xmrig | 48f21351df6ffdb18d3b1fc95b3a70076b3165ceae27a795521ff0b3f6ac025a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
Size

2.3MB
MD5

02f2a3575bf8030890b0e54ce7ee3a63
SHA1

342be6b8ec32b73f77902f0872f5ae09e9e92865
SHA256

48f21351df6ffdb18d3b1fc95b3a70076b3165ceae27a795521ff0b3f6ac025a
SHA512

681f172a71564894704d09240cbe981fa2d6301b932010f97327fd9e84d615150d45175fd1570e569cd5b35a4857205a8b48b516cdd01dac116b12b0b5ba5ea6
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfQu:NABg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/932-38-0x00007FF731E70000-0x00007FF732262000-memory.dmp	xmrig
behavioral2/memory/4152-34-0x00007FF7A6370000-0x00007FF7A6762000-memory.dmp	xmrig
behavioral2/memory/4888-46-0x00007FF66A8A0000-0x00007FF66AC92000-memory.dmp	xmrig
behavioral2/memory/4988-48-0x00007FF6A0F10000-0x00007FF6A1302000-memory.dmp	xmrig
behavioral2/memory/4928-41-0x00007FF7BE7B0000-0x00007FF7BEBA2000-memory.dmp	xmrig
behavioral2/memory/872-61-0x00007FF7F1B30000-0x00007FF7F1F22000-memory.dmp	xmrig
behavioral2/memory/4140-99-0x00007FF7267B0000-0x00007FF726BA2000-memory.dmp	xmrig
behavioral2/memory/1676-109-0x00007FF6CB4A0000-0x00007FF6CB892000-memory.dmp	xmrig
behavioral2/memory/2228-143-0x00007FF7E35D0000-0x00007FF7E39C2000-memory.dmp	xmrig
behavioral2/memory/1972-169-0x00007FF6CFEA0000-0x00007FF6D0292000-memory.dmp	xmrig
behavioral2/memory/3540-164-0x00007FF7C0820000-0x00007FF7C0C12000-memory.dmp	xmrig
behavioral2/memory/2716-153-0x00007FF7891C0000-0x00007FF7895B2000-memory.dmp	xmrig
behavioral2/memory/3648-145-0x00007FF7C7DC0000-0x00007FF7C81B2000-memory.dmp	xmrig
behavioral2/memory/3644-139-0x00007FF7F5A60000-0x00007FF7F5E52000-memory.dmp	xmrig
behavioral2/memory/4388-128-0x00007FF7A8160000-0x00007FF7A8552000-memory.dmp	xmrig
behavioral2/memory/4152-1811-0x00007FF7A6370000-0x00007FF7A6762000-memory.dmp	xmrig
behavioral2/memory/4888-1824-0x00007FF66A8A0000-0x00007FF66AC92000-memory.dmp	xmrig
behavioral2/memory/932-1820-0x00007FF731E70000-0x00007FF732262000-memory.dmp	xmrig
behavioral2/memory/4988-1843-0x00007FF6A0F10000-0x00007FF6A1302000-memory.dmp	xmrig
behavioral2/memory/3540-1848-0x00007FF7C0820000-0x00007FF7C0C12000-memory.dmp	xmrig
behavioral2/memory/4928-1826-0x00007FF7BE7B0000-0x00007FF7BEBA2000-memory.dmp	xmrig
behavioral2/memory/2936-1914-0x00007FF697660000-0x00007FF697A52000-memory.dmp	xmrig
behavioral2/memory/4920-1925-0x00007FF754620000-0x00007FF754A12000-memory.dmp	xmrig
behavioral2/memory/2236-1931-0x00007FF7D1360000-0x00007FF7D1752000-memory.dmp	xmrig
behavioral2/memory/872-1910-0x00007FF7F1B30000-0x00007FF7F1F22000-memory.dmp	xmrig
behavioral2/memory/1424-1938-0x00007FF73D6F0000-0x00007FF73DAE2000-memory.dmp	xmrig
behavioral2/memory/2228-2139-0x00007FF7E35D0000-0x00007FF7E39C2000-memory.dmp	xmrig
behavioral2/memory/3648-2235-0x00007FF7C7DC0000-0x00007FF7C81B2000-memory.dmp	xmrig
behavioral2/memory/1972-2243-0x00007FF6CFEA0000-0x00007FF6D0292000-memory.dmp	xmrig
behavioral2/memory/4984-2037-0x00007FF667170000-0x00007FF667562000-memory.dmp	xmrig
behavioral2/memory/3644-2042-0x00007FF7F5A60000-0x00007FF7F5E52000-memory.dmp	xmrig
behavioral2/memory/1676-2031-0x00007FF6CB4A0000-0x00007FF6CB892000-memory.dmp	xmrig
behavioral2/memory/5032-2036-0x00007FF7ED4F0000-0x00007FF7ED8E2000-memory.dmp	xmrig
behavioral2/memory/4388-2033-0x00007FF7A8160000-0x00007FF7A8552000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
3	4376	powershell.exe
5	4376	powershell.exe
15	4376	powershell.exe
16	4376	powershell.exe
19	4376	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4152	zWePgDr.exe
932	FZblogW.exe
4928	CHJgDaw.exe
4888	naWZWwc.exe
4988	rJdTbii.exe
3540	NlLozBp.exe
872	WBTlrTv.exe
2936	tHgKnJr.exe
4920	zMyvBJf.exe
2236	vZCitMi.exe
1424	KBHJDcr.exe
4984	GVPLCoc.exe
5032	ihBDcUC.exe
1676	UZlDGdc.exe
4388	SevXqfp.exe
3644	wyIZPox.exe
2228	kcceMtn.exe
3648	RHNYTYd.exe
2716	yIxoTtQ.exe
3572	yuORGUF.exe
1972	UlDDmbm.exe
4604	ksraheS.exe
4740	PFkDdac.exe
4644	sEaEeBB.exe
3656	hCSTVKc.exe
1548	bFEuWTN.exe
3332	oDmKqvh.exe
4364	RBSuMCR.exe
1292	uVvWePc.exe
724	iRVCNiT.exe
4884	FgDwzck.exe
2352	hdJrEjQ.exe
5092	sOpeQLu.exe
2828	iphOgAI.exe
3932	mroOpyB.exe
432	KltUuXV.exe
2892	ydpHSBD.exe
4564	EClMcuR.exe
732	ETBTJTV.exe
1284	uWgjheZ.exe
1004	rLwnIvH.exe
3136	ZuBnfNt.exe
4076	DWbwhVB.exe
1392	reftPdL.exe
1624	tyxYGMn.exe
1836	ACDceQV.exe
548	DUPMxyq.exe
2076	fyLgBbV.exe
1812	HniSzoh.exe
1120	oeOMfkR.exe
828	uTYurKx.exe
4772	UkaZiTL.exe
1500	CaBrSGN.exe
4456	QfNKmuc.exe
940	PvnkGXV.exe
4764	tKZkpdo.exe
2256	ZcLgtTq.exe
1968	TyBOeIx.exe
4596	TLJNWMM.exe
924	aOlBbaq.exe
4204	cRPCARX.exe
2796	UEHqojA.exe
4516	ZhIxdGo.exe
4332	rluDOnu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4140-0-0x00007FF7267B0000-0x00007FF726BA2000-memory.dmp	upx
behavioral2/files/0x0008000000023262-5.dat	upx
behavioral2/files/0x0009000000023267-21.dat	upx
behavioral2/files/0x0008000000023268-19.dat	upx
behavioral2/memory/932-38-0x00007FF731E70000-0x00007FF732262000-memory.dmp	upx
behavioral2/files/0x0008000000023269-40.dat	upx
behavioral2/memory/4152-34-0x00007FF7A6370000-0x00007FF7A6762000-memory.dmp	upx
behavioral2/files/0x0008000000023266-32.dat	upx
behavioral2/memory/4888-46-0x00007FF66A8A0000-0x00007FF66AC92000-memory.dmp	upx
behavioral2/memory/4988-48-0x00007FF6A0F10000-0x00007FF6A1302000-memory.dmp	upx
behavioral2/memory/3540-49-0x00007FF7C0820000-0x00007FF7C0C12000-memory.dmp	upx
behavioral2/files/0x000700000002326a-50.dat	upx
behavioral2/memory/4928-41-0x00007FF7BE7B0000-0x00007FF7BEBA2000-memory.dmp	upx
behavioral2/files/0x000700000002326b-54.dat	upx
behavioral2/memory/872-61-0x00007FF7F1B30000-0x00007FF7F1F22000-memory.dmp	upx
behavioral2/files/0x000700000002326c-60.dat	upx
behavioral2/memory/2936-64-0x00007FF697660000-0x00007FF697A52000-memory.dmp	upx
behavioral2/files/0x000700000002326d-68.dat	upx
behavioral2/files/0x000700000002326f-76.dat	upx
behavioral2/files/0x000700000002326e-75.dat	upx
behavioral2/memory/2236-77-0x00007FF7D1360000-0x00007FF7D1752000-memory.dmp	upx
behavioral2/memory/5032-91-0x00007FF7ED4F0000-0x00007FF7ED8E2000-memory.dmp	upx
behavioral2/memory/4984-92-0x00007FF667170000-0x00007FF667562000-memory.dmp	upx
behavioral2/files/0x0007000000023271-88.dat	upx
behavioral2/files/0x0007000000023272-93.dat	upx
behavioral2/memory/1424-84-0x00007FF73D6F0000-0x00007FF73DAE2000-memory.dmp	upx
behavioral2/files/0x0007000000023270-81.dat	upx
behavioral2/memory/4920-70-0x00007FF754620000-0x00007FF754A12000-memory.dmp	upx
behavioral2/memory/4140-99-0x00007FF7267B0000-0x00007FF726BA2000-memory.dmp	upx
behavioral2/files/0x0007000000023273-103.dat	upx
behavioral2/files/0x0007000000023274-111.dat	upx
behavioral2/memory/1676-109-0x00007FF6CB4A0000-0x00007FF6CB892000-memory.dmp	upx
behavioral2/files/0x0007000000023276-129.dat	upx
behavioral2/files/0x0007000000023278-136.dat	upx
behavioral2/memory/2228-143-0x00007FF7E35D0000-0x00007FF7E39C2000-memory.dmp	upx
behavioral2/files/0x000700000002327b-150.dat	upx
behavioral2/files/0x000700000002327e-170.dat	upx
behavioral2/files/0x000700000002327f-174.dat	upx
behavioral2/memory/1972-169-0x00007FF6CFEA0000-0x00007FF6D0292000-memory.dmp	upx
behavioral2/files/0x000700000002327c-168.dat	upx
behavioral2/memory/3540-164-0x00007FF7C0820000-0x00007FF7C0C12000-memory.dmp	upx
behavioral2/files/0x000700000002327d-163.dat	upx
behavioral2/files/0x000700000002327a-159.dat	upx
behavioral2/memory/2716-153-0x00007FF7891C0000-0x00007FF7895B2000-memory.dmp	upx
behavioral2/files/0x0007000000023279-149.dat	upx
behavioral2/memory/3648-145-0x00007FF7C7DC0000-0x00007FF7C81B2000-memory.dmp	upx
behavioral2/files/0x0007000000023277-133.dat	upx
behavioral2/memory/3644-139-0x00007FF7F5A60000-0x00007FF7F5E52000-memory.dmp	upx
behavioral2/memory/3572-132-0x00007FF63EA70000-0x00007FF63EE62000-memory.dmp	upx
behavioral2/memory/4388-128-0x00007FF7A8160000-0x00007FF7A8552000-memory.dmp	upx
behavioral2/files/0x0007000000023275-124.dat	upx
behavioral2/files/0x0007000000023280-180.dat	upx
behavioral2/files/0x0007000000023281-184.dat	upx
behavioral2/files/0x0007000000023283-196.dat	upx
behavioral2/files/0x0007000000023284-198.dat	upx
behavioral2/files/0x0007000000023285-204.dat	upx
behavioral2/files/0x0007000000023282-193.dat	upx
behavioral2/memory/4152-1811-0x00007FF7A6370000-0x00007FF7A6762000-memory.dmp	upx
behavioral2/memory/4888-1824-0x00007FF66A8A0000-0x00007FF66AC92000-memory.dmp	upx
behavioral2/memory/932-1820-0x00007FF731E70000-0x00007FF732262000-memory.dmp	upx
behavioral2/memory/4988-1843-0x00007FF6A0F10000-0x00007FF6A1302000-memory.dmp	upx
behavioral2/memory/3540-1848-0x00007FF7C0820000-0x00007FF7C0C12000-memory.dmp	upx
behavioral2/memory/4928-1826-0x00007FF7BE7B0000-0x00007FF7BEBA2000-memory.dmp	upx
behavioral2/memory/2936-1914-0x00007FF697660000-0x00007FF697A52000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vZCitMi.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\IFaOQRF.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\FviPMUi.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\oeiisSa.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\qeTaJUO.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\SYQWqrV.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\hCSTVKc.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\WydEqfe.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\dYXcYLj.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\VsgrkWF.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\NsUkcBh.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\KBHJDcr.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\IaIibIf.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\nrwuuqQ.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\gtegnxy.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\tXTmGRD.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\BbmeIxV.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\bgftlwK.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\POMYMmk.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\ojnKgwC.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\mzsUhla.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\zqGpakN.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\edkSUBR.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\XxTiTyR.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\GzdGHwV.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\IQimLFL.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\bbFrXzs.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\yaBEHLA.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\lMswFbz.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\jRfRHNv.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\KqcFnbW.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\ysYViAa.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\OVdMLLw.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\bFEuWTN.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\FgDwzck.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\cUTNXtP.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\ckAuOUa.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\yIxoTtQ.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\uTYurKx.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\aMuzLAR.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\uDPZXPK.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\jCzxWgX.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\ZLthyHo.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\qDfqxjn.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\GcUmnwV.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\YMhTbVs.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\PAWXduK.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\GPrdPBT.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\TcTCgjc.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\jIpEWKH.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\uxZPDeo.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\LxrdBuu.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\qNoHwaB.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\GCxfwtc.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\ETBTJTV.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\UDZzWri.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\fbgiZkl.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\TLqdJeQ.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\ZuBnfNt.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\houpSjM.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\NWIsTYt.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\kmamXCQ.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\LXAcEba.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
File created	C:\Windows\System\zMyvBJf.exe	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4376	powershell.exe
4376	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeLockMemoryPrivilege	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4376	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	90
PID 4140 wrote to memory of 4376	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	90
PID 4140 wrote to memory of 4152	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	91
PID 4140 wrote to memory of 4152	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	91
PID 4140 wrote to memory of 932	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	92
PID 4140 wrote to memory of 932	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	92
PID 4140 wrote to memory of 4928	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	93
PID 4140 wrote to memory of 4928	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	93
PID 4140 wrote to memory of 4888	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	94
PID 4140 wrote to memory of 4888	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	94
PID 4140 wrote to memory of 4988	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	95
PID 4140 wrote to memory of 4988	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	95
PID 4140 wrote to memory of 3540	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	96
PID 4140 wrote to memory of 3540	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	96
PID 4140 wrote to memory of 872	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	97
PID 4140 wrote to memory of 872	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	97
PID 4140 wrote to memory of 2936	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	98
PID 4140 wrote to memory of 2936	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	98
PID 4140 wrote to memory of 4920	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	99
PID 4140 wrote to memory of 4920	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	99
PID 4140 wrote to memory of 2236	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	100
PID 4140 wrote to memory of 2236	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	100
PID 4140 wrote to memory of 1424	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	101
PID 4140 wrote to memory of 1424	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	101
PID 4140 wrote to memory of 4984	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	102
PID 4140 wrote to memory of 4984	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	102
PID 4140 wrote to memory of 5032	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	103
PID 4140 wrote to memory of 5032	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	103
PID 4140 wrote to memory of 1676	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	104
PID 4140 wrote to memory of 1676	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	104
PID 4140 wrote to memory of 4388	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	105
PID 4140 wrote to memory of 4388	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	105
PID 4140 wrote to memory of 3644	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	106
PID 4140 wrote to memory of 3644	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	106
PID 4140 wrote to memory of 2228	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	107
PID 4140 wrote to memory of 2228	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	107
PID 4140 wrote to memory of 3648	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	108
PID 4140 wrote to memory of 3648	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	108
PID 4140 wrote to memory of 2716	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	109
PID 4140 wrote to memory of 2716	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	109
PID 4140 wrote to memory of 3572	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	110
PID 4140 wrote to memory of 3572	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	110
PID 4140 wrote to memory of 1972	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	111
PID 4140 wrote to memory of 1972	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	111
PID 4140 wrote to memory of 4604	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	112
PID 4140 wrote to memory of 4604	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	112
PID 4140 wrote to memory of 4740	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	113
PID 4140 wrote to memory of 4740	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	113
PID 4140 wrote to memory of 4644	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	114
PID 4140 wrote to memory of 4644	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	114
PID 4140 wrote to memory of 3656	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	115
PID 4140 wrote to memory of 3656	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	115
PID 4140 wrote to memory of 1548	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	116
PID 4140 wrote to memory of 1548	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	116
PID 4140 wrote to memory of 3332	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	117
PID 4140 wrote to memory of 3332	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	117
PID 4140 wrote to memory of 4364	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	118
PID 4140 wrote to memory of 4364	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	118
PID 4140 wrote to memory of 1292	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	119
PID 4140 wrote to memory of 1292	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	119
PID 4140 wrote to memory of 724	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	120
PID 4140 wrote to memory of 724	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	120
PID 4140 wrote to memory of 4884	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	121
PID 4140 wrote to memory of 4884	4140	02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe	121

C:\Users\Admin\AppData\Local\Temp\02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02f2a3575bf8030890b0e54ce7ee3a63_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\System\zWePgDr.exe
  C:\Windows\System\zWePgDr.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\FZblogW.exe
  C:\Windows\System\FZblogW.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\CHJgDaw.exe
  C:\Windows\System\CHJgDaw.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\naWZWwc.exe
  C:\Windows\System\naWZWwc.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\rJdTbii.exe
  C:\Windows\System\rJdTbii.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\NlLozBp.exe
  C:\Windows\System\NlLozBp.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\WBTlrTv.exe
  C:\Windows\System\WBTlrTv.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\tHgKnJr.exe
  C:\Windows\System\tHgKnJr.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\zMyvBJf.exe
  C:\Windows\System\zMyvBJf.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\vZCitMi.exe
  C:\Windows\System\vZCitMi.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\KBHJDcr.exe
  C:\Windows\System\KBHJDcr.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\GVPLCoc.exe
  C:\Windows\System\GVPLCoc.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\ihBDcUC.exe
  C:\Windows\System\ihBDcUC.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\UZlDGdc.exe
  C:\Windows\System\UZlDGdc.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\SevXqfp.exe
  C:\Windows\System\SevXqfp.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\wyIZPox.exe
  C:\Windows\System\wyIZPox.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\kcceMtn.exe
  C:\Windows\System\kcceMtn.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\RHNYTYd.exe
  C:\Windows\System\RHNYTYd.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\yIxoTtQ.exe
  C:\Windows\System\yIxoTtQ.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\yuORGUF.exe
  C:\Windows\System\yuORGUF.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\UlDDmbm.exe
  C:\Windows\System\UlDDmbm.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\ksraheS.exe
  C:\Windows\System\ksraheS.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\PFkDdac.exe
  C:\Windows\System\PFkDdac.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\sEaEeBB.exe
  C:\Windows\System\sEaEeBB.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\hCSTVKc.exe
  C:\Windows\System\hCSTVKc.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\bFEuWTN.exe
  C:\Windows\System\bFEuWTN.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\oDmKqvh.exe
  C:\Windows\System\oDmKqvh.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\RBSuMCR.exe
  C:\Windows\System\RBSuMCR.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\uVvWePc.exe
  C:\Windows\System\uVvWePc.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\iRVCNiT.exe
  C:\Windows\System\iRVCNiT.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\FgDwzck.exe
  C:\Windows\System\FgDwzck.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\hdJrEjQ.exe
  C:\Windows\System\hdJrEjQ.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\sOpeQLu.exe
  C:\Windows\System\sOpeQLu.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\iphOgAI.exe
  C:\Windows\System\iphOgAI.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\mroOpyB.exe
  C:\Windows\System\mroOpyB.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\KltUuXV.exe
  C:\Windows\System\KltUuXV.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\ydpHSBD.exe
  C:\Windows\System\ydpHSBD.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\EClMcuR.exe
  C:\Windows\System\EClMcuR.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\ETBTJTV.exe
  C:\Windows\System\ETBTJTV.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\uWgjheZ.exe
  C:\Windows\System\uWgjheZ.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\rLwnIvH.exe
  C:\Windows\System\rLwnIvH.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\ZuBnfNt.exe
  C:\Windows\System\ZuBnfNt.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\DWbwhVB.exe
  C:\Windows\System\DWbwhVB.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\reftPdL.exe
  C:\Windows\System\reftPdL.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\tyxYGMn.exe
  C:\Windows\System\tyxYGMn.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\ACDceQV.exe
  C:\Windows\System\ACDceQV.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\DUPMxyq.exe
  C:\Windows\System\DUPMxyq.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\fyLgBbV.exe
  C:\Windows\System\fyLgBbV.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\HniSzoh.exe
  C:\Windows\System\HniSzoh.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\oeOMfkR.exe
  C:\Windows\System\oeOMfkR.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\uTYurKx.exe
  C:\Windows\System\uTYurKx.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\UkaZiTL.exe
  C:\Windows\System\UkaZiTL.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\CaBrSGN.exe
  C:\Windows\System\CaBrSGN.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\QfNKmuc.exe
  C:\Windows\System\QfNKmuc.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\PvnkGXV.exe
  C:\Windows\System\PvnkGXV.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\tKZkpdo.exe
  C:\Windows\System\tKZkpdo.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\ZcLgtTq.exe
  C:\Windows\System\ZcLgtTq.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\TyBOeIx.exe
  C:\Windows\System\TyBOeIx.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\TLJNWMM.exe
  C:\Windows\System\TLJNWMM.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\aOlBbaq.exe
  C:\Windows\System\aOlBbaq.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\cRPCARX.exe
  C:\Windows\System\cRPCARX.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\UEHqojA.exe
  C:\Windows\System\UEHqojA.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\ZhIxdGo.exe
  C:\Windows\System\ZhIxdGo.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\rluDOnu.exe
  C:\Windows\System\rluDOnu.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\OdcDIuh.exe
  C:\Windows\System\OdcDIuh.exe
  2⤵
  PID:2444
- C:\Windows\System\houpSjM.exe
  C:\Windows\System\houpSjM.exe
  2⤵
  PID:3296
- C:\Windows\System\ZiVGRKn.exe
  C:\Windows\System\ZiVGRKn.exe
  2⤵
  PID:396
- C:\Windows\System\behNFmK.exe
  C:\Windows\System\behNFmK.exe
  2⤵
  PID:2100
- C:\Windows\System\fbjbnWN.exe
  C:\Windows\System\fbjbnWN.exe
  2⤵
  PID:456
- C:\Windows\System\fxpFkNM.exe
  C:\Windows\System\fxpFkNM.exe
  2⤵
  PID:4168
- C:\Windows\System\tZPyipU.exe
  C:\Windows\System\tZPyipU.exe
  2⤵
  PID:2964
- C:\Windows\System\ppFFnsR.exe
  C:\Windows\System\ppFFnsR.exe
  2⤵
  PID:2572
- C:\Windows\System\bSppKAY.exe
  C:\Windows\System\bSppKAY.exe
  2⤵
  PID:2876
- C:\Windows\System\UDZzWri.exe
  C:\Windows\System\UDZzWri.exe
  2⤵
  PID:4072
- C:\Windows\System\iIWVskB.exe
  C:\Windows\System\iIWVskB.exe
  2⤵
  PID:2832
- C:\Windows\System\XJqbqbB.exe
  C:\Windows\System\XJqbqbB.exe
  2⤵
  PID:3100
- C:\Windows\System\WydEqfe.exe
  C:\Windows\System\WydEqfe.exe
  2⤵
  PID:4012
- C:\Windows\System\dvnMtHy.exe
  C:\Windows\System\dvnMtHy.exe
  2⤵
  PID:5136
- C:\Windows\System\oyKMIiw.exe
  C:\Windows\System\oyKMIiw.exe
  2⤵
  PID:5152
- C:\Windows\System\XaCPPun.exe
  C:\Windows\System\XaCPPun.exe
  2⤵
  PID:5172
- C:\Windows\System\dzkZjgt.exe
  C:\Windows\System\dzkZjgt.exe
  2⤵
  PID:5228
- C:\Windows\System\NWIsTYt.exe
  C:\Windows\System\NWIsTYt.exe
  2⤵
  PID:5268
- C:\Windows\System\mIYjOsp.exe
  C:\Windows\System\mIYjOsp.exe
  2⤵
  PID:5304
- C:\Windows\System\GzdGHwV.exe
  C:\Windows\System\GzdGHwV.exe
  2⤵
  PID:5320
- C:\Windows\System\nakdciq.exe
  C:\Windows\System\nakdciq.exe
  2⤵
  PID:5352
- C:\Windows\System\PsWZDGp.exe
  C:\Windows\System\PsWZDGp.exe
  2⤵
  PID:5380
- C:\Windows\System\RxcUshb.exe
  C:\Windows\System\RxcUshb.exe
  2⤵
  PID:5396
- C:\Windows\System\ojnKgwC.exe
  C:\Windows\System\ojnKgwC.exe
  2⤵
  PID:5420
- C:\Windows\System\cUTNXtP.exe
  C:\Windows\System\cUTNXtP.exe
  2⤵
  PID:5440
- C:\Windows\System\RgoDHLl.exe
  C:\Windows\System\RgoDHLl.exe
  2⤵
  PID:5492
- C:\Windows\System\tXTmGRD.exe
  C:\Windows\System\tXTmGRD.exe
  2⤵
  PID:5512
- C:\Windows\System\sKEuVRb.exe
  C:\Windows\System\sKEuVRb.exe
  2⤵
  PID:5536
- C:\Windows\System\jCUWeKi.exe
  C:\Windows\System\jCUWeKi.exe
  2⤵
  PID:5556
- C:\Windows\System\mYNfIdu.exe
  C:\Windows\System\mYNfIdu.exe
  2⤵
  PID:5576
- C:\Windows\System\lMswFbz.exe
  C:\Windows\System\lMswFbz.exe
  2⤵
  PID:5624
- C:\Windows\System\PIOMBYU.exe
  C:\Windows\System\PIOMBYU.exe
  2⤵
  PID:5644
- C:\Windows\System\ZepKucz.exe
  C:\Windows\System\ZepKucz.exe
  2⤵
  PID:5660
- C:\Windows\System\jCPflSd.exe
  C:\Windows\System\jCPflSd.exe
  2⤵
  PID:5692
- C:\Windows\System\LESsWxU.exe
  C:\Windows\System\LESsWxU.exe
  2⤵
  PID:5712
- C:\Windows\System\witMzXZ.exe
  C:\Windows\System\witMzXZ.exe
  2⤵
  PID:5740
- C:\Windows\System\GPrdPBT.exe
  C:\Windows\System\GPrdPBT.exe
  2⤵
  PID:5764
- C:\Windows\System\TvlAYoW.exe
  C:\Windows\System\TvlAYoW.exe
  2⤵
  PID:5784
- C:\Windows\System\qelhwyK.exe
  C:\Windows\System\qelhwyK.exe
  2⤵
  PID:5804
- C:\Windows\System\ASUCMAS.exe
  C:\Windows\System\ASUCMAS.exe
  2⤵
  PID:5856
- C:\Windows\System\KovaplB.exe
  C:\Windows\System\KovaplB.exe
  2⤵
  PID:5892
- C:\Windows\System\bTdmlQz.exe
  C:\Windows\System\bTdmlQz.exe
  2⤵
  PID:5912
- C:\Windows\System\XNnKrSF.exe
  C:\Windows\System\XNnKrSF.exe
  2⤵
  PID:5936
- C:\Windows\System\aNSuPTJ.exe
  C:\Windows\System\aNSuPTJ.exe
  2⤵
  PID:5956
- C:\Windows\System\zdcGeSj.exe
  C:\Windows\System\zdcGeSj.exe
  2⤵
  PID:5976
- C:\Windows\System\MLgLkyH.exe
  C:\Windows\System\MLgLkyH.exe
  2⤵
  PID:6052
- C:\Windows\System\ypYgxzv.exe
  C:\Windows\System\ypYgxzv.exe
  2⤵
  PID:6104
- C:\Windows\System\SihlmxZ.exe
  C:\Windows\System\SihlmxZ.exe
  2⤵
  PID:6124
- C:\Windows\System\mzsUhla.exe
  C:\Windows\System\mzsUhla.exe
  2⤵
  PID:2304
- C:\Windows\System\aOUIvWd.exe
  C:\Windows\System\aOUIvWd.exe
  2⤵
  PID:5144
- C:\Windows\System\cqlxBTp.exe
  C:\Windows\System\cqlxBTp.exe
  2⤵
  PID:5244
- C:\Windows\System\BbmeIxV.exe
  C:\Windows\System\BbmeIxV.exe
  2⤵
  PID:5376
- C:\Windows\System\xmbLQiq.exe
  C:\Windows\System\xmbLQiq.exe
  2⤵
  PID:4048
- C:\Windows\System\wQiAxYe.exe
  C:\Windows\System\wQiAxYe.exe
  2⤵
  PID:5480
- C:\Windows\System\Aamaing.exe
  C:\Windows\System\Aamaing.exe
  2⤵
  PID:5548
- C:\Windows\System\PWxyGHZ.exe
  C:\Windows\System\PWxyGHZ.exe
  2⤵
  PID:5656
- C:\Windows\System\qNoHwaB.exe
  C:\Windows\System\qNoHwaB.exe
  2⤵
  PID:5652
- C:\Windows\System\dYyWMlj.exe
  C:\Windows\System\dYyWMlj.exe
  2⤵
  PID:5708
- C:\Windows\System\sHaXois.exe
  C:\Windows\System\sHaXois.exe
  2⤵
  PID:5828
- C:\Windows\System\IFaOQRF.exe
  C:\Windows\System\IFaOQRF.exe
  2⤵
  PID:5884
- C:\Windows\System\aMuzLAR.exe
  C:\Windows\System\aMuzLAR.exe
  2⤵
  PID:5988
- C:\Windows\System\jRfRHNv.exe
  C:\Windows\System\jRfRHNv.exe
  2⤵
  PID:5968
- C:\Windows\System\mxGgRra.exe
  C:\Windows\System\mxGgRra.exe
  2⤵
  PID:6044
- C:\Windows\System\BFxehUY.exe
  C:\Windows\System\BFxehUY.exe
  2⤵
  PID:6120
- C:\Windows\System\kmamXCQ.exe
  C:\Windows\System\kmamXCQ.exe
  2⤵
  PID:5260
- C:\Windows\System\NGnqWwg.exe
  C:\Windows\System\NGnqWwg.exe
  2⤵
  PID:5388
- C:\Windows\System\bgftlwK.exe
  C:\Windows\System\bgftlwK.exe
  2⤵
  PID:5468
- C:\Windows\System\aEzcnfo.exe
  C:\Windows\System\aEzcnfo.exe
  2⤵
  PID:5616
- C:\Windows\System\rhmsYTu.exe
  C:\Windows\System\rhmsYTu.exe
  2⤵
  PID:5944
- C:\Windows\System\HDNAGpz.exe
  C:\Windows\System\HDNAGpz.exe
  2⤵
  PID:5900
- C:\Windows\System\XPbJgUG.exe
  C:\Windows\System\XPbJgUG.exe
  2⤵
  PID:6152
- C:\Windows\System\VjbUsdz.exe
  C:\Windows\System\VjbUsdz.exe
  2⤵
  PID:6172
- C:\Windows\System\imbuwab.exe
  C:\Windows\System\imbuwab.exe
  2⤵
  PID:6188
- C:\Windows\System\NEFkOCS.exe
  C:\Windows\System\NEFkOCS.exe
  2⤵
  PID:6204
- C:\Windows\System\uDPZXPK.exe
  C:\Windows\System\uDPZXPK.exe
  2⤵
  PID:6220
- C:\Windows\System\NfxOSYT.exe
  C:\Windows\System\NfxOSYT.exe
  2⤵
  PID:6240
- C:\Windows\System\nLXeJMh.exe
  C:\Windows\System\nLXeJMh.exe
  2⤵
  PID:6264
- C:\Windows\System\UXbdQEp.exe
  C:\Windows\System\UXbdQEp.exe
  2⤵
  PID:6280
- C:\Windows\System\YMhTbVs.exe
  C:\Windows\System\YMhTbVs.exe
  2⤵
  PID:6296
- C:\Windows\System\WSZmpJN.exe
  C:\Windows\System\WSZmpJN.exe
  2⤵
  PID:6312
- C:\Windows\System\dPTfvvs.exe
  C:\Windows\System\dPTfvvs.exe
  2⤵
  PID:6332
- C:\Windows\System\wAoQats.exe
  C:\Windows\System\wAoQats.exe
  2⤵
  PID:6356
- C:\Windows\System\HlrbzsY.exe
  C:\Windows\System\HlrbzsY.exe
  2⤵
  PID:6372
- C:\Windows\System\AODdvTm.exe
  C:\Windows\System\AODdvTm.exe
  2⤵
  PID:6388
- C:\Windows\System\LnWsfKF.exe
  C:\Windows\System\LnWsfKF.exe
  2⤵
  PID:6428
- C:\Windows\System\cJNrFGJ.exe
  C:\Windows\System\cJNrFGJ.exe
  2⤵
  PID:6444
- C:\Windows\System\FviPMUi.exe
  C:\Windows\System\FviPMUi.exe
  2⤵
  PID:6468
- C:\Windows\System\AwdAlVK.exe
  C:\Windows\System\AwdAlVK.exe
  2⤵
  PID:6488
- C:\Windows\System\lQoSmkK.exe
  C:\Windows\System\lQoSmkK.exe
  2⤵
  PID:6508
- C:\Windows\System\zqGpakN.exe
  C:\Windows\System\zqGpakN.exe
  2⤵
  PID:6528
- C:\Windows\System\GCxfwtc.exe
  C:\Windows\System\GCxfwtc.exe
  2⤵
  PID:6548
- C:\Windows\System\REegaET.exe
  C:\Windows\System\REegaET.exe
  2⤵
  PID:6564
- C:\Windows\System\bbFrXzs.exe
  C:\Windows\System\bbFrXzs.exe
  2⤵
  PID:6584
- C:\Windows\System\DkAbAci.exe
  C:\Windows\System\DkAbAci.exe
  2⤵
  PID:6600
- C:\Windows\System\DhRGIxn.exe
  C:\Windows\System\DhRGIxn.exe
  2⤵
  PID:6640
- C:\Windows\System\FzhFBns.exe
  C:\Windows\System\FzhFBns.exe
  2⤵
  PID:6664
- C:\Windows\System\UczoQuA.exe
  C:\Windows\System\UczoQuA.exe
  2⤵
  PID:6680
- C:\Windows\System\pWeIYRh.exe
  C:\Windows\System\pWeIYRh.exe
  2⤵
  PID:6696
- C:\Windows\System\PAWXduK.exe
  C:\Windows\System\PAWXduK.exe
  2⤵
  PID:6712
- C:\Windows\System\QcJSzSD.exe
  C:\Windows\System\QcJSzSD.exe
  2⤵
  PID:6728
- C:\Windows\System\aVnICfy.exe
  C:\Windows\System\aVnICfy.exe
  2⤵
  PID:6748
- C:\Windows\System\vqvSISo.exe
  C:\Windows\System\vqvSISo.exe
  2⤵
  PID:6768
- C:\Windows\System\DSZyPks.exe
  C:\Windows\System\DSZyPks.exe
  2⤵
  PID:6784
- C:\Windows\System\qNwewwP.exe
  C:\Windows\System\qNwewwP.exe
  2⤵
  PID:6820
- C:\Windows\System\TyItbjZ.exe
  C:\Windows\System\TyItbjZ.exe
  2⤵
  PID:6840
- C:\Windows\System\gApORpM.exe
  C:\Windows\System\gApORpM.exe
  2⤵
  PID:6860
- C:\Windows\System\zzEJTNI.exe
  C:\Windows\System\zzEJTNI.exe
  2⤵
  PID:6880
- C:\Windows\System\IaIibIf.exe
  C:\Windows\System\IaIibIf.exe
  2⤵
  PID:6900
- C:\Windows\System\iAEARRV.exe
  C:\Windows\System\iAEARRV.exe
  2⤵
  PID:6920
- C:\Windows\System\KqcFnbW.exe
  C:\Windows\System\KqcFnbW.exe
  2⤵
  PID:6944
- C:\Windows\System\ckAuOUa.exe
  C:\Windows\System\ckAuOUa.exe
  2⤵
  PID:6968
- C:\Windows\System\hSCviJE.exe
  C:\Windows\System\hSCviJE.exe
  2⤵
  PID:6992
- C:\Windows\System\OoUhmyb.exe
  C:\Windows\System\OoUhmyb.exe
  2⤵
  PID:7012
- C:\Windows\System\ozfRVmg.exe
  C:\Windows\System\ozfRVmg.exe
  2⤵
  PID:7048
- C:\Windows\System\TcTCgjc.exe
  C:\Windows\System\TcTCgjc.exe
  2⤵
  PID:7068
- C:\Windows\System\NHCpTmF.exe
  C:\Windows\System\NHCpTmF.exe
  2⤵
  PID:7088
- C:\Windows\System\sbCBwbP.exe
  C:\Windows\System\sbCBwbP.exe
  2⤵
  PID:7108
- C:\Windows\System\jfiyldF.exe
  C:\Windows\System\jfiyldF.exe
  2⤵
  PID:7124
- C:\Windows\System\nrwuuqQ.exe
  C:\Windows\System\nrwuuqQ.exe
  2⤵
  PID:7140
- C:\Windows\System\hFWJJXQ.exe
  C:\Windows\System\hFWJJXQ.exe
  2⤵
  PID:7156
- C:\Windows\System\ysYViAa.exe
  C:\Windows\System\ysYViAa.exe
  2⤵
  PID:6032
- C:\Windows\System\omsFYbU.exe
  C:\Windows\System\omsFYbU.exe
  2⤵
  PID:2824
- C:\Windows\System\JaMaPnH.exe
  C:\Windows\System\JaMaPnH.exe
  2⤵
  PID:5636
- C:\Windows\System\sSvdkHJ.exe
  C:\Windows\System\sSvdkHJ.exe
  2⤵
  PID:5800
- C:\Windows\System\RPGMAbr.exe
  C:\Windows\System\RPGMAbr.exe
  2⤵
  PID:6184
- C:\Windows\System\EElaPYU.exe
  C:\Windows\System\EElaPYU.exe
  2⤵
  PID:5460
- C:\Windows\System\ofExWbY.exe
  C:\Windows\System\ofExWbY.exe
  2⤵
  PID:6812
- C:\Windows\System\fbgiZkl.exe
  C:\Windows\System\fbgiZkl.exe
  2⤵
  PID:6504
- C:\Windows\System\YtKMrcr.exe
  C:\Windows\System\YtKMrcr.exe
  2⤵
  PID:6896
- C:\Windows\System\dsoMQys.exe
  C:\Windows\System\dsoMQys.exe
  2⤵
  PID:6592
- C:\Windows\System\yaBEHLA.exe
  C:\Windows\System\yaBEHLA.exe
  2⤵
  PID:6400
- C:\Windows\System\SncaWZs.exe
  C:\Windows\System\SncaWZs.exe
  2⤵
  PID:6796
- C:\Windows\System\oeiisSa.exe
  C:\Windows\System\oeiisSa.exe
  2⤵
  PID:6540
- C:\Windows\System\dzBiENw.exe
  C:\Windows\System\dzBiENw.exe
  2⤵
  PID:6976
- C:\Windows\System\zKenPpl.exe
  C:\Windows\System\zKenPpl.exe
  2⤵
  PID:5888
- C:\Windows\System\dYXcYLj.exe
  C:\Windows\System\dYXcYLj.exe
  2⤵
  PID:7132
- C:\Windows\System\qDfqxjn.exe
  C:\Windows\System\qDfqxjn.exe
  2⤵
  PID:6932
- C:\Windows\System\HdyergB.exe
  C:\Windows\System\HdyergB.exe
  2⤵
  PID:6348
- C:\Windows\System\yJATEXz.exe
  C:\Windows\System\yJATEXz.exe
  2⤵
  PID:7040
- C:\Windows\System\uGaraKy.exe
  C:\Windows\System\uGaraKy.exe
  2⤵
  PID:6756
- C:\Windows\System\jIpEWKH.exe
  C:\Windows\System\jIpEWKH.exe
  2⤵
  PID:7192
- C:\Windows\System\KgLweqw.exe
  C:\Windows\System\KgLweqw.exe
  2⤵
  PID:7216
- C:\Windows\System\GsKJOPJ.exe
  C:\Windows\System\GsKJOPJ.exe
  2⤵
  PID:7236
- C:\Windows\System\ZaeWJmi.exe
  C:\Windows\System\ZaeWJmi.exe
  2⤵
  PID:7252
- C:\Windows\System\uxZPDeo.exe
  C:\Windows\System\uxZPDeo.exe
  2⤵
  PID:7276
- C:\Windows\System\wKaxrFz.exe
  C:\Windows\System\wKaxrFz.exe
  2⤵
  PID:7304
- C:\Windows\System\YNQEiiv.exe
  C:\Windows\System\YNQEiiv.exe
  2⤵
  PID:7320
- C:\Windows\System\sfQYcaE.exe
  C:\Windows\System\sfQYcaE.exe
  2⤵
  PID:7340
- C:\Windows\System\CvykcQj.exe
  C:\Windows\System\CvykcQj.exe
  2⤵
  PID:7364
- C:\Windows\System\gtegnxy.exe
  C:\Windows\System\gtegnxy.exe
  2⤵
  PID:7388
- C:\Windows\System\LXAcEba.exe
  C:\Windows\System\LXAcEba.exe
  2⤵
  PID:7408
- C:\Windows\System\AaxjTcp.exe
  C:\Windows\System\AaxjTcp.exe
  2⤵
  PID:7432
- C:\Windows\System\XVshNGD.exe
  C:\Windows\System\XVshNGD.exe
  2⤵
  PID:7452
- C:\Windows\System\yjgnvXI.exe
  C:\Windows\System\yjgnvXI.exe
  2⤵
  PID:7472
- C:\Windows\System\POMYMmk.exe
  C:\Windows\System\POMYMmk.exe
  2⤵
  PID:7492
- C:\Windows\System\EYCdDOr.exe
  C:\Windows\System\EYCdDOr.exe
  2⤵
  PID:7528
- C:\Windows\System\AEUVXBl.exe
  C:\Windows\System\AEUVXBl.exe
  2⤵
  PID:7556
- C:\Windows\System\nqKWMKj.exe
  C:\Windows\System\nqKWMKj.exe
  2⤵
  PID:7576
- C:\Windows\System\GcUmnwV.exe
  C:\Windows\System\GcUmnwV.exe
  2⤵
  PID:7596
- C:\Windows\System\oWpfeLm.exe
  C:\Windows\System\oWpfeLm.exe
  2⤵
  PID:7612
- C:\Windows\System\JoNpCaq.exe
  C:\Windows\System\JoNpCaq.exe
  2⤵
  PID:7640
- C:\Windows\System\zWxORHR.exe
  C:\Windows\System\zWxORHR.exe
  2⤵
  PID:7680
- C:\Windows\System\scvrPIU.exe
  C:\Windows\System\scvrPIU.exe
  2⤵
  PID:7700
- C:\Windows\System\VsgrkWF.exe
  C:\Windows\System\VsgrkWF.exe
  2⤵
  PID:7724
- C:\Windows\System\XSEADnA.exe
  C:\Windows\System\XSEADnA.exe
  2⤵
  PID:7752
- C:\Windows\System\yvovULs.exe
  C:\Windows\System\yvovULs.exe
  2⤵
  PID:7784
- C:\Windows\System\yorxKZg.exe
  C:\Windows\System\yorxKZg.exe
  2⤵
  PID:7812
- C:\Windows\System\IQimLFL.exe
  C:\Windows\System\IQimLFL.exe
  2⤵
  PID:7832
- C:\Windows\System\PGJOYYV.exe
  C:\Windows\System\PGJOYYV.exe
  2⤵
  PID:7852
- C:\Windows\System\eZjCLHc.exe
  C:\Windows\System\eZjCLHc.exe
  2⤵
  PID:7872
- C:\Windows\System\LxrdBuu.exe
  C:\Windows\System\LxrdBuu.exe
  2⤵
  PID:7900
- C:\Windows\System\zMVMjRj.exe
  C:\Windows\System\zMVMjRj.exe
  2⤵
  PID:8136
- C:\Windows\System\wuGiJCL.exe
  C:\Windows\System\wuGiJCL.exe
  2⤵
  PID:8168
- C:\Windows\System\jCzxWgX.exe
  C:\Windows\System\jCzxWgX.exe
  2⤵
  PID:8184
- C:\Windows\System\HYrsKgJ.exe
  C:\Windows\System\HYrsKgJ.exe
  2⤵
  PID:7372
- C:\Windows\System\leDdrHT.exe
  C:\Windows\System\leDdrHT.exe
  2⤵
  PID:5132
- C:\Windows\System\NXAVQXi.exe
  C:\Windows\System\NXAVQXi.exe
  2⤵
  PID:6556
- C:\Windows\System\qeTaJUO.exe
  C:\Windows\System\qeTaJUO.exe
  2⤵
  PID:7592
- C:\Windows\System\muGOqLO.exe
  C:\Windows\System\muGOqLO.exe
  2⤵
  PID:6808
- C:\Windows\System\SYQWqrV.exe
  C:\Windows\System\SYQWqrV.exe
  2⤵
  PID:6496
- C:\Windows\System\cneXbaP.exe
  C:\Windows\System\cneXbaP.exe
  2⤵
  PID:5816
- C:\Windows\System\TLqdJeQ.exe
  C:\Windows\System\TLqdJeQ.exe
  2⤵
  PID:7844
- C:\Windows\System\gKdJaYd.exe
  C:\Windows\System\gKdJaYd.exe
  2⤵
  PID:7896
- C:\Windows\System\bBYAGFL.exe
  C:\Windows\System\bBYAGFL.exe
  2⤵
  PID:7176
- C:\Windows\System\sUrmhvT.exe
  C:\Windows\System\sUrmhvT.exe
  2⤵
  PID:4348
- C:\Windows\System\GrnyWjA.exe
  C:\Windows\System\GrnyWjA.exe
  2⤵
  PID:3372
- C:\Windows\System\edkSUBR.exe
  C:\Windows\System\edkSUBR.exe
  2⤵
  PID:8004
- C:\Windows\System\KlbzqhW.exe
  C:\Windows\System\KlbzqhW.exe
  2⤵
  PID:5928
- C:\Windows\System\cRUWTNz.exe
  C:\Windows\System\cRUWTNz.exe
  2⤵
  PID:5044
- C:\Windows\System\XxTiTyR.exe
  C:\Windows\System\XxTiTyR.exe
  2⤵
  PID:6232
- C:\Windows\System\ZLthyHo.exe
  C:\Windows\System\ZLthyHo.exe
  2⤵
  PID:6776
- C:\Windows\System\CawmwZx.exe
  C:\Windows\System\CawmwZx.exe
  2⤵
  PID:7888
- C:\Windows\System\OVdMLLw.exe
  C:\Windows\System\OVdMLLw.exe
  2⤵
  PID:6892
- C:\Windows\System\ouSaojb.exe
  C:\Windows\System\ouSaojb.exe
  2⤵
  PID:6596
- C:\Windows\System\NsUkcBh.exe
  C:\Windows\System\NsUkcBh.exe
  2⤵
  PID:7188
- C:\Windows\System\VMZGpRx.exe
  C:\Windows\System\VMZGpRx.exe
  2⤵
  PID:7264
- C:\Windows\System\QngMmSG.exe
  C:\Windows\System\QngMmSG.exe
  2⤵
  PID:7332
- C:\Windows\System\FpoGqMi.exe
  C:\Windows\System\FpoGqMi.exe
  2⤵
  PID:7396
- C:\Windows\System\dzAPOvh.exe
  C:\Windows\System\dzAPOvh.exe
  2⤵
  PID:7484
- C:\Windows\System\VhftOcq.exe
  C:\Windows\System\VhftOcq.exe
  2⤵
  PID:8296
- C:\Windows\System\tmkQrhX.exe
  C:\Windows\System\tmkQrhX.exe
  2⤵
  PID:8328
- C:\Windows\System\plkNWXb.exe
  C:\Windows\System\plkNWXb.exe
  2⤵
  PID:8352
- C:\Windows\System\WvXwHsT.exe
  C:\Windows\System\WvXwHsT.exe
  2⤵
  PID:8368
- C:\Windows\System\JzfvSfK.exe
  C:\Windows\System\JzfvSfK.exe
  2⤵
  PID:8388
- C:\Windows\System\QkdjiCY.exe
  C:\Windows\System\QkdjiCY.exe
  2⤵
  PID:8404
- C:\Windows\System\pbdxNyh.exe
  C:\Windows\System\pbdxNyh.exe
  2⤵
  PID:8444
- C:\Windows\System\iVDukqb.exe
  C:\Windows\System\iVDukqb.exe
  2⤵
  PID:8480
- C:\Windows\System\wtYnvpa.exe
  C:\Windows\System\wtYnvpa.exe
  2⤵
  PID:8504
- C:\Windows\System\mhqGvZJ.exe
  C:\Windows\System\mhqGvZJ.exe
  2⤵
  PID:8524
- C:\Windows\System\cAdrepc.exe
  C:\Windows\System\cAdrepc.exe
  2⤵
  PID:8548
- C:\Windows\System\xsaZDGN.exe
  C:\Windows\System\xsaZDGN.exe
  2⤵
  PID:8564
- C:\Windows\System\CesIBBf.exe
  C:\Windows\System\CesIBBf.exe
  2⤵
  PID:8584
- C:\Windows\System\qHDgswl.exe
  C:\Windows\System\qHDgswl.exe
  2⤵
  PID:8612
- C:\Windows\System\dVLLpUc.exe
  C:\Windows\System\dVLLpUc.exe
  2⤵
  PID:8636
- C:\Windows\System\jcFcopw.exe
  C:\Windows\System\jcFcopw.exe
  2⤵
  PID:8660
- C:\Windows\System\wPanHBD.exe
  C:\Windows\System\wPanHBD.exe
  2⤵
  PID:8680
- C:\Windows\System\BtynXdW.exe
  C:\Windows\System\BtynXdW.exe
  2⤵
  PID:8696
- C:\Windows\System\VNwaWkp.exe
  C:\Windows\System\VNwaWkp.exe
  2⤵
  PID:8716
- C:\Windows\System\RAEKzpM.exe
  C:\Windows\System\RAEKzpM.exe
  2⤵
  PID:8740
- C:\Windows\System\SpVMwIV.exe
  C:\Windows\System\SpVMwIV.exe
  2⤵
  PID:8760
- C:\Windows\System\hMRfCtR.exe
  C:\Windows\System\hMRfCtR.exe
  2⤵
  PID:8776
- C:\Windows\System\VVQbkHO.exe
  C:\Windows\System\VVQbkHO.exe
  2⤵
  PID:8808
- C:\Windows\System\QRWhZKH.exe
  C:\Windows\System\QRWhZKH.exe
  2⤵
  PID:8836
- C:\Windows\System\iAqWytE.exe
  C:\Windows\System\iAqWytE.exe
  2⤵
  PID:8856
- C:\Windows\System\wVGJwjq.exe
  C:\Windows\System\wVGJwjq.exe
  2⤵
  PID:8880
- C:\Windows\System\NledVOL.exe
  C:\Windows\System\NledVOL.exe
  2⤵
  PID:8900
- C:\Windows\System\lbFDaYY.exe
  C:\Windows\System\lbFDaYY.exe
  2⤵
  PID:8924
- C:\Windows\System\NKWLxkI.exe
  C:\Windows\System\NKWLxkI.exe
  2⤵
  PID:8952
- C:\Windows\System\fXOJCYl.exe
  C:\Windows\System\fXOJCYl.exe
  2⤵
  PID:8972
- C:\Windows\System\PlVvAkw.exe
  C:\Windows\System\PlVvAkw.exe
  2⤵
  PID:9004
- C:\Windows\System\bQxfFyp.exe
  C:\Windows\System\bQxfFyp.exe
  2⤵
  PID:9024
- C:\Windows\System\CPVTckO.exe
  C:\Windows\System\CPVTckO.exe
  2⤵
  PID:9052
- C:\Windows\System\EMEpetK.exe
  C:\Windows\System\EMEpetK.exe
  2⤵
  PID:9068
- C:\Windows\System\XNaPUPc.exe
  C:\Windows\System\XNaPUPc.exe
  2⤵
  PID:9088
- C:\Windows\System\knSJVNg.exe
  C:\Windows\System\knSJVNg.exe
  2⤵
  PID:9124
- C:\Windows\System\tohxDKc.exe
  C:\Windows\System\tohxDKc.exe
  2⤵
  PID:7708
- C:\Windows\System\nhMeINE.exe
  C:\Windows\System\nhMeINE.exe
  2⤵
  PID:7224
- C:\Windows\System\FABYxlY.exe
  C:\Windows\System\FABYxlY.exe
  2⤵
  PID:7740
- C:\Windows\System\kqhsjAS.exe
  C:\Windows\System\kqhsjAS.exe
  2⤵
  PID:3456
- C:\Windows\System\MBJjmal.exe
  C:\Windows\System\MBJjmal.exe
  2⤵
  PID:8176
- C:\Windows\System\JMbfuPG.exe
  C:\Windows\System\JMbfuPG.exe
  2⤵
  PID:5520
- C:\Windows\System\sWUofgv.exe
  C:\Windows\System\sWUofgv.exe
  2⤵
  PID:7792
- C:\Windows\System\FrKIyWH.exe
  C:\Windows\System\FrKIyWH.exe
  2⤵
  PID:8384
- C:\Windows\System\NQuqpsT.exe
  C:\Windows\System\NQuqpsT.exe
  2⤵
  PID:8456
- C:\Windows\System\DPcxkKK.exe
  C:\Windows\System\DPcxkKK.exe
  2⤵
  PID:7696
- C:\Windows\System\GEEkKzR.exe
  C:\Windows\System\GEEkKzR.exe
  2⤵
  PID:8620
- C:\Windows\System\MuSGGOz.exe
  C:\Windows\System\MuSGGOz.exe
  2⤵
  PID:8828
- C:\Windows\System\FTTkmkt.exe
  C:\Windows\System\FTTkmkt.exe
  2⤵
  PID:6256
- C:\Windows\System\AiCdAVy.exe
  C:\Windows\System\AiCdAVy.exe
  2⤵
  PID:1200
- C:\Windows\System\lgXXCIr.exe
  C:\Windows\System\lgXXCIr.exe
  2⤵
  PID:7504
- C:\Windows\System\zgteExu.exe
  C:\Windows\System\zgteExu.exe
  2⤵
  PID:1820
- C:\Windows\System\LNVgPnE.exe
  C:\Windows\System\LNVgPnE.exe
  2⤵
  PID:7808
- C:\Windows\System\iDnsIwL.exe
  C:\Windows\System\iDnsIwL.exe
  2⤵
  PID:8196
- C:\Windows\System\AbIMnPY.exe
  C:\Windows\System\AbIMnPY.exe
  2⤵
  PID:8864
- C:\Windows\System\wNdkfXV.exe
  C:\Windows\System\wNdkfXV.exe
  2⤵
  PID:8436
- C:\Windows\System\YwOXRMk.exe
  C:\Windows\System\YwOXRMk.exe
  2⤵
  PID:8580
- C:\Windows\System\uLMvnRG.exe
  C:\Windows\System\uLMvnRG.exe
  2⤵
  PID:8692
- C:\Windows\System\BDyxvxp.exe
  C:\Windows\System\BDyxvxp.exe
  2⤵
  PID:9060
- C:\Windows\System\wxphWbR.exe
  C:\Windows\System\wxphWbR.exe
  2⤵
  PID:8820
- C:\Windows\System\KTUJsmn.exe
  C:\Windows\System\KTUJsmn.exe
  2⤵
  PID:8876
- C:\Windows\System\NsajzsB.exe
  C:\Windows\System\NsajzsB.exe
  2⤵
  PID:8940
- C:\Windows\System\LoSxpDO.exe
  C:\Windows\System\LoSxpDO.exe
  2⤵
  PID:8988
- C:\Windows\System\pOVDtMP.exe
  C:\Windows\System\pOVDtMP.exe
  2⤵
  PID:9084
- C:\Windows\System\ZWcCaJl.exe
  C:\Windows\System\ZWcCaJl.exe
  2⤵
  PID:1708
- C:\Windows\System\xCvZtxh.exe
  C:\Windows\System\xCvZtxh.exe
  2⤵
  PID:7604
- C:\Windows\System\elAssMg.exe
  C:\Windows\System\elAssMg.exe
  2⤵
  PID:8752
- C:\Windows\System\HUbroUm.exe
  C:\Windows\System\HUbroUm.exe
  2⤵
  PID:3780
- C:\Windows\System\OOvZmAA.exe
  C:\Windows\System\OOvZmAA.exe
  2⤵
  PID:8452
- C:\Windows\System\dMeqYfN.exe
  C:\Windows\System\dMeqYfN.exe
  2⤵
  PID:8608
- C:\Windows\System\rETNwHQ.exe
  C:\Windows\System\rETNwHQ.exe
  2⤵
  PID:9372
- C:\Windows\System\tcyRHve.exe
  C:\Windows\System\tcyRHve.exe
  2⤵
  PID:9392
- C:\Windows\System\EMuEwRe.exe
  C:\Windows\System\EMuEwRe.exe
  2⤵
  PID:9424
- C:\Windows\System\rfyLzbs.exe
  C:\Windows\System\rfyLzbs.exe
  2⤵
  PID:9448
- C:\Windows\System\MtMVXvp.exe
  C:\Windows\System\MtMVXvp.exe
  2⤵
  PID:9468
- C:\Windows\System\ibEDWzq.exe
  C:\Windows\System\ibEDWzq.exe
  2⤵
  PID:9492
- C:\Windows\System\bSLUOYQ.exe
  C:\Windows\System\bSLUOYQ.exe
  2⤵
  PID:9516
- C:\Windows\System\ZKVBipx.exe
  C:\Windows\System\ZKVBipx.exe
  2⤵
  PID:9532
- C:\Windows\System\RkTVjTQ.exe
  C:\Windows\System\RkTVjTQ.exe
  2⤵
  PID:9552
- C:\Windows\System\mTpLgjK.exe
  C:\Windows\System\mTpLgjK.exe
  2⤵
  PID:9572
- C:\Windows\System\VzDzOrI.exe
  C:\Windows\System\VzDzOrI.exe
  2⤵
  PID:9596
- C:\Windows\System\kBQPSCt.exe
  C:\Windows\System\kBQPSCt.exe
  2⤵
  PID:9636
- C:\Windows\System\cCYFTKW.exe
  C:\Windows\System\cCYFTKW.exe
  2⤵
  PID:9656
- C:\Windows\System\ujKRvGb.exe
  C:\Windows\System\ujKRvGb.exe
  2⤵
  PID:9676
- C:\Windows\System\NoQKiKD.exe
  C:\Windows\System\NoQKiKD.exe
  2⤵
  PID:9700
- C:\Windows\System\hHCNGTs.exe
  C:\Windows\System\hHCNGTs.exe
  2⤵
  PID:9724
- C:\Windows\System\eqoHYtJ.exe
  C:\Windows\System\eqoHYtJ.exe
  2⤵
  PID:9748
- C:\Windows\System\sTYXEcO.exe
  C:\Windows\System\sTYXEcO.exe
  2⤵
  PID:9768
- C:\Windows\System\BCMJcBZ.exe
  C:\Windows\System\BCMJcBZ.exe
  2⤵
  PID:9788
- C:\Windows\System\FsWzGPq.exe
  C:\Windows\System\FsWzGPq.exe
  2⤵
  PID:9816
- C:\Windows\System\LJUAvfs.exe
  C:\Windows\System\LJUAvfs.exe
  2⤵
  PID:9840
- C:\Windows\System\SmAwUus.exe
  C:\Windows\System\SmAwUus.exe
  2⤵
  PID:9860
- C:\Windows\System\XiPBKKZ.exe
  C:\Windows\System\XiPBKKZ.exe
  2⤵
  PID:9880
- C:\Windows\System\cnVarad.exe
  C:\Windows\System\cnVarad.exe
  2⤵
  PID:9904
- C:\Windows\System\DpthEFe.exe
  C:\Windows\System\DpthEFe.exe
  2⤵
  PID:9928
- C:\Windows\System\ydxjAvb.exe
  C:\Windows\System\ydxjAvb.exe
  2⤵
  PID:9956
- C:\Windows\System\BONtTMM.exe
  C:\Windows\System\BONtTMM.exe
  2⤵
  PID:9980
- C:\Windows\System\kTLrkiZ.exe
  C:\Windows\System\kTLrkiZ.exe
  2⤵
  PID:10004
- C:\Windows\System\xtadaVv.exe
  C:\Windows\System\xtadaVv.exe
  2⤵
  PID:10028
- C:\Windows\System\cMXefhg.exe
  C:\Windows\System\cMXefhg.exe
  2⤵
  PID:10048
- C:\Windows\System\lhEhEDK.exe
  C:\Windows\System\lhEhEDK.exe
  2⤵
  PID:10092
- C:\Windows\System\KmcKhBn.exe
  C:\Windows\System\KmcKhBn.exe
  2⤵
  PID:10116
- C:\Windows\System\CfvxgFH.exe
  C:\Windows\System\CfvxgFH.exe
  2⤵
  PID:10144
- C:\Windows\System\UyHiYkU.exe
  C:\Windows\System\UyHiYkU.exe
  2⤵
  PID:10164
- C:\Windows\System\QzoXQXF.exe
  C:\Windows\System\QzoXQXF.exe
  2⤵
  PID:10188
- C:\Windows\System\cCRgZLH.exe
  C:\Windows\System\cCRgZLH.exe
  2⤵
  PID:4648
- C:\Windows\System\eVmmrtf.exe
  C:\Windows\System\eVmmrtf.exe
  2⤵
  PID:8648
- C:\Windows\System\wkUqJes.exe
  C:\Windows\System\wkUqJes.exe
  2⤵
  PID:9132
- C:\Windows\System\HIDJsEy.exe
  C:\Windows\System\HIDJsEy.exe
  2⤵
  PID:9544
- C:\Windows\System\vGmdesY.exe
  C:\Windows\System\vGmdesY.exe
  2⤵
  PID:9584
- C:\Windows\System\TUhViAz.exe
  C:\Windows\System\TUhViAz.exe
  2⤵
  PID:9620
- C:\Windows\System\efNuuoO.exe
  C:\Windows\System\efNuuoO.exe
  2⤵
  PID:9760
- C:\Windows\System\buDBzZd.exe
  C:\Windows\System\buDBzZd.exe
  2⤵
  PID:10000
- C:\Windows\System\LyfrrGq.exe
  C:\Windows\System\LyfrrGq.exe
  2⤵
  PID:10044
- C:\Windows\System\YlgBEfO.exe
  C:\Windows\System\YlgBEfO.exe
  2⤵
  PID:10076
- C:\Windows\System\NObziuq.exe
  C:\Windows\System\NObziuq.exe
  2⤵
  PID:9484
- C:\Windows\System\BPTfYov.exe
  C:\Windows\System\BPTfYov.exe
  2⤵
  PID:9252
- C:\Windows\System\pZWnvod.exe
  C:\Windows\System\pZWnvod.exe
  2⤵
  PID:9732
- C:\Windows\System\DHkGLkY.exe
  C:\Windows\System\DHkGLkY.exe
  2⤵
  PID:9920
- C:\Windows\System\lAgZEDL.exe
  C:\Windows\System\lAgZEDL.exe
  2⤵
  PID:3148
- C:\Windows\System\LJhQoUP.exe
  C:\Windows\System\LJhQoUP.exe
  2⤵
  PID:4924
- C:\Windows\System\BTicMPy.exe
  C:\Windows\System\BTicMPy.exe
  2⤵
  PID:8996
- C:\Windows\System\VselMAu.exe
  C:\Windows\System\VselMAu.exe
  2⤵
  PID:6164
- C:\Windows\System\bujSrER.exe
  C:\Windows\System\bujSrER.exe
  2⤵
  PID:9568
- C:\Windows\System\BLnebei.exe
  C:\Windows\System\BLnebei.exe
  2⤵
  PID:10196
- C:\Windows\System\BsuuVXL.exe
  C:\Windows\System\BsuuVXL.exe
  2⤵
  PID:5328
- C:\Windows\System\XdUDrty.exe
  C:\Windows\System\XdUDrty.exe
  2⤵
  PID:9456
- C:\Windows\System\LSNIZZB.exe
  C:\Windows\System\LSNIZZB.exe
  2⤵
  PID:10180
- C:\Windows\System\ReXscgn.exe
  C:\Windows\System\ReXscgn.exe
  2⤵
  PID:9896
- C:\Windows\System\gQNAfGA.exe
  C:\Windows\System\gQNAfGA.exe
  2⤵
  PID:9804
- C:\Windows\System\UZUkAOE.exe
  C:\Windows\System\UZUkAOE.exe
  2⤵
  PID:6608
- C:\Windows\System\bKtaHUs.exe
  C:\Windows\System\bKtaHUs.exe
  2⤵
  PID:9444
- C:\Windows\System\VGZunwW.exe
  C:\Windows\System\VGZunwW.exe
  2⤵
  PID:10064
- C:\Windows\System\ufYTPKk.exe
  C:\Windows\System\ufYTPKk.exe
  2⤵
  PID:9064
- C:\Windows\System\nKIAvjD.exe
  C:\Windows\System\nKIAvjD.exe
  2⤵
  PID:10252
- C:\Windows\System\eUtXaxm.exe
  C:\Windows\System\eUtXaxm.exe
  2⤵
  PID:10272
- C:\Windows\System\EHClqaM.exe
  C:\Windows\System\EHClqaM.exe
  2⤵
  PID:10292
- C:\Windows\System\DGeLvAz.exe
  C:\Windows\System\DGeLvAz.exe
  2⤵
  PID:10312
- C:\Windows\System\gKNYmPR.exe
  C:\Windows\System\gKNYmPR.exe
  2⤵
  PID:10336
- C:\Windows\System\PKZNHii.exe
  C:\Windows\System\PKZNHii.exe
  2⤵
  PID:10412
- C:\Windows\System\ZfiOzWt.exe
  C:\Windows\System\ZfiOzWt.exe
  2⤵
  PID:10448
- C:\Windows\System\ZaYbOYN.exe
  C:\Windows\System\ZaYbOYN.exe
  2⤵
  PID:10468
- C:\Windows\System\LMWVOhw.exe
  C:\Windows\System\LMWVOhw.exe
  2⤵
  PID:10512
- C:\Windows\System\znMgZxq.exe
  C:\Windows\System\znMgZxq.exe
  2⤵
  PID:10528
- C:\Windows\System\FzOsyGJ.exe
  C:\Windows\System\FzOsyGJ.exe
  2⤵
  PID:10564
- C:\Windows\System\dcObVwR.exe
  C:\Windows\System\dcObVwR.exe
  2⤵
  PID:10588
- C:\Windows\System\fCqOmmC.exe
  C:\Windows\System\fCqOmmC.exe
  2⤵
  PID:10612
- C:\Windows\System\jlQkmUI.exe
  C:\Windows\System\jlQkmUI.exe
  2⤵
  PID:10636
- C:\Windows\System\fhhfvjj.exe
  C:\Windows\System\fhhfvjj.exe
  2⤵
  PID:10676
- C:\Windows\System\WzYZIzS.exe
  C:\Windows\System\WzYZIzS.exe
  2⤵
  PID:10700
- C:\Windows\System\ohUhIiJ.exe
  C:\Windows\System\ohUhIiJ.exe
  2⤵
  PID:10720
- C:\Windows\System\fLRsfVr.exe
  C:\Windows\System\fLRsfVr.exe
  2⤵
  PID:10740
- C:\Windows\System\DrjZEeF.exe
  C:\Windows\System\DrjZEeF.exe
  2⤵
  PID:10756
- C:\Windows\System\gAWnAaE.exe
  C:\Windows\System\gAWnAaE.exe
  2⤵
  PID:10864
- C:\Windows\System\xzQwSRR.exe
  C:\Windows\System\xzQwSRR.exe
  2⤵
  PID:10924
- C:\Windows\System\ctdCoNP.exe
  C:\Windows\System\ctdCoNP.exe
  2⤵
  PID:10952
- C:\Windows\System\jXXeHgX.exe
  C:\Windows\System\jXXeHgX.exe
  2⤵
  PID:10976
- C:\Windows\System\FTxTHzZ.exe
  C:\Windows\System\FTxTHzZ.exe
  2⤵
  PID:11040
- C:\Windows\System\wjsLVlt.exe
  C:\Windows\System\wjsLVlt.exe
  2⤵
  PID:11060
- C:\Windows\System\fsxmrYe.exe
  C:\Windows\System\fsxmrYe.exe
  2⤵
  PID:11116
- C:\Windows\System\XYmjkyh.exe
  C:\Windows\System\XYmjkyh.exe
  2⤵
  PID:11140
- C:\Windows\System\qIlMmCI.exe
  C:\Windows\System\qIlMmCI.exe
  2⤵
  PID:11168
- C:\Windows\System\fwvvDck.exe
  C:\Windows\System\fwvvDck.exe
  2⤵
  PID:11192
- C:\Windows\System\VtMXHuI.exe
  C:\Windows\System\VtMXHuI.exe
  2⤵
  PID:11212
- C:\Windows\System\EoqMAHp.exe
  C:\Windows\System\EoqMAHp.exe
  2⤵
  PID:9644
- C:\Windows\System\dDQeQvG.exe
  C:\Windows\System\dDQeQvG.exe
  2⤵
  PID:1480
- C:\Windows\System\lgrxfNr.exe
  C:\Windows\System\lgrxfNr.exe
  2⤵
  PID:10396
- C:\Windows\System\mPfbVjH.exe
  C:\Windows\System\mPfbVjH.exe
  2⤵
  PID:9784
- C:\Windows\System\IyRnzGR.exe
  C:\Windows\System\IyRnzGR.exe
  2⤵
  PID:10344
- C:\Windows\System\dCyzzXZ.exe
  C:\Windows\System\dCyzzXZ.exe
  2⤵
  PID:10476
- C:\Windows\System\sMCttTr.exe
  C:\Windows\System\sMCttTr.exe
  2⤵
  PID:2332
- C:\Windows\System\AtSdFPQ.exe
  C:\Windows\System\AtSdFPQ.exe
  2⤵
  PID:10484
- C:\Windows\System\DfPXHou.exe
  C:\Windows\System\DfPXHou.exe
  2⤵
  PID:10652
- C:\Windows\System\jdGgLIR.exe
  C:\Windows\System\jdGgLIR.exe
  2⤵
  PID:10560
- C:\Windows\System\xtWdKwH.exe
  C:\Windows\System\xtWdKwH.exe
  2⤵
  PID:10708
- C:\Windows\System\BTgNbZO.exe
  C:\Windows\System\BTgNbZO.exe
  2⤵
  PID:10544
- C:\Windows\System\qUsiLru.exe
  C:\Windows\System\qUsiLru.exe
  2⤵
  PID:10792
- C:\Windows\System\zjEDGbv.exe
  C:\Windows\System\zjEDGbv.exe
  2⤵
  PID:10608
- C:\Windows\System\nhbbEkj.exe
  C:\Windows\System\nhbbEkj.exe
  2⤵
  PID:10736
- C:\Windows\System\akOtVKR.exe
  C:\Windows\System\akOtVKR.exe
  2⤵
  PID:10920
- C:\Windows\System\KitFuNA.exe
  C:\Windows\System\KitFuNA.exe
  2⤵
  PID:10876
- C:\Windows\System\JKvDBCH.exe
  C:\Windows\System\JKvDBCH.exe
  2⤵
  PID:10912
- C:\Windows\System\gMMlLlp.exe
  C:\Windows\System\gMMlLlp.exe
  2⤵
  PID:11000
- C:\Windows\System\lpeAGeq.exe
  C:\Windows\System\lpeAGeq.exe
  2⤵
  PID:11028
- C:\Windows\System\WzMGZmh.exe
  C:\Windows\System\WzMGZmh.exe
  2⤵
  PID:11124
- C:\Windows\System\FQOoQAy.exe
  C:\Windows\System\FQOoQAy.exe
  2⤵
  PID:11204
- C:\Windows\System\hFYxeRe.exe
  C:\Windows\System\hFYxeRe.exe
  2⤵
  PID:10248
- C:\Windows\System\vzmgCKn.exe
  C:\Windows\System\vzmgCKn.exe
  2⤵
  PID:10304
- C:\Windows\System\qddnyCm.exe
  C:\Windows\System\qddnyCm.exe
  2⤵
  PID:10668
- C:\Windows\System\OUbCddA.exe
  C:\Windows\System\OUbCddA.exe
  2⤵
  PID:10820
- C:\Windows\System\JfYAZzP.exe
  C:\Windows\System\JfYAZzP.exe
  2⤵
  PID:9324
- C:\Windows\System\LbZdslt.exe
  C:\Windows\System\LbZdslt.exe
  2⤵
  PID:10684
- C:\Windows\System\aybWgRD.exe
  C:\Windows\System\aybWgRD.exe
  2⤵
  PID:10752
- C:\Windows\System\JoDuBCd.exe
  C:\Windows\System\JoDuBCd.exe
  2⤵
  PID:1780
- C:\Windows\System\CkCFtHn.exe
  C:\Windows\System\CkCFtHn.exe
  2⤵
  PID:10848
- C:\Windows\System\MyPeAnB.exe
  C:\Windows\System\MyPeAnB.exe
  2⤵
  PID:4412
- C:\Windows\System\uUPufgO.exe
  C:\Windows\System\uUPufgO.exe
  2⤵
  PID:10524
- C:\Windows\System\LiEUpXz.exe
  C:\Windows\System\LiEUpXz.exe
  2⤵
  PID:10648
- C:\Windows\System\dagxvrL.exe
  C:\Windows\System\dagxvrL.exe
  2⤵
  PID:10600
- C:\Windows\System\IHPLlmQ.exe
  C:\Windows\System\IHPLlmQ.exe
  2⤵
  PID:11276
- C:\Windows\System\LNUbLix.exe
  C:\Windows\System\LNUbLix.exe
  2⤵
  PID:11300
- C:\Windows\System\JKwuMiU.exe
  C:\Windows\System\JKwuMiU.exe
  2⤵
  PID:11324
- C:\Windows\System\NGrffdg.exe
  C:\Windows\System\NGrffdg.exe
  2⤵
  PID:11344
- C:\Windows\System\JdOoCmV.exe
  C:\Windows\System\JdOoCmV.exe
  2⤵
  PID:11364
- C:\Windows\System\WHbHwLI.exe
  C:\Windows\System\WHbHwLI.exe
  2⤵
  PID:11384
- C:\Windows\System\RUYxshU.exe
  C:\Windows\System\RUYxshU.exe
  2⤵
  PID:11408
- C:\Windows\System\nGccgjC.exe
  C:\Windows\System\nGccgjC.exe
  2⤵
  PID:11432
- C:\Windows\System\ddCElmr.exe
  C:\Windows\System\ddCElmr.exe
  2⤵
  PID:11456
- C:\Windows\System\CvauZso.exe
  C:\Windows\System\CvauZso.exe
  2⤵
  PID:11476
- C:\Windows\System\ZsSwAJf.exe
  C:\Windows\System\ZsSwAJf.exe
  2⤵
  PID:11496
- C:\Windows\System\ySlmHoR.exe
  C:\Windows\System\ySlmHoR.exe
  2⤵
  PID:11512
- C:\Windows\System\JSgczct.exe
  C:\Windows\System\JSgczct.exe
  2⤵
  PID:11532
- C:\Windows\System\bjeWosE.exe
  C:\Windows\System\bjeWosE.exe
  2⤵
  PID:11552
- C:\Windows\System\wiglZQs.exe
  C:\Windows\System\wiglZQs.exe
  2⤵
  PID:11580
- C:\Windows\System\Ytrmgiz.exe
  C:\Windows\System\Ytrmgiz.exe
  2⤵
  PID:11596
- C:\Windows\System\TpgXjOV.exe
  C:\Windows\System\TpgXjOV.exe
  2⤵
  PID:11920
- C:\Windows\System\mIktrZF.exe
  C:\Windows\System\mIktrZF.exe
  2⤵
  PID:11952
- C:\Windows\System\SKYjnBH.exe
  C:\Windows\System\SKYjnBH.exe
  2⤵
  PID:11976
- C:\Windows\System\sSIBwBN.exe
  C:\Windows\System\sSIBwBN.exe
  2⤵
  PID:11996
- C:\Windows\System\ZLSsyKh.exe
  C:\Windows\System\ZLSsyKh.exe
  2⤵
  PID:12016
- C:\Windows\System\uerZxuG.exe
  C:\Windows\System\uerZxuG.exe
  2⤵
  PID:12036
- C:\Windows\System\aHruQxP.exe
  C:\Windows\System\aHruQxP.exe
  2⤵
  PID:12056
- C:\Windows\System\beRmhVx.exe
  C:\Windows\System\beRmhVx.exe
  2⤵
  PID:12072
- C:\Windows\System\WYAULEC.exe
  C:\Windows\System\WYAULEC.exe
  2⤵
  PID:12100
- C:\Windows\System\umoxjeN.exe
  C:\Windows\System\umoxjeN.exe
  2⤵
  PID:12120
- C:\Windows\System\KvWsEeJ.exe
  C:\Windows\System\KvWsEeJ.exe
  2⤵
  PID:12172
- C:\Windows\System\CLteiVV.exe
  C:\Windows\System\CLteiVV.exe
  2⤵
  PID:12192
- C:\Windows\System\tSPBmKO.exe
  C:\Windows\System\tSPBmKO.exe
  2⤵
  PID:12212
- C:\Windows\System\kZoRpLt.exe
  C:\Windows\System\kZoRpLt.exe
  2⤵
  PID:12236
- C:\Windows\System\owazdWp.exe
  C:\Windows\System\owazdWp.exe
  2⤵
  PID:12256
- C:\Windows\System\erzgyRo.exe
  C:\Windows\System\erzgyRo.exe
  2⤵
  PID:1652
- C:\Windows\System\iujXDyv.exe
  C:\Windows\System\iujXDyv.exe
  2⤵
  PID:10988
- C:\Windows\System\rAmDNWc.exe
  C:\Windows\System\rAmDNWc.exe
  2⤵
  PID:10984
- C:\Windows\System\cnqtVGo.exe
  C:\Windows\System\cnqtVGo.exe
  2⤵
  PID:10596
- C:\Windows\System\WqyhZAd.exe
  C:\Windows\System\WqyhZAd.exe
  2⤵
  PID:11416
- C:\Windows\System\bZqMnuq.exe
  C:\Windows\System\bZqMnuq.exe
  2⤵
  PID:11272
- C:\Windows\System\kLePnjj.exe
  C:\Windows\System\kLePnjj.exe
  2⤵
  PID:7288
- C:\Windows\System\rMahuGx.exe
  C:\Windows\System\rMahuGx.exe
  2⤵
  PID:11356
- C:\Windows\System\OravjUb.exe
  C:\Windows\System\OravjUb.exe
  2⤵
  PID:11716
- C:\Windows\System\TsKunas.exe
  C:\Windows\System\TsKunas.exe
  2⤵
  PID:11796
- C:\Windows\System\gZTAVnF.exe
  C:\Windows\System\gZTAVnF.exe
  2⤵
  PID:11812
- C:\Windows\System\ieAqpkp.exe
  C:\Windows\System\ieAqpkp.exe
  2⤵
  PID:11948
- C:\Windows\System\mBuWvCE.exe
  C:\Windows\System\mBuWvCE.exe
  2⤵
  PID:12064
- C:\Windows\System\EROjXmE.exe
  C:\Windows\System\EROjXmE.exe
  2⤵
  PID:12132
- C:\Windows\System\BfRerex.exe
  C:\Windows\System\BfRerex.exe
  2⤵
  PID:10100
- C:\Windows\System\AHVDIuc.exe
  C:\Windows\System\AHVDIuc.exe
  2⤵
  PID:11152
- C:\Windows\System\EzGoXGn.exe
  C:\Windows\System\EzGoXGn.exe
  2⤵
  PID:12220
- C:\Windows\System\GnHDDRz.exe
  C:\Windows\System\GnHDDRz.exe
  2⤵
  PID:12264
- C:\Windows\System\FHxZNqB.exe
  C:\Windows\System\FHxZNqB.exe
  2⤵
  PID:11260
- C:\Windows\System\bLWzghL.exe
  C:\Windows\System\bLWzghL.exe
  2⤵
  PID:10908
- C:\Windows\System\hxTSPQR.exe
  C:\Windows\System\hxTSPQR.exe
  2⤵
  PID:10716
- C:\Windows\System\arSmTdh.exe
  C:\Windows\System\arSmTdh.exe
  2⤵
  PID:11508
- C:\Windows\System\uVGRipM.exe
  C:\Windows\System\uVGRipM.exe
  2⤵
  PID:11404
- C:\Windows\System\PEpjAjo.exe
  C:\Windows\System\PEpjAjo.exe
  2⤵
  PID:10024
- C:\Windows\System\CDICMNW.exe
  C:\Windows\System\CDICMNW.exe
  2⤵
  PID:11888
- C:\Windows\System\VPXUYZx.exe
  C:\Windows\System\VPXUYZx.exe
  2⤵
  PID:11988
- C:\Windows\System\TWDpSMf.exe
  C:\Windows\System\TWDpSMf.exe
  2⤵
  PID:12084
- C:\Windows\System\ctzPTqi.exe
  C:\Windows\System\ctzPTqi.exe
  2⤵
  PID:2232
- C:\Windows\System\BzVCBEe.exe
  C:\Windows\System\BzVCBEe.exe
  2⤵
  PID:4216
- C:\Windows\System\BzCKQLZ.exe
  C:\Windows\System\BzCKQLZ.exe
  2⤵
  PID:808
- C:\Windows\System\hrUkETX.exe
  C:\Windows\System\hrUkETX.exe
  2⤵
  PID:12252
- C:\Windows\System\ARkZWNI.exe
  C:\Windows\System\ARkZWNI.exe
  2⤵
  PID:2540
- C:\Windows\System\BvnxiaV.exe
  C:\Windows\System\BvnxiaV.exe
  2⤵
  PID:11488
- C:\Windows\System\xCxGpGe.exe
  C:\Windows\System\xCxGpGe.exe
  2⤵
  PID:5076
- C:\Windows\System\TnmmOzy.exe
  C:\Windows\System\TnmmOzy.exe
  2⤵
  PID:11708
- C:\Windows\System\tEKXEbq.exe
  C:\Windows\System\tEKXEbq.exe
  2⤵
  PID:12128
- C:\Windows\System\hunzzMm.exe
  C:\Windows\System\hunzzMm.exe
  2⤵
  PID:2428
- C:\Windows\System\eTYoQgU.exe
  C:\Windows\System\eTYoQgU.exe
  2⤵
  PID:4468
- C:\Windows\System\dUguSEk.exe
  C:\Windows\System\dUguSEk.exe
  2⤵
  PID:11180
- C:\Windows\System\dvlsMXt.exe
  C:\Windows\System\dvlsMXt.exe
  2⤵
  PID:1332
- C:\Windows\System\llmJDFF.exe
  C:\Windows\System\llmJDFF.exe
  2⤵
  PID:12308
- C:\Windows\System\CZzrqLh.exe
  C:\Windows\System\CZzrqLh.exe
  2⤵
  PID:12336
- C:\Windows\System\KDLAevn.exe
  C:\Windows\System\KDLAevn.exe
  2⤵
  PID:12352
- C:\Windows\System\SSFVYtN.exe
  C:\Windows\System\SSFVYtN.exe
  2⤵
  PID:12588
- C:\Windows\System\FqpgjDb.exe
  C:\Windows\System\FqpgjDb.exe
  2⤵
  PID:12608
- C:\Windows\System\rooFypR.exe
  C:\Windows\System\rooFypR.exe
  2⤵
  PID:12624
- C:\Windows\System\RvuwygG.exe
  C:\Windows\System\RvuwygG.exe
  2⤵
  PID:12652
- C:\Windows\System\REoyjWM.exe
  C:\Windows\System\REoyjWM.exe
  2⤵
  PID:12672
- C:\Windows\System\bjZaVLO.exe
  C:\Windows\System\bjZaVLO.exe
  2⤵
  PID:12692
- C:\Windows\System\FIPZGeM.exe
  C:\Windows\System\FIPZGeM.exe
  2⤵
  PID:12712
- C:\Windows\System\FdVWTNP.exe
  C:\Windows\System\FdVWTNP.exe
  2⤵
  PID:12732
- C:\Windows\System\KixtNYD.exe
  C:\Windows\System\KixtNYD.exe
  2⤵
  PID:12748
- C:\Windows\System\WsRWEWQ.exe
  C:\Windows\System\WsRWEWQ.exe
  2⤵
  PID:12768
- C:\Windows\System\mZFjCMO.exe
  C:\Windows\System\mZFjCMO.exe
  2⤵
  PID:12788
- C:\Windows\System\GChbqHu.exe
  C:\Windows\System\GChbqHu.exe
  2⤵
  PID:12820
- C:\Windows\System\HutBEMp.exe
  C:\Windows\System\HutBEMp.exe
  2⤵
  PID:12836
- C:\Windows\System\RvjAiQy.exe
  C:\Windows\System\RvjAiQy.exe
  2⤵
  PID:12868
- C:\Windows\System\keikGwP.exe
  C:\Windows\System\keikGwP.exe
  2⤵
  PID:12888
- C:\Windows\System\lLwpRTZ.exe
  C:\Windows\System\lLwpRTZ.exe
  2⤵
  PID:12908
- C:\Windows\System\MrSWbVj.exe
  C:\Windows\System\MrSWbVj.exe
  2⤵
  PID:12932
- C:\Windows\System\kKEZjoJ.exe
  C:\Windows\System\kKEZjoJ.exe
  2⤵
  PID:12948
- C:\Windows\System\KybcyDI.exe
  C:\Windows\System\KybcyDI.exe
  2⤵
  PID:12980
- C:\Windows\System\iXBgdWP.exe
  C:\Windows\System\iXBgdWP.exe
  2⤵
  PID:13000
- C:\Windows\System\AFFdgvO.exe
  C:\Windows\System\AFFdgvO.exe
  2⤵
  PID:13060
- C:\Windows\System\RrhBiIG.exe
  C:\Windows\System\RrhBiIG.exe
  2⤵
  PID:13164
- C:\Windows\System\gjNpAUI.exe
  C:\Windows\System\gjNpAUI.exe
  2⤵
  PID:13196
- C:\Windows\System\HRJdVQK.exe
  C:\Windows\System\HRJdVQK.exe
  2⤵
  PID:13224
- C:\Windows\System\NOxmUwE.exe
  C:\Windows\System\NOxmUwE.exe
  2⤵
  PID:13272
- C:\Windows\System\pkwhgyn.exe
  C:\Windows\System\pkwhgyn.exe
  2⤵
  PID:13292
- C:\Windows\System\KhDsgrM.exe
  C:\Windows\System\KhDsgrM.exe
  2⤵
  PID:11544
- C:\Windows\System\ctxBayB.exe
  C:\Windows\System\ctxBayB.exe
  2⤵
  PID:1492
- C:\Windows\System\jSkePlN.exe
  C:\Windows\System\jSkePlN.exe
  2⤵
  PID:10288
- C:\Windows\System\pIVsIzg.exe
  C:\Windows\System\pIVsIzg.exe
  2⤵
  PID:1516
- C:\Windows\System\nmSWoLu.exe
  C:\Windows\System\nmSWoLu.exe
  2⤵
  PID:12320
- C:\Windows\System\HjfrVdf.exe
  C:\Windows\System\HjfrVdf.exe
  2⤵
  PID:2996
- C:\Windows\System\WHXUcdA.exe
  C:\Windows\System\WHXUcdA.exe
  2⤵
  PID:12380
- C:\Windows\System\OxnWrCQ.exe
  C:\Windows\System\OxnWrCQ.exe
  2⤵
  PID:12452
- C:\Windows\System\uuXezdJ.exe
  C:\Windows\System\uuXezdJ.exe
  2⤵
  PID:3856
- C:\Windows\System\meMpduc.exe
  C:\Windows\System\meMpduc.exe
  2⤵
  PID:12512
- C:\Windows\System\njFQGQs.exe
  C:\Windows\System\njFQGQs.exe
  2⤵
  PID:1096
- C:\Windows\System\BMTdcOf.exe
  C:\Windows\System\BMTdcOf.exe
  2⤵
  PID:4196
- C:\Windows\System\tfYoMXE.exe
  C:\Windows\System\tfYoMXE.exe
  2⤵
  PID:1692
- C:\Windows\System\MQTFiHF.exe
  C:\Windows\System\MQTFiHF.exe
  2⤵
  PID:2812
- C:\Windows\System\YzNcduq.exe
  C:\Windows\System\YzNcduq.exe
  2⤵
  PID:12556
- C:\Windows\System\KxPwywU.exe
  C:\Windows\System\KxPwywU.exe
  2⤵
  PID:12688
- C:\Windows\System\GfzJKXl.exe
  C:\Windows\System\GfzJKXl.exe
  2⤵
  PID:12704
- C:\Windows\System\ryObdoC.exe
  C:\Windows\System\ryObdoC.exe
  2⤵
  PID:3004
- C:\Windows\System\cPIUFcj.exe
  C:\Windows\System\cPIUFcj.exe
  2⤵
  PID:12744
- C:\Windows\System\BNioLaa.exe
  C:\Windows\System\BNioLaa.exe
  2⤵
  PID:11940
- C:\Windows\System\wVEYhvk.exe
  C:\Windows\System\wVEYhvk.exe
  2⤵
  PID:13172
- C:\Windows\System\jnyFUXw.exe
  C:\Windows\System\jnyFUXw.exe
  2⤵
  PID:13216
- C:\Windows\System\BlntfHM.exe
  C:\Windows\System\BlntfHM.exe
  2⤵
  PID:12208
- C:\Windows\System\HSvHyzK.exe
  C:\Windows\System\HSvHyzK.exe
  2⤵
  PID:12180
- C:\Windows\System\zcYFQyg.exe
  C:\Windows\System\zcYFQyg.exe
  2⤵
  PID:3676
- C:\Windows\System\eQzGLtE.exe
  C:\Windows\System\eQzGLtE.exe
  2⤵
  PID:12916
- C:\Windows\System\ZdpwsVw.exe
  C:\Windows\System\ZdpwsVw.exe
  2⤵
  PID:4244
- C:\Windows\System\NsYSSHf.exe
  C:\Windows\System\NsYSSHf.exe
  2⤵
  PID:1188
- C:\Windows\System\srddClu.exe
  C:\Windows\System\srddClu.exe
  2⤵
  PID:12664
- C:\Windows\System\JenXDSL.exe
  C:\Windows\System\JenXDSL.exe
  2⤵
  PID:12604
- C:\Windows\System\JIIIiXn.exe
  C:\Windows\System\JIIIiXn.exe
  2⤵
  PID:13116
- C:\Windows\System\hSCtDYG.exe
  C:\Windows\System\hSCtDYG.exe
  2⤵
  PID:12780
- C:\Windows\System\hQStIss.exe
  C:\Windows\System\hQStIss.exe
  2⤵
  PID:4004
- C:\Windows\System\BQOyAMo.exe
  C:\Windows\System\BQOyAMo.exe
  2⤵
  PID:5344
- C:\Windows\System\WCEJpQb.exe
  C:\Windows\System\WCEJpQb.exe
  2⤵
  PID:1372
- C:\Windows\System\ObEMMrH.exe
  C:\Windows\System\ObEMMrH.exe
  2⤵
  PID:12844
- C:\Windows\System\RPDnqgf.exe
  C:\Windows\System\RPDnqgf.exe
  2⤵
  PID:11916
- C:\Windows\System\itUCNCc.exe
  C:\Windows\System\itUCNCc.exe
  2⤵
  PID:2440
- C:\Windows\System\JpOzzRx.exe
  C:\Windows\System\JpOzzRx.exe
  2⤵
  PID:884
- C:\Windows\System\lvLRnRv.exe
  C:\Windows\System\lvLRnRv.exe
  2⤵
  PID:13100
- C:\Windows\System\npnuDsG.exe
  C:\Windows\System\npnuDsG.exe
  2⤵
  PID:12044
- C:\Windows\System\YgYORXo.exe
  C:\Windows\System\YgYORXo.exe
  2⤵
  PID:12884
- C:\Windows\System\bMkWjFC.exe
  C:\Windows\System\bMkWjFC.exe
  2⤵
  PID:12648
- C:\Windows\System\YQDNjWC.exe
  C:\Windows\System\YQDNjWC.exe
  2⤵
  PID:12600
- C:\Windows\System\YFJfKns.exe
  C:\Windows\System\YFJfKns.exe
  2⤵
  PID:11984
- C:\Windows\System\hDdKzAJ.exe
  C:\Windows\System\hDdKzAJ.exe
  2⤵
  PID:1956
- C:\Windows\System\iNLPfMe.exe
  C:\Windows\System\iNLPfMe.exe
  2⤵
  PID:2308
- C:\Windows\System\WuUdaOw.exe
  C:\Windows\System\WuUdaOw.exe
  2⤵
  PID:12680
- C:\Windows\System\ZqRQUBA.exe
  C:\Windows\System\ZqRQUBA.exe
  2⤵
  PID:12616
- C:\Windows\System\JuMXkcw.exe
  C:\Windows\System\JuMXkcw.exe
  2⤵
  PID:1876
- C:\Windows\System\KnAGCTP.exe
  C:\Windows\System\KnAGCTP.exe
  2⤵
  PID:13380
- C:\Windows\System\XpaKwdd.exe
  C:\Windows\System\XpaKwdd.exe
  2⤵
  PID:13428
- C:\Windows\System\oGFYLsT.exe
  C:\Windows\System\oGFYLsT.exe
  2⤵
  PID:13480
- C:\Windows\System\eDTrtKD.exe
  C:\Windows\System\eDTrtKD.exe
  2⤵
  PID:13764
- C:\Windows\System\xUJVbBg.exe
  C:\Windows\System\xUJVbBg.exe
  2⤵
  PID:13792
- C:\Windows\System\rizUOFg.exe
  C:\Windows\System\rizUOFg.exe
  2⤵
  PID:13820
- C:\Windows\System\opyAdIu.exe
  C:\Windows\System\opyAdIu.exe
  2⤵
  PID:13840
- C:\Windows\System\OTMiZqD.exe
  C:\Windows\System\OTMiZqD.exe
  2⤵
  PID:13864
- C:\Windows\System\qAvHzLt.exe
  C:\Windows\System\qAvHzLt.exe
  2⤵
  PID:14008
- C:\Windows\System\ppsjYul.exe
  C:\Windows\System\ppsjYul.exe
  2⤵
  PID:14136
- C:\Windows\System\qcUTszj.exe
  C:\Windows\System\qcUTszj.exe
  2⤵
  PID:14156
- C:\Windows\System\CaZEHzE.exe
  C:\Windows\System\CaZEHzE.exe
  2⤵
  PID:14172
- C:\Windows\System\aOkpCWW.exe
  C:\Windows\System\aOkpCWW.exe
  2⤵
  PID:14188
- C:\Windows\System\ZtEAuMY.exe
  C:\Windows\System\ZtEAuMY.exe
  2⤵
  PID:14236
- C:\Windows\System\GqygZEI.exe
  C:\Windows\System\GqygZEI.exe
  2⤵
  PID:14256
- C:\Windows\System\qwyoetg.exe
  C:\Windows\System\qwyoetg.exe
  2⤵
  PID:14272
- C:\Windows\System\mTMtWZj.exe
  C:\Windows\System\mTMtWZj.exe
  2⤵
  PID:14288
- C:\Windows\System\NjNCtOS.exe
  C:\Windows\System\NjNCtOS.exe
  2⤵
  PID:14304
- C:\Windows\System\FrZIJyN.exe
  C:\Windows\System\FrZIJyN.exe
  2⤵
  PID:14320
- C:\Windows\System\rilBSpe.exe
  C:\Windows\System\rilBSpe.exe
  2⤵
  PID:3128
- C:\Windows\System\ukTcNwo.exe
  C:\Windows\System\ukTcNwo.exe
  2⤵
  PID:10328
- C:\Windows\System\wQuOPgm.exe
  C:\Windows\System\wQuOPgm.exe
  2⤵
  PID:12344
- C:\Windows\System\kmmKfsv.exe
  C:\Windows\System\kmmKfsv.exe
  2⤵
  PID:13068
- C:\Windows\System\kfrcncF.exe
  C:\Windows\System\kfrcncF.exe
  2⤵
  PID:13340
- C:\Windows\System\knXcVGS.exe
  C:\Windows\System\knXcVGS.exe
  2⤵
  PID:12568
- C:\Windows\System\YxdNQjB.exe
  C:\Windows\System\YxdNQjB.exe
  2⤵
  PID:13348
- C:\Windows\System\IGtwIlg.exe
  C:\Windows\System\IGtwIlg.exe
  2⤵
  PID:13324
- C:\Windows\System\dDtoBUE.exe
  C:\Windows\System\dDtoBUE.exe
  2⤵
  PID:13392
- C:\Windows\System\BsfcYAK.exe
  C:\Windows\System\BsfcYAK.exe
  2⤵
  PID:13396
- C:\Windows\System\aAkifaF.exe
  C:\Windows\System\aAkifaF.exe
  2⤵
  PID:13460
- C:\Windows\System\JepjVQj.exe
  C:\Windows\System\JepjVQj.exe
  2⤵
  PID:13448
- C:\Windows\System\jriPwqs.exe
  C:\Windows\System\jriPwqs.exe
  2⤵
  PID:13616
- C:\Windows\System\EJTOQHL.exe
  C:\Windows\System\EJTOQHL.exe
  2⤵
  PID:13584
- C:\Windows\System\nfJjXeO.exe
  C:\Windows\System\nfJjXeO.exe
  2⤵
  PID:13620
- C:\Windows\System\pAyWKKs.exe
  C:\Windows\System\pAyWKKs.exe
  2⤵
  PID:13644
- C:\Windows\System\xbglNOX.exe
  C:\Windows\System\xbglNOX.exe
  2⤵
  PID:13664
- C:\Windows\System\zATUEJW.exe
  C:\Windows\System\zATUEJW.exe
  2⤵
  PID:948
- C:\Windows\System\fvhaGEu.exe
  C:\Windows\System\fvhaGEu.exe
  2⤵
  PID:13752
- C:\Windows\System\vaTfofu.exe
  C:\Windows\System\vaTfofu.exe
  2⤵
  PID:13876
- C:\Windows\System\aeotwqm.exe
  C:\Windows\System\aeotwqm.exe
  2⤵
  PID:13888
- C:\Windows\System\okCvCOw.exe
  C:\Windows\System\okCvCOw.exe
  2⤵
  PID:13948
- C:\Windows\System\epgYYrq.exe
  C:\Windows\System\epgYYrq.exe
  2⤵
  PID:14060
- C:\Windows\System\XEqUczm.exe
  C:\Windows\System\XEqUczm.exe
  2⤵
  PID:13992
- C:\Windows\System\BsNYCIA.exe
  C:\Windows\System\BsNYCIA.exe
  2⤵
  PID:14312
- C:\Windows\System\NyJeNNS.exe
  C:\Windows\System\NyJeNNS.exe
  2⤵
  PID:14184
- C:\Windows\System\OlIvZWU.exe
  C:\Windows\System\OlIvZWU.exe
  2⤵
  PID:13244
- C:\Windows\System\Ugpmzix.exe
  C:\Windows\System\Ugpmzix.exe
  2⤵
  PID:13512
- C:\Windows\System\DeKVHJv.exe
  C:\Windows\System\DeKVHJv.exe
  2⤵
  PID:14220
- C:\Windows\System\uEZIpSv.exe
  C:\Windows\System\uEZIpSv.exe
  2⤵
  PID:14268
- C:\Windows\System\mEwfLny.exe
  C:\Windows\System\mEwfLny.exe
  2⤵
  PID:14124
- C:\Windows\System\mrwZuxD.exe
  C:\Windows\System\mrwZuxD.exe
  2⤵
  PID:13372
- C:\Windows\System\VwNNZdR.exe
  C:\Windows\System\VwNNZdR.exe
  2⤵
  PID:5180
- C:\Windows\System\EfmVIgn.exe
  C:\Windows\System\EfmVIgn.exe
  2⤵
  PID:13476
- C:\Windows\System\efmdFzl.exe
  C:\Windows\System\efmdFzl.exe
  2⤵
  PID:13712
- C:\Windows\System\muqBQKZ.exe
  C:\Windows\System\muqBQKZ.exe
  2⤵
  PID:5640
- C:\Windows\System\mMqzoKX.exe
  C:\Windows\System\mMqzoKX.exe
  2⤵
  PID:13800
- C:\Windows\System\wnfnsoe.exe
  C:\Windows\System\wnfnsoe.exe
  2⤵
  PID:5608
- C:\Windows\System\ctcFeln.exe
  C:\Windows\System\ctcFeln.exe
  2⤵
  PID:3320
- C:\Windows\System\rMKKmCP.exe
  C:\Windows\System\rMKKmCP.exe
  2⤵
  PID:13748
- C:\Windows\System\fxYKqsu.exe
  C:\Windows\System\fxYKqsu.exe
  2⤵
  PID:14068
- C:\Windows\System\tvLoAOL.exe
  C:\Windows\System\tvLoAOL.exe
  2⤵
  PID:14032
- C:\Windows\System\fMyWYDy.exe
  C:\Windows\System\fMyWYDy.exe
  2⤵
  PID:13708
- C:\Windows\System\kciLQlG.exe
  C:\Windows\System\kciLQlG.exe
  2⤵
  PID:13676
- C:\Windows\System\HyBpKAn.exe
  C:\Windows\System\HyBpKAn.exe
  2⤵
  PID:13772
- C:\Windows\System\TMnfhSX.exe
  C:\Windows\System\TMnfhSX.exe
  2⤵
  PID:13896
- C:\Windows\System\tlZQGMi.exe
  C:\Windows\System\tlZQGMi.exe
  2⤵
  PID:13936
- C:\Windows\System\qxALied.exe
  C:\Windows\System\qxALied.exe
  2⤵
  PID:856
- C:\Windows\System\kFxFdVC.exe
  C:\Windows\System\kFxFdVC.exe
  2⤵
  PID:13964
- C:\Windows\System\eClhtGg.exe
  C:\Windows\System\eClhtGg.exe
  2⤵
  PID:13724
- C:\Windows\System\ZspxjpE.exe
  C:\Windows\System\ZspxjpE.exe
  2⤵
  PID:5212
- C:\Windows\System\WeUFDIw.exe
  C:\Windows\System\WeUFDIw.exe
  2⤵
  PID:5984
- C:\Windows\System\goqACQM.exe
  C:\Windows\System\goqACQM.exe
  2⤵
  PID:6140
- C:\Windows\System\JBuTJas.exe
  C:\Windows\System\JBuTJas.exe
  2⤵
  PID:12620
- C:\Windows\System\GERsHeg.exe
  C:\Windows\System\GERsHeg.exe
  2⤵
  PID:13980
- C:\Windows\System\PnqStwJ.exe
  C:\Windows\System\PnqStwJ.exe
  2⤵
  PID:14016
- C:\Windows\System\GZWLzmg.exe
  C:\Windows\System\GZWLzmg.exe
  2⤵
  PID:6576
- C:\Windows\System\idigSgu.exe
  C:\Windows\System\idigSgu.exe
  2⤵
  PID:5728
- C:\Windows\System\Gzotofr.exe
  C:\Windows\System\Gzotofr.exe
  2⤵
  PID:13920
- C:\Windows\System\JSUmYpW.exe
  C:\Windows\System\JSUmYpW.exe
  2⤵
  PID:1828
- C:\Windows\System\cPazRLv.exe
  C:\Windows\System\cPazRLv.exe
  2⤵
  PID:13968
- C:\Windows\System\PgaHHBl.exe
  C:\Windows\System\PgaHHBl.exe
  2⤵
  PID:2856
- C:\Windows\System\Wfzvheg.exe
  C:\Windows\System\Wfzvheg.exe
  2⤵
  PID:13812
- C:\Windows\System\DAUEAKT.exe
  C:\Windows\System\DAUEAKT.exe
  2⤵
  PID:12464
- C:\Windows\System\VbqtTBh.exe
  C:\Windows\System\VbqtTBh.exe
  2⤵
  PID:3628
- C:\Windows\System\deLtXed.exe
  C:\Windows\System\deLtXed.exe
  2⤵
  PID:5224
- C:\Windows\System\qRJOjGf.exe
  C:\Windows\System\qRJOjGf.exe
  2⤵
  PID:5368
- C:\Windows\System\yVfKeTw.exe
  C:\Windows\System\yVfKeTw.exe
  2⤵
  PID:7056
- C:\Windows\System\cGFTaFm.exe
  C:\Windows\System\cGFTaFm.exe
  2⤵
  PID:13424
- C:\Windows\System\ymIiaGw.exe
  C:\Windows\System\ymIiaGw.exe
  2⤵
  PID:13732
- C:\Windows\System\UlTnHoF.exe
  C:\Windows\System\UlTnHoF.exe
  2⤵
  PID:6720
- C:\Windows\System\xckIJRZ.exe
  C:\Windows\System\xckIJRZ.exe
  2⤵
  PID:6236
- C:\Windows\System\ClNhuaL.exe
  C:\Windows\System\ClNhuaL.exe
  2⤵
  PID:7660
- C:\Windows\System\LDZToAH.exe
  C:\Windows\System\LDZToAH.exe
  2⤵
  PID:376
- C:\Windows\System\uGQWeWw.exe
  C:\Windows\System\uGQWeWw.exe
  2⤵
  PID:13652
- C:\Windows\System\sPlEJQi.exe
  C:\Windows\System\sPlEJQi.exe
  2⤵
  PID:1444
- C:\Windows\System\cOlXvOK.exe
  C:\Windows\System\cOlXvOK.exe
  2⤵
  PID:5168
- C:\Windows\System\uwIsYOg.exe
  C:\Windows\System\uwIsYOg.exe
  2⤵
  PID:5436
- C:\Windows\System\CRmelYQ.exe
  C:\Windows\System\CRmelYQ.exe
  2⤵
  PID:13848
- C:\Windows\System\jlrVFIh.exe
  C:\Windows\System\jlrVFIh.exe
  2⤵
  PID:5360
- C:\Windows\System\jRWGcAP.exe
  C:\Windows\System\jRWGcAP.exe
  2⤵
  PID:13780
- C:\Windows\System\AMYKmJJ.exe
  C:\Windows\System\AMYKmJJ.exe
  2⤵
  PID:6660
- C:\Windows\System\NKNguVV.exe
  C:\Windows\System\NKNguVV.exe
  2⤵
  PID:11024
- C:\Windows\System\CTCYjPe.exe
  C:\Windows\System\CTCYjPe.exe
  2⤵
  PID:5848
- C:\Windows\System\FcXUpEv.exe
  C:\Windows\System\FcXUpEv.exe
  2⤵
  PID:3836
- C:\Windows\System\oUDncOi.exe
  C:\Windows\System\oUDncOi.exe
  2⤵
  PID:8116
- C:\Windows\System\OLWDWwZ.exe
  C:\Windows\System\OLWDWwZ.exe
  2⤵
  PID:13996
- C:\Windows\System\kUeVjRn.exe
  C:\Windows\System\kUeVjRn.exe
  2⤵
  PID:14128
- C:\Windows\System\WvhhGNU.exe
  C:\Windows\System\WvhhGNU.exe
  2⤵
  PID:13716
- C:\Windows\System\QzxkIyO.exe
  C:\Windows\System\QzxkIyO.exe
  2⤵
  PID:6196
- C:\Windows\System\avMfiqw.exe
  C:\Windows\System\avMfiqw.exe
  2⤵
  PID:6868
- C:\Windows\System\BmZzMar.exe
  C:\Windows\System\BmZzMar.exe
  2⤵
  PID:7976
- C:\Windows\System\atUWfGh.exe
  C:\Windows\System\atUWfGh.exe
  2⤵
  PID:6436
- C:\Windows\System\dJfAQTL.exe
  C:\Windows\System\dJfAQTL.exe
  2⤵
  PID:4656
- C:\Windows\System\NHFHsAJ.exe
  C:\Windows\System\NHFHsAJ.exe
  2⤵
  PID:6200
- C:\Windows\System\vgfXMrY.exe
  C:\Windows\System\vgfXMrY.exe
  2⤵
  PID:5204
- C:\Windows\System\MDUmOXx.exe
  C:\Windows\System\MDUmOXx.exe
  2⤵
  PID:6180
- C:\Windows\System\CkoUCbl.exe
  C:\Windows\System\CkoUCbl.exe
  2⤵
  PID:6396
- C:\Windows\System\WeahMnS.exe
  C:\Windows\System\WeahMnS.exe
  2⤵
  PID:8048
- C:\Windows\System\yuPRfCd.exe
  C:\Windows\System\yuPRfCd.exe
  2⤵
  PID:1156
- C:\Windows\System\MzpzzaA.exe
  C:\Windows\System\MzpzzaA.exe
  2⤵
  PID:7960
- C:\Windows\System\pBCfZIo.exe
  C:\Windows\System\pBCfZIo.exe
  2⤵
  PID:5864
- C:\Windows\System\ODZvzyg.exe
  C:\Windows\System\ODZvzyg.exe
  2⤵
  PID:5508
- C:\Windows\System\FrRttbM.exe
  C:\Windows\System\FrRttbM.exe
  2⤵
  PID:6876
- C:\Windows\System\inNlAsI.exe
  C:\Windows\System\inNlAsI.exe
  2⤵
  PID:8200
- C:\Windows\System\MOOGEtp.exe
  C:\Windows\System\MOOGEtp.exe
  2⤵
  PID:5688
- C:\Windows\System\DcaoImU.exe
  C:\Windows\System\DcaoImU.exe
  2⤵
  PID:5844
- C:\Windows\System\VsCcawg.exe
  C:\Windows\System\VsCcawg.exe
  2⤵
  PID:2864
- C:\Windows\System\TWbiNQo.exe
  C:\Windows\System\TWbiNQo.exe
  2⤵
  PID:5564
- C:\Windows\System\hQfQiqW.exe
  C:\Windows\System\hQfQiqW.exe
  2⤵
  PID:7356
- C:\Windows\System\SSFuelT.exe
  C:\Windows\System\SSFuelT.exe
  2⤵
  PID:7032
- C:\Windows\System\imTqtAg.exe
  C:\Windows\System\imTqtAg.exe
  2⤵
  PID:5620
- C:\Windows\System\yPoOpHI.exe
  C:\Windows\System\yPoOpHI.exe
  2⤵
  PID:7084
- C:\Windows\System\PAqitXf.exe
  C:\Windows\System\PAqitXf.exe
  2⤵
  PID:6480
- C:\Windows\System\BSYLqtq.exe
  C:\Windows\System\BSYLqtq.exe
  2⤵
  PID:14072
- C:\Windows\System\FqnITST.exe
  C:\Windows\System\FqnITST.exe
  2⤵
  PID:5840
- C:\Windows\System\DScXYkM.exe
  C:\Windows\System\DScXYkM.exe
  2⤵
  PID:7984
- C:\Windows\System\XBlXhlQ.exe
  C:\Windows\System\XBlXhlQ.exe
  2⤵
  PID:7820
- C:\Windows\System\DoOdBcH.exe
  C:\Windows\System\DoOdBcH.exe
  2⤵
  PID:6476
- C:\Windows\System\IztDDkA.exe
  C:\Windows\System\IztDDkA.exe
  2⤵
  PID:7076
- C:\Windows\System\kCQGyJX.exe
  C:\Windows\System\kCQGyJX.exe
  2⤵
  PID:7652
- C:\Windows\System\yNXRRZO.exe
  C:\Windows\System\yNXRRZO.exe
  2⤵
  PID:8180
- C:\Windows\System\GFSWCha.exe
  C:\Windows\System\GFSWCha.exe
  2⤵
  PID:8068
- C:\Windows\System\kRowSDz.exe
  C:\Windows\System\kRowSDz.exe
  2⤵
  PID:8244
- C:\Windows\System\tZxYZuv.exe
  C:\Windows\System\tZxYZuv.exe
  2⤵
  PID:7632
- C:\Windows\System\FOwnRIB.exe
  C:\Windows\System\FOwnRIB.exe
  2⤵
  PID:7424
- C:\Windows\System\BqKfkxY.exe
  C:\Windows\System\BqKfkxY.exe
  2⤵
  PID:8280
- C:\Windows\System\rLhrwAi.exe
  C:\Windows\System\rLhrwAi.exe
  2⤵
  PID:8088
- C:\Windows\System\FGVBQZn.exe
  C:\Windows\System\FGVBQZn.exe
  2⤵
  PID:13760
- C:\Windows\System\yJbMSkg.exe
  C:\Windows\System\yJbMSkg.exe
  2⤵
  PID:7912
- C:\Windows\System\fWvZcJy.exe
  C:\Windows\System\fWvZcJy.exe
  2⤵
  PID:8340
- C:\Windows\System\YFgazVS.exe
  C:\Windows\System\YFgazVS.exe
  2⤵
  PID:9204
- C:\Windows\System\MhuFDEe.exe
  C:\Windows\System\MhuFDEe.exe
  2⤵
  PID:9180
- C:\Windows\System\WHchPeP.exe
  C:\Windows\System\WHchPeP.exe
  2⤵
  PID:9152
- C:\Windows\System\bcQIVBf.exe
  C:\Windows\System\bcQIVBf.exe
  2⤵
  PID:9196
- C:\Windows\System\KjShRJu.exe
  C:\Windows\System\KjShRJu.exe
  2⤵
  PID:8208
- C:\Windows\System\OBnieeD.exe
  C:\Windows\System\OBnieeD.exe
  2⤵
  PID:9164
- C:\Windows\System\TvnUINm.exe
  C:\Windows\System\TvnUINm.exe
  2⤵
  PID:8292
- C:\Windows\System\nQVgfZE.exe
  C:\Windows\System\nQVgfZE.exe
  2⤵
  PID:6320
- C:\Windows\System\Wrfourj.exe
  C:\Windows\System\Wrfourj.exe
  2⤵
  PID:7352
- C:\Windows\System\ZpZNhyq.exe
  C:\Windows\System\ZpZNhyq.exe
  2⤵
  PID:7184
- C:\Windows\System\kyRdSaG.exe
  C:\Windows\System\kyRdSaG.exe
  2⤵
  PID:11604
- C:\Windows\System\LMmUFnv.exe
  C:\Windows\System\LMmUFnv.exe
  2⤵
  PID:13592
- C:\Windows\System\jkgRFGG.exe
  C:\Windows\System\jkgRFGG.exe
  2⤵
  PID:14352
- C:\Windows\System\UXkqUwt.exe
  C:\Windows\System\UXkqUwt.exe
  2⤵
  PID:14380
- C:\Windows\System\PubdpuG.exe
  C:\Windows\System\PubdpuG.exe
  2⤵
  PID:14408
- C:\Windows\System\EcjdnyT.exe
  C:\Windows\System\EcjdnyT.exe
  2⤵
  PID:14432
- C:\Windows\System\hEFjDrq.exe
  C:\Windows\System\hEFjDrq.exe
  2⤵
  PID:14456
- C:\Windows\System\LfCrcDP.exe
  C:\Windows\System\LfCrcDP.exe
  2⤵
  PID:14480
- C:\Windows\System\ZdRmXyj.exe
  C:\Windows\System\ZdRmXyj.exe
  2⤵
  PID:14500
- C:\Windows\System\UHxySif.exe
  C:\Windows\System\UHxySif.exe
  2⤵
  PID:14524
- C:\Windows\System\bcwMIya.exe
  C:\Windows\System\bcwMIya.exe
  2⤵
  PID:14540
- C:\Windows\System\kyYZoPF.exe
  C:\Windows\System\kyYZoPF.exe
  2⤵
  PID:14560
- C:\Windows\System\swfcvlT.exe
  C:\Windows\System\swfcvlT.exe
  2⤵
  PID:14576
- C:\Windows\System\zvLFVsQ.exe
  C:\Windows\System\zvLFVsQ.exe
  2⤵
  PID:14724
- C:\Windows\System\BsfGJEm.exe
  C:\Windows\System\BsfGJEm.exe
  2⤵
  PID:14752
- C:\Windows\System\tOQUehA.exe
  C:\Windows\System\tOQUehA.exe
  2⤵
  PID:14776
- C:\Windows\System\fhOVkJV.exe
  C:\Windows\System\fhOVkJV.exe
  2⤵
  PID:14804
- C:\Windows\System\bgwDPZd.exe
  C:\Windows\System\bgwDPZd.exe
  2⤵
  PID:14828
- C:\Windows\System\XqCbiUh.exe
  C:\Windows\System\XqCbiUh.exe
  2⤵
  PID:14848
- C:\Windows\System\feiBKMm.exe
  C:\Windows\System\feiBKMm.exe
  2⤵
  PID:14868
- C:\Windows\System\UOuczJL.exe
  C:\Windows\System\UOuczJL.exe
  2⤵
  PID:14896
- C:\Windows\System\hPjukjJ.exe
  C:\Windows\System\hPjukjJ.exe
  2⤵
  PID:14912
- C:\Windows\System\PfQwZCg.exe
  C:\Windows\System\PfQwZCg.exe
  2⤵
  PID:14932
- C:\Windows\System\cYeZdvd.exe
  C:\Windows\System\cYeZdvd.exe
  2⤵
  PID:14948
- C:\Windows\System\ouFYtVv.exe
  C:\Windows\System\ouFYtVv.exe
  2⤵
  PID:14968
- C:\Windows\System\qNgCQsl.exe
  C:\Windows\System\qNgCQsl.exe
  2⤵
  PID:15000
- C:\Windows\System\EnKptoJ.exe
  C:\Windows\System\EnKptoJ.exe
  2⤵
  PID:15032
- C:\Windows\System\SfwOmUX.exe
  C:\Windows\System\SfwOmUX.exe
  2⤵
  PID:15064
- C:\Windows\System\rghPYxW.exe
  C:\Windows\System\rghPYxW.exe
  2⤵
  PID:15092
- C:\Windows\System\xBwPTxr.exe
  C:\Windows\System\xBwPTxr.exe
  2⤵
  PID:15300
- C:\Windows\System\trOeFAk.exe
  C:\Windows\System\trOeFAk.exe
  2⤵
  PID:9140
- C:\Windows\System\msROeEo.exe
  C:\Windows\System\msROeEo.exe
  2⤵
  PID:6168
- C:\Windows\System\MoBDBdG.exe
  C:\Windows\System\MoBDBdG.exe
  2⤵
  PID:8312
- C:\Windows\System\DWmPaCj.exe
  C:\Windows\System\DWmPaCj.exe
  2⤵
  PID:8024
- C:\Windows\System\zglfqeo.exe
  C:\Windows\System\zglfqeo.exe
  2⤵
  PID:8036
- C:\Windows\System\pOBRkkC.exe
  C:\Windows\System\pOBRkkC.exe
  2⤵
  PID:8120
- C:\Windows\System\HFcyPPT.exe
  C:\Windows\System\HFcyPPT.exe
  2⤵
  PID:5024
- C:\Windows\System\CBFinrY.exe
  C:\Windows\System\CBFinrY.exe
  2⤵
  PID:8600
- C:\Windows\System\nFDuMoA.exe
  C:\Windows\System\nFDuMoA.exe
  2⤵
  PID:5220
- C:\Windows\System\FTnSnFx.exe
  C:\Windows\System\FTnSnFx.exe
  2⤵
  PID:8376
- C:\Windows\System\yiPtjGp.exe
  C:\Windows\System\yiPtjGp.exe
  2⤵
  PID:7608
- C:\Windows\System\vXPyHGR.exe
  C:\Windows\System\vXPyHGR.exe
  2⤵
  PID:6888
- C:\Windows\System\tIKBUuw.exe
  C:\Windows\System\tIKBUuw.exe
  2⤵
  PID:14000
- C:\Windows\System\rXlCpri.exe
  C:\Windows\System\rXlCpri.exe
  2⤵
  PID:9220
- C:\Windows\System\tgFJRvZ.exe
  C:\Windows\System\tgFJRvZ.exe
  2⤵
  PID:14368
- C:\Windows\System\cUaoSOI.exe
  C:\Windows\System\cUaoSOI.exe
  2⤵
  PID:9512
- C:\Windows\System\ZCYZyyR.exe
  C:\Windows\System\ZCYZyyR.exe
  2⤵
  PID:14448
- C:\Windows\System\KeLrKqK.exe
  C:\Windows\System\KeLrKqK.exe
  2⤵
  PID:15044
- C:\Windows\System\jFcBbRk.exe
  C:\Windows\System\jFcBbRk.exe
  2⤵
  PID:14496
- C:\Windows\System\TEqEPoV.exe
  C:\Windows\System\TEqEPoV.exe
  2⤵
  PID:10088
- C:\Windows\System\vzgnfwF.exe
  C:\Windows\System\vzgnfwF.exe
  2⤵
  PID:9356
- C:\Windows\System\aSbeEDY.exe
  C:\Windows\System\aSbeEDY.exe
  2⤵
  PID:14552
- C:\Windows\System\OmCaeil.exe
  C:\Windows\System\OmCaeil.exe
  2⤵
  PID:10136
- C:\Windows\System\gkShgrd.exe
  C:\Windows\System\gkShgrd.exe
  2⤵
  PID:7036
- C:\Windows\System\WnVRVrD.exe
  C:\Windows\System\WnVRVrD.exe
  2⤵
  PID:6500
- C:\Windows\System\zAsHWft.exe
  C:\Windows\System\zAsHWft.exe
  2⤵
  PID:14844
- C:\Windows\System\vFSJHlG.exe
  C:\Windows\System\vFSJHlG.exe
  2⤵
  PID:8380
- C:\Windows\System\AJIxUCv.exe
  C:\Windows\System\AJIxUCv.exe
  2⤵
  PID:9336
- C:\Windows\System\UjKjxnH.exe
  C:\Windows\System\UjKjxnH.exe
  2⤵
  PID:14964
- C:\Windows\System\SvIIYVV.exe
  C:\Windows\System\SvIIYVV.exe
  2⤵
  PID:10172
- C:\Windows\System\FKClJHM.exe
  C:\Windows\System\FKClJHM.exe
  2⤵
  PID:8872
- C:\Windows\System\CXsUDOM.exe
  C:\Windows\System\CXsUDOM.exe
  2⤵
  PID:9716
- C:\Windows\System\ocxDQbG.exe
  C:\Windows\System\ocxDQbG.exe
  2⤵
  PID:9740
- C:\Windows\System\lWtzEDN.exe
  C:\Windows\System\lWtzEDN.exe
  2⤵
  PID:15312
- C:\Windows\System\cpIFbrk.exe
  C:\Windows\System\cpIFbrk.exe
  2⤵
  PID:14744
- C:\Windows\System\zhPRVvY.exe
  C:\Windows\System\zhPRVvY.exe
  2⤵
  PID:14784
- C:\Windows\System\VRaHEfk.exe
  C:\Windows\System\VRaHEfk.exe
  2⤵
  PID:14816
- C:\Windows\System\duYcjWg.exe
  C:\Windows\System\duYcjWg.exe
  2⤵
  PID:14840
- C:\Windows\System\VarHxrO.exe
  C:\Windows\System\VarHxrO.exe
  2⤵
  PID:14876
- C:\Windows\System\MLbTEah.exe
  C:\Windows\System\MLbTEah.exe
  2⤵
  PID:8688
- C:\Windows\System\HcJdVsQ.exe
  C:\Windows\System\HcJdVsQ.exe
  2⤵
  PID:14904
- C:\Windows\System\VRAavjZ.exe
  C:\Windows\System\VRAavjZ.exe
  2⤵
  PID:6936
- C:\Windows\System\qOKuWYv.exe
  C:\Windows\System\qOKuWYv.exe
  2⤵
  PID:15220
- C:\Windows\System\yZDMMVo.exe
  C:\Windows\System\yZDMMVo.exe
  2⤵
  PID:15056
- C:\Windows\System\jVsdBSO.exe
  C:\Windows\System\jVsdBSO.exe
  2⤵
  PID:8916
- C:\Windows\System\IxqqQES.exe
  C:\Windows\System\IxqqQES.exe
  2⤵
  PID:9892
- C:\Windows\System\TZVbYSr.exe
  C:\Windows\System\TZVbYSr.exe
  2⤵
  PID:9916
- C:\Windows\System\NUYgPwt.exe
  C:\Windows\System\NUYgPwt.exe
  2⤵
  PID:10080
- C:\Windows\System\MIFpvYQ.exe
  C:\Windows\System\MIFpvYQ.exe
  2⤵
  PID:6148
- C:\Windows\System\TLoWVVd.exe
  C:\Windows\System\TLoWVVd.exe
  2⤵
  PID:4908
- C:\Windows\System\mOTAvSz.exe
  C:\Windows\System\mOTAvSz.exe
  2⤵
  PID:9020
- C:\Windows\System\kfTsPjg.exe
  C:\Windows\System\kfTsPjg.exe
  2⤵
  PID:15264
- C:\Windows\System\kMyMLju.exe
  C:\Windows\System\kMyMLju.exe
  2⤵
  PID:10212
- C:\Windows\System\CKHtenk.exe
  C:\Windows\System\CKHtenk.exe
  2⤵
  PID:7540
- C:\Windows\System\OeAdprv.exe
  C:\Windows\System\OeAdprv.exe
  2⤵
  PID:8496
- C:\Windows\System\pdRRoaU.exe
  C:\Windows\System\pdRRoaU.exe
  2⤵
  PID:8336
- C:\Windows\System\QrcPgyW.exe
  C:\Windows\System\QrcPgyW.exe
  2⤵
  PID:7460
- C:\Windows\System\qQYvIVZ.exe
  C:\Windows\System\qQYvIVZ.exe
  2⤵
  PID:10204
- C:\Windows\System\bIqrceD.exe
  C:\Windows\System\bIqrceD.exe
  2⤵
  PID:6484
- C:\Windows\System\piykhRc.exe
  C:\Windows\System\piykhRc.exe
  2⤵
  PID:8268
- C:\Windows\System\tvtLxHm.exe
  C:\Windows\System\tvtLxHm.exe
  2⤵
  PID:7568
- C:\Windows\System\XqCZiBX.exe
  C:\Windows\System\XqCZiBX.exe
  2⤵
  PID:10184
- C:\Windows\System\dUsDKlJ.exe
  C:\Windows\System\dUsDKlJ.exe
  2⤵
  PID:6408
- C:\Windows\System\syZIZxp.exe
  C:\Windows\System\syZIZxp.exe
  2⤵
  PID:5196
- C:\Windows\System\TQandJi.exe
  C:\Windows\System\TQandJi.exe
  2⤵
  PID:7564
- C:\Windows\System\ocTpABy.exe
  C:\Windows\System\ocTpABy.exe
  2⤵
  PID:13572
- C:\Windows\System\MFGbcae.exe
  C:\Windows\System\MFGbcae.exe
  2⤵
  PID:400
- C:\Windows\System\bNaUXFR.exe
  C:\Windows\System\bNaUXFR.exe
  2⤵
  PID:14420
- C:\Windows\System\ZKZNuyH.exe
  C:\Windows\System\ZKZNuyH.exe
  2⤵
  PID:14520
- C:\Windows\System\YphGjbp.exe
  C:\Windows\System\YphGjbp.exe
  2⤵
  PID:15232
- C:\Windows\System\HItLGhm.exe
  C:\Windows\System\HItLGhm.exe
  2⤵
  PID:8052
- C:\Windows\System\NAgQIjS.exe
  C:\Windows\System\NAgQIjS.exe
  2⤵
  PID:8724
- C:\Windows\System\tqjbWGv.exe
  C:\Windows\System\tqjbWGv.exe
  2⤵
  PID:8236
- C:\Windows\System\eypJEro.exe
  C:\Windows\System\eypJEro.exe
  2⤵
  PID:8476
- C:\Windows\System\SviMxSN.exe
  C:\Windows\System\SviMxSN.exe
  2⤵
  PID:15240
- C:\Windows\System\KsDCTRE.exe
  C:\Windows\System\KsDCTRE.exe
  2⤵
  PID:8412
- C:\Windows\System\EpRFcwF.exe
  C:\Windows\System\EpRFcwF.exe
  2⤵
  PID:14568
- C:\Windows\System\XFMIrTd.exe
  C:\Windows\System\XFMIrTd.exe
  2⤵
  PID:4832
- C:\Windows\System\UqPUipt.exe
  C:\Windows\System\UqPUipt.exe
  2⤵
  PID:4160
- C:\Windows\System\qIItaZu.exe
  C:\Windows\System\qIItaZu.exe
  2⤵
  PID:15028
- C:\Windows\System\qmYOuZK.exe
  C:\Windows\System\qmYOuZK.exe
  2⤵
  PID:3116
- C:\Windows\System\ydhTEmK.exe
  C:\Windows\System\ydhTEmK.exe
  2⤵
  PID:10012
- C:\Windows\System\GcydjZw.exe
  C:\Windows\System\GcydjZw.exe
  2⤵
  PID:15120
- C:\Windows\System\vslXAJV.exe
  C:\Windows\System\vslXAJV.exe
  2⤵
  PID:3808
- C:\Windows\System\BQGxxvg.exe
  C:\Windows\System\BQGxxvg.exe
  2⤵
  PID:10852
- C:\Windows\System\gCTJzAN.exe
  C:\Windows\System\gCTJzAN.exe
  2⤵
  PID:10576
- C:\Windows\System\tmuUXVF.exe
  C:\Windows\System\tmuUXVF.exe
  2⤵
  PID:9500
- C:\Windows\System\TOsCIHB.exe
  C:\Windows\System\TOsCIHB.exe
  2⤵
  PID:10280
- C:\Windows\System\GwiQdmp.exe
  C:\Windows\System\GwiQdmp.exe
  2⤵
  PID:7028
- C:\Windows\System\hlFllXm.exe
  C:\Windows\System\hlFllXm.exe
  2⤵
  PID:10060
- C:\Windows\System\BMyOpfx.exe
  C:\Windows\System\BMyOpfx.exe
  2⤵
  PID:8344
- C:\Windows\System\lhxNoBZ.exe
  C:\Windows\System\lhxNoBZ.exe
  2⤵
  PID:9692
- C:\Windows\System\PDXHAAI.exe
  C:\Windows\System\PDXHAAI.exe
  2⤵
  PID:10364
- C:\Windows\System\IZCfmWu.exe
  C:\Windows\System\IZCfmWu.exe
  2⤵
  PID:9944
- C:\Windows\System\GAVxMCw.exe
  C:\Windows\System\GAVxMCw.exe
  2⤵
  PID:8348
- C:\Windows\System\VDKavyZ.exe
  C:\Windows\System\VDKavyZ.exe
  2⤵
  PID:10372
- C:\Windows\System\YBLqOck.exe
  C:\Windows\System\YBLqOck.exe
  2⤵
  PID:10688
- C:\Windows\System\lqqIFYq.exe
  C:\Windows\System\lqqIFYq.exe
  2⤵
  PID:10728
- C:\Windows\System\cweewUK.exe
  C:\Windows\System\cweewUK.exe
  2⤵
  PID:10836
- C:\Windows\System\LxTGPXD.exe
  C:\Windows\System\LxTGPXD.exe
  2⤵
  PID:10664
- C:\Windows\System\gyHueqh.exe
  C:\Windows\System\gyHueqh.exe
  2⤵
  PID:11220
- C:\Windows\System\PRLntPu.exe
  C:\Windows\System\PRLntPu.exe
  2⤵
  PID:10260
- C:\Windows\System\eEPFiBE.exe
  C:\Windows\System\eEPFiBE.exe
  2⤵
  PID:10992
- C:\Windows\System\pbNQVUz.exe
  C:\Windows\System\pbNQVUz.exe
  2⤵
  PID:11112
- C:\Windows\System\sStiwBZ.exe
  C:\Windows\System\sStiwBZ.exe
  2⤵
  PID:11084
- C:\Windows\System\RyrIkLC.exe
  C:\Windows\System\RyrIkLC.exe
  2⤵
  PID:11200
- C:\Windows\System\FHosfar.exe
  C:\Windows\System\FHosfar.exe
  2⤵
  PID:3852
- C:\Windows\System\CduyyYS.exe
  C:\Windows\System\CduyyYS.exe
  2⤵
  PID:9284
- C:\Windows\System\QDDQssr.exe
  C:\Windows\System\QDDQssr.exe
  2⤵
  PID:15256
- C:\Windows\System\xWKxQAH.exe
  C:\Windows\System\xWKxQAH.exe
  2⤵
  PID:5836
- C:\Windows\System\RUDLimg.exe
  C:\Windows\System\RUDLimg.exe
  2⤵
  PID:11232
- C:\Windows\System\rubJgut.exe
  C:\Windows\System\rubJgut.exe
  2⤵
  PID:1976
- C:\Windows\System\KLAEWAY.exe
  C:\Windows\System\KLAEWAY.exe
  2⤵
  PID:10460
- C:\Windows\System\NZNzWFt.exe
  C:\Windows\System\NZNzWFt.exe
  2⤵
  PID:8276
- C:\Windows\System\OPqIdph.exe
  C:\Windows\System\OPqIdph.exe
  2⤵
  PID:9168
- C:\Windows\System\kQTvhSA.exe
  C:\Windows\System\kQTvhSA.exe
  2⤵
  PID:10672
- C:\Windows\System\CHwqrBA.exe
  C:\Windows\System\CHwqrBA.exe
  2⤵
  PID:11296
- C:\Windows\System\LGejMWJ.exe
  C:\Windows\System\LGejMWJ.exe
  2⤵
  PID:9312
- C:\Windows\System\fpphNau.exe
  C:\Windows\System\fpphNau.exe
  2⤵
  PID:11692
- C:\Windows\System\irCpDcL.exe
  C:\Windows\System\irCpDcL.exe
  2⤵
  PID:11732
- C:\Windows\System\sBFiQol.exe
  C:\Windows\System\sBFiQol.exe
  2⤵
  PID:11052
- C:\Windows\System\LqpFUfD.exe
  C:\Windows\System\LqpFUfD.exe
  2⤵
  PID:7228
- C:\Windows\System\IvxrSoS.exe
  C:\Windows\System\IvxrSoS.exe
  2⤵
  PID:14980
- C:\Windows\System\wNZOIkO.exe
  C:\Windows\System\wNZOIkO.exe
  2⤵
  PID:11032
- C:\Windows\System\iMemzJX.exe
  C:\Windows\System\iMemzJX.exe
  2⤵
  PID:11828
- C:\Windows\System\ZvpGxSi.exe
  C:\Windows\System\ZvpGxSi.exe
  2⤵
  PID:9436
- C:\Windows\System\dHbTRWW.exe
  C:\Windows\System\dHbTRWW.exe
  2⤵
  PID:14720
- C:\Windows\System\VAQCeEE.exe
  C:\Windows\System\VAQCeEE.exe
  2⤵
  PID:5084
- C:\Windows\System\JArYPSf.exe
  C:\Windows\System\JArYPSf.exe
  2⤵
  PID:10796
- C:\Windows\System\tIWADjC.exe
  C:\Windows\System\tIWADjC.exe
  2⤵
  PID:6724
- C:\Windows\System\dDMpOCS.exe
  C:\Windows\System\dDMpOCS.exe
  2⤵
  PID:8400
- C:\Windows\System\aOXteDa.exe
  C:\Windows\System\aOXteDa.exe
  2⤵
  PID:5088
- C:\Windows\System\ZCuJyxm.exe
  C:\Windows\System\ZCuJyxm.exe
  2⤵
  PID:7444
- C:\Windows\System\FgmkEBD.exe
  C:\Windows\System\FgmkEBD.exe
  2⤵
  PID:12156
- C:\Windows\System\tmTfhLH.exe
  C:\Windows\System\tmTfhLH.exe
  2⤵
  PID:9364
- C:\Windows\System\ULdDXnF.exe
  C:\Windows\System\ULdDXnF.exe
  2⤵
  PID:15348
- C:\Windows\System\tCDFOiE.exe
  C:\Windows\System\tCDFOiE.exe
  2⤵
  PID:10628
- C:\Windows\System\uQMghtW.exe
  C:\Windows\System\uQMghtW.exe
  2⤵
  PID:5472
- C:\Windows\System\DlkBigJ.exe
  C:\Windows\System\DlkBigJ.exe
  2⤵
  PID:8108
- C:\Windows\System\skoGwxi.exe
  C:\Windows\System\skoGwxi.exe
  2⤵
  PID:9400
- C:\Windows\System\MDGebvl.exe
  C:\Windows\System\MDGebvl.exe
  2⤵
  PID:12280
- C:\Windows\System\xrtghus.exe
  C:\Windows\System\xrtghus.exe
  2⤵
  PID:11728
- C:\Windows\System\WTNjcYU.exe
  C:\Windows\System\WTNjcYU.exe
  2⤵
  PID:11268
- C:\Windows\System\VIAPFHV.exe
  C:\Windows\System\VIAPFHV.exe
  2⤵
  PID:11624
- C:\Windows\System\ZgMnIyN.exe
  C:\Windows\System\ZgMnIyN.exe
  2⤵
  PID:7248
- C:\Windows\System\JPAurqV.exe
  C:\Windows\System\JPAurqV.exe
  2⤵
  PID:11020
- C:\Windows\System\rMeKfTZ.exe
  C:\Windows\System\rMeKfTZ.exe
  2⤵
  PID:11592
- C:\Windows\System\DrFTWCO.exe
  C:\Windows\System\DrFTWCO.exe
  2⤵
  PID:4172
- C:\Windows\System\fllQLwU.exe
  C:\Windows\System\fllQLwU.exe
  2⤵
  PID:11444
- C:\Windows\System\DbNOhQH.exe
  C:\Windows\System\DbNOhQH.exe
  2⤵
  PID:12160
- C:\Windows\System\ftSKJUq.exe
  C:\Windows\System\ftSKJUq.exe
  2⤵
  PID:11524
- C:\Windows\System\fZHGyiA.exe
  C:\Windows\System\fZHGyiA.exe
  2⤵
  PID:11244
- C:\Windows\System\FzjOZuy.exe
  C:\Windows\System\FzjOZuy.exe
  2⤵
  PID:12276
- C:\Windows\System\KcfGmMZ.exe
  C:\Windows\System\KcfGmMZ.exe
  2⤵
  PID:11912
- C:\Windows\System\BDUqbXN.exe
  C:\Windows\System\BDUqbXN.exe
  2⤵
  PID:4200
- C:\Windows\System\tQaNhDq.exe
  C:\Windows\System\tQaNhDq.exe
  2⤵
  PID:5448
- C:\Windows\System\PJnRKDF.exe
  C:\Windows\System\PJnRKDF.exe
  2⤵
  PID:15072
- C:\Windows\System\OMGobdP.exe
  C:\Windows\System\OMGobdP.exe
  2⤵
  PID:12116
- C:\Windows\System\vgoRfVq.exe
  C:\Windows\System\vgoRfVq.exe
  2⤵
  PID:14360
- C:\Windows\System\OzSVSBy.exe
  C:\Windows\System\OzSVSBy.exe
  2⤵
  PID:11320
- C:\Windows\System\rMZwSCT.exe
  C:\Windows\System\rMZwSCT.exe
  2⤵
  PID:7716
- C:\Windows\System\YpiFmSd.exe
  C:\Windows\System\YpiFmSd.exe
  2⤵
  PID:11832
- C:\Windows\System\ucttPHI.exe
  C:\Windows\System\ucttPHI.exe
  2⤵
  PID:11800
- C:\Windows\System\FgICfRN.exe
  C:\Windows\System\FgICfRN.exe
  2⤵
  PID:2792
- C:\Windows\System\sPyHXwb.exe
  C:\Windows\System\sPyHXwb.exe
  2⤵
  PID:5064
- C:\Windows\System\bdnEmKZ.exe
  C:\Windows\System\bdnEmKZ.exe
  2⤵
  PID:2152
- C:\Windows\System\OlTfcbQ.exe
  C:\Windows\System\OlTfcbQ.exe
  2⤵
  PID:14056
- C:\Windows\System\rrqNMAS.exe
  C:\Windows\System\rrqNMAS.exe
  2⤵
  PID:11680
- C:\Windows\System\gkdXkeX.exe
  C:\Windows\System\gkdXkeX.exe
  2⤵
  PID:10380
- C:\Windows\System\xlqHubw.exe
  C:\Windows\System\xlqHubw.exe
  2⤵
  PID:10552
- C:\Windows\System\pyhgsZb.exe
  C:\Windows\System\pyhgsZb.exe
  2⤵
  PID:11228
- C:\Windows\System\qwJshcz.exe
  C:\Windows\System\qwJshcz.exe
  2⤵
  PID:6116
- C:\Windows\System\LtfcfNH.exe
  C:\Windows\System\LtfcfNH.exe
  2⤵
  PID:11640
- C:\Windows\System\jqMCmKs.exe
  C:\Windows\System\jqMCmKs.exe
  2⤵
  PID:9988
- C:\Windows\System\yyqOEnw.exe
  C:\Windows\System\yyqOEnw.exe
  2⤵
  PID:12472
- C:\Windows\System\HNkkQEm.exe
  C:\Windows\System\HNkkQEm.exe
  2⤵
  PID:12448
- C:\Windows\System\rxuyfgO.exe
  C:\Windows\System\rxuyfgO.exe
  2⤵
  PID:12800
- C:\Windows\System\FjZwQye.exe
  C:\Windows\System\FjZwQye.exe
  2⤵
  PID:7692
- C:\Windows\System\vJXSqnj.exe
  C:\Windows\System\vJXSqnj.exe
  2⤵
  PID:12796
- C:\Windows\System\MMLfXxz.exe
  C:\Windows\System\MMLfXxz.exe
  2⤵
  PID:10556
- C:\Windows\System\lnQuRGZ.exe
  C:\Windows\System\lnQuRGZ.exe
  2⤵
  PID:11420
- C:\Windows\System\VMHrujj.exe
  C:\Windows\System\VMHrujj.exe
  2⤵
  PID:12860
- C:\Windows\System\nXrQCqK.exe
  C:\Windows\System\nXrQCqK.exe
  2⤵
  PID:12408
- C:\Windows\System\dXFUtNj.exe
  C:\Windows\System\dXFUtNj.exe
  2⤵
  PID:12524
- C:\Windows\System\GSTINRT.exe
  C:\Windows\System\GSTINRT.exe
  2⤵
  PID:4720
- C:\Windows\System\ArHSOqn.exe
  C:\Windows\System\ArHSOqn.exe
  2⤵
  PID:13048
- C:\Windows\System\ObKBQSd.exe
  C:\Windows\System\ObKBQSd.exe
  2⤵
  PID:15376
- C:\Windows\System\JzoIMTh.exe
  C:\Windows\System\JzoIMTh.exe
  2⤵
  PID:15392
- C:\Windows\System\duRmVKV.exe
  C:\Windows\System\duRmVKV.exe
  2⤵
  PID:15408
- C:\Windows\System\kEigMxd.exe
  C:\Windows\System\kEigMxd.exe
  2⤵
  PID:15432
- C:\Windows\System\FomflTF.exe
  C:\Windows\System\FomflTF.exe
  2⤵
  PID:15452
- C:\Windows\System\evQmuOD.exe
  C:\Windows\System\evQmuOD.exe
  2⤵
  PID:15476
- C:\Windows\System\SmPQZgV.exe
  C:\Windows\System\SmPQZgV.exe
  2⤵
  PID:15496
- C:\Windows\System\haAfrNs.exe
  C:\Windows\System\haAfrNs.exe
  2⤵
  PID:15512
- C:\Windows\System\YlJQjIC.exe
  C:\Windows\System\YlJQjIC.exe
  2⤵
  PID:15528
- C:\Windows\System\keTBGfg.exe
  C:\Windows\System\keTBGfg.exe
  2⤵
  PID:15556
- C:\Windows\System\VWKvJuy.exe
  C:\Windows\System\VWKvJuy.exe
  2⤵
  PID:15584
- C:\Windows\System\vVuwxSW.exe
  C:\Windows\System\vVuwxSW.exe
  2⤵
  PID:15712
- C:\Windows\System\bmdiGen.exe
  C:\Windows\System\bmdiGen.exe
  2⤵
  PID:15736
- C:\Windows\System\VwMjGhT.exe
  C:\Windows\System\VwMjGhT.exe
  2⤵
  PID:15756
- C:\Windows\System\JILCWuk.exe
  C:\Windows\System\JILCWuk.exe
  2⤵
  PID:15780
- C:\Windows\System\iUfFEMB.exe
  C:\Windows\System\iUfFEMB.exe
  2⤵
  PID:15816
- C:\Windows\System\FIHvnRO.exe
  C:\Windows\System\FIHvnRO.exe
  2⤵
  PID:15844
- C:\Windows\System\NrFxiVq.exe
  C:\Windows\System\NrFxiVq.exe
  2⤵
  PID:16076
- C:\Windows\System\FuuJRyt.exe
  C:\Windows\System\FuuJRyt.exe
  2⤵
  PID:16096
- C:\Windows\System\rfAWRof.exe
  C:\Windows\System\rfAWRof.exe
  2⤵
  PID:16116
- C:\Windows\System\aCkuHYE.exe
  C:\Windows\System\aCkuHYE.exe
  2⤵
  PID:16132
- C:\Windows\System\aZrunkY.exe
  C:\Windows\System\aZrunkY.exe
  2⤵
  PID:16148
- C:\Windows\System\chdfHDq.exe
  C:\Windows\System\chdfHDq.exe
  2⤵
  PID:16164
- C:\Windows\System\bIKRAUB.exe
  C:\Windows\System\bIKRAUB.exe
  2⤵
  PID:16188
- C:\Windows\System\VkkRGUB.exe
  C:\Windows\System\VkkRGUB.exe
  2⤵
  PID:16204
- C:\Windows\System\yddehvi.exe
  C:\Windows\System\yddehvi.exe
  2⤵
  PID:16224
- C:\Windows\System\zDGZDov.exe
  C:\Windows\System\zDGZDov.exe
  2⤵
  PID:16276
- C:\Windows\System\gIRAzmY.exe
  C:\Windows\System\gIRAzmY.exe
  2⤵
  PID:16304
- C:\Windows\System\dSCkwAa.exe
  C:\Windows\System\dSCkwAa.exe
  2⤵
  PID:16336
- C:\Windows\System\gNpfIUr.exe
  C:\Windows\System\gNpfIUr.exe
  2⤵
  PID:16368
- C:\Windows\System\QtokbKV.exe
  C:\Windows\System\QtokbKV.exe
  2⤵
  PID:13160
- C:\Windows\System\eupfMFm.exe
  C:\Windows\System\eupfMFm.exe
  2⤵
  PID:13028
- C:\Windows\System\RHcqopE.exe
  C:\Windows\System\RHcqopE.exe
  2⤵
  PID:11816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2128 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:12636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lb41ctfw.fs1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CHJgDaw.exe

Filesize
2.3MB

MD5
b96e37fdc74d8a9de6f633c59faa5ee6

SHA1
a2cbe7cb1a6612df8654834325773e36af4a33e9

SHA256
b3a3d0df8443e1d63b0606e59a6901cf26c9549f46c5beacf463d8decdd09d4a

SHA512
4c19d7b885a04b8eca3b8aa6a7ed1128d9542b16bdbe85d05869ef97b2f062125928145bfbfa044c809651dc117f3b8b15bcb4302092d6a4afbd65c3fb6f9c5c

Download Submit
C:\Windows\System\FZblogW.exe

Filesize
2.3MB

MD5
9027a79dfbf17a2516eed7aab531f067

SHA1
a845379fe0ed860cd6a09c0f741da8e050a4e89a

SHA256
dc545d302f4e261619776fddf984feb039d3711aac3e04f4791a788184e40430

SHA512
4e25adfc5985b7c42141660b52dd620b960b853f528f58f58f19679ce05651fcc4c975e69f984bfaaf4ecb5b510962b50c92f9b6fa14915e409216ae4afe75ba

Download Submit
C:\Windows\System\FgDwzck.exe

Filesize
2.3MB

MD5
de06fbdf6e8412310b5ddaedfb1f560e

SHA1
c0b9ea35e2b59ff0791b07e313ea0a5fa5dd265a

SHA256
6e81d8abaa110696abeba7c9508d590b0a050ed452777bffee95aac583bec94c

SHA512
0c31ce6c71b01e7effbcb8de2724c43b2cc95a1939c391fed3e238b8063f60997a94870096ac576c74e00e58b4d353cb8fe92bc39306c46bfc4694a714675d91

Download Submit
C:\Windows\System\GVPLCoc.exe

Filesize
2.3MB

MD5
5171635f3449cfe9c6c48a452edae40d

SHA1
5483d69a28fe24655b715661eaa1c2f336391c4a

SHA256
2eeb8e11362685ac2b28804eb2000c222344116a21cd3565432cb5eeadb8a05f

SHA512
5de420ac05e13eabe3a90ef79eb97cce3f71810f541cd9687f125fa0787f151a778878c3e5a1d11d5e4acbb4f6d0fa665e727ed54f3c8b3ee565550eb576a918

Download Submit
C:\Windows\System\KBHJDcr.exe

Filesize
2.3MB

MD5
d042547072bc2a4b0f894e9220df6d6b

SHA1
b7d57c95bdcd1b597c10be060b881d2727d2db96

SHA256
c82a99ffc7c441f347416af7a7576555b4d452efd3a6ecef9fe8c0af4576b506

SHA512
5a38175634032876f21415c4a2c5f1e0a37719a679a223fdb21e0adea1249f71c41573ef4a9520ff29c249b07fac8d950217ad34925a7616568605249cbc01f7

Download Submit
C:\Windows\System\NlLozBp.exe

Filesize
2.3MB

MD5
23d343c4938b80494aeff0486fd09d83

SHA1
4163f5566f77cf570bbd8675e5c27524694a5591

SHA256
f3c98924d3be9f12977d8b24e652fb2b565e2ccf5d37dafd48fc792a92d3e66d

SHA512
8f7a11784c478d4102b0b156c5c440067c86c3fe29eec2cf022db060361b476d0fa9c2f10193355662266eee08b2ccbf04a90b7a16c9c338293aeb63329deb22

Download Submit
C:\Windows\System\PFkDdac.exe

Filesize
2.3MB

MD5
1e931d07b6304c583a113546d026d162

SHA1
2f5335244b81951076f54ed0145e0d0ce45ee93c

SHA256
fa1d29170f4ff4edb798e38a5311d1dc94a811e9b341fb82c515b17288ee4363

SHA512
21185ac6fb22caea1984e62fa354dcefdbd355cfa08c316f30ed0ffd211de5a0e04f0004bbd6f42d5638f3ed903385aa13d07a289c48c926f204c6abaf4aad20

Download Submit
C:\Windows\System\RBSuMCR.exe

Filesize
2.3MB

MD5
a73550cb1e030b804fe6ec7b8ff1f095

SHA1
ba114c27db1ccb48c011fd9350d49f45a9cc8334

SHA256
4255618f8073dc0d6ac121245947306ac889150ba01c3d55d626fb2331516af9

SHA512
f629808ea86b82c7f14ce7f070cf028c5487c8228395b42b023a3f9461574028d837303865b831b1c317b7c6667841bdd6e77b797c9fda3bf1d1383b0e5e3757

Download Submit
C:\Windows\System\RHNYTYd.exe

Filesize
2.3MB

MD5
1fe20853fa63523e65a7c09b0149223f

SHA1
447d816943d808b7fdacd5cc9797d7a55432775e

SHA256
e7a69a427c75233f2e6380c3a32cd236e9224d78f14c2238a048ba3b0699fe31

SHA512
990778260986359b9e079bf38f1011c4d8ca3a57d2b3cd495ac902b504d55459697621334a198d8bdc4101fd9a07678cbc6d241dac7c016fe025959df64754fc

Download Submit
C:\Windows\System\SevXqfp.exe

Filesize
2.3MB

MD5
b041c286a6f787025c4f6004d98fb3cc

SHA1
dfe26b4ad5328acb3952e55437eb55cbb003a54c

SHA256
4e0233794160402921c0665295e26fe2ddebdfdf83786473b351067f3614c3ae

SHA512
43373aa78367ec2f95b2a89cc557d672f09cd3c6793ae0074784292ce50c20c8d209bcd933769ba4726df9df2030b1071196ab2a3581f1183b401068b67995f8

Download Submit
C:\Windows\System\UZlDGdc.exe

Filesize
2.3MB

MD5
3f308f124955f15a6c5d87b2a9c8bfc2

SHA1
06f1beaddfefd0ad7914fd971236128644e0c931

SHA256
e0a00ce6054f49b4b69f875ae0dcd521677adb556f9db29d809b0011380d4ca7

SHA512
31b0dcc0156f2dfd47ffd08956b72ef454ef95b10bbdd3b4f839a4a80eaa6631e33c97b7bfb41c9ff40dc2173ab4f82e9d8247187e5f7d9ece7b8a8d1e1fd055

Download Submit
C:\Windows\System\UlDDmbm.exe

Filesize
2.3MB

MD5
7e0259fa9097d0ae9a01b6aeb724f565

SHA1
37eb927c6263cc728edb0ff511395762753d8ff0

SHA256
a6c41f5a6f528db98a2a6ef86b45dbc63d487c492925a54d8287c2f7ef913735

SHA512
0af4c1524633299d4b0e286d102f4402e1dd8708194b88f3fcd43aa18533dd3850f20c902a535847eec345aa17cde9eb893aebbc3d3a7a4a85d29e3ceb5f386a

Download Submit
C:\Windows\System\WBTlrTv.exe

Filesize
2.3MB

MD5
da3ad95f0c3a990518d63404331455ca

SHA1
87b8f96e9113d499c46a21ab6d0b796145487d38

SHA256
710783e3d2e7bc78c31fb8c5e948e6dbabb55ddc8f61968664e0d42d11c42136

SHA512
6ae20e3327cedd6921933ebfaf54d36aac67fb0e2c7c7f8ea2b4de8fbf187e92b00222f8d19b70d02487bbdd7610e4f9ff4e72fb2b43225148f5d47ea5c6c832

Download Submit
C:\Windows\System\bFEuWTN.exe

Filesize
2.3MB

MD5
23ee65ad824746c7aeb2f7436a057bde

SHA1
30a2d9a6ecd6848cd6bcfad873027b3c75e931c2

SHA256
3fc5b00982b30b301cf208059faa0822e01aa1ed76c9fe12d304a39d883623d0

SHA512
bfbe5b1fd31d9bd9b688740f0c270cbb0339d0e164ad0bbac46b893852a851b8a1d28099f4d59a6198f328401a3a048778378da23d775c06fc29e963d0c008f5

Download Submit
C:\Windows\System\hCSTVKc.exe

Filesize
2.3MB

MD5
8664e0c2c2edd1cc12e67f265733ab83

SHA1
3be55103b94a4c05f16de17a291ff4002020b12a

SHA256
5d57b124e273586b9d2423766642ad256362723eef6cfde413b5b368793697a2

SHA512
f8fbc3d453a45178684bed11af570309055838c834899a32f9eafb92ba4d3f01ea4a60562b6b90d763290dd2f82301f8f90c7186d630e60869086f48ee4b112c

Download Submit
C:\Windows\System\hdJrEjQ.exe

Filesize
2.3MB

MD5
961bc62a3c29d2122d2c10af1d8232be

SHA1
2cdbcb6f9fd21fd8589838f6498ffe19ecd875d1

SHA256
13658c65418abf3bf07219d8da3b8e4a69e9769a76a61d97a2adba8858ab7ea0

SHA512
b185f51362998ae05dd99d176054cc30cf334f6853d54cb4ab3d85be7096e57825280380a3bd898e619477724cadaeb52832d5b6c4103d3d0fbf61c707630359

Download Submit
C:\Windows\System\iRVCNiT.exe

Filesize
2.3MB

MD5
124746518836828ff3d3591c203d0857

SHA1
3aa9561dda31c5897d7f2668f348d9ac8fcb7c76

SHA256
2842acc7e1b50b8013f9cefc91d8c0364e9542de612099ec41bb9fc2f0d3ac65

SHA512
9f95366c7e44a91b0442237c4ebdc97e9c90cbe7ead84a1b1a2756b98302bb1e4affe508cc1fcf6ca6e751a725217c9a0669ab90f73d365731f0591e23c57ffc

Download Submit
C:\Windows\System\ihBDcUC.exe

Filesize
2.3MB

MD5
fe006076b435e6b7ea712ae936b2454f

SHA1
b25b5c26d8f257b1198e680543a3da32e3bae688

SHA256
1e4732d27274dd1cc99127708555ac0cc1ec73db44ba52ff9bc79be86e8fe1b5

SHA512
f96528ee25214146d3dd4f29aacb01b78a9b833b3c78285ff3e99f9aa7a7bdd50e3b87d5f195433bb4dc2ca85260abd2e75ebe0f5c299bca365c98ff53431f86

Download Submit
C:\Windows\System\kcceMtn.exe

Filesize
2.3MB

MD5
132b549acf9ffcf7cefb75aac56eaa6b

SHA1
ac0560d748c5b3178a124bda209a05bb3cef2a7a

SHA256
9ee29d1f7c18c2bdbf98c388909d6302fb0f2ecaf9f8985bd036682e273bc556

SHA512
2c56a9fec627146cdc99b75b70bcb1b2929c4c8ccb29637d9668d1504f096dd2d5414cd3b40f8ca045825a2414e3972acc01f1813697bd5bde565514891b121c

Download Submit
C:\Windows\System\ksraheS.exe

Filesize
2.3MB

MD5
4d95527bd91920c74b0f38218f432278

SHA1
f174e5b82e347882e34f2e77b6d742f6a4d5025e

SHA256
30c6e1ea2482c6af3686947e6ac2e074f508fd9e5c25b0651cb43a7bb29a2d2f

SHA512
22e8405fd381b2eac283db65fe02b2345c2a0619f11cf1795e0087cdb706a4e686467427632f2e73e919f4acc86c2abe6e45eb7e0c50ffa3de4836590d0d24c3

Download Submit
C:\Windows\System\naWZWwc.exe

Filesize
2.3MB

MD5
3551f8a743887704ef0da4ee0e54f52d

SHA1
6a3de617d0914a4037841253ef70d863548bbd77

SHA256
e6c615a9519d87bbbfc1e4af3ad084318add7a78154694564ffbc67bfe3ca9b7

SHA512
fe08a6cb830cdf6cd1f76b215b496f5cc477945e44fe204afb442996a5fb36e8652a8dcb22929af49ac305b486d9400acabe095deb252b40ee61b91d6d0cfd1b

Download Submit
C:\Windows\System\oDmKqvh.exe

Filesize
2.3MB

MD5
0a062bb4d472b610899a609c8a41b8db

SHA1
42595300693442cf9d05c9ce0f5a487d175d8fc7

SHA256
353b6a19e9b18cf8b45edb06a905ba62c45d5a94ccfb97af7d19866922d76358

SHA512
53488225f61662ba39110573663adab5c5491d599cc95bcb2272cac99ff8ace153392faebf1aa8285b14d1366acf5de5b12c17f813eddc4662db313bcf5222de

Download Submit
C:\Windows\System\ojKFWNp.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\rJdTbii.exe

Filesize
2.3MB

MD5
019bcd4cd5c2386fcc14de32f509f057

SHA1
7bd22fcf2091d938c5b36b52d7fc36d4a5e60d04

SHA256
060a41d7a5156169fc6d43e454362eef2b1fb521a32e6b1c8216f567e481175e

SHA512
ef552aa3d4696f41c57981899b3d7476b0f89e5148b4cea34478533ffe99c14dfc405d2b89f7f49b3f9213b100c4c33be33bc532a510f010bd2c72a0d999958b

Download Submit
C:\Windows\System\sEaEeBB.exe

Filesize
2.3MB

MD5
f152a1ebae58fd4bba51ec0234b6af10

SHA1
1e7c0e8765f2674b9400defcd2df5222232fe037

SHA256
8cd433445b59306f8175b82d782c07d71dfc378aca2b8adb0e5b3a581a52240d

SHA512
f047f0e1e35d2f321dd874e633f7966b23073e3fb575d048b78d94bc409361bd29de68cf2af8cb3672652e6d6c3b2dbdae67746be5ee5c51dd9d2b5d6a87d086

Download Submit
C:\Windows\System\sOpeQLu.exe

Filesize
2.3MB

MD5
431872b883789bf8ea5f57b46be224aa

SHA1
119991ea940b500774a03268795f87e140220257

SHA256
2b76957367e20b18979687c778e54c62d8f1ceb3346e25c0996011734b8e8e83

SHA512
d597eb2e4ef28a98414772a1aab444d65d86df4fee0e06ba40dec320210d25e89e7d30f5769721daa9a21c2f2ade405ed4661bd4ed700795874a3c25fc41c2f3

Download Submit
C:\Windows\System\tHgKnJr.exe

Filesize
2.3MB

MD5
251cbaa280b36b28fe971e1bdfa0c1dc

SHA1
d29b4737c3efa35ec18f46027b961635c466971f

SHA256
eda561fb68917d62e3f143c1c350a34af0f209de3e431bf7a556a1b36ed5dff7

SHA512
5455908110c63c94620119ef21ddfbfa6eaa42c5a4af60bc3c1c0deaaa9ff7bc2eedc9c5eb41100da19f50031dc753a77e42b9e0092b33bcf85eaab39ed58df8

Download Submit
C:\Windows\System\uVvWePc.exe

Filesize
2.3MB

MD5
909b941de95e310a900d2bb117914688

SHA1
392d376f431e19b8119b60e4bb74630cb7f7fe72

SHA256
eaba8035cb1b02e76af3154e490d535c9ab3841a267e212652373c290fca9909

SHA512
9ab7bf531f8287d226b16fec1fc9c9846d5651948bd575cc12d3add6a3040a7363f8ed80ac1710cf2919f765a9fa935e5202b72a7b3b1e5a7b4ddc6f8d94d3a9

Download Submit
C:\Windows\System\vZCitMi.exe

Filesize
2.3MB

MD5
4ab217f62293faa99bedcba38b4fc88b

SHA1
709ff2f5df4f9e274933113934bced0a311a1b04

SHA256
6844c9d66f3a72d58e4a7791a926a2420659b2192b9b354db244268608eb4eec

SHA512
0ab831069a9619acde3783e9c0fcbb39d04dae93f34147a89a845745a531983e7d0ae95584b9564dbbb6ac6a8fcd45a48c4b458d1d81b5e72d0223e9fc0676e0

Download Submit
C:\Windows\System\wyIZPox.exe

Filesize
2.3MB

MD5
f92597ef321ff44b51d98e7ad55c0df1

SHA1
b3dead40a16ffb5018a447d50cd6bc6ffc10b234

SHA256
c864d24136a7e9d105cdd62c82d8732d06c983b8d7c144bd56875262c0130d93

SHA512
afff03758ecdacacc0860178f74e8ca17bc7d18cb371bfde79c8eed6d7c6f7a961627da2ed332f5f50838aab45069fcfa936a3c64bc1f04f75b991892db63ab1

Download Submit
C:\Windows\System\yIxoTtQ.exe

Filesize
2.3MB

MD5
506802a2975c2711d2ffd45533333cef

SHA1
a7e9bf0985a2e868dc1e6db12552479f826ebca5

SHA256
a6fd6481aadfa858c07a8d73941c596065b674537d54b79674d8a4d035c6a911

SHA512
b2c5d46ca040462402ee059557797a00b8fe65a168f37779182c3d6d76ec72d737462748e9aa13d073da0e2ea76c25083279b6410f6416f569d54f11edbd9048

Download Submit
C:\Windows\System\yuORGUF.exe

Filesize
2.3MB

MD5
f821b6fc95d0059fa24c83a030d9002c

SHA1
f8d4ec13a46aab2566ced773f00e7d9620129441

SHA256
935b937f592f4984b51efbb80cfb3c253bed437f375555e980eafec3daf401ec

SHA512
9cff56091ea8f6c19fa80ccfb135636c6d324fd979639024def1388321bbcdbac9cb5f98185b94e5b709bdb0ff4703058830a16e9e92b4d35b259c68dfd671e7

Download Submit
C:\Windows\System\zMyvBJf.exe

Filesize
2.3MB

MD5
007c75b60762a83f74970a618d0966c9

SHA1
470215295cbeef15bde0840771426351df6951db

SHA256
81e61765084c6165f72bf746b25aa386911674acfc51192efe27fb8f5b5b6021

SHA512
7642a64c1f1109b640af64473a15c5e28a56d5fc6e37484cdfd92c08e0a8220ce4f834780eaa47a85791d3d7a0dcd575047bb0fbb27beb2a552e699b79abd79f

Download Submit
C:\Windows\System\zWePgDr.exe

Filesize
2.3MB

MD5
6e3044d85b5a8aee31be9787735ed5a7

SHA1
6423da32ca0fad5b8f35338ea1864157d57bbacc

SHA256
729e29b19f1926f15f49654c58206411c7b4225553382c4aa94754870ea9c541

SHA512
e7079aac000a22263f36092dd7004e6946bf48d7ab066fbf924e77508f4ada5ce23d6c0081246f44c04fd5ec13886e6c82c6239901fef1ec347d5fefa3bd70f1

Download Submit
memory/872-1910-0x00007FF7F1B30000-0x00007FF7F1F22000-memory.dmp

Filesize
3.9MB

Download
memory/872-61-0x00007FF7F1B30000-0x00007FF7F1F22000-memory.dmp

Filesize
3.9MB

Download
memory/932-1820-0x00007FF731E70000-0x00007FF732262000-memory.dmp

Filesize
3.9MB

Download
memory/932-38-0x00007FF731E70000-0x00007FF732262000-memory.dmp

Filesize
3.9MB

Download
memory/1424-1938-0x00007FF73D6F0000-0x00007FF73DAE2000-memory.dmp

Filesize
3.9MB

Download
memory/1424-84-0x00007FF73D6F0000-0x00007FF73DAE2000-memory.dmp

Filesize
3.9MB

Download
memory/1676-109-0x00007FF6CB4A0000-0x00007FF6CB892000-memory.dmp

Filesize
3.9MB

Download
memory/1676-2031-0x00007FF6CB4A0000-0x00007FF6CB892000-memory.dmp

Filesize
3.9MB

Download
memory/1972-2243-0x00007FF6CFEA0000-0x00007FF6D0292000-memory.dmp

Filesize
3.9MB

Download
memory/1972-169-0x00007FF6CFEA0000-0x00007FF6D0292000-memory.dmp

Filesize
3.9MB

Download
memory/2228-2139-0x00007FF7E35D0000-0x00007FF7E39C2000-memory.dmp

Filesize
3.9MB

Download
memory/2228-143-0x00007FF7E35D0000-0x00007FF7E39C2000-memory.dmp

Filesize
3.9MB

Download
memory/2236-77-0x00007FF7D1360000-0x00007FF7D1752000-memory.dmp

Filesize
3.9MB

Download
memory/2236-1931-0x00007FF7D1360000-0x00007FF7D1752000-memory.dmp

Filesize
3.9MB

Download
memory/2716-153-0x00007FF7891C0000-0x00007FF7895B2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-1914-0x00007FF697660000-0x00007FF697A52000-memory.dmp

Filesize
3.9MB

Download
memory/2936-64-0x00007FF697660000-0x00007FF697A52000-memory.dmp

Filesize
3.9MB

Download
memory/3540-49-0x00007FF7C0820000-0x00007FF7C0C12000-memory.dmp

Filesize
3.9MB

Download
memory/3540-164-0x00007FF7C0820000-0x00007FF7C0C12000-memory.dmp

Filesize
3.9MB

Download
memory/3540-1848-0x00007FF7C0820000-0x00007FF7C0C12000-memory.dmp

Filesize
3.9MB

Download
memory/3572-132-0x00007FF63EA70000-0x00007FF63EE62000-memory.dmp

Filesize
3.9MB

Download
memory/3644-139-0x00007FF7F5A60000-0x00007FF7F5E52000-memory.dmp

Filesize
3.9MB

Download
memory/3644-2042-0x00007FF7F5A60000-0x00007FF7F5E52000-memory.dmp

Filesize
3.9MB

Download
memory/3648-145-0x00007FF7C7DC0000-0x00007FF7C81B2000-memory.dmp

Filesize
3.9MB

Download
memory/3648-2235-0x00007FF7C7DC0000-0x00007FF7C81B2000-memory.dmp

Filesize
3.9MB

Download
memory/4140-0-0x00007FF7267B0000-0x00007FF726BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4140-1-0x0000017EE3F60000-0x0000017EE3F70000-memory.dmp

Filesize
64KB

Download
memory/4140-99-0x00007FF7267B0000-0x00007FF726BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4152-1811-0x00007FF7A6370000-0x00007FF7A6762000-memory.dmp

Filesize
3.9MB

Download
memory/4152-34-0x00007FF7A6370000-0x00007FF7A6762000-memory.dmp

Filesize
3.9MB

Download
memory/4376-101-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmp

Filesize
10.8MB

Download
memory/4376-35-0x0000023F27AF0000-0x0000023F27B00000-memory.dmp

Filesize
64KB

Download
memory/4376-30-0x0000023F27AF0000-0x0000023F27B00000-memory.dmp

Filesize
64KB

Download
memory/4376-85-0x0000023F41360000-0x0000023F41B06000-memory.dmp

Filesize
7.6MB

Download
memory/4376-117-0x0000023F27AF0000-0x0000023F27B00000-memory.dmp

Filesize
64KB

Download
memory/4376-29-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmp

Filesize
10.8MB

Download
memory/4376-14-0x0000023F27AA0000-0x0000023F27AC2000-memory.dmp

Filesize
136KB

Download
memory/4376-110-0x0000023F27AF0000-0x0000023F27B00000-memory.dmp

Filesize
64KB

Download
memory/4388-128-0x00007FF7A8160000-0x00007FF7A8552000-memory.dmp

Filesize
3.9MB

Download
memory/4388-2033-0x00007FF7A8160000-0x00007FF7A8552000-memory.dmp

Filesize
3.9MB

Download
memory/4888-1824-0x00007FF66A8A0000-0x00007FF66AC92000-memory.dmp

Filesize
3.9MB

Download
memory/4888-46-0x00007FF66A8A0000-0x00007FF66AC92000-memory.dmp

Filesize
3.9MB

Download
memory/4920-70-0x00007FF754620000-0x00007FF754A12000-memory.dmp

Filesize
3.9MB

Download
memory/4920-1925-0x00007FF754620000-0x00007FF754A12000-memory.dmp

Filesize
3.9MB

Download
memory/4928-1826-0x00007FF7BE7B0000-0x00007FF7BEBA2000-memory.dmp

Filesize
3.9MB

Download
memory/4928-41-0x00007FF7BE7B0000-0x00007FF7BEBA2000-memory.dmp

Filesize
3.9MB

Download
memory/4984-2037-0x00007FF667170000-0x00007FF667562000-memory.dmp

Filesize
3.9MB

Download
memory/4984-92-0x00007FF667170000-0x00007FF667562000-memory.dmp

Filesize
3.9MB

Download
memory/4988-48-0x00007FF6A0F10000-0x00007FF6A1302000-memory.dmp

Filesize
3.9MB

Download
memory/4988-1843-0x00007FF6A0F10000-0x00007FF6A1302000-memory.dmp

Filesize
3.9MB

Download
memory/5032-2036-0x00007FF7ED4F0000-0x00007FF7ED8E2000-memory.dmp

Filesize
3.9MB

Download
memory/5032-91-0x00007FF7ED4F0000-0x00007FF7ED8E2000-memory.dmp

Filesize
3.9MB

Download