:\Windows\System\GoQSlJt.exe
  C:\Windows\System\GoQSlJt.exe
  2⤵
  PID:6836
- C:\Windows\System\ckfnGHH.exe
  C:\Windows\System\ckfnGHH.exe
  2⤵
  PID:10820
- C:\Windows\System\VldlDNT.exe
  C:\Windows\System\VldlDNT.exe
  2⤵
  PID:6812
- C:\Windows\System\LfKucZq.exe
  C:\Windows\System\LfKucZq.exe
  2⤵
  PID:9588
- C:\Windows\System\cSGCVkj.exe
  C:\Windows\System\cSGCVkj.exe
  2⤵
  PID:15416
- C:\Windows\System\iXlDqsL.exe
  C:\Windows\System\iXlDqsL.exe
  2⤵
  PID:15496
- C:\Windows\System\crmnlkL.exe
  C:\Windows\System\crmnlkL.exe
  2⤵
  PID:14452
- C:\Windows\System\dleliyy.exe
  C:\Windows\System\dleliyy.exe
  2⤵
  PID:15572
- C:\Windows\System\cfgXwri.exe
  C:\Windows\System\cfgXwri.exe
  2⤵
  PID:10328
- C:\Windows\System\wuIHbuc.exe
  C:\Windows\System\wuIHbuc.exe
  2⤵
  PID:13404
- C:\Windows\System\kIFFWKV.exe
  C:\Windows\System\kIFFWKV.exe
  2⤵
  PID:13468
- C:\Windows\System\MDtIbJJ.exe
  C:\Windows\System\MDtIbJJ.exe
  2⤵
  PID:13456
- C:\Windows\System\lzimExj.exe
  C:\Windows\System\lzimExj.exe
  2⤵
  PID:16380
- C:\Windows\System\eIFnmvk.exe
  C:\Windows\System\eIFnmvk.exe
  2⤵
  PID:8840
- C:\Windows\System\QTUfcXC.exe
  C:\Windows\System\QTUfcXC.exe
  2⤵
  PID:5240
- C:\Windows\System\FGSQBhH.exe
  C:\Windows\System\FGSQBhH.exe
  2⤵
  PID:10640
- C:\Windows\System\jhziqcD.exe
  C:\Windows\System\jhziqcD.exe
  2⤵
  PID:15456
- C:\Windows\System\uVCiefC.exe
  C:\Windows\System\uVCiefC.exe
  2⤵
  PID:15644
- C:\Windows\System\palcvyc.exe
  C:\Windows\System\palcvyc.exe
  2⤵
  PID:15840
- C:\Windows\System\bBPlJDi.exe
  C:\Windows\System\bBPlJDi.exe
  2⤵
  PID:15888
- C:\Windows\System\dtwPkqw.exe
  C:\Windows\System\dtwPkqw.exe
  2⤵
  PID:10928
- C:\Windows\System\ytNToJh.exe
  C:\Windows\System\ytNToJh.exe
  2⤵
  PID:15192
- C:\Windows\System\DvzxhqX.exe
  C:\Windows\System\DvzxhqX.exe
  2⤵
  PID:11016
- C:\Windows\System\uALzGtI.exe
  C:\Windows\System\uALzGtI.exe
  2⤵
  PID:13420
- C:\Windows\System\ejxjgzL.exe
  C:\Windows\System\ejxjgzL.exe
  2⤵
  PID:13436
- C:\Windows\System\LjnCtZD.exe
  C:\Windows\System\LjnCtZD.exe
  2⤵
  PID:16012
- C:\Windows\System\lDEueEv.exe
  C:\Windows\System\lDEueEv.exe
  2⤵
  PID:15436
- C:\Windows\System\heJVlZE.exe
  C:\Windows\System\heJVlZE.exe
  2⤵
  PID:9540
- C:\Windows\System\HvecDtw.exe
  C:\Windows\System\HvecDtw.exe
  2⤵
  PID:14960
- C:\Windows\System\WLMPfFY.exe
  C:\Windows\System\WLMPfFY.exe
  2⤵
  PID:10156
- C:\Windows\System\gDvaCvM.exe
  C:\Windows\System\gDvaCvM.exe
  2⤵
  PID:872
- C:\Windows\System\vhFrSai.exe
  C:\Windows\System\vhFrSai.exe
  2⤵
  PID:12944
- C:\Windows\System\JFymxKZ.exe
  C:\Windows\System\JFymxKZ.exe
  2⤵
  PID:11756
- C:\Windows\System\oZfyVzJ.exe
  C:\Windows\System\oZfyVzJ.exe
  2⤵
  PID:12688
- C:\Windows\System\LPECQGP.exe
  C:\Windows\System\LPECQGP.exe
  2⤵
  PID:10548
- C:\Windows\System\VLvXPdF.exe
  C:\Windows\System\VLvXPdF.exe
  2⤵
  PID:11292
- C:\Windows\System\QXFEZts.exe
  C:\Windows\System\QXFEZts.exe
  2⤵
  PID:12292
- C:\Windows\System\zwCAFZS.exe
  C:\Windows\System\zwCAFZS.exe
  2⤵
  PID:12588
- C:\Windows\System\mLbldBP.exe
  C:\Windows\System\mLbldBP.exe
  2⤵
  PID:15876
- C:\Windows\System\NJDjyIu.exe
  C:\Windows\System\NJDjyIu.exe
  2⤵
  PID:16356
- C:\Windows\System\oOtIJiF.exe
  C:\Windows\System\oOtIJiF.exe
  2⤵
  PID:10464
- C:\Windows\System\gLWBxSi.exe
  C:\Windows\System\gLWBxSi.exe
  2⤵
  PID:15232
- C:\Windows\System\YRApFUP.exe
  C:\Windows\System\YRApFUP.exe
  2⤵
  PID:9916
- C:\Windows\System\ClWBepx.exe
  C:\Windows\System\ClWBepx.exe
  2⤵
  PID:10020
- C:\Windows\System\LfCFQBl.exe
  C:\Windows\System\LfCFQBl.exe
  2⤵
  PID:15568
- C:\Windows\System\HJBmwtI.exe
  C:\Windows\System\HJBmwtI.exe
  2⤵
  PID:9264
- C:\Windows\System\ZzUwkDo.exe
  C:\Windows\System\ZzUwkDo.exe
  2⤵
  PID:16176
- C:\Windows\System\fcVKQrX.exe
  C:\Windows\System\fcVKQrX.exe
  2⤵
  PID:11552
- C:\Windows\System\SSLqpOC.exe
  C:\Windows\System\SSLqpOC.exe
  2⤵
  PID:16288
- C:\Windows\System\QGkAMqL.exe
  C:\Windows\System\QGkAMqL.exe
  2⤵
  PID:12940
- C:\Windows\System\ECeUBYM.exe
  C:\Windows\System\ECeUBYM.exe
  2⤵
  PID:11316
- C:\Windows\System\dvKxcsY.exe
  C:\Windows\System\dvKxcsY.exe
  2⤵
  PID:12204
- C:\Windows\System\yGTAYKP.exe
  C:\Windows\System\yGTAYKP.exe
  2⤵
  PID:11724
- C:\Windows\System\IuJagUM.exe
  C:\Windows\System\IuJagUM.exe
  2⤵
  PID:11000
- C:\Windows\System\wrOioum.exe
  C:\Windows\System\wrOioum.exe
  2⤵
  PID:13124
- C:\Windows\System\vtLpeCF.exe
  C:\Windows\System\vtLpeCF.exe
  2⤵
  PID:12544
- C:\Windows\System\BjuuDWs.exe
  C:\Windows\System\BjuuDWs.exe
  2⤵
  PID:12480
- C:\Windows\System\lmdgLIX.exe
  C:\Windows\System\lmdgLIX.exe
  2⤵
  PID:12884
- C:\Windows\System\GgByIcK.exe
  C:\Windows\System\GgByIcK.exe
  2⤵
  PID:14316
- C:\Windows\System\BepYVBE.exe
  C:\Windows\System\BepYVBE.exe
  2⤵
  PID:11300
- C:\Windows\System\ZrIVhCV.exe
  C:\Windows\System\ZrIVhCV.exe
  2⤵
  PID:13568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:13140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=23278725284032 --process=260 /prefetch:7 --thread=4520
1⤵
PID:13696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c3uhtez5.qgr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\Bsvubpq.exe

Filesize
2.1MB

MD5
f1b40add4ae0711033fd9e30e6713773

SHA1
4d9a942453e47897f4ad6d7a9829988da91ac1c6

SHA256
ead842c8c4ad71f94da846d85f9a94139160710ef3ec9421990cf73b1b3216cc

SHA512
06a1b62f8ba6e33643534cda97c496107045f82bf7d9c479d8123f2c1954fc4585fce85875eee1c8022d80217640df3510178e2eaec820668cf254779c0971d9

Download Submit
C:\Windows\System\CYQROED.exe

Filesize
2.1MB

MD5
8e8024332efb21d9acd1241e78dbcffa

SHA1
406e7c1bf0c4a3ff004fa28893cc55c40f28d26e

SHA256
ae98cb590a6cf5cf82cf8485e70f8ed672b7e6ed18c86f73225274dbb273edea

SHA512
0d13a14e111fcc61b86803bfd98e177e8287ef277ce18fb3458a57f8efae53e99a60f8bb8f58e8b6bfe119865b65ab31de10eb761e152fcae631250fbba2bce9

Download Submit
C:\Windows\System\DberaMB.exe

Filesize
2.1MB

MD5
b6008ff7e50500a5a49dd586f47a4dcc

SHA1
1b6dc80b91ba29c14c5243836d9c7b4be972e328

SHA256
0d41722df4d782229284e01adbf7156c597d4c876ef48c701516197dc4721e34

SHA512
d6fa257cef8b0635bf745f771df84d2e8554ecb8517ccac0093cb22c3bb80a5877f0d571384292c6f0fc1d99db8c50510a392115bd05c3e167df94fff12e6a5f

Download Submit
C:\Windows\System\DtDBwHf.exe

Filesize
2.1MB

MD5
8203f4d7149a59c274c4137142b68bb0

SHA1
2541510edc2d5850e6de67e03560072e62bc33a5

SHA256
e455134bf83fc470e068aa622a5dce7a156a3030043fbd8b4e83e636d6946209

SHA512
7c6d375fdca8e316b1bb55ebcde0e4377fa98dd92c33e9ea99252c1c1be25dccef1fc1251b1ebe745f1d1d046941da44024c823458a73f3dbe8bf980edb44c5d

Download Submit
C:\Windows\System\EDZTADa.exe

Filesize
2.1MB

MD5
527bb3dfacefb17bfc30ed0941887047

SHA1
f43b2d2432c211492efbd9c4399dae3cb8652d5d

SHA256
cc71bfaa7728735c5d665c98bf317d0926b01aa9d7e2956e5c5a534e56fcce78

SHA512
24ef978c2504d653ef9f4dd2ab8e2fa767b0e66499b1a7deb89ae1bcf6b648c00c4eef0d648077c849dfa7926013044f9d357c803f98a307b8196f27ed2ff67b

Download Submit
C:\Windows\System\EJVczrR.exe

Filesize
2.1MB

MD5
6b5f00236a1e30f08365ec8f633da55f

SHA1
0af0b2f41feba3a448643da94045d03a3c47d4fe

SHA256
b19d2ccec2ad337535a931642838c68360203e7ecca3b80f2444415d73b22a47

SHA512
995ae8cb2ac51f111566890d468041472f7046a6995742920c4bda71a821509efe7f7997e7db9c873bd80e1210f47cd74aecefce72e5762a991036103aa892a1

Download Submit
C:\Windows\System\FtDXxcl.exe

Filesize
2.1MB

MD5
f0d8e35a8b5dd9b583ef29a8708b3eab

SHA1
24683c4f04f5ce975cf91ca6ffe56500224a0904

SHA256
e28cab020bd3a8a95fce67e77440772ee5773d41a1f2f48f2440d7d003eca039

SHA512
8db75657c5d378afa6e4333a80dc99b916bc057aa7720456ee431fbf255e6183e1ef41fef91e9f095b2bf54210983541a5f36e1272c9f4d49b2f3b109396f8be

Download Submit
C:\Windows\System\GgYfcjT.exe

Filesize
2.1MB

MD5
82a081a73d036408695c4c0192fa2976

SHA1
ea98246c9fad23db05aee37d7dbaa70308e3e425

SHA256
5aa7c1a49852b0eed822b7abb28c9a5512843bda6dcf0ea8de0c0a5e8cf7c97e

SHA512
14da148702c15bd9cc2e4aa835b0388e2568a1261806949adf598d3566a2c78de3c8c31c7fe476e91bba1d7cef7d5e143fc166d9d350785076103dddc67b8166

Download Submit
C:\Windows\System\HVoITPc.exe

Filesize
2.1MB

MD5
5db6634a7bb5b03647a57b593a46ce2c

SHA1
b399617e2797d14c4bdfefe2389a0232952beb4d

SHA256
955def3f60424feeaaf463ecea79ee824468d83a881ed0af8a9898a99ff8ff51

SHA512
2116e8dbe2cf63148e4c1ed1c2e0153d74b368a363c714962e00e3c95470aa2552311670db6eb95d3a65454520428bebfbd24fead1c87f8279a90b18f023b964

Download Submit
C:\Windows\System\HymRzJH.exe

Filesize
2.1MB

MD5
6aa2179c182b2be4ea7b4a738f66312a

SHA1
0c69017395ae7ad9dfc3b62832d0ec91fc456c20

SHA256
a43ff8cd55224bf39eb9f3f57b9acb475b719de246cd1a36c35ceccccb565018

SHA512
2fe538ffed60d3eba3888cef825da9f4eb353e73a0c3e703bb38e9dd5df169b1a9bb7bb1aa4462d192f15a29fb7d07782870ddcabf62e05d75e8249e5fff5fa0

Download Submit
C:\Windows\System\IFIednq.exe

Filesize
2.1MB

MD5
9ae03e01266928523e6dbd79ea750ce3

SHA1
19a6f97e66712f9bc95030ea2b3b1d398e81c189

SHA256
89ac3d4d7c31a69163abaf5008c2a674a2f7022a84bad2d8902204b0633b7b75

SHA512
85e1ad7ddd5ddd5c6377becd85b193c7f261f631267e3fc70c587e5ca5962e20399cdfaa997feb8edb4a69103c6bd330fc452339f771a0693dad1ff765fba331

Download Submit
C:\Windows\System\OaFXmiC.exe

Filesize
2.1MB

MD5
3056cd80a7d8b04372904a13ba926d22

SHA1
9e62a5d6cb08f35ef24093ffaeed23a645cd79f9

SHA256
fcd32da974d804fa90f1be294960d182b815deae2bb2a2f20c4c632a54b5b7fe

SHA512
59ba9971e43a2f3b489745fe62683658d728399cceb46e59c07c8c8cd3bad8c00d8417789712eebdd717d0b10927dea93b92275b1e995ef27bcd947c09c3a63f

Download Submit
C:\Windows\System\PZkKoBR.exe

Filesize
2.1MB

MD5
3c3b3db680b953032b000c6e480efc36

SHA1
491391eb7bd0272e3f15f367051dea128444a011

SHA256
78c6d91c985a259731267044ef0d597215de49ecaf860831432843c6d9456bd2

SHA512
86bb700d5253974bb2cd2db98c2612c320216dcf5430e5c041d3fc6a8ce51a45ac7e213d87212459d7797078d0b3bc9bd6cb88757d32563ffb5008553fc4896c

Download Submit
C:\Windows\System\RChVjjJ.exe

Filesize
2.1MB

MD5
678006023a389a2f42155d21e8780e6f

SHA1
ede561cede0393d7f23975f12ad5f48bfbc07b65

SHA256
7590fb99cb84bba4f51f7e19829dd1e110a49aacdbb90a91edd5f32bb46377cf

SHA512
3244866e0eaf10ed70b0d29b0ff9261adbe8446301a909c3c5671d230e42696c2a6ea9e12879d4ac9b88e5434f5c6ab1e7266fbcf4914d5ebfd1ca137e56ece8

Download Submit
C:\Windows\System\RZNCEpw.exe

Filesize
2.1MB

MD5
7fb64301e67b2204663005b032c7e160

SHA1
75043f9892543aeb128082c1295845f567c54b7a

SHA256
d806cb23f6ad7e244ffee13b279ecdb8e8d5857e3485c4db433f99583803043f

SHA512
02316aa82dedfe897f48438c83e0771df5b91cc92e58c75890301d9016bb6ccc55df1af0a11258ae86192a2d7ca50a9c50750d8fbd8498ec19b9893e9acbf893

Download Submit
C:\Windows\System\VIazTaz.exe

Filesize
2.1MB

MD5
883a45828b8f2228138d7aeb5ad08057

SHA1
9a41b0d6404b24e69a190537b6d95d86aec3e539

SHA256
656b347fd1e05d582959a6a54155ae3521b2c662ecc66b6d9f361eebd333c4fd

SHA512
dcce14c3b98a46c7efc2fa0020eeae735e1eef8ce85f8ddf8988d6493510a464c3636f4ea4176a3409629da8dc2fa2533aac4271425d602b36ec15420847fdb3

Download Submit
C:\Windows\System\VwUHoTT.exe

Filesize
2.1MB

MD5
941987e2d39276ac38ea9228018c0bd3

SHA1
236b5752e96eae9fa3b73e5b6186663b7de7c3e1

SHA256
8a1f689f3fa2e0e9d7a20998ceb691081e76386b0e70d18f0e57270373be251f

SHA512
50dfbc2d814d3cfeac1c88229b3cc61e706da646ea92b767e5f9ffe121d0ab6d55dd69a216972a89b86f72ed038bde53debec3a38d4a6d12c680685f83481f7c

Download Submit
C:\Windows\System\ZaEAUNP.exe

Filesize
2.1MB

MD5
fa9642501eb45e36f93393637c6cd687

SHA1
50c2e82492539e1855dafec76c53fa55cb1513e7

SHA256
573b96a81d181d1c3aed8b00ca999b552fa0a4c4cf467d546f2ec4d0b11e94ea

SHA512
37a75bd5ef75e5730f3589de4316f0a513f1457412ee137f2ffb36128233866d550bf36a0fbb4ac07b3114e49a648b323edcbaeb68693cb3112db37aa3cce2d2

Download Submit
C:\Windows\System\aEiAokW.exe

Filesize
2.1MB

MD5
fc4d23067d304a619289a845e4c83a63

SHA1
ed39ffc2abb94746b176688be0ccdfa4b91c94be

SHA256
f211656156a09dd7a123bd4a96065e30fc568c8e8984d01da4f6737db4e6262d

SHA512
4536eee5343a4218365c73e7673b55f0f8dc287438aa03fa38629197e564bf8fee783c492a1bf26b9c1ecc145b7bd99e5383d9108388a78cf61e6aa9971d483c

Download Submit
C:\Windows\System\dNjARvp.exe

Filesize
2.1MB

MD5
0b8f5aedf48e436aab8fb76c5ba28c9c

SHA1
31cbcfe441df2f076baad19fb14f479abb01d715

SHA256
e31b72579c27290f516ec71a738443c3bd594d213f3beed42efa5b9bf6fba843

SHA512
89493030741d377aae960d36a37e2d4a8331c655a57b59903750f241cc2fe00a86a4beeed8c7996bb62657d313cb0be2dd3cdd46ace72e1226d4c5ca3163a2d9

Download Submit
C:\Windows\System\doKQvtq.exe

Filesize
2.1MB

MD5
a3953cf11ba8314cbe34c11720c43fbf

SHA1
6615abc670a34b968d3b11caeccee23b401c9926

SHA256
2a8356bc9dd76f6c03c9be2ee766c4381fa0930e793f8d7e3fd1fe30f18c4462

SHA512
f74ebe77c28fa450d07cce6844b93a6c28a6d0abae8e53fa7cc67162bd625dd17038d56b9b012332361cf83b451d280ec8b9d8b2a2ed58ca8184291f51e34031

Download Submit
C:\Windows\System\grLOSmI.exe

Filesize
2.1MB

MD5
389bfd213b7a43446de4b5678fe8354c

SHA1
4ec0e622be11addf2666f5432ac1db53faa72978

SHA256
82a00dc2d19ac610dd7ad0fdd53dca44b9aafe5ef23680cc9bf9eabadbe3d437

SHA512
240e83cf8e922cbfc8427bd0f35918b41f178b83d0ad0d23f2f5dac911218784938980ce45fcdff6c365e7042322b6fec973d56dd1f2495aa5a1aad833fbbe3e

Download Submit
C:\Windows\System\ilxlNQI.exe

Filesize
2.1MB

MD5
3243ea8103a2b997e8701ccd2cdac761

SHA1
6515841c0eb5cd201e11c8077d1d25d5d41f8e0c

SHA256
95c91e0ddfee3bfb1991a28cc13c1bfd43b07fa67f7e42a7de645ef1a6a52c4b

SHA512
325e3d48974c61b88ce52688fa5c6409e5e2da41f6a6e6fcd5c7277538afe81983dfac0a45a88c6ff910ff0bbea4c1e19ce1b7bc328627fc1694eb8fc5e07cbf

Download Submit
C:\Windows\System\jsclpFV.exe

Filesize
2.1MB

MD5
93a7f30e57660921f181a0c770f21e4d

SHA1
f31c5a7d4f5ba32e20208634013b20bf8dfc8090

SHA256
5143898a3424bdda60a51dde7d3b76762ff39e747b85b3e72570c95325ae9cdd

SHA512
ce4ca786e045a0a78bf14b8b0c5710f32b1c3c255cde5c539697d5d87048aeecd619be27514ada2cbfac727ee3f314eb0c5d27b1622b92bf57a794a49d675970

Download Submit
C:\Windows\System\jsgzytf.exe

Filesize
2.1MB

MD5
04810c13479fa78bc9c5bab00abecb9b

SHA1
b51b3ec655647a6e6f1ad07a4b19f8bd2d28009d

SHA256
a50315d1cebd07051241afcfb9d61cbfc51bd8115643dc20e7def584ca9a3d01

SHA512
7c2cd7004fc0d091a62793c5cd1980755ad162ced60853a804d66332e09d50647d96b472e8d65f5038043124b696ccdf428a489ecf38d33e6f6dcd1faaa1fb93

Download Submit
C:\Windows\System\lECJisu.exe

Filesize
2.1MB

MD5
ee8dd23756621b488115a6d9f1ae2e45

SHA1
7ecdd5c2f70aeb73be8381363210ef5709e2d053

SHA256
142cf29c06008482a378a3f8abf7f76d3fa85777dc510c525f3171a14e80501f

SHA512
bb9e41dd006ce3dba750a05031d9b68e42022d32c53cd09e80522a1312f150ea8afa100bf65cc3bb5f27ad4e08deb7be09afbc0600c46a7f83d407fc723264a8

Download Submit
C:\Windows\System\lMOTxMV.exe

Filesize
2.1MB

MD5
0292be3cb29a38a7e79afe439abb83cd

SHA1
abe9b89b5ea35f680deaa5dd0ec580835f20e802

SHA256
2830dc4113f8a5be1737b4c990ba7386684c39b8173eb693f4b5dfdd27b7caa0

SHA512
ed1c5e258d624bc0c19f4d3021d822107f218e3bb4d9e90ce464b4f528db38b2e4c61c01f669cede2a37b4d329e5da49d8c23cbdef1688c5e575f15aee590537

Download Submit
C:\Windows\System\lmZNlZR.exe

Filesize
2.1MB

MD5
4a2be866fc3b3d72149d73317cc55dad

SHA1
402c646d535054a8f17a70767bcece043f62cf82

SHA256
c46861bc6685355177674b45f846dd58238290a5ea2ac55bf54c7f731131fc89

SHA512
2444b17c81ffe127f164155a10fb5d8b89fef7b51f03dcc3cdff85e6979ebdefc632a38caee7215ebba368702a00765a96811912fb255c06d0d87ea200239cc4

Download Submit
C:\Windows\System\mEcxfjP.exe

Filesize
2.1MB

MD5
9e38bccb989d547ff3d4e6adb1456781

SHA1
e00736779ff72ecff02f04e0421938ca70fa738f

SHA256
e3482c241638c594ad909bdc8b3874c8a56f9454b4dd07ec375a7057f85d66ae

SHA512
328a30d48179375815333765f24b8104f741717232639481f38b53621e3727d76425ce098f0b2ac2417385902e6885fec115759e3f26571eac04d646a56542f5

Download Submit
C:\Windows\System\rvlHjTO.exe

Filesize
2.1MB

MD5
3d674fef2f920086655925a5e4ce027e

SHA1
a409be45e02e41a9b4ffe8c699aa4283696a43b7

SHA256
78b3ade97e3644ff2b807c30a34b34b133324b1b47a00a2ee3c6153f66f6dc76

SHA512
303535592794a724c30d12158578a0ebb4645ad089a93934ed225596fafc3820222439470246eb5d5f0d387a01a14fa5eb9e5d16c346ac1bef0953c4b461c142

Download Submit
C:\Windows\System\ugkuNsR.exe

Filesize
2.1MB

MD5
2899c88c587860d550fb6f897b65b352

SHA1
17b533e6ab4b7af0094c8090d15d19c1d3112dda

SHA256
1fbcbf6f3f2fcba056af8d85a8691e17a1019fca1f8967504c8a287b0945b7ec

SHA512
406ba7b29e87235d75ef97b754e66f5bf3c927d849e522bf2eafd06946628303f1375c25c343715b3ebb13d8187d2b8f5eb6acf706748393b33d3726dc4ef6ec

Download Submit
C:\Windows\System\vBeqBsF.exe

Filesize
2.1MB

MD5
9180bba6416d771cb5e85ab8921323cc

SHA1
a5dbcafc07e2d760245cce7053c93d4c75f89483

SHA256
cfb320fa24ec16001ce547389c13e3cdbb4c687adccb43595df1519b6d07b203

SHA512
d7283664afc61caa36fec0b92f8e92d494a91cb21b61b502d466d9fc999a29ea54cf03cc33740042a5a963f05126cbccbc24c59b6deb1b45d327867f65dfba44

Download Submit
C:\Windows\System\yrvOCFq.exe

Filesize
2.1MB

MD5
0beaafb40e974901d2d5085bb387bf8f

SHA1
5d5de1c3c16a339e2010d283b2aeae627cff8fde

SHA256
56971ab2c9480a396d7272d440485f3e870c9838333600152e40f691cb8945e9

SHA512
58f9a3fa27e37fa8389af4f506361faf2cb58e90b6baf593ea235bcb3577c47702e14920705cc162bdf220e70e5b991834583c659fc446e1e23d29cf0f0acb40

Download Submit
memory/448-50-0x00007FF7D9590000-0x00007FF7D9982000-memory.dmp

Filesize
3.9MB

Download
memory/448-1961-0x00007FF7D9590000-0x00007FF7D9982000-memory.dmp

Filesize
3.9MB

Download
memory/1028-149-0x00007FF7D97B0000-0x00007FF7D9BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1028-2136-0x00007FF7D97B0000-0x00007FF7D9BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1536-100-0x00007FF65FFD0000-0x00007FF6603C2000-memory.dmp

Filesize
3.9MB

Download
memory/1536-2097-0x00007FF65FFD0000-0x00007FF6603C2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-106-0x00007FF69C4A0000-0x00007FF69C892000-memory.dmp

Filesize
3.9MB

Download
memory/1624-2117-0x00007FF69C4A0000-0x00007FF69C892000-memory.dmp

Filesize
3.9MB

Download
memory/2348-143-0x00007FF6EAD70000-0x00007FF6EB162000-memory.dmp

Filesize
3.9MB

Download
memory/2348-2247-0x00007FF6EAD70000-0x00007FF6EB162000-memory.dmp

Filesize
3.9MB

Download
memory/2432-1976-0x00007FF66E1D0000-0x00007FF66E5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-76-0x00007FF66E1D0000-0x00007FF66E5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-64-0x00007FF72E020000-0x00007FF72E412000-memory.dmp

Filesize
3.9MB

Download
memory/2672-1971-0x00007FF72E020000-0x00007FF72E412000-memory.dmp

Filesize
3.9MB

Download
memory/2824-1953-0x00007FF6A7BA0000-0x00007FF6A7F92000-memory.dmp

Filesize
3.9MB

Download
memory/2824-71-0x00007FF6A7BA0000-0x00007FF6A7F92000-memory.dmp

Filesize
3.9MB

Download
memory/3108-0-0x00007FF7DFCA0000-0x00007FF7E0092000-memory.dmp

Filesize
3.9MB

Download
memory/3108-1-0x0000025D3E730000-0x0000025D3E740000-memory.dmp

Filesize
64KB

Download
memory/3108-144-0x00007FF7DFCA0000-0x00007FF7E0092000-memory.dmp

Filesize
3.9MB

Download
memory/3148-2081-0x00007FF6DF530000-0x00007FF6DF922000-memory.dmp

Filesize
3.9MB

Download
memory/3148-119-0x00007FF6DF530000-0x00007FF6DF922000-memory.dmp

Filesize
3.9MB

Download
memory/3244-110-0x00007FF754890000-0x00007FF754C82000-memory.dmp

Filesize
3.9MB

Download
memory/3244-2123-0x00007FF754890000-0x00007FF754C82000-memory.dmp

Filesize
3.9MB

Download
memory/3652-47-0x00007FF7C6400000-0x00007FF7C67F2000-memory.dmp

Filesize
3.9MB

Download
memory/3812-59-0x00007FF6C03C0000-0x00007FF6C07B2000-memory.dmp

Filesize
3.9MB

Download
memory/3812-1952-0x00007FF6C03C0000-0x00007FF6C07B2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-81-0x00007FF6805C0000-0x00007FF6809B2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-1977-0x00007FF6805C0000-0x00007FF6809B2000-memory.dmp

Filesize
3.9MB

Download
memory/3896-113-0x00007FF60E220000-0x00007FF60E612000-memory.dmp

Filesize
3.9MB

Download
memory/3896-2075-0x00007FF60E220000-0x00007FF60E612000-memory.dmp

Filesize
3.9MB

Download
memory/4008-1974-0x00007FF6AD0B0000-0x00007FF6AD4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4008-72-0x00007FF6AD0B0000-0x00007FF6AD4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4060-128-0x00007FF62D1B0000-0x00007FF62D5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4060-2089-0x00007FF62D1B0000-0x00007FF62D5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4268-1963-0x00007FF7840A0000-0x00007FF784492000-memory.dmp

Filesize
3.9MB

Download
memory/4268-14-0x00007FF7840A0000-0x00007FF784492000-memory.dmp

Filesize
3.9MB

Download
memory/4296-1992-0x00007FF6227B0000-0x00007FF622BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4296-84-0x00007FF6227B0000-0x00007FF622BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4356-131-0x00007FF7B9980000-0x00007FF7B9D72000-memory.dmp

Filesize
3.9MB

Download
memory/4356-2073-0x00007FF7B9980000-0x00007FF7B9D72000-memory.dmp

Filesize
3.9MB

Download
memory/4496-2146-0x00007FF6C3F60000-0x00007FF6C4352000-memory.dmp

Filesize
3.9MB

Download
memory/4496-147-0x00007FF6C3F60000-0x00007FF6C4352000-memory.dmp

Filesize
3.9MB

Download
memory/4708-1296-0x00007FF696560000-0x00007FF696952000-memory.dmp

Filesize
3.9MB

Download
memory/4708-8-0x00007FF696560000-0x00007FF696952000-memory.dmp

Filesize
3.9MB

Download
memory/4708-1776-0x00007FF696560000-0x00007FF696952000-memory.dmp

Filesize
3.9MB

Download
memory/4916-67-0x000001FAB8770000-0x000001FAB8780000-memory.dmp

Filesize
64KB

Download
memory/4916-32-0x000001FABB1A0000-0x000001FABB1C2000-memory.dmp

Filesize
136KB

Download
memory/4916-44-0x000001FAB8770000-0x000001FAB8780000-memory.dmp

Filesize
64KB

Download
memory/4916-281-0x000001FABBDD0000-0x000001FABC576000-memory.dmp

Filesize
7.6MB

Download
memory/4916-43-0x00007FFBEE9A0000-0x00007FFBEF461000-memory.dmp

Filesize
10.8MB

Download