xmrig | ee4b81eed6734f0c8c318c14924db70fab7b2d50eddeaff5b9cc3705eec87ad8

Analysis

max time kernel
106s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
Size

2.2MB
MD5

0323ad7a45ae7cb9490923f347b6f3de
SHA1

67b047e9f354b7aac97394a074737eb4f5209ed2
SHA256

ee4b81eed6734f0c8c318c14924db70fab7b2d50eddeaff5b9cc3705eec87ad8
SHA512

7101ef2418ba94fa8f443999a50cf4d7a1c8a814263e0cd8bcd638f183824b9b5baa7646259da8c0ee769daf839027527c4b139936e57429a84d2384b348331d
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq4:NABx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/2812-54-0x00007FF6BB230000-0x00007FF6BB622000-memory.dmp	xmrig
behavioral2/memory/2640-67-0x00007FF7C3590000-0x00007FF7C3982000-memory.dmp	xmrig
behavioral2/memory/100-68-0x00007FF71C020000-0x00007FF71C412000-memory.dmp	xmrig
behavioral2/memory/460-66-0x00007FF60C2E0000-0x00007FF60C6D2000-memory.dmp	xmrig
behavioral2/memory/2640-262-0x00007FF7C3590000-0x00007FF7C3982000-memory.dmp	xmrig
behavioral2/memory/2496-265-0x00007FF751890000-0x00007FF751C82000-memory.dmp	xmrig
behavioral2/memory/2744-264-0x00007FF6F7DE0000-0x00007FF6F81D2000-memory.dmp	xmrig
behavioral2/memory/2328-277-0x00007FF6FBD00000-0x00007FF6FC0F2000-memory.dmp	xmrig
behavioral2/memory/3812-279-0x00007FF70F8C0000-0x00007FF70FCB2000-memory.dmp	xmrig
behavioral2/memory/3696-287-0x00007FF76DAA0000-0x00007FF76DE92000-memory.dmp	xmrig
behavioral2/memory/2344-292-0x00007FF68B810000-0x00007FF68BC02000-memory.dmp	xmrig
behavioral2/memory/2104-296-0x00007FF6A9160000-0x00007FF6A9552000-memory.dmp	xmrig
behavioral2/memory/1564-298-0x00007FF614A50000-0x00007FF614E42000-memory.dmp	xmrig
behavioral2/memory/3520-294-0x00007FF7E3EB0000-0x00007FF7E42A2000-memory.dmp	xmrig
behavioral2/memory/404-289-0x00007FF7E4C00000-0x00007FF7E4FF2000-memory.dmp	xmrig
behavioral2/memory/4580-288-0x00007FF75BBB0000-0x00007FF75BFA2000-memory.dmp	xmrig
behavioral2/memory/1624-284-0x00007FF629E30000-0x00007FF62A222000-memory.dmp	xmrig
behavioral2/memory/1760-282-0x00007FF6416D0000-0x00007FF641AC2000-memory.dmp	xmrig
behavioral2/memory/2268-276-0x00007FF6595B0000-0x00007FF6599A2000-memory.dmp	xmrig
behavioral2/memory/880-49-0x00007FF6A4020000-0x00007FF6A4412000-memory.dmp	xmrig
behavioral2/memory/100-1871-0x00007FF71C020000-0x00007FF71C412000-memory.dmp	xmrig
behavioral2/memory/880-2231-0x00007FF6A4020000-0x00007FF6A4412000-memory.dmp	xmrig
behavioral2/memory/3696-2282-0x00007FF76DAA0000-0x00007FF76DE92000-memory.dmp	xmrig
behavioral2/memory/3812-2274-0x00007FF70F8C0000-0x00007FF70FCB2000-memory.dmp	xmrig
behavioral2/memory/2744-2253-0x00007FF6F7DE0000-0x00007FF6F81D2000-memory.dmp	xmrig
behavioral2/memory/1760-2227-0x00007FF6416D0000-0x00007FF641AC2000-memory.dmp	xmrig
behavioral2/memory/4232-2207-0x00007FF7DDB50000-0x00007FF7DDF42000-memory.dmp	xmrig
behavioral2/memory/2812-2206-0x00007FF6BB230000-0x00007FF6BB622000-memory.dmp	xmrig
behavioral2/memory/2328-2239-0x00007FF6FBD00000-0x00007FF6FC0F2000-memory.dmp	xmrig
behavioral2/memory/4548-2202-0x00007FF61E390000-0x00007FF61E782000-memory.dmp	xmrig
behavioral2/memory/404-2316-0x00007FF7E4C00000-0x00007FF7E4FF2000-memory.dmp	xmrig
behavioral2/memory/4580-2311-0x00007FF75BBB0000-0x00007FF75BFA2000-memory.dmp	xmrig
behavioral2/memory/224-2287-0x00007FF7A64C0000-0x00007FF7A68B2000-memory.dmp	xmrig
behavioral2/memory/460-2286-0x00007FF60C2E0000-0x00007FF60C6D2000-memory.dmp	xmrig
behavioral2/memory/2104-2271-0x00007FF6A9160000-0x00007FF6A9552000-memory.dmp	xmrig
behavioral2/memory/3520-2310-0x00007FF7E3EB0000-0x00007FF7E42A2000-memory.dmp	xmrig
behavioral2/memory/1564-2295-0x00007FF614A50000-0x00007FF614E42000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
5	2504	powershell.exe
9	2504	powershell.exe
22	2504	powershell.exe
23	2504	powershell.exe
26	2504	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
100	kJBaQqc.exe
2744	mCNfKYn.exe
2496	lNfVgvJ.exe
4548	MqifKIy.exe
880	HvEhxRr.exe
2812	vVfaJkK.exe
4232	TojgaBD.exe
460	usEUBgb.exe
224	FkDbchl.exe
2268	ptAFIaD.exe
2328	CBspdtZ.exe
3812	KwTXSSw.exe
1760	OoTwIHf.exe
1624	qtNIyqa.exe
3696	hTQCOXG.exe
4580	VnqseWg.exe
404	vIBkQLS.exe
2344	nhJhgth.exe
3520	phsJwDH.exe
2104	sTDzomR.exe
1564	daUMtQh.exe
3832	vyapbGT.exe
3004	rKhAUwK.exe
4260	IlRvety.exe
4316	IFeJilj.exe
4504	IvTWXYd.exe
2652	BjLQWYB.exe
3556	BgkSjGg.exe
2728	YIidJLg.exe
3344	lqMNFRE.exe
4464	PbVwHFx.exe
2392	vVlGXFY.exe
4844	XDuybmY.exe
2644	heVtSaj.exe
972	nJsObmV.exe
3448	UonbQxi.exe
3096	dTVbPXK.exe
5052	krRrYAy.exe
3952	yXHkjMY.exe
1764	YiTfwAP.exe
2464	IbxGobY.exe
2916	truSXuE.exe
2240	YHELLnf.exe
4584	RWiVzhG.exe
4324	KCaovHn.exe
3132	nAuzluQ.exe
3648	GVGwQyL.exe
3816	TXVNHtO.exe
3760	EjLvitX.exe
1948	arVRQgb.exe
3724	bUmlWez.exe
2648	cPWTWGG.exe
2960	SFVWzpX.exe
1968	fsdVuzj.exe
4448	UNvRUPM.exe
844	qvcTFjI.exe
2520	XpLIPNA.exe
3088	yQvVtzc.exe
4036	JPlsbfw.exe
5148	VMBHijl.exe
5180	LvYSpRD.exe
5212	hQeNsBm.exe
5256	uZEsela.exe
5296	UgvlZrR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2640-0-0x00007FF7C3590000-0x00007FF7C3982000-memory.dmp	upx
behavioral2/files/0x0010000000023259-6.dat	upx
behavioral2/memory/100-8-0x00007FF71C020000-0x00007FF71C412000-memory.dmp	upx
behavioral2/files/0x0007000000023267-10.dat	upx
behavioral2/files/0x0008000000023266-14.dat	upx
behavioral2/memory/2744-18-0x00007FF6F7DE0000-0x00007FF6F81D2000-memory.dmp	upx
behavioral2/memory/2496-19-0x00007FF751890000-0x00007FF751C82000-memory.dmp	upx
behavioral2/files/0x0007000000023268-26.dat	upx
behavioral2/memory/4548-42-0x00007FF61E390000-0x00007FF61E782000-memory.dmp	upx
behavioral2/files/0x0008000000023264-41.dat	upx
behavioral2/files/0x0007000000023269-47.dat	upx
behavioral2/files/0x000800000002326a-53.dat	upx
behavioral2/memory/2812-54-0x00007FF6BB230000-0x00007FF6BB622000-memory.dmp	upx
behavioral2/files/0x000700000002326c-60.dat	upx
behavioral2/memory/2640-67-0x00007FF7C3590000-0x00007FF7C3982000-memory.dmp	upx
behavioral2/files/0x000700000002326d-69.dat	upx
behavioral2/files/0x000700000002326e-74.dat	upx
behavioral2/memory/224-72-0x00007FF7A64C0000-0x00007FF7A68B2000-memory.dmp	upx
behavioral2/memory/100-68-0x00007FF71C020000-0x00007FF71C412000-memory.dmp	upx
behavioral2/memory/460-66-0x00007FF60C2E0000-0x00007FF60C6D2000-memory.dmp	upx
behavioral2/memory/4232-57-0x00007FF7DDB50000-0x00007FF7DDF42000-memory.dmp	upx
behavioral2/files/0x0007000000023270-85.dat	upx
behavioral2/files/0x0007000000023271-89.dat	upx
behavioral2/files/0x0007000000023273-99.dat	upx
behavioral2/files/0x0007000000023276-117.dat	upx
behavioral2/files/0x000700000002327a-138.dat	upx
behavioral2/files/0x000700000002327b-143.dat	upx
behavioral2/files/0x000700000002327d-153.dat	upx
behavioral2/files/0x000700000002327f-163.dat	upx
behavioral2/files/0x0007000000023284-184.dat	upx
behavioral2/memory/2640-262-0x00007FF7C3590000-0x00007FF7C3982000-memory.dmp	upx
behavioral2/memory/2496-265-0x00007FF751890000-0x00007FF751C82000-memory.dmp	upx
behavioral2/memory/2744-264-0x00007FF6F7DE0000-0x00007FF6F81D2000-memory.dmp	upx
behavioral2/memory/2328-277-0x00007FF6FBD00000-0x00007FF6FC0F2000-memory.dmp	upx
behavioral2/memory/3812-279-0x00007FF70F8C0000-0x00007FF70FCB2000-memory.dmp	upx
behavioral2/memory/3696-287-0x00007FF76DAA0000-0x00007FF76DE92000-memory.dmp	upx
behavioral2/memory/2344-292-0x00007FF68B810000-0x00007FF68BC02000-memory.dmp	upx
behavioral2/memory/2104-296-0x00007FF6A9160000-0x00007FF6A9552000-memory.dmp	upx
behavioral2/memory/1564-298-0x00007FF614A50000-0x00007FF614E42000-memory.dmp	upx
behavioral2/memory/3520-294-0x00007FF7E3EB0000-0x00007FF7E42A2000-memory.dmp	upx
behavioral2/memory/404-289-0x00007FF7E4C00000-0x00007FF7E4FF2000-memory.dmp	upx
behavioral2/memory/4580-288-0x00007FF75BBB0000-0x00007FF75BFA2000-memory.dmp	upx
behavioral2/memory/1624-284-0x00007FF629E30000-0x00007FF62A222000-memory.dmp	upx
behavioral2/memory/1760-282-0x00007FF6416D0000-0x00007FF641AC2000-memory.dmp	upx
behavioral2/memory/2268-276-0x00007FF6595B0000-0x00007FF6599A2000-memory.dmp	upx
behavioral2/files/0x0007000000023285-187.dat	upx
behavioral2/files/0x0007000000023283-182.dat	upx
behavioral2/files/0x0007000000023282-178.dat	upx
behavioral2/files/0x0007000000023281-172.dat	upx
behavioral2/files/0x0007000000023280-168.dat	upx
behavioral2/files/0x000700000002327e-158.dat	upx
behavioral2/files/0x000700000002327c-147.dat	upx
behavioral2/files/0x0007000000023279-133.dat	upx
behavioral2/files/0x0007000000023278-127.dat	upx
behavioral2/files/0x0007000000023277-123.dat	upx
behavioral2/files/0x0007000000023275-110.dat	upx
behavioral2/files/0x0007000000023274-105.dat	upx
behavioral2/files/0x0007000000023272-95.dat	upx
behavioral2/files/0x000700000002326f-80.dat	upx
behavioral2/memory/880-49-0x00007FF6A4020000-0x00007FF6A4412000-memory.dmp	upx
behavioral2/memory/100-1871-0x00007FF71C020000-0x00007FF71C412000-memory.dmp	upx
behavioral2/memory/880-2231-0x00007FF6A4020000-0x00007FF6A4412000-memory.dmp	upx
behavioral2/memory/3696-2282-0x00007FF76DAA0000-0x00007FF76DE92000-memory.dmp	upx
behavioral2/memory/3812-2274-0x00007FF70F8C0000-0x00007FF70FCB2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YwvptiJ.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\wNWKXeh.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\OelXZdE.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\ohVlrqn.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\GfeUAyf.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\qtNIyqa.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\zcKeYmR.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\JuddWvM.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\qExgleE.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\WsksbfB.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\zXrJBKg.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\moirydD.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\mCNfKYn.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\YrrbaZb.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\DaQvlPK.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\grCGvPC.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\DYWrEdn.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\kMJHgLy.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\sPEOBeU.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\IogUQYH.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\nXLYadc.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\PFsugdS.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\FCywxMj.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\ObpdsVj.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\pAzilEv.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\NJTfADC.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\XkFyxmz.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\cJklJlI.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\vlWJkDN.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\nyujKkP.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\hvuFoOy.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\uXffQsV.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\cYGRUHv.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\SNdgJab.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\YaXpSjv.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\xKlXqIU.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\iyrtWEw.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\bbpEAmT.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\Ptucunw.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\vrFDUtU.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\qcBSlfx.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\SKMRndk.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\CzQfXcw.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\UlUvweb.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\GVGwQyL.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\aKWTxlN.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\eLHDMTB.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\MJtIEdD.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\CFDxfhI.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\WDzAcbU.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\qFpYghE.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\iReVkRs.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\boQqvSt.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\JLDPvzN.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\agsMOFv.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\YLuJxcx.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\gbVzsoX.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\CnfKezX.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\nAZGcoT.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\YnvuRwp.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\aTHHkhx.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\qAtxtZe.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\uQgxhgH.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
File created	C:\Windows\System\xRPKOtR.exe	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2504	powershell.exe
2504	powershell.exe
2504	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
Token: SeDebugPrivilege	2504	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2504	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	92
PID 2640 wrote to memory of 2504	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	92
PID 2640 wrote to memory of 100	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	93
PID 2640 wrote to memory of 100	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	93
PID 2640 wrote to memory of 2744	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	94
PID 2640 wrote to memory of 2744	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	94
PID 2640 wrote to memory of 2496	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	95
PID 2640 wrote to memory of 2496	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	95
PID 2640 wrote to memory of 4548	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	96
PID 2640 wrote to memory of 4548	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	96
PID 2640 wrote to memory of 880	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	97
PID 2640 wrote to memory of 880	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	97
PID 2640 wrote to memory of 2812	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	98
PID 2640 wrote to memory of 2812	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	98
PID 2640 wrote to memory of 4232	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	99
PID 2640 wrote to memory of 4232	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	99
PID 2640 wrote to memory of 460	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	100
PID 2640 wrote to memory of 460	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	100
PID 2640 wrote to memory of 224	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	101
PID 2640 wrote to memory of 224	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	101
PID 2640 wrote to memory of 2268	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	102
PID 2640 wrote to memory of 2268	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	102
PID 2640 wrote to memory of 2328	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	103
PID 2640 wrote to memory of 2328	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	103
PID 2640 wrote to memory of 3812	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	104
PID 2640 wrote to memory of 3812	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	104
PID 2640 wrote to memory of 1760	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	105
PID 2640 wrote to memory of 1760	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	105
PID 2640 wrote to memory of 1624	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	106
PID 2640 wrote to memory of 1624	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	106
PID 2640 wrote to memory of 3696	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	107
PID 2640 wrote to memory of 3696	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	107
PID 2640 wrote to memory of 4580	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	108
PID 2640 wrote to memory of 4580	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	108
PID 2640 wrote to memory of 404	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	109
PID 2640 wrote to memory of 404	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	109
PID 2640 wrote to memory of 2344	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	110
PID 2640 wrote to memory of 2344	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	110
PID 2640 wrote to memory of 3520	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	111
PID 2640 wrote to memory of 3520	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	111
PID 2640 wrote to memory of 2104	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	112
PID 2640 wrote to memory of 2104	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	112
PID 2640 wrote to memory of 1564	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	113
PID 2640 wrote to memory of 1564	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	113
PID 2640 wrote to memory of 3832	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	114
PID 2640 wrote to memory of 3832	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	114
PID 2640 wrote to memory of 3004	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	115
PID 2640 wrote to memory of 3004	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	115
PID 2640 wrote to memory of 4260	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	116
PID 2640 wrote to memory of 4260	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	116
PID 2640 wrote to memory of 4316	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	117
PID 2640 wrote to memory of 4316	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	117
PID 2640 wrote to memory of 4504	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	118
PID 2640 wrote to memory of 4504	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	118
PID 2640 wrote to memory of 2652	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	119
PID 2640 wrote to memory of 2652	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	119
PID 2640 wrote to memory of 3556	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	120
PID 2640 wrote to memory of 3556	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	120
PID 2640 wrote to memory of 2728	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	121
PID 2640 wrote to memory of 2728	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	121
PID 2640 wrote to memory of 3344	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	122
PID 2640 wrote to memory of 3344	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	122
PID 2640 wrote to memory of 4464	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	123
PID 2640 wrote to memory of 4464	2640	0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0323ad7a45ae7cb9490923f347b6f3de_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\System\kJBaQqc.exe
  C:\Windows\System\kJBaQqc.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\mCNfKYn.exe
  C:\Windows\System\mCNfKYn.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\lNfVgvJ.exe
  C:\Windows\System\lNfVgvJ.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\MqifKIy.exe
  C:\Windows\System\MqifKIy.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\HvEhxRr.exe
  C:\Windows\System\HvEhxRr.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\vVfaJkK.exe
  C:\Windows\System\vVfaJkK.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\TojgaBD.exe
  C:\Windows\System\TojgaBD.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\usEUBgb.exe
  C:\Windows\System\usEUBgb.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\FkDbchl.exe
  C:\Windows\System\FkDbchl.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\ptAFIaD.exe
  C:\Windows\System\ptAFIaD.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\CBspdtZ.exe
  C:\Windows\System\CBspdtZ.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\KwTXSSw.exe
  C:\Windows\System\KwTXSSw.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\OoTwIHf.exe
  C:\Windows\System\OoTwIHf.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\qtNIyqa.exe
  C:\Windows\System\qtNIyqa.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\hTQCOXG.exe
  C:\Windows\System\hTQCOXG.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\VnqseWg.exe
  C:\Windows\System\VnqseWg.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\vIBkQLS.exe
  C:\Windows\System\vIBkQLS.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\nhJhgth.exe
  C:\Windows\System\nhJhgth.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\phsJwDH.exe
  C:\Windows\System\phsJwDH.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\sTDzomR.exe
  C:\Windows\System\sTDzomR.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\daUMtQh.exe
  C:\Windows\System\daUMtQh.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\vyapbGT.exe
  C:\Windows\System\vyapbGT.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\rKhAUwK.exe
  C:\Windows\System\rKhAUwK.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\IlRvety.exe
  C:\Windows\System\IlRvety.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\IFeJilj.exe
  C:\Windows\System\IFeJilj.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\IvTWXYd.exe
  C:\Windows\System\IvTWXYd.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\BjLQWYB.exe
  C:\Windows\System\BjLQWYB.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\BgkSjGg.exe
  C:\Windows\System\BgkSjGg.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\YIidJLg.exe
  C:\Windows\System\YIidJLg.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\lqMNFRE.exe
  C:\Windows\System\lqMNFRE.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\PbVwHFx.exe
  C:\Windows\System\PbVwHFx.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\vVlGXFY.exe
  C:\Windows\System\vVlGXFY.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\XDuybmY.exe
  C:\Windows\System\XDuybmY.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\heVtSaj.exe
  C:\Windows\System\heVtSaj.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\nJsObmV.exe
  C:\Windows\System\nJsObmV.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\UonbQxi.exe
  C:\Windows\System\UonbQxi.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\dTVbPXK.exe
  C:\Windows\System\dTVbPXK.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\krRrYAy.exe
  C:\Windows\System\krRrYAy.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\yXHkjMY.exe
  C:\Windows\System\yXHkjMY.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\YiTfwAP.exe
  C:\Windows\System\YiTfwAP.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\IbxGobY.exe
  C:\Windows\System\IbxGobY.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\truSXuE.exe
  C:\Windows\System\truSXuE.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\YHELLnf.exe
  C:\Windows\System\YHELLnf.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\RWiVzhG.exe
  C:\Windows\System\RWiVzhG.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\KCaovHn.exe
  C:\Windows\System\KCaovHn.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\nAuzluQ.exe
  C:\Windows\System\nAuzluQ.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\GVGwQyL.exe
  C:\Windows\System\GVGwQyL.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\TXVNHtO.exe
  C:\Windows\System\TXVNHtO.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\EjLvitX.exe
  C:\Windows\System\EjLvitX.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\arVRQgb.exe
  C:\Windows\System\arVRQgb.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\bUmlWez.exe
  C:\Windows\System\bUmlWez.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\cPWTWGG.exe
  C:\Windows\System\cPWTWGG.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\SFVWzpX.exe
  C:\Windows\System\SFVWzpX.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\fsdVuzj.exe
  C:\Windows\System\fsdVuzj.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\UNvRUPM.exe
  C:\Windows\System\UNvRUPM.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\qvcTFjI.exe
  C:\Windows\System\qvcTFjI.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\XpLIPNA.exe
  C:\Windows\System\XpLIPNA.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\yQvVtzc.exe
  C:\Windows\System\yQvVtzc.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\JPlsbfw.exe
  C:\Windows\System\JPlsbfw.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\VMBHijl.exe
  C:\Windows\System\VMBHijl.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\LvYSpRD.exe
  C:\Windows\System\LvYSpRD.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\hQeNsBm.exe
  C:\Windows\System\hQeNsBm.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\uZEsela.exe
  C:\Windows\System\uZEsela.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\UgvlZrR.exe
  C:\Windows\System\UgvlZrR.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System\LpBAeOx.exe
  C:\Windows\System\LpBAeOx.exe
  2⤵
  PID:5404
- C:\Windows\System\nHhPkIu.exe
  C:\Windows\System\nHhPkIu.exe
  2⤵
  PID:5432
- C:\Windows\System\NtWTCqk.exe
  C:\Windows\System\NtWTCqk.exe
  2⤵
  PID:5456
- C:\Windows\System\mCHiemj.exe
  C:\Windows\System\mCHiemj.exe
  2⤵
  PID:5508
- C:\Windows\System\GNysTMr.exe
  C:\Windows\System\GNysTMr.exe
  2⤵
  PID:5532
- C:\Windows\System\PrYczoI.exe
  C:\Windows\System\PrYczoI.exe
  2⤵
  PID:5564
- C:\Windows\System\tNpauyd.exe
  C:\Windows\System\tNpauyd.exe
  2⤵
  PID:5600
- C:\Windows\System\AZFGynv.exe
  C:\Windows\System\AZFGynv.exe
  2⤵
  PID:5620
- C:\Windows\System\xqdKlGg.exe
  C:\Windows\System\xqdKlGg.exe
  2⤵
  PID:5640
- C:\Windows\System\JvRwBgx.exe
  C:\Windows\System\JvRwBgx.exe
  2⤵
  PID:5668
- C:\Windows\System\hwPjuLT.exe
  C:\Windows\System\hwPjuLT.exe
  2⤵
  PID:5700
- C:\Windows\System\UORkwbl.exe
  C:\Windows\System\UORkwbl.exe
  2⤵
  PID:5724
- C:\Windows\System\uEJnVgK.exe
  C:\Windows\System\uEJnVgK.exe
  2⤵
  PID:5748
- C:\Windows\System\CfuqJjs.exe
  C:\Windows\System\CfuqJjs.exe
  2⤵
  PID:5780
- C:\Windows\System\OvNOJPO.exe
  C:\Windows\System\OvNOJPO.exe
  2⤵
  PID:5820
- C:\Windows\System\LcJtoNp.exe
  C:\Windows\System\LcJtoNp.exe
  2⤵
  PID:5840
- C:\Windows\System\oAwWTUh.exe
  C:\Windows\System\oAwWTUh.exe
  2⤵
  PID:5860
- C:\Windows\System\WbrGpuH.exe
  C:\Windows\System\WbrGpuH.exe
  2⤵
  PID:5900
- C:\Windows\System\UsGaAaT.exe
  C:\Windows\System\UsGaAaT.exe
  2⤵
  PID:5936
- C:\Windows\System\XBBkifp.exe
  C:\Windows\System\XBBkifp.exe
  2⤵
  PID:5960
- C:\Windows\System\zEvzCTt.exe
  C:\Windows\System\zEvzCTt.exe
  2⤵
  PID:5988
- C:\Windows\System\SUCvSPW.exe
  C:\Windows\System\SUCvSPW.exe
  2⤵
  PID:6004
- C:\Windows\System\wsjmNLW.exe
  C:\Windows\System\wsjmNLW.exe
  2⤵
  PID:6028
- C:\Windows\System\HCcVCxx.exe
  C:\Windows\System\HCcVCxx.exe
  2⤵
  PID:6052
- C:\Windows\System\CXvZwwQ.exe
  C:\Windows\System\CXvZwwQ.exe
  2⤵
  PID:6072
- C:\Windows\System\iniuEtw.exe
  C:\Windows\System\iniuEtw.exe
  2⤵
  PID:6104
- C:\Windows\System\ygEAIwD.exe
  C:\Windows\System\ygEAIwD.exe
  2⤵
  PID:6124
- C:\Windows\System\PkBETpo.exe
  C:\Windows\System\PkBETpo.exe
  2⤵
  PID:1512
- C:\Windows\System\xEdIpZD.exe
  C:\Windows\System\xEdIpZD.exe
  2⤵
  PID:5140
- C:\Windows\System\RNxbioD.exe
  C:\Windows\System\RNxbioD.exe
  2⤵
  PID:3580
- C:\Windows\System\bbpEAmT.exe
  C:\Windows\System\bbpEAmT.exe
  2⤵
  PID:1432
- C:\Windows\System\MzolUsI.exe
  C:\Windows\System\MzolUsI.exe
  2⤵
  PID:2148
- C:\Windows\System\EOddFhn.exe
  C:\Windows\System\EOddFhn.exe
  2⤵
  PID:5104
- C:\Windows\System\avSgobX.exe
  C:\Windows\System\avSgobX.exe
  2⤵
  PID:3720
- C:\Windows\System\wWgPXnV.exe
  C:\Windows\System\wWgPXnV.exe
  2⤵
  PID:5320
- C:\Windows\System\liUzgvs.exe
  C:\Windows\System\liUzgvs.exe
  2⤵
  PID:5284
- C:\Windows\System\mOmLNAm.exe
  C:\Windows\System\mOmLNAm.exe
  2⤵
  PID:4216
- C:\Windows\System\fgtLOYJ.exe
  C:\Windows\System\fgtLOYJ.exe
  2⤵
  PID:4076
- C:\Windows\System\lxiiQDd.exe
  C:\Windows\System\lxiiQDd.exe
  2⤵
  PID:5428
- C:\Windows\System\pWhzeUA.exe
  C:\Windows\System\pWhzeUA.exe
  2⤵
  PID:5464
- C:\Windows\System\YdXsrtZ.exe
  C:\Windows\System\YdXsrtZ.exe
  2⤵
  PID:5272
- C:\Windows\System\WYdmTDy.exe
  C:\Windows\System\WYdmTDy.exe
  2⤵
  PID:5516
- C:\Windows\System\IAxungo.exe
  C:\Windows\System\IAxungo.exe
  2⤵
  PID:5572
- C:\Windows\System\gpVJDwC.exe
  C:\Windows\System\gpVJDwC.exe
  2⤵
  PID:1792
- C:\Windows\System\eZItVcI.exe
  C:\Windows\System\eZItVcI.exe
  2⤵
  PID:5220
- C:\Windows\System\gTpoiNE.exe
  C:\Windows\System\gTpoiNE.exe
  2⤵
  PID:5740
- C:\Windows\System\uHPpQaQ.exe
  C:\Windows\System\uHPpQaQ.exe
  2⤵
  PID:5836
- C:\Windows\System\LrqFtbH.exe
  C:\Windows\System\LrqFtbH.exe
  2⤵
  PID:5912
- C:\Windows\System\XKVqyBi.exe
  C:\Windows\System\XKVqyBi.exe
  2⤵
  PID:5928
- C:\Windows\System\oxHEmrP.exe
  C:\Windows\System\oxHEmrP.exe
  2⤵
  PID:6012
- C:\Windows\System\bHZbvlB.exe
  C:\Windows\System\bHZbvlB.exe
  2⤵
  PID:5996
- C:\Windows\System\loDxpzT.exe
  C:\Windows\System\loDxpzT.exe
  2⤵
  PID:6048
- C:\Windows\System\uQWwMXa.exe
  C:\Windows\System\uQWwMXa.exe
  2⤵
  PID:2124
- C:\Windows\System\AqMchhT.exe
  C:\Windows\System\AqMchhT.exe
  2⤵
  PID:5204
- C:\Windows\System\zIKXjsG.exe
  C:\Windows\System\zIKXjsG.exe
  2⤵
  PID:4460
- C:\Windows\System\odPnCHt.exe
  C:\Windows\System\odPnCHt.exe
  2⤵
  PID:5244
- C:\Windows\System\mEVDQRX.exe
  C:\Windows\System\mEVDQRX.exe
  2⤵
  PID:4020
- C:\Windows\System\SyhaaOK.exe
  C:\Windows\System\SyhaaOK.exe
  2⤵
  PID:5444
- C:\Windows\System\wipEIPi.exe
  C:\Windows\System\wipEIPi.exe
  2⤵
  PID:5548
- C:\Windows\System\IogUQYH.exe
  C:\Windows\System\IogUQYH.exe
  2⤵
  PID:5760
- C:\Windows\System\wHzniTc.exe
  C:\Windows\System\wHzniTc.exe
  2⤵
  PID:5852
- C:\Windows\System\VZpCzOk.exe
  C:\Windows\System\VZpCzOk.exe
  2⤵
  PID:6132
- C:\Windows\System\hUzKWKE.exe
  C:\Windows\System\hUzKWKE.exe
  2⤵
  PID:6120
- C:\Windows\System\kQRkYpY.exe
  C:\Windows\System\kQRkYpY.exe
  2⤵
  PID:6112
- C:\Windows\System\PjIVVFE.exe
  C:\Windows\System\PjIVVFE.exe
  2⤵
  PID:6060
- C:\Windows\System\RLfsAew.exe
  C:\Windows\System\RLfsAew.exe
  2⤵
  PID:5584
- C:\Windows\System\iCytSnx.exe
  C:\Windows\System\iCytSnx.exe
  2⤵
  PID:2452
- C:\Windows\System\anfvmou.exe
  C:\Windows\System\anfvmou.exe
  2⤵
  PID:5500
- C:\Windows\System\ZPiQIEX.exe
  C:\Windows\System\ZPiQIEX.exe
  2⤵
  PID:6036
- C:\Windows\System\cjZAtUn.exe
  C:\Windows\System\cjZAtUn.exe
  2⤵
  PID:3944
- C:\Windows\System\FApztCs.exe
  C:\Windows\System\FApztCs.exe
  2⤵
  PID:6152
- C:\Windows\System\lKnRCfK.exe
  C:\Windows\System\lKnRCfK.exe
  2⤵
  PID:6260
- C:\Windows\System\yYNvVmP.exe
  C:\Windows\System\yYNvVmP.exe
  2⤵
  PID:6284
- C:\Windows\System\ZtqMwgC.exe
  C:\Windows\System\ZtqMwgC.exe
  2⤵
  PID:6348
- C:\Windows\System\DbfOiDU.exe
  C:\Windows\System\DbfOiDU.exe
  2⤵
  PID:6376
- C:\Windows\System\xqCHZLr.exe
  C:\Windows\System\xqCHZLr.exe
  2⤵
  PID:6440
- C:\Windows\System\KvzOoas.exe
  C:\Windows\System\KvzOoas.exe
  2⤵
  PID:6456
- C:\Windows\System\QzWmgvW.exe
  C:\Windows\System\QzWmgvW.exe
  2⤵
  PID:6476
- C:\Windows\System\dhVdVqg.exe
  C:\Windows\System\dhVdVqg.exe
  2⤵
  PID:6500
- C:\Windows\System\wuhCkyd.exe
  C:\Windows\System\wuhCkyd.exe
  2⤵
  PID:6524
- C:\Windows\System\fiOaDYG.exe
  C:\Windows\System\fiOaDYG.exe
  2⤵
  PID:6548
- C:\Windows\System\ZlqHUak.exe
  C:\Windows\System\ZlqHUak.exe
  2⤵
  PID:6624
- C:\Windows\System\QzWSWSb.exe
  C:\Windows\System\QzWSWSb.exe
  2⤵
  PID:6652
- C:\Windows\System\QYqjtwD.exe
  C:\Windows\System\QYqjtwD.exe
  2⤵
  PID:6704
- C:\Windows\System\aiTuJEg.exe
  C:\Windows\System\aiTuJEg.exe
  2⤵
  PID:6724
- C:\Windows\System\GcprNce.exe
  C:\Windows\System\GcprNce.exe
  2⤵
  PID:6748
- C:\Windows\System\ccnDeVY.exe
  C:\Windows\System\ccnDeVY.exe
  2⤵
  PID:6776
- C:\Windows\System\qUnkdCk.exe
  C:\Windows\System\qUnkdCk.exe
  2⤵
  PID:6796
- C:\Windows\System\HvkzneB.exe
  C:\Windows\System\HvkzneB.exe
  2⤵
  PID:6824
- C:\Windows\System\ATSTIai.exe
  C:\Windows\System\ATSTIai.exe
  2⤵
  PID:6852
- C:\Windows\System\LpqswDN.exe
  C:\Windows\System\LpqswDN.exe
  2⤵
  PID:6876
- C:\Windows\System\Ptucunw.exe
  C:\Windows\System\Ptucunw.exe
  2⤵
  PID:6900
- C:\Windows\System\VdYfQch.exe
  C:\Windows\System\VdYfQch.exe
  2⤵
  PID:6940
- C:\Windows\System\yWxIzaI.exe
  C:\Windows\System\yWxIzaI.exe
  2⤵
  PID:6960
- C:\Windows\System\EZMCdGx.exe
  C:\Windows\System\EZMCdGx.exe
  2⤵
  PID:6988
- C:\Windows\System\iwBuymf.exe
  C:\Windows\System\iwBuymf.exe
  2⤵
  PID:7024
- C:\Windows\System\LbsfIgu.exe
  C:\Windows\System\LbsfIgu.exe
  2⤵
  PID:7044
- C:\Windows\System\QoQApJe.exe
  C:\Windows\System\QoQApJe.exe
  2⤵
  PID:7064
- C:\Windows\System\xekoFYk.exe
  C:\Windows\System\xekoFYk.exe
  2⤵
  PID:7092
- C:\Windows\System\FajZscj.exe
  C:\Windows\System\FajZscj.exe
  2⤵
  PID:7148
- C:\Windows\System\DaQvlPK.exe
  C:\Windows\System\DaQvlPK.exe
  2⤵
  PID:2968
- C:\Windows\System\USZdkYV.exe
  C:\Windows\System\USZdkYV.exe
  2⤵
  PID:1560
- C:\Windows\System\KxptxZP.exe
  C:\Windows\System\KxptxZP.exe
  2⤵
  PID:6172
- C:\Windows\System\rvocuVx.exe
  C:\Windows\System\rvocuVx.exe
  2⤵
  PID:2572
- C:\Windows\System\aYZhxPH.exe
  C:\Windows\System\aYZhxPH.exe
  2⤵
  PID:6220
- C:\Windows\System\QHVuZti.exe
  C:\Windows\System\QHVuZti.exe
  2⤵
  PID:6368
- C:\Windows\System\BBTFaGV.exe
  C:\Windows\System\BBTFaGV.exe
  2⤵
  PID:6468
- C:\Windows\System\Chfzbav.exe
  C:\Windows\System\Chfzbav.exe
  2⤵
  PID:6412
- C:\Windows\System\JRHrdrs.exe
  C:\Windows\System\JRHrdrs.exe
  2⤵
  PID:6572
- C:\Windows\System\zPXQHrt.exe
  C:\Windows\System\zPXQHrt.exe
  2⤵
  PID:6756
- C:\Windows\System\UEeBDdu.exe
  C:\Windows\System\UEeBDdu.exe
  2⤵
  PID:2324
- C:\Windows\System\atZfoPj.exe
  C:\Windows\System\atZfoPj.exe
  2⤵
  PID:6792
- C:\Windows\System\hDjPxNj.exe
  C:\Windows\System\hDjPxNj.exe
  2⤵
  PID:6884
- C:\Windows\System\PaGUjXa.exe
  C:\Windows\System\PaGUjXa.exe
  2⤵
  PID:6980
- C:\Windows\System\nGViSie.exe
  C:\Windows\System\nGViSie.exe
  2⤵
  PID:7016
- C:\Windows\System\BiwtATd.exe
  C:\Windows\System\BiwtATd.exe
  2⤵
  PID:7156
- C:\Windows\System\jANcumd.exe
  C:\Windows\System\jANcumd.exe
  2⤵
  PID:6148
- C:\Windows\System\ARjqvlc.exe
  C:\Windows\System\ARjqvlc.exe
  2⤵
  PID:5920
- C:\Windows\System\LxEfPIa.exe
  C:\Windows\System\LxEfPIa.exe
  2⤵
  PID:6328
- C:\Windows\System\bKPpSaW.exe
  C:\Windows\System\bKPpSaW.exe
  2⤵
  PID:6436
- C:\Windows\System\gFHsdFL.exe
  C:\Windows\System\gFHsdFL.exe
  2⤵
  PID:6600
- C:\Windows\System\qfLHNzc.exe
  C:\Windows\System\qfLHNzc.exe
  2⤵
  PID:6664
- C:\Windows\System\qRdsfAj.exe
  C:\Windows\System\qRdsfAj.exe
  2⤵
  PID:6668
- C:\Windows\System\daKDigW.exe
  C:\Windows\System\daKDigW.exe
  2⤵
  PID:6952
- C:\Windows\System\pssBCoH.exe
  C:\Windows\System\pssBCoH.exe
  2⤵
  PID:7036
- C:\Windows\System\QKGnaSU.exe
  C:\Windows\System\QKGnaSU.exe
  2⤵
  PID:6344
- C:\Windows\System\JlayLKH.exe
  C:\Windows\System\JlayLKH.exe
  2⤵
  PID:6740
- C:\Windows\System\HLgNuiX.exe
  C:\Windows\System\HLgNuiX.exe
  2⤵
  PID:7104
- C:\Windows\System\RGmIrIB.exe
  C:\Windows\System\RGmIrIB.exe
  2⤵
  PID:6868
- C:\Windows\System\fwtCeRo.exe
  C:\Windows\System\fwtCeRo.exe
  2⤵
  PID:6936
- C:\Windows\System\XlDBZCm.exe
  C:\Windows\System\XlDBZCm.exe
  2⤵
  PID:5504
- C:\Windows\System\xhGPKlp.exe
  C:\Windows\System\xhGPKlp.exe
  2⤵
  PID:7084
- C:\Windows\System\MsiMfmG.exe
  C:\Windows\System\MsiMfmG.exe
  2⤵
  PID:6896
- C:\Windows\System\hMILTAj.exe
  C:\Windows\System\hMILTAj.exe
  2⤵
  PID:7216
- C:\Windows\System\TEZKEaE.exe
  C:\Windows\System\TEZKEaE.exe
  2⤵
  PID:7256
- C:\Windows\System\jGzVvRR.exe
  C:\Windows\System\jGzVvRR.exe
  2⤵
  PID:7280
- C:\Windows\System\ZptnKCE.exe
  C:\Windows\System\ZptnKCE.exe
  2⤵
  PID:7312
- C:\Windows\System\hCdRede.exe
  C:\Windows\System\hCdRede.exe
  2⤵
  PID:7344
- C:\Windows\System\uaAuPts.exe
  C:\Windows\System\uaAuPts.exe
  2⤵
  PID:7376
- C:\Windows\System\cTupjLm.exe
  C:\Windows\System\cTupjLm.exe
  2⤵
  PID:7424
- C:\Windows\System\VqGCAeO.exe
  C:\Windows\System\VqGCAeO.exe
  2⤵
  PID:7472
- C:\Windows\System\EkKBrfi.exe
  C:\Windows\System\EkKBrfi.exe
  2⤵
  PID:7520
- C:\Windows\System\SkDrMOn.exe
  C:\Windows\System\SkDrMOn.exe
  2⤵
  PID:7564
- C:\Windows\System\CuCQTNc.exe
  C:\Windows\System\CuCQTNc.exe
  2⤵
  PID:7592
- C:\Windows\System\suntaPH.exe
  C:\Windows\System\suntaPH.exe
  2⤵
  PID:7632
- C:\Windows\System\DaZteLB.exe
  C:\Windows\System\DaZteLB.exe
  2⤵
  PID:7648
- C:\Windows\System\AyGYWEC.exe
  C:\Windows\System\AyGYWEC.exe
  2⤵
  PID:7684
- C:\Windows\System\OpSshEe.exe
  C:\Windows\System\OpSshEe.exe
  2⤵
  PID:7720
- C:\Windows\System\ybAGyid.exe
  C:\Windows\System\ybAGyid.exe
  2⤵
  PID:7756
- C:\Windows\System\VOgacJE.exe
  C:\Windows\System\VOgacJE.exe
  2⤵
  PID:7784
- C:\Windows\System\aGzncnK.exe
  C:\Windows\System\aGzncnK.exe
  2⤵
  PID:7864
- C:\Windows\System\QdAEOem.exe
  C:\Windows\System\QdAEOem.exe
  2⤵
  PID:7884
- C:\Windows\System\aFDLaoI.exe
  C:\Windows\System\aFDLaoI.exe
  2⤵
  PID:7900
- C:\Windows\System\CbMtSmn.exe
  C:\Windows\System\CbMtSmn.exe
  2⤵
  PID:7932
- C:\Windows\System\nBCRazi.exe
  C:\Windows\System\nBCRazi.exe
  2⤵
  PID:7984
- C:\Windows\System\GXVSuZW.exe
  C:\Windows\System\GXVSuZW.exe
  2⤵
  PID:8132
- C:\Windows\System\GQhDMVq.exe
  C:\Windows\System\GQhDMVq.exe
  2⤵
  PID:8152
- C:\Windows\System\GxIrtMC.exe
  C:\Windows\System\GxIrtMC.exe
  2⤵
  PID:7336
- C:\Windows\System\ccZsluN.exe
  C:\Windows\System\ccZsluN.exe
  2⤵
  PID:7360
- C:\Windows\System\fMGHvNh.exe
  C:\Windows\System\fMGHvNh.exe
  2⤵
  PID:7560
- C:\Windows\System\ZxOYTHL.exe
  C:\Windows\System\ZxOYTHL.exe
  2⤵
  PID:7600
- C:\Windows\System\yUvoASB.exe
  C:\Windows\System\yUvoASB.exe
  2⤵
  PID:7860
- C:\Windows\System\ONeNcgD.exe
  C:\Windows\System\ONeNcgD.exe
  2⤵
  PID:8024
- C:\Windows\System\ecqvkav.exe
  C:\Windows\System\ecqvkav.exe
  2⤵
  PID:8044
- C:\Windows\System\QVYEjgd.exe
  C:\Windows\System\QVYEjgd.exe
  2⤵
  PID:8172
- C:\Windows\System\LyExSQR.exe
  C:\Windows\System\LyExSQR.exe
  2⤵
  PID:8068
- C:\Windows\System\ZSOETbK.exe
  C:\Windows\System\ZSOETbK.exe
  2⤵
  PID:8088
- C:\Windows\System\dSoiAXR.exe
  C:\Windows\System\dSoiAXR.exe
  2⤵
  PID:7496
- C:\Windows\System\LpvkwRq.exe
  C:\Windows\System\LpvkwRq.exe
  2⤵
  PID:7300
- C:\Windows\System\unbDWtK.exe
  C:\Windows\System\unbDWtK.exe
  2⤵
  PID:7200
- C:\Windows\System\eVHVPTA.exe
  C:\Windows\System\eVHVPTA.exe
  2⤵
  PID:7548
- C:\Windows\System\unhITAh.exe
  C:\Windows\System\unhITAh.exe
  2⤵
  PID:7276
- C:\Windows\System\lnzhvQq.exe
  C:\Windows\System\lnzhvQq.exe
  2⤵
  PID:7896
- C:\Windows\System\chgicxv.exe
  C:\Windows\System\chgicxv.exe
  2⤵
  PID:7388
- C:\Windows\System\AOlkjEN.exe
  C:\Windows\System\AOlkjEN.exe
  2⤵
  PID:7492
- C:\Windows\System\qAtxtZe.exe
  C:\Windows\System\qAtxtZe.exe
  2⤵
  PID:7656
- C:\Windows\System\hmYsxId.exe
  C:\Windows\System\hmYsxId.exe
  2⤵
  PID:7696
- C:\Windows\System\GHTMVdM.exe
  C:\Windows\System\GHTMVdM.exe
  2⤵
  PID:7940
- C:\Windows\System\vUayHNy.exe
  C:\Windows\System\vUayHNy.exe
  2⤵
  PID:8040
- C:\Windows\System\LejYPHR.exe
  C:\Windows\System\LejYPHR.exe
  2⤵
  PID:7844
- C:\Windows\System\ZTsAaTi.exe
  C:\Windows\System\ZTsAaTi.exe
  2⤵
  PID:8164
- C:\Windows\System\FJEOyOm.exe
  C:\Windows\System\FJEOyOm.exe
  2⤵
  PID:8148
- C:\Windows\System\KHpimUw.exe
  C:\Windows\System\KHpimUw.exe
  2⤵
  PID:7796
- C:\Windows\System\uzpqUSq.exe
  C:\Windows\System\uzpqUSq.exe
  2⤵
  PID:7820
- C:\Windows\System\oMUEOJt.exe
  C:\Windows\System\oMUEOJt.exe
  2⤵
  PID:7468
- C:\Windows\System\qpzduto.exe
  C:\Windows\System\qpzduto.exe
  2⤵
  PID:7712
- C:\Windows\System\RjLtMrY.exe
  C:\Windows\System\RjLtMrY.exe
  2⤵
  PID:7624
- C:\Windows\System\tBnxAIr.exe
  C:\Windows\System\tBnxAIr.exe
  2⤵
  PID:2300
- C:\Windows\System\uvZPDup.exe
  C:\Windows\System\uvZPDup.exe
  2⤵
  PID:8116
- C:\Windows\System\UqjVmls.exe
  C:\Windows\System\UqjVmls.exe
  2⤵
  PID:6180
- C:\Windows\System\QjXYgac.exe
  C:\Windows\System\QjXYgac.exe
  2⤵
  PID:5348
- C:\Windows\System\PdwaWER.exe
  C:\Windows\System\PdwaWER.exe
  2⤵
  PID:4996
- C:\Windows\System\SHceKam.exe
  C:\Windows\System\SHceKam.exe
  2⤵
  PID:7536
- C:\Windows\System\lgBJaTo.exe
  C:\Windows\System\lgBJaTo.exe
  2⤵
  PID:7752
- C:\Windows\System\ItZJCeq.exe
  C:\Windows\System\ItZJCeq.exe
  2⤵
  PID:6492
- C:\Windows\System\hqYByOC.exe
  C:\Windows\System\hqYByOC.exe
  2⤵
  PID:8216
- C:\Windows\System\DdQWUZF.exe
  C:\Windows\System\DdQWUZF.exe
  2⤵
  PID:8236
- C:\Windows\System\LTrJljw.exe
  C:\Windows\System\LTrJljw.exe
  2⤵
  PID:8252
- C:\Windows\System\TugTIOS.exe
  C:\Windows\System\TugTIOS.exe
  2⤵
  PID:8272
- C:\Windows\System\JJXdKAq.exe
  C:\Windows\System\JJXdKAq.exe
  2⤵
  PID:8292
- C:\Windows\System\vnDxTeN.exe
  C:\Windows\System\vnDxTeN.exe
  2⤵
  PID:8308
- C:\Windows\System\RUZCyzi.exe
  C:\Windows\System\RUZCyzi.exe
  2⤵
  PID:8328
- C:\Windows\System\xYyyXIn.exe
  C:\Windows\System\xYyyXIn.exe
  2⤵
  PID:8352
- C:\Windows\System\NyFhdLX.exe
  C:\Windows\System\NyFhdLX.exe
  2⤵
  PID:8368
- C:\Windows\System\NJTfADC.exe
  C:\Windows\System\NJTfADC.exe
  2⤵
  PID:8388
- C:\Windows\System\ifhGnXq.exe
  C:\Windows\System\ifhGnXq.exe
  2⤵
  PID:8412
- C:\Windows\System\tlKHUsq.exe
  C:\Windows\System\tlKHUsq.exe
  2⤵
  PID:8436
- C:\Windows\System\HvBaner.exe
  C:\Windows\System\HvBaner.exe
  2⤵
  PID:8460
- C:\Windows\System\vHoTira.exe
  C:\Windows\System\vHoTira.exe
  2⤵
  PID:8480
- C:\Windows\System\KHaIiZl.exe
  C:\Windows\System\KHaIiZl.exe
  2⤵
  PID:8504
- C:\Windows\System\MIIakEf.exe
  C:\Windows\System\MIIakEf.exe
  2⤵
  PID:8528
- C:\Windows\System\zIloYcq.exe
  C:\Windows\System\zIloYcq.exe
  2⤵
  PID:8564
- C:\Windows\System\RAqKqOu.exe
  C:\Windows\System\RAqKqOu.exe
  2⤵
  PID:8588
- C:\Windows\System\NmhzTRP.exe
  C:\Windows\System\NmhzTRP.exe
  2⤵
  PID:8608
- C:\Windows\System\hpBBqBO.exe
  C:\Windows\System\hpBBqBO.exe
  2⤵
  PID:8652
- C:\Windows\System\bJKYZKL.exe
  C:\Windows\System\bJKYZKL.exe
  2⤵
  PID:8672
- C:\Windows\System\HJBmpNA.exe
  C:\Windows\System\HJBmpNA.exe
  2⤵
  PID:8696
- C:\Windows\System\EOGMGDL.exe
  C:\Windows\System\EOGMGDL.exe
  2⤵
  PID:8720
- C:\Windows\System\EOWuiEK.exe
  C:\Windows\System\EOWuiEK.exe
  2⤵
  PID:8740
- C:\Windows\System\GjIHCvF.exe
  C:\Windows\System\GjIHCvF.exe
  2⤵
  PID:8760
- C:\Windows\System\zEvMjUq.exe
  C:\Windows\System\zEvMjUq.exe
  2⤵
  PID:8796
- C:\Windows\System\oFbJmuB.exe
  C:\Windows\System\oFbJmuB.exe
  2⤵
  PID:8820
- C:\Windows\System\CSSsyiO.exe
  C:\Windows\System\CSSsyiO.exe
  2⤵
  PID:8840
- C:\Windows\System\BlVEWWe.exe
  C:\Windows\System\BlVEWWe.exe
  2⤵
  PID:8872
- C:\Windows\System\UFLjZJJ.exe
  C:\Windows\System\UFLjZJJ.exe
  2⤵
  PID:8892
- C:\Windows\System\rfLxigW.exe
  C:\Windows\System\rfLxigW.exe
  2⤵
  PID:8916
- C:\Windows\System\jkxTeph.exe
  C:\Windows\System\jkxTeph.exe
  2⤵
  PID:8944
- C:\Windows\System\tjYqoSg.exe
  C:\Windows\System\tjYqoSg.exe
  2⤵
  PID:8968
- C:\Windows\System\VcghHWW.exe
  C:\Windows\System\VcghHWW.exe
  2⤵
  PID:8988
- C:\Windows\System\EUCkoDH.exe
  C:\Windows\System\EUCkoDH.exe
  2⤵
  PID:9016
- C:\Windows\System\uMbIMIO.exe
  C:\Windows\System\uMbIMIO.exe
  2⤵
  PID:9040
- C:\Windows\System\fCBEFkQ.exe
  C:\Windows\System\fCBEFkQ.exe
  2⤵
  PID:9068
- C:\Windows\System\FYDGPnu.exe
  C:\Windows\System\FYDGPnu.exe
  2⤵
  PID:9100
- C:\Windows\System\JeRBlLF.exe
  C:\Windows\System\JeRBlLF.exe
  2⤵
  PID:9124
- C:\Windows\System\ztcKxBn.exe
  C:\Windows\System\ztcKxBn.exe
  2⤵
  PID:9148
- C:\Windows\System\UfdsLpQ.exe
  C:\Windows\System\UfdsLpQ.exe
  2⤵
  PID:9172
- C:\Windows\System\dyswbyQ.exe
  C:\Windows\System\dyswbyQ.exe
  2⤵
  PID:9192
- C:\Windows\System\fxwiSmP.exe
  C:\Windows\System\fxwiSmP.exe
  2⤵
  PID:9212
- C:\Windows\System\iVaiPPC.exe
  C:\Windows\System\iVaiPPC.exe
  2⤵
  PID:8208
- C:\Windows\System\iuCoJMg.exe
  C:\Windows\System\iuCoJMg.exe
  2⤵
  PID:8300
- C:\Windows\System\vKDLRHM.exe
  C:\Windows\System\vKDLRHM.exe
  2⤵
  PID:8516
- C:\Windows\System\hUMZeAy.exe
  C:\Windows\System\hUMZeAy.exe
  2⤵
  PID:8632
- C:\Windows\System\jXIjGNt.exe
  C:\Windows\System\jXIjGNt.exe
  2⤵
  PID:8596
- C:\Windows\System\PkSJGTp.exe
  C:\Windows\System\PkSJGTp.exe
  2⤵
  PID:8788
- C:\Windows\System\SNdgJab.exe
  C:\Windows\System\SNdgJab.exe
  2⤵
  PID:8680
- C:\Windows\System\VPlheWp.exe
  C:\Windows\System\VPlheWp.exe
  2⤵
  PID:8728
- C:\Windows\System\nPRsmbi.exe
  C:\Windows\System\nPRsmbi.exe
  2⤵
  PID:8768
- C:\Windows\System\BTTFonY.exe
  C:\Windows\System\BTTFonY.exe
  2⤵
  PID:8816
- C:\Windows\System\aEYmHIf.exe
  C:\Windows\System\aEYmHIf.exe
  2⤵
  PID:9036
- C:\Windows\System\SWocFxE.exe
  C:\Windows\System\SWocFxE.exe
  2⤵
  PID:8908
- C:\Windows\System\wlWLczD.exe
  C:\Windows\System\wlWLczD.exe
  2⤵
  PID:8384
- C:\Windows\System\uasxOrM.exe
  C:\Windows\System\uasxOrM.exe
  2⤵
  PID:9184
- C:\Windows\System\rLgqvxT.exe
  C:\Windows\System\rLgqvxT.exe
  2⤵
  PID:8264
- C:\Windows\System\XfbDhNS.exe
  C:\Windows\System\XfbDhNS.exe
  2⤵
  PID:8832
- C:\Windows\System\JbrlteV.exe
  C:\Windows\System\JbrlteV.exe
  2⤵
  PID:8952
- C:\Windows\System\bDlAILF.exe
  C:\Windows\System\bDlAILF.exe
  2⤵
  PID:9252
- C:\Windows\System\UytDtgs.exe
  C:\Windows\System\UytDtgs.exe
  2⤵
  PID:9272
- C:\Windows\System\GfeUAyf.exe
  C:\Windows\System\GfeUAyf.exe
  2⤵
  PID:9292
- C:\Windows\System\xYkplcJ.exe
  C:\Windows\System\xYkplcJ.exe
  2⤵
  PID:9324
- C:\Windows\System\bkeyqLb.exe
  C:\Windows\System\bkeyqLb.exe
  2⤵
  PID:9348
- C:\Windows\System\iZrzbGa.exe
  C:\Windows\System\iZrzbGa.exe
  2⤵
  PID:9368
- C:\Windows\System\jwoKTmr.exe
  C:\Windows\System\jwoKTmr.exe
  2⤵
  PID:9392
- C:\Windows\System\KtWrgds.exe
  C:\Windows\System\KtWrgds.exe
  2⤵
  PID:9420
- C:\Windows\System\bZhpIly.exe
  C:\Windows\System\bZhpIly.exe
  2⤵
  PID:9440
- C:\Windows\System\SmNCApA.exe
  C:\Windows\System\SmNCApA.exe
  2⤵
  PID:9476
- C:\Windows\System\lsXEjcd.exe
  C:\Windows\System\lsXEjcd.exe
  2⤵
  PID:9492
- C:\Windows\System\UiZzhFJ.exe
  C:\Windows\System\UiZzhFJ.exe
  2⤵
  PID:9508
- C:\Windows\System\YSnZXug.exe
  C:\Windows\System\YSnZXug.exe
  2⤵
  PID:9640
- C:\Windows\System\FPdUJad.exe
  C:\Windows\System\FPdUJad.exe
  2⤵
  PID:9660
- C:\Windows\System\GcjOiKc.exe
  C:\Windows\System\GcjOiKc.exe
  2⤵
  PID:9688
- C:\Windows\System\fzHOojn.exe
  C:\Windows\System\fzHOojn.exe
  2⤵
  PID:9716
- C:\Windows\System\lrEJeTk.exe
  C:\Windows\System\lrEJeTk.exe
  2⤵
  PID:9776
- C:\Windows\System\oqbHSax.exe
  C:\Windows\System\oqbHSax.exe
  2⤵
  PID:9796
- C:\Windows\System\pPsbrWf.exe
  C:\Windows\System\pPsbrWf.exe
  2⤵
  PID:9832
- C:\Windows\System\wSidFZY.exe
  C:\Windows\System\wSidFZY.exe
  2⤵
  PID:9856
- C:\Windows\System\aVTzHzD.exe
  C:\Windows\System\aVTzHzD.exe
  2⤵
  PID:9880
- C:\Windows\System\AYBDwnO.exe
  C:\Windows\System\AYBDwnO.exe
  2⤵
  PID:9908
- C:\Windows\System\ofaXqBK.exe
  C:\Windows\System\ofaXqBK.exe
  2⤵
  PID:9932
- C:\Windows\System\XynKXev.exe
  C:\Windows\System\XynKXev.exe
  2⤵
  PID:9960
- C:\Windows\System\ztApmdU.exe
  C:\Windows\System\ztApmdU.exe
  2⤵
  PID:10016
- C:\Windows\System\GJnAsmd.exe
  C:\Windows\System\GJnAsmd.exe
  2⤵
  PID:10036
- C:\Windows\System\nwePxqH.exe
  C:\Windows\System\nwePxqH.exe
  2⤵
  PID:10056
- C:\Windows\System\xlLkxLl.exe
  C:\Windows\System\xlLkxLl.exe
  2⤵
  PID:10076
- C:\Windows\System\hZiPioF.exe
  C:\Windows\System\hZiPioF.exe
  2⤵
  PID:10104
- C:\Windows\System\YDiBjxh.exe
  C:\Windows\System\YDiBjxh.exe
  2⤵
  PID:10124
- C:\Windows\System\rnlmrrl.exe
  C:\Windows\System\rnlmrrl.exe
  2⤵
  PID:10144
- C:\Windows\System\uIKCHup.exe
  C:\Windows\System\uIKCHup.exe
  2⤵
  PID:10212
- C:\Windows\System\nFxKvMH.exe
  C:\Windows\System\nFxKvMH.exe
  2⤵
  PID:10232
- C:\Windows\System\GuElMrM.exe
  C:\Windows\System\GuElMrM.exe
  2⤵
  PID:8200
- C:\Windows\System\ivxyFcT.exe
  C:\Windows\System\ivxyFcT.exe
  2⤵
  PID:9052
- C:\Windows\System\cLkCubF.exe
  C:\Windows\System\cLkCubF.exe
  2⤵
  PID:9188
- C:\Windows\System\foRBQrX.exe
  C:\Windows\System\foRBQrX.exe
  2⤵
  PID:8600
- C:\Windows\System\qKxjZKb.exe
  C:\Windows\System\qKxjZKb.exe
  2⤵
  PID:9488
- C:\Windows\System\vLweSuW.exe
  C:\Windows\System\vLweSuW.exe
  2⤵
  PID:9264
- C:\Windows\System\xNmUOVH.exe
  C:\Windows\System\xNmUOVH.exe
  2⤵
  PID:9544
- C:\Windows\System\FJLbrda.exe
  C:\Windows\System\FJLbrda.exe
  2⤵
  PID:9388
- C:\Windows\System\yQSCqAP.exe
  C:\Windows\System\yQSCqAP.exe
  2⤵
  PID:9436
- C:\Windows\System\HQdbtiY.exe
  C:\Windows\System\HQdbtiY.exe
  2⤵
  PID:9608
- C:\Windows\System\UZFbGsh.exe
  C:\Windows\System\UZFbGsh.exe
  2⤵
  PID:9520
- C:\Windows\System\kkZrnGs.exe
  C:\Windows\System\kkZrnGs.exe
  2⤵
  PID:7460
- C:\Windows\System\qwOzZmB.exe
  C:\Windows\System\qwOzZmB.exe
  2⤵
  PID:9592
- C:\Windows\System\gDQybbj.exe
  C:\Windows\System\gDQybbj.exe
  2⤵
  PID:9976
- C:\Windows\System\jXXqnNP.exe
  C:\Windows\System\jXXqnNP.exe
  2⤵
  PID:9844
- C:\Windows\System\OUADKZR.exe
  C:\Windows\System\OUADKZR.exe
  2⤵
  PID:9896
- C:\Windows\System\QcGgleR.exe
  C:\Windows\System\QcGgleR.exe
  2⤵
  PID:10072
- C:\Windows\System\scrjNVS.exe
  C:\Windows\System\scrjNVS.exe
  2⤵
  PID:10064
- C:\Windows\System\bIXIIbw.exe
  C:\Windows\System\bIXIIbw.exe
  2⤵
  PID:10120
- C:\Windows\System\JLYFWqX.exe
  C:\Windows\System\JLYFWqX.exe
  2⤵
  PID:10136
- C:\Windows\System\XsDGWWK.exe
  C:\Windows\System\XsDGWWK.exe
  2⤵
  PID:10164
- C:\Windows\System\TXVSVCm.exe
  C:\Windows\System\TXVSVCm.exe
  2⤵
  PID:10008
- C:\Windows\System\mpckuOB.exe
  C:\Windows\System\mpckuOB.exe
  2⤵
  PID:10032
- C:\Windows\System\IXywmPW.exe
  C:\Windows\System\IXywmPW.exe
  2⤵
  PID:10048
- C:\Windows\System\TqvYMXT.exe
  C:\Windows\System\TqvYMXT.exe
  2⤵
  PID:8804
- C:\Windows\System\aCSsWyX.exe
  C:\Windows\System\aCSsWyX.exe
  2⤵
  PID:9336
- C:\Windows\System\biyFpxO.exe
  C:\Windows\System\biyFpxO.exe
  2⤵
  PID:3368
- C:\Windows\System\WRzRQOO.exe
  C:\Windows\System\WRzRQOO.exe
  2⤵
  PID:9624
- C:\Windows\System\UObCkzI.exe
  C:\Windows\System\UObCkzI.exe
  2⤵
  PID:9340
- C:\Windows\System\QejnhUk.exe
  C:\Windows\System\QejnhUk.exe
  2⤵
  PID:10252
- C:\Windows\System\YpPtWBU.exe
  C:\Windows\System\YpPtWBU.exe
  2⤵
  PID:10276
- C:\Windows\System\LtsrYEl.exe
  C:\Windows\System\LtsrYEl.exe
  2⤵
  PID:10304
- C:\Windows\System\BukakiU.exe
  C:\Windows\System\BukakiU.exe
  2⤵
  PID:10324
- C:\Windows\System\xyAkouh.exe
  C:\Windows\System\xyAkouh.exe
  2⤵
  PID:10352
- C:\Windows\System\yHVyujw.exe
  C:\Windows\System\yHVyujw.exe
  2⤵
  PID:10372
- C:\Windows\System\grCGvPC.exe
  C:\Windows\System\grCGvPC.exe
  2⤵
  PID:10396
- C:\Windows\System\mmbKUNW.exe
  C:\Windows\System\mmbKUNW.exe
  2⤵
  PID:10424
- C:\Windows\System\FephJpy.exe
  C:\Windows\System\FephJpy.exe
  2⤵
  PID:10444
- C:\Windows\System\OyfScAA.exe
  C:\Windows\System\OyfScAA.exe
  2⤵
  PID:10468
- C:\Windows\System\tbwPbAS.exe
  C:\Windows\System\tbwPbAS.exe
  2⤵
  PID:10488
- C:\Windows\System\ojqKGkg.exe
  C:\Windows\System\ojqKGkg.exe
  2⤵
  PID:10516
- C:\Windows\System\OdxXbdq.exe
  C:\Windows\System\OdxXbdq.exe
  2⤵
  PID:10540
- C:\Windows\System\zLhhNvn.exe
  C:\Windows\System\zLhhNvn.exe
  2⤵
  PID:10560
- C:\Windows\System\xlwSdlX.exe
  C:\Windows\System\xlwSdlX.exe
  2⤵
  PID:10620
- C:\Windows\System\uZQVcfs.exe
  C:\Windows\System\uZQVcfs.exe
  2⤵
  PID:10644
- C:\Windows\System\lukpONf.exe
  C:\Windows\System\lukpONf.exe
  2⤵
  PID:10664
- C:\Windows\System\aTHHkhx.exe
  C:\Windows\System\aTHHkhx.exe
  2⤵
  PID:10696
- C:\Windows\System\vmlFafN.exe
  C:\Windows\System\vmlFafN.exe
  2⤵
  PID:10720
- C:\Windows\System\TrWSSAG.exe
  C:\Windows\System\TrWSSAG.exe
  2⤵
  PID:10736
- C:\Windows\System\oDMbLgV.exe
  C:\Windows\System\oDMbLgV.exe
  2⤵
  PID:10760
- C:\Windows\System\xEKsncc.exe
  C:\Windows\System\xEKsncc.exe
  2⤵
  PID:10792
- C:\Windows\System\XnEgTHR.exe
  C:\Windows\System\XnEgTHR.exe
  2⤵
  PID:10816
- C:\Windows\System\cAZIcCu.exe
  C:\Windows\System\cAZIcCu.exe
  2⤵
  PID:10844
- C:\Windows\System\xVNOpMX.exe
  C:\Windows\System\xVNOpMX.exe
  2⤵
  PID:10860
- C:\Windows\System\bAQipnF.exe
  C:\Windows\System\bAQipnF.exe
  2⤵
  PID:10916
- C:\Windows\System\itMKBFT.exe
  C:\Windows\System\itMKBFT.exe
  2⤵
  PID:10936
- C:\Windows\System\zEoZznI.exe
  C:\Windows\System\zEoZznI.exe
  2⤵
  PID:10956
- C:\Windows\System\xfSnlKx.exe
  C:\Windows\System\xfSnlKx.exe
  2⤵
  PID:10980
- C:\Windows\System\eISnlIn.exe
  C:\Windows\System\eISnlIn.exe
  2⤵
  PID:11004
- C:\Windows\System\ttnSHNq.exe
  C:\Windows\System\ttnSHNq.exe
  2⤵
  PID:11028
- C:\Windows\System\ZWXfaHT.exe
  C:\Windows\System\ZWXfaHT.exe
  2⤵
  PID:11060
- C:\Windows\System\VTdhdrD.exe
  C:\Windows\System\VTdhdrD.exe
  2⤵
  PID:11096
- C:\Windows\System\QllTYJc.exe
  C:\Windows\System\QllTYJc.exe
  2⤵
  PID:11120
- C:\Windows\System\VoKtWQW.exe
  C:\Windows\System\VoKtWQW.exe
  2⤵
  PID:11140
- C:\Windows\System\KZvuDsE.exe
  C:\Windows\System\KZvuDsE.exe
  2⤵
  PID:11156
- C:\Windows\System\syXcSVm.exe
  C:\Windows\System\syXcSVm.exe
  2⤵
  PID:11172
- C:\Windows\System\NKRCQzV.exe
  C:\Windows\System\NKRCQzV.exe
  2⤵
  PID:11188
- C:\Windows\System\PiFmpHG.exe
  C:\Windows\System\PiFmpHG.exe
  2⤵
  PID:11208
- C:\Windows\System\IkoKlXH.exe
  C:\Windows\System\IkoKlXH.exe
  2⤵
  PID:11228
- C:\Windows\System\JUsWUMH.exe
  C:\Windows\System\JUsWUMH.exe
  2⤵
  PID:11248
- C:\Windows\System\DXpSwyV.exe
  C:\Windows\System\DXpSwyV.exe
  2⤵
  PID:9560
- C:\Windows\System\DYWrEdn.exe
  C:\Windows\System\DYWrEdn.exe
  2⤵
  PID:10244
- C:\Windows\System\RTBhCgG.exe
  C:\Windows\System\RTBhCgG.exe
  2⤵
  PID:10316
- C:\Windows\System\VyOSwLd.exe
  C:\Windows\System\VyOSwLd.exe
  2⤵
  PID:10364
- C:\Windows\System\BowZdVC.exe
  C:\Windows\System\BowZdVC.exe
  2⤵
  PID:10408
- C:\Windows\System\uHQYXPt.exe
  C:\Windows\System\uHQYXPt.exe
  2⤵
  PID:10460
- C:\Windows\System\qWybtkd.exe
  C:\Windows\System\qWybtkd.exe
  2⤵
  PID:10548
- C:\Windows\System\sSWEZIV.exe
  C:\Windows\System\sSWEZIV.exe
  2⤵
  PID:10628
- C:\Windows\System\ldXlrfe.exe
  C:\Windows\System\ldXlrfe.exe
  2⤵
  PID:10532
- C:\Windows\System\uxTjiPR.exe
  C:\Windows\System\uxTjiPR.exe
  2⤵
  PID:10768
- C:\Windows\System\ycRgBwW.exe
  C:\Windows\System\ycRgBwW.exe
  2⤵
  PID:10744
- C:\Windows\System\vAzRygZ.exe
  C:\Windows\System\vAzRygZ.exe
  2⤵
  PID:10808
- C:\Windows\System\MOjZsjd.exe
  C:\Windows\System\MOjZsjd.exe
  2⤵
  PID:10752
- C:\Windows\System\lElgRRN.exe
  C:\Windows\System\lElgRRN.exe
  2⤵
  PID:10932
- C:\Windows\System\leaLtwN.exe
  C:\Windows\System\leaLtwN.exe
  2⤵
  PID:10964
- C:\Windows\System\rVJOIFr.exe
  C:\Windows\System\rVJOIFr.exe
  2⤵
  PID:11000
- C:\Windows\System\DcvzSRG.exe
  C:\Windows\System\DcvzSRG.exe
  2⤵
  PID:11116
- C:\Windows\System\PPvsenr.exe
  C:\Windows\System\PPvsenr.exe
  2⤵
  PID:11168
- C:\Windows\System\JhdjxGU.exe
  C:\Windows\System\JhdjxGU.exe
  2⤵
  PID:11236
- C:\Windows\System\LWZMKRx.exe
  C:\Windows\System\LWZMKRx.exe
  2⤵
  PID:11196
- C:\Windows\System\qLPgxwE.exe
  C:\Windows\System\qLPgxwE.exe
  2⤵
  PID:11220
- C:\Windows\System\PduCuJC.exe
  C:\Windows\System\PduCuJC.exe
  2⤵
  PID:11260
- C:\Windows\System\JUoOYxc.exe
  C:\Windows\System\JUoOYxc.exe
  2⤵
  PID:10272
- C:\Windows\System\LuFBYqE.exe
  C:\Windows\System\LuFBYqE.exe
  2⤵
  PID:10608
- C:\Windows\System\NMegXAk.exe
  C:\Windows\System\NMegXAk.exe
  2⤵
  PID:10800
- C:\Windows\System\XWDGOvk.exe
  C:\Windows\System\XWDGOvk.exe
  2⤵
  PID:11284
- C:\Windows\System\AMToXzY.exe
  C:\Windows\System\AMToXzY.exe
  2⤵
  PID:11304
- C:\Windows\System\LdXUrIC.exe
  C:\Windows\System\LdXUrIC.exe
  2⤵
  PID:11344
- C:\Windows\System\QlqItIh.exe
  C:\Windows\System\QlqItIh.exe
  2⤵
  PID:11368
- C:\Windows\System\HpSgrDK.exe
  C:\Windows\System\HpSgrDK.exe
  2⤵
  PID:11392
- C:\Windows\System\hxgFsdu.exe
  C:\Windows\System\hxgFsdu.exe
  2⤵
  PID:11448
- C:\Windows\System\SuVrMrf.exe
  C:\Windows\System\SuVrMrf.exe
  2⤵
  PID:11468
- C:\Windows\System\RxYoULp.exe
  C:\Windows\System\RxYoULp.exe
  2⤵
  PID:11572
- C:\Windows\System\MSnhpkF.exe
  C:\Windows\System\MSnhpkF.exe
  2⤵
  PID:11592
- C:\Windows\System\QCqcfip.exe
  C:\Windows\System\QCqcfip.exe
  2⤵
  PID:11616
- C:\Windows\System\Wtoildb.exe
  C:\Windows\System\Wtoildb.exe
  2⤵
  PID:11640
- C:\Windows\System\aUTTXfP.exe
  C:\Windows\System\aUTTXfP.exe
  2⤵
  PID:11660
- C:\Windows\System\wAUTgAH.exe
  C:\Windows\System\wAUTgAH.exe
  2⤵
  PID:11684
- C:\Windows\System\qqQEpxN.exe
  C:\Windows\System\qqQEpxN.exe
  2⤵
  PID:11716
- C:\Windows\System\NKMWZLL.exe
  C:\Windows\System\NKMWZLL.exe
  2⤵
  PID:11732
- C:\Windows\System\AJbvtbw.exe
  C:\Windows\System\AJbvtbw.exe
  2⤵
  PID:11752
- C:\Windows\System\tSHFNgR.exe
  C:\Windows\System\tSHFNgR.exe
  2⤵
  PID:11768
- C:\Windows\System\sZLDSmg.exe
  C:\Windows\System\sZLDSmg.exe
  2⤵
  PID:11784
- C:\Windows\System\kzUsZju.exe
  C:\Windows\System\kzUsZju.exe
  2⤵
  PID:11800
- C:\Windows\System\phjoYMb.exe
  C:\Windows\System\phjoYMb.exe
  2⤵
  PID:11816
- C:\Windows\System\vaRYeNo.exe
  C:\Windows\System\vaRYeNo.exe
  2⤵
  PID:11832
- C:\Windows\System\fYzvdnw.exe
  C:\Windows\System\fYzvdnw.exe
  2⤵
  PID:11848
- C:\Windows\System\IBIHJsJ.exe
  C:\Windows\System\IBIHJsJ.exe
  2⤵
  PID:11876
- C:\Windows\System\VBYMrQk.exe
  C:\Windows\System\VBYMrQk.exe
  2⤵
  PID:11900
- C:\Windows\System\pdWwCuq.exe
  C:\Windows\System\pdWwCuq.exe
  2⤵
  PID:11928
- C:\Windows\System\bsnEPwP.exe
  C:\Windows\System\bsnEPwP.exe
  2⤵
  PID:11948
- C:\Windows\System\wFYHkEj.exe
  C:\Windows\System\wFYHkEj.exe
  2⤵
  PID:11968
- C:\Windows\System\braCQeE.exe
  C:\Windows\System\braCQeE.exe
  2⤵
  PID:12104
- C:\Windows\System\QaTzftM.exe
  C:\Windows\System\QaTzftM.exe
  2⤵
  PID:12124
- C:\Windows\System\boQqvSt.exe
  C:\Windows\System\boQqvSt.exe
  2⤵
  PID:12156
- C:\Windows\System\RYNPLAV.exe
  C:\Windows\System\RYNPLAV.exe
  2⤵
  PID:12172
- C:\Windows\System\oXwjejY.exe
  C:\Windows\System\oXwjejY.exe
  2⤵
  PID:12200
- C:\Windows\System\rPoYEed.exe
  C:\Windows\System\rPoYEed.exe
  2⤵
  PID:12232
- C:\Windows\System\YehFCFJ.exe
  C:\Windows\System\YehFCFJ.exe
  2⤵
  PID:12256
- C:\Windows\System\mETreYd.exe
  C:\Windows\System\mETreYd.exe
  2⤵
  PID:12276
- C:\Windows\System\HgsqIdA.exe
  C:\Windows\System\HgsqIdA.exe
  2⤵
  PID:10976
- C:\Windows\System\MqRhOez.exe
  C:\Windows\System\MqRhOez.exe
  2⤵
  PID:10900
- C:\Windows\System\mygeEWi.exe
  C:\Windows\System\mygeEWi.exe
  2⤵
  PID:11200
- C:\Windows\System\dDQtDeQ.exe
  C:\Windows\System\dDQtDeQ.exe
  2⤵
  PID:10380
- C:\Windows\System\bGzHiTI.exe
  C:\Windows\System\bGzHiTI.exe
  2⤵
  PID:10728
- C:\Windows\System\iuTXbur.exe
  C:\Windows\System\iuTXbur.exe
  2⤵
  PID:11356
- C:\Windows\System\aKWTxlN.exe
  C:\Windows\System\aKWTxlN.exe
  2⤵
  PID:11412
- C:\Windows\System\EwEqRhN.exe
  C:\Windows\System\EwEqRhN.exe
  2⤵
  PID:11296
- C:\Windows\System\iLQHbIW.exe
  C:\Windows\System\iLQHbIW.exe
  2⤵
  PID:11164
- C:\Windows\System\jMyzrPI.exe
  C:\Windows\System\jMyzrPI.exe
  2⤵
  PID:11340
- C:\Windows\System\KTOoYLg.exe
  C:\Windows\System\KTOoYLg.exe
  2⤵
  PID:11184
- C:\Windows\System\SKAYzYf.exe
  C:\Windows\System\SKAYzYf.exe
  2⤵
  PID:10712
- C:\Windows\System\eeeyINd.exe
  C:\Windows\System\eeeyINd.exe
  2⤵
  PID:11792
- C:\Windows\System\eLHDMTB.exe
  C:\Windows\System\eLHDMTB.exe
  2⤵
  PID:11692
- C:\Windows\System\eBqTVmI.exe
  C:\Windows\System\eBqTVmI.exe
  2⤵
  PID:11696
- C:\Windows\System\OwUkdwA.exe
  C:\Windows\System\OwUkdwA.exe
  2⤵
  PID:12076
- C:\Windows\System\krVvFwa.exe
  C:\Windows\System\krVvFwa.exe
  2⤵
  PID:11040
- C:\Windows\System\MeRNpQF.exe
  C:\Windows\System\MeRNpQF.exe
  2⤵
  PID:11112
- C:\Windows\System\HbGeuMX.exe
  C:\Windows\System\HbGeuMX.exe
  2⤵
  PID:10528
- C:\Windows\System\tQnlYIS.exe
  C:\Windows\System\tQnlYIS.exe
  2⤵
  PID:11244
- C:\Windows\System\upRFSTz.exe
  C:\Windows\System\upRFSTz.exe
  2⤵
  PID:10580
- C:\Windows\System\juFUNaL.exe
  C:\Windows\System\juFUNaL.exe
  2⤵
  PID:10388
- C:\Windows\System\RaHyvgF.exe
  C:\Windows\System\RaHyvgF.exe
  2⤵
  PID:11180
- C:\Windows\System\HqusjqK.exe
  C:\Windows\System\HqusjqK.exe
  2⤵
  PID:11680
- C:\Windows\System\JIykbWJ.exe
  C:\Windows\System\JIykbWJ.exe
  2⤵
  PID:12164
- C:\Windows\System\HDXHlXj.exe
  C:\Windows\System\HDXHlXj.exe
  2⤵
  PID:10264
- C:\Windows\System\rKSfuiH.exe
  C:\Windows\System\rKSfuiH.exe
  2⤵
  PID:11724
- C:\Windows\System\EEGjAcF.exe
  C:\Windows\System\EEGjAcF.exe
  2⤵
  PID:11796
- C:\Windows\System\kpLxkjl.exe
  C:\Windows\System\kpLxkjl.exe
  2⤵
  PID:11964
- C:\Windows\System\XjYdjYr.exe
  C:\Windows\System\XjYdjYr.exe
  2⤵
  PID:12304
- C:\Windows\System\BMtAGwG.exe
  C:\Windows\System\BMtAGwG.exe
  2⤵
  PID:12328
- C:\Windows\System\FYHBfUz.exe
  C:\Windows\System\FYHBfUz.exe
  2⤵
  PID:12360
- C:\Windows\System\tTVzyPa.exe
  C:\Windows\System\tTVzyPa.exe
  2⤵
  PID:12376
- C:\Windows\System\okplIuH.exe
  C:\Windows\System\okplIuH.exe
  2⤵
  PID:12404
- C:\Windows\System\pJrkNnQ.exe
  C:\Windows\System\pJrkNnQ.exe
  2⤵
  PID:12504
- C:\Windows\System\FcIrWZN.exe
  C:\Windows\System\FcIrWZN.exe
  2⤵
  PID:12532
- C:\Windows\System\VNzsAxj.exe
  C:\Windows\System\VNzsAxj.exe
  2⤵
  PID:12552
- C:\Windows\System\mEMntWP.exe
  C:\Windows\System\mEMntWP.exe
  2⤵
  PID:12572
- C:\Windows\System\eTZBIQL.exe
  C:\Windows\System\eTZBIQL.exe
  2⤵
  PID:12596
- C:\Windows\System\XkFyxmz.exe
  C:\Windows\System\XkFyxmz.exe
  2⤵
  PID:12616
- C:\Windows\System\RRhlkxT.exe
  C:\Windows\System\RRhlkxT.exe
  2⤵
  PID:12636
- C:\Windows\System\CKESiGk.exe
  C:\Windows\System\CKESiGk.exe
  2⤵
  PID:12660
- C:\Windows\System\qDlHFtq.exe
  C:\Windows\System\qDlHFtq.exe
  2⤵
  PID:12680
- C:\Windows\System\YrPKpBF.exe
  C:\Windows\System\YrPKpBF.exe
  2⤵
  PID:12708
- C:\Windows\System\sEdiZwl.exe
  C:\Windows\System\sEdiZwl.exe
  2⤵
  PID:12740
- C:\Windows\System\nYaKCPs.exe
  C:\Windows\System\nYaKCPs.exe
  2⤵
  PID:12764
- C:\Windows\System\shILisn.exe
  C:\Windows\System\shILisn.exe
  2⤵
  PID:12792
- C:\Windows\System\LqhlhoK.exe
  C:\Windows\System\LqhlhoK.exe
  2⤵
  PID:12816
- C:\Windows\System\yOdEPSy.exe
  C:\Windows\System\yOdEPSy.exe
  2⤵
  PID:12836
- C:\Windows\System\kkVHucU.exe
  C:\Windows\System\kkVHucU.exe
  2⤵
  PID:12876
- C:\Windows\System\PzBRxdF.exe
  C:\Windows\System\PzBRxdF.exe
  2⤵
  PID:12908
- C:\Windows\System\SjuHhKw.exe
  C:\Windows\System\SjuHhKw.exe
  2⤵
  PID:13024
- C:\Windows\System\uCIJZAA.exe
  C:\Windows\System\uCIJZAA.exe
  2⤵
  PID:13080
- C:\Windows\System\posvKSr.exe
  C:\Windows\System\posvKSr.exe
  2⤵
  PID:13104
- C:\Windows\System\ECWRmUH.exe
  C:\Windows\System\ECWRmUH.exe
  2⤵
  PID:13132
- C:\Windows\System\aafAkcM.exe
  C:\Windows\System\aafAkcM.exe
  2⤵
  PID:13152
- C:\Windows\System\hmLeRWt.exe
  C:\Windows\System\hmLeRWt.exe
  2⤵
  PID:13176
- C:\Windows\System\lRCqHWn.exe
  C:\Windows\System\lRCqHWn.exe
  2⤵
  PID:13200
- C:\Windows\System\AeqtaQt.exe
  C:\Windows\System\AeqtaQt.exe
  2⤵
  PID:13228
- C:\Windows\System\ADccQwh.exe
  C:\Windows\System\ADccQwh.exe
  2⤵
  PID:13244
- C:\Windows\System\WvVlHWe.exe
  C:\Windows\System\WvVlHWe.exe
  2⤵
  PID:13264
- C:\Windows\System\RirAndi.exe
  C:\Windows\System\RirAndi.exe
  2⤵
  PID:13288
- C:\Windows\System\AMbnqGE.exe
  C:\Windows\System\AMbnqGE.exe
  2⤵
  PID:11276
- C:\Windows\System\MrjiTAT.exe
  C:\Windows\System\MrjiTAT.exe
  2⤵
  PID:848
- C:\Windows\System\IWHyDVW.exe
  C:\Windows\System\IWHyDVW.exe
  2⤵
  PID:10300
- C:\Windows\System\skDouKY.exe
  C:\Windows\System\skDouKY.exe
  2⤵
  PID:1572
- C:\Windows\System\rDxBwXU.exe
  C:\Windows\System\rDxBwXU.exe
  2⤵
  PID:12388
- C:\Windows\System\ezCfVgq.exe
  C:\Windows\System\ezCfVgq.exe
  2⤵
  PID:4628
- C:\Windows\System\IvELkHx.exe
  C:\Windows\System\IvELkHx.exe
  2⤵
  PID:10880
- C:\Windows\System\cMgkcFP.exe
  C:\Windows\System\cMgkcFP.exe
  2⤵
  PID:11012
- C:\Windows\System\dPTHxtS.exe
  C:\Windows\System\dPTHxtS.exe
  2⤵
  PID:12296
- C:\Windows\System\KSjaBhR.exe
  C:\Windows\System\KSjaBhR.exe
  2⤵
  PID:12396
- C:\Windows\System\WMUgZWn.exe
  C:\Windows\System\WMUgZWn.exe
  2⤵
  PID:13304
- C:\Windows\System\iCqcBas.exe
  C:\Windows\System\iCqcBas.exe
  2⤵
  PID:12244
- C:\Windows\System\bZbveCq.exe
  C:\Windows\System\bZbveCq.exe
  2⤵
  PID:13140
- C:\Windows\System\jTqdHQX.exe
  C:\Windows\System\jTqdHQX.exe
  2⤵
  PID:12384
- C:\Windows\System\AcZkWwe.exe
  C:\Windows\System\AcZkWwe.exe
  2⤵
  PID:12884
- C:\Windows\System\uqixDcz.exe
  C:\Windows\System\uqixDcz.exe
  2⤵
  PID:12748
- C:\Windows\System\QYMLXuH.exe
  C:\Windows\System\QYMLXuH.exe
  2⤵
  PID:12692
- C:\Windows\System\VIlXEDj.exe
  C:\Windows\System\VIlXEDj.exe
  2⤵
  PID:12632
- C:\Windows\System\weIrrIz.exe
  C:\Windows\System\weIrrIz.exe
  2⤵
  PID:12136
- C:\Windows\System\hNsRyBN.exe
  C:\Windows\System\hNsRyBN.exe
  2⤵
  PID:2940
- C:\Windows\System\CbKpvWz.exe
  C:\Windows\System\CbKpvWz.exe
  2⤵
  PID:4964
- C:\Windows\System\OUsqgpV.exe
  C:\Windows\System\OUsqgpV.exe
  2⤵
  PID:12168
- C:\Windows\System\RPSDGKM.exe
  C:\Windows\System\RPSDGKM.exe
  2⤵
  PID:12584
- C:\Windows\System\STjZkou.exe
  C:\Windows\System\STjZkou.exe
  2⤵
  PID:12964
- C:\Windows\System\gjmVpKx.exe
  C:\Windows\System\gjmVpKx.exe
  2⤵
  PID:12800
- C:\Windows\System\yjHvPEw.exe
  C:\Windows\System\yjHvPEw.exe
  2⤵
  PID:12604
- C:\Windows\System\LdRzIUE.exe
  C:\Windows\System\LdRzIUE.exe
  2⤵
  PID:5384
- C:\Windows\System\pAzilEv.exe
  C:\Windows\System\pAzilEv.exe
  2⤵
  PID:12656
- C:\Windows\System\xoRIciO.exe
  C:\Windows\System\xoRIciO.exe
  2⤵
  PID:4200
- C:\Windows\System\YwvptiJ.exe
  C:\Windows\System\YwvptiJ.exe
  2⤵
  PID:13040
- C:\Windows\System\CaZfphl.exe
  C:\Windows\System\CaZfphl.exe
  2⤵
  PID:13100
- C:\Windows\System\AbyAnOG.exe
  C:\Windows\System\AbyAnOG.exe
  2⤵
  PID:5424
- C:\Windows\System\GvqdsEm.exe
  C:\Windows\System\GvqdsEm.exe
  2⤵
  PID:5492
- C:\Windows\System\pVrJhVH.exe
  C:\Windows\System\pVrJhVH.exe
  2⤵
  PID:11760
- C:\Windows\System\OCHPaSZ.exe
  C:\Windows\System\OCHPaSZ.exe
  2⤵
  PID:5588
- C:\Windows\System\tcBOWxy.exe
  C:\Windows\System\tcBOWxy.exe
  2⤵
  PID:5720
- C:\Windows\System\LmcnGSu.exe
  C:\Windows\System\LmcnGSu.exe
  2⤵
  PID:12264
- C:\Windows\System\HWTnYWG.exe
  C:\Windows\System\HWTnYWG.exe
  2⤵
  PID:5092
- C:\Windows\System\NmrfjKe.exe
  C:\Windows\System\NmrfjKe.exe
  2⤵
  PID:12864
- C:\Windows\System\TsKGZLV.exe
  C:\Windows\System\TsKGZLV.exe
  2⤵
  PID:3872
- C:\Windows\System\nQqqsLC.exe
  C:\Windows\System\nQqqsLC.exe
  2⤵
  PID:2776
- C:\Windows\System\bcdkBRc.exe
  C:\Windows\System\bcdkBRc.exe
  2⤵
  PID:12548
- C:\Windows\System\CBjbrOZ.exe
  C:\Windows\System\CBjbrOZ.exe
  2⤵
  PID:2332
- C:\Windows\System\VPiKTKJ.exe
  C:\Windows\System\VPiKTKJ.exe
  2⤵
  PID:1376
- C:\Windows\System\itDtOss.exe
  C:\Windows\System\itDtOss.exe
  2⤵
  PID:3672
- C:\Windows\System\zcKeYmR.exe
  C:\Windows\System\zcKeYmR.exe
  2⤵
  PID:12760
- C:\Windows\System\lQWYDYc.exe
  C:\Windows\System\lQWYDYc.exe
  2⤵
  PID:13216
- C:\Windows\System\JuddWvM.exe
  C:\Windows\System\JuddWvM.exe
  2⤵
  PID:5736
- C:\Windows\System\flCAeMh.exe
  C:\Windows\System\flCAeMh.exe
  2⤵
  PID:13128
- C:\Windows\System\YIgsZjL.exe
  C:\Windows\System\YIgsZjL.exe
  2⤵
  PID:4764
- C:\Windows\System\tJkbjvn.exe
  C:\Windows\System\tJkbjvn.exe
  2⤵
  PID:13412
- C:\Windows\System\MxWuDNg.exe
  C:\Windows\System\MxWuDNg.exe
  2⤵
  PID:13432
- C:\Windows\System\NAXiCNR.exe
  C:\Windows\System\NAXiCNR.exe
  2⤵
  PID:13464
- C:\Windows\System\qbikHsb.exe
  C:\Windows\System\qbikHsb.exe
  2⤵
  PID:13480
- C:\Windows\System\uHAeuqn.exe
  C:\Windows\System\uHAeuqn.exe
  2⤵
  PID:13504
- C:\Windows\System\zHWRMWw.exe
  C:\Windows\System\zHWRMWw.exe
  2⤵
  PID:13576
- C:\Windows\System\ZukWzln.exe
  C:\Windows\System\ZukWzln.exe
  2⤵
  PID:13596
- C:\Windows\System\CHNHIMl.exe
  C:\Windows\System\CHNHIMl.exe
  2⤵
  PID:13616
- C:\Windows\System\nPothdZ.exe
  C:\Windows\System\nPothdZ.exe
  2⤵
  PID:13636
- C:\Windows\System\KpZRifD.exe
  C:\Windows\System\KpZRifD.exe
  2⤵
  PID:13656
- C:\Windows\System\rYmFlbp.exe
  C:\Windows\System\rYmFlbp.exe
  2⤵
  PID:13680
- C:\Windows\System\bUTcZZH.exe
  C:\Windows\System\bUTcZZH.exe
  2⤵
  PID:13700
- C:\Windows\System\ZgKiCIW.exe
  C:\Windows\System\ZgKiCIW.exe
  2⤵
  PID:13724
- C:\Windows\System\vqFFrBV.exe
  C:\Windows\System\vqFFrBV.exe
  2⤵
  PID:13748
- C:\Windows\System\LhxeGie.exe
  C:\Windows\System\LhxeGie.exe
  2⤵
  PID:13772
- C:\Windows\System\HOrVoLX.exe
  C:\Windows\System\HOrVoLX.exe
  2⤵
  PID:13792
- C:\Windows\System\KvftZSZ.exe
  C:\Windows\System\KvftZSZ.exe
  2⤵
  PID:13868
- C:\Windows\System\jYyZGfY.exe
  C:\Windows\System\jYyZGfY.exe
  2⤵
  PID:13896
- C:\Windows\System\tSBAXUv.exe
  C:\Windows\System\tSBAXUv.exe
  2⤵
  PID:13928
- C:\Windows\System\CpCEors.exe
  C:\Windows\System\CpCEors.exe
  2⤵
  PID:13960
- C:\Windows\System\fResxCY.exe
  C:\Windows\System\fResxCY.exe
  2⤵
  PID:13976
- C:\Windows\System\ZonjVAU.exe
  C:\Windows\System\ZonjVAU.exe
  2⤵
  PID:14000
- C:\Windows\System\GiAPyUg.exe
  C:\Windows\System\GiAPyUg.exe
  2⤵
  PID:14020
- C:\Windows\System\dAwwjke.exe
  C:\Windows\System\dAwwjke.exe
  2⤵
  PID:14044
- C:\Windows\System\RDzvXDS.exe
  C:\Windows\System\RDzvXDS.exe
  2⤵
  PID:14076
- C:\Windows\System\qryLFKr.exe
  C:\Windows\System\qryLFKr.exe
  2⤵
  PID:14100
- C:\Windows\System\qExgleE.exe
  C:\Windows\System\qExgleE.exe
  2⤵
  PID:14124
- C:\Windows\System\yHBwQLz.exe
  C:\Windows\System\yHBwQLz.exe
  2⤵
  PID:14148
- C:\Windows\System\nKoLUBQ.exe
  C:\Windows\System\nKoLUBQ.exe
  2⤵
  PID:14168
- C:\Windows\System\sPEOBeU.exe
  C:\Windows\System\sPEOBeU.exe
  2⤵
  PID:14188
- C:\Windows\System\sWDGYQC.exe
  C:\Windows\System\sWDGYQC.exe
  2⤵
  PID:14220
- C:\Windows\System\SHUGhdP.exe
  C:\Windows\System\SHUGhdP.exe
  2⤵
  PID:14248
- C:\Windows\System\JUsSiOH.exe
  C:\Windows\System\JUsSiOH.exe
  2⤵
  PID:14288
- C:\Windows\System\NSZaBSG.exe
  C:\Windows\System\NSZaBSG.exe
  2⤵
  PID:5764
- C:\Windows\System\eWcHtku.exe
  C:\Windows\System\eWcHtku.exe
  2⤵
  PID:12772
- C:\Windows\System\CmTLStZ.exe
  C:\Windows\System\CmTLStZ.exe
  2⤵
  PID:4048
- C:\Windows\System\SyAuqqr.exe
  C:\Windows\System\SyAuqqr.exe
  2⤵
  PID:13740
- C:\Windows\System\kaOqBhP.exe
  C:\Windows\System\kaOqBhP.exe
  2⤵
  PID:4560
- C:\Windows\System\vRTUktM.exe
  C:\Windows\System\vRTUktM.exe
  2⤵
  PID:13560
- C:\Windows\System\tTilUDB.exe
  C:\Windows\System\tTilUDB.exe
  2⤵
  PID:13588
- C:\Windows\System\kYBsAZK.exe
  C:\Windows\System\kYBsAZK.exe
  2⤵
  PID:13608
- C:\Windows\System\NUEQDGH.exe
  C:\Windows\System\NUEQDGH.exe
  2⤵
  PID:13632
- C:\Windows\System\wiURQpR.exe
  C:\Windows\System\wiURQpR.exe
  2⤵
  PID:13696
- C:\Windows\System\pIhQSlm.exe
  C:\Windows\System\pIhQSlm.exe
  2⤵
  PID:13840
- C:\Windows\System\aOHpjOn.exe
  C:\Windows\System\aOHpjOn.exe
  2⤵
  PID:1876
- C:\Windows\System\jKvgWMg.exe
  C:\Windows\System\jKvgWMg.exe
  2⤵
  PID:13644
- C:\Windows\System\zWMQnoN.exe
  C:\Windows\System\zWMQnoN.exe
  2⤵
  PID:13676
- C:\Windows\System\HPDXTYK.exe
  C:\Windows\System\HPDXTYK.exe
  2⤵
  PID:14012
- C:\Windows\System\HtWojkn.exe
  C:\Windows\System\HtWojkn.exe
  2⤵
  PID:14008
- C:\Windows\System\SxkoQnZ.exe
  C:\Windows\System\SxkoQnZ.exe
  2⤵
  PID:14236
- C:\Windows\System\rbFEEHh.exe
  C:\Windows\System\rbFEEHh.exe
  2⤵
  PID:13072
- C:\Windows\System\XmHyfeL.exe
  C:\Windows\System\XmHyfeL.exe
  2⤵
  PID:14160
- C:\Windows\System\kwLPgyX.exe
  C:\Windows\System\kwLPgyX.exe
  2⤵
  PID:13916
- C:\Windows\System\cbSipKR.exe
  C:\Windows\System\cbSipKR.exe
  2⤵
  PID:764
- C:\Windows\System\gkLFJOh.exe
  C:\Windows\System\gkLFJOh.exe
  2⤵
  PID:14060
- C:\Windows\System\uQgxhgH.exe
  C:\Windows\System\uQgxhgH.exe
  2⤵
  PID:14184
- C:\Windows\System\CTWLBOk.exe
  C:\Windows\System\CTWLBOk.exe
  2⤵
  PID:3528
- C:\Windows\System\SoDxLBO.exe
  C:\Windows\System\SoDxLBO.exe
  2⤵
  PID:14320
- C:\Windows\System\tDRkuJp.exe
  C:\Windows\System\tDRkuJp.exe
  2⤵
  PID:5684
- C:\Windows\System\DDllATA.exe
  C:\Windows\System\DDllATA.exe
  2⤵
  PID:3620
- C:\Windows\System\vlNWYTU.exe
  C:\Windows\System\vlNWYTU.exe
  2⤵
  PID:5000
- C:\Windows\System\dpisXgB.exe
  C:\Windows\System\dpisXgB.exe
  2⤵
  PID:2712
- C:\Windows\System\bEWAuYA.exe
  C:\Windows\System\bEWAuYA.exe
  2⤵
  PID:6932
- C:\Windows\System\VLNFbzo.exe
  C:\Windows\System\VLNFbzo.exe
  2⤵
  PID:2260
- C:\Windows\System\lPjmpwI.exe
  C:\Windows\System\lPjmpwI.exe
  2⤵
  PID:816
- C:\Windows\System\cAoOhUa.exe
  C:\Windows\System\cAoOhUa.exe
  2⤵
  PID:12132
- C:\Windows\System\uKYcSAn.exe
  C:\Windows\System\uKYcSAn.exe
  2⤵
  PID:13860
- C:\Windows\System\DKqdeoG.exe
  C:\Windows\System\DKqdeoG.exe
  2⤵
  PID:14108
- C:\Windows\System\DsmywtD.exe
  C:\Windows\System\DsmywtD.exe
  2⤵
  PID:14324
- C:\Windows\System\aEuvOLx.exe
  C:\Windows\System\aEuvOLx.exe
  2⤵
  PID:4908
- C:\Windows\System\DQbADhY.exe
  C:\Windows\System\DQbADhY.exe
  2⤵
  PID:2176
- C:\Windows\System\rhXJmOX.exe
  C:\Windows\System\rhXJmOX.exe
  2⤵
  PID:13568
- C:\Windows\System\slziqkN.exe
  C:\Windows\System\slziqkN.exe
  2⤵
  PID:13496
- C:\Windows\System\RFuJbbw.exe
  C:\Windows\System\RFuJbbw.exe
  2⤵
  PID:4024
- C:\Windows\System\rZcGjxl.exe
  C:\Windows\System\rZcGjxl.exe
  2⤵
  PID:4820
- C:\Windows\System\HDLVHkw.exe
  C:\Windows\System\HDLVHkw.exe
  2⤵
  PID:540
- C:\Windows\System\DfWzQWl.exe
  C:\Windows\System\DfWzQWl.exe
  2⤵
  PID:1652
- C:\Windows\System\QABmZMC.exe
  C:\Windows\System\QABmZMC.exe
  2⤵
  PID:14036
- C:\Windows\System\TLZouwD.exe
  C:\Windows\System\TLZouwD.exe
  2⤵
  PID:13240
- C:\Windows\System\tUaTkTp.exe
  C:\Windows\System\tUaTkTp.exe
  2⤵
  PID:14032
- C:\Windows\System\jwUoFDO.exe
  C:\Windows\System\jwUoFDO.exe
  2⤵
  PID:5128
- C:\Windows\System\HwFPFBq.exe
  C:\Windows\System\HwFPFBq.exe
  2⤵
  PID:3356
- C:\Windows\System\phFRmwj.exe
  C:\Windows\System\phFRmwj.exe
  2⤵
  PID:5224
- C:\Windows\System\hNqgCnT.exe
  C:\Windows\System\hNqgCnT.exe
  2⤵
  PID:4256
- C:\Windows\System\SkhzXBW.exe
  C:\Windows\System\SkhzXBW.exe
  2⤵
  PID:7776
- C:\Windows\System\eJNFvSg.exe
  C:\Windows\System\eJNFvSg.exe
  2⤵
  PID:5848
- C:\Windows\System\UxaOoSo.exe
  C:\Windows\System\UxaOoSo.exe
  2⤵
  PID:8060
- C:\Windows\System\cTMZdAy.exe
  C:\Windows\System\cTMZdAy.exe
  2⤵
  PID:7448
- C:\Windows\System\RKmMxBh.exe
  C:\Windows\System\RKmMxBh.exe
  2⤵
  PID:6040
- C:\Windows\System\BUPaCuK.exe
  C:\Windows\System\BUPaCuK.exe
  2⤵
  PID:13844
- C:\Windows\System\qlKsPqV.exe
  C:\Windows\System\qlKsPqV.exe
  2⤵
  PID:5984
- C:\Windows\System\fHjXIQC.exe
  C:\Windows\System\fHjXIQC.exe
  2⤵
  PID:3612
- C:\Windows\System\iFiAsBu.exe
  C:\Windows\System\iFiAsBu.exe
  2⤵
  PID:13992
- C:\Windows\System\dNtOHbO.exe
  C:\Windows\System\dNtOHbO.exe
  2⤵
  PID:3104
- C:\Windows\System\AYSkHLc.exe
  C:\Windows\System\AYSkHLc.exe
  2⤵
  PID:1952
- C:\Windows\System\rmKWojJ.exe
  C:\Windows\System\rmKWojJ.exe
  2⤵
  PID:11744
- C:\Windows\System\xzlMVcu.exe
  C:\Windows\System\xzlMVcu.exe
  2⤵
  PID:5440
- C:\Windows\System\bOMUrkg.exe
  C:\Windows\System\bOMUrkg.exe
  2⤵
  PID:14216
- C:\Windows\System\RgCAbmY.exe
  C:\Windows\System\RgCAbmY.exe
  2⤵
  PID:5908
- C:\Windows\System\vdjndrG.exe
  C:\Windows\System\vdjndrG.exe
  2⤵
  PID:5756
- C:\Windows\System\CNUbJfJ.exe
  C:\Windows\System\CNUbJfJ.exe
  2⤵
  PID:5368
- C:\Windows\System\dpjzFeY.exe
  C:\Windows\System\dpjzFeY.exe
  2⤵
  PID:1704
- C:\Windows\System\rCinYgO.exe
  C:\Windows\System\rCinYgO.exe
  2⤵
  PID:5176
- C:\Windows\System\lTlZcfB.exe
  C:\Windows\System\lTlZcfB.exe
  2⤵
  PID:3592
- C:\Windows\System\hlKpmTL.exe
  C:\Windows\System\hlKpmTL.exe
  2⤵
  PID:7544
- C:\Windows\System\wGHtvwq.exe
  C:\Windows\System\wGHtvwq.exe
  2⤵
  PID:1020
- C:\Windows\System\hjoRFZW.exe
  C:\Windows\System\hjoRFZW.exe
  2⤵
  PID:7708
- C:\Windows\System\YptStLW.exe
  C:\Windows\System\YptStLW.exe
  2⤵
  PID:12032
- C:\Windows\System\QkHSBaw.exe
  C:\Windows\System\QkHSBaw.exe
  2⤵
  PID:5396
- C:\Windows\System\ePEBLZQ.exe
  C:\Windows\System\ePEBLZQ.exe
  2⤵
  PID:6408
- C:\Windows\System\IflMNHm.exe
  C:\Windows\System\IflMNHm.exe
  2⤵
  PID:892
- C:\Windows\System\qVwrUqA.exe
  C:\Windows\System\qVwrUqA.exe
  2⤵
  PID:6568
- C:\Windows\System\gxxSclm.exe
  C:\Windows\System\gxxSclm.exe
  2⤵
  PID:6928
- C:\Windows\System\CEzVmXl.exe
  C:\Windows\System\CEzVmXl.exe
  2⤵
  PID:6772
- C:\Windows\System\ECMLFbH.exe
  C:\Windows\System\ECMLFbH.exe
  2⤵
  PID:6588
- C:\Windows\System\PiuCBxG.exe
  C:\Windows\System\PiuCBxG.exe
  2⤵
  PID:6160
- C:\Windows\System\iyrtWEw.exe
  C:\Windows\System\iyrtWEw.exe
  2⤵
  PID:6712
- C:\Windows\System\utOtRJW.exe
  C:\Windows\System\utOtRJW.exe
  2⤵
  PID:4972
- C:\Windows\System\PzWRBNG.exe
  C:\Windows\System\PzWRBNG.exe
  2⤵
  PID:7628
- C:\Windows\System\rImncdz.exe
  C:\Windows\System\rImncdz.exe
  2⤵
  PID:14180
- C:\Windows\System\GaJDUFK.exe
  C:\Windows\System\GaJDUFK.exe
  2⤵
  PID:4140
- C:\Windows\System\DYdDgRp.exe
  C:\Windows\System\DYdDgRp.exe
  2⤵
  PID:6216
- C:\Windows\System\hAkGPpU.exe
  C:\Windows\System\hAkGPpU.exe
  2⤵
  PID:6080
- C:\Windows\System\hCjbhVq.exe
  C:\Windows\System\hCjbhVq.exe
  2⤵
  PID:1044
- C:\Windows\System\DceNoFH.exe
  C:\Windows\System\DceNoFH.exe
  2⤵
  PID:7116
- C:\Windows\System\SKMRndk.exe
  C:\Windows\System\SKMRndk.exe
  2⤵
  PID:7136
- C:\Windows\System\zVnOIPo.exe
  C:\Windows\System\zVnOIPo.exe
  2⤵
  PID:5544
- C:\Windows\System\HVFQxHY.exe
  C:\Windows\System\HVFQxHY.exe
  2⤵
  PID:6488
- C:\Windows\System\rRiuWyQ.exe
  C:\Windows\System\rRiuWyQ.exe
  2⤵
  PID:7160
- C:\Windows\System\numSJos.exe
  C:\Windows\System\numSJos.exe
  2⤵
  PID:6308
- C:\Windows\System\EjBggAG.exe
  C:\Windows\System\EjBggAG.exe
  2⤵
  PID:7680
- C:\Windows\System\ttruXsN.exe
  C:\Windows\System\ttruXsN.exe
  2⤵
  PID:6672
- C:\Windows\System\RikHmGk.exe
  C:\Windows\System\RikHmGk.exe
  2⤵
  PID:6836
- C:\Windows\System\QhwRliu.exe
  C:\Windows\System\QhwRliu.exe
  2⤵
  PID:6236
- C:\Windows\System\DWTkRYH.exe
  C:\Windows\System\DWTkRYH.exe
  2⤵
  PID:7080
- C:\Windows\System\AxnRprz.exe
  C:\Windows\System\AxnRprz.exe
  2⤵
  PID:5968
- C:\Windows\System\DbYqpBt.exe
  C:\Windows\System\DbYqpBt.exe
  2⤵
  PID:5892
- C:\Windows\System\rOeuERy.exe
  C:\Windows\System\rOeuERy.exe
  2⤵
  PID:7072
- C:\Windows\System\lyLVtyC.exe
  C:\Windows\System\lyLVtyC.exe
  2⤵
  PID:3848
- C:\Windows\System\CksMpte.exe
  C:\Windows\System\CksMpte.exe
  2⤵
  PID:6716
- C:\Windows\System\ZjmQLoj.exe
  C:\Windows\System\ZjmQLoj.exe
  2⤵
  PID:6176
- C:\Windows\System\moirydD.exe
  C:\Windows\System\moirydD.exe
  2⤵
  PID:6564
- C:\Windows\System\WDzAcbU.exe
  C:\Windows\System\WDzAcbU.exe
  2⤵
  PID:13296
- C:\Windows\System\PlOaRZX.exe
  C:\Windows\System\PlOaRZX.exe
  2⤵
  PID:5192
- C:\Windows\System\canpqoS.exe
  C:\Windows\System\canpqoS.exe
  2⤵
  PID:5816
- C:\Windows\System\KSQtkHw.exe
  C:\Windows\System\KSQtkHw.exe
  2⤵
  PID:7224
- C:\Windows\System\svwwkWz.exe
  C:\Windows\System\svwwkWz.exe
  2⤵
  PID:7320
- C:\Windows\System\cMRFlqc.exe
  C:\Windows\System\cMRFlqc.exe
  2⤵
  PID:5652
- C:\Windows\System\GIxLZib.exe
  C:\Windows\System\GIxLZib.exe
  2⤵
  PID:1776
- C:\Windows\System\YqgTCAr.exe
  C:\Windows\System\YqgTCAr.exe
  2⤵
  PID:6164
- C:\Windows\System\IJNnnCb.exe
  C:\Windows\System\IJNnnCb.exe
  2⤵
  PID:1980
- C:\Windows\System\ASAIXsy.exe
  C:\Windows\System\ASAIXsy.exe
  2⤵
  PID:6576
- C:\Windows\System\oqVUBLf.exe
  C:\Windows\System\oqVUBLf.exe
  2⤵
  PID:4368
- C:\Windows\System\LImFVkd.exe
  C:\Windows\System\LImFVkd.exe
  2⤵
  PID:3608
- C:\Windows\System\DYImmlb.exe
  C:\Windows\System\DYImmlb.exe
  2⤵
  PID:6224
- C:\Windows\System\WgcfGtu.exe
  C:\Windows\System\WgcfGtu.exe
  2⤵
  PID:6252
- C:\Windows\System\RvrfDlx.exe
  C:\Windows\System\RvrfDlx.exe
  2⤵
  PID:6812
- C:\Windows\System\wgSDBsI.exe
  C:\Windows\System\wgSDBsI.exe
  2⤵
  PID:5144
- C:\Windows\System\WAlDypF.exe
  C:\Windows\System\WAlDypF.exe
  2⤵
  PID:6596
- C:\Windows\System\tITvJgt.exe
  C:\Windows\System\tITvJgt.exe
  2⤵
  PID:2928
- C:\Windows\System\jQxxkJF.exe
  C:\Windows\System\jQxxkJF.exe
  2⤵
  PID:13408
- C:\Windows\System\FvVWpRv.exe
  C:\Windows\System\FvVWpRv.exe
  2⤵
  PID:7816
- C:\Windows\System\vvvTpIe.exe
  C:\Windows\System\vvvTpIe.exe
  2⤵
  PID:7928
- C:\Windows\System\ZgMFsny.exe
  C:\Windows\System\ZgMFsny.exe
  2⤵
  PID:6292
- C:\Windows\System\jEFmoji.exe
  C:\Windows\System\jEFmoji.exe
  2⤵
  PID:6688
- C:\Windows\System\mRZUFhi.exe
  C:\Windows\System\mRZUFhi.exe
  2⤵
  PID:6300
- C:\Windows\System\vUWmEDF.exe
  C:\Windows\System\vUWmEDF.exe
  2⤵
  PID:7980
- C:\Windows\System\mHQqmUr.exe
  C:\Windows\System\mHQqmUr.exe
  2⤵
  PID:6312
- C:\Windows\System\rgemrld.exe
  C:\Windows\System\rgemrld.exe
  2⤵
  PID:9772
- C:\Windows\System\lIieLcD.exe
  C:\Windows\System\lIieLcD.exe
  2⤵
  PID:7288
- C:\Windows\System\yLaxyGC.exe
  C:\Windows\System\yLaxyGC.exe
  2⤵
  PID:7328
- C:\Windows\System\VlidDaI.exe
  C:\Windows\System\VlidDaI.exe
  2⤵
  PID:7088
- C:\Windows\System\HISFqhE.exe
  C:\Windows\System\HISFqhE.exe
  2⤵
  PID:4156
- C:\Windows\System\uZKGJpU.exe
  C:\Windows\System\uZKGJpU.exe
  2⤵
  PID:6428
- C:\Windows\System\CzQfXcw.exe
  C:\Windows\System\CzQfXcw.exe
  2⤵
  PID:8248
- C:\Windows\System\RHhNnXh.exe
  C:\Windows\System\RHhNnXh.exe
  2⤵
  PID:14356
- C:\Windows\System\lRJnPNg.exe
  C:\Windows\System\lRJnPNg.exe
  2⤵
  PID:14384
- C:\Windows\System\PnKKJac.exe
  C:\Windows\System\PnKKJac.exe
  2⤵
  PID:14408
- C:\Windows\System\nAZGcoT.exe
  C:\Windows\System\nAZGcoT.exe
  2⤵
  PID:14448
- C:\Windows\System\dKtXTIb.exe
  C:\Windows\System\dKtXTIb.exe
  2⤵
  PID:14476
- C:\Windows\System\lawautD.exe
  C:\Windows\System\lawautD.exe
  2⤵
  PID:14492
- C:\Windows\System\CgILKYs.exe
  C:\Windows\System\CgILKYs.exe
  2⤵
  PID:14516
- C:\Windows\System\gpaeORw.exe
  C:\Windows\System\gpaeORw.exe
  2⤵
  PID:14540
- C:\Windows\System\nlKoIIh.exe
  C:\Windows\System\nlKoIIh.exe
  2⤵
  PID:14564
- C:\Windows\System\hLsOcSl.exe
  C:\Windows\System\hLsOcSl.exe
  2⤵
  PID:14596
- C:\Windows\System\vNyNSET.exe
  C:\Windows\System\vNyNSET.exe
  2⤵
  PID:14616
- C:\Windows\System\RkzkGSr.exe
  C:\Windows\System\RkzkGSr.exe
  2⤵
  PID:14636
- C:\Windows\System\yOvkRpd.exe
  C:\Windows\System\yOvkRpd.exe
  2⤵
  PID:14660
- C:\Windows\System\INwpdgg.exe
  C:\Windows\System\INwpdgg.exe
  2⤵
  PID:14688
- C:\Windows\System\OoYczKh.exe
  C:\Windows\System\OoYczKh.exe
  2⤵
  PID:14712
- C:\Windows\System\bhGrbya.exe
  C:\Windows\System\bhGrbya.exe
  2⤵
  PID:14736
- C:\Windows\System\VHlwsKs.exe
  C:\Windows\System\VHlwsKs.exe
  2⤵
  PID:14752
- C:\Windows\System\rGAdLIb.exe
  C:\Windows\System\rGAdLIb.exe
  2⤵
  PID:14772
- C:\Windows\System\ltlJZAp.exe
  C:\Windows\System\ltlJZAp.exe
  2⤵
  PID:14800
- C:\Windows\System\DeMRWWj.exe
  C:\Windows\System\DeMRWWj.exe
  2⤵
  PID:14932
- C:\Windows\System\WyQHXuK.exe
  C:\Windows\System\WyQHXuK.exe
  2⤵
  PID:14964
- C:\Windows\System\cVYQtvU.exe
  C:\Windows\System\cVYQtvU.exe
  2⤵
  PID:14988
- C:\Windows\System\laafxrh.exe
  C:\Windows\System\laafxrh.exe
  2⤵
  PID:15124
- C:\Windows\System\raMpzWA.exe
  C:\Windows\System\raMpzWA.exe
  2⤵
  PID:15248
- C:\Windows\System\RHvLJvo.exe
  C:\Windows\System\RHvLJvo.exe
  2⤵
  PID:15272
- C:\Windows\System\FAAmSZX.exe
  C:\Windows\System\FAAmSZX.exe
  2⤵
  PID:6840
- C:\Windows\System\SwcuXac.exe
  C:\Windows\System\SwcuXac.exe
  2⤵
  PID:8012
- C:\Windows\System\WQhBXqP.exe
  C:\Windows\System\WQhBXqP.exe
  2⤵
  PID:6324
- C:\Windows\System\NLDZRJz.exe
  C:\Windows\System\NLDZRJz.exe
  2⤵
  PID:7268
- C:\Windows\System\MqmvCzo.exe
  C:\Windows\System\MqmvCzo.exe
  2⤵
  PID:6580
- C:\Windows\System\MFOaeNK.exe
  C:\Windows\System\MFOaeNK.exe
  2⤵
  PID:14372
- C:\Windows\System\DGMWWSa.exe
  C:\Windows\System\DGMWWSa.exe
  2⤵
  PID:14548
- C:\Windows\System\FjhPAXE.exe
  C:\Windows\System\FjhPAXE.exe
  2⤵
  PID:14580
- C:\Windows\System\qFpYghE.exe
  C:\Windows\System\qFpYghE.exe
  2⤵
  PID:14592
- C:\Windows\System\wQAYahh.exe
  C:\Windows\System\wQAYahh.exe
  2⤵
  PID:14464
- C:\Windows\System\BxDlBbX.exe
  C:\Windows\System\BxDlBbX.exe
  2⤵
  PID:7396
- C:\Windows\System\alYSUvX.exe
  C:\Windows\System\alYSUvX.exe
  2⤵
  PID:14836
- C:\Windows\System\ohKLcdO.exe
  C:\Windows\System\ohKLcdO.exe
  2⤵
  PID:8180
- C:\Windows\System\rCTVQmC.exe
  C:\Windows\System\rCTVQmC.exe
  2⤵
  PID:14612
- C:\Windows\System\WirsdZX.exe
  C:\Windows\System\WirsdZX.exe
  2⤵
  PID:14668
- C:\Windows\System\VNulBWL.exe
  C:\Windows\System\VNulBWL.exe
  2⤵
  PID:14708
- C:\Windows\System\qdZrWuP.exe
  C:\Windows\System\qdZrWuP.exe
  2⤵
  PID:14884
- C:\Windows\System\OCqOftj.exe
  C:\Windows\System\OCqOftj.exe
  2⤵
  PID:7764
- C:\Windows\System\jmDbRxA.exe
  C:\Windows\System\jmDbRxA.exe
  2⤵
  PID:14508
- C:\Windows\System\kcqmxew.exe
  C:\Windows\System\kcqmxew.exe
  2⤵
  PID:15084
- C:\Windows\System\CayzWzU.exe
  C:\Windows\System\CayzWzU.exe
  2⤵
  PID:14840
- C:\Windows\System\tmEfYKn.exe
  C:\Windows\System\tmEfYKn.exe
  2⤵
  PID:7640
- C:\Windows\System\JpbbBam.exe
  C:\Windows\System\JpbbBam.exe
  2⤵
  PID:7704
- C:\Windows\System\BfzTgkR.exe
  C:\Windows\System\BfzTgkR.exe
  2⤵
  PID:8420
- C:\Windows\System\JQdSYfz.exe
  C:\Windows\System\JQdSYfz.exe
  2⤵
  PID:8560
- C:\Windows\System\AQtWKUK.exe
  C:\Windows\System\AQtWKUK.exe
  2⤵
  PID:8660
- C:\Windows\System\EOgaxnq.exe
  C:\Windows\System\EOgaxnq.exe
  2⤵
  PID:7364
- C:\Windows\System\NCYORUM.exe
  C:\Windows\System\NCYORUM.exe
  2⤵
  PID:8572
- C:\Windows\System\RlwqPxv.exe
  C:\Windows\System\RlwqPxv.exe
  2⤵
  PID:15352
- C:\Windows\System\GXrZytX.exe
  C:\Windows\System\GXrZytX.exe
  2⤵
  PID:8984
- C:\Windows\System\sbZAMsc.exe
  C:\Windows\System\sbZAMsc.exe
  2⤵
  PID:7540
- C:\Windows\System\VClgnXK.exe
  C:\Windows\System\VClgnXK.exe
  2⤵
  PID:14488
- C:\Windows\System\ULuGqkM.exe
  C:\Windows\System\ULuGqkM.exe
  2⤵
  PID:14536
- C:\Windows\System\myrVNyE.exe
  C:\Windows\System\myrVNyE.exe
  2⤵
  PID:8812
- C:\Windows\System\zbcuxQP.exe
  C:\Windows\System\zbcuxQP.exe
  2⤵
  PID:8108
- C:\Windows\System\tfvMfOQ.exe
  C:\Windows\System\tfvMfOQ.exe
  2⤵
  PID:8032
- C:\Windows\System\ERWYaqL.exe
  C:\Windows\System\ERWYaqL.exe
  2⤵
  PID:8900
- C:\Windows\System\xawSpii.exe
  C:\Windows\System\xawSpii.exe
  2⤵
  PID:14896
- C:\Windows\System\ZqAzhRC.exe
  C:\Windows\System\ZqAzhRC.exe
  2⤵
  PID:8748
- C:\Windows\System\ZxjQCPq.exe
  C:\Windows\System\ZxjQCPq.exe
  2⤵
  PID:14644
- C:\Windows\System\IXtwoaB.exe
  C:\Windows\System\IXtwoaB.exe
  2⤵
  PID:14748
- C:\Windows\System\VXTNosL.exe
  C:\Windows\System\VXTNosL.exe
  2⤵
  PID:14880
- C:\Windows\System\WhyZkKy.exe
  C:\Windows\System\WhyZkKy.exe
  2⤵
  PID:14796
- C:\Windows\System\aZxXnXr.exe
  C:\Windows\System\aZxXnXr.exe
  2⤵
  PID:8928
- C:\Windows\System\BQgxqlf.exe
  C:\Windows\System\BQgxqlf.exe
  2⤵
  PID:14812
- C:\Windows\System\pmrNsck.exe
  C:\Windows\System\pmrNsck.exe
  2⤵
  PID:15024
- C:\Windows\System\WYYxBjZ.exe
  C:\Windows\System\WYYxBjZ.exe
  2⤵
  PID:1128
- C:\Windows\System\dTpOaCA.exe
  C:\Windows\System\dTpOaCA.exe
  2⤵
  PID:5948
- C:\Windows\System\bbLuGWK.exe
  C:\Windows\System\bbLuGWK.exe
  2⤵
  PID:14980
- C:\Windows\System\hvuFoOy.exe
  C:\Windows\System\hvuFoOy.exe
  2⤵
  PID:14984
- C:\Windows\System\FTdVSch.exe
  C:\Windows\System\FTdVSch.exe
  2⤵
  PID:9280
- C:\Windows\System\RBuBvOq.exe
  C:\Windows\System\RBuBvOq.exe
  2⤵
  PID:8500
- C:\Windows\System\hasGVSu.exe
  C:\Windows\System\hasGVSu.exe
  2⤵
  PID:9024
- C:\Windows\System\BuomsEn.exe
  C:\Windows\System\BuomsEn.exe
  2⤵
  PID:9240
- C:\Windows\System\ROqalBj.exe
  C:\Windows\System\ROqalBj.exe
  2⤵
  PID:7748
- C:\Windows\System\PzUmTPA.exe
  C:\Windows\System\PzUmTPA.exe
  2⤵
  PID:9456
- C:\Windows\System\zJiAqGI.exe
  C:\Windows\System\zJiAqGI.exe
  2⤵
  PID:15164
- C:\Windows\System\pNVmEmS.exe
  C:\Windows\System\pNVmEmS.exe
  2⤵
  PID:9736
- C:\Windows\System\uvDuoZW.exe
  C:\Windows\System\uvDuoZW.exe
  2⤵
  PID:9344
- C:\Windows\System\GUYMQVZ.exe
  C:\Windows\System\GUYMQVZ.exe
  2⤵
  PID:9628
- C:\Windows\System\tuqjTDd.exe
  C:\Windows\System\tuqjTDd.exe
  2⤵
  PID:1824
- C:\Windows\System\EecQyCv.exe
  C:\Windows\System\EecQyCv.exe
  2⤵
  PID:2628
- C:\Windows\System\xvQLRbS.exe
  C:\Windows\System\xvQLRbS.exe
  2⤵
  PID:9648
- C:\Windows\System\wNWKXeh.exe
  C:\Windows\System\wNWKXeh.exe
  2⤵
  PID:8836
- C:\Windows\System\RIcedes.exe
  C:\Windows\System\RIcedes.exe
  2⤵
  PID:8144
- C:\Windows\System\ynEwJeZ.exe
  C:\Windows\System\ynEwJeZ.exe
  2⤵
  PID:13032
- C:\Windows\System\usvyuGa.exe
  C:\Windows\System\usvyuGa.exe
  2⤵
  PID:14744
- C:\Windows\System\uJSibmu.exe
  C:\Windows\System\uJSibmu.exe
  2⤵
  PID:9920
- C:\Windows\System\RpUwrfp.exe
  C:\Windows\System\RpUwrfp.exe
  2⤵
  PID:9824
- C:\Windows\System\xiWgMvz.exe
  C:\Windows\System\xiWgMvz.exe
  2⤵
  PID:4540
- C:\Windows\System\JuXqXgA.exe
  C:\Windows\System\JuXqXgA.exe
  2⤵
  PID:9744
- C:\Windows\System\EpHpNYp.exe
  C:\Windows\System\EpHpNYp.exe
  2⤵
  PID:9004
- C:\Windows\System\rfUbTOz.exe
  C:\Windows\System\rfUbTOz.exe
  2⤵
  PID:8848
- C:\Windows\System\eKyEiTy.exe
  C:\Windows\System\eKyEiTy.exe
  2⤵
  PID:10156
- C:\Windows\System\iReVkRs.exe
  C:\Windows\System\iReVkRs.exe
  2⤵
  PID:9236
- C:\Windows\System\WWwuccw.exe
  C:\Windows\System\WWwuccw.exe
  2⤵
  PID:15108
- C:\Windows\System\jrBEnuW.exe
  C:\Windows\System\jrBEnuW.exe
  2⤵
  PID:8096
- C:\Windows\System\meZTCoD.exe
  C:\Windows\System\meZTCoD.exe
  2⤵
  PID:8904
- C:\Windows\System\kfSEjWO.exe
  C:\Windows\System\kfSEjWO.exe
  2⤵
  PID:8336
- C:\Windows\System\reBEJUg.exe
  C:\Windows\System\reBEJUg.exe
  2⤵
  PID:8752
- C:\Windows\System\XOAygpd.exe
  C:\Windows\System\XOAygpd.exe
  2⤵
  PID:9532
- C:\Windows\System\WIpVEMa.exe
  C:\Windows\System\WIpVEMa.exe
  2⤵
  PID:9868
- C:\Windows\System\SemkVpm.exe
  C:\Windows\System\SemkVpm.exe
  2⤵
  PID:9168
- C:\Windows\System\qmPBSTT.exe
  C:\Windows\System\qmPBSTT.exe
  2⤵
  PID:9576
- C:\Windows\System\cJctjNM.exe
  C:\Windows\System\cJctjNM.exe
  2⤵
  PID:15280
- C:\Windows\System\uXffQsV.exe
  C:\Windows\System\uXffQsV.exe
  2⤵
  PID:8912
- C:\Windows\System\NOTdDij.exe
  C:\Windows\System\NOTdDij.exe
  2⤵
  PID:9668
- C:\Windows\System\qCpPTrZ.exe
  C:\Windows\System\qCpPTrZ.exe
  2⤵
  PID:4576
- C:\Windows\System\OelXZdE.exe
  C:\Windows\System\OelXZdE.exe
  2⤵
  PID:10188
- C:\Windows\System\MvXkCWN.exe
  C:\Windows\System\MvXkCWN.exe
  2⤵
  PID:9840
- C:\Windows\System\EKVIqeI.exe
  C:\Windows\System\EKVIqeI.exe
  2⤵
  PID:10204
- C:\Windows\System\xuMDPKY.exe
  C:\Windows\System\xuMDPKY.exe
  2⤵
  PID:9676
- C:\Windows\System\oJZMIqb.exe
  C:\Windows\System\oJZMIqb.exe
  2⤵
  PID:8424
- C:\Windows\System\hUZyoaN.exe
  C:\Windows\System\hUZyoaN.exe
  2⤵
  PID:9968
- C:\Windows\System\uXOOwYw.exe
  C:\Windows\System\uXOOwYw.exe
  2⤵
  PID:9180
- C:\Windows\System\cXFFHJx.exe
  C:\Windows\System\cXFFHJx.exe
  2⤵
  PID:9408
- C:\Windows\System\ccjaVbO.exe
  C:\Windows\System\ccjaVbO.exe
  2⤵
  PID:8736
- C:\Windows\System\kuCSzfq.exe
  C:\Windows\System\kuCSzfq.exe
  2⤵
  PID:10268
- C:\Windows\System\zdWSgTc.exe
  C:\Windows\System\zdWSgTc.exe
  2⤵
  PID:10228
- C:\Windows\System\otNfjLO.exe
  C:\Windows\System\otNfjLO.exe
  2⤵
  PID:10536
- C:\Windows\System\BSlaVaD.exe
  C:\Windows\System\BSlaVaD.exe
  2⤵
  PID:8524
- C:\Windows\System\fJumFXL.exe
  C:\Windows\System\fJumFXL.exe
  2⤵
  PID:9460
- C:\Windows\System\pjKheMo.exe
  C:\Windows\System\pjKheMo.exe
  2⤵
  PID:9500
- C:\Windows\System\SEwJzJv.exe
  C:\Windows\System\SEwJzJv.exe
  2⤵
  PID:10680
- C:\Windows\System\vYdBhAU.exe
  C:\Windows\System\vYdBhAU.exe
  2⤵
  PID:10576
- C:\Windows\System\UwTaipl.exe
  C:\Windows\System\UwTaipl.exe
  2⤵
  PID:8712
- C:\Windows\System\IADPZoe.exe
  C:\Windows\System\IADPZoe.exe
  2⤵
  PID:10824
- C:\Windows\System\CvYfoeR.exe
  C:\Windows\System\CvYfoeR.exe
  2⤵
  PID:10840
- C:\Windows\System\yWFVgbz.exe
  C:\Windows\System\yWFVgbz.exe
  2⤵
  PID:9876
- C:\Windows\System\Piirzxu.exe
  C:\Windows\System\Piirzxu.exe
  2⤵
  PID:9924
- C:\Windows\System\BMRNorj.exe
  C:\Windows\System\BMRNorj.exe
  2⤵
  PID:10172
- C:\Windows\System\DdydUnL.exe
  C:\Windows\System\DdydUnL.exe
  2⤵
  PID:7840
- C:\Windows\System\UGXRkIB.exe
  C:\Windows\System\UGXRkIB.exe
  2⤵
  PID:15336
- C:\Windows\System\EhbGJnc.exe
  C:\Windows\System\EhbGJnc.exe
  2⤵
  PID:10092
- C:\Windows\System\TtwuzTc.exe
  C:\Windows\System\TtwuzTc.exe
  2⤵
  PID:11044
- C:\Windows\System\YjhlWwB.exe
  C:\Windows\System\YjhlWwB.exe
  2⤵
  PID:1964
- C:\Windows\System\cYGRUHv.exe
  C:\Windows\System\cYGRUHv.exe
  2⤵
  PID:10596
- C:\Windows\System\TGMQHvI.exe
  C:\Windows\System\TGMQHvI.exe
  2⤵
  PID:10788
- C:\Windows\System\wclTPds.exe
  C:\Windows\System\wclTPds.exe
  2⤵
  PID:10508
- C:\Windows\System\XWpuCck.exe
  C:\Windows\System\XWpuCck.exe
  2⤵
  PID:11072
- C:\Windows\System\FftXtBD.exe
  C:\Windows\System\FftXtBD.exe
  2⤵
  PID:10616
- C:\Windows\System\SOwsljr.exe
  C:\Windows\System\SOwsljr.exe
  2⤵
  PID:9536
- C:\Windows\System\wnGGPBP.exe
  C:\Windows\System\wnGGPBP.exe
  2⤵
  PID:15368
- C:\Windows\System\BOZhKNu.exe
  C:\Windows\System\BOZhKNu.exe
  2⤵
  PID:15396
- C:\Windows\System\ynuAYFm.exe
  C:\Windows\System\ynuAYFm.exe
  2⤵
  PID:15428
- C:\Windows\System\PYGhBxS.exe
  C:\Windows\System\PYGhBxS.exe
  2⤵
  PID:15444
- C:\Windows\System\TZuylOz.exe
  C:\Windows\System\TZuylOz.exe
  2⤵
  PID:15464
- C:\Windows\System\kIWHdXa.exe
  C:\Windows\System\kIWHdXa.exe
  2⤵
  PID:15488
- C:\Windows\System\hGtyZkD.exe
  C:\Windows\System\hGtyZkD.exe
  2⤵
  PID:15508
- C:\Windows\System\riOAfMr.exe
  C:\Windows\System\riOAfMr.exe
  2⤵
  PID:15524
- C:\Windows\System\WDgNrnL.exe
  C:\Windows\System\WDgNrnL.exe
  2⤵
  PID:15540
- C:\Windows\System\DCWfbTQ.exe
  C:\Windows\System\DCWfbTQ.exe
  2⤵
  PID:15560
- C:\Windows\System\nRvGcvr.exe
  C:\Windows\System\nRvGcvr.exe
  2⤵
  PID:15592
- C:\Windows\System\tMWOfMO.exe
  C:\Windows\System\tMWOfMO.exe
  2⤵
  PID:15752
- C:\Windows\System\gbVzsoX.exe
  C:\Windows\System\gbVzsoX.exe
  2⤵
  PID:15780
- C:\Windows\System\gsSpqEW.exe
  C:\Windows\System\gsSpqEW.exe
  2⤵
  PID:15804
- C:\Windows\System\AHyiqgl.exe
  C:\Windows\System\AHyiqgl.exe
  2⤵
  PID:15820
- C:\Windows\System\KZaVyDe.exe
  C:\Windows\System\KZaVyDe.exe
  2⤵
  PID:15860
- C:\Windows\System\FMdhbQc.exe
  C:\Windows\System\FMdhbQc.exe
  2⤵
  PID:15884
- C:\Windows\System\CRjxamP.exe
  C:\Windows\System\CRjxamP.exe
  2⤵
  PID:15908
- C:\Windows\System\GVZUNei.exe
  C:\Windows\System\GVZUNei.exe
  2⤵
  PID:16076
- C:\Windows\System\vgsVyPS.exe
  C:\Windows\System\vgsVyPS.exe
  2⤵
  PID:16100
- C:\Windows\System\oVAxLuy.exe
  C:\Windows\System\oVAxLuy.exe
  2⤵
  PID:16124
- C:\Windows\System\ueMwdsx.exe
  C:\Windows\System\ueMwdsx.exe
  2⤵
  PID:16148
- C:\Windows\System\MmgRvsq.exe
  C:\Windows\System\MmgRvsq.exe
  2⤵
  PID:16172
- C:\Windows\System\rSGBdyF.exe
  C:\Windows\System\rSGBdyF.exe
  2⤵
  PID:16192
- C:\Windows\System\ohVlrqn.exe
  C:\Windows\System\ohVlrqn.exe
  2⤵
  PID:16216
- C:\Windows\System\eHcHXqR.exe
  C:\Windows\System\eHcHXqR.exe
  2⤵
  PID:16240
- C:\Windows\System\wFLNkVH.exe
  C:\Windows\System\wFLNkVH.exe
  2⤵
  PID:16260
- C:\Windows\System\tTJjFnh.exe
  C:\Windows\System\tTJjFnh.exe
  2⤵
  PID:16284
- C:\Windows\System\eoBUxUB.exe
  C:\Windows\System\eoBUxUB.exe
  2⤵
  PID:16304
- C:\Windows\System\kzlhcFV.exe
  C:\Windows\System\kzlhcFV.exe
  2⤵
  PID:16332
- C:\Windows\System\bDZszIq.exe
  C:\Windows\System\bDZszIq.exe
  2⤵
  PID:16356
- C:\Windows\System\BOqXdXc.exe
  C:\Windows\System\BOqXdXc.exe
  2⤵
  PID:10652
- C:\Windows\System\wKmGMGs.exe
  C:\Windows\System\wKmGMGs.exe
  2⤵
  PID:11016
- C:\Windows\System\jkpvuEr.exe
  C:\Windows\System\jkpvuEr.exe
  2⤵
  PID:8016
- C:\Windows\System\kzxUBaY.exe
  C:\Windows\System\kzxUBaY.exe
  2⤵
  PID:10452
- C:\Windows\System\LjHvXvS.exe
  C:\Windows\System\LjHvXvS.exe
  2⤵
  PID:10908
- C:\Windows\System\pjlHCDf.exe
  C:\Windows\System\pjlHCDf.exe
  2⤵
  PID:11216
- C:\Windows\System\cAeOyxE.exe
  C:\Windows\System\cAeOyxE.exe
  2⤵
  PID:15484
- C:\Windows\System\ofXyenK.exe
  C:\Windows\System\ofXyenK.exe
  2⤵
  PID:11428
- C:\Windows\System\cNsVEbA.exe
  C:\Windows\System\cNsVEbA.exe
  2⤵
  PID:15796
- C:\Windows\System\CdTNpGy.exe
  C:\Windows\System\CdTNpGy.exe
  2⤵
  PID:9464
- C:\Windows\System\LYKVNgr.exe
  C:\Windows\System\LYKVNgr.exe
  2⤵
  PID:15380
- C:\Windows\System\TZCJENa.exe
  C:\Windows\System\TZCJENa.exe
  2⤵
  PID:11564
- C:\Windows\System\BrwSeZZ.exe
  C:\Windows\System\BrwSeZZ.exe
  2⤵
  PID:11420
- C:\Windows\System\jEvdiCH.exe
  C:\Windows\System\jEvdiCH.exe
  2⤵
  PID:15892
- C:\Windows\System\QnaUDKg.exe
  C:\Windows\System\QnaUDKg.exe
  2⤵
  PID:15424
- C:\Windows\System\ZIONLSg.exe
  C:\Windows\System\ZIONLSg.exe
  2⤵
  PID:15452
- C:\Windows\System\xJktXcV.exe
  C:\Windows\System\xJktXcV.exe
  2⤵
  PID:15720
- C:\Windows\System\ZiUNrfJ.exe
  C:\Windows\System\ZiUNrfJ.exe
  2⤵
  PID:11508
- C:\Windows\System\OnkiSiJ.exe
  C:\Windows\System\OnkiSiJ.exe
  2⤵
  PID:15748
- C:\Windows\System\QQtfdxH.exe
  C:\Windows\System\QQtfdxH.exe
  2⤵
  PID:16040
- C:\Windows\System\MdFljyr.exe
  C:\Windows\System\MdFljyr.exe
  2⤵
  PID:16052
- C:\Windows\System\yYbPCDY.exe
  C:\Windows\System\yYbPCDY.exe
  2⤵
  PID:15648
- C:\Windows\System\TppuGSO.exe
  C:\Windows\System\TppuGSO.exe
  2⤵
  PID:15920
- C:\Windows\System\QbrXYmr.exe
  C:\Windows\System\QbrXYmr.exe
  2⤵
  PID:15960
- C:\Windows\System\cobBACz.exe
  C:\Windows\System\cobBACz.exe
  2⤵
  PID:11864
- C:\Windows\System\NxneROG.exe
  C:\Windows\System\NxneROG.exe
  2⤵
  PID:10028
- C:\Windows\System\CbxlyDl.exe
  C:\Windows\System\CbxlyDl.exe
  2⤵
  PID:16236
- C:\Windows\System\gyyRqiN.exe
  C:\Windows\System\gyyRqiN.exe
  2⤵
  PID:12248
- C:\Windows\System\gpkdfqb.exe
  C:\Windows\System\gpkdfqb.exe
  2⤵
  PID:12048
- C:\Windows\System\TiqNcxO.exe
  C:\Windows\System\TiqNcxO.exe
  2⤵
  PID:10828
- C:\Windows\System\PfUPvig.exe
  C:\Windows\System\PfUPvig.exe
  2⤵
  PID:15384
- C:\Windows\System\nPLhmAI.exe
  C:\Windows\System\nPLhmAI.exe
  2⤵
  PID:11500
- C:\Windows\System\HTlsyDk.exe
  C:\Windows\System\HTlsyDk.exe
  2⤵
  PID:11728
- C:\Windows\System\RGldUhG.exe
  C:\Windows\System\RGldUhG.exe
  2⤵
  PID:10348
- C:\Windows\System\blZpNBe.exe
  C:\Windows\System\blZpNBe.exe
  2⤵
  PID:6764
- C:\Windows\System\tNISwqn.exe
  C:\Windows\System\tNISwqn.exe
  2⤵
  PID:12268
- C:\Windows\System\BhMVdEE.exe
  C:\Windows\System\BhMVdEE.exe
  2⤵
  PID:11148
- C:\Windows\System\boCQFwF.exe
  C:\Windows\System\boCQFwF.exe
  2⤵
  PID:15392
- C:\Windows\System\ZjVSObn.exe
  C:\Windows\System\ZjVSObn.exe
  2⤵
  PID:11764
- C:\Windows\System\kzKeuis.exe
  C:\Windows\System\kzKeuis.exe
  2⤵
  PID:11892
- C:\Windows\System\RGjNfpd.exe
  C:\Windows\System\RGjNfpd.exe
  2⤵
  PID:12252
- C:\Windows\System\khLJQoz.exe
  C:\Windows\System\khLJQoz.exe
  2⤵
  PID:12484
- C:\Windows\System\HRpPXIv.exe
  C:\Windows\System\HRpPXIv.exe
  2⤵
  PID:12392
- C:\Windows\System\eaFCAIF.exe
  C:\Windows\System\eaFCAIF.exe
  2⤵
  PID:15412
- C:\Windows\System\AaTbLjT.exe
  C:\Windows\System\AaTbLjT.exe
  2⤵
  PID:12008
- C:\Windows\System\YYQFnXx.exe
  C:\Windows\System\YYQFnXx.exe
  2⤵
  PID:11568
- C:\Windows\System\JkIzWjr.exe
  C:\Windows\System\JkIzWjr.exe
  2⤵
  PID:15652
- C:\Windows\System\TqUEDLx.exe
  C:\Windows\System\TqUEDLx.exe
  2⤵
  PID:9820
- C:\Windows\System\TscpYls.exe
  C:\Windows\System\TscpYls.exe
  2⤵
  PID:15640
- C:\Windows\System\wBYtsja.exe
  C:\Windows\System\wBYtsja.exe
  2⤵
  PID:15836
- C:\Windows\System\xKfZhEE.exe
  C:\Windows\System\xKfZhEE.exe
  2⤵
  PID:15964
- C:\Windows\System\DQEoSgi.exe
  C:\Windows\System\DQEoSgi.exe
  2⤵
  PID:10332
- C:\Windows\System\QIMKHfk.exe
  C:\Windows\System\QIMKHfk.exe
  2⤵
  PID:11092
- C:\Windows\System\FALXHRm.exe
  C:\Windows\System\FALXHRm.exe
  2⤵
  PID:16272
- C:\Windows\System\WokuPGe.exe
  C:\Windows\System\WokuPGe.exe
  2⤵
  PID:16140
- C:\Windows\System\ztMTfZk.exe
  C:\Windows\System\ztMTfZk.exe
  2⤵
  PID:11976
- C:\Windows\System\WllyIjE.exe
  C:\Windows\System\WllyIjE.exe
  2⤵
  PID:13076
- C:\Windows\System\WqURZsC.exe
  C:\Windows\System\WqURZsC.exe
  2⤵
  PID:13252
- C:\Windows\System\CXSNmYV.exe
  C:\Windows\System\CXSNmYV.exe
  2⤵
  PID:11556
- C:\Windows\System\QqAmvPT.exe
  C:\Windows\System\QqAmvPT.exe
  2⤵
  PID:9732
- C:\Windows\System\sVTrUHn.exe
  C:\Windows\System\sVTrUHn.exe
  2⤵
  PID:8052
- C:\Windows\System\wmthtAm.exe
  C:\Windows\System\wmthtAm.exe
  2⤵
  PID:10420
- C:\Windows\System\kbXZBNx.exe
  C:\Windows\System\kbXZBNx.exe
  2⤵
  PID:12544
- C:\Windows\System\eHeAmoe.exe
  C:\Windows\System\eHeAmoe.exe
  2⤵
  PID:11656
- C:\Windows\System\UlUvweb.exe
  C:\Windows\System\UlUvweb.exe
  2⤵
  PID:10600
- C:\Windows\System\moHsbOS.exe
  C:\Windows\System\moHsbOS.exe
  2⤵
  PID:13088
- C:\Windows\System\FxeQeKf.exe
  C:\Windows\System\FxeQeKf.exe
  2⤵
  PID:12520
- C:\Windows\System\BFmRBQJ.exe
  C:\Windows\System\BFmRBQJ.exe
  2⤵
  PID:12320
- C:\Windows\System\RlNfPFJ.exe
  C:\Windows\System\RlNfPFJ.exe
  2⤵
  PID:12500
- C:\Windows\System\dMmJTwr.exe
  C:\Windows\System\dMmJTwr.exe
  2⤵
  PID:10836
- C:\Windows\System\SlGCNsL.exe
  C:\Windows\System\SlGCNsL.exe
  2⤵
  PID:15500
- C:\Windows\System\qWgFvMs.exe
  C:\Windows\System\qWgFvMs.exe
  2⤵
  PID:15800
- C:\Windows\System\FKPBsJm.exe
  C:\Windows\System\FKPBsJm.exe
  2⤵
  PID:11524
- C:\Windows\System\cUmcjdy.exe
  C:\Windows\System\cUmcjdy.exe
  2⤵
  PID:16004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5428 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hdoj2h3a.b0w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BgkSjGg.exe

Filesize
2.2MB

MD5
eaddf13f70581b20462073522fb0553b

SHA1
ab09902ff54deab7e70ec85cf603eed42cc6ff1c

SHA256
9ea4e5309b9041ecc4d3ead573e751a4c4dfe0470b197a8931497f416125cedf

SHA512
10cb524d64a9995d48f26a2b3ae0260f0cbe7ae39786cd195612bb33969560be7da05ee810029ba6ce6cbe05afec246508399762554cfe10c9357dbc4af3430d

Download Submit
C:\Windows\System\BjLQWYB.exe

Filesize
2.2MB

MD5
9877c529f6ff6f099c2fe779e810235b

SHA1
d1840294cea81133d367aa31ea3f1ec22cab74d0

SHA256
e9af9f687f8a16926df671ff11fcc31e340c946289e484cc276cd8d13de6d6f0

SHA512
dafe77d80861b1c06dbeb6f5fb343d699045c1e7e10401f92ccd5ddd374ef36568209d65cfeb662a301ffb6888a758680c3f9129b8e3655ff79f5e0ac69355d9

Download Submit
C:\Windows\System\CBspdtZ.exe

Filesize
2.2MB

MD5
c7c4ef2127d978ed7f9b3e84b61bae51

SHA1
5523682054129d059edfd7928ccd6c4e9707f645

SHA256
f24b5268cdb1cbaf5db848cefea6b7b8b78f975f42bcea9e0aeb2ba21d797fe6

SHA512
7d058f6767a86c24a4381821f94d724bfa2269803dc3d51066e6f0f1dd20e7917dbf5becea61301954f5c4a01272b17f80c8c64e45d6e2193e21087b66ee0537

Download Submit
C:\Windows\System\FkDbchl.exe

Filesize
2.2MB

MD5
aa57789af28f0b966d4eb637a9604945

SHA1
fdd60cfb87499988d762f579a000c13179f7ee36

SHA256
df29d4fcfa0d7eda0d5eb11ba34eadc4039516ce43e845efeccbe7e84cd4aacb

SHA512
56d5d90cc9e7b02a8959fec5d277221eb8c1ec84cd355c2f2e809e999f9d343be4eaf9b6e3cc73b09928f7827613409562868b5d85545629ef0810696ce1c1f1

Download Submit
C:\Windows\System\HvEhxRr.exe

Filesize
2.2MB

MD5
18c4ba67ff4a1c2a63110badd2fb7f68

SHA1
85c4e55f863bd3670639736d7c368df71f2d12a9

SHA256
efeeaf33265a5f2e173fb2e633cecf52b3fd131274adb73e525c58f4c2c1f3ca

SHA512
5dc8f896f539bd4d4518342f0b9bd549290d4dec705d0b5d4fe4f71c6fccd1ef0d30f48377bf12417b432cc91c1a3ef20a7d821c542b5503e6d9071cd509247d

Download Submit
C:\Windows\System\IFeJilj.exe

Filesize
2.2MB

MD5
d7d57fc5131f9e7b20bf0426567d8663

SHA1
909a29fc497869672ae2319398bbdff2b5dc1a02

SHA256
be548de166ed59568a3d194fcc8342880ef8e2a46841d77fbdbb966868c40cdf

SHA512
978653717060753082f0eee5367c55f4c962f5961021c2fd7cca48a450e07d964ad82ce2f5efb8f2eeb98702fc6c4c94a60476f85bed63c147d49dcc19a3f14b

Download Submit
C:\Windows\System\IlRvety.exe

Filesize
2.2MB

MD5
63d77177c39b0ccbf45650771cf91515

SHA1
fe69817f00d89a510f9db557ccab58b181d93ca6

SHA256
ff347d94157d4da962ba2d053cb898502a59954117adcb9c959266cafb3cbb41

SHA512
3a16f79f37e836dd19a744f6b6b3b84dae67f38ea5911f333f467f7db5835c3c998dc77e326063fc4d805f59bb1479fa2876c6bdf86f454c65eb2cdd25e4be8a

Download Submit
C:\Windows\System\IvTWXYd.exe

Filesize
2.2MB

MD5
e601de57475d87cf8f55ab7f1199921a

SHA1
913692c3d90b910978429c47959424cb32ef36cf

SHA256
e6fcba026ce8ceaefff778d26ae76964164018455da1d589560444b301a58342

SHA512
fe29810a581a5a954aafbf09ce7e3bdf6b80fa6f9751b952f1cb6c71195e0623c7f677a608de1205f5a04ae8a155c1c121020867f3d49ab8ad531096e6cd0f98

Download Submit
C:\Windows\System\KwTXSSw.exe

Filesize
2.2MB

MD5
cf6e34344aad5a9408a63c00ae767063

SHA1
74e96a8acebccb9168582d1aa2bb9d123f78547a

SHA256
ca8c9c047d23021b7f7b3c29a3b1dd54e83d0dbefd4cbbf5aa1d51feaa0bc1aa

SHA512
c35a4b0181da62c027e02b9e9c19e814963e7ce9df2014894ff5606ae0c7deca1c727c5d446a76611bda7a0b026031c3fea036fd4880ae3484d926fd8b81d892

Download Submit
C:\Windows\System\MqifKIy.exe

Filesize
2.2MB

MD5
a747c70b679ce18f74d54911d43bf60f

SHA1
e28d54b5a20021bc284f21c76961cbb47e1622b5

SHA256
a671740b4860ae3e97924e5b5fd9e7182f5327c970860cacb6fa7cb76027ebc0

SHA512
303557bf30b42e0bc078e0aab92aeb4b26c7031803d25280d3d72e212001a6461b6edbaffba4f27f136de335adb11c808658fc9dcf45ee463e5e99d3270feaad

Download Submit
C:\Windows\System\OoTwIHf.exe

Filesize
2.2MB

MD5
e4c0de616776398ed91bb5750f0a7451

SHA1
c540a82f594005c61ef34f1fc7166e7f651317fc

SHA256
508410ce4c01f5977f6b92defcb5b3fc574a35a9cbceb33474067eba4d8adfdb

SHA512
0cf6d5be1240931867b3ffa66c39643b611787aed5ce009dccf2324f50b21a4e25cb6b2c7f473aa48c073b5b0f0fd853cdd802fb102f77a46e6df3046fa2eb9d

Download Submit
C:\Windows\System\PbVwHFx.exe

Filesize
2.2MB

MD5
cb3fedb60860fc9de728eca46c1e9fce

SHA1
2e103465aee498b5e6d14f2a0035ebca0ecc4b6a

SHA256
0e13996ae190f4561b8603e47b3a05639d7fc9be0170399ec1797b26b2d3cfb5

SHA512
01ea9b42df9466572e7cd3dcfbb05858048e6703e55ebb4c77ac203c18d429bb7390743813ffcf027a6162c5f56d3ce8c565be52a53b960f6626111d6466a19e

Download Submit
C:\Windows\System\TojgaBD.exe

Filesize
2.2MB

MD5
16ea84446910b3c34032456818afefef

SHA1
316c3e0b0a78fb5e21d20217484aabbd9a468d39

SHA256
6a62bdbc1db905148c62825e72bfae1b9c17742e66a9d5f9b1c671ba99b30b60

SHA512
b52fe2bee814df072d9ea2fdb1dfb10a8f54bd9757e8c5dfa14d9f6e3a2aae563bd8218ad415b52e6cca531853f97e3f91417633927dd335f95cb9fcf9672f99

Download Submit
C:\Windows\System\VnqseWg.exe

Filesize
2.2MB

MD5
d91e3f2c473cc3790c42a33a22e9d87c

SHA1
ee9ecdf606c06aac2d19eb4b8dfa294c5c1135b8

SHA256
5134b3b8bcab3487225e3e4b76bcad152cea25cbe9e573ac15eb0ff3fe21c8ee

SHA512
2808c95c6304b9f361f3e6b69c38adf613c66b4f2b97971afec9a9ca692f3f446e3b46d21b134136d07a80939813b37288302e51583581196968a5c9cee9c55e

Download Submit
C:\Windows\System\XDuybmY.exe

Filesize
2.2MB

MD5
bc7243a16e0eb7474ec5953fd11b731f

SHA1
b5b5595bd1e923956d7eb825139ce28833a7d3c0

SHA256
6fcb334163552b9bc085f3be6ff7d6c4665f5bc6cc6d9c6a9a424d3d748ccee8

SHA512
4eefaf8960d87cbad41244acd09490173959d9707a4769c04180feabf7646dbfe6a5f627a4f2310c9fa77a0abb2b1b6bc28398ccf0cb9a772f7f83e9a2def952

Download Submit
C:\Windows\System\YIidJLg.exe

Filesize
2.2MB

MD5
9cedc8d7f89a0562bf771168ef96daf7

SHA1
e446ab73f7787237b6e71ff3a1b2d41a6a4ba598

SHA256
018fd3605cdab69cf9e4affead83df9c96d906a481f61166a70ede3c03d05ef4

SHA512
baa1ad25d691d5557e459ca766f259e775a996f87f001d8b79676c0d02e12307911d77f1fcf32f039514bfba5599e5a8167d22b68713b14867fd85d44e1f9f5a

Download Submit
C:\Windows\System\daUMtQh.exe

Filesize
2.2MB

MD5
b9f7c87aba37953a71a54bce0fe0fab4

SHA1
f66aa6841f8b14e8af38ff453cdd59b94502b925

SHA256
3cf9ae850fe48084bf2d4bf80d83b6b95f234ecdda6d0c21e3f7653bc77e49b7

SHA512
df798ab1c03df875283ac534444eb2046a5dc385f09cb4dea61cccc314d04154bab24e24447e6599f2ab281b09a29f2f9434198ba13c696ccb7babd4e8e6acfe

Download Submit
C:\Windows\System\hTQCOXG.exe

Filesize
2.2MB

MD5
a3df52508921577d2d5da9f0b2e01056

SHA1
74ab3a57103ebb1ddb7eda62c282d69825cfccd6

SHA256
06c900708791426e0543d7ad8e45ac013e4ed63a5ac689d79c13562bdc08331c

SHA512
0a5ade0bf793d8e59a04b8f73ead8a050fb2678a932059c8aff8f4d05bc1065b19c552cd83ad8df217045ebe13db976eedaf2557a4353740bd77edc5684fc231

Download Submit
C:\Windows\System\kJBaQqc.exe

Filesize
2.2MB

MD5
e2549f66b2780948ac6d86e8bc487d8e

SHA1
09d03774c8adea5d803c650e20bae806dd6d6e70

SHA256
729824dd7016da77f9ffc839d4a6d30e0adab641182078858afefc641a89e040

SHA512
85a6ac8aab468a05a749dd308102a0b1a4a2018320b7bfbd1a70b9b459ab30986e9588f6c983c74f6562b7362a2252e9ea32c2aa3c6ba91587b721699c2841a9

Download Submit
C:\Windows\System\lNfVgvJ.exe

Filesize
2.2MB

MD5
aaf6fd1ab0e46c0cb73a64bfd73612cf

SHA1
981d5b2d52994416b787dec7f263e7c3390f2fee

SHA256
398c0d0eb4a214de03abaa926985739418d8265e185956933a388be9877ea664

SHA512
8fb443ef87f8a604dda8e1b459e5d5c1c33653944a9f05e91c7171e16775e101a9f720bec03535e728939d1eb812be8bcec4d21f59679f52bfabf58c14ce83bb

Download Submit
C:\Windows\System\lqMNFRE.exe

Filesize
2.2MB

MD5
3f59c5452f67dfbea53de6520d6fa59b

SHA1
4a26d3cc426e7a25f6e68af6e3be420af218c020

SHA256
04c5284c5891e193f726ba55c48c4d6f796fe0344d0d0ff9d8e6c646a5a2e164

SHA512
bdde07d39b0fb698311a0e16fac080bbd246723ef208687637cb825f74102cc01f2fdfa67d9914226b9270ceb86f0c32850480ed24736e9bbd4eee8fc43a9321

Download Submit
C:\Windows\System\mCNfKYn.exe

Filesize
2.2MB

MD5
011b5ac49491c19d531c343ef787ab7c

SHA1
3e0dc7e0acf8cdfee57f23fb3b02d56af5c29207

SHA256
3a1cc042f2051dc181d0aed2ade8ced332fa784c6a55bab00cf168f457f150c8

SHA512
deeec171fcc62723129699314c253e0a61f91d9cc7b45534aa8caf9954b7bea26cf91aa9e6e565b81bd28c24e12771d7606e5201ef1eb32de444677ca832c974

Download Submit
C:\Windows\System\nhJhgth.exe

Filesize
2.2MB

MD5
94a95eacc938aa58ec3bddd079e0767d

SHA1
a8bb99893f2df022fb980f542e0dc37a1ce59263

SHA256
3e6a439528fe6b438a18b7f8025ea091b2d96e741831a631e948701bcc17bddd

SHA512
580987ad25e77e3350532fc4cfbfb1aea6308fbf47ea452b55cebca4166c98d0f2838dbf30f290363e843c554e4f3eae3522a15da58b773fce64ad59e10a7163

Download Submit
C:\Windows\System\phsJwDH.exe

Filesize
2.2MB

MD5
821c0b4ef7524fe7b4e68ff4a3920ebe

SHA1
ace03a3a324cd13e37fbe86ff2b848ac1630d435

SHA256
175b876908a3e63aeebc283d32d59f17540aa6e8ac2b8b36f25e0b6e14ff7b0e

SHA512
7ea06acb00842539df99cb8e2f49cae97625c95d4eec15aa7ef7e08b810b237e9132fc573f4b0514bef32aa60c85db9b65fbdae4c7e8a5b29cb8cbfef59ca353

Download Submit
C:\Windows\System\ptAFIaD.exe

Filesize
2.2MB

MD5
4448979e4691292995f603de0f09dc4e

SHA1
ed5d6d6c8312c58aeda466b68c3ee08473ac70af

SHA256
0b0fdf32e64b72f46e3d1ee60e1c3bfd78663b22668e0b963de1b8fce250feab

SHA512
5e7ca629487082cce92673af0c352c64e5aa06f4d09a683c62e1ef262da9aea35367942b0631aa38b9948c9f5e0dcf588d35e673d7661d6b5627f8bcec1abd97

Download Submit
C:\Windows\System\qtNIyqa.exe

Filesize
2.2MB

MD5
9b3d31ea45a8057a7220a519af0b6b67

SHA1
80b6489b2bad6be95b173be8fc229cabd3f823d3

SHA256
f0860e5a92926bd646cf7f602b994b6f338297d1599b551af65b07ce61f3fd6a

SHA512
90440874b33804f0427c419406bbf208dc9cf0a153deb74c71e1f92854bb6d306fc3ce8dbfab09b15b31c2fb165745d9523f0fc148a83f02991a29e6a6669b15

Download Submit
C:\Windows\System\rKhAUwK.exe

Filesize
2.2MB

MD5
40c819fc103eb74cb1a350ec5ee65fdb

SHA1
6006e5667d8a76762717b3f89eebe6fd87a9f0fb

SHA256
194c3ddb6601c8fe2b4b282e4ea48b96778e0eae86e1838214666526e0f4779e

SHA512
db80e5f8b8f66bfbe22fa286d962dc0d0b2d00780eb2febe6678408d42f2b5e7bfdfe8c7ef5f80046144f9d8c101c0bd3f2a9717fb9cf46f5e30926c99bccc7b

Download Submit
C:\Windows\System\sTDzomR.exe

Filesize
2.2MB

MD5
8e9c4dfd7c83cf3e2826c1ad712eebdb

SHA1
ecd6a54ee62b7de8c3cf7f1c46d0a5e590bc3f1e

SHA256
87a252d7ee457cebb64e3c1e15078915f876ab6123475d78533f64b28e77b25e

SHA512
9488cd72427508b90da8d77eb6eb451f46ca1f7b8ce53c9df8a8ec4aa713b33e6a2c708586c76e7deb5e458f97c2752e111af0f65c87e60b7905f032d394e328

Download Submit
C:\Windows\System\usEUBgb.exe

Filesize
2.2MB

MD5
d5ad89af220a2ee13d422a151fa8a685

SHA1
5b9d60c39d2bf8e1a3be0448f7adac456360dc75

SHA256
27753d639606f6f51359b1bbd42baeddc84d13bb096fac2b3e4536f6b7bfff9a

SHA512
60768bd6bc88d7cacc213792a4daa5ae896adf7821d46f43ae2a42c9b43164137391433061314bf40beb966735491e50981a1e1f368967b4c1d2c6de0acf0176

Download Submit
C:\Windows\System\vIBkQLS.exe

Filesize
2.2MB

MD5
c08ef1a4cc8921b81a6fd93cc4f8d714

SHA1
3ba4780aa417a7b44507b7d93e6c043c40901a9c

SHA256
d5649b3090841a377aff8c6bf7fe73624370b8dd05223544365f6846b9ed7734

SHA512
f5ebf19ee64393afa3113fda4e24020d06eed0617600ca249e3948913e05d1107fad102738289a78c69a40c71eaaeeebe53b397e7dfc9a80137cc43b9400915f

Download Submit
C:\Windows\System\vVfaJkK.exe

Filesize
2.2MB

MD5
b3a3e752701813853bc441b57bb33d41

SHA1
25defc958a7644ac4336f73bb05fe520ca141ef7

SHA256
ff2e91b0bda5deab97c09acf836741f44e94ef8d2f97bcba96e4e264a0452a9f

SHA512
9ed2a678bb7d5ca2270c067600f0b835b138626519e458ddf3285714dcfa1e3b6876c69012630b939d3ba7dbb2d1c4727c21ddc2dbedff15d0c4f53664b864bc

Download Submit
C:\Windows\System\vVlGXFY.exe

Filesize
2.2MB

MD5
5a57bd724406a038d6c1242fea909c80

SHA1
81665a5704dd3a1fa7560384d12a0ae3ae9ee8c2

SHA256
a96ec8ebdc7ecafaf3f3b0df63d36188f2d4c234101ab59c96258b4ed7b12d7e

SHA512
76838df50e415d79fe77ed70e5348c6a1fa577aac9b2d4da710ea41971684074fb86e251f3d72d15b970619e4ded3acafd8abbc2a2e04457ed0a5ed39f08c347

Download Submit
C:\Windows\System\vyapbGT.exe

Filesize
2.2MB

MD5
6c3469b591a0441bbef7c76b9e9c6cc3

SHA1
03840538eecf96848dbaec70a841b38b6cffe30d

SHA256
fe8c399bc49560a24331c0f3672c0bf959b23a42455072b6ba7250caa682ec25

SHA512
f4ec6b417e3df166b8c2eccc0a0e82389b66ec9f1f19314f2db7c1a03d3cce81ed24dddfe2e99eb7888e3228abce2dd1a9d1d6b759bbb41a9e469647d97e3f2a

Download Submit
memory/100-8-0x00007FF71C020000-0x00007FF71C412000-memory.dmp

Filesize
3.9MB

Download
memory/100-68-0x00007FF71C020000-0x00007FF71C412000-memory.dmp

Filesize
3.9MB

Download
memory/100-1871-0x00007FF71C020000-0x00007FF71C412000-memory.dmp

Filesize
3.9MB

Download
memory/224-2287-0x00007FF7A64C0000-0x00007FF7A68B2000-memory.dmp

Filesize
3.9MB

Download
memory/224-72-0x00007FF7A64C0000-0x00007FF7A68B2000-memory.dmp

Filesize
3.9MB

Download
memory/404-289-0x00007FF7E4C00000-0x00007FF7E4FF2000-memory.dmp

Filesize
3.9MB

Download
memory/404-2316-0x00007FF7E4C00000-0x00007FF7E4FF2000-memory.dmp

Filesize
3.9MB

Download
memory/460-2286-0x00007FF60C2E0000-0x00007FF60C6D2000-memory.dmp

Filesize
3.9MB

Download
memory/460-66-0x00007FF60C2E0000-0x00007FF60C6D2000-memory.dmp

Filesize
3.9MB

Download
memory/880-2231-0x00007FF6A4020000-0x00007FF6A4412000-memory.dmp

Filesize
3.9MB

Download
memory/880-49-0x00007FF6A4020000-0x00007FF6A4412000-memory.dmp

Filesize
3.9MB

Download
memory/1564-298-0x00007FF614A50000-0x00007FF614E42000-memory.dmp

Filesize
3.9MB

Download
memory/1564-2295-0x00007FF614A50000-0x00007FF614E42000-memory.dmp

Filesize
3.9MB

Download
memory/1624-284-0x00007FF629E30000-0x00007FF62A222000-memory.dmp

Filesize
3.9MB

Download
memory/1760-282-0x00007FF6416D0000-0x00007FF641AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1760-2227-0x00007FF6416D0000-0x00007FF641AC2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-296-0x00007FF6A9160000-0x00007FF6A9552000-memory.dmp

Filesize
3.9MB

Download
memory/2104-2271-0x00007FF6A9160000-0x00007FF6A9552000-memory.dmp

Filesize
3.9MB

Download
memory/2268-276-0x00007FF6595B0000-0x00007FF6599A2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-277-0x00007FF6FBD00000-0x00007FF6FC0F2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-2239-0x00007FF6FBD00000-0x00007FF6FC0F2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-292-0x00007FF68B810000-0x00007FF68BC02000-memory.dmp

Filesize
3.9MB

Download
memory/2496-19-0x00007FF751890000-0x00007FF751C82000-memory.dmp

Filesize
3.9MB

Download
memory/2496-265-0x00007FF751890000-0x00007FF751C82000-memory.dmp

Filesize
3.9MB

Download
memory/2504-273-0x00007FFE94220000-0x00007FFE94CE1000-memory.dmp

Filesize
10.8MB

Download
memory/2504-539-0x0000024E70710000-0x0000024E70720000-memory.dmp

Filesize
64KB

Download
memory/2504-20-0x0000024E70710000-0x0000024E70720000-memory.dmp

Filesize
64KB

Download
memory/2504-17-0x0000024E70710000-0x0000024E70720000-memory.dmp

Filesize
64KB

Download
memory/2504-28-0x0000024E70680000-0x0000024E706A2000-memory.dmp

Filesize
136KB

Download
memory/2504-16-0x00007FFE94220000-0x00007FFE94CE1000-memory.dmp

Filesize
10.8MB

Download
memory/2504-204-0x0000024E73470000-0x0000024E73C16000-memory.dmp

Filesize
7.6MB

Download
memory/2640-1-0x0000022DDB5A0000-0x0000022DDB5B0000-memory.dmp

Filesize
64KB

Download
memory/2640-262-0x00007FF7C3590000-0x00007FF7C3982000-memory.dmp

Filesize
3.9MB

Download
memory/2640-67-0x00007FF7C3590000-0x00007FF7C3982000-memory.dmp

Filesize
3.9MB

Download
memory/2640-0-0x00007FF7C3590000-0x00007FF7C3982000-memory.dmp

Filesize
3.9MB

Download
memory/2744-18-0x00007FF6F7DE0000-0x00007FF6F81D2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-264-0x00007FF6F7DE0000-0x00007FF6F81D2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-2253-0x00007FF6F7DE0000-0x00007FF6F81D2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-54-0x00007FF6BB230000-0x00007FF6BB622000-memory.dmp

Filesize
3.9MB

Download
memory/2812-2206-0x00007FF6BB230000-0x00007FF6BB622000-memory.dmp

Filesize
3.9MB

Download
memory/3520-294-0x00007FF7E3EB0000-0x00007FF7E42A2000-memory.dmp

Filesize
3.9MB

Download
memory/3520-2310-0x00007FF7E3EB0000-0x00007FF7E42A2000-memory.dmp

Filesize
3.9MB

Download
memory/3696-287-0x00007FF76DAA0000-0x00007FF76DE92000-memory.dmp

Filesize
3.9MB

Download
memory/3696-2282-0x00007FF76DAA0000-0x00007FF76DE92000-memory.dmp

Filesize
3.9MB

Download
memory/3812-2274-0x00007FF70F8C0000-0x00007FF70FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/3812-279-0x00007FF70F8C0000-0x00007FF70FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/4232-2207-0x00007FF7DDB50000-0x00007FF7DDF42000-memory.dmp

Filesize
3.9MB

Download
memory/4232-57-0x00007FF7DDB50000-0x00007FF7DDF42000-memory.dmp

Filesize
3.9MB

Download
memory/4548-2202-0x00007FF61E390000-0x00007FF61E782000-memory.dmp

Filesize
3.9MB

Download
memory/4548-42-0x00007FF61E390000-0x00007FF61E782000-memory.dmp

Filesize
3.9MB

Download
memory/4580-2311-0x00007FF75BBB0000-0x00007FF75BFA2000-memory.dmp

Filesize
3.9MB

Download
memory/4580-288-0x00007FF75BBB0000-0x00007FF75BFA2000-memory.dmp

Filesize
3.9MB

Download