xmrig | 5250e8fe2801d05638a6bec3a2d0bdc7c116f74f0a321467b1fe1109ee7665d7

Analysis

max time kernel
152s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
Size

2.2MB
MD5

0563e0cc382192bef9be40d6ca5bb752
SHA1

25c809e95618e4277220fdf180cd0d9435180039
SHA256

5250e8fe2801d05638a6bec3a2d0bdc7c116f74f0a321467b1fe1109ee7665d7
SHA512

adb96a4f8f4d9d70e116bf369627329bfdd36d475661294c7ffa88e068321ade67dd0a47819cec5edd916d4942c0f14caacd47ebf77a3e902cc49a6095445c98
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cbRr:NABF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/2028-42-0x00007FF749510000-0x00007FF749902000-memory.dmp	xmrig
behavioral2/memory/3688-41-0x00007FF6CDF80000-0x00007FF6CE372000-memory.dmp	xmrig
behavioral2/memory/4112-53-0x00007FF623D80000-0x00007FF624172000-memory.dmp	xmrig
behavioral2/memory/2964-38-0x00007FF73FB90000-0x00007FF73FF82000-memory.dmp	xmrig
behavioral2/memory/3956-493-0x00007FF6454A0000-0x00007FF645892000-memory.dmp	xmrig
behavioral2/memory/1680-507-0x00007FF67DDD0000-0x00007FF67E1C2000-memory.dmp	xmrig
behavioral2/memory/4820-517-0x00007FF6EFA60000-0x00007FF6EFE52000-memory.dmp	xmrig
behavioral2/memory/1648-526-0x00007FF60DF50000-0x00007FF60E342000-memory.dmp	xmrig
behavioral2/memory/3896-541-0x00007FF6A3040000-0x00007FF6A3432000-memory.dmp	xmrig
behavioral2/memory/3628-532-0x00007FF7BFF50000-0x00007FF7C0342000-memory.dmp	xmrig
behavioral2/memory/3568-540-0x00007FF70DD50000-0x00007FF70E142000-memory.dmp	xmrig
behavioral2/memory/2916-562-0x00007FF64F4D0000-0x00007FF64F8C2000-memory.dmp	xmrig
behavioral2/memory/232-574-0x00007FF650660000-0x00007FF650A52000-memory.dmp	xmrig
behavioral2/memory/3604-570-0x00007FF674E00000-0x00007FF6751F2000-memory.dmp	xmrig
behavioral2/memory/3428-569-0x00007FF7817F0000-0x00007FF781BE2000-memory.dmp	xmrig
behavioral2/memory/2440-556-0x00007FF6065C0000-0x00007FF6069B2000-memory.dmp	xmrig
behavioral2/memory/1408-545-0x00007FF6973D0000-0x00007FF6977C2000-memory.dmp	xmrig
behavioral2/memory/3688-1736-0x00007FF6CDF80000-0x00007FF6CE372000-memory.dmp	xmrig
behavioral2/memory/3896-1735-0x00007FF6A3040000-0x00007FF6A3432000-memory.dmp	xmrig
behavioral2/memory/2028-1732-0x00007FF749510000-0x00007FF749902000-memory.dmp	xmrig
behavioral2/memory/1680-1730-0x00007FF67DDD0000-0x00007FF67E1C2000-memory.dmp	xmrig
behavioral2/memory/944-1729-0x00007FF79D4A0000-0x00007FF79D892000-memory.dmp	xmrig
behavioral2/memory/1408-1728-0x00007FF6973D0000-0x00007FF6977C2000-memory.dmp	xmrig
behavioral2/memory/4820-1779-0x00007FF6EFA60000-0x00007FF6EFE52000-memory.dmp	xmrig
behavioral2/memory/3628-1766-0x00007FF7BFF50000-0x00007FF7C0342000-memory.dmp	xmrig
behavioral2/memory/2964-1764-0x00007FF73FB90000-0x00007FF73FF82000-memory.dmp	xmrig
behavioral2/memory/5008-1762-0x00007FF7DE5F0000-0x00007FF7DE9E2000-memory.dmp	xmrig
behavioral2/memory/1648-1731-0x00007FF60DF50000-0x00007FF60E342000-memory.dmp	xmrig
behavioral2/memory/3428-1850-0x00007FF7817F0000-0x00007FF781BE2000-memory.dmp	xmrig
behavioral2/memory/1460-2402-0x00007FF67C3D0000-0x00007FF67C7C2000-memory.dmp	xmrig
behavioral2/memory/232-1865-0x00007FF650660000-0x00007FF650A52000-memory.dmp	xmrig
behavioral2/memory/3604-1856-0x00007FF674E00000-0x00007FF6751F2000-memory.dmp	xmrig
behavioral2/memory/2916-1849-0x00007FF64F4D0000-0x00007FF64F8C2000-memory.dmp	xmrig
behavioral2/memory/2440-1825-0x00007FF6065C0000-0x00007FF6069B2000-memory.dmp	xmrig
behavioral2/memory/4112-1776-0x00007FF623D80000-0x00007FF624172000-memory.dmp	xmrig
behavioral2/memory/3568-1774-0x00007FF70DD50000-0x00007FF70E142000-memory.dmp	xmrig
behavioral2/memory/1444-1773-0x00007FF798760000-0x00007FF798B52000-memory.dmp	xmrig
behavioral2/memory/3956-1769-0x00007FF6454A0000-0x00007FF645892000-memory.dmp	xmrig
behavioral2/memory/652-3474-0x00007FF7C9430000-0x00007FF7C9822000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	568	powershell.exe
9	568	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
5008	RhSEDKw.exe
2964	WsmkGcG.exe
3688	OHutIDn.exe
2028	tUaxXVm.exe
944	IhaghgB.exe
4112	bAYwHiT.exe
1460	cUCjvUV.exe
1444	OVwLiXb.exe
3956	tuEbUbf.exe
1680	RPDEQjo.exe
4820	XXFYqmq.exe
1648	qKHCozV.exe
3628	mZBtOhB.exe
3568	HOREwcO.exe
3896	dHnYCEM.exe
1408	YIJrnBW.exe
2440	mMZhrVt.exe
2916	AncbhMx.exe
3428	RgiBqhm.exe
3604	njPkNWb.exe
232	ureSxMk.exe
2120	RebfcsO.exe
1484	IczNyXC.exe
1768	UAJFFhd.exe
1288	hQnuJuN.exe
3708	FGaLhOx.exe
1708	MzPNcQO.exe
1568	xNYFfTY.exe
4992	AWpBNZb.exe
4144	INXdnGd.exe
2008	RXdMBNy.exe
4292	waweaKa.exe
640	LgpqSCm.exe
4216	ebuFmwQ.exe
384	HxIBOtw.exe
4896	HOIkJGa.exe
4968	GwdBCui.exe
4576	AwOcorU.exe
1300	gustmNJ.exe
4548	ORFFzoL.exe
3540	izBTlkU.exe
3456	jHKZqJD.exe
4180	vEqlUor.exe
4928	EpMgNXD.exe
740	zOySAJj.exe
3112	oTXlwCz.exe
4128	UMmVJHB.exe
4248	XxVjETo.exe
3260	EJKyMgy.exe
912	WBnJsJS.exe
3760	RCHvhgq.exe
1616	GlgDprC.exe
3632	jAbtwhU.exe
2944	CwuGPZV.exe
3100	Ocehybb.exe
4300	hEgUGSw.exe
220	BlDikMd.exe
5140	tLQEDiL.exe
5164	CWGWCZi.exe
5184	LVgjahJ.exe
5208	WacIXlX.exe
5236	OpdBfve.exe
5264	IfyvCbZ.exe
5292	mWMztEg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/652-0-0x00007FF7C9430000-0x00007FF7C9822000-memory.dmp	upx
behavioral2/files/0x000b000000023214-5.dat	upx
behavioral2/memory/5008-7-0x00007FF7DE5F0000-0x00007FF7DE9E2000-memory.dmp	upx
behavioral2/files/0x000800000002323d-12.dat	upx
behavioral2/files/0x000700000002323e-10.dat	upx
behavioral2/files/0x000700000002323f-20.dat	upx
behavioral2/files/0x000800000002323b-25.dat	upx
behavioral2/memory/2028-42-0x00007FF749510000-0x00007FF749902000-memory.dmp	upx
behavioral2/memory/944-43-0x00007FF79D4A0000-0x00007FF79D892000-memory.dmp	upx
behavioral2/memory/3688-41-0x00007FF6CDF80000-0x00007FF6CE372000-memory.dmp	upx
behavioral2/files/0x0007000000023240-48.dat	upx
behavioral2/files/0x0008000000023241-52.dat	upx
behavioral2/memory/4112-53-0x00007FF623D80000-0x00007FF624172000-memory.dmp	upx
behavioral2/memory/1460-58-0x00007FF67C3D0000-0x00007FF67C7C2000-memory.dmp	upx
behavioral2/files/0x0007000000023243-62.dat	upx
behavioral2/files/0x0007000000023244-69.dat	upx
behavioral2/files/0x0007000000023245-78.dat	upx
behavioral2/files/0x0007000000023246-82.dat	upx
behavioral2/files/0x0007000000023247-85.dat	upx
behavioral2/files/0x0007000000023249-95.dat	upx
behavioral2/files/0x000700000002324a-100.dat	upx
behavioral2/files/0x000700000002324b-105.dat	upx
behavioral2/files/0x000700000002324c-110.dat	upx
behavioral2/files/0x000700000002324f-125.dat	upx
behavioral2/files/0x0007000000023251-135.dat	upx
behavioral2/files/0x0007000000023255-155.dat	upx
behavioral2/files/0x0007000000023257-167.dat	upx
behavioral2/files/0x000700000002325b-182.dat	upx
behavioral2/files/0x000700000002325a-179.dat	upx
behavioral2/files/0x0007000000023259-177.dat	upx
behavioral2/files/0x0007000000023258-173.dat	upx
behavioral2/files/0x0007000000023256-163.dat	upx
behavioral2/files/0x0007000000023254-150.dat	upx
behavioral2/files/0x0007000000023253-145.dat	upx
behavioral2/files/0x0007000000023252-140.dat	upx
behavioral2/files/0x0007000000023250-130.dat	upx
behavioral2/files/0x000700000002324e-120.dat	upx
behavioral2/files/0x000700000002324d-115.dat	upx
behavioral2/files/0x0007000000023248-90.dat	upx
behavioral2/files/0x0008000000023242-63.dat	upx
behavioral2/memory/1444-61-0x00007FF798760000-0x00007FF798B52000-memory.dmp	upx
behavioral2/memory/2964-38-0x00007FF73FB90000-0x00007FF73FF82000-memory.dmp	upx
behavioral2/memory/3956-493-0x00007FF6454A0000-0x00007FF645892000-memory.dmp	upx
behavioral2/memory/1680-507-0x00007FF67DDD0000-0x00007FF67E1C2000-memory.dmp	upx
behavioral2/memory/4820-517-0x00007FF6EFA60000-0x00007FF6EFE52000-memory.dmp	upx
behavioral2/memory/1648-526-0x00007FF60DF50000-0x00007FF60E342000-memory.dmp	upx
behavioral2/memory/3896-541-0x00007FF6A3040000-0x00007FF6A3432000-memory.dmp	upx
behavioral2/memory/3628-532-0x00007FF7BFF50000-0x00007FF7C0342000-memory.dmp	upx
behavioral2/memory/3568-540-0x00007FF70DD50000-0x00007FF70E142000-memory.dmp	upx
behavioral2/memory/2916-562-0x00007FF64F4D0000-0x00007FF64F8C2000-memory.dmp	upx
behavioral2/memory/232-574-0x00007FF650660000-0x00007FF650A52000-memory.dmp	upx
behavioral2/memory/3604-570-0x00007FF674E00000-0x00007FF6751F2000-memory.dmp	upx
behavioral2/memory/3428-569-0x00007FF7817F0000-0x00007FF781BE2000-memory.dmp	upx
behavioral2/memory/2440-556-0x00007FF6065C0000-0x00007FF6069B2000-memory.dmp	upx
behavioral2/memory/1408-545-0x00007FF6973D0000-0x00007FF6977C2000-memory.dmp	upx
behavioral2/memory/3688-1736-0x00007FF6CDF80000-0x00007FF6CE372000-memory.dmp	upx
behavioral2/memory/3896-1735-0x00007FF6A3040000-0x00007FF6A3432000-memory.dmp	upx
behavioral2/memory/2028-1732-0x00007FF749510000-0x00007FF749902000-memory.dmp	upx
behavioral2/memory/1680-1730-0x00007FF67DDD0000-0x00007FF67E1C2000-memory.dmp	upx
behavioral2/memory/944-1729-0x00007FF79D4A0000-0x00007FF79D892000-memory.dmp	upx
behavioral2/memory/1408-1728-0x00007FF6973D0000-0x00007FF6977C2000-memory.dmp	upx
behavioral2/memory/4820-1779-0x00007FF6EFA60000-0x00007FF6EFE52000-memory.dmp	upx
behavioral2/memory/3628-1766-0x00007FF7BFF50000-0x00007FF7C0342000-memory.dmp	upx
behavioral2/memory/2964-1764-0x00007FF73FB90000-0x00007FF73FF82000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iTQucpm.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\oGOXZOH.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\CWlluuY.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\fEgKOnB.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\huEyxyI.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\pGfARbC.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\NxAkAFX.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\QotZHpN.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\BUZJQBn.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\nYPXTZh.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\wPdnJrT.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\dzLMCqI.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\jKEkMRM.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\ioEEGfB.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\KYamEAu.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\oNwsYCV.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\iwAdEJR.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\JNLvmqX.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\nRyGAHN.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\vsFYRfX.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\NVtRJiG.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\dARLiDN.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\GDNyOVb.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\dhWPcaB.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\rPCwZtC.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\QXTOSnA.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\AuyfczT.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\NHfHywe.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\xVhnejV.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\rQgGnOu.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\ZhtuVwQ.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\TyVxCIO.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\pRlkrhs.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\CWIBahw.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\NixHAAJ.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\uOWGfSa.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\AaGUDec.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\MRaoidG.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\QwUPPdK.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\eALmnoW.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\MahHhfx.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\WyfDWsb.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\TEZEjNG.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\CqMLQmT.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\sbCDYsS.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\xfjFzKZ.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\MjnCGTB.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\dlimtmx.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\rQQmFfc.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\bhwSufA.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\fLnYmxl.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\XdETpIo.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\tnnpGar.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\nbPapDj.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\bAYwHiT.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\LitIRgO.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\SEjMDqG.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\IgZwCkM.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\xVRsGLI.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\NRoTRxq.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\ZPtxkfZ.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\ugmTzWj.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\oSOukLk.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\DlZiBNe.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
568	powershell.exe
568	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
Token: SeDebugPrivilege	568	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 568	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	91
PID 652 wrote to memory of 568	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	91
PID 652 wrote to memory of 5008	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	92
PID 652 wrote to memory of 5008	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	92
PID 652 wrote to memory of 2964	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	93
PID 652 wrote to memory of 2964	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	93
PID 652 wrote to memory of 3688	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	94
PID 652 wrote to memory of 3688	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	94
PID 652 wrote to memory of 2028	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	95
PID 652 wrote to memory of 2028	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	95
PID 652 wrote to memory of 944	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	96
PID 652 wrote to memory of 944	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	96
PID 652 wrote to memory of 4112	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	97
PID 652 wrote to memory of 4112	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	97
PID 652 wrote to memory of 1460	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	98
PID 652 wrote to memory of 1460	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	98
PID 652 wrote to memory of 1444	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	99
PID 652 wrote to memory of 1444	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	99
PID 652 wrote to memory of 3956	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	100
PID 652 wrote to memory of 3956	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	100
PID 652 wrote to memory of 1680	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	101
PID 652 wrote to memory of 1680	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	101
PID 652 wrote to memory of 4820	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	102
PID 652 wrote to memory of 4820	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	102
PID 652 wrote to memory of 1648	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	103
PID 652 wrote to memory of 1648	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	103
PID 652 wrote to memory of 3628	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	104
PID 652 wrote to memory of 3628	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	104
PID 652 wrote to memory of 3568	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	105
PID 652 wrote to memory of 3568	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	105
PID 652 wrote to memory of 3896	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	106
PID 652 wrote to memory of 3896	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	106
PID 652 wrote to memory of 1408	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	107
PID 652 wrote to memory of 1408	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	107
PID 652 wrote to memory of 2440	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	108
PID 652 wrote to memory of 2440	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	108
PID 652 wrote to memory of 2916	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	109
PID 652 wrote to memory of 2916	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	109
PID 652 wrote to memory of 3428	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	110
PID 652 wrote to memory of 3428	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	110
PID 652 wrote to memory of 3604	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	111
PID 652 wrote to memory of 3604	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	111
PID 652 wrote to memory of 232	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	112
PID 652 wrote to memory of 232	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	112
PID 652 wrote to memory of 2120	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	113
PID 652 wrote to memory of 2120	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	113
PID 652 wrote to memory of 1484	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	114
PID 652 wrote to memory of 1484	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	114
PID 652 wrote to memory of 1768	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	115
PID 652 wrote to memory of 1768	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	115
PID 652 wrote to memory of 1288	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	116
PID 652 wrote to memory of 1288	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	116
PID 652 wrote to memory of 3708	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	117
PID 652 wrote to memory of 3708	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	117
PID 652 wrote to memory of 1708	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	118
PID 652 wrote to memory of 1708	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	118
PID 652 wrote to memory of 1568	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	119
PID 652 wrote to memory of 1568	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	119
PID 652 wrote to memory of 4992	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	120
PID 652 wrote to memory of 4992	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	120
PID 652 wrote to memory of 4144	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	121
PID 652 wrote to memory of 4144	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	121
PID 652 wrote to memory of 2008	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	122
PID 652 wrote to memory of 2008	652	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:568
- C:\Windows\System\RhSEDKw.exe
  C:\Windows\System\RhSEDKw.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\WsmkGcG.exe
  C:\Windows\System\WsmkGcG.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\OHutIDn.exe
  C:\Windows\System\OHutIDn.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\tUaxXVm.exe
  C:\Windows\System\tUaxXVm.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\IhaghgB.exe
  C:\Windows\System\IhaghgB.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\bAYwHiT.exe
  C:\Windows\System\bAYwHiT.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\cUCjvUV.exe
  C:\Windows\System\cUCjvUV.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\OVwLiXb.exe
  C:\Windows\System\OVwLiXb.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\tuEbUbf.exe
  C:\Windows\System\tuEbUbf.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\RPDEQjo.exe
  C:\Windows\System\RPDEQjo.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\XXFYqmq.exe
  C:\Windows\System\XXFYqmq.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\qKHCozV.exe
  C:\Windows\System\qKHCozV.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\mZBtOhB.exe
  C:\Windows\System\mZBtOhB.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\HOREwcO.exe
  C:\Windows\System\HOREwcO.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\dHnYCEM.exe
  C:\Windows\System\dHnYCEM.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\YIJrnBW.exe
  C:\Windows\System\YIJrnBW.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\mMZhrVt.exe
  C:\Windows\System\mMZhrVt.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\AncbhMx.exe
  C:\Windows\System\AncbhMx.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\RgiBqhm.exe
  C:\Windows\System\RgiBqhm.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\njPkNWb.exe
  C:\Windows\System\njPkNWb.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\ureSxMk.exe
  C:\Windows\System\ureSxMk.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\RebfcsO.exe
  C:\Windows\System\RebfcsO.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\IczNyXC.exe
  C:\Windows\System\IczNyXC.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\UAJFFhd.exe
  C:\Windows\System\UAJFFhd.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\hQnuJuN.exe
  C:\Windows\System\hQnuJuN.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\FGaLhOx.exe
  C:\Windows\System\FGaLhOx.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\MzPNcQO.exe
  C:\Windows\System\MzPNcQO.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\xNYFfTY.exe
  C:\Windows\System\xNYFfTY.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\AWpBNZb.exe
  C:\Windows\System\AWpBNZb.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\INXdnGd.exe
  C:\Windows\System\INXdnGd.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\RXdMBNy.exe
  C:\Windows\System\RXdMBNy.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\waweaKa.exe
  C:\Windows\System\waweaKa.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\LgpqSCm.exe
  C:\Windows\System\LgpqSCm.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\ebuFmwQ.exe
  C:\Windows\System\ebuFmwQ.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\HxIBOtw.exe
  C:\Windows\System\HxIBOtw.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\HOIkJGa.exe
  C:\Windows\System\HOIkJGa.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\GwdBCui.exe
  C:\Windows\System\GwdBCui.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\AwOcorU.exe
  C:\Windows\System\AwOcorU.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\gustmNJ.exe
  C:\Windows\System\gustmNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\ORFFzoL.exe
  C:\Windows\System\ORFFzoL.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\izBTlkU.exe
  C:\Windows\System\izBTlkU.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\jHKZqJD.exe
  C:\Windows\System\jHKZqJD.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\vEqlUor.exe
  C:\Windows\System\vEqlUor.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\EpMgNXD.exe
  C:\Windows\System\EpMgNXD.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\zOySAJj.exe
  C:\Windows\System\zOySAJj.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\oTXlwCz.exe
  C:\Windows\System\oTXlwCz.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\UMmVJHB.exe
  C:\Windows\System\UMmVJHB.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\XxVjETo.exe
  C:\Windows\System\XxVjETo.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\EJKyMgy.exe
  C:\Windows\System\EJKyMgy.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\WBnJsJS.exe
  C:\Windows\System\WBnJsJS.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\RCHvhgq.exe
  C:\Windows\System\RCHvhgq.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\GlgDprC.exe
  C:\Windows\System\GlgDprC.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\jAbtwhU.exe
  C:\Windows\System\jAbtwhU.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\CwuGPZV.exe
  C:\Windows\System\CwuGPZV.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\Ocehybb.exe
  C:\Windows\System\Ocehybb.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\hEgUGSw.exe
  C:\Windows\System\hEgUGSw.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\BlDikMd.exe
  C:\Windows\System\BlDikMd.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\tLQEDiL.exe
  C:\Windows\System\tLQEDiL.exe
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\System\CWGWCZi.exe
  C:\Windows\System\CWGWCZi.exe
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Windows\System\LVgjahJ.exe
  C:\Windows\System\LVgjahJ.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\WacIXlX.exe
  C:\Windows\System\WacIXlX.exe
  2⤵
  - Executes dropped EXE
  PID:5208
- C:\Windows\System\OpdBfve.exe
  C:\Windows\System\OpdBfve.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\IfyvCbZ.exe
  C:\Windows\System\IfyvCbZ.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System\mWMztEg.exe
  C:\Windows\System\mWMztEg.exe
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\Windows\System\JMpKqdy.exe
  C:\Windows\System\JMpKqdy.exe
  2⤵
  PID:5320
- C:\Windows\System\bhwSufA.exe
  C:\Windows\System\bhwSufA.exe
  2⤵
  PID:5348
- C:\Windows\System\IyocEqi.exe
  C:\Windows\System\IyocEqi.exe
  2⤵
  PID:5380
- C:\Windows\System\ZqcpnfY.exe
  C:\Windows\System\ZqcpnfY.exe
  2⤵
  PID:5408
- C:\Windows\System\KhbibUE.exe
  C:\Windows\System\KhbibUE.exe
  2⤵
  PID:5436
- C:\Windows\System\lcwmFIV.exe
  C:\Windows\System\lcwmFIV.exe
  2⤵
  PID:5468
- C:\Windows\System\GzbDZMn.exe
  C:\Windows\System\GzbDZMn.exe
  2⤵
  PID:5496
- C:\Windows\System\bodkmxU.exe
  C:\Windows\System\bodkmxU.exe
  2⤵
  PID:5528
- C:\Windows\System\rrFAnET.exe
  C:\Windows\System\rrFAnET.exe
  2⤵
  PID:5560
- C:\Windows\System\BzDcmqt.exe
  C:\Windows\System\BzDcmqt.exe
  2⤵
  PID:5584
- C:\Windows\System\CsydRcl.exe
  C:\Windows\System\CsydRcl.exe
  2⤵
  PID:5616
- C:\Windows\System\VpVmpiC.exe
  C:\Windows\System\VpVmpiC.exe
  2⤵
  PID:5640
- C:\Windows\System\MJIATzG.exe
  C:\Windows\System\MJIATzG.exe
  2⤵
  PID:5668
- C:\Windows\System\quWscIm.exe
  C:\Windows\System\quWscIm.exe
  2⤵
  PID:5696
- C:\Windows\System\aBUZqQK.exe
  C:\Windows\System\aBUZqQK.exe
  2⤵
  PID:5720
- C:\Windows\System\niMfDLd.exe
  C:\Windows\System\niMfDLd.exe
  2⤵
  PID:5752
- C:\Windows\System\reiefhe.exe
  C:\Windows\System\reiefhe.exe
  2⤵
  PID:5780
- C:\Windows\System\eVdxKXH.exe
  C:\Windows\System\eVdxKXH.exe
  2⤵
  PID:5808
- C:\Windows\System\WZEnegi.exe
  C:\Windows\System\WZEnegi.exe
  2⤵
  PID:5836
- C:\Windows\System\eZZBLCt.exe
  C:\Windows\System\eZZBLCt.exe
  2⤵
  PID:5864
- C:\Windows\System\cdEYxSI.exe
  C:\Windows\System\cdEYxSI.exe
  2⤵
  PID:5904
- C:\Windows\System\MAFgTrH.exe
  C:\Windows\System\MAFgTrH.exe
  2⤵
  PID:5932
- C:\Windows\System\AazojNT.exe
  C:\Windows\System\AazojNT.exe
  2⤵
  PID:5952
- C:\Windows\System\yvUvOxZ.exe
  C:\Windows\System\yvUvOxZ.exe
  2⤵
  PID:5980
- C:\Windows\System\YXHiCwF.exe
  C:\Windows\System\YXHiCwF.exe
  2⤵
  PID:6004
- C:\Windows\System\LitIRgO.exe
  C:\Windows\System\LitIRgO.exe
  2⤵
  PID:6032
- C:\Windows\System\BlMMSVl.exe
  C:\Windows\System\BlMMSVl.exe
  2⤵
  PID:6060
- C:\Windows\System\hHtbGvI.exe
  C:\Windows\System\hHtbGvI.exe
  2⤵
  PID:6088
- C:\Windows\System\zjvtYiX.exe
  C:\Windows\System\zjvtYiX.exe
  2⤵
  PID:6116
- C:\Windows\System\shHFVDb.exe
  C:\Windows\System\shHFVDb.exe
  2⤵
  PID:4632
- C:\Windows\System\qfoTGGK.exe
  C:\Windows\System\qfoTGGK.exe
  2⤵
  PID:2252
- C:\Windows\System\rQgGnOu.exe
  C:\Windows\System\rQgGnOu.exe
  2⤵
  PID:1844
- C:\Windows\System\WyfDWsb.exe
  C:\Windows\System\WyfDWsb.exe
  2⤵
  PID:5132
- C:\Windows\System\DDvfDcz.exe
  C:\Windows\System\DDvfDcz.exe
  2⤵
  PID:5196
- C:\Windows\System\tzlkkYj.exe
  C:\Windows\System\tzlkkYj.exe
  2⤵
  PID:5252
- C:\Windows\System\PvkUkDH.exe
  C:\Windows\System\PvkUkDH.exe
  2⤵
  PID:5308
- C:\Windows\System\KYamEAu.exe
  C:\Windows\System\KYamEAu.exe
  2⤵
  PID:5344
- C:\Windows\System\eScuOlt.exe
  C:\Windows\System\eScuOlt.exe
  2⤵
  PID:4064
- C:\Windows\System\zdeBraI.exe
  C:\Windows\System\zdeBraI.exe
  2⤵
  PID:5600
- C:\Windows\System\KPpJPdo.exe
  C:\Windows\System\KPpJPdo.exe
  2⤵
  PID:5768
- C:\Windows\System\kYuQydR.exe
  C:\Windows\System\kYuQydR.exe
  2⤵
  PID:5800
- C:\Windows\System\pDyzLqO.exe
  C:\Windows\System\pDyzLqO.exe
  2⤵
  PID:3932
- C:\Windows\System\wWgTLgr.exe
  C:\Windows\System\wWgTLgr.exe
  2⤵
  PID:5860
- C:\Windows\System\NwdEbPx.exe
  C:\Windows\System\NwdEbPx.exe
  2⤵
  PID:5900
- C:\Windows\System\RQEVaHk.exe
  C:\Windows\System\RQEVaHk.exe
  2⤵
  PID:4480
- C:\Windows\System\EvrWWqD.exe
  C:\Windows\System\EvrWWqD.exe
  2⤵
  PID:5972
- C:\Windows\System\BUVRJee.exe
  C:\Windows\System\BUVRJee.exe
  2⤵
  PID:6104
- C:\Windows\System\EEctors.exe
  C:\Windows\System\EEctors.exe
  2⤵
  PID:2832
- C:\Windows\System\MVBFRXJ.exe
  C:\Windows\System\MVBFRXJ.exe
  2⤵
  PID:4428
- C:\Windows\System\YKmjLIv.exe
  C:\Windows\System\YKmjLIv.exe
  2⤵
  PID:4636
- C:\Windows\System\eqAhesS.exe
  C:\Windows\System\eqAhesS.exe
  2⤵
  PID:4920
- C:\Windows\System\wpYuIqH.exe
  C:\Windows\System\wpYuIqH.exe
  2⤵
  PID:664
- C:\Windows\System\zwipXhL.exe
  C:\Windows\System\zwipXhL.exe
  2⤵
  PID:5228
- C:\Windows\System\cAShSbg.exe
  C:\Windows\System\cAShSbg.exe
  2⤵
  PID:4504
- C:\Windows\System\GqOpZWd.exe
  C:\Windows\System\GqOpZWd.exe
  2⤵
  PID:5368
- C:\Windows\System\HOeRQnU.exe
  C:\Windows\System\HOeRQnU.exe
  2⤵
  PID:4804
- C:\Windows\System\itzjXHd.exe
  C:\Windows\System\itzjXHd.exe
  2⤵
  PID:4912
- C:\Windows\System\RxgfCTK.exe
  C:\Windows\System\RxgfCTK.exe
  2⤵
  PID:4432
- C:\Windows\System\xBYvQgC.exe
  C:\Windows\System\xBYvQgC.exe
  2⤵
  PID:436
- C:\Windows\System\FXYuzGm.exe
  C:\Windows\System\FXYuzGm.exe
  2⤵
  PID:5660
- C:\Windows\System\BNknzGv.exe
  C:\Windows\System\BNknzGv.exe
  2⤵
  PID:5548
- C:\Windows\System\QotZHpN.exe
  C:\Windows\System\QotZHpN.exe
  2⤵
  PID:5856
- C:\Windows\System\ltXAbDE.exe
  C:\Windows\System\ltXAbDE.exe
  2⤵
  PID:5944
- C:\Windows\System\zMkwxOW.exe
  C:\Windows\System\zMkwxOW.exe
  2⤵
  PID:5692
- C:\Windows\System\sskGeKW.exe
  C:\Windows\System\sskGeKW.exe
  2⤵
  PID:5732
- C:\Windows\System\cpEzNnn.exe
  C:\Windows\System\cpEzNnn.exe
  2⤵
  PID:6080
- C:\Windows\System\PTPHsIx.exe
  C:\Windows\System\PTPHsIx.exe
  2⤵
  PID:4120
- C:\Windows\System\kFGPHyX.exe
  C:\Windows\System\kFGPHyX.exe
  2⤵
  PID:1244
- C:\Windows\System\JWlUxUq.exe
  C:\Windows\System\JWlUxUq.exe
  2⤵
  PID:5160
- C:\Windows\System\alcyLRd.exe
  C:\Windows\System\alcyLRd.exe
  2⤵
  PID:5488
- C:\Windows\System\KecAVHW.exe
  C:\Windows\System\KecAVHW.exe
  2⤵
  PID:5580
- C:\Windows\System\oNwsYCV.exe
  C:\Windows\System\oNwsYCV.exe
  2⤵
  PID:1256
- C:\Windows\System\bfJryXx.exe
  C:\Windows\System\bfJryXx.exe
  2⤵
  PID:2248
- C:\Windows\System\iwYbOFN.exe
  C:\Windows\System\iwYbOFN.exe
  2⤵
  PID:6164
- C:\Windows\System\JGBhUxj.exe
  C:\Windows\System\JGBhUxj.exe
  2⤵
  PID:6268
- C:\Windows\System\bLqyxPw.exe
  C:\Windows\System\bLqyxPw.exe
  2⤵
  PID:6292
- C:\Windows\System\GDNyOVb.exe
  C:\Windows\System\GDNyOVb.exe
  2⤵
  PID:6312
- C:\Windows\System\LunSVVD.exe
  C:\Windows\System\LunSVVD.exe
  2⤵
  PID:6336
- C:\Windows\System\VSFnryp.exe
  C:\Windows\System\VSFnryp.exe
  2⤵
  PID:6376
- C:\Windows\System\TbsLuaf.exe
  C:\Windows\System\TbsLuaf.exe
  2⤵
  PID:6408
- C:\Windows\System\XUDkMuQ.exe
  C:\Windows\System\XUDkMuQ.exe
  2⤵
  PID:6432
- C:\Windows\System\NhDfbtg.exe
  C:\Windows\System\NhDfbtg.exe
  2⤵
  PID:6456
- C:\Windows\System\MZfwhQd.exe
  C:\Windows\System\MZfwhQd.exe
  2⤵
  PID:6536
- C:\Windows\System\wMzzWYM.exe
  C:\Windows\System\wMzzWYM.exe
  2⤵
  PID:6560
- C:\Windows\System\TijiXgQ.exe
  C:\Windows\System\TijiXgQ.exe
  2⤵
  PID:6592
- C:\Windows\System\qnrejYh.exe
  C:\Windows\System\qnrejYh.exe
  2⤵
  PID:6624
- C:\Windows\System\OsDUNYK.exe
  C:\Windows\System\OsDUNYK.exe
  2⤵
  PID:6676
- C:\Windows\System\UttnyqN.exe
  C:\Windows\System\UttnyqN.exe
  2⤵
  PID:6712
- C:\Windows\System\iXzQclq.exe
  C:\Windows\System\iXzQclq.exe
  2⤵
  PID:6760
- C:\Windows\System\WVyNAnn.exe
  C:\Windows\System\WVyNAnn.exe
  2⤵
  PID:6776
- C:\Windows\System\fNyyTWT.exe
  C:\Windows\System\fNyyTWT.exe
  2⤵
  PID:6792
- C:\Windows\System\RpxjVOu.exe
  C:\Windows\System\RpxjVOu.exe
  2⤵
  PID:6812
- C:\Windows\System\qxSYBeH.exe
  C:\Windows\System\qxSYBeH.exe
  2⤵
  PID:6872
- C:\Windows\System\mQuiUqI.exe
  C:\Windows\System\mQuiUqI.exe
  2⤵
  PID:6904
- C:\Windows\System\CHLHUwU.exe
  C:\Windows\System\CHLHUwU.exe
  2⤵
  PID:6940
- C:\Windows\System\bAdBrzP.exe
  C:\Windows\System\bAdBrzP.exe
  2⤵
  PID:6956
- C:\Windows\System\hIbdiUe.exe
  C:\Windows\System\hIbdiUe.exe
  2⤵
  PID:6980
- C:\Windows\System\NGFfHMJ.exe
  C:\Windows\System\NGFfHMJ.exe
  2⤵
  PID:7004
- C:\Windows\System\YXTywnR.exe
  C:\Windows\System\YXTywnR.exe
  2⤵
  PID:7032
- C:\Windows\System\djgItdd.exe
  C:\Windows\System\djgItdd.exe
  2⤵
  PID:7052
- C:\Windows\System\WHtpZWK.exe
  C:\Windows\System\WHtpZWK.exe
  2⤵
  PID:7100
- C:\Windows\System\yZKsFcP.exe
  C:\Windows\System\yZKsFcP.exe
  2⤵
  PID:7136
- C:\Windows\System\AsnDFmI.exe
  C:\Windows\System\AsnDFmI.exe
  2⤵
  PID:7152
- C:\Windows\System\PHmMLzt.exe
  C:\Windows\System\PHmMLzt.exe
  2⤵
  PID:2936
- C:\Windows\System\OkfjXBb.exe
  C:\Windows\System\OkfjXBb.exe
  2⤵
  PID:6172
- C:\Windows\System\gZRDGPQ.exe
  C:\Windows\System\gZRDGPQ.exe
  2⤵
  PID:6156
- C:\Windows\System\yNHJcHn.exe
  C:\Windows\System\yNHJcHn.exe
  2⤵
  PID:6216
- C:\Windows\System\gLeozlA.exe
  C:\Windows\System\gLeozlA.exe
  2⤵
  PID:6236
- C:\Windows\System\zJXjLBs.exe
  C:\Windows\System\zJXjLBs.exe
  2⤵
  PID:6320
- C:\Windows\System\SMYMltF.exe
  C:\Windows\System\SMYMltF.exe
  2⤵
  PID:6416
- C:\Windows\System\scERmIM.exe
  C:\Windows\System\scERmIM.exe
  2⤵
  PID:6440
- C:\Windows\System\SupCuTJ.exe
  C:\Windows\System\SupCuTJ.exe
  2⤵
  PID:6488
- C:\Windows\System\vRouini.exe
  C:\Windows\System\vRouini.exe
  2⤵
  PID:6668
- C:\Windows\System\rpDwJDc.exe
  C:\Windows\System\rpDwJDc.exe
  2⤵
  PID:6752
- C:\Windows\System\MdSGbAN.exe
  C:\Windows\System\MdSGbAN.exe
  2⤵
  PID:6828
- C:\Windows\System\tCIjnTB.exe
  C:\Windows\System\tCIjnTB.exe
  2⤵
  PID:6848
- C:\Windows\System\MafAkpl.exe
  C:\Windows\System\MafAkpl.exe
  2⤵
  PID:6028
- C:\Windows\System\xNqSqbB.exe
  C:\Windows\System\xNqSqbB.exe
  2⤵
  PID:6476
- C:\Windows\System\uwCexLp.exe
  C:\Windows\System\uwCexLp.exe
  2⤵
  PID:6932
- C:\Windows\System\tfyNtvc.exe
  C:\Windows\System\tfyNtvc.exe
  2⤵
  PID:6972
- C:\Windows\System\hpbtPhP.exe
  C:\Windows\System\hpbtPhP.exe
  2⤵
  PID:7092
- C:\Windows\System\mJVmoIs.exe
  C:\Windows\System\mJVmoIs.exe
  2⤵
  PID:7120
- C:\Windows\System\BGDyYEi.exe
  C:\Windows\System\BGDyYEi.exe
  2⤵
  PID:5664
- C:\Windows\System\tlUOQGo.exe
  C:\Windows\System\tlUOQGo.exe
  2⤵
  PID:6468
- C:\Windows\System\hXOqmTr.exe
  C:\Windows\System\hXOqmTr.exe
  2⤵
  PID:6400
- C:\Windows\System\gYIPYhS.exe
  C:\Windows\System\gYIPYhS.exe
  2⤵
  PID:6612
- C:\Windows\System\wDAvVVR.exe
  C:\Windows\System\wDAvVVR.exe
  2⤵
  PID:6740
- C:\Windows\System\dWvxslZ.exe
  C:\Windows\System\dWvxslZ.exe
  2⤵
  PID:6532
- C:\Windows\System\lgjWqBv.exe
  C:\Windows\System\lgjWqBv.exe
  2⤵
  PID:6948
- C:\Windows\System\WOZnCDh.exe
  C:\Windows\System\WOZnCDh.exe
  2⤵
  PID:7132
- C:\Windows\System\mmMoqzv.exe
  C:\Windows\System\mmMoqzv.exe
  2⤵
  PID:6260
- C:\Windows\System\CzfSLkM.exe
  C:\Windows\System\CzfSLkM.exe
  2⤵
  PID:6684
- C:\Windows\System\ACRxVUo.exe
  C:\Windows\System\ACRxVUo.exe
  2⤵
  PID:7044
- C:\Windows\System\iRYbSbL.exe
  C:\Windows\System\iRYbSbL.exe
  2⤵
  PID:6196
- C:\Windows\System\haJitTn.exe
  C:\Windows\System\haJitTn.exe
  2⤵
  PID:6772
- C:\Windows\System\FYgzIkV.exe
  C:\Windows\System\FYgzIkV.exe
  2⤵
  PID:5572
- C:\Windows\System\RgaiKks.exe
  C:\Windows\System\RgaiKks.exe
  2⤵
  PID:7212
- C:\Windows\System\DvXlFEC.exe
  C:\Windows\System\DvXlFEC.exe
  2⤵
  PID:7228
- C:\Windows\System\tDeYBDR.exe
  C:\Windows\System\tDeYBDR.exe
  2⤵
  PID:7252
- C:\Windows\System\PumfvOY.exe
  C:\Windows\System\PumfvOY.exe
  2⤵
  PID:7268
- C:\Windows\System\xzjctPE.exe
  C:\Windows\System\xzjctPE.exe
  2⤵
  PID:7304
- C:\Windows\System\fLnYmxl.exe
  C:\Windows\System\fLnYmxl.exe
  2⤵
  PID:7352
- C:\Windows\System\zUqSgPG.exe
  C:\Windows\System\zUqSgPG.exe
  2⤵
  PID:7380
- C:\Windows\System\HZdZIMB.exe
  C:\Windows\System\HZdZIMB.exe
  2⤵
  PID:7404
- C:\Windows\System\xCUzeec.exe
  C:\Windows\System\xCUzeec.exe
  2⤵
  PID:7424
- C:\Windows\System\MDKcmwV.exe
  C:\Windows\System\MDKcmwV.exe
  2⤵
  PID:7444
- C:\Windows\System\KSxBPoc.exe
  C:\Windows\System\KSxBPoc.exe
  2⤵
  PID:7480
- C:\Windows\System\knAOysB.exe
  C:\Windows\System\knAOysB.exe
  2⤵
  PID:7512
- C:\Windows\System\OdxCUGk.exe
  C:\Windows\System\OdxCUGk.exe
  2⤵
  PID:7564
- C:\Windows\System\mxYRvUZ.exe
  C:\Windows\System\mxYRvUZ.exe
  2⤵
  PID:7584
- C:\Windows\System\LabarPu.exe
  C:\Windows\System\LabarPu.exe
  2⤵
  PID:7604
- C:\Windows\System\GgMrUTV.exe
  C:\Windows\System\GgMrUTV.exe
  2⤵
  PID:7628
- C:\Windows\System\yDmfREZ.exe
  C:\Windows\System\yDmfREZ.exe
  2⤵
  PID:7656
- C:\Windows\System\aidBFjv.exe
  C:\Windows\System\aidBFjv.exe
  2⤵
  PID:7680
- C:\Windows\System\lHWTjoh.exe
  C:\Windows\System\lHWTjoh.exe
  2⤵
  PID:7712
- C:\Windows\System\yrUzYmt.exe
  C:\Windows\System\yrUzYmt.exe
  2⤵
  PID:7732
- C:\Windows\System\WWyOFbj.exe
  C:\Windows\System\WWyOFbj.exe
  2⤵
  PID:7752
- C:\Windows\System\kHFEkjJ.exe
  C:\Windows\System\kHFEkjJ.exe
  2⤵
  PID:7804
- C:\Windows\System\RjNArCf.exe
  C:\Windows\System\RjNArCf.exe
  2⤵
  PID:7828
- C:\Windows\System\LyoItHf.exe
  C:\Windows\System\LyoItHf.exe
  2⤵
  PID:7844
- C:\Windows\System\disgzyC.exe
  C:\Windows\System\disgzyC.exe
  2⤵
  PID:7868
- C:\Windows\System\PStzCAT.exe
  C:\Windows\System\PStzCAT.exe
  2⤵
  PID:7892
- C:\Windows\System\jVHrQpb.exe
  C:\Windows\System\jVHrQpb.exe
  2⤵
  PID:7916
- C:\Windows\System\mscGGCs.exe
  C:\Windows\System\mscGGCs.exe
  2⤵
  PID:7968
- C:\Windows\System\sbCDYsS.exe
  C:\Windows\System\sbCDYsS.exe
  2⤵
  PID:7996
- C:\Windows\System\NTTPoeQ.exe
  C:\Windows\System\NTTPoeQ.exe
  2⤵
  PID:8016
- C:\Windows\System\FnbaTPy.exe
  C:\Windows\System\FnbaTPy.exe
  2⤵
  PID:8068
- C:\Windows\System\RGZbxhh.exe
  C:\Windows\System\RGZbxhh.exe
  2⤵
  PID:8088
- C:\Windows\System\tRbUdgf.exe
  C:\Windows\System\tRbUdgf.exe
  2⤵
  PID:8116
- C:\Windows\System\wOcbMgy.exe
  C:\Windows\System\wOcbMgy.exe
  2⤵
  PID:8152
- C:\Windows\System\YPIyZfn.exe
  C:\Windows\System\YPIyZfn.exe
  2⤵
  PID:8172
- C:\Windows\System\RmraWmV.exe
  C:\Windows\System\RmraWmV.exe
  2⤵
  PID:6988
- C:\Windows\System\uEJUHLB.exe
  C:\Windows\System\uEJUHLB.exe
  2⤵
  PID:7184
- C:\Windows\System\DcUzRVU.exe
  C:\Windows\System\DcUzRVU.exe
  2⤵
  PID:7260
- C:\Windows\System\JMiHMXz.exe
  C:\Windows\System\JMiHMXz.exe
  2⤵
  PID:7292
- C:\Windows\System\dVIWvot.exe
  C:\Windows\System\dVIWvot.exe
  2⤵
  PID:7344
- C:\Windows\System\dhWPcaB.exe
  C:\Windows\System\dhWPcaB.exe
  2⤵
  PID:7388
- C:\Windows\System\feNBxCB.exe
  C:\Windows\System\feNBxCB.exe
  2⤵
  PID:7420
- C:\Windows\System\nCnSFUE.exe
  C:\Windows\System\nCnSFUE.exe
  2⤵
  PID:7504
- C:\Windows\System\xfjFzKZ.exe
  C:\Windows\System\xfjFzKZ.exe
  2⤵
  PID:7532
- C:\Windows\System\NShKQaq.exe
  C:\Windows\System\NShKQaq.exe
  2⤵
  PID:7624
- C:\Windows\System\FNtUSNM.exe
  C:\Windows\System\FNtUSNM.exe
  2⤵
  PID:7664
- C:\Windows\System\kKqQiiW.exe
  C:\Windows\System\kKqQiiW.exe
  2⤵
  PID:7060
- C:\Windows\System\sVXExsD.exe
  C:\Windows\System\sVXExsD.exe
  2⤵
  PID:7776
- C:\Windows\System\KoyhHdv.exe
  C:\Windows\System\KoyhHdv.exe
  2⤵
  PID:7860
- C:\Windows\System\YzxLlai.exe
  C:\Windows\System\YzxLlai.exe
  2⤵
  PID:7976
- C:\Windows\System\xBHAfzi.exe
  C:\Windows\System\xBHAfzi.exe
  2⤵
  PID:8012
- C:\Windows\System\kTvTuLB.exe
  C:\Windows\System\kTvTuLB.exe
  2⤵
  PID:8040
- C:\Windows\System\dqKwnMK.exe
  C:\Windows\System\dqKwnMK.exe
  2⤵
  PID:8124
- C:\Windows\System\uLnJebh.exe
  C:\Windows\System\uLnJebh.exe
  2⤵
  PID:7192
- C:\Windows\System\mtkvwVb.exe
  C:\Windows\System\mtkvwVb.exe
  2⤵
  PID:8180
- C:\Windows\System\gtHNmPW.exe
  C:\Windows\System\gtHNmPW.exe
  2⤵
  PID:7372
- C:\Windows\System\RslYYGy.exe
  C:\Windows\System\RslYYGy.exe
  2⤵
  PID:7572
- C:\Windows\System\hWfmmLv.exe
  C:\Windows\System\hWfmmLv.exe
  2⤵
  PID:7600
- C:\Windows\System\FXzRSWZ.exe
  C:\Windows\System\FXzRSWZ.exe
  2⤵
  PID:7816
- C:\Windows\System\iKFCEkK.exe
  C:\Windows\System\iKFCEkK.exe
  2⤵
  PID:7676
- C:\Windows\System\fnDcIBh.exe
  C:\Windows\System\fnDcIBh.exe
  2⤵
  PID:8140
- C:\Windows\System\UyzVuku.exe
  C:\Windows\System\UyzVuku.exe
  2⤵
  PID:7224
- C:\Windows\System\bFhytyq.exe
  C:\Windows\System\bFhytyq.exe
  2⤵
  PID:8204
- C:\Windows\System\HtGZkKB.exe
  C:\Windows\System\HtGZkKB.exe
  2⤵
  PID:8224
- C:\Windows\System\eBObiTJ.exe
  C:\Windows\System\eBObiTJ.exe
  2⤵
  PID:8244
- C:\Windows\System\xBwiSnK.exe
  C:\Windows\System\xBwiSnK.exe
  2⤵
  PID:8264
- C:\Windows\System\iesaAkK.exe
  C:\Windows\System\iesaAkK.exe
  2⤵
  PID:8288
- C:\Windows\System\aNzKtTW.exe
  C:\Windows\System\aNzKtTW.exe
  2⤵
  PID:8308
- C:\Windows\System\QFfklRo.exe
  C:\Windows\System\QFfklRo.exe
  2⤵
  PID:8332
- C:\Windows\System\pfXocXd.exe
  C:\Windows\System\pfXocXd.exe
  2⤵
  PID:8356
- C:\Windows\System\APyGydU.exe
  C:\Windows\System\APyGydU.exe
  2⤵
  PID:8376
- C:\Windows\System\ASMDsXD.exe
  C:\Windows\System\ASMDsXD.exe
  2⤵
  PID:8396
- C:\Windows\System\SIwHUnV.exe
  C:\Windows\System\SIwHUnV.exe
  2⤵
  PID:8416
- C:\Windows\System\gnTkHPl.exe
  C:\Windows\System\gnTkHPl.exe
  2⤵
  PID:8436
- C:\Windows\System\ZKAkjUX.exe
  C:\Windows\System\ZKAkjUX.exe
  2⤵
  PID:8452
- C:\Windows\System\zShWbec.exe
  C:\Windows\System\zShWbec.exe
  2⤵
  PID:8476
- C:\Windows\System\uLYuTQX.exe
  C:\Windows\System\uLYuTQX.exe
  2⤵
  PID:8496
- C:\Windows\System\BUZJQBn.exe
  C:\Windows\System\BUZJQBn.exe
  2⤵
  PID:8520
- C:\Windows\System\qJKwKTc.exe
  C:\Windows\System\qJKwKTc.exe
  2⤵
  PID:8540
- C:\Windows\System\CScSJvw.exe
  C:\Windows\System\CScSJvw.exe
  2⤵
  PID:8560
- C:\Windows\System\NixHAAJ.exe
  C:\Windows\System\NixHAAJ.exe
  2⤵
  PID:8588
- C:\Windows\System\CFRkNyn.exe
  C:\Windows\System\CFRkNyn.exe
  2⤵
  PID:8632
- C:\Windows\System\XUXnpWC.exe
  C:\Windows\System\XUXnpWC.exe
  2⤵
  PID:8656
- C:\Windows\System\fFYFZVf.exe
  C:\Windows\System\fFYFZVf.exe
  2⤵
  PID:8676
- C:\Windows\System\roxjTxu.exe
  C:\Windows\System\roxjTxu.exe
  2⤵
  PID:8756
- C:\Windows\System\wnkrwqF.exe
  C:\Windows\System\wnkrwqF.exe
  2⤵
  PID:8776
- C:\Windows\System\vrPzKFw.exe
  C:\Windows\System\vrPzKFw.exe
  2⤵
  PID:8796
- C:\Windows\System\IWtVWYn.exe
  C:\Windows\System\IWtVWYn.exe
  2⤵
  PID:8820
- C:\Windows\System\JcIdIKI.exe
  C:\Windows\System\JcIdIKI.exe
  2⤵
  PID:8836
- C:\Windows\System\yljiHgc.exe
  C:\Windows\System\yljiHgc.exe
  2⤵
  PID:8864
- C:\Windows\System\XdETpIo.exe
  C:\Windows\System\XdETpIo.exe
  2⤵
  PID:8880
- C:\Windows\System\KdGIrpN.exe
  C:\Windows\System\KdGIrpN.exe
  2⤵
  PID:8904
- C:\Windows\System\qKslHzV.exe
  C:\Windows\System\qKslHzV.exe
  2⤵
  PID:8928
- C:\Windows\System\fewooWC.exe
  C:\Windows\System\fewooWC.exe
  2⤵
  PID:8956
- C:\Windows\System\MjnCGTB.exe
  C:\Windows\System\MjnCGTB.exe
  2⤵
  PID:8980
- C:\Windows\System\fmClxzt.exe
  C:\Windows\System\fmClxzt.exe
  2⤵
  PID:9192
- C:\Windows\System\sKCtgQF.exe
  C:\Windows\System\sKCtgQF.exe
  2⤵
  PID:7236
- C:\Windows\System\IVmStiY.exe
  C:\Windows\System\IVmStiY.exe
  2⤵
  PID:7296
- C:\Windows\System\DjbaYru.exe
  C:\Windows\System\DjbaYru.exe
  2⤵
  PID:7856
- C:\Windows\System\ZBXlbUk.exe
  C:\Windows\System\ZBXlbUk.exe
  2⤵
  PID:7908
- C:\Windows\System\SiXkpxZ.exe
  C:\Windows\System\SiXkpxZ.exe
  2⤵
  PID:8300
- C:\Windows\System\XlIQlEN.exe
  C:\Windows\System\XlIQlEN.exe
  2⤵
  PID:8328
- C:\Windows\System\pcgtShl.exe
  C:\Windows\System\pcgtShl.exe
  2⤵
  PID:8384
- C:\Windows\System\cPQtzYx.exe
  C:\Windows\System\cPQtzYx.exe
  2⤵
  PID:8240
- C:\Windows\System\VdUCXzp.exe
  C:\Windows\System\VdUCXzp.exe
  2⤵
  PID:7464
- C:\Windows\System\bhxMgBm.exe
  C:\Windows\System\bhxMgBm.exe
  2⤵
  PID:8472
- C:\Windows\System\OoJJHYy.exe
  C:\Windows\System\OoJJHYy.exe
  2⤵
  PID:8488
- C:\Windows\System\nMeUcvr.exe
  C:\Windows\System\nMeUcvr.exe
  2⤵
  PID:8556
- C:\Windows\System\HwFzXef.exe
  C:\Windows\System\HwFzXef.exe
  2⤵
  PID:8628
- C:\Windows\System\feILveM.exe
  C:\Windows\System\feILveM.exe
  2⤵
  PID:8672
- C:\Windows\System\VZpLjUd.exe
  C:\Windows\System\VZpLjUd.exe
  2⤵
  PID:8808
- C:\Windows\System\wOKDvdG.exe
  C:\Windows\System\wOKDvdG.exe
  2⤵
  PID:8832
- C:\Windows\System\uQcpoiE.exe
  C:\Windows\System\uQcpoiE.exe
  2⤵
  PID:8860
- C:\Windows\System\TXSgRPg.exe
  C:\Windows\System\TXSgRPg.exe
  2⤵
  PID:8900
- C:\Windows\System\GPCGNbV.exe
  C:\Windows\System\GPCGNbV.exe
  2⤵
  PID:8648
- C:\Windows\System\eZqtxzz.exe
  C:\Windows\System\eZqtxzz.exe
  2⤵
  PID:8788
- C:\Windows\System\SYHNbhV.exe
  C:\Windows\System\SYHNbhV.exe
  2⤵
  PID:2728
- C:\Windows\System\QjZJBol.exe
  C:\Windows\System\QjZJBol.exe
  2⤵
  PID:9040
- C:\Windows\System\rLwgLgL.exe
  C:\Windows\System\rLwgLgL.exe
  2⤵
  PID:9072
- C:\Windows\System\rqsQSSE.exe
  C:\Windows\System\rqsQSSE.exe
  2⤵
  PID:8968
- C:\Windows\System\AdDjtFj.exe
  C:\Windows\System\AdDjtFj.exe
  2⤵
  PID:7960
- C:\Windows\System\gzYlADs.exe
  C:\Windows\System\gzYlADs.exe
  2⤵
  PID:8284
- C:\Windows\System\abrVNNq.exe
  C:\Windows\System\abrVNNq.exe
  2⤵
  PID:8468
- C:\Windows\System\BRBYOpi.exe
  C:\Windows\System\BRBYOpi.exe
  2⤵
  PID:8316
- C:\Windows\System\rPCwZtC.exe
  C:\Windows\System\rPCwZtC.exe
  2⤵
  PID:7900
- C:\Windows\System\hDyQaPb.exe
  C:\Windows\System\hDyQaPb.exe
  2⤵
  PID:8304
- C:\Windows\System\LZBqTqm.exe
  C:\Windows\System\LZBqTqm.exe
  2⤵
  PID:8260
- C:\Windows\System\ugFqNIt.exe
  C:\Windows\System\ugFqNIt.exe
  2⤵
  PID:9224
- C:\Windows\System\OCVhHFM.exe
  C:\Windows\System\OCVhHFM.exe
  2⤵
  PID:9260
- C:\Windows\System\spWzmfZ.exe
  C:\Windows\System\spWzmfZ.exe
  2⤵
  PID:9276
- C:\Windows\System\LnzYzOv.exe
  C:\Windows\System\LnzYzOv.exe
  2⤵
  PID:9296
- C:\Windows\System\vdjVMbq.exe
  C:\Windows\System\vdjVMbq.exe
  2⤵
  PID:9332
- C:\Windows\System\MOhoRPw.exe
  C:\Windows\System\MOhoRPw.exe
  2⤵
  PID:9648
- C:\Windows\System\GwGhfWD.exe
  C:\Windows\System\GwGhfWD.exe
  2⤵
  PID:9692
- C:\Windows\System\cBhcFSN.exe
  C:\Windows\System\cBhcFSN.exe
  2⤵
  PID:9716
- C:\Windows\System\dBtYbZN.exe
  C:\Windows\System\dBtYbZN.exe
  2⤵
  PID:9732
- C:\Windows\System\hqHIHbg.exe
  C:\Windows\System\hqHIHbg.exe
  2⤵
  PID:9748
- C:\Windows\System\IxOnfGG.exe
  C:\Windows\System\IxOnfGG.exe
  2⤵
  PID:9780
- C:\Windows\System\VURjyAt.exe
  C:\Windows\System\VURjyAt.exe
  2⤵
  PID:9804
- C:\Windows\System\ZFucEap.exe
  C:\Windows\System\ZFucEap.exe
  2⤵
  PID:9824
- C:\Windows\System\uekRNrm.exe
  C:\Windows\System\uekRNrm.exe
  2⤵
  PID:9848
- C:\Windows\System\urSfJwi.exe
  C:\Windows\System\urSfJwi.exe
  2⤵
  PID:9868
- C:\Windows\System\sTVstpE.exe
  C:\Windows\System\sTVstpE.exe
  2⤵
  PID:9884
- C:\Windows\System\aKCIZAO.exe
  C:\Windows\System\aKCIZAO.exe
  2⤵
  PID:9900
- C:\Windows\System\SWscHDD.exe
  C:\Windows\System\SWscHDD.exe
  2⤵
  PID:9916
- C:\Windows\System\jTnDgla.exe
  C:\Windows\System\jTnDgla.exe
  2⤵
  PID:9952
- C:\Windows\System\zOyayIb.exe
  C:\Windows\System\zOyayIb.exe
  2⤵
  PID:9976
- C:\Windows\System\iveYSeC.exe
  C:\Windows\System\iveYSeC.exe
  2⤵
  PID:9996
- C:\Windows\System\MJtsMmg.exe
  C:\Windows\System\MJtsMmg.exe
  2⤵
  PID:10012
- C:\Windows\System\OnDjgAq.exe
  C:\Windows\System\OnDjgAq.exe
  2⤵
  PID:10028
- C:\Windows\System\vsFGBKz.exe
  C:\Windows\System\vsFGBKz.exe
  2⤵
  PID:10044
- C:\Windows\System\iZPiGJe.exe
  C:\Windows\System\iZPiGJe.exe
  2⤵
  PID:10060
- C:\Windows\System\rqPimwr.exe
  C:\Windows\System\rqPimwr.exe
  2⤵
  PID:10076
- C:\Windows\System\eGmoDgJ.exe
  C:\Windows\System\eGmoDgJ.exe
  2⤵
  PID:10092
- C:\Windows\System\MMvamcd.exe
  C:\Windows\System\MMvamcd.exe
  2⤵
  PID:10108
- C:\Windows\System\guJMdKo.exe
  C:\Windows\System\guJMdKo.exe
  2⤵
  PID:10128
- C:\Windows\System\oXYFfZw.exe
  C:\Windows\System\oXYFfZw.exe
  2⤵
  PID:10160
- C:\Windows\System\fpJmYwh.exe
  C:\Windows\System\fpJmYwh.exe
  2⤵
  PID:9092
- C:\Windows\System\qCfHexr.exe
  C:\Windows\System\qCfHexr.exe
  2⤵
  PID:8772
- C:\Windows\System\iwAdEJR.exe
  C:\Windows\System\iwAdEJR.exe
  2⤵
  PID:8236
- C:\Windows\System\hfivnCx.exe
  C:\Windows\System\hfivnCx.exe
  2⤵
  PID:9236
- C:\Windows\System\hhZEVPN.exe
  C:\Windows\System\hhZEVPN.exe
  2⤵
  PID:8392
- C:\Windows\System\atUVNjB.exe
  C:\Windows\System\atUVNjB.exe
  2⤵
  PID:9292
- C:\Windows\System\kAXtkEY.exe
  C:\Windows\System\kAXtkEY.exe
  2⤵
  PID:9456
- C:\Windows\System\KxkjOPs.exe
  C:\Windows\System\KxkjOPs.exe
  2⤵
  PID:9328
- C:\Windows\System\ZlbFOlb.exe
  C:\Windows\System\ZlbFOlb.exe
  2⤵
  PID:9484
- C:\Windows\System\kEelRFM.exe
  C:\Windows\System\kEelRFM.exe
  2⤵
  PID:8136
- C:\Windows\System\UrlYtxQ.exe
  C:\Windows\System\UrlYtxQ.exe
  2⤵
  PID:7988
- C:\Windows\System\jaOqmxD.exe
  C:\Windows\System\jaOqmxD.exe
  2⤵
  PID:8828
- C:\Windows\System\bibPxUq.exe
  C:\Windows\System\bibPxUq.exe
  2⤵
  PID:9600
- C:\Windows\System\qJcbrQA.exe
  C:\Windows\System\qJcbrQA.exe
  2⤵
  PID:8444
- C:\Windows\System\oZwwtDW.exe
  C:\Windows\System\oZwwtDW.exe
  2⤵
  PID:9676
- C:\Windows\System\ScevgPY.exe
  C:\Windows\System\ScevgPY.exe
  2⤵
  PID:6052
- C:\Windows\System\QnzmtkL.exe
  C:\Windows\System\QnzmtkL.exe
  2⤵
  PID:9704
- C:\Windows\System\IjvTRnF.exe
  C:\Windows\System\IjvTRnF.exe
  2⤵
  PID:9776
- C:\Windows\System\kFjoMuJ.exe
  C:\Windows\System\kFjoMuJ.exe
  2⤵
  PID:9944
- C:\Windows\System\JNLvmqX.exe
  C:\Windows\System\JNLvmqX.exe
  2⤵
  PID:6056
- C:\Windows\System\idMYngt.exe
  C:\Windows\System\idMYngt.exe
  2⤵
  PID:9844
- C:\Windows\System\UONfRHM.exe
  C:\Windows\System\UONfRHM.exe
  2⤵
  PID:9912
- C:\Windows\System\ODVBYtH.exe
  C:\Windows\System\ODVBYtH.exe
  2⤵
  PID:10084
- C:\Windows\System\UIadlDE.exe
  C:\Windows\System\UIadlDE.exe
  2⤵
  PID:10120
- C:\Windows\System\UrkGgaD.exe
  C:\Windows\System\UrkGgaD.exe
  2⤵
  PID:8920
- C:\Windows\System\qdPqcYc.exe
  C:\Windows\System\qdPqcYc.exe
  2⤵
  PID:10056
- C:\Windows\System\HSHCZQl.exe
  C:\Windows\System\HSHCZQl.exe
  2⤵
  PID:10136
- C:\Windows\System\JBJDYDh.exe
  C:\Windows\System\JBJDYDh.exe
  2⤵
  PID:1860
- C:\Windows\System\kDqiBDN.exe
  C:\Windows\System\kDqiBDN.exe
  2⤵
  PID:10220
- C:\Windows\System\LEBgvcj.exe
  C:\Windows\System\LEBgvcj.exe
  2⤵
  PID:9368
- C:\Windows\System\KoGCRho.exe
  C:\Windows\System\KoGCRho.exe
  2⤵
  PID:9756
- C:\Windows\System\EpniVWP.exe
  C:\Windows\System\EpniVWP.exe
  2⤵
  PID:9036
- C:\Windows\System\RoUAzkR.exe
  C:\Windows\System\RoUAzkR.exe
  2⤵
  PID:9940
- C:\Windows\System\SMxXIlI.exe
  C:\Windows\System\SMxXIlI.exe
  2⤵
  PID:9816
- C:\Windows\System\VuyuieB.exe
  C:\Windows\System\VuyuieB.exe
  2⤵
  PID:10244
- C:\Windows\System\JbEsREs.exe
  C:\Windows\System\JbEsREs.exe
  2⤵
  PID:10264
- C:\Windows\System\HnmqNSg.exe
  C:\Windows\System\HnmqNSg.exe
  2⤵
  PID:10284
- C:\Windows\System\pWpcbMk.exe
  C:\Windows\System\pWpcbMk.exe
  2⤵
  PID:10436
- C:\Windows\System\nwaSPQH.exe
  C:\Windows\System\nwaSPQH.exe
  2⤵
  PID:10456
- C:\Windows\System\FAcPDWX.exe
  C:\Windows\System\FAcPDWX.exe
  2⤵
  PID:10476
- C:\Windows\System\ddhbuVm.exe
  C:\Windows\System\ddhbuVm.exe
  2⤵
  PID:10496
- C:\Windows\System\KjtuQlm.exe
  C:\Windows\System\KjtuQlm.exe
  2⤵
  PID:10540
- C:\Windows\System\caEIFoO.exe
  C:\Windows\System\caEIFoO.exe
  2⤵
  PID:10560
- C:\Windows\System\nYPXTZh.exe
  C:\Windows\System\nYPXTZh.exe
  2⤵
  PID:10584
- C:\Windows\System\pRyFqdZ.exe
  C:\Windows\System\pRyFqdZ.exe
  2⤵
  PID:10608
- C:\Windows\System\xwDMzYb.exe
  C:\Windows\System\xwDMzYb.exe
  2⤵
  PID:10632
- C:\Windows\System\JQezxdz.exe
  C:\Windows\System\JQezxdz.exe
  2⤵
  PID:10648
- C:\Windows\System\jXmHGFZ.exe
  C:\Windows\System\jXmHGFZ.exe
  2⤵
  PID:10664
- C:\Windows\System\byShHKP.exe
  C:\Windows\System\byShHKP.exe
  2⤵
  PID:10680
- C:\Windows\System\RusVZlV.exe
  C:\Windows\System\RusVZlV.exe
  2⤵
  PID:10700
- C:\Windows\System\GYdRbhN.exe
  C:\Windows\System\GYdRbhN.exe
  2⤵
  PID:10720
- C:\Windows\System\WfuWLEr.exe
  C:\Windows\System\WfuWLEr.exe
  2⤵
  PID:10740
- C:\Windows\System\kaCoZJB.exe
  C:\Windows\System\kaCoZJB.exe
  2⤵
  PID:10756
- C:\Windows\System\nnjkGVX.exe
  C:\Windows\System\nnjkGVX.exe
  2⤵
  PID:10892
- C:\Windows\System\MihcrBe.exe
  C:\Windows\System\MihcrBe.exe
  2⤵
  PID:10912
- C:\Windows\System\eAaPsLT.exe
  C:\Windows\System\eAaPsLT.exe
  2⤵
  PID:10940
- C:\Windows\System\TjpBeHR.exe
  C:\Windows\System\TjpBeHR.exe
  2⤵
  PID:10956
- C:\Windows\System\OEmbGpj.exe
  C:\Windows\System\OEmbGpj.exe
  2⤵
  PID:10972
- C:\Windows\System\EBXSUpp.exe
  C:\Windows\System\EBXSUpp.exe
  2⤵
  PID:10992
- C:\Windows\System\EVjFdhM.exe
  C:\Windows\System\EVjFdhM.exe
  2⤵
  PID:11008
- C:\Windows\System\WhvJtEi.exe
  C:\Windows\System\WhvJtEi.exe
  2⤵
  PID:11028
- C:\Windows\System\hkMxxLO.exe
  C:\Windows\System\hkMxxLO.exe
  2⤵
  PID:11052
- C:\Windows\System\BTPpIVw.exe
  C:\Windows\System\BTPpIVw.exe
  2⤵
  PID:11072
- C:\Windows\System\DyaNGYf.exe
  C:\Windows\System\DyaNGYf.exe
  2⤵
  PID:11096
- C:\Windows\System\OYZYtQH.exe
  C:\Windows\System\OYZYtQH.exe
  2⤵
  PID:11112
- C:\Windows\System\iKnFKNp.exe
  C:\Windows\System\iKnFKNp.exe
  2⤵
  PID:11136
- C:\Windows\System\eFAhmrc.exe
  C:\Windows\System\eFAhmrc.exe
  2⤵
  PID:11160
- C:\Windows\System\JwBjnju.exe
  C:\Windows\System\JwBjnju.exe
  2⤵
  PID:11184
- C:\Windows\System\HEeJrIW.exe
  C:\Windows\System\HEeJrIW.exe
  2⤵
  PID:11204
- C:\Windows\System\zpWThfM.exe
  C:\Windows\System\zpWThfM.exe
  2⤵
  PID:11244
- C:\Windows\System\pUCPRnu.exe
  C:\Windows\System\pUCPRnu.exe
  2⤵
  PID:2732
- C:\Windows\System\bXSCBKL.exe
  C:\Windows\System\bXSCBKL.exe
  2⤵
  PID:10156
- C:\Windows\System\WaeoHAE.exe
  C:\Windows\System\WaeoHAE.exe
  2⤵
  PID:9536
- C:\Windows\System\ZlzedXV.exe
  C:\Windows\System\ZlzedXV.exe
  2⤵
  PID:9560
- C:\Windows\System\cpJJSan.exe
  C:\Windows\System\cpJJSan.exe
  2⤵
  PID:9724
- C:\Windows\System\VSbHaWe.exe
  C:\Windows\System\VSbHaWe.exe
  2⤵
  PID:9672
- C:\Windows\System\dSWNtjh.exe
  C:\Windows\System\dSWNtjh.exe
  2⤵
  PID:4696
- C:\Windows\System\adtkGAi.exe
  C:\Windows\System\adtkGAi.exe
  2⤵
  PID:10312
- C:\Windows\System\TGvxPoT.exe
  C:\Windows\System\TGvxPoT.exe
  2⤵
  PID:9880
- C:\Windows\System\BjpPgPl.exe
  C:\Windows\System\BjpPgPl.exe
  2⤵
  PID:9964
- C:\Windows\System\TEZEjNG.exe
  C:\Windows\System\TEZEjNG.exe
  2⤵
  PID:10204
- C:\Windows\System\CGqZbAj.exe
  C:\Windows\System\CGqZbAj.exe
  2⤵
  PID:772
- C:\Windows\System\pGxhDbX.exe
  C:\Windows\System\pGxhDbX.exe
  2⤵
  PID:9304
- C:\Windows\System\DRxKkYf.exe
  C:\Windows\System\DRxKkYf.exe
  2⤵
  PID:9896
- C:\Windows\System\lKoLXuG.exe
  C:\Windows\System\lKoLXuG.exe
  2⤵
  PID:10252
- C:\Windows\System\iIrzEDm.exe
  C:\Windows\System\iIrzEDm.exe
  2⤵
  PID:3848
- C:\Windows\System\CmDJgVQ.exe
  C:\Windows\System\CmDJgVQ.exe
  2⤵
  PID:10180
- C:\Windows\System\qSeMewa.exe
  C:\Windows\System\qSeMewa.exe
  2⤵
  PID:9624
- C:\Windows\System\OuKQPbH.exe
  C:\Windows\System\OuKQPbH.exe
  2⤵
  PID:10468
- C:\Windows\System\wYCtsWD.exe
  C:\Windows\System\wYCtsWD.exe
  2⤵
  PID:10868
- C:\Windows\System\sTMoyjm.exe
  C:\Windows\System\sTMoyjm.exe
  2⤵
  PID:10400
- C:\Windows\System\pZKYLyd.exe
  C:\Windows\System\pZKYLyd.exe
  2⤵
  PID:11016
- C:\Windows\System\AJBzZzF.exe
  C:\Windows\System\AJBzZzF.exe
  2⤵
  PID:11048
- C:\Windows\System\kokanbv.exe
  C:\Windows\System\kokanbv.exe
  2⤵
  PID:10504
- C:\Windows\System\HzWVcDf.exe
  C:\Windows\System\HzWVcDf.exe
  2⤵
  PID:11152
- C:\Windows\System\yxpXIHf.exe
  C:\Windows\System\yxpXIHf.exe
  2⤵
  PID:10576
- C:\Windows\System\nRyGAHN.exe
  C:\Windows\System\nRyGAHN.exe
  2⤵
  PID:10712
- C:\Windows\System\QwYmvST.exe
  C:\Windows\System\QwYmvST.exe
  2⤵
  PID:10936
- C:\Windows\System\ZhtuVwQ.exe
  C:\Windows\System\ZhtuVwQ.exe
  2⤵
  PID:10452
- C:\Windows\System\SEjMDqG.exe
  C:\Windows\System\SEjMDqG.exe
  2⤵
  PID:9788
- C:\Windows\System\vDUdOGb.exe
  C:\Windows\System\vDUdOGb.exe
  2⤵
  PID:11168
- C:\Windows\System\vfMEXCk.exe
  C:\Windows\System\vfMEXCk.exe
  2⤵
  PID:5996
- C:\Windows\System\mXOUDcR.exe
  C:\Windows\System\mXOUDcR.exe
  2⤵
  PID:9840
- C:\Windows\System\iJddQgm.exe
  C:\Windows\System\iJddQgm.exe
  2⤵
  PID:9220
- C:\Windows\System\IOAXuhn.exe
  C:\Windows\System\IOAXuhn.exe
  2⤵
  PID:11288
- C:\Windows\System\mmMOAOK.exe
  C:\Windows\System\mmMOAOK.exe
  2⤵
  PID:11320
- C:\Windows\System\GdgLtjP.exe
  C:\Windows\System\GdgLtjP.exe
  2⤵
  PID:11340
- C:\Windows\System\QDGaXtn.exe
  C:\Windows\System\QDGaXtn.exe
  2⤵
  PID:11360
- C:\Windows\System\rEJrntV.exe
  C:\Windows\System\rEJrntV.exe
  2⤵
  PID:11384
- C:\Windows\System\yyvlvkt.exe
  C:\Windows\System\yyvlvkt.exe
  2⤵
  PID:11408
- C:\Windows\System\MDSywde.exe
  C:\Windows\System\MDSywde.exe
  2⤵
  PID:11432
- C:\Windows\System\ljyIdQv.exe
  C:\Windows\System\ljyIdQv.exe
  2⤵
  PID:11460
- C:\Windows\System\pJqtRxl.exe
  C:\Windows\System\pJqtRxl.exe
  2⤵
  PID:11488
- C:\Windows\System\clKrWIQ.exe
  C:\Windows\System\clKrWIQ.exe
  2⤵
  PID:11512
- C:\Windows\System\vIGdUTn.exe
  C:\Windows\System\vIGdUTn.exe
  2⤵
  PID:11528
- C:\Windows\System\VHDqIPU.exe
  C:\Windows\System\VHDqIPU.exe
  2⤵
  PID:11548
- C:\Windows\System\WgbUBIM.exe
  C:\Windows\System\WgbUBIM.exe
  2⤵
  PID:11568
- C:\Windows\System\LtBiQgQ.exe
  C:\Windows\System\LtBiQgQ.exe
  2⤵
  PID:11588
- C:\Windows\System\MgzRZOk.exe
  C:\Windows\System\MgzRZOk.exe
  2⤵
  PID:11800
- C:\Windows\System\sxWmSlB.exe
  C:\Windows\System\sxWmSlB.exe
  2⤵
  PID:11840
- C:\Windows\System\DWGDkpF.exe
  C:\Windows\System\DWGDkpF.exe
  2⤵
  PID:11864
- C:\Windows\System\zkzlbfZ.exe
  C:\Windows\System\zkzlbfZ.exe
  2⤵
  PID:11884
- C:\Windows\System\rAtBhek.exe
  C:\Windows\System\rAtBhek.exe
  2⤵
  PID:11904
- C:\Windows\System\DHudoHn.exe
  C:\Windows\System\DHudoHn.exe
  2⤵
  PID:11928
- C:\Windows\System\TyVxCIO.exe
  C:\Windows\System\TyVxCIO.exe
  2⤵
  PID:11948
- C:\Windows\System\HnmSHqv.exe
  C:\Windows\System\HnmSHqv.exe
  2⤵
  PID:11972
- C:\Windows\System\kEJXMKq.exe
  C:\Windows\System\kEJXMKq.exe
  2⤵
  PID:11996
- C:\Windows\System\DPJcoXd.exe
  C:\Windows\System\DPJcoXd.exe
  2⤵
  PID:12020
- C:\Windows\System\DDlMTaa.exe
  C:\Windows\System\DDlMTaa.exe
  2⤵
  PID:12040
- C:\Windows\System\lSCAvny.exe
  C:\Windows\System\lSCAvny.exe
  2⤵
  PID:12060
- C:\Windows\System\isVUThD.exe
  C:\Windows\System\isVUThD.exe
  2⤵
  PID:12080
- C:\Windows\System\bibnkxY.exe
  C:\Windows\System\bibnkxY.exe
  2⤵
  PID:12096
- C:\Windows\System\ZxIyjqz.exe
  C:\Windows\System\ZxIyjqz.exe
  2⤵
  PID:12116
- C:\Windows\System\njqooTu.exe
  C:\Windows\System\njqooTu.exe
  2⤵
  PID:12148
- C:\Windows\System\ZPtxkfZ.exe
  C:\Windows\System\ZPtxkfZ.exe
  2⤵
  PID:12172
- C:\Windows\System\xmVrXkq.exe
  C:\Windows\System\xmVrXkq.exe
  2⤵
  PID:12200
- C:\Windows\System\yTokVWe.exe
  C:\Windows\System\yTokVWe.exe
  2⤵
  PID:12232
- C:\Windows\System\thIcxzf.exe
  C:\Windows\System\thIcxzf.exe
  2⤵
  PID:12252
- C:\Windows\System\CJeSVfp.exe
  C:\Windows\System\CJeSVfp.exe
  2⤵
  PID:12272
- C:\Windows\System\dTcdeKD.exe
  C:\Windows\System\dTcdeKD.exe
  2⤵
  PID:11272
- C:\Windows\System\nzvWIvw.exe
  C:\Windows\System\nzvWIvw.exe
  2⤵
  PID:11352
- C:\Windows\System\LKwcfdT.exe
  C:\Windows\System\LKwcfdT.exe
  2⤵
  PID:11524
- C:\Windows\System\xbALmgx.exe
  C:\Windows\System\xbALmgx.exe
  2⤵
  PID:11236
- C:\Windows\System\NYqankJ.exe
  C:\Windows\System\NYqankJ.exe
  2⤵
  PID:9632
- C:\Windows\System\ReHmmUr.exe
  C:\Windows\System\ReHmmUr.exe
  2⤵
  PID:5576
- C:\Windows\System\SpMjGgD.exe
  C:\Windows\System\SpMjGgD.exe
  2⤵
  PID:11448
- C:\Windows\System\mFFZFsA.exe
  C:\Windows\System\mFFZFsA.exe
  2⤵
  PID:4752
- C:\Windows\System\npeKHAx.exe
  C:\Windows\System\npeKHAx.exe
  2⤵
  PID:11040
- C:\Windows\System\qwOBHMa.exe
  C:\Windows\System\qwOBHMa.exe
  2⤵
  PID:10392
- C:\Windows\System\ZMiSFjE.exe
  C:\Windows\System\ZMiSFjE.exe
  2⤵
  PID:9640
- C:\Windows\System\LYtXAfD.exe
  C:\Windows\System\LYtXAfD.exe
  2⤵
  PID:11336
- C:\Windows\System\hiAuumn.exe
  C:\Windows\System\hiAuumn.exe
  2⤵
  PID:12220
- C:\Windows\System\LrjjvtE.exe
  C:\Windows\System\LrjjvtE.exe
  2⤵
  PID:1056
- C:\Windows\System\ZGxqqnI.exe
  C:\Windows\System\ZGxqqnI.exe
  2⤵
  PID:1808
- C:\Windows\System\xjyMCOa.exe
  C:\Windows\System\xjyMCOa.exe
  2⤵
  PID:10676
- C:\Windows\System\wOTCmgj.exe
  C:\Windows\System\wOTCmgj.exe
  2⤵
  PID:10424
- C:\Windows\System\VJXewgB.exe
  C:\Windows\System\VJXewgB.exe
  2⤵
  PID:10840
- C:\Windows\System\XipPuLA.exe
  C:\Windows\System\XipPuLA.exe
  2⤵
  PID:12228
- C:\Windows\System\pmdKUMw.exe
  C:\Windows\System\pmdKUMw.exe
  2⤵
  PID:560
- C:\Windows\System\wPdnJrT.exe
  C:\Windows\System\wPdnJrT.exe
  2⤵
  PID:11584
- C:\Windows\System\ArEkKxL.exe
  C:\Windows\System\ArEkKxL.exe
  2⤵
  PID:11876
- C:\Windows\System\cgDqWFU.exe
  C:\Windows\System\cgDqWFU.exe
  2⤵
  PID:12304
- C:\Windows\System\GnpdLCW.exe
  C:\Windows\System\GnpdLCW.exe
  2⤵
  PID:12320
- C:\Windows\System\JlWJqRh.exe
  C:\Windows\System\JlWJqRh.exe
  2⤵
  PID:12340
- C:\Windows\System\khjHSVN.exe
  C:\Windows\System\khjHSVN.exe
  2⤵
  PID:12360
- C:\Windows\System\iuELloQ.exe
  C:\Windows\System\iuELloQ.exe
  2⤵
  PID:12380
- C:\Windows\System\zzUfYCW.exe
  C:\Windows\System\zzUfYCW.exe
  2⤵
  PID:12400
- C:\Windows\System\UzTqLrB.exe
  C:\Windows\System\UzTqLrB.exe
  2⤵
  PID:12424
- C:\Windows\System\cDnfGbi.exe
  C:\Windows\System\cDnfGbi.exe
  2⤵
  PID:12444
- C:\Windows\System\iQuuAtT.exe
  C:\Windows\System\iQuuAtT.exe
  2⤵
  PID:12476
- C:\Windows\System\GKCpMGD.exe
  C:\Windows\System\GKCpMGD.exe
  2⤵
  PID:12496
- C:\Windows\System\zWFfUzb.exe
  C:\Windows\System\zWFfUzb.exe
  2⤵
  PID:12516
- C:\Windows\System\JgYnzoI.exe
  C:\Windows\System\JgYnzoI.exe
  2⤵
  PID:12536
- C:\Windows\System\XHkZyRG.exe
  C:\Windows\System\XHkZyRG.exe
  2⤵
  PID:12560
- C:\Windows\System\dCyHuQn.exe
  C:\Windows\System\dCyHuQn.exe
  2⤵
  PID:12584
- C:\Windows\System\zdMQfnF.exe
  C:\Windows\System\zdMQfnF.exe
  2⤵
  PID:12600
- C:\Windows\System\PFmidDd.exe
  C:\Windows\System\PFmidDd.exe
  2⤵
  PID:12616
- C:\Windows\System\KLAKzBN.exe
  C:\Windows\System\KLAKzBN.exe
  2⤵
  PID:12632
- C:\Windows\System\FqJRDcY.exe
  C:\Windows\System\FqJRDcY.exe
  2⤵
  PID:12652
- C:\Windows\System\vzhORkD.exe
  C:\Windows\System\vzhORkD.exe
  2⤵
  PID:12668
- C:\Windows\System\tTWMEkq.exe
  C:\Windows\System\tTWMEkq.exe
  2⤵
  PID:12684
- C:\Windows\System\MKdKJOf.exe
  C:\Windows\System\MKdKJOf.exe
  2⤵
  PID:12700
- C:\Windows\System\jvFzIVc.exe
  C:\Windows\System\jvFzIVc.exe
  2⤵
  PID:12716
- C:\Windows\System\nUPMzqa.exe
  C:\Windows\System\nUPMzqa.exe
  2⤵
  PID:12736
- C:\Windows\System\qjUzmRX.exe
  C:\Windows\System\qjUzmRX.exe
  2⤵
  PID:12752
- C:\Windows\System\jdockzA.exe
  C:\Windows\System\jdockzA.exe
  2⤵
  PID:12772
- C:\Windows\System\LBErwXC.exe
  C:\Windows\System\LBErwXC.exe
  2⤵
  PID:12796
- C:\Windows\System\NaEtsYX.exe
  C:\Windows\System\NaEtsYX.exe
  2⤵
  PID:12820
- C:\Windows\System\kVxcaJO.exe
  C:\Windows\System\kVxcaJO.exe
  2⤵
  PID:12844
- C:\Windows\System\ugmTzWj.exe
  C:\Windows\System\ugmTzWj.exe
  2⤵
  PID:12864
- C:\Windows\System\mOLqMlu.exe
  C:\Windows\System\mOLqMlu.exe
  2⤵
  PID:12888
- C:\Windows\System\cGeatZm.exe
  C:\Windows\System\cGeatZm.exe
  2⤵
  PID:12908
- C:\Windows\System\bjcNyaW.exe
  C:\Windows\System\bjcNyaW.exe
  2⤵
  PID:12928
- C:\Windows\System\aelMAnf.exe
  C:\Windows\System\aelMAnf.exe
  2⤵
  PID:12948
- C:\Windows\System\fEgKOnB.exe
  C:\Windows\System\fEgKOnB.exe
  2⤵
  PID:12964
- C:\Windows\System\cbiRxeF.exe
  C:\Windows\System\cbiRxeF.exe
  2⤵
  PID:13088
- C:\Windows\System\AwsFKwr.exe
  C:\Windows\System\AwsFKwr.exe
  2⤵
  PID:13104
- C:\Windows\System\BMfEyDf.exe
  C:\Windows\System\BMfEyDf.exe
  2⤵
  PID:13120
- C:\Windows\System\EPoJvWK.exe
  C:\Windows\System\EPoJvWK.exe
  2⤵
  PID:13140
- C:\Windows\System\zIzQwXh.exe
  C:\Windows\System\zIzQwXh.exe
  2⤵
  PID:13168
- C:\Windows\System\sILBwFt.exe
  C:\Windows\System\sILBwFt.exe
  2⤵
  PID:13212
- C:\Windows\System\IaEAmFb.exe
  C:\Windows\System\IaEAmFb.exe
  2⤵
  PID:13232
- C:\Windows\System\DQgqHwH.exe
  C:\Windows\System\DQgqHwH.exe
  2⤵
  PID:13248
- C:\Windows\System\nHEIPfm.exe
  C:\Windows\System\nHEIPfm.exe
  2⤵
  PID:13264
- C:\Windows\System\tThixKv.exe
  C:\Windows\System\tThixKv.exe
  2⤵
  PID:13280
- C:\Windows\System\htMIDpA.exe
  C:\Windows\System\htMIDpA.exe
  2⤵
  PID:13296
- C:\Windows\System\SAaqdWt.exe
  C:\Windows\System\SAaqdWt.exe
  2⤵
  PID:11980
- C:\Windows\System\qmwbkVw.exe
  C:\Windows\System\qmwbkVw.exe
  2⤵
  PID:5524
- C:\Windows\System\SngdSYC.exe
  C:\Windows\System\SngdSYC.exe
  2⤵
  PID:11304
- C:\Windows\System\ugZPlOA.exe
  C:\Windows\System\ugZPlOA.exe
  2⤵
  PID:12316
- C:\Windows\System\grykyeW.exe
  C:\Windows\System\grykyeW.exe
  2⤵
  PID:11284
- C:\Windows\System\RNDrSvd.exe
  C:\Windows\System\RNDrSvd.exe
  2⤵
  PID:12408
- C:\Windows\System\rVeyoxG.exe
  C:\Windows\System\rVeyoxG.exe
  2⤵
  PID:12468
- C:\Windows\System\pGfARbC.exe
  C:\Windows\System\pGfARbC.exe
  2⤵
  PID:12732
- C:\Windows\System\bfHmdcH.exe
  C:\Windows\System\bfHmdcH.exe
  2⤵
  PID:12768
- C:\Windows\System\EUUwIXN.exe
  C:\Windows\System\EUUwIXN.exe
  2⤵
  PID:12816
- C:\Windows\System\vfkzEGv.exe
  C:\Windows\System\vfkzEGv.exe
  2⤵
  PID:12960
- C:\Windows\System\AtPPLSS.exe
  C:\Windows\System\AtPPLSS.exe
  2⤵
  PID:12436
- C:\Windows\System\LtKIRev.exe
  C:\Windows\System\LtKIRev.exe
  2⤵
  PID:9972
- C:\Windows\System\dPfaSIe.exe
  C:\Windows\System\dPfaSIe.exe
  2⤵
  PID:13100
- C:\Windows\System\LMeZBgt.exe
  C:\Windows\System\LMeZBgt.exe
  2⤵
  PID:12992
- C:\Windows\System\dGIXomo.exe
  C:\Windows\System\dGIXomo.exe
  2⤵
  PID:1604
- C:\Windows\System\nSVsgau.exe
  C:\Windows\System\nSVsgau.exe
  2⤵
  PID:432
- C:\Windows\System\LMXzhAP.exe
  C:\Windows\System\LMXzhAP.exe
  2⤵
  PID:13060
- C:\Windows\System\DMdQxor.exe
  C:\Windows\System\DMdQxor.exe
  2⤵
  PID:11544
- C:\Windows\System\zwKPufT.exe
  C:\Windows\System\zwKPufT.exe
  2⤵
  PID:1872
- C:\Windows\System\rLzmjwd.exe
  C:\Windows\System\rLzmjwd.exe
  2⤵
  PID:972
- C:\Windows\System\cvYvurO.exe
  C:\Windows\System\cvYvurO.exe
  2⤵
  PID:2932
- C:\Windows\System\NxAkAFX.exe
  C:\Windows\System\NxAkAFX.exe
  2⤵
  PID:12924
- C:\Windows\System\GweBijU.exe
  C:\Windows\System\GweBijU.exe
  2⤵
  PID:872
- C:\Windows\System\jPXDNtE.exe
  C:\Windows\System\jPXDNtE.exe
  2⤵
  PID:13164
- C:\Windows\System\bsrKZaX.exe
  C:\Windows\System\bsrKZaX.exe
  2⤵
  PID:13228
- C:\Windows\System\oYlxDry.exe
  C:\Windows\System\oYlxDry.exe
  2⤵
  PID:13256
- C:\Windows\System\UjBYdWW.exe
  C:\Windows\System\UjBYdWW.exe
  2⤵
  PID:13336
- C:\Windows\System\KetrNJT.exe
  C:\Windows\System\KetrNJT.exe
  2⤵
  PID:13360
- C:\Windows\System\RYnMZgB.exe
  C:\Windows\System\RYnMZgB.exe
  2⤵
  PID:13380
- C:\Windows\System\AnNXCAX.exe
  C:\Windows\System\AnNXCAX.exe
  2⤵
  PID:13400
- C:\Windows\System\xZrQHdm.exe
  C:\Windows\System\xZrQHdm.exe
  2⤵
  PID:13416
- C:\Windows\System\FKpdmRu.exe
  C:\Windows\System\FKpdmRu.exe
  2⤵
  PID:13456
- C:\Windows\System\CwbrXWS.exe
  C:\Windows\System\CwbrXWS.exe
  2⤵
  PID:13516
- C:\Windows\System\vsFYRfX.exe
  C:\Windows\System\vsFYRfX.exe
  2⤵
  PID:13536
- C:\Windows\System\mSpKVDr.exe
  C:\Windows\System\mSpKVDr.exe
  2⤵
  PID:13552
- C:\Windows\System\XXZHFlF.exe
  C:\Windows\System\XXZHFlF.exe
  2⤵
  PID:13572
- C:\Windows\System\fAKkegj.exe
  C:\Windows\System\fAKkegj.exe
  2⤵
  PID:13592
- C:\Windows\System\AhWnhMM.exe
  C:\Windows\System\AhWnhMM.exe
  2⤵
  PID:13612
- C:\Windows\System\OdXWgMT.exe
  C:\Windows\System\OdXWgMT.exe
  2⤵
  PID:13636
- C:\Windows\System\NZGTrbh.exe
  C:\Windows\System\NZGTrbh.exe
  2⤵
  PID:13656
- C:\Windows\System\DmxhLcj.exe
  C:\Windows\System\DmxhLcj.exe
  2⤵
  PID:13672
- C:\Windows\System\zLQERbD.exe
  C:\Windows\System\zLQERbD.exe
  2⤵
  PID:13692
- C:\Windows\System\BuMQnMd.exe
  C:\Windows\System\BuMQnMd.exe
  2⤵
  PID:13708
- C:\Windows\System\DblQehw.exe
  C:\Windows\System\DblQehw.exe
  2⤵
  PID:13788
- C:\Windows\System\VJivtzZ.exe
  C:\Windows\System\VJivtzZ.exe
  2⤵
  PID:13804
- C:\Windows\System\yGXqUei.exe
  C:\Windows\System\yGXqUei.exe
  2⤵
  PID:13824
- C:\Windows\System\BrYHKNe.exe
  C:\Windows\System\BrYHKNe.exe
  2⤵
  PID:13856
- C:\Windows\System\LrsuVfj.exe
  C:\Windows\System\LrsuVfj.exe
  2⤵
  PID:13872
- C:\Windows\System\hrkLEVo.exe
  C:\Windows\System\hrkLEVo.exe
  2⤵
  PID:13888
- C:\Windows\System\qmfSGJf.exe
  C:\Windows\System\qmfSGJf.exe
  2⤵
  PID:14052
- C:\Windows\System\lHEETdM.exe
  C:\Windows\System\lHEETdM.exe
  2⤵
  PID:14116
- C:\Windows\System\WIItYpx.exe
  C:\Windows\System\WIItYpx.exe
  2⤵
  PID:14140
- C:\Windows\System\FggIpGK.exe
  C:\Windows\System\FggIpGK.exe
  2⤵
  PID:14160
- C:\Windows\System\NVtRJiG.exe
  C:\Windows\System\NVtRJiG.exe
  2⤵
  PID:14188
- C:\Windows\System\PrOzyKZ.exe
  C:\Windows\System\PrOzyKZ.exe
  2⤵
  PID:14208
- C:\Windows\System\XTTUKJj.exe
  C:\Windows\System\XTTUKJj.exe
  2⤵
  PID:14252
- C:\Windows\System\vuWGFnH.exe
  C:\Windows\System\vuWGFnH.exe
  2⤵
  PID:14276
- C:\Windows\System\glFgxVi.exe
  C:\Windows\System\glFgxVi.exe
  2⤵
  PID:14316
- C:\Windows\System\VfcZAyj.exe
  C:\Windows\System\VfcZAyj.exe
  2⤵
  PID:12680
- C:\Windows\System\bXwmjFk.exe
  C:\Windows\System\bXwmjFk.exe
  2⤵
  PID:1072
- C:\Windows\System\nYDtovg.exe
  C:\Windows\System\nYDtovg.exe
  2⤵
  PID:1120
- C:\Windows\System\tsePfBF.exe
  C:\Windows\System\tsePfBF.exe
  2⤵
  PID:13160
- C:\Windows\System\KUIYFRI.exe
  C:\Windows\System\KUIYFRI.exe
  2⤵
  PID:13344
- C:\Windows\System\ttbxQkP.exe
  C:\Windows\System\ttbxQkP.exe
  2⤵
  PID:13376
- C:\Windows\System\WbAGXnn.exe
  C:\Windows\System\WbAGXnn.exe
  2⤵
  PID:4844
- C:\Windows\System\sDMlvxw.exe
  C:\Windows\System\sDMlvxw.exe
  2⤵
  PID:13488
- C:\Windows\System\lRuFSjz.exe
  C:\Windows\System\lRuFSjz.exe
  2⤵
  PID:13508
- C:\Windows\System\smFkXqe.exe
  C:\Windows\System\smFkXqe.exe
  2⤵
  PID:13548
- C:\Windows\System\rVgIOsP.exe
  C:\Windows\System\rVgIOsP.exe
  2⤵
  PID:13668
- C:\Windows\System\GQsxsxy.exe
  C:\Windows\System\GQsxsxy.exe
  2⤵
  PID:13980
- C:\Windows\System\tnnddVY.exe
  C:\Windows\System\tnnddVY.exe
  2⤵
  PID:3468
- C:\Windows\System\AoGkMQL.exe
  C:\Windows\System\AoGkMQL.exe
  2⤵
  PID:14084
- C:\Windows\System\BYvLbSa.exe
  C:\Windows\System\BYvLbSa.exe
  2⤵
  PID:5192
- C:\Windows\System\BBtTkRx.exe
  C:\Windows\System\BBtTkRx.exe
  2⤵
  PID:5248
- C:\Windows\System\teADptW.exe
  C:\Windows\System\teADptW.exe
  2⤵
  PID:13816
- C:\Windows\System\OikoHoD.exe
  C:\Windows\System\OikoHoD.exe
  2⤵
  PID:14028
- C:\Windows\System\PVKmqJd.exe
  C:\Windows\System\PVKmqJd.exe
  2⤵
  PID:14044
- C:\Windows\System\tTwbLvm.exe
  C:\Windows\System\tTwbLvm.exe
  2⤵
  PID:2500
- C:\Windows\System\bgqpaVq.exe
  C:\Windows\System\bgqpaVq.exe
  2⤵
  PID:1096
- C:\Windows\System\SyEJRyW.exe
  C:\Windows\System\SyEJRyW.exe
  2⤵
  PID:2140
- C:\Windows\System\WVYSbLB.exe
  C:\Windows\System\WVYSbLB.exe
  2⤵
  PID:13928
- C:\Windows\System\JXXfvGG.exe
  C:\Windows\System\JXXfvGG.exe
  2⤵
  PID:14108
- C:\Windows\System\NCslHNe.exe
  C:\Windows\System\NCslHNe.exe
  2⤵
  PID:1228
- C:\Windows\System\CyvvHgL.exe
  C:\Windows\System\CyvvHgL.exe
  2⤵
  PID:14096
- C:\Windows\System\NajduuT.exe
  C:\Windows\System\NajduuT.exe
  2⤵
  PID:13112
- C:\Windows\System\VJtTkag.exe
  C:\Windows\System\VJtTkag.exe
  2⤵
  PID:5596
- C:\Windows\System\sHlpSbU.exe
  C:\Windows\System\sHlpSbU.exe
  2⤵
  PID:12764
- C:\Windows\System\MRaoidG.exe
  C:\Windows\System\MRaoidG.exe
  2⤵
  PID:13864
- C:\Windows\System\DlUDcWZ.exe
  C:\Windows\System\DlUDcWZ.exe
  2⤵
  PID:13472
- C:\Windows\System\wMbkWiC.exe
  C:\Windows\System\wMbkWiC.exe
  2⤵
  PID:3296
- C:\Windows\System\BGlzdfG.exe
  C:\Windows\System\BGlzdfG.exe
  2⤵
  PID:2908
- C:\Windows\System\oJMzHZO.exe
  C:\Windows\System\oJMzHZO.exe
  2⤵
  PID:12556
- C:\Windows\System\EhwTetU.exe
  C:\Windows\System\EhwTetU.exe
  2⤵
  PID:5420
- C:\Windows\System\rQQmFfc.exe
  C:\Windows\System\rQQmFfc.exe
  2⤵
  PID:13904
- C:\Windows\System\ApsRhTE.exe
  C:\Windows\System\ApsRhTE.exe
  2⤵
  PID:5172
- C:\Windows\System\CtOFnIj.exe
  C:\Windows\System\CtOFnIj.exe
  2⤵
  PID:13880
- C:\Windows\System\wLinCuj.exe
  C:\Windows\System\wLinCuj.exe
  2⤵
  PID:8076
- C:\Windows\System\oZfyCeF.exe
  C:\Windows\System\oZfyCeF.exe
  2⤵
  PID:5540
- C:\Windows\System\oDDkbqj.exe
  C:\Windows\System\oDDkbqj.exe
  2⤵
  PID:13632
- C:\Windows\System\RvLAeoW.exe
  C:\Windows\System\RvLAeoW.exe
  2⤵
  PID:13500
- C:\Windows\System\WNjCgMb.exe
  C:\Windows\System\WNjCgMb.exe
  2⤵
  PID:13016
- C:\Windows\System\zOIeLWA.exe
  C:\Windows\System\zOIeLWA.exe
  2⤵
  PID:13796
- C:\Windows\System\jbmzCuf.exe
  C:\Windows\System\jbmzCuf.exe
  2⤵
  PID:2652
- C:\Windows\System\LcZrExv.exe
  C:\Windows\System\LcZrExv.exe
  2⤵
  PID:14072
- C:\Windows\System\xCbpnqu.exe
  C:\Windows\System\xCbpnqu.exe
  2⤵
  PID:5444
- C:\Windows\System\fUemwme.exe
  C:\Windows\System\fUemwme.exe
  2⤵
  PID:5432
- C:\Windows\System\OWGdOaJ.exe
  C:\Windows\System\OWGdOaJ.exe
  2⤵
  PID:6016
- C:\Windows\System\PXqKJfo.exe
  C:\Windows\System\PXqKJfo.exe
  2⤵
  PID:14244
- C:\Windows\System\JlbfumG.exe
  C:\Windows\System\JlbfumG.exe
  2⤵
  PID:6096
- C:\Windows\System\yuVZjfi.exe
  C:\Windows\System\yuVZjfi.exe
  2⤵
  PID:5676
- C:\Windows\System\AiObSuQ.exe
  C:\Windows\System\AiObSuQ.exe
  2⤵
  PID:5628
- C:\Windows\System\yZhkOQp.exe
  C:\Windows\System\yZhkOQp.exe
  2⤵
  PID:13992
- C:\Windows\System\BzcvjQQ.exe
  C:\Windows\System\BzcvjQQ.exe
  2⤵
  PID:12416
- C:\Windows\System\ZmoruHO.exe
  C:\Windows\System\ZmoruHO.exe
  2⤵
  PID:12352
- C:\Windows\System\rTUxfyo.exe
  C:\Windows\System\rTUxfyo.exe
  2⤵
  PID:12452
- C:\Windows\System\pKqQgfl.exe
  C:\Windows\System\pKqQgfl.exe
  2⤵
  PID:2348
- C:\Windows\System\pCWUDzL.exe
  C:\Windows\System\pCWUDzL.exe
  2⤵
  PID:8148
- C:\Windows\System\iGsOOrf.exe
  C:\Windows\System\iGsOOrf.exe
  2⤵
  PID:9208
- C:\Windows\System\mciySLO.exe
  C:\Windows\System\mciySLO.exe
  2⤵
  PID:7492
- C:\Windows\System\UnliDBO.exe
  C:\Windows\System\UnliDBO.exe
  2⤵
  PID:8492
- C:\Windows\System\AaGUDec.exe
  C:\Windows\System\AaGUDec.exe
  2⤵
  PID:8528
- C:\Windows\System\jMbJGMA.exe
  C:\Windows\System\jMbJGMA.exe
  2⤵
  PID:8952
- C:\Windows\System\mDKoKoo.exe
  C:\Windows\System\mDKoKoo.exe
  2⤵
  PID:8600
- C:\Windows\System\eVQfMsW.exe
  C:\Windows\System\eVQfMsW.exe
  2⤵
  PID:9172
- C:\Windows\System\cVVrJog.exe
  C:\Windows\System\cVVrJog.exe
  2⤵
  PID:9360
- C:\Windows\System\aFAQFcL.exe
  C:\Windows\System\aFAQFcL.exe
  2⤵
  PID:9372
- C:\Windows\System\vGPWDIb.exe
  C:\Windows\System\vGPWDIb.exe
  2⤵
  PID:9240
- C:\Windows\System\KbuKkoY.exe
  C:\Windows\System\KbuKkoY.exe
  2⤵
  PID:9404
- C:\Windows\System\SfFtwXq.exe
  C:\Windows\System\SfFtwXq.exe
  2⤵
  PID:9512
- C:\Windows\System\FWsAkdF.exe
  C:\Windows\System\FWsAkdF.exe
  2⤵
  PID:1104
- C:\Windows\System\jYhLxXE.exe
  C:\Windows\System\jYhLxXE.exe
  2⤵
  PID:9412
- C:\Windows\System\SDPmfNx.exe
  C:\Windows\System\SDPmfNx.exe
  2⤵
  PID:9488
- C:\Windows\System\obINEoJ.exe
  C:\Windows\System\obINEoJ.exe
  2⤵
  PID:9508
- C:\Windows\System\YNLjwNk.exe
  C:\Windows\System\YNLjwNk.exe
  2⤵
  PID:12412
- C:\Windows\System\Tlekrss.exe
  C:\Windows\System\Tlekrss.exe
  2⤵
  PID:9348
- C:\Windows\System\odMSbmQ.exe
  C:\Windows\System\odMSbmQ.exe
  2⤵
  PID:9516
- C:\Windows\System\bGqtnus.exe
  C:\Windows\System\bGqtnus.exe
  2⤵
  PID:13932
- C:\Windows\System\lQavPIO.exe
  C:\Windows\System\lQavPIO.exe
  2⤵
  PID:9588
- C:\Windows\System\ZREwrrv.exe
  C:\Windows\System\ZREwrrv.exe
  2⤵
  PID:9596
- C:\Windows\System\AnjovCb.exe
  C:\Windows\System\AnjovCb.exe
  2⤵
  PID:5448
- C:\Windows\System\IUkorUS.exe
  C:\Windows\System\IUkorUS.exe
  2⤵
  PID:5400
- C:\Windows\System\uuUpepF.exe
  C:\Windows\System\uuUpepF.exe
  2⤵
  PID:5776
- C:\Windows\System\YDmWtPo.exe
  C:\Windows\System\YDmWtPo.exe
  2⤵
  PID:6024
- C:\Windows\System\tBgYCzs.exe
  C:\Windows\System\tBgYCzs.exe
  2⤵
  PID:13604
- C:\Windows\System\kdWvZiA.exe
  C:\Windows\System\kdWvZiA.exe
  2⤵
  PID:13564
- C:\Windows\System\pRlkrhs.exe
  C:\Windows\System\pRlkrhs.exe
  2⤵
  PID:5728
- C:\Windows\System\HCjXoXw.exe
  C:\Windows\System\HCjXoXw.exe
  2⤵
  PID:13908
- C:\Windows\System\cLnZmmG.exe
  C:\Windows\System\cLnZmmG.exe
  2⤵
  PID:5760
- C:\Windows\System\eLfGBQb.exe
  C:\Windows\System\eLfGBQb.exe
  2⤵
  PID:2052
- C:\Windows\System\UcOknfs.exe
  C:\Windows\System\UcOknfs.exe
  2⤵
  PID:6836
- C:\Windows\System\fTGvXxD.exe
  C:\Windows\System\fTGvXxD.exe
  2⤵
  PID:6200
- C:\Windows\System\NRoTRxq.exe
  C:\Windows\System\NRoTRxq.exe
  2⤵
  PID:6208
- C:\Windows\System\SCvapEy.exe
  C:\Windows\System\SCvapEy.exe
  2⤵
  PID:6396
- C:\Windows\System\LtukKaY.exe
  C:\Windows\System\LtukKaY.exe
  2⤵
  PID:6744
- C:\Windows\System\DMfNhoL.exe
  C:\Windows\System\DMfNhoL.exe
  2⤵
  PID:6856
- C:\Windows\System\pczfAlV.exe
  C:\Windows\System\pczfAlV.exe
  2⤵
  PID:6288
- C:\Windows\System\vxjucea.exe
  C:\Windows\System\vxjucea.exe
  2⤵
  PID:6672
- C:\Windows\System\cTzUUbI.exe
  C:\Windows\System\cTzUUbI.exe
  2⤵
  PID:6444
- C:\Windows\System\nbPapDj.exe
  C:\Windows\System\nbPapDj.exe
  2⤵
  PID:6176
- C:\Windows\System\kzKOKHs.exe
  C:\Windows\System\kzKOKHs.exe
  2⤵
  PID:5988
- C:\Windows\System\HNbnzkz.exe
  C:\Windows\System\HNbnzkz.exe
  2⤵
  PID:13072
- C:\Windows\System\WqPwQHm.exe
  C:\Windows\System\WqPwQHm.exe
  2⤵
  PID:1800
- C:\Windows\System\WIVOBLX.exe
  C:\Windows\System\WIVOBLX.exe
  2⤵
  PID:11000
- C:\Windows\System\BGnhRBu.exe
  C:\Windows\System\BGnhRBu.exe
  2⤵
  PID:7360
- C:\Windows\System\tDWTOnc.exe
  C:\Windows\System\tDWTOnc.exe
  2⤵
  PID:2584
- C:\Windows\System\rjmPeaH.exe
  C:\Windows\System\rjmPeaH.exe
  2⤵
  PID:6308
- C:\Windows\System\QwUPPdK.exe
  C:\Windows\System\QwUPPdK.exe
  2⤵
  PID:7328
- C:\Windows\System\oLTcaqk.exe
  C:\Windows\System\oLTcaqk.exe
  2⤵
  PID:7488
- C:\Windows\System\gFmqYyS.exe
  C:\Windows\System\gFmqYyS.exe
  2⤵
  PID:8768
- C:\Windows\System\pIJSGLo.exe
  C:\Windows\System\pIJSGLo.exe
  2⤵
  PID:7000
- C:\Windows\System\AnTPvGV.exe
  C:\Windows\System\AnTPvGV.exe
  2⤵
  PID:6452
- C:\Windows\System\xNcxMgf.exe
  C:\Windows\System\xNcxMgf.exe
  2⤵
  PID:6256
- C:\Windows\System\zqIqKCu.exe
  C:\Windows\System\zqIqKCu.exe
  2⤵
  PID:5636
- C:\Windows\System\CWIBahw.exe
  C:\Windows\System\CWIBahw.exe
  2⤵
  PID:7200
- C:\Windows\System\zNAuiOo.exe
  C:\Windows\System\zNAuiOo.exe
  2⤵
  PID:7276
- C:\Windows\System\huEyxyI.exe
  C:\Windows\System\huEyxyI.exe
  2⤵
  PID:7048
- C:\Windows\System\fxikdGg.exe
  C:\Windows\System\fxikdGg.exe
  2⤵
  PID:7412
- C:\Windows\System\gkHDsxh.exe
  C:\Windows\System\gkHDsxh.exe
  2⤵
  PID:7740
- C:\Windows\System\BurvuWA.exe
  C:\Windows\System\BurvuWA.exe
  2⤵
  PID:7784
- C:\Windows\System\WwCHPGL.exe
  C:\Windows\System\WwCHPGL.exe
  2⤵
  PID:8024
- C:\Windows\System\UfUKDxh.exe
  C:\Windows\System\UfUKDxh.exe
  2⤵
  PID:7620
- C:\Windows\System\tunPCzV.exe
  C:\Windows\System\tunPCzV.exe
  2⤵
  PID:7904
- C:\Windows\System\CyasVYo.exe
  C:\Windows\System\CyasVYo.exe
  2⤵
  PID:5544
- C:\Windows\System\mHiQZSS.exe
  C:\Windows\System\mHiQZSS.exe
  2⤵
  PID:5204
- C:\Windows\System\ASLDKYx.exe
  C:\Windows\System\ASLDKYx.exe
  2⤵
  PID:14012
- C:\Windows\System\rVrDALx.exe
  C:\Windows\System\rVrDALx.exe
  2⤵
  PID:6044
- C:\Windows\System\SZzjkWD.exe
  C:\Windows\System\SZzjkWD.exe
  2⤵
  PID:7984
- C:\Windows\System\zXEAFua.exe
  C:\Windows\System\zXEAFua.exe
  2⤵
  PID:5476
- C:\Windows\System\QCOgkJK.exe
  C:\Windows\System\QCOgkJK.exe
  2⤵
  PID:11616
- C:\Windows\System\jqdKazF.exe
  C:\Windows\System\jqdKazF.exe
  2⤵
  PID:4408
- C:\Windows\System\JtrOQMa.exe
  C:\Windows\System\JtrOQMa.exe
  2⤵
  PID:7888
- C:\Windows\System\RAnwFxZ.exe
  C:\Windows\System\RAnwFxZ.exe
  2⤵
  PID:6504
- C:\Windows\System\xjqFFbU.exe
  C:\Windows\System\xjqFFbU.exe
  2⤵
  PID:6636
- C:\Windows\System\DppbLtp.exe
  C:\Windows\System\DppbLtp.exe
  2⤵
  PID:6364
- C:\Windows\System\egjWgsy.exe
  C:\Windows\System\egjWgsy.exe
  2⤵
  PID:8352
- C:\Windows\System\eALmnoW.exe
  C:\Windows\System\eALmnoW.exe
  2⤵
  PID:5992
- C:\Windows\System\JtSxhYG.exe
  C:\Windows\System\JtSxhYG.exe
  2⤵
  PID:5748
- C:\Windows\System\YHlGsPo.exe
  C:\Windows\System\YHlGsPo.exe
  2⤵
  PID:7024
- C:\Windows\System\dBedqEJ.exe
  C:\Windows\System\dBedqEJ.exe
  2⤵
  PID:7644
- C:\Windows\System\dzLMCqI.exe
  C:\Windows\System\dzLMCqI.exe
  2⤵
  PID:8460
- C:\Windows\System\wQjgWjz.exe
  C:\Windows\System\wQjgWjz.exe
  2⤵
  PID:7180
- C:\Windows\System\qcodgHY.exe
  C:\Windows\System\qcodgHY.exe
  2⤵
  PID:14292
- C:\Windows\System\OLboAok.exe
  C:\Windows\System\OLboAok.exe
  2⤵
  PID:8584
- C:\Windows\System\DYTlYEZ.exe
  C:\Windows\System\DYTlYEZ.exe
  2⤵
  PID:6544
- C:\Windows\System\HzXkPXc.exe
  C:\Windows\System\HzXkPXc.exe
  2⤵
  PID:8688
- C:\Windows\System\EWVDbQS.exe
  C:\Windows\System\EWVDbQS.exe
  2⤵
  PID:6916
- C:\Windows\System\bsIshal.exe
  C:\Windows\System\bsIshal.exe
  2⤵
  PID:7944
- C:\Windows\System\qTepYJT.exe
  C:\Windows\System\qTepYJT.exe
  2⤵
  PID:8548
- C:\Windows\System\VJMYXyl.exe
  C:\Windows\System\VJMYXyl.exe
  2⤵
  PID:10604
- C:\Windows\System\MwuYueV.exe
  C:\Windows\System\MwuYueV.exe
  2⤵
  PID:11348
- C:\Windows\System\FDfGxam.exe
  C:\Windows\System\FDfGxam.exe
  2⤵
  PID:11480
- C:\Windows\System\RZjctXh.exe
  C:\Windows\System\RZjctXh.exe
  2⤵
  PID:5392
- C:\Windows\System\fYYChbN.exe
  C:\Windows\System\fYYChbN.exe
  2⤵
  PID:9664
- C:\Windows\System\vdlZcRL.exe
  C:\Windows\System\vdlZcRL.exe
  2⤵
  PID:5744
- C:\Windows\System\pEcWFSx.exe
  C:\Windows\System\pEcWFSx.exe
  2⤵
  PID:7068
- C:\Windows\System\jnGujOz.exe
  C:\Windows\System\jnGujOz.exe
  2⤵
  PID:7812
- C:\Windows\System\TdqrPhZ.exe
  C:\Windows\System\TdqrPhZ.exe
  2⤵
  PID:14308
- C:\Windows\System\OfFBXvS.exe
  C:\Windows\System\OfFBXvS.exe
  2⤵
  PID:8744
- C:\Windows\System\GPHTCAy.exe
  C:\Windows\System\GPHTCAy.exe
  2⤵
  PID:9524
- C:\Windows\System\rqCpAQQ.exe
  C:\Windows\System\rqCpAQQ.exe
  2⤵
  PID:13392
- C:\Windows\System\fZhXRSC.exe
  C:\Windows\System\fZhXRSC.exe
  2⤵
  PID:6140
- C:\Windows\System\uzOorGB.exe
  C:\Windows\System\uzOorGB.exe
  2⤵
  PID:9168
- C:\Windows\System\RDfSzJY.exe
  C:\Windows\System\RDfSzJY.exe
  2⤵
  PID:8724
- C:\Windows\System\FsOyfix.exe
  C:\Windows\System\FsOyfix.exe
  2⤵
  PID:3852
- C:\Windows\System\UfwbYRW.exe
  C:\Windows\System\UfwbYRW.exe
  2⤵
  PID:6068
- C:\Windows\System\UAdPlec.exe
  C:\Windows\System\UAdPlec.exe
  2⤵
  PID:5852
- C:\Windows\System\xGAuaMn.exe
  C:\Windows\System\xGAuaMn.exe
  2⤵
  PID:9064
- C:\Windows\System\BBcgZWV.exe
  C:\Windows\System\BBcgZWV.exe
  2⤵
  PID:3020
- C:\Windows\System\RFkaGAA.exe
  C:\Windows\System\RFkaGAA.exe
  2⤵
  PID:6620
- C:\Windows\System\zGHmKns.exe
  C:\Windows\System\zGHmKns.exe
  2⤵
  PID:7820
- C:\Windows\System\XLfrVNq.exe
  C:\Windows\System\XLfrVNq.exe
  2⤵
  PID:10864
- C:\Windows\System\JPvqXxi.exe
  C:\Windows\System\JPvqXxi.exe
  2⤵
  PID:6360
- C:\Windows\System\bTBbVvU.exe
  C:\Windows\System\bTBbVvU.exe
  2⤵
  PID:396
- C:\Windows\System\gQLraoO.exe
  C:\Windows\System\gQLraoO.exe
  2⤵
  PID:9164
- C:\Windows\System\XFZSbFy.exe
  C:\Windows\System\XFZSbFy.exe
  2⤵
  PID:10656
- C:\Windows\System\ZFuTImN.exe
  C:\Windows\System\ZFuTImN.exe
  2⤵
  PID:11036
- C:\Windows\System\iTQucpm.exe
  C:\Windows\System\iTQucpm.exe
  2⤵
  PID:7160
- C:\Windows\System\GJzppvU.exe
  C:\Windows\System\GJzppvU.exe
  2⤵
  PID:7244
- C:\Windows\System\ynPVCnC.exe
  C:\Windows\System\ynPVCnC.exe
  2⤵
  PID:11308
- C:\Windows\System\EtUprOs.exe
  C:\Windows\System\EtUprOs.exe
  2⤵
  PID:9148
- C:\Windows\System\PSkxwsb.exe
  C:\Windows\System\PSkxwsb.exe
  2⤵
  PID:7064
- C:\Windows\System\oilUEdl.exe
  C:\Windows\System\oilUEdl.exe
  2⤵
  PID:9116
- C:\Windows\System\bmYatpo.exe
  C:\Windows\System\bmYatpo.exe
  2⤵
  PID:6348
- C:\Windows\System\XIVKmSL.exe
  C:\Windows\System\XIVKmSL.exe
  2⤵
  PID:8764
- C:\Windows\System\cRYxPiT.exe
  C:\Windows\System\cRYxPiT.exe
  2⤵
  PID:14104
- C:\Windows\System\chWIMUi.exe
  C:\Windows\System\chWIMUi.exe
  2⤵
  PID:11428
- C:\Windows\System\yCveRlZ.exe
  C:\Windows\System\yCveRlZ.exe
  2⤵
  PID:11392
- C:\Windows\System\xXZodKB.exe
  C:\Windows\System\xXZodKB.exe
  2⤵
  PID:11376
- C:\Windows\System\PtgKnhU.exe
  C:\Windows\System\PtgKnhU.exe
  2⤵
  PID:12092
- C:\Windows\System\onpqplr.exe
  C:\Windows\System\onpqplr.exe
  2⤵
  PID:12160
- C:\Windows\System\TYyhgqu.exe
  C:\Windows\System\TYyhgqu.exe
  2⤵
  PID:9552
- C:\Windows\System\HoUgHBt.exe
  C:\Windows\System\HoUgHBt.exe
  2⤵
  PID:5416
- C:\Windows\System\MgBKrUc.exe
  C:\Windows\System\MgBKrUc.exe
  2⤵
  PID:9620
- C:\Windows\System\yNSsEnS.exe
  C:\Windows\System\yNSsEnS.exe
  2⤵
  PID:12032
- C:\Windows\System\fnKZWtA.exe
  C:\Windows\System\fnKZWtA.exe
  2⤵
  PID:6552
- C:\Windows\System\xFWYiVe.exe
  C:\Windows\System\xFWYiVe.exe
  2⤵
  PID:9468
- C:\Windows\System\CtnNLHL.exe
  C:\Windows\System\CtnNLHL.exe
  2⤵
  PID:9004
- C:\Windows\System\SdYoVvY.exe
  C:\Windows\System\SdYoVvY.exe
  2⤵
  PID:4684
- C:\Windows\System\ZUEzCDo.exe
  C:\Windows\System\ZUEzCDo.exe
  2⤵
  PID:8320
- C:\Windows\System\pccGjIy.exe
  C:\Windows\System\pccGjIy.exe
  2⤵
  PID:7652
- C:\Windows\System\QIvbhvr.exe
  C:\Windows\System\QIvbhvr.exe
  2⤵
  PID:8196
- C:\Windows\System\LXzaQqX.exe
  C:\Windows\System\LXzaQqX.exe
  2⤵
  PID:9556
- C:\Windows\System\mnGfrox.exe
  C:\Windows\System\mnGfrox.exe
  2⤵
  PID:11608
- C:\Windows\System\chTHAtj.exe
  C:\Windows\System\chTHAtj.exe
  2⤵
  PID:9204
- C:\Windows\System\JpEDawB.exe
  C:\Windows\System\JpEDawB.exe
  2⤵
  PID:11900
- C:\Windows\System\vFdFUVr.exe
  C:\Windows\System\vFdFUVr.exe
  2⤵
  PID:6076
- C:\Windows\System\XVpCzAw.exe
  C:\Windows\System\XVpCzAw.exe
  2⤵
  PID:9108
- C:\Windows\System\gAwlzam.exe
  C:\Windows\System\gAwlzam.exe
  2⤵
  PID:3224
- C:\Windows\System\inLJQGm.exe
  C:\Windows\System\inLJQGm.exe
  2⤵
  PID:14040
- C:\Windows\System\KImdZTx.exe
  C:\Windows\System\KImdZTx.exe
  2⤵
  PID:8692
- C:\Windows\System\lHjDOtL.exe
  C:\Windows\System\lHjDOtL.exe
  2⤵
  PID:10324
- C:\Windows\System\oGOXZOH.exe
  C:\Windows\System\oGOXZOH.exe
  2⤵
  PID:8368
- C:\Windows\System\hzekrit.exe
  C:\Windows\System\hzekrit.exe
  2⤵
  PID:9284
- C:\Windows\System\lVoqgpf.exe
  C:\Windows\System\lVoqgpf.exe
  2⤵
  PID:9892
- C:\Windows\System\zxZCVxQ.exe
  C:\Windows\System\zxZCVxQ.exe
  2⤵
  PID:9068
- C:\Windows\System\RrimpWC.exe
  C:\Windows\System\RrimpWC.exe
  2⤵
  PID:14360
- C:\Windows\System\SaDoYGf.exe
  C:\Windows\System\SaDoYGf.exe
  2⤵
  PID:14528
- C:\Windows\System\IRcdGxl.exe
  C:\Windows\System\IRcdGxl.exe
  2⤵
  PID:14876
- C:\Windows\System\yjWSMsZ.exe
  C:\Windows\System\yjWSMsZ.exe
  2⤵
  PID:14960
- C:\Windows\System\jtnqiFV.exe
  C:\Windows\System\jtnqiFV.exe
  2⤵
  PID:15328
- C:\Windows\System\HGmcikz.exe
  C:\Windows\System\HGmcikz.exe
  2⤵
  PID:15344
- C:\Windows\System\edSjwOH.exe
  C:\Windows\System\edSjwOH.exe
  2⤵
  PID:10352
- C:\Windows\System\SaFnrxd.exe
  C:\Windows\System\SaFnrxd.exe
  2⤵
  PID:10236
- C:\Windows\System\pWcscnN.exe
  C:\Windows\System\pWcscnN.exe
  2⤵
  PID:10036
- C:\Windows\System\DlZiBNe.exe
  C:\Windows\System\DlZiBNe.exe
  2⤵
  PID:10472
- C:\Windows\System\vlxLQiQ.exe
  C:\Windows\System\vlxLQiQ.exe
  2⤵
  PID:12036
- C:\Windows\System\mmGZBhK.exe
  C:\Windows\System\mmGZBhK.exe
  2⤵
  PID:1856
- C:\Windows\System\cFcNXOC.exe
  C:\Windows\System\cFcNXOC.exe
  2⤵
  PID:10428
- C:\Windows\System\lOZSDIL.exe
  C:\Windows\System\lOZSDIL.exe
  2⤵
  PID:4892
- C:\Windows\System\sKpgQEy.exe
  C:\Windows\System\sKpgQEy.exe
  2⤵
  PID:8372
- C:\Windows\System\hUGgKmP.exe
  C:\Windows\System\hUGgKmP.exe
  2⤵
  PID:10520
- C:\Windows\System\oGcYeZu.exe
  C:\Windows\System\oGcYeZu.exe
  2⤵
  PID:9060
- C:\Windows\System\aIPKKMN.exe
  C:\Windows\System\aIPKKMN.exe
  2⤵
  PID:10404
- C:\Windows\System\JomCfcz.exe
  C:\Windows\System\JomCfcz.exe
  2⤵
  PID:12164
- C:\Windows\System\yFJuAKh.exe
  C:\Windows\System\yFJuAKh.exe
  2⤵
  PID:10844
- C:\Windows\System\kAhaDHI.exe
  C:\Windows\System\kAhaDHI.exe
  2⤵
  PID:8596
- C:\Windows\System\FDFYxQx.exe
  C:\Windows\System\FDFYxQx.exe
  2⤵
  PID:8096
- C:\Windows\System\YiKVtnt.exe
  C:\Windows\System\YiKVtnt.exe
  2⤵
  PID:10928
- C:\Windows\System\rMiSKWO.exe
  C:\Windows\System\rMiSKWO.exe
  2⤵
  PID:14384
- C:\Windows\System\RMtChxt.exe
  C:\Windows\System\RMtChxt.exe
  2⤵
  PID:14444
- C:\Windows\System\WmlxyWW.exe
  C:\Windows\System\WmlxyWW.exe
  2⤵
  PID:10848
- C:\Windows\System\AyGJSyZ.exe
  C:\Windows\System\AyGJSyZ.exe
  2⤵
  PID:14624
- C:\Windows\System\kLVXEkW.exe
  C:\Windows\System\kLVXEkW.exe
  2⤵
  PID:14524
- C:\Windows\System\dDjaQkI.exe
  C:\Windows\System\dDjaQkI.exe
  2⤵
  PID:14768
- C:\Windows\System\LJmhYWT.exe
  C:\Windows\System\LJmhYWT.exe
  2⤵
  PID:10072
- C:\Windows\System\BIcmQfI.exe
  C:\Windows\System\BIcmQfI.exe
  2⤵
  PID:5452
- C:\Windows\System\iyjjriE.exe
  C:\Windows\System\iyjjriE.exe
  2⤵
  PID:15000
- C:\Windows\System\yehkWGR.exe
  C:\Windows\System\yehkWGR.exe
  2⤵
  PID:9668
- C:\Windows\System\ivWdpSp.exe
  C:\Windows\System\ivWdpSp.exe
  2⤵
  PID:15052
- C:\Windows\System\dKpYvqZ.exe
  C:\Windows\System\dKpYvqZ.exe
  2⤵
  PID:15056
- C:\Windows\System\MxvnDDQ.exe
  C:\Windows\System\MxvnDDQ.exe
  2⤵
  PID:1744
- C:\Windows\System\xrTxdRJ.exe
  C:\Windows\System\xrTxdRJ.exe
  2⤵
  PID:14972
- C:\Windows\System\gOmMksx.exe
  C:\Windows\System\gOmMksx.exe
  2⤵
  PID:10388
- C:\Windows\System\WBxLJSw.exe
  C:\Windows\System\WBxLJSw.exe
  2⤵
  PID:11580
- C:\Windows\System\FgXQIBO.exe
  C:\Windows\System\FgXQIBO.exe
  2⤵
  PID:15124
- C:\Windows\System\mMtUnNR.exe
  C:\Windows\System\mMtUnNR.exe
  2⤵
  PID:15312
- C:\Windows\System\pLqNsee.exe
  C:\Windows\System\pLqNsee.exe
  2⤵
  PID:11684
- C:\Windows\System\szjSPcQ.exe
  C:\Windows\System\szjSPcQ.exe
  2⤵
  PID:10348
- C:\Windows\System\craAZbf.exe
  C:\Windows\System\craAZbf.exe
  2⤵
  PID:11080
- C:\Windows\System\WXkxSnr.exe
  C:\Windows\System\WXkxSnr.exe
  2⤵
  PID:10820
- C:\Windows\System\eSAwKgN.exe
  C:\Windows\System\eSAwKgN.exe
  2⤵
  PID:11824
- C:\Windows\System\WmdybRQ.exe
  C:\Windows\System\WmdybRQ.exe
  2⤵
  PID:4988
- C:\Windows\System\SovBsZm.exe
  C:\Windows\System\SovBsZm.exe
  2⤵
  PID:11984
- C:\Windows\System\wOBxZsQ.exe
  C:\Windows\System\wOBxZsQ.exe
  2⤵
  PID:12156
- C:\Windows\System\YnhKAQs.exe
  C:\Windows\System\YnhKAQs.exe
  2⤵
  PID:9176
- C:\Windows\System\lqxBuev.exe
  C:\Windows\System\lqxBuev.exe
  2⤵
  PID:15144
- C:\Windows\System\LZnAlxu.exe
  C:\Windows\System\LZnAlxu.exe
  2⤵
  PID:15216
- C:\Windows\System\fYKPSWf.exe
  C:\Windows\System\fYKPSWf.exe
  2⤵
  PID:15264
- C:\Windows\System\lZGpgFI.exe
  C:\Windows\System\lZGpgFI.exe
  2⤵
  PID:11812
- C:\Windows\System\GTYvHJx.exe
  C:\Windows\System\GTYvHJx.exe
  2⤵
  PID:12184
- C:\Windows\System\pYhhybM.exe
  C:\Windows\System\pYhhybM.exe
  2⤵
  PID:12212
- C:\Windows\System\NeAJuNt.exe
  C:\Windows\System\NeAJuNt.exe
  2⤵
  PID:3416
- C:\Windows\System\TsSMHWM.exe
  C:\Windows\System\TsSMHWM.exe
  2⤵
  PID:12136
- C:\Windows\System\aZzOgGq.exe
  C:\Windows\System\aZzOgGq.exe
  2⤵
  PID:6704
- C:\Windows\System\DRudYtJ.exe
  C:\Windows\System\DRudYtJ.exe
  2⤵
  PID:11556
- C:\Windows\System\QNMeemL.exe
  C:\Windows\System\QNMeemL.exe
  2⤵
  PID:8816
- C:\Windows\System\ccsUPjS.exe
  C:\Windows\System\ccsUPjS.exe
  2⤵
  PID:7576
- C:\Windows\System\WVhJVzh.exe
  C:\Windows\System\WVhJVzh.exe
  2⤵
  PID:14372
- C:\Windows\System\nYBjZVe.exe
  C:\Windows\System\nYBjZVe.exe
  2⤵
  PID:15276
- C:\Windows\System\gyWoeER.exe
  C:\Windows\System\gyWoeER.exe
  2⤵
  PID:10512
- C:\Windows\System\ioEEGfB.exe
  C:\Windows\System\ioEEGfB.exe
  2⤵
  PID:15340
- C:\Windows\System\BInlBMB.exe
  C:\Windows\System\BInlBMB.exe
  2⤵
  PID:9864
- C:\Windows\System\uBtAQyv.exe
  C:\Windows\System\uBtAQyv.exe
  2⤵
  PID:13920
- C:\Windows\System\MwlYvPf.exe
  C:\Windows\System\MwlYvPf.exe
  2⤵
  PID:10320
- C:\Windows\System\efJgZzj.exe
  C:\Windows\System\efJgZzj.exe
  2⤵
  PID:11120
- C:\Windows\System\vgmfwEZ.exe
  C:\Windows\System\vgmfwEZ.exe
  2⤵
  PID:10304
- C:\Windows\System\CWlluuY.exe
  C:\Windows\System\CWlluuY.exe
  2⤵
  PID:11400
- C:\Windows\System\qtTCGHt.exe
  C:\Windows\System\qtTCGHt.exe
  2⤵
  PID:10360
- C:\Windows\System\hqzHUaS.exe
  C:\Windows\System\hqzHUaS.exe
  2⤵
  PID:2484
- C:\Windows\System\jzRnxPd.exe
  C:\Windows\System\jzRnxPd.exe
  2⤵
  PID:11220
- C:\Windows\System\fvmsRVn.exe
  C:\Windows\System\fvmsRVn.exe
  2⤵
  PID:14428
- C:\Windows\System\cspdOqz.exe
  C:\Windows\System\cspdOqz.exe
  2⤵
  PID:14704
- C:\Windows\System\dJfpani.exe
  C:\Windows\System\dJfpani.exe
  2⤵
  PID:12524
- C:\Windows\System\tNITDBT.exe
  C:\Windows\System\tNITDBT.exe
  2⤵
  PID:11148
- C:\Windows\System\azyHdET.exe
  C:\Windows\System\azyHdET.exe
  2⤵
  PID:14800
- C:\Windows\System\OxVbcvp.exe
  C:\Windows\System\OxVbcvp.exe
  2⤵
  PID:10804
- C:\Windows\System\AUpcoCO.exe
  C:\Windows\System\AUpcoCO.exe
  2⤵
  PID:12760
- C:\Windows\System\TUAtqCZ.exe
  C:\Windows\System\TUAtqCZ.exe
  2⤵
  PID:14780
- C:\Windows\System\gqUghrB.exe
  C:\Windows\System\gqUghrB.exe
  2⤵
  PID:14836
- C:\Windows\System\xVhnejV.exe
  C:\Windows\System\xVhnejV.exe
  2⤵
  PID:10732
- C:\Windows\System\SyMElCj.exe
  C:\Windows\System\SyMElCj.exe
  2⤵
  PID:6976
- C:\Windows\System\dEIycEP.exe
  C:\Windows\System\dEIycEP.exe
  2⤵
  PID:13044
- C:\Windows\System\YnBEIiG.exe
  C:\Windows\System\YnBEIiG.exe
  2⤵
  PID:11628
- C:\Windows\System\zajzfcj.exe
  C:\Windows\System\zajzfcj.exe
  2⤵
  PID:11680
- C:\Windows\System\PdptLiP.exe
  C:\Windows\System\PdptLiP.exe
  2⤵
  PID:13308
- C:\Windows\System\aWuEMCx.exe
  C:\Windows\System\aWuEMCx.exe
  2⤵
  PID:13076
- C:\Windows\System\dHgdnOY.exe
  C:\Windows\System\dHgdnOY.exe
  2⤵
  PID:15240
- C:\Windows\System\jXIsMNw.exe
  C:\Windows\System\jXIsMNw.exe
  2⤵
  PID:12376
- C:\Windows\System\mTMJtyi.exe
  C:\Windows\System\mTMJtyi.exe
  2⤵
  PID:10116
- C:\Windows\System\LECjnkQ.exe
  C:\Windows\System\LECjnkQ.exe
  2⤵
  PID:10788
- C:\Windows\System\XDoWXSw.exe
  C:\Windows\System\XDoWXSw.exe
  2⤵
  PID:4932
- C:\Windows\System\BnByAXi.exe
  C:\Windows\System\BnByAXi.exe
  2⤵
  PID:9792
- C:\Windows\System\AWicyMz.exe
  C:\Windows\System\AWicyMz.exe
  2⤵
  PID:10508
- C:\Windows\System\BLIQegO.exe
  C:\Windows\System\BLIQegO.exe
  2⤵
  PID:15120
- C:\Windows\System\quALGhe.exe
  C:\Windows\System\quALGhe.exe
  2⤵
  PID:9576
- C:\Windows\System\HNeUYmh.exe
  C:\Windows\System\HNeUYmh.exe
  2⤵
  PID:11456
- C:\Windows\System\pdfKCTI.exe
  C:\Windows\System\pdfKCTI.exe
  2⤵
  PID:10292
- C:\Windows\System\WsYycVu.exe
  C:\Windows\System\WsYycVu.exe
  2⤵
  PID:11788
- C:\Windows\System\lMfgzHZ.exe
  C:\Windows\System\lMfgzHZ.exe
  2⤵
  PID:9580
- C:\Windows\System\xyVQHJs.exe
  C:\Windows\System\xyVQHJs.exe
  2⤵
  PID:14888
- C:\Windows\System\MahHhfx.exe
  C:\Windows\System\MahHhfx.exe
  2⤵
  PID:11476
- C:\Windows\System\WwVfbZI.exe
  C:\Windows\System\WwVfbZI.exe
  2⤵
  PID:14688
- C:\Windows\System\EqSnJVt.exe
  C:\Windows\System\EqSnJVt.exe
  2⤵
  PID:11708
- C:\Windows\System\YuHUloQ.exe
  C:\Windows\System\YuHUloQ.exe
  2⤵
  PID:12884
- C:\Windows\System\qKNePtB.exe
  C:\Windows\System\qKNePtB.exe
  2⤵
  PID:8504
- C:\Windows\System\YXMxrtY.exe
  C:\Windows\System\YXMxrtY.exe
  2⤵
  PID:14784
- C:\Windows\System\vNzxQGF.exe
  C:\Windows\System\vNzxQGF.exe
  2⤵
  PID:14540
- C:\Windows\System\BHlUEqA.exe
  C:\Windows\System\BHlUEqA.exe
  2⤵
  PID:12008
- C:\Windows\System\cfGSukx.exe
  C:\Windows\System\cfGSukx.exe
  2⤵
  PID:2432
- C:\Windows\System\PYvMtWV.exe
  C:\Windows\System\PYvMtWV.exe
  2⤵
  PID:14684
- C:\Windows\System\ORbsEvC.exe
  C:\Windows\System\ORbsEvC.exe
  2⤵
  PID:14788
- C:\Windows\System\gLbGeWz.exe
  C:\Windows\System\gLbGeWz.exe
  2⤵
  PID:15196
- C:\Windows\System\jnXfzoC.exe
  C:\Windows\System\jnXfzoC.exe
  2⤵
  PID:15040
- C:\Windows\System\aBsWFEU.exe
  C:\Windows\System\aBsWFEU.exe
  2⤵
  PID:12956
- C:\Windows\System\ZomyYkl.exe
  C:\Windows\System\ZomyYkl.exe
  2⤵
  PID:13056
- C:\Windows\System\aLxVDBe.exe
  C:\Windows\System\aLxVDBe.exe
  2⤵
  PID:11060
- C:\Windows\System\whiBtma.exe
  C:\Windows\System\whiBtma.exe
  2⤵
  PID:12724
- C:\Windows\System\ZERLxyN.exe
  C:\Windows\System\ZERLxyN.exe
  2⤵
  PID:12112
- C:\Windows\System\HJNfUBg.exe
  C:\Windows\System\HJNfUBg.exe
  2⤵
  PID:13152
- C:\Windows\System\YhMYWFb.exe
  C:\Windows\System\YhMYWFb.exe
  2⤵
  PID:13756
- C:\Windows\System\HbykNVC.exe
  C:\Windows\System\HbykNVC.exe
  2⤵
  PID:13432
- C:\Windows\System\RTIaJsn.exe
  C:\Windows\System\RTIaJsn.exe
  2⤵
  PID:12580
- C:\Windows\System\IDUnTZF.exe
  C:\Windows\System\IDUnTZF.exe
  2⤵
  PID:11732
- C:\Windows\System\OlKCcoH.exe
  C:\Windows\System\OlKCcoH.exe
  2⤵
  PID:15228
- C:\Windows\System\HsHtbOb.exe
  C:\Windows\System\HsHtbOb.exe
  2⤵
  PID:13580
- C:\Windows\System\hqHlqZT.exe
  C:\Windows\System\hqHlqZT.exe
  2⤵
  PID:11784
- C:\Windows\System\hWATZtf.exe
  C:\Windows\System\hWATZtf.exe
  2⤵
  PID:13720
- C:\Windows\System\eQWQvIk.exe
  C:\Windows\System\eQWQvIk.exe
  2⤵
  PID:13200
- C:\Windows\System\BqtEuCe.exe
  C:\Windows\System\BqtEuCe.exe
  2⤵
  PID:14000
- C:\Windows\System\dPPwXZz.exe
  C:\Windows\System\dPPwXZz.exe
  2⤵
  PID:12660
- C:\Windows\System\gPsYUtI.exe
  C:\Windows\System\gPsYUtI.exe
  2⤵
  PID:15352
- C:\Windows\System\uXFbtQC.exe
  C:\Windows\System\uXFbtQC.exe
  2⤵
  PID:10524
- C:\Windows\System\oXLNOWi.exe
  C:\Windows\System\oXLNOWi.exe
  2⤵
  PID:13984
- C:\Windows\System\OnYKwoR.exe
  C:\Windows\System\OnYKwoR.exe
  2⤵
  PID:10856
- C:\Windows\System\CwSTdNq.exe
  C:\Windows\System\CwSTdNq.exe
  2⤵
  PID:13832
- C:\Windows\System\kTPDtMw.exe
  C:\Windows\System\kTPDtMw.exe
  2⤵
  PID:4368
- C:\Windows\System\oqcoLLb.exe
  C:\Windows\System\oqcoLLb.exe
  2⤵
  PID:12828
- C:\Windows\System\TRYoGwJ.exe
  C:\Windows\System\TRYoGwJ.exe
  2⤵
  PID:10968
- C:\Windows\System\xDUUXsP.exe
  C:\Windows\System\xDUUXsP.exe
  2⤵
  PID:14324
- C:\Windows\System\brGCYbm.exe
  C:\Windows\System\brGCYbm.exe
  2⤵
  PID:10532
- C:\Windows\System\cAkMOQb.exe
  C:\Windows\System\cAkMOQb.exe
  2⤵
  PID:13996
- C:\Windows\System\EjmXxhE.exe
  C:\Windows\System\EjmXxhE.exe
  2⤵
  PID:14020
- C:\Windows\System\lBqTixg.exe
  C:\Windows\System\lBqTixg.exe
  2⤵
  PID:13840
- C:\Windows\System\yrPLYzz.exe
  C:\Windows\System\yrPLYzz.exe
  2⤵
  PID:13952
- C:\Windows\System\nwkbulk.exe
  C:\Windows\System\nwkbulk.exe
  2⤵
  PID:13440
- C:\Windows\System\bmcDalG.exe
  C:\Windows\System\bmcDalG.exe
  2⤵
  PID:14404
- C:\Windows\System\KzKkFZn.exe
  C:\Windows\System\KzKkFZn.exe
  2⤵
  PID:12664
- C:\Windows\System\tmSVWIb.exe
  C:\Windows\System\tmSVWIb.exe
  2⤵
  PID:1040
- C:\Windows\System\SEyKjBP.exe
  C:\Windows\System\SEyKjBP.exe
  2⤵
  PID:12860
- C:\Windows\System\LxpPrTj.exe
  C:\Windows\System\LxpPrTj.exe
  2⤵
  PID:12940
- C:\Windows\System\NNPiTdg.exe
  C:\Windows\System\NNPiTdg.exe
  2⤵
  PID:12568
- C:\Windows\System\aPngjRQ.exe
  C:\Windows\System\aPngjRQ.exe
  2⤵
  PID:2124
- C:\Windows\System\osGQjGm.exe
  C:\Windows\System\osGQjGm.exe
  2⤵
  PID:9988
- C:\Windows\System\CgKglQg.exe
  C:\Windows\System\CgKglQg.exe
  2⤵
  PID:8060
- C:\Windows\System\wpoyHpM.exe
  C:\Windows\System\wpoyHpM.exe
  2⤵
  PID:4108
- C:\Windows\System\fHNACNZ.exe
  C:\Windows\System\fHNACNZ.exe
  2⤵
  PID:11748
- C:\Windows\System\sBEEnZB.exe
  C:\Windows\System\sBEEnZB.exe
  2⤵
  PID:13948
- C:\Windows\System\RlbYHPF.exe
  C:\Windows\System\RlbYHPF.exe
  2⤵
  PID:15200
- C:\Windows\System\DCRXJEp.exe
  C:\Windows\System\DCRXJEp.exe
  2⤵
  PID:4616
- C:\Windows\System\NfQpByV.exe
  C:\Windows\System\NfQpByV.exe
  2⤵
  PID:12592
- C:\Windows\System\dgRYabR.exe
  C:\Windows\System\dgRYabR.exe
  2⤵
  PID:13624
- C:\Windows\System\WswSLjX.exe
  C:\Windows\System\WswSLjX.exe
  2⤵
  PID:12132
- C:\Windows\System\NxQOtbh.exe
  C:\Windows\System\NxQOtbh.exe
  2⤵
  PID:3936
- C:\Windows\System\WnaTNOE.exe
  C:\Windows\System\WnaTNOE.exe
  2⤵
  PID:13768
- C:\Windows\System\jCKVJbL.exe
  C:\Windows\System\jCKVJbL.exe
  2⤵
  PID:12980
- C:\Windows\System\LfWbQOL.exe
  C:\Windows\System\LfWbQOL.exe
  2⤵
  PID:10260
- C:\Windows\System\DoOSKAJ.exe
  C:\Windows\System\DoOSKAJ.exe
  2⤵
  PID:13836
- C:\Windows\System\QZNUnrp.exe
  C:\Windows\System\QZNUnrp.exe
  2⤵
  PID:13352
- C:\Windows\System\pIXpcIs.exe
  C:\Windows\System\pIXpcIs.exe
  2⤵
  PID:5592
- C:\Windows\System\adqLLjc.exe
  C:\Windows\System\adqLLjc.exe
  2⤵
  PID:5884
- C:\Windows\System\KjCDABj.exe
  C:\Windows\System\KjCDABj.exe
  2⤵
  PID:1676
- C:\Windows\System\KSiPkLS.exe
  C:\Windows\System\KSiPkLS.exe
  2⤵
  PID:14180
- C:\Windows\System\mkcdoCS.exe
  C:\Windows\System\mkcdoCS.exe
  2⤵
  PID:5536
- C:\Windows\System\TNVCmrq.exe
  C:\Windows\System\TNVCmrq.exe
  2⤵
  PID:7616
- C:\Windows\System\BrYckZE.exe
  C:\Windows\System\BrYckZE.exe
  2⤵
  PID:13688
- C:\Windows\System\CvrOSJT.exe
  C:\Windows\System\CvrOSJT.exe
  2⤵
  PID:5568
- C:\Windows\System\FgBtLOl.exe
  C:\Windows\System\FgBtLOl.exe
  2⤵
  PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5764 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:12140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_25lhe1b5.cth.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AWpBNZb.exe

Filesize
2.2MB

MD5
1d7b654fc6f1af73ad39ede91b096058

SHA1
3fae935adbd8b76347be4ede8e877a9d83a5e27b

SHA256
cbf719658000b8c21218359e2105ddd862190efe2a848591e55cfbed5866c06e

SHA512
c6c927b81dfcc1074ea64bf2820eb0364033326f52ce4b989ae9e68613241ac85b1ebc1f997f2c04bf299823f2a90e7c0e5fcafb0d44278f146bd828d49ea390

Download Submit
C:\Windows\System\AncbhMx.exe

Filesize
2.2MB

MD5
23c65e80e1c8531540a81c15b4f6265f

SHA1
ab2aa8d623592e734b2e68ad0bb7497bde5815d6

SHA256
c38d84a8fcb6870bd6604268cf28bc0936cffab80cef421c5c80e20b3441b326

SHA512
8e0c25b153a5720f78dfbdcf8786649f472691cedf8047063b7bdef7a4ab31b5bbd619779e237072381c41d0275a92a3024e99c8af2654057eb3e3c1bdf50c7a

Download Submit
C:\Windows\System\FGaLhOx.exe

Filesize
2.2MB

MD5
b6adb1f4052e9371c7a1893060702c57

SHA1
d4632e5cca32a3228fc3d17968f8483bba9090ca

SHA256
eda164e110267b261fadc651e7434a99673eddc2f5872bf8393515fe54e01ec8

SHA512
a0036d0ddb3ecd2b50e24401c397d13df40c479294f83c9319cacd8ad9c3fa134b00e9eae8245d85d98b49d1bf1f8236ef9cdf8509073e2ab4771f16f1a83e6c

Download Submit
C:\Windows\System\HOREwcO.exe

Filesize
2.2MB

MD5
1a57d344b87a78301bf31d3dc8af1407

SHA1
497a796b76138c7559f040866a00c99a9f734010

SHA256
e16966b36ae978e695198915f5604f7eaf7e13ec595f6ab77abf5dc7e9e2a35f

SHA512
580d192526d4a6edccba1a62ba65ecf5e5707e289ccf6cb59dcbaa2718089fcddc6a33bb3eb93df5db01f344a04a256c47498d91f8ad87373fa7dc1bc150c7e6

Download Submit
C:\Windows\System\INXdnGd.exe

Filesize
2.2MB

MD5
18451ca8bf0fd0caa93fe80d1fc0bda3

SHA1
3d413d8f216d57d9bd5e3d502d584364480671c2

SHA256
a26d62565dd46678786bdb3ffd01c86a98040a984c15dd70d164066770afd5e8

SHA512
364171fd0d31b3b1beef20af6fdf6a4f61a38bd4f2abf8c6185c5a1a5901e09e4ef8cfb3860f1867b6ce63564c0e0fcc1084637d13d90f346babc4a2a99b16ec

Download Submit
C:\Windows\System\IczNyXC.exe

Filesize
2.2MB

MD5
23b4c638d8538113748e42b79d3134ad

SHA1
5c9d68c0a5ef024ff8499d5432fce2f214002d33

SHA256
686d47143b38d6d0318ebd2d8554d99612edece9c9a2fe605f182f2d316e5810

SHA512
142b6f6a502b32dddd1658aae61b509a4a091a8d58a52dc441c7cdf70576bc6e84a4f3aeb1a90b8e63a76b1c3309b83366dd7b8cd005bf69dd7339e34b84112f

Download Submit
C:\Windows\System\IhaghgB.exe

Filesize
2.2MB

MD5
308c6d8629d1ea5cd5df386b09e14593

SHA1
156cd6163b5ce09f840d0f3919c1f0ecdf9d7f90

SHA256
4847882d32ed09c0758c8d6bc7678b2c11f291233e37e54155f7edd932fa61f0

SHA512
5d651bf38d4005c5cf7e81ea31e2dba360e3d3a9f1e969aa5001963c7ce340d1bb85ffe71bb30fb7431b6cf728c811b686d070787dffe8dabfc3ef2fac6daa45

Download Submit
C:\Windows\System\LgpqSCm.exe

Filesize
2.2MB

MD5
1302e24231b999675e3e0b2d74d01800

SHA1
b9d8d54944997d3c07c7822a2d1eaee7dafb6872

SHA256
e1fb8058bff9ec687204edfa3f6c5b0b8439f28ac7b2748e40302a70accd96a8

SHA512
16a714dd1df291daca957f282e5ffb419e7b6039ac1c1cb94e31046f7ac23dc2fd14a265e03c9c6279829e09c34bb353f1ec27c7d598cda19533928fbcf4dd17

Download Submit
C:\Windows\System\MzPNcQO.exe

Filesize
2.2MB

MD5
2ca18408fe837714d7e29886c8222fe1

SHA1
9c299347f4a127fc32ad7843ee876f02986aefdf

SHA256
558350cafae107e30efc8c71f94c2c3702026caf85c11636d459e0b613948c12

SHA512
50fe3b5a1c3e6e1f2a1c9a6ccdf0a33cddc33dda1dbb14dc9fdd704e8dc6db7344d820dd100b0dccb7a42265034faf032d5cfb1f58e12327ee674fe82928514d

Download Submit
C:\Windows\System\OHutIDn.exe

Filesize
2.2MB

MD5
9ed2d01e67b6c3095e63062ae425167f

SHA1
e14d412f95adffa6cee2cd790c5ceafffba65b12

SHA256
9a6777933b9cef77eeba624dcbadeccb56152468c2acc2cbe20bdf2616aa3e56

SHA512
ba6cbea3b708804d346d74951ea1b416bb6efa71634e53611d1db16486e7bcf190e22d82c9aa43805e077e18b6eec52d874dc8284bfaaebd7a86f42f9e1352c3

Download Submit
C:\Windows\System\OVwLiXb.exe

Filesize
2.2MB

MD5
47dd289b0a6b95216d7123977b71f25c

SHA1
cd7bb114ca8c15c5ceec36df951b34af4fa0e49f

SHA256
1a3aa61e2897aa813a7e0837c4b66fc033b9acd6f9531223cfa537bfa7de0170

SHA512
b85f4e724e155a61762b291a8d88da57faec0f7f80ce7687263bb113c46173c18a02c8568680b0e13e1402ec0ad9e71e56907fde2097fc433f8f38d63a53266b

Download Submit
C:\Windows\System\RPDEQjo.exe

Filesize
2.2MB

MD5
7c6bec28d7bd14867288e7acbe4816e9

SHA1
d13a2b9fad44561f327b72d9cd597bf2a2e83e69

SHA256
46962188fde06931cd3151322890ec1d74d3213229cecabf4763b8e7357e0f1a

SHA512
caea3bcf1e7b0dcff49536ae65f9a3f5bd338bd9751210406b6dd55afacb628b699434ef86acaf1d8889ce6badd441517aadb7f5666ef145a578b4951e7de6cc

Download Submit
C:\Windows\System\RXdMBNy.exe

Filesize
2.2MB

MD5
3edaaef086d8735e08441fb930c53fe5

SHA1
da5cb1cdd7df5c3eaf1e8d46611446281fdff0dd

SHA256
6b74496e7b6d9af8f615c8454a7a3dcd2ffade0ab00572395305b49b59891e2b

SHA512
d0fcc5fd7faf6fd099ee1788add38b4f903e1804980467aecd92924d562b9b38dd661f5e0d7a088ec7ed54f2e492c9eb2cdf4bdccbb33d55128e3d9a5e7bdd85

Download Submit
C:\Windows\System\RebfcsO.exe

Filesize
2.2MB

MD5
79de51ae88d48954a1e88939c52397e2

SHA1
edf4c817934f81244d8801706f696fa4c2b576ac

SHA256
33e071364b44099456f1e0b930327728c634a9754142f6ec0a5d588610ec3738

SHA512
9463ca33f627571ffe350d530ffdc1a2adb8afd65488839b1e4b9fadef43e1cdd7284b7539d7764091f689af804d98bcb51cb9770f3a01b52f09db35e13f6e37

Download Submit
C:\Windows\System\RgiBqhm.exe

Filesize
2.2MB

MD5
d08d5e03ccd56cda4c4675039a88c385

SHA1
b62ab34f74f71c093625c19ac5a725c724289dc3

SHA256
b858e8a2941effc9dc21966c32154152be0ac4c6dc6364d6b91d6e6102c469c2

SHA512
26c13a197bfd08aa96501422301cfd78874dccd010f20525c3b950267a44bd4008bcdf4f387643da3335b5d28df702da0196920e602e2cefa242c94c44645422

Download Submit
C:\Windows\System\RhSEDKw.exe

Filesize
2.2MB

MD5
979a654ebd479ed1539e01d9c123d2d1

SHA1
df588e142b8be4e3a2a9aa07568547bb6d951976

SHA256
fe6cf4643cd5d70d9b5f058581ac5cf786a9e1a82fd28247a92919a62b8b00d0

SHA512
3c9bcedae6bd185ac83588319de9646bde12e72dfec305dbf9efa4ff70b812d21a430b5c89fd1c1de2b5b92ca0a214594e66b3fefc913a679d05647fd9893814

Download Submit
C:\Windows\System\UAJFFhd.exe

Filesize
2.2MB

MD5
5fcde8bd5a6eba620194fcf94ce0f3e8

SHA1
1ac4c2b3c36af3d49f86e9caaa9e26a2e41e56bf

SHA256
21fa902164b8ee3ab602906e48b1e39e484eb4f5195e9f2da925f98030b03f73

SHA512
bd384104b364bfaa40c3db82b6b229cea36b028fdae9279f3e3ee4e9571c0f90b616f7bcc90fbe5d159a6ee3a158782da029638836d69b8b9eb90a38f7c05bf3

Download Submit
C:\Windows\System\WsmkGcG.exe

Filesize
2.2MB

MD5
d287262901978048b885ae8b6755a1db

SHA1
5e20c475f3134b98f65e12cb752ad2c57529a87b

SHA256
40af71838d40cb4cd0d434a378a75e2e121aedf450d000325183757acaa429e0

SHA512
2ec180885b5ae1eba5ba6927004115f2e93d247fca9b472b33a87328cfc6c46994e41f6b4acd61651daf7b491359c982a08c0c618c75235d29265651b69c5b6d

Download Submit
C:\Windows\System\XXFYqmq.exe

Filesize
2.2MB

MD5
361f46497bbf8efe230d2ab2109b4654

SHA1
beed7a03833ee2f7a98a6c8c28ff7486fb59f312

SHA256
39591e03a5c7dbb8ee2c472c7cebb99d292724c52a781f6c5dc325f4adcc61d5

SHA512
dce8bd24c35641c8e810afdd72f86df9a0a0fc467fc1ec07b72b161e0a7c2d6203dcb295ef9d21e52e13b669521a541874b43b256bdba0fca44fb801dfddd437

Download Submit
C:\Windows\System\YIJrnBW.exe

Filesize
2.2MB

MD5
1c77e7056af29087b14c2e67071c8dce

SHA1
c6010b337a83b081111fedc968f5525da6dd37a8

SHA256
90a01b9ccc79e9084c93c44a41a188d2217570a01b79841fa62f1355ea5790ea

SHA512
3ddf33cbf1967c80f3811e1134298c735e414d7e2862891d2c14ffed39d4c72241cfa5b1ed0ca1ace032fcd0b23a2420fad6a2db06185b7adf2c25fa8c36fdb6

Download Submit
C:\Windows\System\bAYwHiT.exe

Filesize
2.2MB

MD5
edef64c2a7c7d1d04ff1edc2524b9682

SHA1
6c3e820349c037e2a4d4a004b6ca1416cbd7e6ec

SHA256
622bdaf082ff11804c378088afcea8e126043a118bf60e75fa63765dd946cb02

SHA512
579fbfd6745e4e9419474e5fd192e2549dabb7c564fee16a81988740bd524e8ede83cf72312a95153357c87df82d820b42aed3cd75042dde00a60120728490d7

Download Submit
C:\Windows\System\cUCjvUV.exe

Filesize
2.2MB

MD5
388b0138babffaf3b090fbafb095d18b

SHA1
e07912a9557791f2fa7a62182d7d3850ea94a6a7

SHA256
a195c61895fd6ea1b52acd3338114171cddeccb432d19e85cbd372d3e7c699d8

SHA512
d16b4ea1ff222dbe1ac955a535ffc0fe9e81d03c3ea2b04f5fb6e900d44a63e3c3672e882c1287364ba80df6c3d82ef84460aa379890c6aa39442c1e8f356866

Download Submit
C:\Windows\System\dHnYCEM.exe

Filesize
2.2MB

MD5
2f43e5a2e93c2f20826ad6d37736e518

SHA1
1e666bb1e4d1f7c2befd271e804b8cabafa5116e

SHA256
12dc53f8e1ba5fb4a0299fe8afbfa3e445cc050955a749bfbc897c47703fa876

SHA512
9e4058e43ad8c271eb363c64b61d50349776ad2bb49881326ef090a3a60102e16e15fb5df24bba407473931b639636c9f62e012870abfe0531763fbdb519dad8

Download Submit
C:\Windows\System\hQnuJuN.exe

Filesize
2.2MB

MD5
b5b6e6ec0237b48a8c1f39fa0aacfb48

SHA1
8f0dc739e71c022a3977318398973983cfd145fc

SHA256
db39d74d8dee6afa8a5f4fbf94c9d0e461bb4c647c3a0f6586463c568302627b

SHA512
6880e74e1aa1b0b258ed927b80acf79ac0d44dc9e06195aff5d07acb92da5a44ec1f80fe885574adaec72d88c03257c27444213289968d5f4897af819e1ec622

Download Submit
C:\Windows\System\mMZhrVt.exe

Filesize
2.2MB

MD5
ffcc0cbcf2daa70de38ed730f4b036b5

SHA1
dcce75ee044b0cb471d6522e59c3c19312cda90f

SHA256
84efe5cbf431227d4c6e19ba5da9775da0144730ec7876f21bbd18f06f98f8f3

SHA512
607464a6d2066a4b6ae5a7004e5e609103d120d97468b43acbd0537f152a80015065a5ace43c16142b9a5c5c820d4a1ef960a56cd8491f602044b6ddc8d1703c

Download Submit
C:\Windows\System\mZBtOhB.exe

Filesize
2.2MB

MD5
96eea6b5e53b30cd011135ca2a55f471

SHA1
d40e95512edf54dc07f4ec3ddb80795a6ba2e551

SHA256
7045d8a9aa5eca81acc7440bc164eb7c3571f18d5fe42fabeccc6ebfc52270bb

SHA512
82ee0273a47d0434a9ca7e2f2fc76f2d82ae6cdd1d776d46119f9925358f0943d4e6be425170ca50d86f92c94a71c70d0f08656bf0a9ce921ff63a5c6f37d668

Download Submit
C:\Windows\System\njPkNWb.exe

Filesize
2.2MB

MD5
4ac43bce65b6ebcdf15994e108a6ce00

SHA1
436e2494f5e4a829370ccce7d096b8bc06801c7b

SHA256
ee24a0a54e8ca87d03a4449b10be7e1ae4a64a43f1b9939fc52b7356152ebc37

SHA512
4d6a47d7871741361eea381ad4bd3f9491231b28461a51c52d8531dd67e7b3341f768d243f78202acce4b2d68c34d037c2931ae873af377455abbb8f7b90a583

Download Submit
C:\Windows\System\qKHCozV.exe

Filesize
2.2MB

MD5
eb227dd90c724c1f289111911de9871c

SHA1
ec6f793207e0f12c2066b67f724e662842133543

SHA256
b057aa029c76d0e3e4323f87a8f1357dea2e5a3b2738f38a75e397b0a49354c3

SHA512
ad44c4d5c5335782e2e2d811ddcbc8e8a430c2492ec66cbe7a399598dbd3ff46f5c67a829ba17801244ea3635f8e6ae7c0d59c1d667c854ddc4dc63b1fb0adcb

Download Submit
C:\Windows\System\tUaxXVm.exe

Filesize
2.2MB

MD5
e7900f4406fbecca20355149bc4721e6

SHA1
d1e6c38fe42161a9aab049bdeef74f2b72abd02c

SHA256
debecd239fbb0ec71e79a35edbe7376cc11bddccec07df0f1bf942f91823967d

SHA512
881cc480c9b47fd946a1bbec19313b43d5be993ee94102b0f7b5526b8b46226c98f1bcf8cfbc36be45ea491c481477332ef9f67bdcdbf64c49d2e9c0c0dfb79c

Download Submit
C:\Windows\System\tuEbUbf.exe

Filesize
2.2MB

MD5
cf8f86475354bb1770392e6d48227c4b

SHA1
ba1a7806eda94076e53f46f4e46eb037b0668ecf

SHA256
5cbf3c5f6f1b49cff463c03edf62fc2c94df188ade5315af8d4c0363aaa9b30b

SHA512
20613828c9076402e35ee0616fcbca6e7ed69446f04c7e79c364edfaacd034ca9e657366a3f833c200ee462e240184e143efd92b525bbbfb889d4ce3e9f12a38

Download Submit
C:\Windows\System\ureSxMk.exe

Filesize
2.2MB

MD5
8687703dc103d6d2c289e782365f7638

SHA1
a397804756c9349e43fe3cba09d0fcfbf9040528

SHA256
18b0fd598daff602cede24d0cf3aaff083f355c2844ffdcbaa9fe5c75d3a1885

SHA512
97ad2d3b29002edf0169510d35d8661132b42019fb5326871d942e7a0671d7b2d78a56c63293ceeeeecb15508f43010e9a5e49fd57cf9cb1d6a3916dd11ed3a5

Download Submit
C:\Windows\System\waweaKa.exe

Filesize
2.2MB

MD5
a7cf6026d3a336393cb776f99a1f4dfc

SHA1
41b0c2254e88a4e494b30bd9f25a13a32ed1bbcb

SHA256
b48990be00d4b32bdeaa27739df2fe3c371abd0589505b8008d9646220085591

SHA512
6be63b06e17085b62fa6914470540d880de6b4dee6832f92be438d787dc32f7a291fd5975eea901e8dbbb532cebd0039983c87906cd3d62aadfba607ea7ffc8f

Download Submit
C:\Windows\System\xNYFfTY.exe

Filesize
2.2MB

MD5
4e56e9922f6c6a90220ba3f5b5f6ec7b

SHA1
faa96cd2b9028fd995ed2552f2f8750a3a13e4f3

SHA256
271a3f831c41c3f70ead03651bc2b58f6bbe11b740bd1c0600d0aeced56dca3b

SHA512
df6722322c61dae0d63e49ef83c630260a0bc130484a8602b8470720f84c6506e3e0f2552ffa5ef0c2a3f6c009886fa6d5df8de4274cd4148da17818cf6b87b4

Download Submit
memory/232-574-0x00007FF650660000-0x00007FF650A52000-memory.dmp

Filesize
3.9MB

Download
memory/232-1865-0x00007FF650660000-0x00007FF650A52000-memory.dmp

Filesize
3.9MB

Download
memory/568-279-0x00000232F23C0000-0x00000232F2B66000-memory.dmp

Filesize
7.6MB

Download
memory/568-5073-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download
memory/568-39-0x00000232EF350000-0x00000232EF360000-memory.dmp

Filesize
64KB

Download
memory/568-16-0x00000232EF570000-0x00000232EF592000-memory.dmp

Filesize
136KB

Download
memory/568-26-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download
memory/652-3474-0x00007FF7C9430000-0x00007FF7C9822000-memory.dmp

Filesize
3.9MB

Download
memory/652-1-0x000002236BFF0000-0x000002236C000000-memory.dmp

Filesize
64KB

Download
memory/652-0-0x00007FF7C9430000-0x00007FF7C9822000-memory.dmp

Filesize
3.9MB

Download
memory/944-1729-0x00007FF79D4A0000-0x00007FF79D892000-memory.dmp

Filesize
3.9MB

Download
memory/944-43-0x00007FF79D4A0000-0x00007FF79D892000-memory.dmp

Filesize
3.9MB

Download
memory/1408-545-0x00007FF6973D0000-0x00007FF6977C2000-memory.dmp

Filesize
3.9MB

Download
memory/1408-1728-0x00007FF6973D0000-0x00007FF6977C2000-memory.dmp

Filesize
3.9MB

Download
memory/1444-61-0x00007FF798760000-0x00007FF798B52000-memory.dmp

Filesize
3.9MB

Download
memory/1444-1773-0x00007FF798760000-0x00007FF798B52000-memory.dmp

Filesize
3.9MB

Download
memory/1460-2402-0x00007FF67C3D0000-0x00007FF67C7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-58-0x00007FF67C3D0000-0x00007FF67C7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-526-0x00007FF60DF50000-0x00007FF60E342000-memory.dmp

Filesize
3.9MB

Download
memory/1648-1731-0x00007FF60DF50000-0x00007FF60E342000-memory.dmp

Filesize
3.9MB

Download
memory/1680-507-0x00007FF67DDD0000-0x00007FF67E1C2000-memory.dmp

Filesize
3.9MB

Download
memory/1680-1730-0x00007FF67DDD0000-0x00007FF67E1C2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-1732-0x00007FF749510000-0x00007FF749902000-memory.dmp

Filesize
3.9MB

Download
memory/2028-42-0x00007FF749510000-0x00007FF749902000-memory.dmp

Filesize
3.9MB

Download
memory/2440-1825-0x00007FF6065C0000-0x00007FF6069B2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-556-0x00007FF6065C0000-0x00007FF6069B2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-562-0x00007FF64F4D0000-0x00007FF64F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-1849-0x00007FF64F4D0000-0x00007FF64F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-1764-0x00007FF73FB90000-0x00007FF73FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2964-38-0x00007FF73FB90000-0x00007FF73FF82000-memory.dmp

Filesize
3.9MB

Download
memory/3428-1850-0x00007FF7817F0000-0x00007FF781BE2000-memory.dmp

Filesize
3.9MB

Download
memory/3428-569-0x00007FF7817F0000-0x00007FF781BE2000-memory.dmp

Filesize
3.9MB

Download
memory/3568-540-0x00007FF70DD50000-0x00007FF70E142000-memory.dmp

Filesize
3.9MB

Download
memory/3568-1774-0x00007FF70DD50000-0x00007FF70E142000-memory.dmp

Filesize
3.9MB

Download
memory/3604-570-0x00007FF674E00000-0x00007FF6751F2000-memory.dmp

Filesize
3.9MB

Download
memory/3604-1856-0x00007FF674E00000-0x00007FF6751F2000-memory.dmp

Filesize
3.9MB

Download
memory/3628-1766-0x00007FF7BFF50000-0x00007FF7C0342000-memory.dmp

Filesize
3.9MB

Download
memory/3628-532-0x00007FF7BFF50000-0x00007FF7C0342000-memory.dmp

Filesize
3.9MB

Download
memory/3688-41-0x00007FF6CDF80000-0x00007FF6CE372000-memory.dmp

Filesize
3.9MB

Download
memory/3688-1736-0x00007FF6CDF80000-0x00007FF6CE372000-memory.dmp

Filesize
3.9MB

Download
memory/3896-541-0x00007FF6A3040000-0x00007FF6A3432000-memory.dmp

Filesize
3.9MB

Download
memory/3896-1735-0x00007FF6A3040000-0x00007FF6A3432000-memory.dmp

Filesize
3.9MB

Download
memory/3956-493-0x00007FF6454A0000-0x00007FF645892000-memory.dmp

Filesize
3.9MB

Download
memory/3956-1769-0x00007FF6454A0000-0x00007FF645892000-memory.dmp

Filesize
3.9MB

Download
memory/4112-1776-0x00007FF623D80000-0x00007FF624172000-memory.dmp

Filesize
3.9MB

Download
memory/4112-53-0x00007FF623D80000-0x00007FF624172000-memory.dmp

Filesize
3.9MB

Download
memory/4820-517-0x00007FF6EFA60000-0x00007FF6EFE52000-memory.dmp

Filesize
3.9MB

Download
memory/4820-1779-0x00007FF6EFA60000-0x00007FF6EFE52000-memory.dmp

Filesize
3.9MB

Download
memory/5008-1762-0x00007FF7DE5F0000-0x00007FF7DE9E2000-memory.dmp

Filesize
3.9MB

Download
memory/5008-7-0x00007FF7DE5F0000-0x00007FF7DE9E2000-memory.dmp

Filesize
3.9MB

Download