xmrig | ed4e144913771b76e8fb0fff4fabe0b3ff69e496894d9fe0ba39d41d18cb5fc2

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
Size

1.5MB
MD5

04b950ca5287f735584e8ffe422d3201
SHA1

30344df57c6b07b619a142abc2c3a81badcdb46f
SHA256

ed4e144913771b76e8fb0fff4fabe0b3ff69e496894d9fe0ba39d41d18cb5fc2
SHA512

dbacddbe6bce46abef5acca0650f122610da6dd1c34d08c76024170de8a11d5d931af80abb65108f0b0bde6fd96fa9413bf07f63bce2b42ee7916c5cec76269c
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwPay:Lz071uv4BPMkibTIA5CJM

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 11908 created 12688	11908	WerFaultSecure.exe	1880

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/3132-49-0x00007FF710800000-0x00007FF710BF2000-memory.dmp	xmrig
behavioral2/memory/1256-80-0x00007FF61E370000-0x00007FF61E762000-memory.dmp	xmrig
behavioral2/memory/5040-84-0x00007FF716AE0000-0x00007FF716ED2000-memory.dmp	xmrig
behavioral2/memory/2440-88-0x00007FF79F770000-0x00007FF79FB62000-memory.dmp	xmrig
behavioral2/memory/1728-91-0x00007FF7DDF50000-0x00007FF7DE342000-memory.dmp	xmrig
behavioral2/memory/4412-92-0x00007FF70E1E0000-0x00007FF70E5D2000-memory.dmp	xmrig
behavioral2/memory/3848-90-0x00007FF6803F0000-0x00007FF6807E2000-memory.dmp	xmrig
behavioral2/memory/4964-89-0x00007FF7FC0C0000-0x00007FF7FC4B2000-memory.dmp	xmrig
behavioral2/memory/872-85-0x00007FF74C6D0000-0x00007FF74CAC2000-memory.dmp	xmrig
behavioral2/memory/220-75-0x00007FF6A08B0000-0x00007FF6A0CA2000-memory.dmp	xmrig
behavioral2/memory/452-72-0x00007FF799AF0000-0x00007FF799EE2000-memory.dmp	xmrig
behavioral2/memory/2228-56-0x00007FF759D30000-0x00007FF75A122000-memory.dmp	xmrig
behavioral2/memory/2880-42-0x00007FF79D4F0000-0x00007FF79D8E2000-memory.dmp	xmrig
behavioral2/memory/404-146-0x00007FF622E30000-0x00007FF623222000-memory.dmp	xmrig
behavioral2/memory/3624-153-0x00007FF6B3370000-0x00007FF6B3762000-memory.dmp	xmrig
behavioral2/memory/3012-150-0x00007FF7A8BA0000-0x00007FF7A8F92000-memory.dmp	xmrig
behavioral2/memory/2880-2391-0x00007FF79D4F0000-0x00007FF79D8E2000-memory.dmp	xmrig
behavioral2/memory/1256-2434-0x00007FF61E370000-0x00007FF61E762000-memory.dmp	xmrig
behavioral2/memory/220-2421-0x00007FF6A08B0000-0x00007FF6A0CA2000-memory.dmp	xmrig
behavioral2/memory/4964-2484-0x00007FF7FC0C0000-0x00007FF7FC4B2000-memory.dmp	xmrig
behavioral2/memory/3848-2486-0x00007FF6803F0000-0x00007FF6807E2000-memory.dmp	xmrig
behavioral2/memory/452-2502-0x00007FF799AF0000-0x00007FF799EE2000-memory.dmp	xmrig
behavioral2/memory/4412-2525-0x00007FF70E1E0000-0x00007FF70E5D2000-memory.dmp	xmrig
behavioral2/memory/5040-2529-0x00007FF716AE0000-0x00007FF716ED2000-memory.dmp	xmrig
behavioral2/memory/872-2472-0x00007FF74C6D0000-0x00007FF74CAC2000-memory.dmp	xmrig
behavioral2/memory/3012-2606-0x00007FF7A8BA0000-0x00007FF7A8F92000-memory.dmp	xmrig
behavioral2/memory/2800-2637-0x00007FF741AA0000-0x00007FF741E92000-memory.dmp	xmrig
behavioral2/memory/2108-2641-0x00007FF69FFD0000-0x00007FF6A03C2000-memory.dmp	xmrig
behavioral2/memory/3416-2615-0x00007FF7A2A70000-0x00007FF7A2E62000-memory.dmp	xmrig
behavioral2/memory/2776-2605-0x00007FF7496A0000-0x00007FF749A92000-memory.dmp	xmrig
behavioral2/memory/440-2604-0x00007FF7B83E0000-0x00007FF7B87D2000-memory.dmp	xmrig
behavioral2/memory/404-2613-0x00007FF622E30000-0x00007FF623222000-memory.dmp	xmrig
behavioral2/memory/3624-2603-0x00007FF6B3370000-0x00007FF6B3762000-memory.dmp	xmrig
behavioral2/memory/2548-6658-0x00007FF739320000-0x00007FF739712000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2060	powershell.exe
9	2060	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2880	NkxyDsu.exe
3132	HTnBqOd.exe
2228	qkFnock.exe
452	xmLdNag.exe
220	txKcTSN.exe
872	QRZxRxZ.exe
2440	zJwAUqX.exe
4964	yyUiKWG.exe
3848	KtoCGsm.exe
1256	MypsqAe.exe
5040	CLsjPIh.exe
1728	EQtCWDB.exe
4412	ImRKTcD.exe
2108	mDobBWE.exe
3416	apJRJLo.exe
2800	PqpTmyy.exe
2776	OBSppFi.exe
404	tJLQgCJ.exe
440	qvgFKFa.exe
3012	TxANEjD.exe
3624	ekYNkyt.exe
3996	nVwiCLk.exe
3256	QohxVnO.exe
4380	eZXndmx.exe
4068	koDmKRv.exe
4784	wwiDnOk.exe
3564	yrknNCC.exe
464	bveHBzZ.exe
780	pUwjhbD.exe
4272	rBletFH.exe
2636	lTyEplf.exe
2940	TVxRYvh.exe
964	XVHnEKD.exe
1376	XbYgrJs.exe
1708	JCisRzl.exe
1608	oOgUaWe.exe
228	AtpYEvv.exe
4332	BPLTTUv.exe
3152	WCPRqBY.exe
3688	fYUFrNG.exe
4856	FxLrSbi.exe
1228	OnBDtpy.exe
2084	QFEgawd.exe
3084	sQiJuOx.exe
3224	AChfxiv.exe
3968	HQjcpJJ.exe
4696	Mljtchq.exe
4620	IIRrumm.exe
4044	FLQskBI.exe
1836	dTyBpdH.exe
3444	vFnJjSb.exe
940	YOfLzyn.exe
3020	VIYxAZK.exe
2236	CbzbakY.exe
3820	xqRIBeF.exe
5132	klNwuJo.exe
5160	CYwvdKA.exe
5188	VEbhVUF.exe
5212	wPQPqKD.exe
5244	LQWhNpB.exe
5272	aFCjWxq.exe
5304	yZVnrHn.exe
5332	wHdiwSf.exe
5356	wymdQcT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2548-0-0x00007FF739320000-0x00007FF739712000-memory.dmp	upx
behavioral2/files/0x000900000002325d-5.dat	upx
behavioral2/files/0x0008000000023261-9.dat	upx
behavioral2/files/0x0008000000023263-7.dat	upx
behavioral2/files/0x0007000000023264-21.dat	upx
behavioral2/files/0x0007000000023267-41.dat	upx
behavioral2/memory/3132-49-0x00007FF710800000-0x00007FF710BF2000-memory.dmp	upx
behavioral2/files/0x000700000002326a-52.dat	upx
behavioral2/files/0x0008000000023268-64.dat	upx
behavioral2/files/0x000700000002326c-69.dat	upx
behavioral2/memory/1256-80-0x00007FF61E370000-0x00007FF61E762000-memory.dmp	upx
behavioral2/memory/5040-84-0x00007FF716AE0000-0x00007FF716ED2000-memory.dmp	upx
behavioral2/memory/2440-88-0x00007FF79F770000-0x00007FF79FB62000-memory.dmp	upx
behavioral2/memory/1728-91-0x00007FF7DDF50000-0x00007FF7DE342000-memory.dmp	upx
behavioral2/memory/4412-92-0x00007FF70E1E0000-0x00007FF70E5D2000-memory.dmp	upx
behavioral2/memory/3848-90-0x00007FF6803F0000-0x00007FF6807E2000-memory.dmp	upx
behavioral2/memory/4964-89-0x00007FF7FC0C0000-0x00007FF7FC4B2000-memory.dmp	upx
behavioral2/files/0x000700000002326e-86.dat	upx
behavioral2/memory/872-85-0x00007FF74C6D0000-0x00007FF74CAC2000-memory.dmp	upx
behavioral2/files/0x000700000002326d-82.dat	upx
behavioral2/memory/220-75-0x00007FF6A08B0000-0x00007FF6A0CA2000-memory.dmp	upx
behavioral2/memory/452-72-0x00007FF799AF0000-0x00007FF799EE2000-memory.dmp	upx
behavioral2/files/0x000700000002326b-68.dat	upx
behavioral2/files/0x0008000000023269-58.dat	upx
behavioral2/memory/2228-56-0x00007FF759D30000-0x00007FF75A122000-memory.dmp	upx
behavioral2/memory/2880-42-0x00007FF79D4F0000-0x00007FF79D8E2000-memory.dmp	upx
behavioral2/files/0x0007000000023266-38.dat	upx
behavioral2/files/0x000700000002326f-97.dat	upx
behavioral2/memory/2108-103-0x00007FF69FFD0000-0x00007FF6A03C2000-memory.dmp	upx
behavioral2/memory/3416-109-0x00007FF7A2A70000-0x00007FF7A2E62000-memory.dmp	upx
behavioral2/files/0x0007000000023273-116.dat	upx
behavioral2/files/0x0007000000023271-119.dat	upx
behavioral2/files/0x0007000000023272-127.dat	upx
behavioral2/files/0x0007000000023275-137.dat	upx
behavioral2/files/0x0007000000023278-142.dat	upx
behavioral2/memory/404-146-0x00007FF622E30000-0x00007FF623222000-memory.dmp	upx
behavioral2/memory/3624-153-0x00007FF6B3370000-0x00007FF6B3762000-memory.dmp	upx
behavioral2/files/0x0007000000023279-159.dat	upx
behavioral2/files/0x000700000002327a-160.dat	upx
behavioral2/files/0x000700000002327b-165.dat	upx
behavioral2/files/0x000700000002327d-175.dat	upx
behavioral2/files/0x000700000002327e-183.dat	upx
behavioral2/files/0x0007000000023282-197.dat	upx
behavioral2/files/0x0007000000023280-195.dat	upx
behavioral2/files/0x0007000000023281-192.dat	upx
behavioral2/files/0x000700000002327f-188.dat	upx
behavioral2/files/0x000700000002327c-170.dat	upx
behavioral2/memory/3012-150-0x00007FF7A8BA0000-0x00007FF7A8F92000-memory.dmp	upx
behavioral2/files/0x0007000000023277-149.dat	upx
behavioral2/files/0x0007000000023276-143.dat	upx
behavioral2/memory/440-140-0x00007FF7B83E0000-0x00007FF7B87D2000-memory.dmp	upx
behavioral2/memory/2776-134-0x00007FF7496A0000-0x00007FF749A92000-memory.dmp	upx
behavioral2/files/0x0007000000023274-126.dat	upx
behavioral2/memory/2800-118-0x00007FF741AA0000-0x00007FF741E92000-memory.dmp	upx
behavioral2/files/0x0007000000023270-110.dat	upx
behavioral2/memory/2880-2391-0x00007FF79D4F0000-0x00007FF79D8E2000-memory.dmp	upx
behavioral2/memory/1256-2434-0x00007FF61E370000-0x00007FF61E762000-memory.dmp	upx
behavioral2/memory/220-2421-0x00007FF6A08B0000-0x00007FF6A0CA2000-memory.dmp	upx
behavioral2/memory/4964-2484-0x00007FF7FC0C0000-0x00007FF7FC4B2000-memory.dmp	upx
behavioral2/memory/3848-2486-0x00007FF6803F0000-0x00007FF6807E2000-memory.dmp	upx
behavioral2/memory/452-2502-0x00007FF799AF0000-0x00007FF799EE2000-memory.dmp	upx
behavioral2/memory/4412-2525-0x00007FF70E1E0000-0x00007FF70E5D2000-memory.dmp	upx
behavioral2/memory/5040-2529-0x00007FF716AE0000-0x00007FF716ED2000-memory.dmp	upx
behavioral2/memory/872-2472-0x00007FF74C6D0000-0x00007FF74CAC2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LoHULrt.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\FBnJvLV.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\EdXIJhH.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\SmCIQcV.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\lAussEj.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\IxPvdpG.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\qroNrtB.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\NELsLCz.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\fTSDVVf.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\fIdoLij.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\YLOPgDl.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\WmrorQc.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\Zcownsk.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\UPkJywe.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\LsezPTd.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\isABAeY.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\MztBXXc.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\ImRKTcD.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\FIalPnl.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\JJnNBQq.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\oXmleYS.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\rNtRfio.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\LCzrqdZ.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\yBUvuiC.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\bUZdOpi.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\hbNiRuC.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\DFZdwgn.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\dvkdvci.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\PQOTfFb.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\hMsfCoT.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\IqibwBZ.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\nGqMwai.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\pdlbvOK.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\BJREixJ.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\tLBXsky.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\CnWtucj.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\ZHnluOx.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\Lyjdzxs.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\DRessHi.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\ENJKCzZ.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\ivrXmfE.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\ygHZAJk.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\elRaZZR.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\AauvPcp.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\CcKzXTA.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\KbCkrEP.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\arhAnuP.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\MlRNTjj.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\fHjGnui.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\KunUNrV.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\znnrZaN.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\TUowldz.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\xikZaRI.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\ARJLcbv.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\WLJXBQp.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\rhrHEkC.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\YgzQMKD.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\dTyBpdH.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\KdSPlnb.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\bTPHviT.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\FnqGTqx.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\EuUzdNk.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\BaYUdgE.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
File created	C:\Windows\System\nRQhmyk.exe	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeLockMemoryPrivilege	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	11824	Process not Found
Token: SeChangeNotifyPrivilege	11824	Process not Found
Token: 33	11824	Process not Found
Token: SeIncBasePriorityPrivilege	11824	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2060	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	91
PID 2548 wrote to memory of 2060	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	91
PID 2548 wrote to memory of 2880	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	92
PID 2548 wrote to memory of 2880	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	92
PID 2548 wrote to memory of 3132	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	93
PID 2548 wrote to memory of 3132	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	93
PID 2548 wrote to memory of 2228	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	94
PID 2548 wrote to memory of 2228	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	94
PID 2548 wrote to memory of 452	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	95
PID 2548 wrote to memory of 452	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	95
PID 2548 wrote to memory of 220	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	96
PID 2548 wrote to memory of 220	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	96
PID 2548 wrote to memory of 872	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	97
PID 2548 wrote to memory of 872	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	97
PID 2548 wrote to memory of 2440	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	98
PID 2548 wrote to memory of 2440	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	98
PID 2548 wrote to memory of 4964	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	99
PID 2548 wrote to memory of 4964	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	99
PID 2548 wrote to memory of 3848	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	100
PID 2548 wrote to memory of 3848	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	100
PID 2548 wrote to memory of 1256	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	101
PID 2548 wrote to memory of 1256	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	101
PID 2548 wrote to memory of 5040	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	102
PID 2548 wrote to memory of 5040	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	102
PID 2548 wrote to memory of 1728	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	103
PID 2548 wrote to memory of 1728	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	103
PID 2548 wrote to memory of 4412	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	104
PID 2548 wrote to memory of 4412	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	104
PID 2548 wrote to memory of 2108	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	105
PID 2548 wrote to memory of 2108	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	105
PID 2548 wrote to memory of 3416	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	106
PID 2548 wrote to memory of 3416	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	106
PID 2548 wrote to memory of 2800	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	107
PID 2548 wrote to memory of 2800	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	107
PID 2548 wrote to memory of 2776	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	108
PID 2548 wrote to memory of 2776	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	108
PID 2548 wrote to memory of 404	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	109
PID 2548 wrote to memory of 404	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	109
PID 2548 wrote to memory of 440	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	110
PID 2548 wrote to memory of 440	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	110
PID 2548 wrote to memory of 3012	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	111
PID 2548 wrote to memory of 3012	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	111
PID 2548 wrote to memory of 3624	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	112
PID 2548 wrote to memory of 3624	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	112
PID 2548 wrote to memory of 3996	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	113
PID 2548 wrote to memory of 3996	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	113
PID 2548 wrote to memory of 3256	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	114
PID 2548 wrote to memory of 3256	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	114
PID 2548 wrote to memory of 4380	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	115
PID 2548 wrote to memory of 4380	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	115
PID 2548 wrote to memory of 4068	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	116
PID 2548 wrote to memory of 4068	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	116
PID 2548 wrote to memory of 4784	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	117
PID 2548 wrote to memory of 4784	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	117
PID 2548 wrote to memory of 3564	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	118
PID 2548 wrote to memory of 3564	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	118
PID 2548 wrote to memory of 464	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	119
PID 2548 wrote to memory of 464	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	119
PID 2548 wrote to memory of 780	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	120
PID 2548 wrote to memory of 780	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	120
PID 2548 wrote to memory of 4272	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	121
PID 2548 wrote to memory of 4272	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	121
PID 2548 wrote to memory of 2636	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	122
PID 2548 wrote to memory of 2636	2548	04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04b950ca5287f735584e8ffe422d3201_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Windows\System\NkxyDsu.exe
  C:\Windows\System\NkxyDsu.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\HTnBqOd.exe
  C:\Windows\System\HTnBqOd.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\qkFnock.exe
  C:\Windows\System\qkFnock.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\xmLdNag.exe
  C:\Windows\System\xmLdNag.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\txKcTSN.exe
  C:\Windows\System\txKcTSN.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\QRZxRxZ.exe
  C:\Windows\System\QRZxRxZ.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\zJwAUqX.exe
  C:\Windows\System\zJwAUqX.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\yyUiKWG.exe
  C:\Windows\System\yyUiKWG.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\KtoCGsm.exe
  C:\Windows\System\KtoCGsm.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\MypsqAe.exe
  C:\Windows\System\MypsqAe.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\CLsjPIh.exe
  C:\Windows\System\CLsjPIh.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\EQtCWDB.exe
  C:\Windows\System\EQtCWDB.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\ImRKTcD.exe
  C:\Windows\System\ImRKTcD.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\mDobBWE.exe
  C:\Windows\System\mDobBWE.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\apJRJLo.exe
  C:\Windows\System\apJRJLo.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\PqpTmyy.exe
  C:\Windows\System\PqpTmyy.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\OBSppFi.exe
  C:\Windows\System\OBSppFi.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\tJLQgCJ.exe
  C:\Windows\System\tJLQgCJ.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\qvgFKFa.exe
  C:\Windows\System\qvgFKFa.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\TxANEjD.exe
  C:\Windows\System\TxANEjD.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\ekYNkyt.exe
  C:\Windows\System\ekYNkyt.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\nVwiCLk.exe
  C:\Windows\System\nVwiCLk.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\QohxVnO.exe
  C:\Windows\System\QohxVnO.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\eZXndmx.exe
  C:\Windows\System\eZXndmx.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\koDmKRv.exe
  C:\Windows\System\koDmKRv.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\wwiDnOk.exe
  C:\Windows\System\wwiDnOk.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\yrknNCC.exe
  C:\Windows\System\yrknNCC.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\bveHBzZ.exe
  C:\Windows\System\bveHBzZ.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\pUwjhbD.exe
  C:\Windows\System\pUwjhbD.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\rBletFH.exe
  C:\Windows\System\rBletFH.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\lTyEplf.exe
  C:\Windows\System\lTyEplf.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\TVxRYvh.exe
  C:\Windows\System\TVxRYvh.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\XVHnEKD.exe
  C:\Windows\System\XVHnEKD.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\XbYgrJs.exe
  C:\Windows\System\XbYgrJs.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\JCisRzl.exe
  C:\Windows\System\JCisRzl.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\oOgUaWe.exe
  C:\Windows\System\oOgUaWe.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\AtpYEvv.exe
  C:\Windows\System\AtpYEvv.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\BPLTTUv.exe
  C:\Windows\System\BPLTTUv.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\WCPRqBY.exe
  C:\Windows\System\WCPRqBY.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\fYUFrNG.exe
  C:\Windows\System\fYUFrNG.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\FxLrSbi.exe
  C:\Windows\System\FxLrSbi.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\OnBDtpy.exe
  C:\Windows\System\OnBDtpy.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\QFEgawd.exe
  C:\Windows\System\QFEgawd.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\sQiJuOx.exe
  C:\Windows\System\sQiJuOx.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\AChfxiv.exe
  C:\Windows\System\AChfxiv.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\HQjcpJJ.exe
  C:\Windows\System\HQjcpJJ.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\Mljtchq.exe
  C:\Windows\System\Mljtchq.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\IIRrumm.exe
  C:\Windows\System\IIRrumm.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\FLQskBI.exe
  C:\Windows\System\FLQskBI.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\dTyBpdH.exe
  C:\Windows\System\dTyBpdH.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\vFnJjSb.exe
  C:\Windows\System\vFnJjSb.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\YOfLzyn.exe
  C:\Windows\System\YOfLzyn.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\VIYxAZK.exe
  C:\Windows\System\VIYxAZK.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\CbzbakY.exe
  C:\Windows\System\CbzbakY.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\xqRIBeF.exe
  C:\Windows\System\xqRIBeF.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\klNwuJo.exe
  C:\Windows\System\klNwuJo.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\CYwvdKA.exe
  C:\Windows\System\CYwvdKA.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\VEbhVUF.exe
  C:\Windows\System\VEbhVUF.exe
  2⤵
  - Executes dropped EXE
  PID:5188
- C:\Windows\System\wPQPqKD.exe
  C:\Windows\System\wPQPqKD.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\LQWhNpB.exe
  C:\Windows\System\LQWhNpB.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\aFCjWxq.exe
  C:\Windows\System\aFCjWxq.exe
  2⤵
  - Executes dropped EXE
  PID:5272
- C:\Windows\System\yZVnrHn.exe
  C:\Windows\System\yZVnrHn.exe
  2⤵
  - Executes dropped EXE
  PID:5304
- C:\Windows\System\wHdiwSf.exe
  C:\Windows\System\wHdiwSf.exe
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Windows\System\wymdQcT.exe
  C:\Windows\System\wymdQcT.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System\AkmqcZI.exe
  C:\Windows\System\AkmqcZI.exe
  2⤵
  PID:5388
- C:\Windows\System\pUxhBBm.exe
  C:\Windows\System\pUxhBBm.exe
  2⤵
  PID:5420
- C:\Windows\System\LCzrqdZ.exe
  C:\Windows\System\LCzrqdZ.exe
  2⤵
  PID:5448
- C:\Windows\System\zXsQWEX.exe
  C:\Windows\System\zXsQWEX.exe
  2⤵
  PID:5476
- C:\Windows\System\DxslgRw.exe
  C:\Windows\System\DxslgRw.exe
  2⤵
  PID:5496
- C:\Windows\System\rhrHEkC.exe
  C:\Windows\System\rhrHEkC.exe
  2⤵
  PID:5528
- C:\Windows\System\UOrEqLE.exe
  C:\Windows\System\UOrEqLE.exe
  2⤵
  PID:5572
- C:\Windows\System\JxLPDSu.exe
  C:\Windows\System\JxLPDSu.exe
  2⤵
  PID:5596
- C:\Windows\System\EuUzdNk.exe
  C:\Windows\System\EuUzdNk.exe
  2⤵
  PID:5624
- C:\Windows\System\ojXKiNd.exe
  C:\Windows\System\ojXKiNd.exe
  2⤵
  PID:5652
- C:\Windows\System\wHTrJJX.exe
  C:\Windows\System\wHTrJJX.exe
  2⤵
  PID:5676
- C:\Windows\System\PEBMciw.exe
  C:\Windows\System\PEBMciw.exe
  2⤵
  PID:5712
- C:\Windows\System\KeiWMdX.exe
  C:\Windows\System\KeiWMdX.exe
  2⤵
  PID:5736
- C:\Windows\System\eQNfFxQ.exe
  C:\Windows\System\eQNfFxQ.exe
  2⤵
  PID:5780
- C:\Windows\System\XpdlbCv.exe
  C:\Windows\System\XpdlbCv.exe
  2⤵
  PID:5800
- C:\Windows\System\EsSKoEG.exe
  C:\Windows\System\EsSKoEG.exe
  2⤵
  PID:5828
- C:\Windows\System\qrKffMl.exe
  C:\Windows\System\qrKffMl.exe
  2⤵
  PID:5856
- C:\Windows\System\uEbjFcm.exe
  C:\Windows\System\uEbjFcm.exe
  2⤵
  PID:5872
- C:\Windows\System\BSmKsOx.exe
  C:\Windows\System\BSmKsOx.exe
  2⤵
  PID:5896
- C:\Windows\System\wpugKpF.exe
  C:\Windows\System\wpugKpF.exe
  2⤵
  PID:5944
- C:\Windows\System\ulyEerM.exe
  C:\Windows\System\ulyEerM.exe
  2⤵
  PID:5964
- C:\Windows\System\nDagxJT.exe
  C:\Windows\System\nDagxJT.exe
  2⤵
  PID:5984
- C:\Windows\System\PPglTkF.exe
  C:\Windows\System\PPglTkF.exe
  2⤵
  PID:6020
- C:\Windows\System\newjAFm.exe
  C:\Windows\System\newjAFm.exe
  2⤵
  PID:6056
- C:\Windows\System\XgvwWVn.exe
  C:\Windows\System\XgvwWVn.exe
  2⤵
  PID:6096
- C:\Windows\System\vvDtqvw.exe
  C:\Windows\System\vvDtqvw.exe
  2⤵
  PID:6124
- C:\Windows\System\pZZuhSp.exe
  C:\Windows\System\pZZuhSp.exe
  2⤵
  PID:6140
- C:\Windows\System\sWGxsBm.exe
  C:\Windows\System\sWGxsBm.exe
  2⤵
  PID:4572
- C:\Windows\System\HKrrznH.exe
  C:\Windows\System\HKrrznH.exe
  2⤵
  PID:1428
- C:\Windows\System\lZxpdGm.exe
  C:\Windows\System\lZxpdGm.exe
  2⤵
  PID:4128
- C:\Windows\System\KdSPlnb.exe
  C:\Windows\System\KdSPlnb.exe
  2⤵
  PID:1112
- C:\Windows\System\aUvaASX.exe
  C:\Windows\System\aUvaASX.exe
  2⤵
  PID:5208
- C:\Windows\System\mSIWbyl.exe
  C:\Windows\System\mSIWbyl.exe
  2⤵
  PID:5236
- C:\Windows\System\JerZwkD.exe
  C:\Windows\System\JerZwkD.exe
  2⤵
  PID:5312
- C:\Windows\System\vSpIYMk.exe
  C:\Windows\System\vSpIYMk.exe
  2⤵
  PID:5352
- C:\Windows\System\CMSFsGR.exe
  C:\Windows\System\CMSFsGR.exe
  2⤵
  PID:4672
- C:\Windows\System\wBOgoAX.exe
  C:\Windows\System\wBOgoAX.exe
  2⤵
  PID:1148
- C:\Windows\System\QsRWPuZ.exe
  C:\Windows\System\QsRWPuZ.exe
  2⤵
  PID:5416
- C:\Windows\System\QpBfeev.exe
  C:\Windows\System\QpBfeev.exe
  2⤵
  PID:5444
- C:\Windows\System\axoqSQM.exe
  C:\Windows\System\axoqSQM.exe
  2⤵
  PID:4468
- C:\Windows\System\wtBjYAX.exe
  C:\Windows\System\wtBjYAX.exe
  2⤵
  PID:5536
- C:\Windows\System\sMPppkh.exe
  C:\Windows\System\sMPppkh.exe
  2⤵
  PID:4808
- C:\Windows\System\hltzXKE.exe
  C:\Windows\System\hltzXKE.exe
  2⤵
  PID:1392
- C:\Windows\System\trwcXOv.exe
  C:\Windows\System\trwcXOv.exe
  2⤵
  PID:5640
- C:\Windows\System\zUvYLPJ.exe
  C:\Windows\System\zUvYLPJ.exe
  2⤵
  PID:4992
- C:\Windows\System\tsumbnd.exe
  C:\Windows\System\tsumbnd.exe
  2⤵
  PID:5728
- C:\Windows\System\wrMwxne.exe
  C:\Windows\System\wrMwxne.exe
  2⤵
  PID:3784
- C:\Windows\System\YWdZYpS.exe
  C:\Windows\System\YWdZYpS.exe
  2⤵
  PID:1484
- C:\Windows\System\xRIySzk.exe
  C:\Windows\System\xRIySzk.exe
  2⤵
  PID:5008
- C:\Windows\System\LEWewnS.exe
  C:\Windows\System\LEWewnS.exe
  2⤵
  PID:5904
- C:\Windows\System\vmmTzTY.exe
  C:\Windows\System\vmmTzTY.exe
  2⤵
  PID:5868
- C:\Windows\System\gIVFeiq.exe
  C:\Windows\System\gIVFeiq.exe
  2⤵
  PID:6048
- C:\Windows\System\gVJbSjt.exe
  C:\Windows\System\gVJbSjt.exe
  2⤵
  PID:4076
- C:\Windows\System\ZCUVhsc.exe
  C:\Windows\System\ZCUVhsc.exe
  2⤵
  PID:932
- C:\Windows\System\NtzlBHP.exe
  C:\Windows\System\NtzlBHP.exe
  2⤵
  PID:4876
- C:\Windows\System\iwHdiCC.exe
  C:\Windows\System\iwHdiCC.exe
  2⤵
  PID:5180
- C:\Windows\System\roLCDzb.exe
  C:\Windows\System\roLCDzb.exe
  2⤵
  PID:5292
- C:\Windows\System\PLTvzvJ.exe
  C:\Windows\System\PLTvzvJ.exe
  2⤵
  PID:2720
- C:\Windows\System\ZGIySoz.exe
  C:\Windows\System\ZGIySoz.exe
  2⤵
  PID:4352
- C:\Windows\System\NOkkWUt.exe
  C:\Windows\System\NOkkWUt.exe
  2⤵
  PID:4588
- C:\Windows\System\YCijylp.exe
  C:\Windows\System\YCijylp.exe
  2⤵
  PID:1212
- C:\Windows\System\WkjZxJh.exe
  C:\Windows\System\WkjZxJh.exe
  2⤵
  PID:5636
- C:\Windows\System\NCldBFs.exe
  C:\Windows\System\NCldBFs.exe
  2⤵
  PID:4136
- C:\Windows\System\yiDxPgq.exe
  C:\Windows\System\yiDxPgq.exe
  2⤵
  PID:5848
- C:\Windows\System\DOPxvvP.exe
  C:\Windows\System\DOPxvvP.exe
  2⤵
  PID:4516
- C:\Windows\System\IRVHUPL.exe
  C:\Windows\System\IRVHUPL.exe
  2⤵
  PID:6116
- C:\Windows\System\uIgEDQv.exe
  C:\Windows\System\uIgEDQv.exe
  2⤵
  PID:552
- C:\Windows\System\UmJtQKA.exe
  C:\Windows\System\UmJtQKA.exe
  2⤵
  PID:1432
- C:\Windows\System\jtAckzs.exe
  C:\Windows\System\jtAckzs.exe
  2⤵
  PID:5484
- C:\Windows\System\tQVKoox.exe
  C:\Windows\System\tQVKoox.exe
  2⤵
  PID:5768
- C:\Windows\System\IxPvdpG.exe
  C:\Windows\System\IxPvdpG.exe
  2⤵
  PID:2508
- C:\Windows\System\gAsCvFm.exe
  C:\Windows\System\gAsCvFm.exe
  2⤵
  PID:5404
- C:\Windows\System\RmNlmKY.exe
  C:\Windows\System\RmNlmKY.exe
  2⤵
  PID:4132
- C:\Windows\System\kEsLpOo.exe
  C:\Windows\System\kEsLpOo.exe
  2⤵
  PID:3812
- C:\Windows\System\UbLwKYa.exe
  C:\Windows\System\UbLwKYa.exe
  2⤵
  PID:6136
- C:\Windows\System\RylKPJZ.exe
  C:\Windows\System\RylKPJZ.exe
  2⤵
  PID:6172
- C:\Windows\System\NbBIXGj.exe
  C:\Windows\System\NbBIXGj.exe
  2⤵
  PID:6200
- C:\Windows\System\lbZHGIP.exe
  C:\Windows\System\lbZHGIP.exe
  2⤵
  PID:6228
- C:\Windows\System\zvCQNuo.exe
  C:\Windows\System\zvCQNuo.exe
  2⤵
  PID:6248
- C:\Windows\System\WDFTygZ.exe
  C:\Windows\System\WDFTygZ.exe
  2⤵
  PID:6268
- C:\Windows\System\FzGRVwm.exe
  C:\Windows\System\FzGRVwm.exe
  2⤵
  PID:6316
- C:\Windows\System\MLIollb.exe
  C:\Windows\System\MLIollb.exe
  2⤵
  PID:6332
- C:\Windows\System\RpqVAfg.exe
  C:\Windows\System\RpqVAfg.exe
  2⤵
  PID:6356
- C:\Windows\System\npRvCDS.exe
  C:\Windows\System\npRvCDS.exe
  2⤵
  PID:6400
- C:\Windows\System\YjyazWL.exe
  C:\Windows\System\YjyazWL.exe
  2⤵
  PID:6440
- C:\Windows\System\KszZZLn.exe
  C:\Windows\System\KszZZLn.exe
  2⤵
  PID:6468
- C:\Windows\System\dIokmVy.exe
  C:\Windows\System\dIokmVy.exe
  2⤵
  PID:6492
- C:\Windows\System\iwihFSK.exe
  C:\Windows\System\iwihFSK.exe
  2⤵
  PID:6532
- C:\Windows\System\yzftKle.exe
  C:\Windows\System\yzftKle.exe
  2⤵
  PID:6560
- C:\Windows\System\YIyegLX.exe
  C:\Windows\System\YIyegLX.exe
  2⤵
  PID:6596
- C:\Windows\System\YAwENpB.exe
  C:\Windows\System\YAwENpB.exe
  2⤵
  PID:6632
- C:\Windows\System\kjKyLci.exe
  C:\Windows\System\kjKyLci.exe
  2⤵
  PID:6656
- C:\Windows\System\lEfIcmX.exe
  C:\Windows\System\lEfIcmX.exe
  2⤵
  PID:6680
- C:\Windows\System\WDaxvkc.exe
  C:\Windows\System\WDaxvkc.exe
  2⤵
  PID:6704
- C:\Windows\System\bZWJPFm.exe
  C:\Windows\System\bZWJPFm.exe
  2⤵
  PID:6724
- C:\Windows\System\rgaxqjW.exe
  C:\Windows\System\rgaxqjW.exe
  2⤵
  PID:6740
- C:\Windows\System\oSlRuqK.exe
  C:\Windows\System\oSlRuqK.exe
  2⤵
  PID:6764
- C:\Windows\System\JFAsMZD.exe
  C:\Windows\System\JFAsMZD.exe
  2⤵
  PID:6784
- C:\Windows\System\HLviLjc.exe
  C:\Windows\System\HLviLjc.exe
  2⤵
  PID:6804
- C:\Windows\System\CNvzjzT.exe
  C:\Windows\System\CNvzjzT.exe
  2⤵
  PID:6848
- C:\Windows\System\iVlxYmj.exe
  C:\Windows\System\iVlxYmj.exe
  2⤵
  PID:6888
- C:\Windows\System\OdsoUMR.exe
  C:\Windows\System\OdsoUMR.exe
  2⤵
  PID:6912
- C:\Windows\System\CXfswhI.exe
  C:\Windows\System\CXfswhI.exe
  2⤵
  PID:6960
- C:\Windows\System\urOSrdm.exe
  C:\Windows\System\urOSrdm.exe
  2⤵
  PID:6980
- C:\Windows\System\OdjqvGC.exe
  C:\Windows\System\OdjqvGC.exe
  2⤵
  PID:7004
- C:\Windows\System\ntWYPaP.exe
  C:\Windows\System\ntWYPaP.exe
  2⤵
  PID:7032
- C:\Windows\System\LtdHczu.exe
  C:\Windows\System\LtdHczu.exe
  2⤵
  PID:7068
- C:\Windows\System\hJqMNNT.exe
  C:\Windows\System\hJqMNNT.exe
  2⤵
  PID:7088
- C:\Windows\System\nvneQSI.exe
  C:\Windows\System\nvneQSI.exe
  2⤵
  PID:7116
- C:\Windows\System\SLIrjeO.exe
  C:\Windows\System\SLIrjeO.exe
  2⤵
  PID:7140
- C:\Windows\System\QupUsdg.exe
  C:\Windows\System\QupUsdg.exe
  2⤵
  PID:2092
- C:\Windows\System\omDISiV.exe
  C:\Windows\System\omDISiV.exe
  2⤵
  PID:6164
- C:\Windows\System\UroAENi.exe
  C:\Windows\System\UroAENi.exe
  2⤵
  PID:6192
- C:\Windows\System\WVBnaXZ.exe
  C:\Windows\System\WVBnaXZ.exe
  2⤵
  PID:6288
- C:\Windows\System\znnrZaN.exe
  C:\Windows\System\znnrZaN.exe
  2⤵
  PID:6408
- C:\Windows\System\DMckuPk.exe
  C:\Windows\System\DMckuPk.exe
  2⤵
  PID:6432
- C:\Windows\System\EqVjmco.exe
  C:\Windows\System\EqVjmco.exe
  2⤵
  PID:6504
- C:\Windows\System\EsWGBZx.exe
  C:\Windows\System\EsWGBZx.exe
  2⤵
  PID:6584
- C:\Windows\System\hyYCfVz.exe
  C:\Windows\System\hyYCfVz.exe
  2⤵
  PID:6668
- C:\Windows\System\FIewhzN.exe
  C:\Windows\System\FIewhzN.exe
  2⤵
  PID:6716
- C:\Windows\System\TOZdTkY.exe
  C:\Windows\System\TOZdTkY.exe
  2⤵
  PID:6796
- C:\Windows\System\ecZacYQ.exe
  C:\Windows\System\ecZacYQ.exe
  2⤵
  PID:6856
- C:\Windows\System\rJGquEW.exe
  C:\Windows\System\rJGquEW.exe
  2⤵
  PID:6908
- C:\Windows\System\fmWfUzk.exe
  C:\Windows\System\fmWfUzk.exe
  2⤵
  PID:6972
- C:\Windows\System\bvjpRnX.exe
  C:\Windows\System\bvjpRnX.exe
  2⤵
  PID:7060
- C:\Windows\System\NFauxXO.exe
  C:\Windows\System\NFauxXO.exe
  2⤵
  PID:7108
- C:\Windows\System\JMZXTCg.exe
  C:\Windows\System\JMZXTCg.exe
  2⤵
  PID:7160
- C:\Windows\System\piJnhfg.exe
  C:\Windows\System\piJnhfg.exe
  2⤵
  PID:6112
- C:\Windows\System\BLVUDZh.exe
  C:\Windows\System\BLVUDZh.exe
  2⤵
  PID:6368
- C:\Windows\System\QnziVwt.exe
  C:\Windows\System\QnziVwt.exe
  2⤵
  PID:6456
- C:\Windows\System\CcKzXTA.exe
  C:\Windows\System\CcKzXTA.exe
  2⤵
  PID:5396
- C:\Windows\System\oEDvctX.exe
  C:\Windows\System\oEDvctX.exe
  2⤵
  PID:6640
- C:\Windows\System\neewgTg.exe
  C:\Windows\System\neewgTg.exe
  2⤵
  PID:6700
- C:\Windows\System\yOIMytm.exe
  C:\Windows\System\yOIMytm.exe
  2⤵
  PID:6732
- C:\Windows\System\zODOAge.exe
  C:\Windows\System\zODOAge.exe
  2⤵
  PID:6940
- C:\Windows\System\sQbumGH.exe
  C:\Windows\System\sQbumGH.exe
  2⤵
  PID:2036
- C:\Windows\System\RRJGPAa.exe
  C:\Windows\System\RRJGPAa.exe
  2⤵
  PID:2804
- C:\Windows\System\xZqsXUb.exe
  C:\Windows\System\xZqsXUb.exe
  2⤵
  PID:6188
- C:\Windows\System\wzWjWqZ.exe
  C:\Windows\System\wzWjWqZ.exe
  2⤵
  PID:6488
- C:\Windows\System\vbxfQaY.exe
  C:\Windows\System\vbxfQaY.exe
  2⤵
  PID:6644
- C:\Windows\System\ewuXiQL.exe
  C:\Windows\System\ewuXiQL.exe
  2⤵
  PID:7180
- C:\Windows\System\whmycTs.exe
  C:\Windows\System\whmycTs.exe
  2⤵
  PID:7196
- C:\Windows\System\uYAHcHS.exe
  C:\Windows\System\uYAHcHS.exe
  2⤵
  PID:7220
- C:\Windows\System\aeqhDCB.exe
  C:\Windows\System\aeqhDCB.exe
  2⤵
  PID:7240
- C:\Windows\System\IqibwBZ.exe
  C:\Windows\System\IqibwBZ.exe
  2⤵
  PID:7260
- C:\Windows\System\fLsHBgZ.exe
  C:\Windows\System\fLsHBgZ.exe
  2⤵
  PID:7280
- C:\Windows\System\isABAeY.exe
  C:\Windows\System\isABAeY.exe
  2⤵
  PID:7300
- C:\Windows\System\aSjJfKB.exe
  C:\Windows\System\aSjJfKB.exe
  2⤵
  PID:7324
- C:\Windows\System\TsxMngS.exe
  C:\Windows\System\TsxMngS.exe
  2⤵
  PID:7340
- C:\Windows\System\oLgOuye.exe
  C:\Windows\System\oLgOuye.exe
  2⤵
  PID:7356
- C:\Windows\System\xRcjSjx.exe
  C:\Windows\System\xRcjSjx.exe
  2⤵
  PID:7372
- C:\Windows\System\airtiFe.exe
  C:\Windows\System\airtiFe.exe
  2⤵
  PID:7392
- C:\Windows\System\vMAmMnb.exe
  C:\Windows\System\vMAmMnb.exe
  2⤵
  PID:7408
- C:\Windows\System\VwbUlqr.exe
  C:\Windows\System\VwbUlqr.exe
  2⤵
  PID:7440
- C:\Windows\System\FsRzgig.exe
  C:\Windows\System\FsRzgig.exe
  2⤵
  PID:7528
- C:\Windows\System\bPGPELA.exe
  C:\Windows\System\bPGPELA.exe
  2⤵
  PID:7552
- C:\Windows\System\tYiGsnv.exe
  C:\Windows\System\tYiGsnv.exe
  2⤵
  PID:7572
- C:\Windows\System\qkPApjz.exe
  C:\Windows\System\qkPApjz.exe
  2⤵
  PID:7588
- C:\Windows\System\fzSzZUi.exe
  C:\Windows\System\fzSzZUi.exe
  2⤵
  PID:7616
- C:\Windows\System\AZMqgcd.exe
  C:\Windows\System\AZMqgcd.exe
  2⤵
  PID:7648
- C:\Windows\System\dtCorqI.exe
  C:\Windows\System\dtCorqI.exe
  2⤵
  PID:7664
- C:\Windows\System\pBzkbRK.exe
  C:\Windows\System\pBzkbRK.exe
  2⤵
  PID:7688
- C:\Windows\System\zpTCQEb.exe
  C:\Windows\System\zpTCQEb.exe
  2⤵
  PID:7704
- C:\Windows\System\Zcownsk.exe
  C:\Windows\System\Zcownsk.exe
  2⤵
  PID:7724
- C:\Windows\System\KbCkrEP.exe
  C:\Windows\System\KbCkrEP.exe
  2⤵
  PID:7748
- C:\Windows\System\TEOmaTU.exe
  C:\Windows\System\TEOmaTU.exe
  2⤵
  PID:7768
- C:\Windows\System\OIFxuII.exe
  C:\Windows\System\OIFxuII.exe
  2⤵
  PID:7792
- C:\Windows\System\XpCDPWx.exe
  C:\Windows\System\XpCDPWx.exe
  2⤵
  PID:7808
- C:\Windows\System\MvGlPNT.exe
  C:\Windows\System\MvGlPNT.exe
  2⤵
  PID:7824
- C:\Windows\System\XfcMNWy.exe
  C:\Windows\System\XfcMNWy.exe
  2⤵
  PID:7844
- C:\Windows\System\uyqwQSV.exe
  C:\Windows\System\uyqwQSV.exe
  2⤵
  PID:7860
- C:\Windows\System\satWACt.exe
  C:\Windows\System\satWACt.exe
  2⤵
  PID:7892
- C:\Windows\System\gqNXYwO.exe
  C:\Windows\System\gqNXYwO.exe
  2⤵
  PID:7912
- C:\Windows\System\aNXIvGy.exe
  C:\Windows\System\aNXIvGy.exe
  2⤵
  PID:7940
- C:\Windows\System\KBSncAE.exe
  C:\Windows\System\KBSncAE.exe
  2⤵
  PID:7960
- C:\Windows\System\eFnpKKx.exe
  C:\Windows\System\eFnpKKx.exe
  2⤵
  PID:7980
- C:\Windows\System\SvJWssT.exe
  C:\Windows\System\SvJWssT.exe
  2⤵
  PID:7996
- C:\Windows\System\ZIdbCZB.exe
  C:\Windows\System\ZIdbCZB.exe
  2⤵
  PID:8016
- C:\Windows\System\dojsCVL.exe
  C:\Windows\System\dojsCVL.exe
  2⤵
  PID:8040
- C:\Windows\System\SniGwkY.exe
  C:\Windows\System\SniGwkY.exe
  2⤵
  PID:8060
- C:\Windows\System\JRHJOPT.exe
  C:\Windows\System\JRHJOPT.exe
  2⤵
  PID:8084
- C:\Windows\System\dJbTuKh.exe
  C:\Windows\System\dJbTuKh.exe
  2⤵
  PID:8104
- C:\Windows\System\blGHafl.exe
  C:\Windows\System\blGHafl.exe
  2⤵
  PID:8124
- C:\Windows\System\pVsYLCP.exe
  C:\Windows\System\pVsYLCP.exe
  2⤵
  PID:7028
- C:\Windows\System\uSIQvtI.exe
  C:\Windows\System\uSIQvtI.exe
  2⤵
  PID:7192
- C:\Windows\System\OpNXVcU.exe
  C:\Windows\System\OpNXVcU.exe
  2⤵
  PID:6244
- C:\Windows\System\DRessHi.exe
  C:\Windows\System\DRessHi.exe
  2⤵
  PID:7204
- C:\Windows\System\sZAOraB.exe
  C:\Windows\System\sZAOraB.exe
  2⤵
  PID:7128
- C:\Windows\System\LoHULrt.exe
  C:\Windows\System\LoHULrt.exe
  2⤵
  PID:7296
- C:\Windows\System\yKpfiOs.exe
  C:\Windows\System\yKpfiOs.exe
  2⤵
  PID:4900
- C:\Windows\System\VspNiHZ.exe
  C:\Windows\System\VspNiHZ.exe
  2⤵
  PID:3220
- C:\Windows\System\djuGPpn.exe
  C:\Windows\System\djuGPpn.exe
  2⤵
  PID:7428
- C:\Windows\System\qLeKxgk.exe
  C:\Windows\System\qLeKxgk.exe
  2⤵
  PID:7548
- C:\Windows\System\VtPXuEW.exe
  C:\Windows\System\VtPXuEW.exe
  2⤵
  PID:7252
- C:\Windows\System\OIXnqUS.exe
  C:\Windows\System\OIXnqUS.exe
  2⤵
  PID:7336
- C:\Windows\System\XZwLlUk.exe
  C:\Windows\System\XZwLlUk.exe
  2⤵
  PID:7756
- C:\Windows\System\xHammGU.exe
  C:\Windows\System\xHammGU.exe
  2⤵
  PID:7820
- C:\Windows\System\PieNhHu.exe
  C:\Windows\System\PieNhHu.exe
  2⤵
  PID:7640
- C:\Windows\System\tyvESHR.exe
  C:\Windows\System\tyvESHR.exe
  2⤵
  PID:7680
- C:\Windows\System\iVQYANb.exe
  C:\Windows\System\iVQYANb.exe
  2⤵
  PID:7700
- C:\Windows\System\kWiLGve.exe
  C:\Windows\System\kWiLGve.exe
  2⤵
  PID:8052
- C:\Windows\System\LYrQhmG.exe
  C:\Windows\System\LYrQhmG.exe
  2⤵
  PID:7876
- C:\Windows\System\yJnbRrc.exe
  C:\Windows\System\yJnbRrc.exe
  2⤵
  PID:8028
- C:\Windows\System\HbhbZeK.exe
  C:\Windows\System\HbhbZeK.exe
  2⤵
  PID:8208
- C:\Windows\System\bGFIvKs.exe
  C:\Windows\System\bGFIvKs.exe
  2⤵
  PID:8224
- C:\Windows\System\lSvhPcu.exe
  C:\Windows\System\lSvhPcu.exe
  2⤵
  PID:8240
- C:\Windows\System\wcBuAwc.exe
  C:\Windows\System\wcBuAwc.exe
  2⤵
  PID:8256
- C:\Windows\System\CythPop.exe
  C:\Windows\System\CythPop.exe
  2⤵
  PID:8280
- C:\Windows\System\yvHENia.exe
  C:\Windows\System\yvHENia.exe
  2⤵
  PID:8300
- C:\Windows\System\EAdvDuW.exe
  C:\Windows\System\EAdvDuW.exe
  2⤵
  PID:8324
- C:\Windows\System\gQAnLfz.exe
  C:\Windows\System\gQAnLfz.exe
  2⤵
  PID:8352
- C:\Windows\System\fzmLtKV.exe
  C:\Windows\System\fzmLtKV.exe
  2⤵
  PID:8460
- C:\Windows\System\fXSlLAB.exe
  C:\Windows\System\fXSlLAB.exe
  2⤵
  PID:8484
- C:\Windows\System\hJKLMVf.exe
  C:\Windows\System\hJKLMVf.exe
  2⤵
  PID:8512
- C:\Windows\System\VDgVMha.exe
  C:\Windows\System\VDgVMha.exe
  2⤵
  PID:8536
- C:\Windows\System\XNlmCob.exe
  C:\Windows\System\XNlmCob.exe
  2⤵
  PID:8552
- C:\Windows\System\cwAnLsB.exe
  C:\Windows\System\cwAnLsB.exe
  2⤵
  PID:8576
- C:\Windows\System\IqDoZXU.exe
  C:\Windows\System\IqDoZXU.exe
  2⤵
  PID:8596
- C:\Windows\System\HpYgOzg.exe
  C:\Windows\System\HpYgOzg.exe
  2⤵
  PID:8628
- C:\Windows\System\iJqUmLn.exe
  C:\Windows\System\iJqUmLn.exe
  2⤵
  PID:8656
- C:\Windows\System\aUvLwTw.exe
  C:\Windows\System\aUvLwTw.exe
  2⤵
  PID:8708
- C:\Windows\System\tTITIaM.exe
  C:\Windows\System\tTITIaM.exe
  2⤵
  PID:8724
- C:\Windows\System\SJyxRrZ.exe
  C:\Windows\System\SJyxRrZ.exe
  2⤵
  PID:8744
- C:\Windows\System\TGjcBKk.exe
  C:\Windows\System\TGjcBKk.exe
  2⤵
  PID:8764
- C:\Windows\System\yaImVjd.exe
  C:\Windows\System\yaImVjd.exe
  2⤵
  PID:8792
- C:\Windows\System\HeMJWQZ.exe
  C:\Windows\System\HeMJWQZ.exe
  2⤵
  PID:8812
- C:\Windows\System\kLkDRpP.exe
  C:\Windows\System\kLkDRpP.exe
  2⤵
  PID:8828
- C:\Windows\System\wqCVMaO.exe
  C:\Windows\System\wqCVMaO.exe
  2⤵
  PID:8848
- C:\Windows\System\ystlZQL.exe
  C:\Windows\System\ystlZQL.exe
  2⤵
  PID:8868
- C:\Windows\System\zlFHaHo.exe
  C:\Windows\System\zlFHaHo.exe
  2⤵
  PID:8888
- C:\Windows\System\SYTNWfJ.exe
  C:\Windows\System\SYTNWfJ.exe
  2⤵
  PID:8908
- C:\Windows\System\BMVSHRP.exe
  C:\Windows\System\BMVSHRP.exe
  2⤵
  PID:8928
- C:\Windows\System\kHoDUsi.exe
  C:\Windows\System\kHoDUsi.exe
  2⤵
  PID:8952
- C:\Windows\System\fCgDWlO.exe
  C:\Windows\System\fCgDWlO.exe
  2⤵
  PID:8972
- C:\Windows\System\HjCYzYM.exe
  C:\Windows\System\HjCYzYM.exe
  2⤵
  PID:8992
- C:\Windows\System\idbxMHl.exe
  C:\Windows\System\idbxMHl.exe
  2⤵
  PID:9008
- C:\Windows\System\qOaYThA.exe
  C:\Windows\System\qOaYThA.exe
  2⤵
  PID:9024
- C:\Windows\System\BhSRVvQ.exe
  C:\Windows\System\BhSRVvQ.exe
  2⤵
  PID:9044
- C:\Windows\System\gOYBpXC.exe
  C:\Windows\System\gOYBpXC.exe
  2⤵
  PID:9064
- C:\Windows\System\xmlQGop.exe
  C:\Windows\System\xmlQGop.exe
  2⤵
  PID:9084
- C:\Windows\System\nWxfJTt.exe
  C:\Windows\System\nWxfJTt.exe
  2⤵
  PID:9112
- C:\Windows\System\GvEcCXc.exe
  C:\Windows\System\GvEcCXc.exe
  2⤵
  PID:8076
- C:\Windows\System\zXwCnSx.exe
  C:\Windows\System\zXwCnSx.exe
  2⤵
  PID:8548
- C:\Windows\System\zVBfquZ.exe
  C:\Windows\System\zVBfquZ.exe
  2⤵
  PID:9000
- C:\Windows\System\Ucqshlq.exe
  C:\Windows\System\Ucqshlq.exe
  2⤵
  PID:8504
- C:\Windows\System\CIFjhoT.exe
  C:\Windows\System\CIFjhoT.exe
  2⤵
  PID:8592
- C:\Windows\System\ATJTNCl.exe
  C:\Windows\System\ATJTNCl.exe
  2⤵
  PID:8964
- C:\Windows\System\riIyNTi.exe
  C:\Windows\System\riIyNTi.exe
  2⤵
  PID:9076
- C:\Windows\System\pCKKYAy.exe
  C:\Windows\System\pCKKYAy.exe
  2⤵
  PID:8664
- C:\Windows\System\HDLSNCl.exe
  C:\Windows\System\HDLSNCl.exe
  2⤵
  PID:9192
- C:\Windows\System\PiMjGVa.exe
  C:\Windows\System\PiMjGVa.exe
  2⤵
  PID:8716
- C:\Windows\System\sfLcQTb.exe
  C:\Windows\System\sfLcQTb.exe
  2⤵
  PID:8824
- C:\Windows\System\BeRhUXI.exe
  C:\Windows\System\BeRhUXI.exe
  2⤵
  PID:8864
- C:\Windows\System\DQETcmQ.exe
  C:\Windows\System\DQETcmQ.exe
  2⤵
  PID:8920
- C:\Windows\System\THGaaQt.exe
  C:\Windows\System\THGaaQt.exe
  2⤵
  PID:9040
- C:\Windows\System\KxZjjBG.exe
  C:\Windows\System\KxZjjBG.exe
  2⤵
  PID:9120
- C:\Windows\System\SxfkHQi.exe
  C:\Windows\System\SxfkHQi.exe
  2⤵
  PID:9180
- C:\Windows\System\HghSqGb.exe
  C:\Windows\System\HghSqGb.exe
  2⤵
  PID:8232
- C:\Windows\System\YASdAnP.exe
  C:\Windows\System\YASdAnP.exe
  2⤵
  PID:9124
- C:\Windows\System\JIqoGco.exe
  C:\Windows\System\JIqoGco.exe
  2⤵
  PID:7584
- C:\Windows\System\QtMqEvp.exe
  C:\Windows\System\QtMqEvp.exe
  2⤵
  PID:7212
- C:\Windows\System\yNdPxNL.exe
  C:\Windows\System\yNdPxNL.exe
  2⤵
  PID:8440
- C:\Windows\System\WxTikzF.exe
  C:\Windows\System\WxTikzF.exe
  2⤵
  PID:7976
- C:\Windows\System\BaYUdgE.exe
  C:\Windows\System\BaYUdgE.exe
  2⤵
  PID:8652
- C:\Windows\System\auKbVHA.exe
  C:\Windows\System\auKbVHA.exe
  2⤵
  PID:8732
- C:\Windows\System\LrGNJaR.exe
  C:\Windows\System\LrGNJaR.exe
  2⤵
  PID:408
- C:\Windows\System\xCpBgGy.exe
  C:\Windows\System\xCpBgGy.exe
  2⤵
  PID:8572
- C:\Windows\System\feiXIgV.exe
  C:\Windows\System\feiXIgV.exe
  2⤵
  PID:9036
- C:\Windows\System\KUrrsqk.exe
  C:\Windows\System\KUrrsqk.exe
  2⤵
  PID:9220
- C:\Windows\System\qWIrDQD.exe
  C:\Windows\System\qWIrDQD.exe
  2⤵
  PID:9244
- C:\Windows\System\iGOMmCL.exe
  C:\Windows\System\iGOMmCL.exe
  2⤵
  PID:9264
- C:\Windows\System\oXDmGIV.exe
  C:\Windows\System\oXDmGIV.exe
  2⤵
  PID:9284
- C:\Windows\System\LDvRWQW.exe
  C:\Windows\System\LDvRWQW.exe
  2⤵
  PID:9304
- C:\Windows\System\FBRZZPL.exe
  C:\Windows\System\FBRZZPL.exe
  2⤵
  PID:9324
- C:\Windows\System\vRmudUD.exe
  C:\Windows\System\vRmudUD.exe
  2⤵
  PID:9340
- C:\Windows\System\UVcAsCg.exe
  C:\Windows\System\UVcAsCg.exe
  2⤵
  PID:9356
- C:\Windows\System\wiBfVEg.exe
  C:\Windows\System\wiBfVEg.exe
  2⤵
  PID:9376
- C:\Windows\System\FRArjtO.exe
  C:\Windows\System\FRArjtO.exe
  2⤵
  PID:9392
- C:\Windows\System\sRELqoR.exe
  C:\Windows\System\sRELqoR.exe
  2⤵
  PID:9412
- C:\Windows\System\NgSNUdo.exe
  C:\Windows\System\NgSNUdo.exe
  2⤵
  PID:9432
- C:\Windows\System\UTZzjXG.exe
  C:\Windows\System\UTZzjXG.exe
  2⤵
  PID:9456
- C:\Windows\System\ggoxMeU.exe
  C:\Windows\System\ggoxMeU.exe
  2⤵
  PID:9472
- C:\Windows\System\fqxCjlk.exe
  C:\Windows\System\fqxCjlk.exe
  2⤵
  PID:9492
- C:\Windows\System\bmfwFAN.exe
  C:\Windows\System\bmfwFAN.exe
  2⤵
  PID:9516
- C:\Windows\System\YIdhjiw.exe
  C:\Windows\System\YIdhjiw.exe
  2⤵
  PID:9536
- C:\Windows\System\wtplluc.exe
  C:\Windows\System\wtplluc.exe
  2⤵
  PID:9560
- C:\Windows\System\QVDWenV.exe
  C:\Windows\System\QVDWenV.exe
  2⤵
  PID:9580
- C:\Windows\System\XsJwlwj.exe
  C:\Windows\System\XsJwlwj.exe
  2⤵
  PID:9596
- C:\Windows\System\aJFAMtM.exe
  C:\Windows\System\aJFAMtM.exe
  2⤵
  PID:9616
- C:\Windows\System\JzjtXlp.exe
  C:\Windows\System\JzjtXlp.exe
  2⤵
  PID:9636
- C:\Windows\System\LSMOZMf.exe
  C:\Windows\System\LSMOZMf.exe
  2⤵
  PID:9652
- C:\Windows\System\dvkdvci.exe
  C:\Windows\System\dvkdvci.exe
  2⤵
  PID:9668
- C:\Windows\System\zrrQrzI.exe
  C:\Windows\System\zrrQrzI.exe
  2⤵
  PID:9692
- C:\Windows\System\iBYAyPL.exe
  C:\Windows\System\iBYAyPL.exe
  2⤵
  PID:9716
- C:\Windows\System\tKFhDMp.exe
  C:\Windows\System\tKFhDMp.exe
  2⤵
  PID:9732
- C:\Windows\System\soJSJOq.exe
  C:\Windows\System\soJSJOq.exe
  2⤵
  PID:9752
- C:\Windows\System\QyPNiTk.exe
  C:\Windows\System\QyPNiTk.exe
  2⤵
  PID:9772
- C:\Windows\System\SxauOOV.exe
  C:\Windows\System\SxauOOV.exe
  2⤵
  PID:9788
- C:\Windows\System\cWUkJFr.exe
  C:\Windows\System\cWUkJFr.exe
  2⤵
  PID:9812
- C:\Windows\System\XytLhhY.exe
  C:\Windows\System\XytLhhY.exe
  2⤵
  PID:9828
- C:\Windows\System\ZrcEqQr.exe
  C:\Windows\System\ZrcEqQr.exe
  2⤵
  PID:9852
- C:\Windows\System\DwdFwEc.exe
  C:\Windows\System\DwdFwEc.exe
  2⤵
  PID:9868
- C:\Windows\System\JWBfrbO.exe
  C:\Windows\System\JWBfrbO.exe
  2⤵
  PID:9888
- C:\Windows\System\JPeExJp.exe
  C:\Windows\System\JPeExJp.exe
  2⤵
  PID:9904
- C:\Windows\System\wTygzPt.exe
  C:\Windows\System\wTygzPt.exe
  2⤵
  PID:9928
- C:\Windows\System\kyBPyPg.exe
  C:\Windows\System\kyBPyPg.exe
  2⤵
  PID:9944
- C:\Windows\System\nCHfSxa.exe
  C:\Windows\System\nCHfSxa.exe
  2⤵
  PID:9964
- C:\Windows\System\TJIxGZd.exe
  C:\Windows\System\TJIxGZd.exe
  2⤵
  PID:9984
- C:\Windows\System\MXQFXhW.exe
  C:\Windows\System\MXQFXhW.exe
  2⤵
  PID:10016
- C:\Windows\System\aCvPVKH.exe
  C:\Windows\System\aCvPVKH.exe
  2⤵
  PID:10040
- C:\Windows\System\BkTHGFX.exe
  C:\Windows\System\BkTHGFX.exe
  2⤵
  PID:10056
- C:\Windows\System\xcOSJIM.exe
  C:\Windows\System\xcOSJIM.exe
  2⤵
  PID:10076
- C:\Windows\System\WgJsbjm.exe
  C:\Windows\System\WgJsbjm.exe
  2⤵
  PID:10096
- C:\Windows\System\xZkufPl.exe
  C:\Windows\System\xZkufPl.exe
  2⤵
  PID:10112
- C:\Windows\System\FcMlLVG.exe
  C:\Windows\System\FcMlLVG.exe
  2⤵
  PID:10128
- C:\Windows\System\LfdGRDg.exe
  C:\Windows\System\LfdGRDg.exe
  2⤵
  PID:10144
- C:\Windows\System\HBFUEVu.exe
  C:\Windows\System\HBFUEVu.exe
  2⤵
  PID:10164
- C:\Windows\System\zqfMvqT.exe
  C:\Windows\System\zqfMvqT.exe
  2⤵
  PID:10184
- C:\Windows\System\VMqzkzq.exe
  C:\Windows\System\VMqzkzq.exe
  2⤵
  PID:10204
- C:\Windows\System\VvOSXEZ.exe
  C:\Windows\System\VvOSXEZ.exe
  2⤵
  PID:10224
- C:\Windows\System\FmleOkm.exe
  C:\Windows\System\FmleOkm.exe
  2⤵
  PID:8296
- C:\Windows\System\WEOOdul.exe
  C:\Windows\System\WEOOdul.exe
  2⤵
  PID:8860
- C:\Windows\System\QFDZimR.exe
  C:\Windows\System\QFDZimR.exe
  2⤵
  PID:9004
- C:\Windows\System\qCsQFNV.exe
  C:\Windows\System\qCsQFNV.exe
  2⤵
  PID:8924
- C:\Windows\System\soNfNPh.exe
  C:\Windows\System\soNfNPh.exe
  2⤵
  PID:9240
- C:\Windows\System\pvUHaLH.exe
  C:\Windows\System\pvUHaLH.exe
  2⤵
  PID:8844
- C:\Windows\System\WmrorQc.exe
  C:\Windows\System\WmrorQc.exe
  2⤵
  PID:9320
- C:\Windows\System\MwltlFx.exe
  C:\Windows\System\MwltlFx.exe
  2⤵
  PID:9348
- C:\Windows\System\bdXrmLd.exe
  C:\Windows\System\bdXrmLd.exe
  2⤵
  PID:7672
- C:\Windows\System\kGXzBRN.exe
  C:\Windows\System\kGXzBRN.exe
  2⤵
  PID:9232
- C:\Windows\System\lVqRhAe.exe
  C:\Windows\System\lVqRhAe.exe
  2⤵
  PID:9508
- C:\Windows\System\yfmToay.exe
  C:\Windows\System\yfmToay.exe
  2⤵
  PID:7488
- C:\Windows\System\qzCvUwF.exe
  C:\Windows\System\qzCvUwF.exe
  2⤵
  PID:10088
- C:\Windows\System\aEBxUaL.exe
  C:\Windows\System\aEBxUaL.exe
  2⤵
  PID:10136
- C:\Windows\System\erQmxgs.exe
  C:\Windows\System\erQmxgs.exe
  2⤵
  PID:9144
- C:\Windows\System\yRORhap.exe
  C:\Windows\System\yRORhap.exe
  2⤵
  PID:9280
- C:\Windows\System\OaAytCX.exe
  C:\Windows\System\OaAytCX.exe
  2⤵
  PID:9352
- C:\Windows\System\cfvlpWZ.exe
  C:\Windows\System\cfvlpWZ.exe
  2⤵
  PID:9444
- C:\Windows\System\wizjKGj.exe
  C:\Windows\System\wizjKGj.exe
  2⤵
  PID:9992
- C:\Windows\System\IDPxMjh.exe
  C:\Windows\System\IDPxMjh.exe
  2⤵
  PID:10388
- C:\Windows\System\SGGejRw.exe
  C:\Windows\System\SGGejRw.exe
  2⤵
  PID:10408
- C:\Windows\System\FFmbLCH.exe
  C:\Windows\System\FFmbLCH.exe
  2⤵
  PID:10428
- C:\Windows\System\apcluoq.exe
  C:\Windows\System\apcluoq.exe
  2⤵
  PID:10444
- C:\Windows\System\gdddGEw.exe
  C:\Windows\System\gdddGEw.exe
  2⤵
  PID:10468
- C:\Windows\System\bAmXAKN.exe
  C:\Windows\System\bAmXAKN.exe
  2⤵
  PID:10484
- C:\Windows\System\pnvgqlY.exe
  C:\Windows\System\pnvgqlY.exe
  2⤵
  PID:10508
- C:\Windows\System\jLRWQnQ.exe
  C:\Windows\System\jLRWQnQ.exe
  2⤵
  PID:10532
- C:\Windows\System\AaTYJRJ.exe
  C:\Windows\System\AaTYJRJ.exe
  2⤵
  PID:10552
- C:\Windows\System\jZegELt.exe
  C:\Windows\System\jZegELt.exe
  2⤵
  PID:10576
- C:\Windows\System\luGHGHi.exe
  C:\Windows\System\luGHGHi.exe
  2⤵
  PID:10596
- C:\Windows\System\KYvDIDM.exe
  C:\Windows\System\KYvDIDM.exe
  2⤵
  PID:10616
- C:\Windows\System\UeJJAYK.exe
  C:\Windows\System\UeJJAYK.exe
  2⤵
  PID:10644
- C:\Windows\System\kYfKYcR.exe
  C:\Windows\System\kYfKYcR.exe
  2⤵
  PID:10664
- C:\Windows\System\xJdCARc.exe
  C:\Windows\System\xJdCARc.exe
  2⤵
  PID:10716
- C:\Windows\System\LCWHclj.exe
  C:\Windows\System\LCWHclj.exe
  2⤵
  PID:10736
- C:\Windows\System\iGqRmbJ.exe
  C:\Windows\System\iGqRmbJ.exe
  2⤵
  PID:10756
- C:\Windows\System\emSoPAk.exe
  C:\Windows\System\emSoPAk.exe
  2⤵
  PID:10772
- C:\Windows\System\Usftbkn.exe
  C:\Windows\System\Usftbkn.exe
  2⤵
  PID:10796
- C:\Windows\System\nnDIhhD.exe
  C:\Windows\System\nnDIhhD.exe
  2⤵
  PID:10824
- C:\Windows\System\FccUbah.exe
  C:\Windows\System\FccUbah.exe
  2⤵
  PID:10840
- C:\Windows\System\zcafNgT.exe
  C:\Windows\System\zcafNgT.exe
  2⤵
  PID:10864
- C:\Windows\System\NxacZuY.exe
  C:\Windows\System\NxacZuY.exe
  2⤵
  PID:10880
- C:\Windows\System\TwYHecy.exe
  C:\Windows\System\TwYHecy.exe
  2⤵
  PID:10900
- C:\Windows\System\EPUZYrE.exe
  C:\Windows\System\EPUZYrE.exe
  2⤵
  PID:10920
- C:\Windows\System\VsIhHCm.exe
  C:\Windows\System\VsIhHCm.exe
  2⤵
  PID:10940
- C:\Windows\System\xRQhUuG.exe
  C:\Windows\System\xRQhUuG.exe
  2⤵
  PID:10960
- C:\Windows\System\pcvBTYw.exe
  C:\Windows\System\pcvBTYw.exe
  2⤵
  PID:10976
- C:\Windows\System\DIUyzdR.exe
  C:\Windows\System\DIUyzdR.exe
  2⤵
  PID:11000
- C:\Windows\System\XLioLkI.exe
  C:\Windows\System\XLioLkI.exe
  2⤵
  PID:11020
- C:\Windows\System\jGIfAFP.exe
  C:\Windows\System\jGIfAFP.exe
  2⤵
  PID:11040
- C:\Windows\System\suVxlLQ.exe
  C:\Windows\System\suVxlLQ.exe
  2⤵
  PID:11060
- C:\Windows\System\XkjGjMD.exe
  C:\Windows\System\XkjGjMD.exe
  2⤵
  PID:9688
- C:\Windows\System\kfoDcQJ.exe
  C:\Windows\System\kfoDcQJ.exe
  2⤵
  PID:9724
- C:\Windows\System\hSNWhlC.exe
  C:\Windows\System\hSNWhlC.exe
  2⤵
  PID:9800
- C:\Windows\System\NnRyNZv.exe
  C:\Windows\System\NnRyNZv.exe
  2⤵
  PID:9820
- C:\Windows\System\FqOHlHT.exe
  C:\Windows\System\FqOHlHT.exe
  2⤵
  PID:6328
- C:\Windows\System\vkwOLqs.exe
  C:\Windows\System\vkwOLqs.exe
  2⤵
  PID:9764
- C:\Windows\System\NAGUhfZ.exe
  C:\Windows\System\NAGUhfZ.exe
  2⤵
  PID:10172
- C:\Windows\System\USLUfIG.exe
  C:\Windows\System\USLUfIG.exe
  2⤵
  PID:8072
- C:\Windows\System\haUoAhH.exe
  C:\Windows\System\haUoAhH.exe
  2⤵
  PID:9252
- C:\Windows\System\vpHNXht.exe
  C:\Windows\System\vpHNXht.exe
  2⤵
  PID:9316
- C:\Windows\System\iuqvHfk.exe
  C:\Windows\System\iuqvHfk.exe
  2⤵
  PID:8480
- C:\Windows\System\uMzwOly.exe
  C:\Windows\System\uMzwOly.exe
  2⤵
  PID:9848
- C:\Windows\System\EmliltQ.exe
  C:\Windows\System\EmliltQ.exe
  2⤵
  PID:10460
- C:\Windows\System\bCDTjlo.exe
  C:\Windows\System\bCDTjlo.exe
  2⤵
  PID:10516
- C:\Windows\System\fIdoLij.exe
  C:\Windows\System\fIdoLij.exe
  2⤵
  PID:10280
- C:\Windows\System\MHSSKan.exe
  C:\Windows\System\MHSSKan.exe
  2⤵
  PID:10764
- C:\Windows\System\yiesFCJ.exe
  C:\Windows\System\yiesFCJ.exe
  2⤵
  PID:10804
- C:\Windows\System\ZvPuVux.exe
  C:\Windows\System\ZvPuVux.exe
  2⤵
  PID:10852
- C:\Windows\System\HLTUEOc.exe
  C:\Windows\System\HLTUEOc.exe
  2⤵
  PID:10892
- C:\Windows\System\qroNrtB.exe
  C:\Windows\System\qroNrtB.exe
  2⤵
  PID:10928
- C:\Windows\System\tLBXsky.exe
  C:\Windows\System\tLBXsky.exe
  2⤵
  PID:10124
- C:\Windows\System\MWQWgfn.exe
  C:\Windows\System\MWQWgfn.exe
  2⤵
  PID:9336
- C:\Windows\System\huiofOs.exe
  C:\Windows\System\huiofOs.exe
  2⤵
  PID:10436
- C:\Windows\System\iwhaCod.exe
  C:\Windows\System\iwhaCod.exe
  2⤵
  PID:11128
- C:\Windows\System\wGfbhQS.exe
  C:\Windows\System\wGfbhQS.exe
  2⤵
  PID:10672
- C:\Windows\System\zbYJbVK.exe
  C:\Windows\System\zbYJbVK.exe
  2⤵
  PID:11048
- C:\Windows\System\VxOLfgc.exe
  C:\Windows\System\VxOLfgc.exe
  2⤵
  PID:10372
- C:\Windows\System\ujtoZHP.exe
  C:\Windows\System\ujtoZHP.exe
  2⤵
  PID:10604
- C:\Windows\System\KWAmybV.exe
  C:\Windows\System\KWAmybV.exe
  2⤵
  PID:11276
- C:\Windows\System\mLZuBpv.exe
  C:\Windows\System\mLZuBpv.exe
  2⤵
  PID:11296
- C:\Windows\System\nRLidgj.exe
  C:\Windows\System\nRLidgj.exe
  2⤵
  PID:11312
- C:\Windows\System\FQFOjon.exe
  C:\Windows\System\FQFOjon.exe
  2⤵
  PID:11328
- C:\Windows\System\LXSymIM.exe
  C:\Windows\System\LXSymIM.exe
  2⤵
  PID:11344
- C:\Windows\System\arhAnuP.exe
  C:\Windows\System\arhAnuP.exe
  2⤵
  PID:11360
- C:\Windows\System\reAKYwG.exe
  C:\Windows\System\reAKYwG.exe
  2⤵
  PID:11380
- C:\Windows\System\cMtubMO.exe
  C:\Windows\System\cMtubMO.exe
  2⤵
  PID:11396
- C:\Windows\System\QJKYDCZ.exe
  C:\Windows\System\QJKYDCZ.exe
  2⤵
  PID:11412
- C:\Windows\System\tYXqeWy.exe
  C:\Windows\System\tYXqeWy.exe
  2⤵
  PID:11432
- C:\Windows\System\TuBJgGB.exe
  C:\Windows\System\TuBJgGB.exe
  2⤵
  PID:11452
- C:\Windows\System\AKPkDvN.exe
  C:\Windows\System\AKPkDvN.exe
  2⤵
  PID:11472
- C:\Windows\System\LgsPWfj.exe
  C:\Windows\System\LgsPWfj.exe
  2⤵
  PID:11488
- C:\Windows\System\bfVthfK.exe
  C:\Windows\System\bfVthfK.exe
  2⤵
  PID:11512
- C:\Windows\System\SCHRlod.exe
  C:\Windows\System\SCHRlod.exe
  2⤵
  PID:11536
- C:\Windows\System\OlMLfxN.exe
  C:\Windows\System\OlMLfxN.exe
  2⤵
  PID:11556
- C:\Windows\System\OyjkGHp.exe
  C:\Windows\System\OyjkGHp.exe
  2⤵
  PID:11576
- C:\Windows\System\GsVPtnk.exe
  C:\Windows\System\GsVPtnk.exe
  2⤵
  PID:11592
- C:\Windows\System\agdwTQk.exe
  C:\Windows\System\agdwTQk.exe
  2⤵
  PID:11616
- C:\Windows\System\LGSBSNT.exe
  C:\Windows\System\LGSBSNT.exe
  2⤵
  PID:11640
- C:\Windows\System\WUEZvrd.exe
  C:\Windows\System\WUEZvrd.exe
  2⤵
  PID:11660
- C:\Windows\System\FdEJysF.exe
  C:\Windows\System\FdEJysF.exe
  2⤵
  PID:11684
- C:\Windows\System\ReedOie.exe
  C:\Windows\System\ReedOie.exe
  2⤵
  PID:11700
- C:\Windows\System\UqmEguP.exe
  C:\Windows\System\UqmEguP.exe
  2⤵
  PID:11724
- C:\Windows\System\SxsLkxg.exe
  C:\Windows\System\SxsLkxg.exe
  2⤵
  PID:11748
- C:\Windows\System\BJREixJ.exe
  C:\Windows\System\BJREixJ.exe
  2⤵
  PID:11772
- C:\Windows\System\BJcjzZg.exe
  C:\Windows\System\BJcjzZg.exe
  2⤵
  PID:11796
- C:\Windows\System\qomPWxR.exe
  C:\Windows\System\qomPWxR.exe
  2⤵
  PID:11812
- C:\Windows\System\ntrqnuj.exe
  C:\Windows\System\ntrqnuj.exe
  2⤵
  PID:11836
- C:\Windows\System\naHzIns.exe
  C:\Windows\System\naHzIns.exe
  2⤵
  PID:11864
- C:\Windows\System\NlUEBQL.exe
  C:\Windows\System\NlUEBQL.exe
  2⤵
  PID:11888
- C:\Windows\System\kpwqLVd.exe
  C:\Windows\System\kpwqLVd.exe
  2⤵
  PID:11912
- C:\Windows\System\dbZxEYN.exe
  C:\Windows\System\dbZxEYN.exe
  2⤵
  PID:11936
- C:\Windows\System\qtXovFc.exe
  C:\Windows\System\qtXovFc.exe
  2⤵
  PID:12212
- C:\Windows\System\wLtZNXv.exe
  C:\Windows\System\wLtZNXv.exe
  2⤵
  PID:12236
- C:\Windows\System\SGUoDQC.exe
  C:\Windows\System\SGUoDQC.exe
  2⤵
  PID:12252
- C:\Windows\System\WtWiJTA.exe
  C:\Windows\System\WtWiJTA.exe
  2⤵
  PID:12272
- C:\Windows\System\ugubEax.exe
  C:\Windows\System\ugubEax.exe
  2⤵
  PID:10608
- C:\Windows\System\DRzKzlG.exe
  C:\Windows\System\DRzKzlG.exe
  2⤵
  PID:8528
- C:\Windows\System\blQFEWK.exe
  C:\Windows\System\blQFEWK.exe
  2⤵
  PID:10680
- C:\Windows\System\WCgCfEa.exe
  C:\Windows\System\WCgCfEa.exe
  2⤵
  PID:10992
- C:\Windows\System\HLTbrqs.exe
  C:\Windows\System\HLTbrqs.exe
  2⤵
  PID:11012
- C:\Windows\System\WoXcaNW.exe
  C:\Windows\System\WoXcaNW.exe
  2⤵
  PID:11188
- C:\Windows\System\YswMmRf.exe
  C:\Windows\System\YswMmRf.exe
  2⤵
  PID:11208
- C:\Windows\System\OQvxkjl.exe
  C:\Windows\System\OQvxkjl.exe
  2⤵
  PID:11256
- C:\Windows\System\UZHPCpc.exe
  C:\Windows\System\UZHPCpc.exe
  2⤵
  PID:11100
- C:\Windows\System\ZVuXgZv.exe
  C:\Windows\System\ZVuXgZv.exe
  2⤵
  PID:11464
- C:\Windows\System\uGDEyFs.exe
  C:\Windows\System\uGDEyFs.exe
  2⤵
  PID:11744
- C:\Windows\System\hhaQzxL.exe
  C:\Windows\System\hhaQzxL.exe
  2⤵
  PID:11884
- C:\Windows\System\xoJMpGk.exe
  C:\Windows\System\xoJMpGk.exe
  2⤵
  PID:9556
- C:\Windows\System\ghJfooE.exe
  C:\Windows\System\ghJfooE.exe
  2⤵
  PID:7544
- C:\Windows\System\VqHFSCZ.exe
  C:\Windows\System\VqHFSCZ.exe
  2⤵
  PID:9092
- C:\Windows\System\KCIXroa.exe
  C:\Windows\System\KCIXroa.exe
  2⤵
  PID:10640
- C:\Windows\System\LvUeAju.exe
  C:\Windows\System\LvUeAju.exe
  2⤵
  PID:10872
- C:\Windows\System\MeCcLWI.exe
  C:\Windows\System\MeCcLWI.exe
  2⤵
  PID:10916
- C:\Windows\System\UVImNDw.exe
  C:\Windows\System\UVImNDw.exe
  2⤵
  PID:9844
- C:\Windows\System\DeGIHiz.exe
  C:\Windows\System\DeGIHiz.exe
  2⤵
  PID:9644
- C:\Windows\System\vOFBzYc.exe
  C:\Windows\System\vOFBzYc.exe
  2⤵
  PID:11268
- C:\Windows\System\wbfWZyk.exe
  C:\Windows\System\wbfWZyk.exe
  2⤵
  PID:12300
- C:\Windows\System\UozlafQ.exe
  C:\Windows\System\UozlafQ.exe
  2⤵
  PID:12316
- C:\Windows\System\dIUSDgw.exe
  C:\Windows\System\dIUSDgw.exe
  2⤵
  PID:12332
- C:\Windows\System\pXvURhy.exe
  C:\Windows\System\pXvURhy.exe
  2⤵
  PID:12348
- C:\Windows\System\HMMkyPj.exe
  C:\Windows\System\HMMkyPj.exe
  2⤵
  PID:12364
- C:\Windows\System\JxPdSXZ.exe
  C:\Windows\System\JxPdSXZ.exe
  2⤵
  PID:12380
- C:\Windows\System\ntswDfl.exe
  C:\Windows\System\ntswDfl.exe
  2⤵
  PID:12404
- C:\Windows\System\ovCeyVk.exe
  C:\Windows\System\ovCeyVk.exe
  2⤵
  PID:12424
- C:\Windows\System\EUxJEJB.exe
  C:\Windows\System\EUxJEJB.exe
  2⤵
  PID:12444
- C:\Windows\System\YfaeSUv.exe
  C:\Windows\System\YfaeSUv.exe
  2⤵
  PID:12468
- C:\Windows\System\OmVCsmN.exe
  C:\Windows\System\OmVCsmN.exe
  2⤵
  PID:12488
- C:\Windows\System\mQGvrAL.exe
  C:\Windows\System\mQGvrAL.exe
  2⤵
  PID:12516
- C:\Windows\System\tTeFTCA.exe
  C:\Windows\System\tTeFTCA.exe
  2⤵
  PID:12536
- C:\Windows\System\oJVLMNr.exe
  C:\Windows\System\oJVLMNr.exe
  2⤵
  PID:12552
- C:\Windows\System\lvyzIre.exe
  C:\Windows\System\lvyzIre.exe
  2⤵
  PID:12568
- C:\Windows\System\TGotKWN.exe
  C:\Windows\System\TGotKWN.exe
  2⤵
  PID:12596
- C:\Windows\System\GGVHNqV.exe
  C:\Windows\System\GGVHNqV.exe
  2⤵
  PID:12620
- C:\Windows\System\flyLCml.exe
  C:\Windows\System\flyLCml.exe
  2⤵
  PID:12636
- C:\Windows\System\udpWARA.exe
  C:\Windows\System\udpWARA.exe
  2⤵
  PID:12656
- C:\Windows\System\pirkRKT.exe
  C:\Windows\System\pirkRKT.exe
  2⤵
  PID:12680
- C:\Windows\System\astCFqr.exe
  C:\Windows\System\astCFqr.exe
  2⤵
  PID:12712
- C:\Windows\System\CZNLPGk.exe
  C:\Windows\System\CZNLPGk.exe
  2⤵
  PID:12732
- C:\Windows\System\NNchMIs.exe
  C:\Windows\System\NNchMIs.exe
  2⤵
  PID:12752
- C:\Windows\System\zcTTXfR.exe
  C:\Windows\System\zcTTXfR.exe
  2⤵
  PID:12772
- C:\Windows\System\ATSVmNQ.exe
  C:\Windows\System\ATSVmNQ.exe
  2⤵
  PID:12788
- C:\Windows\System\JzxNPAb.exe
  C:\Windows\System\JzxNPAb.exe
  2⤵
  PID:12808
- C:\Windows\System\hoGAVnA.exe
  C:\Windows\System\hoGAVnA.exe
  2⤵
  PID:12824
- C:\Windows\System\uWzxBLF.exe
  C:\Windows\System\uWzxBLF.exe
  2⤵
  PID:12844
- C:\Windows\System\OCNZukr.exe
  C:\Windows\System\OCNZukr.exe
  2⤵
  PID:12860
- C:\Windows\System\gQYmgAh.exe
  C:\Windows\System\gQYmgAh.exe
  2⤵
  PID:12876
- C:\Windows\System\hnzFYPX.exe
  C:\Windows\System\hnzFYPX.exe
  2⤵
  PID:12896
- C:\Windows\System\uoIFAut.exe
  C:\Windows\System\uoIFAut.exe
  2⤵
  PID:12912
- C:\Windows\System\DHsgdib.exe
  C:\Windows\System\DHsgdib.exe
  2⤵
  PID:12932
- C:\Windows\System\LcexZaR.exe
  C:\Windows\System\LcexZaR.exe
  2⤵
  PID:12948
- C:\Windows\System\CvKTwdU.exe
  C:\Windows\System\CvKTwdU.exe
  2⤵
  PID:12964
- C:\Windows\System\GhwPwWD.exe
  C:\Windows\System\GhwPwWD.exe
  2⤵
  PID:12980
- C:\Windows\System\FcfnjHl.exe
  C:\Windows\System\FcfnjHl.exe
  2⤵
  PID:12996
- C:\Windows\System\fUuvkXn.exe
  C:\Windows\System\fUuvkXn.exe
  2⤵
  PID:13012
- C:\Windows\System\RSYqUZp.exe
  C:\Windows\System\RSYqUZp.exe
  2⤵
  PID:13028
- C:\Windows\System\IfosdLb.exe
  C:\Windows\System\IfosdLb.exe
  2⤵
  PID:13044
- C:\Windows\System\pkkZubn.exe
  C:\Windows\System\pkkZubn.exe
  2⤵
  PID:13064
- C:\Windows\System\JvidIEs.exe
  C:\Windows\System\JvidIEs.exe
  2⤵
  PID:13080
- C:\Windows\System\LhNSAgu.exe
  C:\Windows\System\LhNSAgu.exe
  2⤵
  PID:13096
- C:\Windows\System\FaTNYSd.exe
  C:\Windows\System\FaTNYSd.exe
  2⤵
  PID:13116
- C:\Windows\System\cLtgaFU.exe
  C:\Windows\System\cLtgaFU.exe
  2⤵
  PID:13132
- C:\Windows\System\ZaSYEfC.exe
  C:\Windows\System\ZaSYEfC.exe
  2⤵
  PID:13152
- C:\Windows\System\rNMbpAx.exe
  C:\Windows\System\rNMbpAx.exe
  2⤵
  PID:13172
- C:\Windows\System\ClSUlbi.exe
  C:\Windows\System\ClSUlbi.exe
  2⤵
  PID:13196
- C:\Windows\System\HcSgQui.exe
  C:\Windows\System\HcSgQui.exe
  2⤵
  PID:12180
- C:\Windows\System\IsZNwns.exe
  C:\Windows\System\IsZNwns.exe
  2⤵
  PID:12200
- C:\Windows\System\JIpAOjn.exe
  C:\Windows\System\JIpAOjn.exe
  2⤵
  PID:12260
- C:\Windows\System\FrhpCmW.exe
  C:\Windows\System\FrhpCmW.exe
  2⤵
  PID:13300
- C:\Windows\System\NoYwYyj.exe
  C:\Windows\System\NoYwYyj.exe
  2⤵
  PID:12672
- C:\Windows\System\lBWKPdk.exe
  C:\Windows\System\lBWKPdk.exe
  2⤵
  PID:9920
- C:\Windows\System\OyMRcZU.exe
  C:\Windows\System\OyMRcZU.exe
  2⤵
  PID:11420
- C:\Windows\System\rDvYkiy.exe
  C:\Windows\System\rDvYkiy.exe
  2⤵
  PID:10320
- C:\Windows\System\xvrUvAc.exe
  C:\Windows\System\xvrUvAc.exe
  2⤵
  PID:13268
- C:\Windows\System\FZvqoZf.exe
  C:\Windows\System\FZvqoZf.exe
  2⤵
  PID:13040
- C:\Windows\System\fakKTSO.exe
  C:\Windows\System\fakKTSO.exe
  2⤵
  PID:9916
- C:\Windows\System\eetDGgI.exe
  C:\Windows\System\eetDGgI.exe
  2⤵
  PID:10748
- C:\Windows\System\OTBtpZX.exe
  C:\Windows\System\OTBtpZX.exe
  2⤵
  PID:3788
- C:\Windows\System\DNfOuos.exe
  C:\Windows\System\DNfOuos.exe
  2⤵
  PID:7928
- C:\Windows\System\xjtetkP.exe
  C:\Windows\System\xjtetkP.exe
  2⤵
  PID:9660
- C:\Windows\System\iwJuVeO.exe
  C:\Windows\System\iwJuVeO.exe
  2⤵
  PID:12872
- C:\Windows\System\ACtRnnF.exe
  C:\Windows\System\ACtRnnF.exe
  2⤵
  PID:11720
- C:\Windows\System\HrgfmBZ.exe
  C:\Windows\System\HrgfmBZ.exe
  2⤵
  PID:13052
- C:\Windows\System\BLAFmAq.exe
  C:\Windows\System\BLAFmAq.exe
  2⤵
  PID:13128
- C:\Windows\System\AauvPcp.exe
  C:\Windows\System\AauvPcp.exe
  2⤵
  PID:11228
- C:\Windows\System\bTdDsPJ.exe
  C:\Windows\System\bTdDsPJ.exe
  2⤵
  PID:10912
- C:\Windows\System\ZLQQdTY.exe
  C:\Windows\System\ZLQQdTY.exe
  2⤵
  PID:9836
- C:\Windows\System\SBYiLME.exe
  C:\Windows\System\SBYiLME.exe
  2⤵
  PID:10440
- C:\Windows\System\FDNVDYP.exe
  C:\Windows\System\FDNVDYP.exe
  2⤵
  PID:11068
- C:\Windows\System\wlLdUzl.exe
  C:\Windows\System\wlLdUzl.exe
  2⤵
  PID:7516
- C:\Windows\System\GawBRYI.exe
  C:\Windows\System\GawBRYI.exe
  2⤵
  PID:10364
- C:\Windows\System\GXaDBRB.exe
  C:\Windows\System\GXaDBRB.exe
  2⤵
  PID:11520
- C:\Windows\System\lWuMpAS.exe
  C:\Windows\System\lWuMpAS.exe
  2⤵
  PID:12340
- C:\Windows\System\MDjNchU.exe
  C:\Windows\System\MDjNchU.exe
  2⤵
  PID:11656
- C:\Windows\System\PQOTfFb.exe
  C:\Windows\System\PQOTfFb.exe
  2⤵
  PID:11628
- C:\Windows\System\rayntfB.exe
  C:\Windows\System\rayntfB.exe
  2⤵
  PID:10072
- C:\Windows\System\rwfwFoE.exe
  C:\Windows\System\rwfwFoE.exe
  2⤵
  PID:12204
- C:\Windows\System\gGLlVUu.exe
  C:\Windows\System\gGLlVUu.exe
  2⤵
  PID:12060
- C:\Windows\System\ybybYHl.exe
  C:\Windows\System\ybybYHl.exe
  2⤵
  PID:12232
- C:\Windows\System\gMUNOKn.exe
  C:\Windows\System\gMUNOKn.exe
  2⤵
  PID:2148
- C:\Windows\System\yekBXkp.exe
  C:\Windows\System\yekBXkp.exe
  2⤵
  PID:13284
- C:\Windows\System\vSbLLpK.exe
  C:\Windows\System\vSbLLpK.exe
  2⤵
  PID:11548
- C:\Windows\System\NUBAAbX.exe
  C:\Windows\System\NUBAAbX.exe
  2⤵
  PID:3980
- C:\Windows\System\UjsJRku.exe
  C:\Windows\System\UjsJRku.exe
  2⤵
  PID:10788
- C:\Windows\System\sgBmRAc.exe
  C:\Windows\System\sgBmRAc.exe
  2⤵
  PID:5836
- C:\Windows\System\mXcalnC.exe
  C:\Windows\System\mXcalnC.exe
  2⤵
  PID:13308
- C:\Windows\System\FswFAPl.exe
  C:\Windows\System\FswFAPl.exe
  2⤵
  PID:2744
- C:\Windows\System\SlXAcch.exe
  C:\Windows\System\SlXAcch.exe
  2⤵
  PID:12704
- C:\Windows\System\YlAClaF.exe
  C:\Windows\System\YlAClaF.exe
  2⤵
  PID:3060
- C:\Windows\System\KJSLMSP.exe
  C:\Windows\System\KJSLMSP.exe
  2⤵
  PID:1984
- C:\Windows\System\FrgYpag.exe
  C:\Windows\System\FrgYpag.exe
  2⤵
  PID:5592
- C:\Windows\System\CKrQQdy.exe
  C:\Windows\System\CKrQQdy.exe
  2⤵
  PID:4752
- C:\Windows\System\qJfgaUh.exe
  C:\Windows\System\qJfgaUh.exe
  2⤵
  PID:2284
- C:\Windows\System\TShrSgr.exe
  C:\Windows\System\TShrSgr.exe
  2⤵
  PID:4304
- C:\Windows\System\eCPhUPF.exe
  C:\Windows\System\eCPhUPF.exe
  2⤵
  PID:11768
- C:\Windows\System\ogCpSAr.exe
  C:\Windows\System\ogCpSAr.exe
  2⤵
  PID:5668
- C:\Windows\System\IYkfPuP.exe
  C:\Windows\System\IYkfPuP.exe
  2⤵
  PID:5792
- C:\Windows\System\veNDsZZ.exe
  C:\Windows\System\veNDsZZ.exe
  2⤵
  PID:5176
- C:\Windows\System\UReaqaU.exe
  C:\Windows\System\UReaqaU.exe
  2⤵
  PID:6372
- C:\Windows\System\mGrYsKP.exe
  C:\Windows\System\mGrYsKP.exe
  2⤵
  PID:6476
- C:\Windows\System\NhMmEwc.exe
  C:\Windows\System\NhMmEwc.exe
  2⤵
  PID:6540
- C:\Windows\System\ZHkZekq.exe
  C:\Windows\System\ZHkZekq.exe
  2⤵
  PID:6588
- C:\Windows\System\HmumICp.exe
  C:\Windows\System\HmumICp.exe
  2⤵
  PID:6552
- C:\Windows\System\xbWtJpW.exe
  C:\Windows\System\xbWtJpW.exe
  2⤵
  PID:11352
- C:\Windows\System\DfFLYNB.exe
  C:\Windows\System\DfFLYNB.exe
  2⤵
  PID:2280
- C:\Windows\System\unQBxlv.exe
  C:\Windows\System\unQBxlv.exe
  2⤵
  PID:9440
- C:\Windows\System\qmDhUWc.exe
  C:\Windows\System\qmDhUWc.exe
  2⤵
  PID:4336
- C:\Windows\System\yHwgKmb.exe
  C:\Windows\System\yHwgKmb.exe
  2⤵
  PID:972
- C:\Windows\System\ZHnluOx.exe
  C:\Windows\System\ZHnluOx.exe
  2⤵
  PID:1332
- C:\Windows\System\xUKjzTQ.exe
  C:\Windows\System\xUKjzTQ.exe
  2⤵
  PID:1884
- C:\Windows\System\MJkcNWe.exe
  C:\Windows\System\MJkcNWe.exe
  2⤵
  PID:12892
- C:\Windows\System\HLpjKiZ.exe
  C:\Windows\System\HLpjKiZ.exe
  2⤵
  PID:1832
- C:\Windows\System\Zcgcguc.exe
  C:\Windows\System\Zcgcguc.exe
  2⤵
  PID:3176
- C:\Windows\System\cbsWFJZ.exe
  C:\Windows\System\cbsWFJZ.exe
  2⤵
  PID:2276
- C:\Windows\System\QTquTSI.exe
  C:\Windows\System\QTquTSI.exe
  2⤵
  PID:852
- C:\Windows\System\BdktAmm.exe
  C:\Windows\System\BdktAmm.exe
  2⤵
  PID:11292
- C:\Windows\System\kQCXiNE.exe
  C:\Windows\System\kQCXiNE.exe
  2⤵
  PID:5048
- C:\Windows\System\irnzZDe.exe
  C:\Windows\System\irnzZDe.exe
  2⤵
  PID:13060
- C:\Windows\System\UuwYYAf.exe
  C:\Windows\System\UuwYYAf.exe
  2⤵
  PID:6152
- C:\Windows\System\micvzmE.exe
  C:\Windows\System\micvzmE.exe
  2⤵
  PID:1092
- C:\Windows\System\lRPwJGF.exe
  C:\Windows\System\lRPwJGF.exe
  2⤵
  PID:3500
- C:\Windows\System\xikZaRI.exe
  C:\Windows\System\xikZaRI.exe
  2⤵
  PID:5064
- C:\Windows\System\ygHZAJk.exe
  C:\Windows\System\ygHZAJk.exe
  2⤵
  PID:1900
- C:\Windows\System\GqMalrK.exe
  C:\Windows\System\GqMalrK.exe
  2⤵
  PID:6160
- C:\Windows\System\rNLoVag.exe
  C:\Windows\System\rNLoVag.exe
  2⤵
  PID:6276
- C:\Windows\System\RIxGLft.exe
  C:\Windows\System\RIxGLft.exe
  2⤵
  PID:10624
- C:\Windows\System\Mbiozpf.exe
  C:\Windows\System\Mbiozpf.exe
  2⤵
  PID:3124
- C:\Windows\System\FnqGTqx.exe
  C:\Windows\System\FnqGTqx.exe
  2⤵
  PID:6412
- C:\Windows\System\HIDwkSD.exe
  C:\Windows\System\HIDwkSD.exe
  2⤵
  PID:6364
- C:\Windows\System\HIkyoue.exe
  C:\Windows\System\HIkyoue.exe
  2⤵
  PID:6520
- C:\Windows\System\nGqMwai.exe
  C:\Windows\System\nGqMwai.exe
  2⤵
  PID:11636
- C:\Windows\System\DCCNkUm.exe
  C:\Windows\System\DCCNkUm.exe
  2⤵
  PID:760
- C:\Windows\System\SmCIQcV.exe
  C:\Windows\System\SmCIQcV.exe
  2⤵
  PID:12728
- C:\Windows\System\NyzUqKn.exe
  C:\Windows\System\NyzUqKn.exe
  2⤵
  PID:11928
- C:\Windows\System\QhjjWlv.exe
  C:\Windows\System\QhjjWlv.exe
  2⤵
  PID:3156
- C:\Windows\System\hMsfCoT.exe
  C:\Windows\System\hMsfCoT.exe
  2⤵
  PID:3108
- C:\Windows\System\tVEwxMk.exe
  C:\Windows\System\tVEwxMk.exe
  2⤵
  PID:3008
- C:\Windows\System\HEGFwGQ.exe
  C:\Windows\System\HEGFwGQ.exe
  2⤵
  PID:12112
- C:\Windows\System\LWliXzJ.exe
  C:\Windows\System\LWliXzJ.exe
  2⤵
  PID:4716
- C:\Windows\System\kmtrFiN.exe
  C:\Windows\System\kmtrFiN.exe
  2⤵
  PID:1176
- C:\Windows\System\MztBXXc.exe
  C:\Windows\System\MztBXXc.exe
  2⤵
  PID:13320
- C:\Windows\System\kNZzJRU.exe
  C:\Windows\System\kNZzJRU.exe
  2⤵
  PID:13360
- C:\Windows\System\aFGUDUA.exe
  C:\Windows\System\aFGUDUA.exe
  2⤵
  PID:13376
- C:\Windows\System\pEUjljh.exe
  C:\Windows\System\pEUjljh.exe
  2⤵
  PID:13396
- C:\Windows\System\mPARQKO.exe
  C:\Windows\System\mPARQKO.exe
  2⤵
  PID:13416
- C:\Windows\System\saoVheH.exe
  C:\Windows\System\saoVheH.exe
  2⤵
  PID:14108
- C:\Windows\System\bzAhYhx.exe
  C:\Windows\System\bzAhYhx.exe
  2⤵
  PID:14144
- C:\Windows\System\NsNGTIR.exe
  C:\Windows\System\NsNGTIR.exe
  2⤵
  PID:14172
- C:\Windows\System\lAussEj.exe
  C:\Windows\System\lAussEj.exe
  2⤵
  PID:14232
- C:\Windows\System\bUZdOpi.exe
  C:\Windows\System\bUZdOpi.exe
  2⤵
  PID:14252
- C:\Windows\System\oRTcmrs.exe
  C:\Windows\System\oRTcmrs.exe
  2⤵
  PID:14268
- C:\Windows\System\zJquklt.exe
  C:\Windows\System\zJquklt.exe
  2⤵
  PID:14292
- C:\Windows\System\QNFfvyl.exe
  C:\Windows\System\QNFfvyl.exe
  2⤵
  PID:3776
- C:\Windows\System\dwQKdPl.exe
  C:\Windows\System\dwQKdPl.exe
  2⤵
  PID:4480
- C:\Windows\System\ihplhKe.exe
  C:\Windows\System\ihplhKe.exe
  2⤵
  PID:1304
- C:\Windows\System\VYqhkVr.exe
  C:\Windows\System\VYqhkVr.exe
  2⤵
  PID:3576
- C:\Windows\System\JiwMjSE.exe
  C:\Windows\System\JiwMjSE.exe
  2⤵
  PID:11976
- C:\Windows\System\qFyOcdD.exe
  C:\Windows\System\qFyOcdD.exe
  2⤵
  PID:13348
- C:\Windows\System\GmNgevw.exe
  C:\Windows\System\GmNgevw.exe
  2⤵
  PID:13392
- C:\Windows\System\RZDJLEE.exe
  C:\Windows\System\RZDJLEE.exe
  2⤵
  PID:892
- C:\Windows\System\qeNuGBf.exe
  C:\Windows\System\qeNuGBf.exe
  2⤵
  PID:3112
- C:\Windows\System\hNcjnrH.exe
  C:\Windows\System\hNcjnrH.exe
  2⤵
  PID:4968
- C:\Windows\System\ozFUItF.exe
  C:\Windows\System\ozFUItF.exe
  2⤵
  PID:3504
- C:\Windows\System\XiiQoot.exe
  C:\Windows\System\XiiQoot.exe
  2⤵
  PID:5140
- C:\Windows\System\ncqQKFj.exe
  C:\Windows\System\ncqQKFj.exe
  2⤵
  PID:772
- C:\Windows\System\elRaZZR.exe
  C:\Windows\System\elRaZZR.exe
  2⤵
  PID:13412
- C:\Windows\System\nayGgEs.exe
  C:\Windows\System\nayGgEs.exe
  2⤵
  PID:13452
- C:\Windows\System\TOgtQul.exe
  C:\Windows\System\TOgtQul.exe
  2⤵
  PID:3880
- C:\Windows\System\JlhIpHz.exe
  C:\Windows\System\JlhIpHz.exe
  2⤵
  PID:1508
- C:\Windows\System\IGDJOsN.exe
  C:\Windows\System\IGDJOsN.exe
  2⤵
  PID:1276
- C:\Windows\System\daIOyQy.exe
  C:\Windows\System\daIOyQy.exe
  2⤵
  PID:5252
- C:\Windows\System\TnliYnz.exe
  C:\Windows\System\TnliYnz.exe
  2⤵
  PID:5128
- C:\Windows\System\gVARUCN.exe
  C:\Windows\System\gVARUCN.exe
  2⤵
  PID:13356
- C:\Windows\System\AgrTcXB.exe
  C:\Windows\System\AgrTcXB.exe
  2⤵
  PID:3492
- C:\Windows\System\fvHBPFP.exe
  C:\Windows\System\fvHBPFP.exe
  2⤵
  PID:3816
- C:\Windows\System\sNeCoom.exe
  C:\Windows\System\sNeCoom.exe
  2⤵
  PID:2296
- C:\Windows\System\aKDlUqe.exe
  C:\Windows\System\aKDlUqe.exe
  2⤵
  PID:13488
- C:\Windows\System\kGLLkll.exe
  C:\Windows\System\kGLLkll.exe
  2⤵
  PID:13712
- C:\Windows\System\rPUwqUW.exe
  C:\Windows\System\rPUwqUW.exe
  2⤵
  PID:5492
- C:\Windows\System\KunUNrV.exe
  C:\Windows\System\KunUNrV.exe
  2⤵
  PID:5544
- C:\Windows\System\alXsDnu.exe
  C:\Windows\System\alXsDnu.exe
  2⤵
  PID:13640
- C:\Windows\System\bKlrCpN.exe
  C:\Windows\System\bKlrCpN.exe
  2⤵
  PID:13880
- C:\Windows\System\PYgoncR.exe
  C:\Windows\System\PYgoncR.exe
  2⤵
  PID:13736
- C:\Windows\System\GIxDbwg.exe
  C:\Windows\System\GIxDbwg.exe
  2⤵
  PID:14264
- C:\Windows\System\GPCGnMT.exe
  C:\Windows\System\GPCGnMT.exe
  2⤵
  PID:4768
- C:\Windows\System\FnpuNUS.exe
  C:\Windows\System\FnpuNUS.exe
  2⤵
  PID:5980
- C:\Windows\System\AhDqJoc.exe
  C:\Windows\System\AhDqJoc.exe
  2⤵
  PID:5616
- C:\Windows\System\NlzYPYz.exe
  C:\Windows\System\NlzYPYz.exe
  2⤵
  PID:13500
- C:\Windows\System\AAfRFva.exe
  C:\Windows\System\AAfRFva.exe
  2⤵
  PID:13368
- C:\Windows\System\LrcrJmM.exe
  C:\Windows\System\LrcrJmM.exe
  2⤵
  PID:5076
- C:\Windows\System\VXNKlHk.exe
  C:\Windows\System\VXNKlHk.exe
  2⤵
  PID:5432
- C:\Windows\System\dLFrUIB.exe
  C:\Windows\System\dLFrUIB.exe
  2⤵
  PID:5364
- C:\Windows\System\UGaRNyh.exe
  C:\Windows\System\UGaRNyh.exe
  2⤵
  PID:13468
- C:\Windows\System\udJOXix.exe
  C:\Windows\System\udJOXix.exe
  2⤵
  PID:13984
- C:\Windows\System\LsezPTd.exe
  C:\Windows\System\LsezPTd.exe
  2⤵
  PID:5992
- C:\Windows\System\lSNgqeo.exe
  C:\Windows\System\lSNgqeo.exe
  2⤵
  PID:5440
- C:\Windows\System\kvSlYMe.exe
  C:\Windows\System\kvSlYMe.exe
  2⤵
  PID:5764
- C:\Windows\System\rBXYnGQ.exe
  C:\Windows\System\rBXYnGQ.exe
  2⤵
  PID:6076
- C:\Windows\System\lhrQLXM.exe
  C:\Windows\System\lhrQLXM.exe
  2⤵
  PID:5812
- C:\Windows\System\LFekXyj.exe
  C:\Windows\System\LFekXyj.exe
  2⤵
  PID:3568
- C:\Windows\System\FFytYeC.exe
  C:\Windows\System\FFytYeC.exe
  2⤵
  PID:13568
- C:\Windows\System\oUglcmB.exe
  C:\Windows\System\oUglcmB.exe
  2⤵
  PID:2260
- C:\Windows\System\GTvvaRX.exe
  C:\Windows\System\GTvvaRX.exe
  2⤵
  PID:6816
- C:\Windows\System\tesPIMS.exe
  C:\Windows\System\tesPIMS.exe
  2⤵
  PID:13764
- C:\Windows\System\TevtcOT.exe
  C:\Windows\System\TevtcOT.exe
  2⤵
  PID:14300
- C:\Windows\System\wuaNzsC.exe
  C:\Windows\System\wuaNzsC.exe
  2⤵
  PID:5928
- C:\Windows\System\HKBGNnA.exe
  C:\Windows\System\HKBGNnA.exe
  2⤵
  PID:3392
- C:\Windows\System\OACFcod.exe
  C:\Windows\System\OACFcod.exe
  2⤵
  PID:2172
- C:\Windows\System\bpxvMyE.exe
  C:\Windows\System\bpxvMyE.exe
  2⤵
  PID:4920
- C:\Windows\System\iHbxEcW.exe
  C:\Windows\System\iHbxEcW.exe
  2⤵
  PID:6652
- C:\Windows\System\hplixil.exe
  C:\Windows\System\hplixil.exe
  2⤵
  PID:5660
- C:\Windows\System\pCfclDY.exe
  C:\Windows\System\pCfclDY.exe
  2⤵
  PID:6580
- C:\Windows\System\igkiJTH.exe
  C:\Windows\System\igkiJTH.exe
  2⤵
  PID:5924
- C:\Windows\System\EHDYfYl.exe
  C:\Windows\System\EHDYfYl.exe
  2⤵
  PID:5720
- C:\Windows\System\ePMihbj.exe
  C:\Windows\System\ePMihbj.exe
  2⤵
  PID:6988
- C:\Windows\System\qAlMGiU.exe
  C:\Windows\System\qAlMGiU.exe
  2⤵
  PID:6460
- C:\Windows\System\HpNupOo.exe
  C:\Windows\System\HpNupOo.exe
  2⤵
  PID:5456
- C:\Windows\System\oDgzUYW.exe
  C:\Windows\System\oDgzUYW.exe
  2⤵
  PID:6864
- C:\Windows\System\nXhSJwu.exe
  C:\Windows\System\nXhSJwu.exe
  2⤵
  PID:13844
- C:\Windows\System\fpCpoWs.exe
  C:\Windows\System\fpCpoWs.exe
  2⤵
  PID:5648
- C:\Windows\System\JLwmONb.exe
  C:\Windows\System\JLwmONb.exe
  2⤵
  PID:14088
- C:\Windows\System\pdlbvOK.exe
  C:\Windows\System\pdlbvOK.exe
  2⤵
  PID:6760
- C:\Windows\System\DfQULrI.exe
  C:\Windows\System\DfQULrI.exe
  2⤵
  PID:14244
- C:\Windows\System\qejGHkq.exe
  C:\Windows\System\qejGHkq.exe
  2⤵
  PID:6240
- C:\Windows\System\bwXIhda.exe
  C:\Windows\System\bwXIhda.exe
  2⤵
  PID:3272
- C:\Windows\System\tRwGIas.exe
  C:\Windows\System\tRwGIas.exe
  2⤵
  PID:5612
- C:\Windows\System\ySaHEdm.exe
  C:\Windows\System\ySaHEdm.exe
  2⤵
  PID:6256
- C:\Windows\System\uSLrynM.exe
  C:\Windows\System\uSLrynM.exe
  2⤵
  PID:6876
- C:\Windows\System\iURKQIf.exe
  C:\Windows\System\iURKQIf.exe
  2⤵
  PID:7208
- C:\Windows\System\MrJnGdo.exe
  C:\Windows\System\MrJnGdo.exe
  2⤵
  PID:5512
- C:\Windows\System\xSKDybH.exe
  C:\Windows\System\xSKDybH.exe
  2⤵
  PID:6120
- C:\Windows\System\gITEvPU.exe
  C:\Windows\System\gITEvPU.exe
  2⤵
  PID:5280
- C:\Windows\System\hyRkJPm.exe
  C:\Windows\System\hyRkJPm.exe
  2⤵
  PID:5788
- C:\Windows\System\mwDjGqL.exe
  C:\Windows\System\mwDjGqL.exe
  2⤵
  PID:7492
- C:\Windows\System\IKkCbei.exe
  C:\Windows\System\IKkCbei.exe
  2⤵
  PID:6676
- C:\Windows\System\fkNBgOE.exe
  C:\Windows\System\fkNBgOE.exe
  2⤵
  PID:7016
- C:\Windows\System\iWpfTNs.exe
  C:\Windows\System\iWpfTNs.exe
  2⤵
  PID:6000
- C:\Windows\System\xZebKCi.exe
  C:\Windows\System\xZebKCi.exe
  2⤵
  PID:7524
- C:\Windows\System\rDLgCAd.exe
  C:\Windows\System\rDLgCAd.exe
  2⤵
  PID:8036
- C:\Windows\System\wSkVGPa.exe
  C:\Windows\System\wSkVGPa.exe
  2⤵
  PID:13756
- C:\Windows\System\YPRceVz.exe
  C:\Windows\System\YPRceVz.exe
  2⤵
  PID:7936
- C:\Windows\System\EtUeMLm.exe
  C:\Windows\System\EtUeMLm.exe
  2⤵
  PID:13436
- C:\Windows\System\WJlglmi.exe
  C:\Windows\System\WJlglmi.exe
  2⤵
  PID:7332
- C:\Windows\System\urqXWqX.exe
  C:\Windows\System\urqXWqX.exe
  2⤵
  PID:8176
- C:\Windows\System\ThyuIcX.exe
  C:\Windows\System\ThyuIcX.exe
  2⤵
  PID:6772
- C:\Windows\System\XZUelnk.exe
  C:\Windows\System\XZUelnk.exe
  2⤵
  PID:5972
- C:\Windows\System\VeefdzA.exe
  C:\Windows\System\VeefdzA.exe
  2⤵
  PID:7948
- C:\Windows\System\AUDLBFV.exe
  C:\Windows\System\AUDLBFV.exe
  2⤵
  PID:7096
- C:\Windows\System\PMrZUpi.exe
  C:\Windows\System\PMrZUpi.exe
  2⤵
  PID:7064
- C:\Windows\System\sbxzlEO.exe
  C:\Windows\System\sbxzlEO.exe
  2⤵
  PID:7744
- C:\Windows\System\iPEcpGA.exe
  C:\Windows\System\iPEcpGA.exe
  2⤵
  PID:8148
- C:\Windows\System\HphIzDS.exe
  C:\Windows\System\HphIzDS.exe
  2⤵
  PID:5908
- C:\Windows\System\gXfgGRz.exe
  C:\Windows\System\gXfgGRz.exe
  2⤵
  PID:8372
- C:\Windows\System\RDWffoK.exe
  C:\Windows\System\RDWffoK.exe
  2⤵
  PID:8508
- C:\Windows\System\uGandRY.exe
  C:\Windows\System\uGandRY.exe
  2⤵
  PID:8168
- C:\Windows\System\qITCcPn.exe
  C:\Windows\System\qITCcPn.exe
  2⤵
  PID:5348
- C:\Windows\System\opCJtFW.exe
  C:\Windows\System\opCJtFW.exe
  2⤵
  PID:8700
- C:\Windows\System\gxeBnGx.exe
  C:\Windows\System\gxeBnGx.exe
  2⤵
  PID:6556
- C:\Windows\System\dBEABfs.exe
  C:\Windows\System\dBEABfs.exe
  2⤵
  PID:8120
- C:\Windows\System\oZqYVLr.exe
  C:\Windows\System\oZqYVLr.exe
  2⤵
  PID:8404
- C:\Windows\System\gFYdyZs.exe
  C:\Windows\System\gFYdyZs.exe
  2⤵
  PID:8788
- C:\Windows\System\zVpGsjZ.exe
  C:\Windows\System\zVpGsjZ.exe
  2⤵
  PID:8644
- C:\Windows\System\QJYcvXY.exe
  C:\Windows\System\QJYcvXY.exe
  2⤵
  PID:7132
- C:\Windows\System\OemjyoW.exe
  C:\Windows\System\OemjyoW.exe
  2⤵
  PID:7636
- C:\Windows\System\NxhqdvV.exe
  C:\Windows\System\NxhqdvV.exe
  2⤵
  PID:8416
- C:\Windows\System\zPMBddy.exe
  C:\Windows\System\zPMBddy.exe
  2⤵
  PID:8444
- C:\Windows\System\NJbYSjr.exe
  C:\Windows\System\NJbYSjr.exe
  2⤵
  PID:7856
- C:\Windows\System\jfrGLzB.exe
  C:\Windows\System\jfrGLzB.exe
  2⤵
  PID:7172
- C:\Windows\System\XBzPfLq.exe
  C:\Windows\System\XBzPfLq.exe
  2⤵
  PID:6576
- C:\Windows\System\XueTEeV.exe
  C:\Windows\System\XueTEeV.exe
  2⤵
  PID:7400
- C:\Windows\System\XsGdSBq.exe
  C:\Windows\System\XsGdSBq.exe
  2⤵
  PID:6396
- C:\Windows\System\gtxwNzY.exe
  C:\Windows\System\gtxwNzY.exe
  2⤵
  PID:8420
- C:\Windows\System\UexFjPQ.exe
  C:\Windows\System\UexFjPQ.exe
  2⤵
  PID:7612
- C:\Windows\System\uQiAIza.exe
  C:\Windows\System\uQiAIza.exe
  2⤵
  PID:7012
- C:\Windows\System\WTdKcPu.exe
  C:\Windows\System\WTdKcPu.exe
  2⤵
  PID:13836
- C:\Windows\System\ZqekDuL.exe
  C:\Windows\System\ZqekDuL.exe
  2⤵
  PID:7052
- C:\Windows\System\pFWkIDP.exe
  C:\Windows\System\pFWkIDP.exe
  2⤵
  PID:8144
- C:\Windows\System\lMZsUAR.exe
  C:\Windows\System\lMZsUAR.exe
  2⤵
  PID:8620
- C:\Windows\System\VmOErMV.exe
  C:\Windows\System\VmOErMV.exe
  2⤵
  PID:7920
- C:\Windows\System\vSIbCmh.exe
  C:\Windows\System\vSIbCmh.exe
  2⤵
  PID:7816
- C:\Windows\System\iLkTAcm.exe
  C:\Windows\System\iLkTAcm.exe
  2⤵
  PID:8780
- C:\Windows\System\YXRvgNP.exe
  C:\Windows\System\YXRvgNP.exe
  2⤵
  PID:6308
- C:\Windows\System\VusQwvN.exe
  C:\Windows\System\VusQwvN.exe
  2⤵
  PID:4612
- C:\Windows\System\OQnFHrP.exe
  C:\Windows\System\OQnFHrP.exe
  2⤵
  PID:8560
- C:\Windows\System\vYHxtev.exe
  C:\Windows\System\vYHxtev.exe
  2⤵
  PID:7684
- C:\Windows\System\vOBavWf.exe
  C:\Windows\System\vOBavWf.exe
  2⤵
  PID:2916
- C:\Windows\System\gixeEyh.exe
  C:\Windows\System\gixeEyh.exe
  2⤵
  PID:8772
- C:\Windows\System\oFTtBpL.exe
  C:\Windows\System\oFTtBpL.exe
  2⤵
  PID:6092
- C:\Windows\System\yeCppAP.exe
  C:\Windows\System\yeCppAP.exe
  2⤵
  PID:7568
- C:\Windows\System\tXEtOxv.exe
  C:\Windows\System\tXEtOxv.exe
  2⤵
  PID:8172
- C:\Windows\System\fmXlqRv.exe
  C:\Windows\System\fmXlqRv.exe
  2⤵
  PID:8048
- C:\Windows\System\yJCRWlQ.exe
  C:\Windows\System\yJCRWlQ.exe
  2⤵
  PID:704
- C:\Windows\System\WqIvSSr.exe
  C:\Windows\System\WqIvSSr.exe
  2⤵
  PID:3728
- C:\Windows\System\IuOfXSh.exe
  C:\Windows\System\IuOfXSh.exe
  2⤵
  PID:8344
- C:\Windows\System\PjxCVqK.exe
  C:\Windows\System\PjxCVqK.exe
  2⤵
  PID:7024
- C:\Windows\System\GMakCSA.exe
  C:\Windows\System\GMakCSA.exe
  2⤵
  PID:7600
- C:\Windows\System\xLitnBg.exe
  C:\Windows\System\xLitnBg.exe
  2⤵
  PID:8436
- C:\Windows\System\JzHpoqW.exe
  C:\Windows\System\JzHpoqW.exe
  2⤵
  PID:7512
- C:\Windows\System\ExsHqFJ.exe
  C:\Windows\System\ExsHqFJ.exe
  2⤵
  PID:9108
- C:\Windows\System\TWlUpQi.exe
  C:\Windows\System\TWlUpQi.exe
  2⤵
  PID:6604
- C:\Windows\System\ISIlhRT.exe
  C:\Windows\System\ISIlhRT.exe
  2⤵
  PID:8432
- C:\Windows\System\BdLJllv.exe
  C:\Windows\System\BdLJllv.exe
  2⤵
  PID:7176
- C:\Windows\System\PsgwlLR.exe
  C:\Windows\System\PsgwlLR.exe
  2⤵
  PID:9876
- C:\Windows\System\vciOJXY.exe
  C:\Windows\System\vciOJXY.exe
  2⤵
  PID:9996
- C:\Windows\System\XjZXtXH.exe
  C:\Windows\System\XjZXtXH.exe
  2⤵
  PID:5956
- C:\Windows\System\KoZXDgm.exe
  C:\Windows\System\KoZXDgm.exe
  2⤵
  PID:8312
- C:\Windows\System\FpNqonA.exe
  C:\Windows\System\FpNqonA.exe
  2⤵
  PID:9568
- C:\Windows\System\ibBupdX.exe
  C:\Windows\System\ibBupdX.exe
  2⤵
  PID:9236
- C:\Windows\System\OqAiZNw.exe
  C:\Windows\System\OqAiZNw.exe
  2⤵
  PID:7832
- C:\Windows\System\fliblng.exe
  C:\Windows\System\fliblng.exe
  2⤵
  PID:6944
- C:\Windows\System\HMSqyPO.exe
  C:\Windows\System\HMSqyPO.exe
  2⤵
  PID:9148
- C:\Windows\System\NFFfWsv.exe
  C:\Windows\System\NFFfWsv.exe
  2⤵
  PID:7580
- C:\Windows\System\XKjiZxW.exe
  C:\Windows\System\XKjiZxW.exe
  2⤵
  PID:8704
- C:\Windows\System\zTuOKao.exe
  C:\Windows\System\zTuOKao.exe
  2⤵
  PID:8396
- C:\Windows\System\ZPoutHx.exe
  C:\Windows\System\ZPoutHx.exe
  2⤵
  PID:14016
- C:\Windows\System\ZtIBlHl.exe
  C:\Windows\System\ZtIBlHl.exe
  2⤵
  PID:9804
- C:\Windows\System\ouYXkEi.exe
  C:\Windows\System\ouYXkEi.exe
  2⤵
  PID:9796
- C:\Windows\System\EBflMZJ.exe
  C:\Windows\System\EBflMZJ.exe
  2⤵
  PID:9404
- C:\Windows\System\cEUDnCL.exe
  C:\Windows\System\cEUDnCL.exe
  2⤵
  PID:8308
- C:\Windows\System\eEQlBKH.exe
  C:\Windows\System\eEQlBKH.exe
  2⤵
  PID:8784
- C:\Windows\System\uKkQhfw.exe
  C:\Windows\System\uKkQhfw.exe
  2⤵
  PID:9168
- C:\Windows\System\mcggQzw.exe
  C:\Windows\System\mcggQzw.exe
  2⤵
  PID:13448
- C:\Windows\System\djBAnnV.exe
  C:\Windows\System\djBAnnV.exe
  2⤵
  PID:10368
- C:\Windows\System\kgtJGLF.exe
  C:\Windows\System\kgtJGLF.exe
  2⤵
  PID:8392
- C:\Windows\System\gDDVaHR.exe
  C:\Windows\System\gDDVaHR.exe
  2⤵
  PID:10304
- C:\Windows\System\KKlKawq.exe
  C:\Windows\System\KKlKawq.exe
  2⤵
  PID:9624
- C:\Windows\System\IEmrMhL.exe
  C:\Windows\System\IEmrMhL.exe
  2⤵
  PID:8532
- C:\Windows\System\fxxImnT.exe
  C:\Windows\System\fxxImnT.exe
  2⤵
  PID:10684
- C:\Windows\System\afbyJLy.exe
  C:\Windows\System\afbyJLy.exe
  2⤵
  PID:13252
- C:\Windows\System\FdIxYiP.exe
  C:\Windows\System\FdIxYiP.exe
  2⤵
  PID:10276
- C:\Windows\System\WJVYLww.exe
  C:\Windows\System\WJVYLww.exe
  2⤵
  PID:10000
- C:\Windows\System\ALWezfO.exe
  C:\Windows\System\ALWezfO.exe
  2⤵
  PID:10068
- C:\Windows\System\DPNdcDR.exe
  C:\Windows\System\DPNdcDR.exe
  2⤵
  PID:10416
- C:\Windows\System\EvhMOzI.exe
  C:\Windows\System\EvhMOzI.exe
  2⤵
  PID:7596
- C:\Windows\System\YtrQSZq.exe
  C:\Windows\System\YtrQSZq.exe
  2⤵
  PID:14352
- C:\Windows\System\ZMoAeJo.exe
  C:\Windows\System\ZMoAeJo.exe
  2⤵
  PID:14376
- C:\Windows\System\CtxpWsR.exe
  C:\Windows\System\CtxpWsR.exe
  2⤵
  PID:14396
- C:\Windows\System\PNGROnO.exe
  C:\Windows\System\PNGROnO.exe
  2⤵
  PID:14416
- C:\Windows\System\QuBJvsA.exe
  C:\Windows\System\QuBJvsA.exe
  2⤵
  PID:14440
- C:\Windows\System\ayiVAHB.exe
  C:\Windows\System\ayiVAHB.exe
  2⤵
  PID:14584
- C:\Windows\System\VxdKGtu.exe
  C:\Windows\System\VxdKGtu.exe
  2⤵
  PID:14608
- C:\Windows\System\dYWOZbq.exe
  C:\Windows\System\dYWOZbq.exe
  2⤵
  PID:14644
- C:\Windows\System\dKgnvGH.exe
  C:\Windows\System\dKgnvGH.exe
  2⤵
  PID:14860
- C:\Windows\System\KRtILZH.exe
  C:\Windows\System\KRtILZH.exe
  2⤵
  PID:14876
- C:\Windows\System\fuOkbWx.exe
  C:\Windows\System\fuOkbWx.exe
  2⤵
  PID:14892
- C:\Windows\System\rKHXSvr.exe
  C:\Windows\System\rKHXSvr.exe
  2⤵
  PID:14912
- C:\Windows\System\aPatuiM.exe
  C:\Windows\System\aPatuiM.exe
  2⤵
  PID:14932
- C:\Windows\System\eWgyUaR.exe
  C:\Windows\System\eWgyUaR.exe
  2⤵
  PID:14956
- C:\Windows\System\tMaxvHi.exe
  C:\Windows\System\tMaxvHi.exe
  2⤵
  PID:14972
- C:\Windows\System\MVwjGpg.exe
  C:\Windows\System\MVwjGpg.exe
  2⤵
  PID:14992
- C:\Windows\System\BQAJLMK.exe
  C:\Windows\System\BQAJLMK.exe
  2⤵
  PID:15008
- C:\Windows\System\wtKysWi.exe
  C:\Windows\System\wtKysWi.exe
  2⤵
  PID:15024
- C:\Windows\System\jNEmVCl.exe
  C:\Windows\System\jNEmVCl.exe
  2⤵
  PID:15040
- C:\Windows\System\xUYBHZe.exe
  C:\Windows\System\xUYBHZe.exe
  2⤵
  PID:15060
- C:\Windows\System\mfEFItM.exe
  C:\Windows\System\mfEFItM.exe
  2⤵
  PID:15076
- C:\Windows\System\FcZIQxg.exe
  C:\Windows\System\FcZIQxg.exe
  2⤵
  PID:15096
- C:\Windows\System\ucEaAFu.exe
  C:\Windows\System\ucEaAFu.exe
  2⤵
  PID:15120
- C:\Windows\System\SxuBNOn.exe
  C:\Windows\System\SxuBNOn.exe
  2⤵
  PID:15140
- C:\Windows\System\AIOKJPN.exe
  C:\Windows\System\AIOKJPN.exe
  2⤵
  PID:15156
- C:\Windows\System\qJFfmYd.exe
  C:\Windows\System\qJFfmYd.exe
  2⤵
  PID:15172
- C:\Windows\System\AepcmXz.exe
  C:\Windows\System\AepcmXz.exe
  2⤵
  PID:15196
- C:\Windows\System\rFkTkIk.exe
  C:\Windows\System\rFkTkIk.exe
  2⤵
  PID:15220
- C:\Windows\System\WpsiggF.exe
  C:\Windows\System\WpsiggF.exe
  2⤵
  PID:15244
- C:\Windows\System\bIXQcsP.exe
  C:\Windows\System\bIXQcsP.exe
  2⤵
  PID:15264
- C:\Windows\System\ufsARfN.exe
  C:\Windows\System\ufsARfN.exe
  2⤵
  PID:15280
- C:\Windows\System\wkDxhoV.exe
  C:\Windows\System\wkDxhoV.exe
  2⤵
  PID:15312
- C:\Windows\System\IdWmhzP.exe
  C:\Windows\System\IdWmhzP.exe
  2⤵
  PID:15332
- C:\Windows\System\dAGqoQu.exe
  C:\Windows\System\dAGqoQu.exe
  2⤵
  PID:15352
- C:\Windows\System\BZURkQR.exe
  C:\Windows\System\BZURkQR.exe
  2⤵
  PID:11136
- C:\Windows\System\snoEUHJ.exe
  C:\Windows\System\snoEUHJ.exe
  2⤵
  PID:11140
- C:\Windows\System\DLRqIbu.exe
  C:\Windows\System\DLRqIbu.exe
  2⤵
  PID:13484
- C:\Windows\System\LDuBbjv.exe
  C:\Windows\System\LDuBbjv.exe
  2⤵
  PID:8500
- C:\Windows\System\lTkzXQN.exe
  C:\Windows\System\lTkzXQN.exe
  2⤵
  PID:10692
- C:\Windows\System\eQjqqae.exe
  C:\Windows\System\eQjqqae.exe
  2⤵
  PID:7188
- C:\Windows\System\EtHthsr.exe
  C:\Windows\System\EtHthsr.exe
  2⤵
  PID:7404
- C:\Windows\System\PTmteoR.exe
  C:\Windows\System\PTmteoR.exe
  2⤵
  PID:8800
- C:\Windows\System\NnPyGJc.exe
  C:\Windows\System\NnPyGJc.exe
  2⤵
  PID:7968
- C:\Windows\System\DiAIpdK.exe
  C:\Windows\System\DiAIpdK.exe
  2⤵
  PID:9164
- C:\Windows\System\TZEmucz.exe
  C:\Windows\System\TZEmucz.exe
  2⤵
  PID:11104
- C:\Windows\System\fJEqBpX.exe
  C:\Windows\System\fJEqBpX.exe
  2⤵
  PID:14364
- C:\Windows\System\oISfZId.exe
  C:\Windows\System\oISfZId.exe
  2⤵
  PID:5632
- C:\Windows\System\CJbJxCx.exe
  C:\Windows\System\CJbJxCx.exe
  2⤵
  PID:2336
- C:\Windows\System\laHRTIh.exe
  C:\Windows\System\laHRTIh.exe
  2⤵
  PID:11908
- C:\Windows\System\fVYJHgo.exe
  C:\Windows\System\fVYJHgo.exe
  2⤵
  PID:11168
- C:\Windows\System\SUCKlNH.exe
  C:\Windows\System\SUCKlNH.exe
  2⤵
  PID:10180
- C:\Windows\System\YWngPXB.exe
  C:\Windows\System\YWngPXB.exe
  2⤵
  PID:11152
- C:\Windows\System\TTtGdKn.exe
  C:\Windows\System\TTtGdKn.exe
  2⤵
  PID:7992
- C:\Windows\System\LrFTNTS.exe
  C:\Windows\System\LrFTNTS.exe
  2⤵
  PID:8684
- C:\Windows\System\VIgqQDS.exe
  C:\Windows\System\VIgqQDS.exe
  2⤵
  PID:6616
- C:\Windows\System\HYcpkAx.exe
  C:\Windows\System\HYcpkAx.exe
  2⤵
  PID:13576
- C:\Windows\System\MnOzkNI.exe
  C:\Windows\System\MnOzkNI.exe
  2⤵
  PID:13492
- C:\Windows\System\uZGAeVQ.exe
  C:\Windows\System\uZGAeVQ.exe
  2⤵
  PID:10700
- C:\Windows\System\qLQoqOk.exe
  C:\Windows\System\qLQoqOk.exe
  2⤵
  PID:14428
- C:\Windows\System\vXuyNdm.exe
  C:\Windows\System\vXuyNdm.exe
  2⤵
  PID:11096
- C:\Windows\System\dminTRj.exe
  C:\Windows\System\dminTRj.exe
  2⤵
  PID:14660
- C:\Windows\System\aHuWZRH.exe
  C:\Windows\System\aHuWZRH.exe
  2⤵
  PID:11192
- C:\Windows\System\XBvAHYi.exe
  C:\Windows\System\XBvAHYi.exe
  2⤵
  PID:10036
- C:\Windows\System\oHnrvIp.exe
  C:\Windows\System\oHnrvIp.exe
  2⤵
  PID:10504
- C:\Windows\System\oOhjvqS.exe
  C:\Windows\System\oOhjvqS.exe
  2⤵
  PID:7236
- C:\Windows\System\QdqwDbp.exe
  C:\Windows\System\QdqwDbp.exe
  2⤵
  PID:10160
- C:\Windows\System\rCPQlpr.exe
  C:\Windows\System\rCPQlpr.exe
  2⤵
  PID:9760
- C:\Windows\System\TKMKako.exe
  C:\Windows\System\TKMKako.exe
  2⤵
  PID:11372
- C:\Windows\System\ZOAXShr.exe
  C:\Windows\System\ZOAXShr.exe
  2⤵
  PID:9700
- C:\Windows\System\yyMvqFS.exe
  C:\Windows\System\yyMvqFS.exe
  2⤵
  PID:11856
- C:\Windows\System\IOBNpBs.exe
  C:\Windows\System\IOBNpBs.exe
  2⤵
  PID:9976
- C:\Windows\System\aZnvZDc.exe
  C:\Windows\System\aZnvZDc.exe
  2⤵
  PID:10744
- C:\Windows\System\hxsPaaz.exe
  C:\Windows\System\hxsPaaz.exe
  2⤵
  PID:8388
- C:\Windows\System\kKCvQoS.exe
  C:\Windows\System\kKCvQoS.exe
  2⤵
  PID:10008
- C:\Windows\System\eTrTqQh.exe
  C:\Windows\System\eTrTqQh.exe
  2⤵
  PID:10592
- C:\Windows\System\PByYfPj.exe
  C:\Windows\System\PByYfPj.exe
  2⤵
  PID:12028
- C:\Windows\System\oOrUpNN.exe
  C:\Windows\System\oOrUpNN.exe
  2⤵
  PID:14368
- C:\Windows\System\yLLUfHb.exe
  C:\Windows\System\yLLUfHb.exe
  2⤵
  PID:14456
- C:\Windows\System\kEPFTPc.exe
  C:\Windows\System\kEPFTPc.exe
  2⤵
  PID:14900
- C:\Windows\System\LuuDSwz.exe
  C:\Windows\System\LuuDSwz.exe
  2⤵
  PID:11216
- C:\Windows\System\bdDRYnN.exe
  C:\Windows\System\bdDRYnN.exe
  2⤵
  PID:14904
- C:\Windows\System\bvPuEyp.exe
  C:\Windows\System\bvPuEyp.exe
  2⤵
  PID:14940
- C:\Windows\System\GqJsdow.exe
  C:\Windows\System\GqJsdow.exe
  2⤵
  PID:10048
- C:\Windows\System\uwudlHT.exe
  C:\Windows\System\uwudlHT.exe
  2⤵
  PID:11248
- C:\Windows\System\fSoxDwi.exe
  C:\Windows\System\fSoxDwi.exe
  2⤵
  PID:15036
- C:\Windows\System\JGCggyn.exe
  C:\Windows\System\JGCggyn.exe
  2⤵
  PID:14736
- C:\Windows\System\rNtRfio.exe
  C:\Windows\System\rNtRfio.exe
  2⤵
  PID:15212
- C:\Windows\System\KrVJjOa.exe
  C:\Windows\System\KrVJjOa.exe
  2⤵
  PID:9332
- C:\Windows\System\mdgvYia.exe
  C:\Windows\System\mdgvYia.exe
  2⤵
  PID:14532
- C:\Windows\System\UFOcGuE.exe
  C:\Windows\System\UFOcGuE.exe
  2⤵
  PID:15348
- C:\Windows\System\EvweFwE.exe
  C:\Windows\System\EvweFwE.exe
  2⤵
  PID:11648
- C:\Windows\System\iTCmiYd.exe
  C:\Windows\System\iTCmiYd.exe
  2⤵
  PID:15372
- C:\Windows\System\WDDYTKq.exe
  C:\Windows\System\WDDYTKq.exe
  2⤵
  PID:15392
- C:\Windows\System\zGSpqpX.exe
  C:\Windows\System\zGSpqpX.exe
  2⤵
  PID:15412
- C:\Windows\System\EiprXLC.exe
  C:\Windows\System\EiprXLC.exe
  2⤵
  PID:15432
- C:\Windows\System\sgLHAzA.exe
  C:\Windows\System\sgLHAzA.exe
  2⤵
  PID:15456
- C:\Windows\System\QCpYEeU.exe
  C:\Windows\System\QCpYEeU.exe
  2⤵
  PID:15476
- C:\Windows\System\xRWhPcC.exe
  C:\Windows\System\xRWhPcC.exe
  2⤵
  PID:15496
- C:\Windows\System\IkiFEIE.exe
  C:\Windows\System\IkiFEIE.exe
  2⤵
  PID:15520
- C:\Windows\System\qdsVnfj.exe
  C:\Windows\System\qdsVnfj.exe
  2⤵
  PID:15540
- C:\Windows\System\GSHNngO.exe
  C:\Windows\System\GSHNngO.exe
  2⤵
  PID:15556
- C:\Windows\System\YKkxKSh.exe
  C:\Windows\System\YKkxKSh.exe
  2⤵
  PID:15576
- C:\Windows\System\hjkoQIs.exe
  C:\Windows\System\hjkoQIs.exe
  2⤵
  PID:15596
- C:\Windows\System\iYuVDxM.exe
  C:\Windows\System\iYuVDxM.exe
  2⤵
  PID:15616
- C:\Windows\System\GlatCrv.exe
  C:\Windows\System\GlatCrv.exe
  2⤵
  PID:15636
- C:\Windows\System\ISSmjiJ.exe
  C:\Windows\System\ISSmjiJ.exe
  2⤵
  PID:15660
- C:\Windows\System\SVCoDwv.exe
  C:\Windows\System\SVCoDwv.exe
  2⤵
  PID:15680
- C:\Windows\System\WcXUnCe.exe
  C:\Windows\System\WcXUnCe.exe
  2⤵
  PID:15700
- C:\Windows\System\awmEXcm.exe
  C:\Windows\System\awmEXcm.exe
  2⤵
  PID:15720
- C:\Windows\System\NBhALld.exe
  C:\Windows\System\NBhALld.exe
  2⤵
  PID:15748
- C:\Windows\System\ARJLcbv.exe
  C:\Windows\System\ARJLcbv.exe
  2⤵
  PID:16188
- C:\Windows\System\GTHlfbq.exe
  C:\Windows\System\GTHlfbq.exe
  2⤵
  PID:14668
- C:\Windows\System\THnTaoS.exe
  C:\Windows\System\THnTaoS.exe
  2⤵
  PID:15472
- C:\Windows\System\nsrJsmy.exe
  C:\Windows\System\nsrJsmy.exe
  2⤵
  PID:10816
- C:\Windows\System\wAPCyiL.exe
  C:\Windows\System\wAPCyiL.exe
  2⤵
  PID:14348
- C:\Windows\System\SZwhNom.exe
  C:\Windows\System\SZwhNom.exe
  2⤵
  PID:14412
- C:\Windows\System\oZcCAKy.exe
  C:\Windows\System\oZcCAKy.exe
  2⤵
  PID:14628
- C:\Windows\System\nlehOSm.exe
  C:\Windows\System\nlehOSm.exe
  2⤵
  PID:10032
- C:\Windows\System\xVaHEBF.exe
  C:\Windows\System\xVaHEBF.exe
  2⤵
  PID:15016
- C:\Windows\System\GBfrBww.exe
  C:\Windows\System\GBfrBww.exe
  2⤵
  PID:14772
- C:\Windows\System\geOkGyN.exe
  C:\Windows\System\geOkGyN.exe
  2⤵
  PID:15388
- C:\Windows\System\jUPeGGH.exe
  C:\Windows\System\jUPeGGH.exe
  2⤵
  PID:12012
- C:\Windows\System\LxJZIVT.exe
  C:\Windows\System\LxJZIVT.exe
  2⤵
  PID:10936
- C:\Windows\System\KZgMEdJ.exe
  C:\Windows\System\KZgMEdJ.exe
  2⤵
  PID:15868
- C:\Windows\System\KpqgEJK.exe
  C:\Windows\System\KpqgEJK.exe
  2⤵
  PID:15652
- C:\Windows\System\cqcHuVb.exe
  C:\Windows\System\cqcHuVb.exe
  2⤵
  PID:15716
- C:\Windows\System\QHXogCP.exe
  C:\Windows\System\QHXogCP.exe
  2⤵
  PID:7084
- C:\Windows\System\dDQppdm.exe
  C:\Windows\System\dDQppdm.exe
  2⤵
  PID:15588
- C:\Windows\System\BKwrLJp.exe
  C:\Windows\System\BKwrLJp.exe
  2⤵
  PID:15440
- C:\Windows\System\FfUiwpP.exe
  C:\Windows\System\FfUiwpP.exe
  2⤵
  PID:5268
- C:\Windows\System\WUVuANT.exe
  C:\Windows\System\WUVuANT.exe
  2⤵
  PID:14680
- C:\Windows\System\TGWIUkC.exe
  C:\Windows\System\TGWIUkC.exe
  2⤵
  PID:15900
- C:\Windows\System\QAyIWhj.exe
  C:\Windows\System\QAyIWhj.exe
  2⤵
  PID:15956
- C:\Windows\System\LVSNvNW.exe
  C:\Windows\System\LVSNvNW.exe
  2⤵
  PID:16332
- C:\Windows\System\EtGofSe.exe
  C:\Windows\System\EtGofSe.exe
  2⤵
  PID:13228
- C:\Windows\System\WwanyFv.exe
  C:\Windows\System\WwanyFv.exe
  2⤵
  PID:9228
- C:\Windows\System\xvpLKcn.exe
  C:\Windows\System\xvpLKcn.exe
  2⤵
  PID:16084
- C:\Windows\System\TAWZhee.exe
  C:\Windows\System\TAWZhee.exe
  2⤵
  PID:16140
- C:\Windows\System\jKDBZla.exe
  C:\Windows\System\jKDBZla.exe
  2⤵
  PID:15548
- C:\Windows\System\CwCKJVJ.exe
  C:\Windows\System\CwCKJVJ.exe
  2⤵
  PID:11820
- C:\Windows\System\hSPmnvq.exe
  C:\Windows\System\hSPmnvq.exe
  2⤵
  PID:12156
- C:\Windows\System\KFHmAto.exe
  C:\Windows\System\KFHmAto.exe
  2⤵
  PID:15932
- C:\Windows\System\mYlacMC.exe
  C:\Windows\System\mYlacMC.exe
  2⤵
  PID:15948
- C:\Windows\System\EAzaVvn.exe
  C:\Windows\System\EAzaVvn.exe
  2⤵
  PID:12884
- C:\Windows\System\tbsGsjw.exe
  C:\Windows\System\tbsGsjw.exe
  2⤵
  PID:7148
- C:\Windows\System\PDsJvhK.exe
  C:\Windows\System\PDsJvhK.exe
  2⤵
  PID:16040
- C:\Windows\System\XFqSCJN.exe
  C:\Windows\System\XFqSCJN.exe
  2⤵
  PID:11532
- C:\Windows\System\qkdKCjX.exe
  C:\Windows\System\qkdKCjX.exe
  2⤵
  PID:10264
- C:\Windows\System\qfKvpnW.exe
  C:\Windows\System\qfKvpnW.exe
  2⤵
  PID:11320
- C:\Windows\System\pkTZGaE.exe
  C:\Windows\System\pkTZGaE.exe
  2⤵
  PID:11792
- C:\Windows\System\QdrhQQl.exe
  C:\Windows\System\QdrhQQl.exe
  2⤵
  PID:12644
- C:\Windows\System\cGvMwGL.exe
  C:\Windows\System\cGvMwGL.exe
  2⤵
  PID:10500
- C:\Windows\System\wKHoVmO.exe
  C:\Windows\System\wKHoVmO.exe
  2⤵
  PID:11672
- C:\Windows\System\gCHwmrj.exe
  C:\Windows\System\gCHwmrj.exe
  2⤵
  PID:13076
- C:\Windows\System\XBamdBt.exe
  C:\Windows\System\XBamdBt.exe
  2⤵
  PID:10836
- C:\Windows\System\copWuVt.exe
  C:\Windows\System\copWuVt.exe
  2⤵
  PID:12208
- C:\Windows\System\EOdQqtA.exe
  C:\Windows\System\EOdQqtA.exe
  2⤵
  PID:16212
- C:\Windows\System\HPeKhPr.exe
  C:\Windows\System\HPeKhPr.exe
  2⤵
  PID:13184
- C:\Windows\System\eaHfHxq.exe
  C:\Windows\System\eaHfHxq.exe
  2⤵
  PID:16276
- C:\Windows\System\bpmdsag.exe
  C:\Windows\System\bpmdsag.exe
  2⤵
  PID:16308
- C:\Windows\System\FmRixSh.exe
  C:\Windows\System\FmRixSh.exe
  2⤵
  PID:12816
- C:\Windows\System\csQuabu.exe
  C:\Windows\System\csQuabu.exe
  2⤵
  PID:9488

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 12688 -i 12688 -h 540 -j 520 -s 444 -d 10092
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:11908

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 12688 -s 532
1⤵
PID:9532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kbtlastu.di4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CLsjPIh.exe

Filesize
1.5MB

MD5
1791ba1440a16c605803b513cd80df7c

SHA1
1f5ea957dce899df297ed7929c1eaa94205b8f11

SHA256
5e58aba2997c495c7bae04fe9769bf64d412a3696b13f1b4ab17cd911d6fcd4d

SHA512
1c6e605032719f974b42a31e886183bd20f32b281b9d0dff339b4f0f00a9b5c3b4ac01f96c28bdd476d257262097ad9afd0991d48b2f13e42485ee05dcb88dcf

Download Submit
C:\Windows\System\EQtCWDB.exe

Filesize
1.5MB

MD5
4e699e0b652dfd559021f355e04f2002

SHA1
0bd66c497e77354273ab8c94df856b5a267a9530

SHA256
33682ebfd4b35eb954325543da1dd5ccf08c44a60113e4788b4df0788c410ec9

SHA512
ae412c942094500c41ee97f91c95a14f047067b30f502da4043113f09b40a66cbae56faa774e70f5558cb05c3b5224f7334c1c1ef92bb971b63207b922d3886b

Download Submit
C:\Windows\System\EdXIJhH.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\System\HTnBqOd.exe

Filesize
1.5MB

MD5
9186c9235ae17a9989e4ac3204325271

SHA1
032d9a37804235399d2d1e9b18190a747d6ea2d0

SHA256
1f9a8155d95ea89f8ebc663d12ceb93e1a080a8398a59af023c57ab355864388

SHA512
fd64b0f8bce8e191bd430dad986ff279375d9890a547db6e038d95cfe5c2238c71f5daf58b9dd8fe13ad92b5cd2709c1c6482100ffa0467608f7d0003e4e007f

Download Submit
C:\Windows\System\ImRKTcD.exe

Filesize
1.5MB

MD5
b9a51b0b1e9ef4d64057b335aebe584d

SHA1
bc02e921287e9aeba64bfb2582505f9c2b58eca0

SHA256
fdc1441fadd369e9a6a7184d467a0ee7a84400bcde2d3f18723ee44c9cdf7fb4

SHA512
ab4aa6d4d5af1203750052ee5914bc33c320e1d6c8fc1ff42515aeb895274a7047d6dfd65cebfb5d3002ffb2b318dba1572043799edd67f556a13b1e3da0823c

Download Submit
C:\Windows\System\KtoCGsm.exe

Filesize
1.5MB

MD5
97fc9a5ba333b867ed3a7cc0427b2f53

SHA1
49426f4f6cf3c014e55fdeeadd77897d189c52bf

SHA256
10d348fe66c61e05f50add3b551c8c1433a0bd5cea6e08917fd5c4bd5fb8f7db

SHA512
51d87f759e7768e6905226a28922ce7e8e83a4b3e9bc8c3d32d4ff182c7d8b02d451714b5fd7c475377790321883a0d0612ed1abb8a6f35c28fe38a4cd3c6f2e

Download Submit
C:\Windows\System\MypsqAe.exe

Filesize
1.5MB

MD5
1b6f268ac5c2655c3afd3d216953e688

SHA1
d19ef6e641bb87fe2c70b56efe05c4b02dbb84a9

SHA256
8ebd50752c125222232f08a397b1de5425bad3888b12e8ef837a125a7d75e5a5

SHA512
ff3e0ead10ad5d12a91388a1cf4cd902b4ba67b60dd20829acb334c3a5614bc1bd391fc14ec673942613507ce3364dff19fdf357e7763c4ff4eea267c1c5f272

Download Submit
C:\Windows\System\NkxyDsu.exe

Filesize
1.5MB

MD5
42278a79c0df5a8fcb22426a86d2e1a0

SHA1
e49eb065274873ade4ff6f95a8fa65e2beca1033

SHA256
43f6b03da4ff8f367e67d214e060e3a18a7cd7f4bc93a4aeb82c4029741c99e2

SHA512
3a5597890788e3a0563ab349b159bb5e22f23abd3b74ec831532ac16c9dd8eebb70ca43de111f6fc32521e6314f87e2c0c3931eb6e37ddbf43a6464e6fdab28a

Download Submit
C:\Windows\System\OBSppFi.exe

Filesize
1.5MB

MD5
1bd80ee28e8f1784a7b2e2add5da71e8

SHA1
46379b9147f1e1d39562e833a439b317fcbe78b2

SHA256
f678c4b69d59c41d6155652f9f9bf427d22a5c199fef7f584e9f4fbd1556f3ba

SHA512
d28b2aa01d13f2d7c97d65866e7953ee236c37d4212fa6313a313dcfcaf0b39a2df597cf17525972add97b63049877072cbba819b4446586b99f60bb0fc51741

Download Submit
C:\Windows\System\PqpTmyy.exe

Filesize
1.5MB

MD5
9da72db921334a261166c0adc784b175

SHA1
346c87af929600f524b5c1544c369902ac862bc8

SHA256
11382511e3e4a489dc9c67cbccb42fac492bf7be09537c01d40dff9895f59019

SHA512
31dc1706e66b583ed21b86eba8c6b251df98f70fd090e90344bc93f7c901d54216430381c719095e85822faf8dfae7bb92a54f2ccc7bd045c47421f4c178ab20

Download Submit
C:\Windows\System\QRZxRxZ.exe

Filesize
1.5MB

MD5
cd87808592ca259e9eeccf490368f5e6

SHA1
f12f21fc736021b7d11efa864675cdc7a451e758

SHA256
1d1f00a66dcfd11bad053f54e5ac6d164f949a3b7d0b5bdd7b2c1616b5d2389c

SHA512
ba8670650bfdfe091bbc69494275634603eab7f007acec2b7752db5e568497bc0800e35804e2998ef480799cfabeb83847b0989558d01c981a3ce2ec574ff63e

Download Submit
C:\Windows\System\QohxVnO.exe

Filesize
1.5MB

MD5
972b27225863b97c69af786a49eb405c

SHA1
c54ec4fb55dcda237ec91692c35e74098b97ddd7

SHA256
535bf3110fc9cc8b2307e125c946746c14b79319f4b8d870ce28c5b336903292

SHA512
94488271a593522b7b079225168eac7250c802872309b0e0834e256b864e9b97e0a087a5bfe96c9740e8f11f20859d6b1afe0be200c3e29c202de326fe68dbe8

Download Submit
C:\Windows\System\TVxRYvh.exe

Filesize
1.5MB

MD5
ceb4ac89216b741e172fa68788d4c15e

SHA1
4aa3cb294e77a1ccc4682a24bddc7c247cba0b90

SHA256
b9642960be69613468b118f18b6227c4d1d167ee0dbbcf9381a84a48b444630c

SHA512
1d9fe8c2d7a59474d86984b7d1b3e251f6e2f729cc58f47487e4cb444c9af937e4ddbe7510a8599d3aa6f0e2151edffe38985f4f4a97d1e0526a7ab3b1c32b3b

Download Submit
C:\Windows\System\TxANEjD.exe

Filesize
1.5MB

MD5
c90c3a441bbcdbeb766ccf5b64b8e4e8

SHA1
66c9f63c0e01b4a14a3e1d8bf5c60ef866b9cf5d

SHA256
7bf8a83d42a4cdd7ae862b5d383faf4898200ae4bc906ada5559890d743c68b0

SHA512
f7910609b66c2a994a38d7bfd82407a32128f13f279e27928dd7f46ce28869deb3666944b0d9c5fcd3e3aac3be79c1e6a7fd06399dd567a5173beaeab1052fb1

Download Submit
C:\Windows\System\XVHnEKD.exe

Filesize
1.5MB

MD5
1be520819a59e58e0ca95262e6e322ec

SHA1
dab8657faf83dfd4a7999fb59ffe890661a12d37

SHA256
8a79c1bcbfe180d1d9b2b8577e5edc67426688092ed4cf8bd4a0371b6fdbc125

SHA512
3711fb3b6b23284aeba45fdaaf72dc922ea01466201da0ccb563f5990bcf4c4173c9501dc570733f52e5246ba8b949742a1ebcbd0b86fc45d0044aaa20f8e303

Download Submit
C:\Windows\System\apJRJLo.exe

Filesize
1.5MB

MD5
ce5e91c4fc7413c0d0c5d9ca0fe354db

SHA1
59ca1d7d07852fbb621e554385e8fa49fca1874c

SHA256
42d05e0ad699f686c5ff39b8f756253e4b26e6549fff95c32d2eb80175590d1e

SHA512
f42c97583d41b2c6106d01b636458c2c6ec76152220975c992b807a52cb16a94b0aff5460322c0f53c8fdf7b9f5892919263b78ccf9fb287c4adc321f04b3110

Download Submit
C:\Windows\System\bveHBzZ.exe

Filesize
1.5MB

MD5
6b7d6ad49b505c976d367d1f8bf15ecc

SHA1
15ac084a9e1383461a36eaf3acddc77cb77fc57f

SHA256
3a31f205ea9e5f05b52c54472adc73bb804c1064c7f90a2f55650d3b14113580

SHA512
db90835c145ac80675e7ea82ef4afde117990f0978a6f3c32c24946a7ed81cee5f1d8b43dfe24d2f8e66ea4e87c56468cb036fc0c997c81ccc59f7c19d7383d4

Download Submit
C:\Windows\System\eZXndmx.exe

Filesize
1.5MB

MD5
3e61cb513929ede46e768e398957b21e

SHA1
d1f7e59485c0680bc4514153dbd422d06f64cde5

SHA256
fb13dbf4d4d2fdf3872068c328da020de72baa9b994d3e910fd749e31a787ab2

SHA512
d9231f7cefad9d09c39cb29558a4e122522fdd550c74406ea6c7968cd63fbf2695a64f87cbdab7ba44591e981027dc5cd6a4db95367edf27fbcd8fb937366213

Download Submit
C:\Windows\System\ekYNkyt.exe

Filesize
1.5MB

MD5
df46020703a21269b2884e13f3460391

SHA1
3033a9c15760e6dbcd756054146cb4aa6b4d7885

SHA256
d2a9898a7a30080c5b9e4e4bc337c385c814b64636bcf407218f466ca05bbbb6

SHA512
6b67b2e42a047cdea7451d4cbb10dc41d3ffa4f6eba82c073d099e056cc86d74f6cb32046bef137707fdb7e71b2de4be79004a3d43d94e8e15202a22f2c69ac4

Download Submit
C:\Windows\System\koDmKRv.exe

Filesize
1.5MB

MD5
66432692095b0bb1bce35dc2fc3cde12

SHA1
01ac4d48668709b6a6bc811b521a53cdcaa00b58

SHA256
80ec9a05f40e2f2fc70ac5786beb21908993e9d01623d539ed6f75e9c137f972

SHA512
c0a8ddf8c387fb056c4d5778c59f6f31e56bef83e9fac0dd33da14a31f646bfb3b15e33a0e968969cde4ccce8840c098bddaf281549174d5f74cd1c3cd23b3ce

Download Submit
C:\Windows\System\lTyEplf.exe

Filesize
1.5MB

MD5
537f72b3f8de3eb84a6beddf74fbd5d7

SHA1
56ce7820a1c34c501c0112293acb20fc828942db

SHA256
ee1b3cdf8d4bf104dd4086a3f7d2a4e3ef99b6397b2bdfab4845f10e987f9e4f

SHA512
06b7179b6151254f84fa6d8036f0cddbab5a9caddabf0d6295f389e591f8725de8000302abefc59f58445b1583c0f68038ffc9d39b3de122cb35e895e7759ef5

Download Submit
C:\Windows\System\mDobBWE.exe

Filesize
1.5MB

MD5
53fdfa58f313260987fbd0cbb9557eeb

SHA1
e950d829be2deb924f8786d07f12ae673cbe6695

SHA256
aebc99b937ac1c9c13cc74b36c5a0989f28e941b5b83d498c5df353ab8b7aafe

SHA512
b8da3cddb158737046baadbb676854708651035065ab42063b9f58aa9c1c001e0c7efbe97229729eeb9217d566aa349cc8edabdf9a5dbb2be4a98c7c16b37031

Download Submit
C:\Windows\System\nVwiCLk.exe

Filesize
1.5MB

MD5
c67b8c648febd982b6af1f48b24a82cf

SHA1
99b994bd70215334bb3711c4acdaa5b97d7f3806

SHA256
0ef3123054d8484cab2b6c87d3547a1c2249b0468f6bdb70de4d0d46d90d12ac

SHA512
d50c021c996d1b0be98ba11009ca1cedb85142ca0c812bf4e0bce6133990c36f159584f2a5ad9a1113757b85493d946ce607355fb3ab77514f56f8132f29cc96

Download Submit
C:\Windows\System\pUwjhbD.exe

Filesize
1.5MB

MD5
6b0cbfc1b37fa542b505a223a86ea51a

SHA1
a504ce3df44fa14a7cc5e463d2440963c168b5be

SHA256
663a8b7901522c8185f7f359c84f913abcbdc38c0481f0f0b3fd3eb4c90371f9

SHA512
7ef7047bdabf2f08400a5d5eb7e15320a5f536da5509c621bf56893ee35e3c188aceef519d38bb0b02ceb72c87f3db0ea89edb0f9cd5a995a69c996ec1e1cb70

Download Submit
C:\Windows\System\qkFnock.exe

Filesize
1.5MB

MD5
553b9b19e3c2be0c1d75339a5daeff86

SHA1
163d5e7155a2b184eac7e95eb6c279c4a86bf1f3

SHA256
ca2953982266d8d93b85e1796474af0306b09443ba88d68645cdeb7e504846af

SHA512
fcba87bf43612636985aa2a9c6b42ecb472869ab0789a942c17ed2ac2d23ff51ea3279dc1d6beb1bfea8bc1f9d4990bb11dd0e546b69a8da8a82ba1b34580721

Download Submit
C:\Windows\System\qvgFKFa.exe

Filesize
1.5MB

MD5
18aca0c684ec685ee3cbed9905d5aa93

SHA1
6cef1c05c7bd25ae7240bccf7759b93002989d38

SHA256
7abd5d7ae0eea3c04c28e6866c3cc744934e658b9f65c5f5ef41576ed9121a76

SHA512
a7b0a80292bf5b4f0c1656d41b5e83c36b4949b8db8b781e294ddba046832774fde12a66d5b5e64eeec8b1ea831bba89a62a338a30ffdd7ee4d56d4bb265c1b4

Download Submit
C:\Windows\System\rBletFH.exe

Filesize
1.5MB

MD5
59da193438d6e421f2e7b6336b7d99dc

SHA1
34339cd1f5147f0a433e11f86762c6f291a2d5d3

SHA256
1b6173e194742f46824fa8fd5c08c1aa8ef058cb7cbddfc95eb0a0d75301c379

SHA512
9d2fee628b10cd926a5f89637d2b1348d8dff924cd4a27221f17473fdce947946adf9d06c747fd756dad6d0ed770c86cbfe474960f35e8e1a73e8e9f9062f60c

Download Submit
C:\Windows\System\tJLQgCJ.exe

Filesize
1.5MB

MD5
da5af3335c3fdd2780faeccf74ec4071

SHA1
570a0fcca897e271b18f08ffafbbd10ec01e264c

SHA256
1f4ffc185d6c7e73a3eddc4cd4c5001539abd3fc8a00906313ccc76ca4b3b0ca

SHA512
9e9ca768304fda91308f9afa8b6c1ba00d02169235137253f65b8b0a3b52d56cd1314feb3435b72947e9c45628d1162580c9e4e98ccd9721a658c568b1cb8fa3

Download Submit
C:\Windows\System\txKcTSN.exe

Filesize
1.5MB

MD5
1e2ba35f10e103ce5c0d20d2e04a19ef

SHA1
4e47ce2c0ff6fe77a5486d7598158b15176b0d03

SHA256
454975a407a3b258f6136ffebda4820f92991e00c71b20c1cd395d8cb13a4755

SHA512
d195235bb0bcd4abcb2c417ba5214c83297809826da5f5125ca9bf970bafd752b980fdab45910738cacb8d37a38ccac9d6b0b5c7bfddcdc2cbc3146da62d8088

Download Submit
C:\Windows\System\wwiDnOk.exe

Filesize
1.5MB

MD5
0a106b74c871a42735b8cb6fc1f23d47

SHA1
fe20905ac3c607cc05eca7090baaa04055ab5904

SHA256
ff7e8237f1512051d636c7ab5d23947c8d1a93ed1e9f6df0487c7730b0aacc24

SHA512
1745aa85728f779c8d8fc91f191809454daaa877edf03be0e2e7b5094b27d3be56a9b2644cbe7888ff875431d9a0d66b9bfb64092c41da1aefc62f63a268da7f

Download Submit
C:\Windows\System\xmLdNag.exe

Filesize
1.5MB

MD5
f18962aa9606f0c8c86cc7e9ad6b09bf

SHA1
1b43c0054ffc385aaa07e4ac1b877776a945d13c

SHA256
9d9071f3e050d04584be56dcc387a7e0e4030498005c29b1fa0d2bbd729e3afe

SHA512
0391ce1e803a4c07060f7ff631d0c735c7dd072a1ffdfa3e46c5ae3fe91f471d5b111f0f81997187152324dbc1c34fa101aa0e777180d8e19d53a068bafa50f2

Download Submit
C:\Windows\System\yrknNCC.exe

Filesize
1.5MB

MD5
374d59c0b569ca986b7ebc2c7beae593

SHA1
9903b90b74772e2a6769ed8336649214c0a4c41c

SHA256
08a3a92238b0c8226b2d85c347e32cd3f4677d78f73ebf62578cd642f884aa6c

SHA512
91aa4dab676ad2328832a8af3b25fb1cf457b97e1ff3701882615ef1a82a71060a5b77d10d8faf8b10c5210d54487671a108813b06a18189a28d5130233f6ef2

Download Submit
C:\Windows\System\yyUiKWG.exe

Filesize
1.5MB

MD5
1b41e80c72166140b249d800d572f014

SHA1
ba8e793c8dc98c2ed3014b0cef90e4f9a8227b48

SHA256
097d750b2d76fb39234db06e58f17fa82bd843ecedec9195d995f8c70e92f9dc

SHA512
36710ebae0acead2ec93e95fd56143b610711f32b5649335ef910fd4d4a7bc42eef8da654c44791254f605be22300dcc510697b6664c8f5be8ca28dcafaece15

Download Submit
C:\Windows\System\zJwAUqX.exe

Filesize
1.5MB

MD5
001ba64c9a6fe71d4ca1e33f1950d565

SHA1
80bf7d42ffb6f5c832d2379ce75e3aa8e9c9a63d

SHA256
003926635d46fd0664a9c31a582c283fba87adffb6b5ccc9c16e010aaefeb0b6

SHA512
dac5ad35127dd2353402927fc8c829a83deaaab650c7ea8f299be040b98411a74bdeeda2748e276db6dde0cad0ab961ceeae428558a2ba1a2df25b59e7951d8a

Download Submit
memory/220-75-0x00007FF6A08B0000-0x00007FF6A0CA2000-memory.dmp

Filesize
3.9MB

Download
memory/220-2421-0x00007FF6A08B0000-0x00007FF6A0CA2000-memory.dmp

Filesize
3.9MB

Download
memory/404-146-0x00007FF622E30000-0x00007FF623222000-memory.dmp

Filesize
3.9MB

Download
memory/404-2613-0x00007FF622E30000-0x00007FF623222000-memory.dmp

Filesize
3.9MB

Download
memory/440-140-0x00007FF7B83E0000-0x00007FF7B87D2000-memory.dmp

Filesize
3.9MB

Download
memory/440-2604-0x00007FF7B83E0000-0x00007FF7B87D2000-memory.dmp

Filesize
3.9MB

Download
memory/452-2502-0x00007FF799AF0000-0x00007FF799EE2000-memory.dmp

Filesize
3.9MB

Download
memory/452-72-0x00007FF799AF0000-0x00007FF799EE2000-memory.dmp

Filesize
3.9MB

Download
memory/872-85-0x00007FF74C6D0000-0x00007FF74CAC2000-memory.dmp

Filesize
3.9MB

Download
memory/872-2472-0x00007FF74C6D0000-0x00007FF74CAC2000-memory.dmp

Filesize
3.9MB

Download
memory/1256-2434-0x00007FF61E370000-0x00007FF61E762000-memory.dmp

Filesize
3.9MB

Download
memory/1256-80-0x00007FF61E370000-0x00007FF61E762000-memory.dmp

Filesize
3.9MB

Download
memory/1728-91-0x00007FF7DDF50000-0x00007FF7DE342000-memory.dmp

Filesize
3.9MB

Download
memory/2060-93-0x0000019BF3190000-0x0000019BF3936000-memory.dmp

Filesize
7.6MB

Download
memory/2060-6193-0x00007FFFD6D20000-0x00007FFFD77E1000-memory.dmp

Filesize
10.8MB

Download
memory/2060-43-0x0000019BF1E90000-0x0000019BF1EA0000-memory.dmp

Filesize
64KB

Download
memory/2060-33-0x0000019BF23F0000-0x0000019BF2412000-memory.dmp

Filesize
136KB

Download
memory/2060-34-0x00007FFFD6D20000-0x00007FFFD77E1000-memory.dmp

Filesize
10.8MB

Download
memory/2108-103-0x00007FF69FFD0000-0x00007FF6A03C2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-2641-0x00007FF69FFD0000-0x00007FF6A03C2000-memory.dmp

Filesize
3.9MB

Download
memory/2228-56-0x00007FF759D30000-0x00007FF75A122000-memory.dmp

Filesize
3.9MB

Download
memory/2440-88-0x00007FF79F770000-0x00007FF79FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2548-6658-0x00007FF739320000-0x00007FF739712000-memory.dmp

Filesize
3.9MB

Download
memory/2548-1-0x0000016788860000-0x0000016788870000-memory.dmp

Filesize
64KB

Download
memory/2548-0-0x00007FF739320000-0x00007FF739712000-memory.dmp

Filesize
3.9MB

Download
memory/2776-2605-0x00007FF7496A0000-0x00007FF749A92000-memory.dmp

Filesize
3.9MB

Download
memory/2776-134-0x00007FF7496A0000-0x00007FF749A92000-memory.dmp

Filesize
3.9MB

Download
memory/2800-118-0x00007FF741AA0000-0x00007FF741E92000-memory.dmp

Filesize
3.9MB

Download
memory/2800-2637-0x00007FF741AA0000-0x00007FF741E92000-memory.dmp

Filesize
3.9MB

Download
memory/2880-2391-0x00007FF79D4F0000-0x00007FF79D8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2880-42-0x00007FF79D4F0000-0x00007FF79D8E2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-150-0x00007FF7A8BA0000-0x00007FF7A8F92000-memory.dmp

Filesize
3.9MB

Download
memory/3012-2606-0x00007FF7A8BA0000-0x00007FF7A8F92000-memory.dmp

Filesize
3.9MB

Download
memory/3132-49-0x00007FF710800000-0x00007FF710BF2000-memory.dmp

Filesize
3.9MB

Download
memory/3416-109-0x00007FF7A2A70000-0x00007FF7A2E62000-memory.dmp

Filesize
3.9MB

Download
memory/3416-2615-0x00007FF7A2A70000-0x00007FF7A2E62000-memory.dmp

Filesize
3.9MB

Download
memory/3624-2603-0x00007FF6B3370000-0x00007FF6B3762000-memory.dmp

Filesize
3.9MB

Download
memory/3624-153-0x00007FF6B3370000-0x00007FF6B3762000-memory.dmp

Filesize
3.9MB

Download
memory/3848-2486-0x00007FF6803F0000-0x00007FF6807E2000-memory.dmp

Filesize
3.9MB

Download
memory/3848-90-0x00007FF6803F0000-0x00007FF6807E2000-memory.dmp

Filesize
3.9MB

Download
memory/4412-92-0x00007FF70E1E0000-0x00007FF70E5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4412-2525-0x00007FF70E1E0000-0x00007FF70E5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4964-89-0x00007FF7FC0C0000-0x00007FF7FC4B2000-memory.dmp

Filesize
3.9MB

Download
memory/4964-2484-0x00007FF7FC0C0000-0x00007FF7FC4B2000-memory.dmp

Filesize
3.9MB

Download
memory/5040-2529-0x00007FF716AE0000-0x00007FF716ED2000-memory.dmp

Filesize
3.9MB

Download
memory/5040-84-0x00007FF716AE0000-0x00007FF716ED2000-memory.dmp

Filesize
3.9MB

Download