xmrig | 3e07afa6658d4fab5ad640528e24a2844790ed67ad1c0c157bd9d6b2b3fb713c

Analysis

max time kernel
40s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
Size

2.2MB
MD5

05dba6e00982480d75e209a9dc41c420
SHA1

216225e5828e8c9edfc968a25c85c5249ce7737a
SHA256

3e07afa6658d4fab5ad640528e24a2844790ed67ad1c0c157bd9d6b2b3fb713c
SHA512

65a7fd157de71527b220c882a3723105d0477288783796f09e38842dbbb92d6f3da622145fbae201bb3a40490ab7e8e261d7b590e5c0d6e0dfb0c54b50e8eac7
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfu:NABb

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/3416-22-0x00007FF686410000-0x00007FF686802000-memory.dmp	xmrig
behavioral2/memory/5008-66-0x00007FF782EC0000-0x00007FF7832B2000-memory.dmp	xmrig
behavioral2/memory/2800-133-0x00007FF7DF440000-0x00007FF7DF832000-memory.dmp	xmrig
behavioral2/memory/3548-149-0x00007FF6A72F0000-0x00007FF6A76E2000-memory.dmp	xmrig
behavioral2/memory/336-153-0x00007FF64C6A0000-0x00007FF64CA92000-memory.dmp	xmrig
behavioral2/memory/4024-157-0x00007FF62C830000-0x00007FF62CC22000-memory.dmp	xmrig
behavioral2/memory/2268-156-0x00007FF7A2000000-0x00007FF7A23F2000-memory.dmp	xmrig
behavioral2/memory/1112-155-0x00007FF76FD30000-0x00007FF770122000-memory.dmp	xmrig
behavioral2/memory/1336-154-0x00007FF6024F0000-0x00007FF6028E2000-memory.dmp	xmrig
behavioral2/memory/3552-151-0x00007FF606780000-0x00007FF606B72000-memory.dmp	xmrig
behavioral2/memory/3192-150-0x00007FF746F90000-0x00007FF747382000-memory.dmp	xmrig
behavioral2/memory/1092-70-0x00007FF779A90000-0x00007FF779E82000-memory.dmp	xmrig
behavioral2/memory/2728-36-0x00007FF7F1420000-0x00007FF7F1812000-memory.dmp	xmrig
behavioral2/memory/3688-21-0x00007FF7A1A40000-0x00007FF7A1E32000-memory.dmp	xmrig
behavioral2/memory/3416-1539-0x00007FF686410000-0x00007FF686802000-memory.dmp	xmrig
behavioral2/memory/3688-1529-0x00007FF7A1A40000-0x00007FF7A1E32000-memory.dmp	xmrig
behavioral2/memory/5008-1549-0x00007FF782EC0000-0x00007FF7832B2000-memory.dmp	xmrig
behavioral2/memory/2728-1546-0x00007FF7F1420000-0x00007FF7F1812000-memory.dmp	xmrig
behavioral2/memory/4128-1545-0x00007FF745D10000-0x00007FF746102000-memory.dmp	xmrig
behavioral2/memory/3524-1544-0x00007FF613EE0000-0x00007FF6142D2000-memory.dmp	xmrig
behavioral2/memory/3908-1543-0x00007FF7D8630000-0x00007FF7D8A22000-memory.dmp	xmrig
behavioral2/memory/3884-1584-0x00007FF763D20000-0x00007FF764112000-memory.dmp	xmrig
behavioral2/memory/3744-1640-0x00007FF771B90000-0x00007FF771F82000-memory.dmp	xmrig
behavioral2/memory/3552-1649-0x00007FF606780000-0x00007FF606B72000-memory.dmp	xmrig
behavioral2/memory/224-1692-0x00007FF6F4350000-0x00007FF6F4742000-memory.dmp	xmrig
behavioral2/memory/1344-1720-0x00007FF79F780000-0x00007FF79FB72000-memory.dmp	xmrig
behavioral2/memory/3192-1648-0x00007FF746F90000-0x00007FF747382000-memory.dmp	xmrig
behavioral2/memory/4024-1642-0x00007FF62C830000-0x00007FF62CC22000-memory.dmp	xmrig
behavioral2/memory/4644-1636-0x00007FF6A52E0000-0x00007FF6A56D2000-memory.dmp	xmrig
behavioral2/memory/1112-1635-0x00007FF76FD30000-0x00007FF770122000-memory.dmp	xmrig
behavioral2/memory/2800-1631-0x00007FF7DF440000-0x00007FF7DF832000-memory.dmp	xmrig
behavioral2/memory/3548-1633-0x00007FF6A72F0000-0x00007FF6A76E2000-memory.dmp	xmrig
behavioral2/memory/2268-1629-0x00007FF7A2000000-0x00007FF7A23F2000-memory.dmp	xmrig
behavioral2/memory/336-1623-0x00007FF64C6A0000-0x00007FF64CA92000-memory.dmp	xmrig
behavioral2/memory/1336-1592-0x00007FF6024F0000-0x00007FF6028E2000-memory.dmp	xmrig
behavioral2/memory/3092-1595-0x00007FF6A89B0000-0x00007FF6A8DA2000-memory.dmp	xmrig
behavioral2/memory/1092-1594-0x00007FF779A90000-0x00007FF779E82000-memory.dmp	xmrig
behavioral2/memory/2260-1552-0x00007FF7FBB80000-0x00007FF7FBF72000-memory.dmp	xmrig
behavioral2/memory/956-3224-0x00007FF781160000-0x00007FF781552000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	1960	powershell.exe
10	1960	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3908	HByomct.exe
3688	jjpwXJd.exe
3416	LZRboBX.exe
3524	aXlChOA.exe
2728	SUgzAlz.exe
4128	btedYdP.exe
2260	eBkieAB.exe
5008	UHEUMiZ.exe
1092	DNLitsK.exe
3092	sRHaFQE.exe
336	wfHxiIZ.exe
1336	fKNCTRq.exe
3884	zjihbxj.exe
4644	fHFDtCN.exe
1112	lAQHzIr.exe
2268	zasLGwX.exe
3744	ovLpAEX.exe
2800	ctMqJkf.exe
3548	vUwOSPP.exe
4024	ztLgzbH.exe
1344	CjUocLQ.exe
3192	bGsMCjP.exe
3552	sMgesmx.exe
224	lIHIXAP.exe
4488	uFMzvlx.exe
848	jqJdPsh.exe
5056	ObVnSdQ.exe
2480	jivftRP.exe
892	AtiiBCd.exe
1380	BwKjgZj.exe
2868	urVNzHQ.exe
4188	ulVcLmj.exe
4512	znktKSV.exe
4404	hxAYVOA.exe
1628	NxlYpim.exe
652	naAxhSc.exe
1180	hNsdTHo.exe
3880	oHKLFpf.exe
2152	fdBhXMI.exe
3252	mrasfrT.exe
2676	SIugXKu.exe
2084	AkntthF.exe
3928	pEfPNRN.exe
1820	cTPkXZi.exe
1384	xxdyeLN.exe
4444	njxFEMN.exe
4648	EMMZFPF.exe
3432	OIAdYds.exe
3136	xZrdPhr.exe
3624	dmlDaxe.exe
212	AsqdQlH.exe
5152	CWCUnIX.exe
5172	IAodCKI.exe
5192	vRhdMnY.exe
5212	xaoHyjZ.exe
5228	bFvJNQt.exe
5252	gbfkDtg.exe
5272	LQHTWSl.exe
5300	eTSNUgF.exe
5320	jOgCfKg.exe
5336	tELKJYU.exe
5364	jnJaTxh.exe
5380	KWiPLqr.exe
5400	nHBwUYc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/956-0-0x00007FF781160000-0x00007FF781552000-memory.dmp	upx
behavioral2/files/0x000800000002323f-5.dat	upx
behavioral2/memory/3908-6-0x00007FF7D8630000-0x00007FF7D8A22000-memory.dmp	upx
behavioral2/files/0x0008000000023242-11.dat	upx
behavioral2/files/0x0008000000023245-15.dat	upx
behavioral2/memory/3416-22-0x00007FF686410000-0x00007FF686802000-memory.dmp	upx
behavioral2/files/0x0007000000023248-35.dat	upx
behavioral2/files/0x000700000002324a-37.dat	upx
behavioral2/files/0x0007000000023249-40.dat	upx
behavioral2/files/0x000700000002324b-45.dat	upx
behavioral2/files/0x000700000002324c-57.dat	upx
behavioral2/memory/5008-66-0x00007FF782EC0000-0x00007FF7832B2000-memory.dmp	upx
behavioral2/files/0x0007000000023251-80.dat	upx
behavioral2/files/0x0007000000023252-89.dat	upx
behavioral2/files/0x0007000000023255-102.dat	upx
behavioral2/files/0x0007000000023254-101.dat	upx
behavioral2/files/0x0007000000023253-98.dat	upx
behavioral2/files/0x0007000000023250-86.dat	upx
behavioral2/memory/3884-83-0x00007FF763D20000-0x00007FF764112000-memory.dmp	upx
behavioral2/files/0x000700000002324d-81.dat	upx
behavioral2/files/0x000700000002324e-79.dat	upx
behavioral2/memory/2800-133-0x00007FF7DF440000-0x00007FF7DF832000-memory.dmp	upx
behavioral2/memory/3548-149-0x00007FF6A72F0000-0x00007FF6A76E2000-memory.dmp	upx
behavioral2/memory/336-153-0x00007FF64C6A0000-0x00007FF64CA92000-memory.dmp	upx
behavioral2/memory/1344-158-0x00007FF79F780000-0x00007FF79FB72000-memory.dmp	upx
behavioral2/memory/4024-157-0x00007FF62C830000-0x00007FF62CC22000-memory.dmp	upx
behavioral2/memory/2268-156-0x00007FF7A2000000-0x00007FF7A23F2000-memory.dmp	upx
behavioral2/files/0x000700000002325d-168.dat	upx
behavioral2/files/0x0007000000023265-200.dat	upx
behavioral2/files/0x000700000002325f-192.dat	upx
behavioral2/files/0x000700000002325e-188.dat	upx
behavioral2/files/0x0007000000023264-187.dat	upx
behavioral2/files/0x0007000000023263-186.dat	upx
behavioral2/files/0x0007000000023262-185.dat	upx
behavioral2/files/0x0007000000023261-180.dat	upx
behavioral2/files/0x0007000000023260-176.dat	upx
behavioral2/files/0x0007000000023259-173.dat	upx
behavioral2/files/0x0007000000023256-164.dat	upx
behavioral2/files/0x000700000002325c-162.dat	upx
behavioral2/memory/1112-155-0x00007FF76FD30000-0x00007FF770122000-memory.dmp	upx
behavioral2/memory/1336-154-0x00007FF6024F0000-0x00007FF6028E2000-memory.dmp	upx
behavioral2/memory/224-152-0x00007FF6F4350000-0x00007FF6F4742000-memory.dmp	upx
behavioral2/memory/3552-151-0x00007FF606780000-0x00007FF606B72000-memory.dmp	upx
behavioral2/memory/3192-150-0x00007FF746F90000-0x00007FF747382000-memory.dmp	upx
behavioral2/files/0x0007000000023258-147.dat	upx
behavioral2/files/0x000700000002325b-146.dat	upx
behavioral2/files/0x000700000002325a-140.dat	upx
behavioral2/files/0x0007000000023257-134.dat	upx
behavioral2/memory/3744-115-0x00007FF771B90000-0x00007FF771F82000-memory.dmp	upx
behavioral2/memory/4644-105-0x00007FF6A52E0000-0x00007FF6A56D2000-memory.dmp	upx
behavioral2/files/0x000700000002324f-75.dat	upx
behavioral2/memory/3092-71-0x00007FF6A89B0000-0x00007FF6A8DA2000-memory.dmp	upx
behavioral2/memory/1092-70-0x00007FF779A90000-0x00007FF779E82000-memory.dmp	upx
behavioral2/files/0x0008000000023243-62.dat	upx
behavioral2/memory/2260-42-0x00007FF7FBB80000-0x00007FF7FBF72000-memory.dmp	upx
behavioral2/memory/4128-39-0x00007FF745D10000-0x00007FF746102000-memory.dmp	upx
behavioral2/memory/2728-36-0x00007FF7F1420000-0x00007FF7F1812000-memory.dmp	upx
behavioral2/files/0x0008000000023247-29.dat	upx
behavioral2/memory/3524-28-0x00007FF613EE0000-0x00007FF6142D2000-memory.dmp	upx
behavioral2/memory/3688-21-0x00007FF7A1A40000-0x00007FF7A1E32000-memory.dmp	upx
behavioral2/memory/3416-1539-0x00007FF686410000-0x00007FF686802000-memory.dmp	upx
behavioral2/memory/3688-1529-0x00007FF7A1A40000-0x00007FF7A1E32000-memory.dmp	upx
behavioral2/memory/5008-1549-0x00007FF782EC0000-0x00007FF7832B2000-memory.dmp	upx
behavioral2/memory/2728-1546-0x00007FF7F1420000-0x00007FF7F1812000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wmbZIYO.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\TaakhNb.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\ERgeHKe.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\GkUpnCw.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\nrACZyN.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\FVjXquW.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\huZjrmR.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\jjpwXJd.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\LGeKjYP.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\ssbtGoK.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\DdmWjbV.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\tUyxnDR.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\rmDiVrm.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\jivftRP.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\nEppGTN.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\WCcolUw.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\njxFEMN.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\CWCUnIX.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\fKNCTRq.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\OPRWHli.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\chlJNZc.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\dSgMhzN.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\FmFnfoX.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\DAQovDR.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\cpRYbkp.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\RzAZmOt.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\DeLjNih.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\WTbLDvF.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\RNXoyrV.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\HRmyPyx.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\aJBehKM.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\cmGHTRg.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\GtMZwIJ.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\kgjPUJo.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\aVKmVuj.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\BDIdfoz.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\lIHIXAP.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\WufoDHS.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\jysIHyT.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\vGwdJKU.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\cEqqArM.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\ghLxPHy.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\bFvJNQt.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\CRMvCxo.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\xMJNtcx.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\YSrDRYz.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\ZwDMcZE.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\LwFZeVJ.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\BwtNmSd.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\mAXntVN.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\LiIrxjO.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\lNnehOZ.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\fZOONVZ.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\zvzoCYP.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\fdBhXMI.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\bYdtJOT.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\WfSNzrB.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\KlVRodz.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\TvtSgeP.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\MTnCmKu.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\iPlmlQu.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\hPVtgzO.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\FZJQfLv.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\PVnjLIi.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
Token: SeDebugPrivilege	1960	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1960	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	92
PID 956 wrote to memory of 1960	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	92
PID 956 wrote to memory of 3908	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	93
PID 956 wrote to memory of 3908	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	93
PID 956 wrote to memory of 3688	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	94
PID 956 wrote to memory of 3688	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	94
PID 956 wrote to memory of 3416	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	95
PID 956 wrote to memory of 3416	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	95
PID 956 wrote to memory of 3524	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	96
PID 956 wrote to memory of 3524	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	96
PID 956 wrote to memory of 2728	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	97
PID 956 wrote to memory of 2728	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	97
PID 956 wrote to memory of 4128	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	98
PID 956 wrote to memory of 4128	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	98
PID 956 wrote to memory of 2260	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	99
PID 956 wrote to memory of 2260	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	99
PID 956 wrote to memory of 5008	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	100
PID 956 wrote to memory of 5008	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	100
PID 956 wrote to memory of 1092	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	101
PID 956 wrote to memory of 1092	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	101
PID 956 wrote to memory of 3092	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	102
PID 956 wrote to memory of 3092	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	102
PID 956 wrote to memory of 3884	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	103
PID 956 wrote to memory of 3884	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	103
PID 956 wrote to memory of 336	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	104
PID 956 wrote to memory of 336	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	104
PID 956 wrote to memory of 1336	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	105
PID 956 wrote to memory of 1336	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	105
PID 956 wrote to memory of 4644	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	106
PID 956 wrote to memory of 4644	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	106
PID 956 wrote to memory of 1112	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	107
PID 956 wrote to memory of 1112	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	107
PID 956 wrote to memory of 2268	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	108
PID 956 wrote to memory of 2268	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	108
PID 956 wrote to memory of 3744	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	109
PID 956 wrote to memory of 3744	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	109
PID 956 wrote to memory of 2800	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	110
PID 956 wrote to memory of 2800	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	110
PID 956 wrote to memory of 3548	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	111
PID 956 wrote to memory of 3548	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	111
PID 956 wrote to memory of 1344	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	112
PID 956 wrote to memory of 1344	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	112
PID 956 wrote to memory of 4024	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	113
PID 956 wrote to memory of 4024	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	113
PID 956 wrote to memory of 224	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	114
PID 956 wrote to memory of 224	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	114
PID 956 wrote to memory of 5056	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	115
PID 956 wrote to memory of 5056	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	115
PID 956 wrote to memory of 3192	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	116
PID 956 wrote to memory of 3192	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	116
PID 956 wrote to memory of 3552	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	117
PID 956 wrote to memory of 3552	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	117
PID 956 wrote to memory of 4488	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	118
PID 956 wrote to memory of 4488	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	118
PID 956 wrote to memory of 848	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	119
PID 956 wrote to memory of 848	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	119
PID 956 wrote to memory of 2480	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	120
PID 956 wrote to memory of 2480	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	120
PID 956 wrote to memory of 892	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	121
PID 956 wrote to memory of 892	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	121
PID 956 wrote to memory of 1380	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	122
PID 956 wrote to memory of 1380	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	122
PID 956 wrote to memory of 2868	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	123
PID 956 wrote to memory of 2868	956	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System\HByomct.exe
  C:\Windows\System\HByomct.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\jjpwXJd.exe
  C:\Windows\System\jjpwXJd.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\LZRboBX.exe
  C:\Windows\System\LZRboBX.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\aXlChOA.exe
  C:\Windows\System\aXlChOA.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\SUgzAlz.exe
  C:\Windows\System\SUgzAlz.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\btedYdP.exe
  C:\Windows\System\btedYdP.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\eBkieAB.exe
  C:\Windows\System\eBkieAB.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\UHEUMiZ.exe
  C:\Windows\System\UHEUMiZ.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\DNLitsK.exe
  C:\Windows\System\DNLitsK.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\sRHaFQE.exe
  C:\Windows\System\sRHaFQE.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\zjihbxj.exe
  C:\Windows\System\zjihbxj.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\wfHxiIZ.exe
  C:\Windows\System\wfHxiIZ.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\fKNCTRq.exe
  C:\Windows\System\fKNCTRq.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\fHFDtCN.exe
  C:\Windows\System\fHFDtCN.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\lAQHzIr.exe
  C:\Windows\System\lAQHzIr.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\zasLGwX.exe
  C:\Windows\System\zasLGwX.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\ovLpAEX.exe
  C:\Windows\System\ovLpAEX.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\ctMqJkf.exe
  C:\Windows\System\ctMqJkf.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\vUwOSPP.exe
  C:\Windows\System\vUwOSPP.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\CjUocLQ.exe
  C:\Windows\System\CjUocLQ.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\ztLgzbH.exe
  C:\Windows\System\ztLgzbH.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\lIHIXAP.exe
  C:\Windows\System\lIHIXAP.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\ObVnSdQ.exe
  C:\Windows\System\ObVnSdQ.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\bGsMCjP.exe
  C:\Windows\System\bGsMCjP.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\sMgesmx.exe
  C:\Windows\System\sMgesmx.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\uFMzvlx.exe
  C:\Windows\System\uFMzvlx.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\jqJdPsh.exe
  C:\Windows\System\jqJdPsh.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\jivftRP.exe
  C:\Windows\System\jivftRP.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\AtiiBCd.exe
  C:\Windows\System\AtiiBCd.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\BwKjgZj.exe
  C:\Windows\System\BwKjgZj.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\urVNzHQ.exe
  C:\Windows\System\urVNzHQ.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\ulVcLmj.exe
  C:\Windows\System\ulVcLmj.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\znktKSV.exe
  C:\Windows\System\znktKSV.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\hxAYVOA.exe
  C:\Windows\System\hxAYVOA.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\NxlYpim.exe
  C:\Windows\System\NxlYpim.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\naAxhSc.exe
  C:\Windows\System\naAxhSc.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\hNsdTHo.exe
  C:\Windows\System\hNsdTHo.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\oHKLFpf.exe
  C:\Windows\System\oHKLFpf.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\fdBhXMI.exe
  C:\Windows\System\fdBhXMI.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\mrasfrT.exe
  C:\Windows\System\mrasfrT.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\SIugXKu.exe
  C:\Windows\System\SIugXKu.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\AkntthF.exe
  C:\Windows\System\AkntthF.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\pEfPNRN.exe
  C:\Windows\System\pEfPNRN.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\cTPkXZi.exe
  C:\Windows\System\cTPkXZi.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\xxdyeLN.exe
  C:\Windows\System\xxdyeLN.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\njxFEMN.exe
  C:\Windows\System\njxFEMN.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\EMMZFPF.exe
  C:\Windows\System\EMMZFPF.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\OIAdYds.exe
  C:\Windows\System\OIAdYds.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\xZrdPhr.exe
  C:\Windows\System\xZrdPhr.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\dmlDaxe.exe
  C:\Windows\System\dmlDaxe.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\AsqdQlH.exe
  C:\Windows\System\AsqdQlH.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\CWCUnIX.exe
  C:\Windows\System\CWCUnIX.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\IAodCKI.exe
  C:\Windows\System\IAodCKI.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\vRhdMnY.exe
  C:\Windows\System\vRhdMnY.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System\xaoHyjZ.exe
  C:\Windows\System\xaoHyjZ.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\bFvJNQt.exe
  C:\Windows\System\bFvJNQt.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System\gbfkDtg.exe
  C:\Windows\System\gbfkDtg.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\LQHTWSl.exe
  C:\Windows\System\LQHTWSl.exe
  2⤵
  - Executes dropped EXE
  PID:5272
- C:\Windows\System\eTSNUgF.exe
  C:\Windows\System\eTSNUgF.exe
  2⤵
  - Executes dropped EXE
  PID:5300
- C:\Windows\System\jOgCfKg.exe
  C:\Windows\System\jOgCfKg.exe
  2⤵
  - Executes dropped EXE
  PID:5320
- C:\Windows\System\tELKJYU.exe
  C:\Windows\System\tELKJYU.exe
  2⤵
  - Executes dropped EXE
  PID:5336
- C:\Windows\System\jnJaTxh.exe
  C:\Windows\System\jnJaTxh.exe
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\System\KWiPLqr.exe
  C:\Windows\System\KWiPLqr.exe
  2⤵
  - Executes dropped EXE
  PID:5380
- C:\Windows\System\nHBwUYc.exe
  C:\Windows\System\nHBwUYc.exe
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Windows\System\CJSJIYz.exe
  C:\Windows\System\CJSJIYz.exe
  2⤵
  PID:5428
- C:\Windows\System\WTbLDvF.exe
  C:\Windows\System\WTbLDvF.exe
  2⤵
  PID:5448
- C:\Windows\System\sZwRnQe.exe
  C:\Windows\System\sZwRnQe.exe
  2⤵
  PID:5468
- C:\Windows\System\tlsAbWD.exe
  C:\Windows\System\tlsAbWD.exe
  2⤵
  PID:5496
- C:\Windows\System\RaWubBV.exe
  C:\Windows\System\RaWubBV.exe
  2⤵
  PID:5516
- C:\Windows\System\VwXgqEK.exe
  C:\Windows\System\VwXgqEK.exe
  2⤵
  PID:5532
- C:\Windows\System\nEppGTN.exe
  C:\Windows\System\nEppGTN.exe
  2⤵
  PID:5552
- C:\Windows\System\bYdtJOT.exe
  C:\Windows\System\bYdtJOT.exe
  2⤵
  PID:5576
- C:\Windows\System\yQarhfy.exe
  C:\Windows\System\yQarhfy.exe
  2⤵
  PID:5736
- C:\Windows\System\osXEjbp.exe
  C:\Windows\System\osXEjbp.exe
  2⤵
  PID:5952
- C:\Windows\System\pYaUAZn.exe
  C:\Windows\System\pYaUAZn.exe
  2⤵
  PID:6004
- C:\Windows\System\fxfqFRK.exe
  C:\Windows\System\fxfqFRK.exe
  2⤵
  PID:6028
- C:\Windows\System\agsxbiE.exe
  C:\Windows\System\agsxbiE.exe
  2⤵
  PID:6048
- C:\Windows\System\IkjKoPt.exe
  C:\Windows\System\IkjKoPt.exe
  2⤵
  PID:4208
- C:\Windows\System\tpWpXoH.exe
  C:\Windows\System\tpWpXoH.exe
  2⤵
  PID:1768
- C:\Windows\System\FCjqwYb.exe
  C:\Windows\System\FCjqwYb.exe
  2⤵
  PID:3096
- C:\Windows\System\Iwteyxp.exe
  C:\Windows\System\Iwteyxp.exe
  2⤵
  PID:3284
- C:\Windows\System\jCLCPEZ.exe
  C:\Windows\System\jCLCPEZ.exe
  2⤵
  PID:4536
- C:\Windows\System\hnsbpGL.exe
  C:\Windows\System\hnsbpGL.exe
  2⤵
  PID:5040
- C:\Windows\System\EAycvrV.exe
  C:\Windows\System\EAycvrV.exe
  2⤵
  PID:4480
- C:\Windows\System\oAZGnkz.exe
  C:\Windows\System\oAZGnkz.exe
  2⤵
  PID:3544
- C:\Windows\System\sAhQFAu.exe
  C:\Windows\System\sAhQFAu.exe
  2⤵
  PID:5164
- C:\Windows\System\llNzuvt.exe
  C:\Windows\System\llNzuvt.exe
  2⤵
  PID:4528
- C:\Windows\System\xgsKZiT.exe
  C:\Windows\System\xgsKZiT.exe
  2⤵
  PID:5240
- C:\Windows\System\SBJMYXd.exe
  C:\Windows\System\SBJMYXd.exe
  2⤵
  PID:5312
- C:\Windows\System\nrACZyN.exe
  C:\Windows\System\nrACZyN.exe
  2⤵
  PID:5352
- C:\Windows\System\KdiKzXI.exe
  C:\Windows\System\KdiKzXI.exe
  2⤵
  PID:5408
- C:\Windows\System\USalZUI.exe
  C:\Windows\System\USalZUI.exe
  2⤵
  PID:5440
- C:\Windows\System\OFdhwtt.exe
  C:\Windows\System\OFdhwtt.exe
  2⤵
  PID:5488
- C:\Windows\System\AUbDUNk.exe
  C:\Windows\System\AUbDUNk.exe
  2⤵
  PID:5524
- C:\Windows\System\CRMvCxo.exe
  C:\Windows\System\CRMvCxo.exe
  2⤵
  PID:5568
- C:\Windows\System\ipnXSHk.exe
  C:\Windows\System\ipnXSHk.exe
  2⤵
  PID:5652
- C:\Windows\System\uWBUNWs.exe
  C:\Windows\System\uWBUNWs.exe
  2⤵
  PID:5708
- C:\Windows\System\BiEyGKP.exe
  C:\Windows\System\BiEyGKP.exe
  2⤵
  PID:5772
- C:\Windows\System\rteNqXE.exe
  C:\Windows\System\rteNqXE.exe
  2⤵
  PID:5828
- C:\Windows\System\WgjukHR.exe
  C:\Windows\System\WgjukHR.exe
  2⤵
  PID:4428
- C:\Windows\System\LGeKjYP.exe
  C:\Windows\System\LGeKjYP.exe
  2⤵
  PID:4828
- C:\Windows\System\WCcolUw.exe
  C:\Windows\System\WCcolUw.exe
  2⤵
  PID:5928
- C:\Windows\System\eTZUCyI.exe
  C:\Windows\System\eTZUCyI.exe
  2⤵
  PID:3396
- C:\Windows\System\tMcjadD.exe
  C:\Windows\System\tMcjadD.exe
  2⤵
  PID:3840
- C:\Windows\System\ghkmWsm.exe
  C:\Windows\System\ghkmWsm.exe
  2⤵
  PID:3516
- C:\Windows\System\IOjQnLD.exe
  C:\Windows\System\IOjQnLD.exe
  2⤵
  PID:4400
- C:\Windows\System\bXynyFV.exe
  C:\Windows\System\bXynyFV.exe
  2⤵
  PID:4236
- C:\Windows\System\BDyhFxy.exe
  C:\Windows\System\BDyhFxy.exe
  2⤵
  PID:2128
- C:\Windows\System\lTJQBpF.exe
  C:\Windows\System\lTJQBpF.exe
  2⤵
  PID:408
- C:\Windows\System\yvysOYs.exe
  C:\Windows\System\yvysOYs.exe
  2⤵
  PID:1308
- C:\Windows\System\ftadJwa.exe
  C:\Windows\System\ftadJwa.exe
  2⤵
  PID:980
- C:\Windows\System\brfVuUV.exe
  C:\Windows\System\brfVuUV.exe
  2⤵
  PID:8
- C:\Windows\System\ZKqMGvj.exe
  C:\Windows\System\ZKqMGvj.exe
  2⤵
  PID:1504
- C:\Windows\System\ZtlaWDz.exe
  C:\Windows\System\ZtlaWDz.exe
  2⤵
  PID:2836
- C:\Windows\System\QMwBZaB.exe
  C:\Windows\System\QMwBZaB.exe
  2⤵
  PID:4016
- C:\Windows\System\LPUaYIN.exe
  C:\Windows\System\LPUaYIN.exe
  2⤵
  PID:5996
- C:\Windows\System\EVFdvgk.exe
  C:\Windows\System\EVFdvgk.exe
  2⤵
  PID:6044
- C:\Windows\System\WlAvvEB.exe
  C:\Windows\System\WlAvvEB.exe
  2⤵
  PID:6104
- C:\Windows\System\WtHniXp.exe
  C:\Windows\System\WtHniXp.exe
  2⤵
  PID:5924
- C:\Windows\System\ekVuLcz.exe
  C:\Windows\System\ekVuLcz.exe
  2⤵
  PID:4424
- C:\Windows\System\cmGHTRg.exe
  C:\Windows\System\cmGHTRg.exe
  2⤵
  PID:768
- C:\Windows\System\IJrADPu.exe
  C:\Windows\System\IJrADPu.exe
  2⤵
  PID:5160
- C:\Windows\System\EAmzkLJ.exe
  C:\Windows\System\EAmzkLJ.exe
  2⤵
  PID:4120
- C:\Windows\System\VYhIaMA.exe
  C:\Windows\System\VYhIaMA.exe
  2⤵
  PID:5476
- C:\Windows\System\ssbtGoK.exe
  C:\Windows\System\ssbtGoK.exe
  2⤵
  PID:5704
- C:\Windows\System\EEsOCsx.exe
  C:\Windows\System\EEsOCsx.exe
  2⤵
  PID:2360
- C:\Windows\System\ismXLYs.exe
  C:\Windows\System\ismXLYs.exe
  2⤵
  PID:3456
- C:\Windows\System\SWnMfpd.exe
  C:\Windows\System\SWnMfpd.exe
  2⤵
  PID:5344
- C:\Windows\System\qUsbtNk.exe
  C:\Windows\System\qUsbtNk.exe
  2⤵
  PID:5464
- C:\Windows\System\LhAArhq.exe
  C:\Windows\System\LhAArhq.exe
  2⤵
  PID:4196
- C:\Windows\System\Imapizn.exe
  C:\Windows\System\Imapizn.exe
  2⤵
  PID:4948
- C:\Windows\System\zyDmrkF.exe
  C:\Windows\System\zyDmrkF.exe
  2⤵
  PID:1812
- C:\Windows\System\yloYGOR.exe
  C:\Windows\System\yloYGOR.exe
  2⤵
  PID:4896
- C:\Windows\System\nHJEWVo.exe
  C:\Windows\System\nHJEWVo.exe
  2⤵
  PID:5984
- C:\Windows\System\wgUNYPw.exe
  C:\Windows\System\wgUNYPw.exe
  2⤵
  PID:3600
- C:\Windows\System\sbUkbze.exe
  C:\Windows\System\sbUkbze.exe
  2⤵
  PID:4248
- C:\Windows\System\WfSNzrB.exe
  C:\Windows\System\WfSNzrB.exe
  2⤵
  PID:6164
- C:\Windows\System\TaakhNb.exe
  C:\Windows\System\TaakhNb.exe
  2⤵
  PID:6272
- C:\Windows\System\KlVRodz.exe
  C:\Windows\System\KlVRodz.exe
  2⤵
  PID:6316
- C:\Windows\System\lLhauAF.exe
  C:\Windows\System\lLhauAF.exe
  2⤵
  PID:6336
- C:\Windows\System\TvtSgeP.exe
  C:\Windows\System\TvtSgeP.exe
  2⤵
  PID:6364
- C:\Windows\System\FGWmQaT.exe
  C:\Windows\System\FGWmQaT.exe
  2⤵
  PID:6384
- C:\Windows\System\sKZnUyy.exe
  C:\Windows\System\sKZnUyy.exe
  2⤵
  PID:6420
- C:\Windows\System\NYeEyLA.exe
  C:\Windows\System\NYeEyLA.exe
  2⤵
  PID:6444
- C:\Windows\System\ttoDGPx.exe
  C:\Windows\System\ttoDGPx.exe
  2⤵
  PID:6468
- C:\Windows\System\oeQXlMI.exe
  C:\Windows\System\oeQXlMI.exe
  2⤵
  PID:6496
- C:\Windows\System\GfMyEZT.exe
  C:\Windows\System\GfMyEZT.exe
  2⤵
  PID:6520
- C:\Windows\System\xMJNtcx.exe
  C:\Windows\System\xMJNtcx.exe
  2⤵
  PID:6540
- C:\Windows\System\YENAoJU.exe
  C:\Windows\System\YENAoJU.exe
  2⤵
  PID:6580
- C:\Windows\System\DkNnlqk.exe
  C:\Windows\System\DkNnlqk.exe
  2⤵
  PID:6604
- C:\Windows\System\ESZsZNh.exe
  C:\Windows\System\ESZsZNh.exe
  2⤵
  PID:6620
- C:\Windows\System\NUMipoc.exe
  C:\Windows\System\NUMipoc.exe
  2⤵
  PID:6652
- C:\Windows\System\EWDcPah.exe
  C:\Windows\System\EWDcPah.exe
  2⤵
  PID:6680
- C:\Windows\System\WXEUWHK.exe
  C:\Windows\System\WXEUWHK.exe
  2⤵
  PID:6696
- C:\Windows\System\WVyQvOA.exe
  C:\Windows\System\WVyQvOA.exe
  2⤵
  PID:6728
- C:\Windows\System\sOtHKFw.exe
  C:\Windows\System\sOtHKFw.exe
  2⤵
  PID:6748
- C:\Windows\System\vSibSTz.exe
  C:\Windows\System\vSibSTz.exe
  2⤵
  PID:6772
- C:\Windows\System\zrMfdSf.exe
  C:\Windows\System\zrMfdSf.exe
  2⤵
  PID:6796
- C:\Windows\System\amgqfwz.exe
  C:\Windows\System\amgqfwz.exe
  2⤵
  PID:6816
- C:\Windows\System\orMwpLb.exe
  C:\Windows\System\orMwpLb.exe
  2⤵
  PID:6840
- C:\Windows\System\OOncPoD.exe
  C:\Windows\System\OOncPoD.exe
  2⤵
  PID:6860
- C:\Windows\System\nxPagma.exe
  C:\Windows\System\nxPagma.exe
  2⤵
  PID:6888
- C:\Windows\System\DbhlGkr.exe
  C:\Windows\System\DbhlGkr.exe
  2⤵
  PID:6908
- C:\Windows\System\JlkSxxt.exe
  C:\Windows\System\JlkSxxt.exe
  2⤵
  PID:6932
- C:\Windows\System\ncDpOwD.exe
  C:\Windows\System\ncDpOwD.exe
  2⤵
  PID:6956
- C:\Windows\System\MhSWilL.exe
  C:\Windows\System\MhSWilL.exe
  2⤵
  PID:6984
- C:\Windows\System\tYeAfVn.exe
  C:\Windows\System\tYeAfVn.exe
  2⤵
  PID:7000
- C:\Windows\System\bkFaKLo.exe
  C:\Windows\System\bkFaKLo.exe
  2⤵
  PID:7024
- C:\Windows\System\OlmFXks.exe
  C:\Windows\System\OlmFXks.exe
  2⤵
  PID:7048
- C:\Windows\System\lDZNucd.exe
  C:\Windows\System\lDZNucd.exe
  2⤵
  PID:7068
- C:\Windows\System\OPRWHli.exe
  C:\Windows\System\OPRWHli.exe
  2⤵
  PID:7092
- C:\Windows\System\BPquVON.exe
  C:\Windows\System\BPquVON.exe
  2⤵
  PID:7112
- C:\Windows\System\vEYMMwL.exe
  C:\Windows\System\vEYMMwL.exe
  2⤵
  PID:7132
- C:\Windows\System\xWMMCyS.exe
  C:\Windows\System\xWMMCyS.exe
  2⤵
  PID:7156
- C:\Windows\System\PphWoSf.exe
  C:\Windows\System\PphWoSf.exe
  2⤵
  PID:5992
- C:\Windows\System\ObxgEgy.exe
  C:\Windows\System\ObxgEgy.exe
  2⤵
  PID:3836
- C:\Windows\System\qKFIfCJ.exe
  C:\Windows\System\qKFIfCJ.exe
  2⤵
  PID:488
- C:\Windows\System\jFkbOlF.exe
  C:\Windows\System\jFkbOlF.exe
  2⤵
  PID:5540
- C:\Windows\System\NVhsJSR.exe
  C:\Windows\System\NVhsJSR.exe
  2⤵
  PID:5628
- C:\Windows\System\Fvwdimb.exe
  C:\Windows\System\Fvwdimb.exe
  2⤵
  PID:3608
- C:\Windows\System\TYZLzhp.exe
  C:\Windows\System\TYZLzhp.exe
  2⤵
  PID:1428
- C:\Windows\System\hBMpUHw.exe
  C:\Windows\System\hBMpUHw.exe
  2⤵
  PID:5820
- C:\Windows\System\PwGocdB.exe
  C:\Windows\System\PwGocdB.exe
  2⤵
  PID:6332
- C:\Windows\System\vpRxwcO.exe
  C:\Windows\System\vpRxwcO.exe
  2⤵
  PID:6224
- C:\Windows\System\AgvDcrT.exe
  C:\Windows\System\AgvDcrT.exe
  2⤵
  PID:6464
- C:\Windows\System\KMrjJjn.exe
  C:\Windows\System\KMrjJjn.exe
  2⤵
  PID:4788
- C:\Windows\System\APejwCR.exe
  C:\Windows\System\APejwCR.exe
  2⤵
  PID:6284
- C:\Windows\System\AqvuSYM.exe
  C:\Windows\System\AqvuSYM.exe
  2⤵
  PID:6176
- C:\Windows\System\uOKuOpq.exe
  C:\Windows\System\uOKuOpq.exe
  2⤵
  PID:6392
- C:\Windows\System\CVkrmcU.exe
  C:\Windows\System\CVkrmcU.exe
  2⤵
  PID:6508
- C:\Windows\System\ideMJEo.exe
  C:\Windows\System\ideMJEo.exe
  2⤵
  PID:6564
- C:\Windows\System\Engjutw.exe
  C:\Windows\System\Engjutw.exe
  2⤵
  PID:6640
- C:\Windows\System\uHzVzco.exe
  C:\Windows\System\uHzVzco.exe
  2⤵
  PID:6992
- C:\Windows\System\eFdUfvQ.exe
  C:\Windows\System\eFdUfvQ.exe
  2⤵
  PID:6716
- C:\Windows\System\ZwDMcZE.exe
  C:\Windows\System\ZwDMcZE.exe
  2⤵
  PID:6744
- C:\Windows\System\mTEulPX.exe
  C:\Windows\System\mTEulPX.exe
  2⤵
  PID:6436
- C:\Windows\System\lzUUimi.exe
  C:\Windows\System\lzUUimi.exe
  2⤵
  PID:6512
- C:\Windows\System\dSgMhzN.exe
  C:\Windows\System\dSgMhzN.exe
  2⤵
  PID:4568
- C:\Windows\System\lnDFIFT.exe
  C:\Windows\System\lnDFIFT.exe
  2⤵
  PID:6900
- C:\Windows\System\XjDidHB.exe
  C:\Windows\System\XjDidHB.exe
  2⤵
  PID:2248
- C:\Windows\System\KdPcrZT.exe
  C:\Windows\System\KdPcrZT.exe
  2⤵
  PID:6616
- C:\Windows\System\cZELEem.exe
  C:\Windows\System\cZELEem.exe
  2⤵
  PID:6996
- C:\Windows\System\cpXpZBJ.exe
  C:\Windows\System\cpXpZBJ.exe
  2⤵
  PID:440
- C:\Windows\System\klHsJUb.exe
  C:\Windows\System\klHsJUb.exe
  2⤵
  PID:6568
- C:\Windows\System\aVKmVuj.exe
  C:\Windows\System\aVKmVuj.exe
  2⤵
  PID:7188
- C:\Windows\System\PHTarbB.exe
  C:\Windows\System\PHTarbB.exe
  2⤵
  PID:7208
- C:\Windows\System\bKYaYVQ.exe
  C:\Windows\System\bKYaYVQ.exe
  2⤵
  PID:7224
- C:\Windows\System\HjbVoOW.exe
  C:\Windows\System\HjbVoOW.exe
  2⤵
  PID:7424
- C:\Windows\System\GtMZwIJ.exe
  C:\Windows\System\GtMZwIJ.exe
  2⤵
  PID:7444
- C:\Windows\System\CPsMTEg.exe
  C:\Windows\System\CPsMTEg.exe
  2⤵
  PID:7468
- C:\Windows\System\RNXoyrV.exe
  C:\Windows\System\RNXoyrV.exe
  2⤵
  PID:7488
- C:\Windows\System\jYFCovJ.exe
  C:\Windows\System\jYFCovJ.exe
  2⤵
  PID:7508
- C:\Windows\System\BdMcoKa.exe
  C:\Windows\System\BdMcoKa.exe
  2⤵
  PID:7528
- C:\Windows\System\yEpcLqB.exe
  C:\Windows\System\yEpcLqB.exe
  2⤵
  PID:7548
- C:\Windows\System\TPXNmSx.exe
  C:\Windows\System\TPXNmSx.exe
  2⤵
  PID:7568
- C:\Windows\System\YeSEliu.exe
  C:\Windows\System\YeSEliu.exe
  2⤵
  PID:7604
- C:\Windows\System\iajknfb.exe
  C:\Windows\System\iajknfb.exe
  2⤵
  PID:7628
- C:\Windows\System\HczNUrl.exe
  C:\Windows\System\HczNUrl.exe
  2⤵
  PID:7648
- C:\Windows\System\hTxyTod.exe
  C:\Windows\System\hTxyTod.exe
  2⤵
  PID:7668
- C:\Windows\System\JGyxuoz.exe
  C:\Windows\System\JGyxuoz.exe
  2⤵
  PID:7688
- C:\Windows\System\mAXntVN.exe
  C:\Windows\System\mAXntVN.exe
  2⤵
  PID:7720
- C:\Windows\System\vezJFdK.exe
  C:\Windows\System\vezJFdK.exe
  2⤵
  PID:7740
- C:\Windows\System\LwFZeVJ.exe
  C:\Windows\System\LwFZeVJ.exe
  2⤵
  PID:7768
- C:\Windows\System\hPVtgzO.exe
  C:\Windows\System\hPVtgzO.exe
  2⤵
  PID:7796
- C:\Windows\System\KtnEGsR.exe
  C:\Windows\System\KtnEGsR.exe
  2⤵
  PID:7824
- C:\Windows\System\khRxORP.exe
  C:\Windows\System\khRxORP.exe
  2⤵
  PID:7848
- C:\Windows\System\hWQEvgn.exe
  C:\Windows\System\hWQEvgn.exe
  2⤵
  PID:7880
- C:\Windows\System\YWtIwWk.exe
  C:\Windows\System\YWtIwWk.exe
  2⤵
  PID:7908
- C:\Windows\System\VovKOLg.exe
  C:\Windows\System\VovKOLg.exe
  2⤵
  PID:7940
- C:\Windows\System\GoSJOIG.exe
  C:\Windows\System\GoSJOIG.exe
  2⤵
  PID:7964
- C:\Windows\System\EpkAmul.exe
  C:\Windows\System\EpkAmul.exe
  2⤵
  PID:7988
- C:\Windows\System\chpjSRi.exe
  C:\Windows\System\chpjSRi.exe
  2⤵
  PID:8008
- C:\Windows\System\gGaAuNF.exe
  C:\Windows\System\gGaAuNF.exe
  2⤵
  PID:8028
- C:\Windows\System\lNnehOZ.exe
  C:\Windows\System\lNnehOZ.exe
  2⤵
  PID:8048
- C:\Windows\System\Tejvsxh.exe
  C:\Windows\System\Tejvsxh.exe
  2⤵
  PID:8068
- C:\Windows\System\mKsEPZb.exe
  C:\Windows\System\mKsEPZb.exe
  2⤵
  PID:8088
- C:\Windows\System\vGvbHqt.exe
  C:\Windows\System\vGvbHqt.exe
  2⤵
  PID:8112
- C:\Windows\System\NFHsIVQ.exe
  C:\Windows\System\NFHsIVQ.exe
  2⤵
  PID:8140
- C:\Windows\System\eRqnJmn.exe
  C:\Windows\System\eRqnJmn.exe
  2⤵
  PID:3028
- C:\Windows\System\DdmWjbV.exe
  C:\Windows\System\DdmWjbV.exe
  2⤵
  PID:6628
- C:\Windows\System\vGCceLj.exe
  C:\Windows\System\vGCceLj.exe
  2⤵
  PID:3036
- C:\Windows\System\HzpbSGc.exe
  C:\Windows\System\HzpbSGc.exe
  2⤵
  PID:7216
- C:\Windows\System\BwtNmSd.exe
  C:\Windows\System\BwtNmSd.exe
  2⤵
  PID:7480
- C:\Windows\System\jysIHyT.exe
  C:\Windows\System\jysIHyT.exe
  2⤵
  PID:7520
- C:\Windows\System\rEIVQBg.exe
  C:\Windows\System\rEIVQBg.exe
  2⤵
  PID:7560
- C:\Windows\System\FZJQfLv.exe
  C:\Windows\System\FZJQfLv.exe
  2⤵
  PID:7596
- C:\Windows\System\UfWurAQ.exe
  C:\Windows\System\UfWurAQ.exe
  2⤵
  PID:7664
- C:\Windows\System\HMNvCwT.exe
  C:\Windows\System\HMNvCwT.exe
  2⤵
  PID:7200
- C:\Windows\System\YPeXkSx.exe
  C:\Windows\System\YPeXkSx.exe
  2⤵
  PID:7836
- C:\Windows\System\ikdRrLi.exe
  C:\Windows\System\ikdRrLi.exe
  2⤵
  PID:7996
- C:\Windows\System\GcoSkMj.exe
  C:\Windows\System\GcoSkMj.exe
  2⤵
  PID:8024
- C:\Windows\System\brzlZib.exe
  C:\Windows\System\brzlZib.exe
  2⤵
  PID:8148
- C:\Windows\System\eZISDBb.exe
  C:\Windows\System\eZISDBb.exe
  2⤵
  PID:8100
- C:\Windows\System\POVhZyK.exe
  C:\Windows\System\POVhZyK.exe
  2⤵
  PID:6968
- C:\Windows\System\vGwdJKU.exe
  C:\Windows\System\vGwdJKU.exe
  2⤵
  PID:7032
- C:\Windows\System\ImMhGFE.exe
  C:\Windows\System\ImMhGFE.exe
  2⤵
  PID:6532
- C:\Windows\System\iivfwgo.exe
  C:\Windows\System\iivfwgo.exe
  2⤵
  PID:2780
- C:\Windows\System\sGtuzpr.exe
  C:\Windows\System\sGtuzpr.exe
  2⤵
  PID:7660
- C:\Windows\System\cQrGHTj.exe
  C:\Windows\System\cQrGHTj.exe
  2⤵
  PID:8204
- C:\Windows\System\JImZNsL.exe
  C:\Windows\System\JImZNsL.exe
  2⤵
  PID:8228
- C:\Windows\System\mykLFBL.exe
  C:\Windows\System\mykLFBL.exe
  2⤵
  PID:8244
- C:\Windows\System\LdEZViS.exe
  C:\Windows\System\LdEZViS.exe
  2⤵
  PID:8260
- C:\Windows\System\WBIpmFo.exe
  C:\Windows\System\WBIpmFo.exe
  2⤵
  PID:8284
- C:\Windows\System\ERgeHKe.exe
  C:\Windows\System\ERgeHKe.exe
  2⤵
  PID:8308
- C:\Windows\System\aXKMJVk.exe
  C:\Windows\System\aXKMJVk.exe
  2⤵
  PID:8332
- C:\Windows\System\jSiJLbe.exe
  C:\Windows\System\jSiJLbe.exe
  2⤵
  PID:8352
- C:\Windows\System\UmUwTIo.exe
  C:\Windows\System\UmUwTIo.exe
  2⤵
  PID:8372
- C:\Windows\System\bOvqKyZ.exe
  C:\Windows\System\bOvqKyZ.exe
  2⤵
  PID:8392
- C:\Windows\System\bLmYyWp.exe
  C:\Windows\System\bLmYyWp.exe
  2⤵
  PID:8416
- C:\Windows\System\oDoXVdK.exe
  C:\Windows\System\oDoXVdK.exe
  2⤵
  PID:8440
- C:\Windows\System\XalOGCq.exe
  C:\Windows\System\XalOGCq.exe
  2⤵
  PID:8456
- C:\Windows\System\XQocDtq.exe
  C:\Windows\System\XQocDtq.exe
  2⤵
  PID:8476
- C:\Windows\System\KBWMEJl.exe
  C:\Windows\System\KBWMEJl.exe
  2⤵
  PID:8500
- C:\Windows\System\LiIrxjO.exe
  C:\Windows\System\LiIrxjO.exe
  2⤵
  PID:8520
- C:\Windows\System\ehpwZlg.exe
  C:\Windows\System\ehpwZlg.exe
  2⤵
  PID:8544
- C:\Windows\System\VrykyzX.exe
  C:\Windows\System\VrykyzX.exe
  2⤵
  PID:8564
- C:\Windows\System\ttTednh.exe
  C:\Windows\System\ttTednh.exe
  2⤵
  PID:8592
- C:\Windows\System\tUyxnDR.exe
  C:\Windows\System\tUyxnDR.exe
  2⤵
  PID:8612
- C:\Windows\System\rcmThQT.exe
  C:\Windows\System\rcmThQT.exe
  2⤵
  PID:8640
- C:\Windows\System\NFDJlfN.exe
  C:\Windows\System\NFDJlfN.exe
  2⤵
  PID:8660
- C:\Windows\System\wKjEuZZ.exe
  C:\Windows\System\wKjEuZZ.exe
  2⤵
  PID:8684
- C:\Windows\System\HspsGPo.exe
  C:\Windows\System\HspsGPo.exe
  2⤵
  PID:8700
- C:\Windows\System\aSHqPGY.exe
  C:\Windows\System\aSHqPGY.exe
  2⤵
  PID:8724
- C:\Windows\System\xNcJXoS.exe
  C:\Windows\System\xNcJXoS.exe
  2⤵
  PID:8748
- C:\Windows\System\GhXvkrk.exe
  C:\Windows\System\GhXvkrk.exe
  2⤵
  PID:8768
- C:\Windows\System\TVvDOOk.exe
  C:\Windows\System\TVvDOOk.exe
  2⤵
  PID:8804
- C:\Windows\System\PEjUvTu.exe
  C:\Windows\System\PEjUvTu.exe
  2⤵
  PID:8824
- C:\Windows\System\QoNPHnv.exe
  C:\Windows\System\QoNPHnv.exe
  2⤵
  PID:8844
- C:\Windows\System\SjbxUha.exe
  C:\Windows\System\SjbxUha.exe
  2⤵
  PID:8956
- C:\Windows\System\GknnQFx.exe
  C:\Windows\System\GknnQFx.exe
  2⤵
  PID:8988
- C:\Windows\System\Wvadwwc.exe
  C:\Windows\System\Wvadwwc.exe
  2⤵
  PID:9012
- C:\Windows\System\rmDiVrm.exe
  C:\Windows\System\rmDiVrm.exe
  2⤵
  PID:9036
- C:\Windows\System\ZinbxLH.exe
  C:\Windows\System\ZinbxLH.exe
  2⤵
  PID:9056
- C:\Windows\System\pOGoThE.exe
  C:\Windows\System\pOGoThE.exe
  2⤵
  PID:9100
- C:\Windows\System\vpTZIkG.exe
  C:\Windows\System\vpTZIkG.exe
  2⤵
  PID:9120
- C:\Windows\System\msoHGay.exe
  C:\Windows\System\msoHGay.exe
  2⤵
  PID:9152
- C:\Windows\System\WufoDHS.exe
  C:\Windows\System\WufoDHS.exe
  2⤵
  PID:9172
- C:\Windows\System\fYUYTfZ.exe
  C:\Windows\System\fYUYTfZ.exe
  2⤵
  PID:9188
- C:\Windows\System\fiwLZng.exe
  C:\Windows\System\fiwLZng.exe
  2⤵
  PID:6416
- C:\Windows\System\HRmyPyx.exe
  C:\Windows\System\HRmyPyx.exe
  2⤵
  PID:8004
- C:\Windows\System\WJcpqzR.exe
  C:\Windows\System\WJcpqzR.exe
  2⤵
  PID:7948
- C:\Windows\System\pPLpwKE.exe
  C:\Windows\System\pPLpwKE.exe
  2⤵
  PID:6688
- C:\Windows\System\qRXJcMR.exe
  C:\Windows\System\qRXJcMR.exe
  2⤵
  PID:7892
- C:\Windows\System\fZOONVZ.exe
  C:\Windows\System\fZOONVZ.exe
  2⤵
  PID:8292
- C:\Windows\System\EFgVziP.exe
  C:\Windows\System\EFgVziP.exe
  2⤵
  PID:6488
- C:\Windows\System\VbmVezQ.exe
  C:\Windows\System\VbmVezQ.exe
  2⤵
  PID:8368
- C:\Windows\System\DcFZnKb.exe
  C:\Windows\System\DcFZnKb.exe
  2⤵
  PID:8404
- C:\Windows\System\JOOhefz.exe
  C:\Windows\System\JOOhefz.exe
  2⤵
  PID:7748
- C:\Windows\System\uiWhdWM.exe
  C:\Windows\System\uiWhdWM.exe
  2⤵
  PID:8212
- C:\Windows\System\kgjPUJo.exe
  C:\Windows\System\kgjPUJo.exe
  2⤵
  PID:8528
- C:\Windows\System\yRvchZm.exe
  C:\Windows\System\yRvchZm.exe
  2⤵
  PID:8588
- C:\Windows\System\RUovcXZ.exe
  C:\Windows\System\RUovcXZ.exe
  2⤵
  PID:8632
- C:\Windows\System\AQdUGvn.exe
  C:\Windows\System\AQdUGvn.exe
  2⤵
  PID:8436
- C:\Windows\System\BWnJpze.exe
  C:\Windows\System\BWnJpze.exe
  2⤵
  PID:8492
- C:\Windows\System\uySjoKa.exe
  C:\Windows\System\uySjoKa.exe
  2⤵
  PID:8836
- C:\Windows\System\ZIbdOFl.exe
  C:\Windows\System\ZIbdOFl.exe
  2⤵
  PID:8648
- C:\Windows\System\UGedIoB.exe
  C:\Windows\System\UGedIoB.exe
  2⤵
  PID:8696
- C:\Windows\System\JvcXBJX.exe
  C:\Windows\System\JvcXBJX.exe
  2⤵
  PID:8740
- C:\Windows\System\IvnfUdy.exe
  C:\Windows\System\IvnfUdy.exe
  2⤵
  PID:8800
- C:\Windows\System\hGXJRsd.exe
  C:\Windows\System\hGXJRsd.exe
  2⤵
  PID:8948
- C:\Windows\System\mtsajSe.exe
  C:\Windows\System\mtsajSe.exe
  2⤵
  PID:8656
- C:\Windows\System\ftjQfqX.exe
  C:\Windows\System\ftjQfqX.exe
  2⤵
  PID:9032
- C:\Windows\System\aeXHyNX.exe
  C:\Windows\System\aeXHyNX.exe
  2⤵
  PID:9148
- C:\Windows\System\AEVqfTX.exe
  C:\Windows\System\AEVqfTX.exe
  2⤵
  PID:9232
- C:\Windows\System\CSPtBUi.exe
  C:\Windows\System\CSPtBUi.exe
  2⤵
  PID:9584
- C:\Windows\System\SfBzQol.exe
  C:\Windows\System\SfBzQol.exe
  2⤵
  PID:9600
- C:\Windows\System\QQlfjmV.exe
  C:\Windows\System\QQlfjmV.exe
  2⤵
  PID:9636
- C:\Windows\System\chlJNZc.exe
  C:\Windows\System\chlJNZc.exe
  2⤵
  PID:9772
- C:\Windows\System\zJNIpHs.exe
  C:\Windows\System\zJNIpHs.exe
  2⤵
  PID:9880
- C:\Windows\System\YQOFmIz.exe
  C:\Windows\System\YQOFmIz.exe
  2⤵
  PID:9968
- C:\Windows\System\nlFJorh.exe
  C:\Windows\System\nlFJorh.exe
  2⤵
  PID:9988
- C:\Windows\System\GrkNyKq.exe
  C:\Windows\System\GrkNyKq.exe
  2⤵
  PID:10004
- C:\Windows\System\vQByDVb.exe
  C:\Windows\System\vQByDVb.exe
  2⤵
  PID:10024
- C:\Windows\System\KcfEMIu.exe
  C:\Windows\System\KcfEMIu.exe
  2⤵
  PID:10044
- C:\Windows\System\LFjKmFC.exe
  C:\Windows\System\LFjKmFC.exe
  2⤵
  PID:10068
- C:\Windows\System\mDQqRba.exe
  C:\Windows\System\mDQqRba.exe
  2⤵
  PID:10088
- C:\Windows\System\TMYPfZX.exe
  C:\Windows\System\TMYPfZX.exe
  2⤵
  PID:10112
- C:\Windows\System\eSOxPqt.exe
  C:\Windows\System\eSOxPqt.exe
  2⤵
  PID:10136
- C:\Windows\System\RCWgQyk.exe
  C:\Windows\System\RCWgQyk.exe
  2⤵
  PID:10152
- C:\Windows\System\rCsrqFk.exe
  C:\Windows\System\rCsrqFk.exe
  2⤵
  PID:10176
- C:\Windows\System\rSREmrZ.exe
  C:\Windows\System\rSREmrZ.exe
  2⤵
  PID:10196
- C:\Windows\System\RypjRiA.exe
  C:\Windows\System\RypjRiA.exe
  2⤵
  PID:10220
- C:\Windows\System\aQexubl.exe
  C:\Windows\System\aQexubl.exe
  2⤵
  PID:9196
- C:\Windows\System\YuYZpsm.exe
  C:\Windows\System\YuYZpsm.exe
  2⤵
  PID:8120
- C:\Windows\System\biZWHhe.exe
  C:\Windows\System\biZWHhe.exe
  2⤵
  PID:8676
- C:\Windows\System\cEqqArM.exe
  C:\Windows\System\cEqqArM.exe
  2⤵
  PID:9164
- C:\Windows\System\BDIdfoz.exe
  C:\Windows\System\BDIdfoz.exe
  2⤵
  PID:9276
- C:\Windows\System\GkUpnCw.exe
  C:\Windows\System\GkUpnCw.exe
  2⤵
  PID:8944
- C:\Windows\System\ZCycLoN.exe
  C:\Windows\System\ZCycLoN.exe
  2⤵
  PID:9020
- C:\Windows\System\KnwxGwR.exe
  C:\Windows\System\KnwxGwR.exe
  2⤵
  PID:9108
- C:\Windows\System\ghLxPHy.exe
  C:\Windows\System\ghLxPHy.exe
  2⤵
  PID:9052
- C:\Windows\System\tDHBzOU.exe
  C:\Windows\System\tDHBzOU.exe
  2⤵
  PID:8104
- C:\Windows\System\yyhzoku.exe
  C:\Windows\System\yyhzoku.exe
  2⤵
  PID:8200
- C:\Windows\System\zvzoCYP.exe
  C:\Windows\System\zvzoCYP.exe
  2⤵
  PID:6460
- C:\Windows\System\lJrFFrv.exe
  C:\Windows\System\lJrFFrv.exe
  2⤵
  PID:7952
- C:\Windows\System\ySbxgDD.exe
  C:\Windows\System\ySbxgDD.exe
  2⤵
  PID:8620
- C:\Windows\System\sBVKFCq.exe
  C:\Windows\System\sBVKFCq.exe
  2⤵
  PID:8760
- C:\Windows\System\DAQovDR.exe
  C:\Windows\System\DAQovDR.exe
  2⤵
  PID:8868
- C:\Windows\System\PVnjLIi.exe
  C:\Windows\System\PVnjLIi.exe
  2⤵
  PID:9360
- C:\Windows\System\iUTeKTq.exe
  C:\Windows\System\iUTeKTq.exe
  2⤵
  PID:9228
- C:\Windows\System\cpRYbkp.exe
  C:\Windows\System\cpRYbkp.exe
  2⤵
  PID:9580
- C:\Windows\System\XpcSyHj.exe
  C:\Windows\System\XpcSyHj.exe
  2⤵
  PID:9408
- C:\Windows\System\RzAZmOt.exe
  C:\Windows\System\RzAZmOt.exe
  2⤵
  PID:9704
- C:\Windows\System\MQJpmRJ.exe
  C:\Windows\System\MQJpmRJ.exe
  2⤵
  PID:9624
- C:\Windows\System\iPlmlQu.exe
  C:\Windows\System\iPlmlQu.exe
  2⤵
  PID:4300
- C:\Windows\System\kVILfkA.exe
  C:\Windows\System\kVILfkA.exe
  2⤵
  PID:9488
- C:\Windows\System\RQSUFsj.exe
  C:\Windows\System\RQSUFsj.exe
  2⤵
  PID:9752
- C:\Windows\System\UqGBHDW.exe
  C:\Windows\System\UqGBHDW.exe
  2⤵
  PID:9832
- C:\Windows\System\RNzfjGn.exe
  C:\Windows\System\RNzfjGn.exe
  2⤵
  PID:9788
- C:\Windows\System\NofGuUF.exe
  C:\Windows\System\NofGuUF.exe
  2⤵
  PID:9868
- C:\Windows\System\AasQgZZ.exe
  C:\Windows\System\AasQgZZ.exe
  2⤵
  PID:9964
- C:\Windows\System\XVFaDiS.exe
  C:\Windows\System\XVFaDiS.exe
  2⤵
  PID:2324
- C:\Windows\System\DeLjNih.exe
  C:\Windows\System\DeLjNih.exe
  2⤵
  PID:10108
- C:\Windows\System\YjSrzJl.exe
  C:\Windows\System\YjSrzJl.exe
  2⤵
  PID:10188
- C:\Windows\System\HverhjT.exe
  C:\Windows\System\HverhjT.exe
  2⤵
  PID:10228
- C:\Windows\System\huOGDaE.exe
  C:\Windows\System\huOGDaE.exe
  2⤵
  PID:8096
- C:\Windows\System\geJZmGj.exe
  C:\Windows\System\geJZmGj.exe
  2⤵
  PID:10212
- C:\Windows\System\ZaQlnLv.exe
  C:\Windows\System\ZaQlnLv.exe
  2⤵
  PID:9212
- C:\Windows\System\Aujvdni.exe
  C:\Windows\System\Aujvdni.exe
  2⤵
  PID:6920
- C:\Windows\System\kENhkBC.exe
  C:\Windows\System\kENhkBC.exe
  2⤵
  PID:8252
- C:\Windows\System\XdumJbo.exe
  C:\Windows\System\XdumJbo.exe
  2⤵
  PID:8412
- C:\Windows\System\DyDOsqk.exe
  C:\Windows\System\DyDOsqk.exe
  2⤵
  PID:8964
- C:\Windows\System\kHbygWo.exe
  C:\Windows\System\kHbygWo.exe
  2⤵
  PID:8328
- C:\Windows\System\RstPUHU.exe
  C:\Windows\System\RstPUHU.exe
  2⤵
  PID:9456
- C:\Windows\System\SnKiYaA.exe
  C:\Windows\System\SnKiYaA.exe
  2⤵
  PID:8180
- C:\Windows\System\huZjrmR.exe
  C:\Windows\System\huZjrmR.exe
  2⤵
  PID:10248
- C:\Windows\System\aJBehKM.exe
  C:\Windows\System\aJBehKM.exe
  2⤵
  PID:10276
- C:\Windows\System\kohbkLO.exe
  C:\Windows\System\kohbkLO.exe
  2⤵
  PID:10300
- C:\Windows\System\fYFRxLy.exe
  C:\Windows\System\fYFRxLy.exe
  2⤵
  PID:10320
- C:\Windows\System\xIcxpHA.exe
  C:\Windows\System\xIcxpHA.exe
  2⤵
  PID:10340
- C:\Windows\System\NFAJplF.exe
  C:\Windows\System\NFAJplF.exe
  2⤵
  PID:10360
- C:\Windows\System\FmFnfoX.exe
  C:\Windows\System\FmFnfoX.exe
  2⤵
  PID:10384
- C:\Windows\System\ruuIkev.exe
  C:\Windows\System\ruuIkev.exe
  2⤵
  PID:10400
- C:\Windows\System\DwCEpQl.exe
  C:\Windows\System\DwCEpQl.exe
  2⤵
  PID:10420
- C:\Windows\System\wZoMBti.exe
  C:\Windows\System\wZoMBti.exe
  2⤵
  PID:10444
- C:\Windows\System\ZHqYTzi.exe
  C:\Windows\System\ZHqYTzi.exe
  2⤵
  PID:10464
- C:\Windows\System\wmbZIYO.exe
  C:\Windows\System\wmbZIYO.exe
  2⤵
  PID:10488
- C:\Windows\System\MsvSRmO.exe
  C:\Windows\System\MsvSRmO.exe
  2⤵
  PID:10504
- C:\Windows\System\qlXLcRO.exe
  C:\Windows\System\qlXLcRO.exe
  2⤵
  PID:10528
- C:\Windows\System\aXvekNM.exe
  C:\Windows\System\aXvekNM.exe
  2⤵
  PID:10548
- C:\Windows\System\RLwzrSQ.exe
  C:\Windows\System\RLwzrSQ.exe
  2⤵
  PID:10568
- C:\Windows\System\gsAtdds.exe
  C:\Windows\System\gsAtdds.exe
  2⤵
  PID:10584
- C:\Windows\System\qxupnrN.exe
  C:\Windows\System\qxupnrN.exe
  2⤵
  PID:10612
- C:\Windows\System\OBcqQpt.exe
  C:\Windows\System\OBcqQpt.exe
  2⤵
  PID:10632
- C:\Windows\System\zkOfvKK.exe
  C:\Windows\System\zkOfvKK.exe
  2⤵
  PID:10652
- C:\Windows\System\MxBleKH.exe
  C:\Windows\System\MxBleKH.exe
  2⤵
  PID:10672
- C:\Windows\System\WYLsFdZ.exe
  C:\Windows\System\WYLsFdZ.exe
  2⤵
  PID:10692
- C:\Windows\System\ZRUHVpb.exe
  C:\Windows\System\ZRUHVpb.exe
  2⤵
  PID:10712
- C:\Windows\System\pdQzuWu.exe
  C:\Windows\System\pdQzuWu.exe
  2⤵
  PID:10728
- C:\Windows\System\MTnCmKu.exe
  C:\Windows\System\MTnCmKu.exe
  2⤵
  PID:10744
- C:\Windows\System\rGReAVU.exe
  C:\Windows\System\rGReAVU.exe
  2⤵
  PID:10852
- C:\Windows\System\zeoNFmU.exe
  C:\Windows\System\zeoNFmU.exe
  2⤵
  PID:10876
- C:\Windows\System\CWURaRf.exe
  C:\Windows\System\CWURaRf.exe
  2⤵
  PID:11020
- C:\Windows\System\iZOIUYF.exe
  C:\Windows\System\iZOIUYF.exe
  2⤵
  PID:11052
- C:\Windows\System\hZXGMdd.exe
  C:\Windows\System\hZXGMdd.exe
  2⤵
  PID:11072
- C:\Windows\System\McFlGhD.exe
  C:\Windows\System\McFlGhD.exe
  2⤵
  PID:11092
- C:\Windows\System\WoYleYB.exe
  C:\Windows\System\WoYleYB.exe
  2⤵
  PID:11116
- C:\Windows\System\RxCzhCI.exe
  C:\Windows\System\RxCzhCI.exe
  2⤵
  PID:11140
- C:\Windows\System\FVjXquW.exe
  C:\Windows\System\FVjXquW.exe
  2⤵
  PID:11164
- C:\Windows\System\VBgQCsX.exe
  C:\Windows\System\VBgQCsX.exe
  2⤵
  PID:11192
- C:\Windows\System\YSrDRYz.exe
  C:\Windows\System\YSrDRYz.exe
  2⤵
  PID:9528
- C:\Windows\System\WZPxJbV.exe
  C:\Windows\System\WZPxJbV.exe
  2⤵
  PID:10456
- C:\Windows\System\yxhJdGK.exe
  C:\Windows\System\yxhJdGK.exe
  2⤵
  PID:8508
- C:\Windows\System\tqUjPks.exe
  C:\Windows\System\tqUjPks.exe
  2⤵
  PID:3860
- C:\Windows\System\vksJMNQ.exe
  C:\Windows\System\vksJMNQ.exe
  2⤵
  PID:10312
- C:\Windows\System\icvelHK.exe
  C:\Windows\System\icvelHK.exe
  2⤵
  PID:9132
- C:\Windows\System\wynmgAH.exe
  C:\Windows\System\wynmgAH.exe
  2⤵
  PID:10500
- C:\Windows\System\lWWFGlE.exe
  C:\Windows\System\lWWFGlE.exe
  2⤵
  PID:10560
- C:\Windows\System\leRdQNY.exe
  C:\Windows\System\leRdQNY.exe
  2⤵
  PID:10648
- C:\Windows\System\cjnRTJL.exe
  C:\Windows\System\cjnRTJL.exe
  2⤵
  PID:10284
- C:\Windows\System\prerYVp.exe
  C:\Windows\System\prerYVp.exe
  2⤵
  PID:10472
- C:\Windows\System\kFUvilA.exe
  C:\Windows\System\kFUvilA.exe
  2⤵
  PID:10956
- C:\Windows\System\qPzlMgu.exe
  C:\Windows\System\qPzlMgu.exe
  2⤵
  PID:11044
- C:\Windows\System\zeaebsj.exe
  C:\Windows\System\zeaebsj.exe
  2⤵
  PID:11124
- C:\Windows\System\aNSpmot.exe
  C:\Windows\System\aNSpmot.exe
  2⤵
  PID:10368
- C:\Windows\System\OvFziaQ.exe
  C:\Windows\System\OvFziaQ.exe
  2⤵
  PID:11016
- C:\Windows\System\uIkAiFP.exe
  C:\Windows\System\uIkAiFP.exe
  2⤵
  PID:10556
- C:\Windows\System\LdioRmR.exe
  C:\Windows\System\LdioRmR.exe
  2⤵
  PID:10476
- C:\Windows\System\xpSCrrX.exe
  C:\Windows\System\xpSCrrX.exe
  2⤵
  PID:10272
- C:\Windows\System\zBwodhM.exe
  C:\Windows\System\zBwodhM.exe
  2⤵
  PID:9440
- C:\Windows\System\NHnYUer.exe
  C:\Windows\System\NHnYUer.exe
  2⤵
  PID:11180
- C:\Windows\System\QvkydSF.exe
  C:\Windows\System\QvkydSF.exe
  2⤵
  PID:11244
- C:\Windows\System\BLrulBL.exe
  C:\Windows\System\BLrulBL.exe
  2⤵
  PID:10604
- C:\Windows\System\kBkqCce.exe
  C:\Windows\System\kBkqCce.exe
  2⤵
  PID:6200
- C:\Windows\System\GtyObSt.exe
  C:\Windows\System\GtyObSt.exe
  2⤵
  PID:11268
- C:\Windows\System\BWQlxpL.exe
  C:\Windows\System\BWQlxpL.exe
  2⤵
  PID:11296
- C:\Windows\System\NnAJrcJ.exe
  C:\Windows\System\NnAJrcJ.exe
  2⤵
  PID:11316
- C:\Windows\System\HfvdEOn.exe
  C:\Windows\System\HfvdEOn.exe
  2⤵
  PID:11332
- C:\Windows\System\iIhTrjF.exe
  C:\Windows\System\iIhTrjF.exe
  2⤵
  PID:11468
- C:\Windows\System\RIyqorX.exe
  C:\Windows\System\RIyqorX.exe
  2⤵
  PID:11484
- C:\Windows\System\gyrsQje.exe
  C:\Windows\System\gyrsQje.exe
  2⤵
  PID:11508
- C:\Windows\System\vPqoCBc.exe
  C:\Windows\System\vPqoCBc.exe
  2⤵
  PID:11548
- C:\Windows\System\PwnINJQ.exe
  C:\Windows\System\PwnINJQ.exe
  2⤵
  PID:11572
- C:\Windows\System\rizUAXh.exe
  C:\Windows\System\rizUAXh.exe
  2⤵
  PID:11588
- C:\Windows\System\XjkfiKs.exe
  C:\Windows\System\XjkfiKs.exe
  2⤵
  PID:11604
- C:\Windows\System\dNwodWw.exe
  C:\Windows\System\dNwodWw.exe
  2⤵
  PID:11624
- C:\Windows\System\EXQmIvl.exe
  C:\Windows\System\EXQmIvl.exe
  2⤵
  PID:11644
- C:\Windows\System\oqMZkQh.exe
  C:\Windows\System\oqMZkQh.exe
  2⤵
  PID:11664
- C:\Windows\System\rvLPzjY.exe
  C:\Windows\System\rvLPzjY.exe
  2⤵
  PID:11684
- C:\Windows\System\MntUzWV.exe
  C:\Windows\System\MntUzWV.exe
  2⤵
  PID:11704
- C:\Windows\System\oCpotnz.exe
  C:\Windows\System\oCpotnz.exe
  2⤵
  PID:11724
- C:\Windows\System\WHEZdBw.exe
  C:\Windows\System\WHEZdBw.exe
  2⤵
  PID:11744
- C:\Windows\System\ybTAsrs.exe
  C:\Windows\System\ybTAsrs.exe
  2⤵
  PID:11764
- C:\Windows\System\BpFxabC.exe
  C:\Windows\System\BpFxabC.exe
  2⤵
  PID:11784
- C:\Windows\System\OiwwqYF.exe
  C:\Windows\System\OiwwqYF.exe
  2⤵
  PID:11800
- C:\Windows\System\DTZAULR.exe
  C:\Windows\System\DTZAULR.exe
  2⤵
  PID:11820
- C:\Windows\System\OZiCfIg.exe
  C:\Windows\System\OZiCfIg.exe
  2⤵
  PID:11844
- C:\Windows\System\wTwaUGl.exe
  C:\Windows\System\wTwaUGl.exe
  2⤵
  PID:11872
- C:\Windows\System\tMCCMiB.exe
  C:\Windows\System\tMCCMiB.exe
  2⤵
  PID:11888
- C:\Windows\System\wLWgMgk.exe
  C:\Windows\System\wLWgMgk.exe
  2⤵
  PID:11904
- C:\Windows\System\NTZcWEV.exe
  C:\Windows\System\NTZcWEV.exe
  2⤵
  PID:11920
- C:\Windows\System\sNPgeNm.exe
  C:\Windows\System\sNPgeNm.exe
  2⤵
  PID:11936
- C:\Windows\System\EsUWXFJ.exe
  C:\Windows\System\EsUWXFJ.exe
  2⤵
  PID:11952
- C:\Windows\System\qPqJQNB.exe
  C:\Windows\System\qPqJQNB.exe
  2⤵
  PID:11968
- C:\Windows\System\iCIWIKd.exe
  C:\Windows\System\iCIWIKd.exe
  2⤵
  PID:11992
- C:\Windows\System\RIJSBbk.exe
  C:\Windows\System\RIJSBbk.exe
  2⤵
  PID:12012
- C:\Windows\System\BbdwaWi.exe
  C:\Windows\System\BbdwaWi.exe
  2⤵
  PID:12032
- C:\Windows\System\aKZgcZA.exe
  C:\Windows\System\aKZgcZA.exe
  2⤵
  PID:12116
- C:\Windows\System\GkhPcQY.exe
  C:\Windows\System\GkhPcQY.exe
  2⤵
  PID:12140
- C:\Windows\System\JuCnCTv.exe
  C:\Windows\System\JuCnCTv.exe
  2⤵
  PID:12160
- C:\Windows\System\SNTgCOn.exe
  C:\Windows\System\SNTgCOn.exe
  2⤵
  PID:12264
- C:\Windows\System\mQZErsx.exe
  C:\Windows\System\mQZErsx.exe
  2⤵
  PID:10804
- C:\Windows\System\cbWUElH.exe
  C:\Windows\System\cbWUElH.exe
  2⤵
  PID:10768
- C:\Windows\System\lxeotzz.exe
  C:\Windows\System\lxeotzz.exe
  2⤵
  PID:10988
- C:\Windows\System\vVcThXF.exe
  C:\Windows\System\vVcThXF.exe
  2⤵
  PID:6972
- C:\Windows\System\JGPaBQI.exe
  C:\Windows\System\JGPaBQI.exe
  2⤵
  PID:10256
- C:\Windows\System\isfURVA.exe
  C:\Windows\System\isfURVA.exe
  2⤵
  PID:10316
- C:\Windows\System\tytKvIL.exe
  C:\Windows\System\tytKvIL.exe
  2⤵
  PID:11088
- C:\Windows\System\lrYnIxy.exe
  C:\Windows\System\lrYnIxy.exe
  2⤵
  PID:11596
- C:\Windows\System\ehNNNfm.exe
  C:\Windows\System\ehNNNfm.exe
  2⤵
  PID:11560
- C:\Windows\System\endqdmm.exe
  C:\Windows\System\endqdmm.exe
  2⤵
  PID:12040
- C:\Windows\System\OMAlZSL.exe
  C:\Windows\System\OMAlZSL.exe
  2⤵
  PID:12056
- C:\Windows\System\xGweTWL.exe
  C:\Windows\System\xGweTWL.exe
  2⤵
  PID:11612
- C:\Windows\System\cIOkWbp.exe
  C:\Windows\System\cIOkWbp.exe
  2⤵
  PID:11964
- C:\Windows\System\hlzmxol.exe
  C:\Windows\System\hlzmxol.exe
  2⤵
  PID:11812
- C:\Windows\System\tGajxDH.exe
  C:\Windows\System\tGajxDH.exe
  2⤵
  PID:12044
- C:\Windows\System\oeIcMbc.exe
  C:\Windows\System\oeIcMbc.exe
  2⤵
  PID:10668
- C:\Windows\System\rfYkfJT.exe
  C:\Windows\System\rfYkfJT.exe
  2⤵
  PID:1136
- C:\Windows\System\qDmcvLu.exe
  C:\Windows\System\qDmcvLu.exe
  2⤵
  PID:12220
- C:\Windows\System\AtKFzwe.exe
  C:\Windows\System\AtKFzwe.exe
  2⤵
  PID:11496
- C:\Windows\System\PjPsIEC.exe
  C:\Windows\System\PjPsIEC.exe
  2⤵
  PID:11112
- C:\Windows\System\DTrVUtc.exe
  C:\Windows\System\DTrVUtc.exe
  2⤵
  PID:12284
- C:\Windows\System\XOyOkhP.exe
  C:\Windows\System\XOyOkhP.exe
  2⤵
  PID:6812
- C:\Windows\System\TmoYDrx.exe
  C:\Windows\System\TmoYDrx.exe
  2⤵
  PID:11312
- C:\Windows\System\mvFqAAp.exe
  C:\Windows\System\mvFqAAp.exe
  2⤵
  PID:12444
- C:\Windows\System\RWnXLxR.exe
  C:\Windows\System\RWnXLxR.exe
  2⤵
  PID:12512
- C:\Windows\System\nyqbWpq.exe
  C:\Windows\System\nyqbWpq.exe
  2⤵
  PID:12532
- C:\Windows\System\fAEvxEm.exe
  C:\Windows\System\fAEvxEm.exe
  2⤵
  PID:12556
- C:\Windows\System\SDUQEQW.exe
  C:\Windows\System\SDUQEQW.exe
  2⤵
  PID:12588
- C:\Windows\System\TRSZENC.exe
  C:\Windows\System\TRSZENC.exe
  2⤵
  PID:12608
- C:\Windows\System\miOBQdt.exe
  C:\Windows\System\miOBQdt.exe
  2⤵
  PID:12644
- C:\Windows\System\AUrJwsk.exe
  C:\Windows\System\AUrJwsk.exe
  2⤵
  PID:12672
- C:\Windows\System\fmGoseQ.exe
  C:\Windows\System\fmGoseQ.exe
  2⤵
  PID:12696
- C:\Windows\System\bgTXkbf.exe
  C:\Windows\System\bgTXkbf.exe
  2⤵
  PID:12716
- C:\Windows\System\DFnwUfN.exe
  C:\Windows\System\DFnwUfN.exe
  2⤵
  PID:12736
- C:\Windows\System\qutvfxh.exe
  C:\Windows\System\qutvfxh.exe
  2⤵
  PID:12756
- C:\Windows\System\gprVBoC.exe
  C:\Windows\System\gprVBoC.exe
  2⤵
  PID:12804
- C:\Windows\System\anEDZOm.exe
  C:\Windows\System\anEDZOm.exe
  2⤵
  PID:12824
- C:\Windows\System\NcFntIO.exe
  C:\Windows\System\NcFntIO.exe
  2⤵
  PID:12844
- C:\Windows\System\CVqfssB.exe
  C:\Windows\System\CVqfssB.exe
  2⤵
  PID:12860
- C:\Windows\System\wgPwvZT.exe
  C:\Windows\System\wgPwvZT.exe
  2⤵
  PID:12896
- C:\Windows\System\jReVTIN.exe
  C:\Windows\System\jReVTIN.exe
  2⤵
  PID:12912
- C:\Windows\System\UeVIcVw.exe
  C:\Windows\System\UeVIcVw.exe
  2⤵
  PID:12932
- C:\Windows\System\vDCFcan.exe
  C:\Windows\System\vDCFcan.exe
  2⤵
  PID:12956
- C:\Windows\System\VDxRbRd.exe
  C:\Windows\System\VDxRbRd.exe
  2⤵
  PID:12976
- C:\Windows\System\UOGoiWy.exe
  C:\Windows\System\UOGoiWy.exe
  2⤵
  PID:12992
- C:\Windows\System\WORiaLq.exe
  C:\Windows\System\WORiaLq.exe
  2⤵
  PID:13008
- C:\Windows\System\RMbKBEa.exe
  C:\Windows\System\RMbKBEa.exe
  2⤵
  PID:13024
- C:\Windows\System\nQCBfFU.exe
  C:\Windows\System\nQCBfFU.exe
  2⤵
  PID:13112
- C:\Windows\System\YFxSqlj.exe
  C:\Windows\System\YFxSqlj.exe
  2⤵
  PID:13212
- C:\Windows\System\jHsBukf.exe
  C:\Windows\System\jHsBukf.exe
  2⤵
  PID:13264
- C:\Windows\System\rpiuKlz.exe
  C:\Windows\System\rpiuKlz.exe
  2⤵
  PID:13288
- C:\Windows\System\NeRnBdF.exe
  C:\Windows\System\NeRnBdF.exe
  2⤵
  PID:13308
- C:\Windows\System\MtcUtcl.exe
  C:\Windows\System\MtcUtcl.exe
  2⤵
  PID:11640
- C:\Windows\System\hOdUdQQ.exe
  C:\Windows\System\hOdUdQQ.exe
  2⤵
  PID:12328
- C:\Windows\System\hjsAGVd.exe
  C:\Windows\System\hjsAGVd.exe
  2⤵
  PID:4612
- C:\Windows\System\mqZZCGL.exe
  C:\Windows\System\mqZZCGL.exe
  2⤵
  PID:4628
- C:\Windows\System\awZjKEZ.exe
  C:\Windows\System\awZjKEZ.exe
  2⤵
  PID:9484
- C:\Windows\System\nIXJdTk.exe
  C:\Windows\System\nIXJdTk.exe
  2⤵
  PID:2984
- C:\Windows\System\ymwQASD.exe
  C:\Windows\System\ymwQASD.exe
  2⤵
  PID:1204
- C:\Windows\System\TGlGxWy.exe
  C:\Windows\System\TGlGxWy.exe
  2⤵
  PID:12248
- C:\Windows\System\eXthmYq.exe
  C:\Windows\System\eXthmYq.exe
  2⤵
  PID:7728
- C:\Windows\System\fUkSKFd.exe
  C:\Windows\System\fUkSKFd.exe
  2⤵
  PID:1520
- C:\Windows\System\IGqgeRw.exe
  C:\Windows\System\IGqgeRw.exe
  2⤵
  PID:3204
- C:\Windows\System\XyZHgSp.exe
  C:\Windows\System\XyZHgSp.exe
  2⤵
  PID:12428
- C:\Windows\System\lYLhmqT.exe
  C:\Windows\System\lYLhmqT.exe
  2⤵
  PID:12304
- C:\Windows\System\dLMktrc.exe
  C:\Windows\System\dLMktrc.exe
  2⤵
  PID:12360
- C:\Windows\System\owpNzrF.exe
  C:\Windows\System\owpNzrF.exe
  2⤵
  PID:12508
- C:\Windows\System\kdsmZYY.exe
  C:\Windows\System\kdsmZYY.exe
  2⤵
  PID:13052
- C:\Windows\System\kfZwbTv.exe
  C:\Windows\System\kfZwbTv.exe
  2⤵
  PID:13104
- C:\Windows\System\mPDPmCu.exe
  C:\Windows\System\mPDPmCu.exe
  2⤵
  PID:12888
- C:\Windows\System\gHYZYYL.exe
  C:\Windows\System\gHYZYYL.exe
  2⤵
  PID:13164
- C:\Windows\System\gpCBWmz.exe
  C:\Windows\System\gpCBWmz.exe
  2⤵
  PID:1852
- C:\Windows\System\cvDOgXT.exe
  C:\Windows\System\cvDOgXT.exe
  2⤵
  PID:13068
- C:\Windows\System\OVTUjsC.exe
  C:\Windows\System\OVTUjsC.exe
  2⤵
  PID:1948
- C:\Windows\System\PhHyuZN.exe
  C:\Windows\System\PhHyuZN.exe
  2⤵
  PID:2208
- C:\Windows\System\Ikezvug.exe
  C:\Windows\System\Ikezvug.exe
  2⤵
  PID:2576
- C:\Windows\System\lpHceqq.exe
  C:\Windows\System\lpHceqq.exe
  2⤵
  PID:2408
- C:\Windows\System\FENPoYM.exe
  C:\Windows\System\FENPoYM.exe
  2⤵
  PID:13252
- C:\Windows\System\tIzCzwP.exe
  C:\Windows\System\tIzCzwP.exe
  2⤵
  PID:13300
- C:\Windows\System\hQSIygN.exe
  C:\Windows\System\hQSIygN.exe
  2⤵
  PID:11736
- C:\Windows\System\ShepAcb.exe
  C:\Windows\System\ShepAcb.exe
  2⤵
  PID:2308
- C:\Windows\System\xmCvQBs.exe
  C:\Windows\System\xmCvQBs.exe
  2⤵
  PID:3316
- C:\Windows\System\XnsAWoi.exe
  C:\Windows\System\XnsAWoi.exe
  2⤵
  PID:11672
- C:\Windows\System\SnCPFDS.exe
  C:\Windows\System\SnCPFDS.exe
  2⤵
  PID:4792
- C:\Windows\System\PtWfmxm.exe
  C:\Windows\System\PtWfmxm.exe
  2⤵
  PID:60
- C:\Windows\System\dbsTiQt.exe
  C:\Windows\System\dbsTiQt.exe
  2⤵
  PID:2424
- C:\Windows\System\NlATeUH.exe
  C:\Windows\System\NlATeUH.exe
  2⤵
  PID:5316
- C:\Windows\System\qwdeyQT.exe
  C:\Windows\System\qwdeyQT.exe
  2⤵
  PID:5596
- C:\Windows\System\kWlWZzx.exe
  C:\Windows\System\kWlWZzx.exe
  2⤵
  PID:12768
- C:\Windows\System\kvQTyuN.exe
  C:\Windows\System\kvQTyuN.exe
  2⤵
  PID:12484
- C:\Windows\System\qEZVaCM.exe
  C:\Windows\System\qEZVaCM.exe
  2⤵
  PID:12820
- C:\Windows\System\IXWdaGl.exe
  C:\Windows\System\IXWdaGl.exe
  2⤵
  PID:12908
- C:\Windows\System\pwNCJzM.exe
  C:\Windows\System\pwNCJzM.exe
  2⤵
  PID:5480
- C:\Windows\System\nptlLKQ.exe
  C:\Windows\System\nptlLKQ.exe
  2⤵
  PID:12924
- C:\Windows\System\KLDHcGx.exe
  C:\Windows\System\KLDHcGx.exe
  2⤵
  PID:12872
- C:\Windows\System\HDjpvWH.exe
  C:\Windows\System\HDjpvWH.exe
  2⤵
  PID:5656
- C:\Windows\System\vxyCpuU.exe
  C:\Windows\System\vxyCpuU.exe
  2⤵
  PID:12636
- C:\Windows\System\WxrLvrd.exe
  C:\Windows\System\WxrLvrd.exe
  2⤵
  PID:5672
- C:\Windows\System\qtAyead.exe
  C:\Windows\System\qtAyead.exe
  2⤵
  PID:5792
- C:\Windows\System\QQaFiVi.exe
  C:\Windows\System\QQaFiVi.exe
  2⤵
  PID:3276
- C:\Windows\System\dbibsVq.exe
  C:\Windows\System\dbibsVq.exe
  2⤵
  PID:2124
- C:\Windows\System\uxTCWHA.exe
  C:\Windows\System\uxTCWHA.exe
  2⤵
  PID:5808
- C:\Windows\System\mXnQjCo.exe
  C:\Windows\System\mXnQjCo.exe
  2⤵
  PID:1156
- C:\Windows\System\xkDqMdv.exe
  C:\Windows\System\xkDqMdv.exe
  2⤵
  PID:1120
- C:\Windows\System\BqzgDrT.exe
  C:\Windows\System\BqzgDrT.exe
  2⤵
  PID:13176
- C:\Windows\System\HEuLaqE.exe
  C:\Windows\System\HEuLaqE.exe
  2⤵
  PID:4304
- C:\Windows\System\yjfyYoE.exe
  C:\Windows\System\yjfyYoE.exe
  2⤵
  PID:12524
- C:\Windows\System\lOFgMXY.exe
  C:\Windows\System\lOFgMXY.exe
  2⤵
  PID:3700
- C:\Windows\System\yNJYOcW.exe
  C:\Windows\System\yNJYOcW.exe
  2⤵
  PID:11048
- C:\Windows\System\bQPlfwX.exe
  C:\Windows\System\bQPlfwX.exe
  2⤵
  PID:12564
- C:\Windows\System\ktjvsBL.exe
  C:\Windows\System\ktjvsBL.exe
  2⤵
  PID:12600
- C:\Windows\System\VCprBjj.exe
  C:\Windows\System\VCprBjj.exe
  2⤵
  PID:5548
- C:\Windows\System\MLYONCm.exe
  C:\Windows\System\MLYONCm.exe
  2⤵
  PID:11380
- C:\Windows\System\DXSOCIA.exe
  C:\Windows\System\DXSOCIA.exe
  2⤵
  PID:5756
- C:\Windows\System\BbJHCNJ.exe
  C:\Windows\System\BbJHCNJ.exe
  2⤵
  PID:5764
- C:\Windows\System\birTWXR.exe
  C:\Windows\System\birTWXR.exe
  2⤵
  PID:2608
- C:\Windows\System\EjvosNp.exe
  C:\Windows\System\EjvosNp.exe
  2⤵
  PID:5776
- C:\Windows\System\BNBBXSy.exe
  C:\Windows\System\BNBBXSy.exe
  2⤵
  PID:400
- C:\Windows\System\MLeCDtK.exe
  C:\Windows\System\MLeCDtK.exe
  2⤵
  PID:5824
- C:\Windows\System\pQkdsQh.exe
  C:\Windows\System\pQkdsQh.exe
  2⤵
  PID:2088
- C:\Windows\System\UIXHBuK.exe
  C:\Windows\System\UIXHBuK.exe
  2⤵
  PID:2908
- C:\Windows\System\jkhCiTQ.exe
  C:\Windows\System\jkhCiTQ.exe
  2⤵
  PID:216
- C:\Windows\System\bXIqEjF.exe
  C:\Windows\System\bXIqEjF.exe
  2⤵
  PID:5288
- C:\Windows\System\yucihRr.exe
  C:\Windows\System\yucihRr.exe
  2⤵
  PID:9680
- C:\Windows\System\PcXyulX.exe
  C:\Windows\System\PcXyulX.exe
  2⤵
  PID:4104
- C:\Windows\System\IyfIeYO.exe
  C:\Windows\System\IyfIeYO.exe
  2⤵
  PID:5804
- C:\Windows\System\prlYujq.exe
  C:\Windows\System\prlYujq.exe
  2⤵
  PID:6708
- C:\Windows\System\rrbLFfZ.exe
  C:\Windows\System\rrbLFfZ.exe
  2⤵
  PID:12028
- C:\Windows\System\CiEQtXq.exe
  C:\Windows\System\CiEQtXq.exe
  2⤵
  PID:5720
- C:\Windows\System\scFirln.exe
  C:\Windows\System\scFirln.exe
  2⤵
  PID:13324
- C:\Windows\System\YCBSfxP.exe
  C:\Windows\System\YCBSfxP.exe
  2⤵
  PID:13348
- C:\Windows\System\iLHzuGU.exe
  C:\Windows\System\iLHzuGU.exe
  2⤵
  PID:13388
- C:\Windows\System\LrHGPAE.exe
  C:\Windows\System\LrHGPAE.exe
  2⤵
  PID:13404
- C:\Windows\System\qWjImUn.exe
  C:\Windows\System\qWjImUn.exe
  2⤵
  PID:13420
- C:\Windows\System\ZyvmIfs.exe
  C:\Windows\System\ZyvmIfs.exe
  2⤵
  PID:13440
- C:\Windows\System\rnUgqRf.exe
  C:\Windows\System\rnUgqRf.exe
  2⤵
  PID:13488
- C:\Windows\System\lOrmDid.exe
  C:\Windows\System\lOrmDid.exe
  2⤵
  PID:13508
- C:\Windows\System\pFHBthz.exe
  C:\Windows\System\pFHBthz.exe
  2⤵
  PID:13524
- C:\Windows\System\hrvoIye.exe
  C:\Windows\System\hrvoIye.exe
  2⤵
  PID:13548
- C:\Windows\System\NsjqSJZ.exe
  C:\Windows\System\NsjqSJZ.exe
  2⤵
  PID:13624
- C:\Windows\System\tSdEhri.exe
  C:\Windows\System\tSdEhri.exe
  2⤵
  PID:13676
- C:\Windows\System\WFscCCv.exe
  C:\Windows\System\WFscCCv.exe
  2⤵
  PID:13708
- C:\Windows\System\vYDcigN.exe
  C:\Windows\System\vYDcigN.exe
  2⤵
  PID:13724
- C:\Windows\System\LWqMyTW.exe
  C:\Windows\System\LWqMyTW.exe
  2⤵
  PID:13792
- C:\Windows\System\KAGhZfN.exe
  C:\Windows\System\KAGhZfN.exe
  2⤵
  PID:13812
- C:\Windows\System\aSagubP.exe
  C:\Windows\System\aSagubP.exe
  2⤵
  PID:13860
- C:\Windows\System\yccPHtW.exe
  C:\Windows\System\yccPHtW.exe
  2⤵
  PID:13880
- C:\Windows\System\QpUgOpn.exe
  C:\Windows\System\QpUgOpn.exe
  2⤵
  PID:13908
- C:\Windows\System\fiOaGTg.exe
  C:\Windows\System\fiOaGTg.exe
  2⤵
  PID:13928
- C:\Windows\System\zjrEPhr.exe
  C:\Windows\System\zjrEPhr.exe
  2⤵
  PID:13944
- C:\Windows\System\aRKtZGi.exe
  C:\Windows\System\aRKtZGi.exe
  2⤵
  PID:13960
- C:\Windows\System\vMaiDNA.exe
  C:\Windows\System\vMaiDNA.exe
  2⤵
  PID:13976
- C:\Windows\System\lUubYln.exe
  C:\Windows\System\lUubYln.exe
  2⤵
  PID:14000
- C:\Windows\System\mmVSHih.exe
  C:\Windows\System\mmVSHih.exe
  2⤵
  PID:14020
- C:\Windows\System\aDHExpC.exe
  C:\Windows\System\aDHExpC.exe
  2⤵
  PID:14044
- C:\Windows\System\UQbVTwU.exe
  C:\Windows\System\UQbVTwU.exe
  2⤵
  PID:14064
- C:\Windows\System\LjdwxHt.exe
  C:\Windows\System\LjdwxHt.exe
  2⤵
  PID:14084
- C:\Windows\System\lwqfQyy.exe
  C:\Windows\System\lwqfQyy.exe
  2⤵
  PID:14112
- C:\Windows\System\KjeYAIc.exe
  C:\Windows\System\KjeYAIc.exe
  2⤵
  PID:14132
- C:\Windows\System\wjOkhdJ.exe
  C:\Windows\System\wjOkhdJ.exe
  2⤵
  PID:14148
- C:\Windows\System\NMoNZxi.exe
  C:\Windows\System\NMoNZxi.exe
  2⤵
  PID:14204
- C:\Windows\System\SjeNnXu.exe
  C:\Windows\System\SjeNnXu.exe
  2⤵
  PID:14220
- C:\Windows\System\unJtXYc.exe
  C:\Windows\System\unJtXYc.exe
  2⤵
  PID:14248
- C:\Windows\System\eRVECDK.exe
  C:\Windows\System\eRVECDK.exe
  2⤵
  PID:14276
- C:\Windows\System\MLZkdzl.exe
  C:\Windows\System\MLZkdzl.exe
  2⤵
  PID:14296
- C:\Windows\System\lhfLBlc.exe
  C:\Windows\System\lhfLBlc.exe
  2⤵
  PID:14320
- C:\Windows\System\oTwwVfT.exe
  C:\Windows\System\oTwwVfT.exe
  2⤵
  PID:9620
- C:\Windows\System\KkUFLOf.exe
  C:\Windows\System\KkUFLOf.exe
  2⤵
  PID:5188
- C:\Windows\System\JgvJGuq.exe
  C:\Windows\System\JgvJGuq.exe
  2⤵
  PID:13356
- C:\Windows\System\wqeBcfu.exe
  C:\Windows\System\wqeBcfu.exe
  2⤵
  PID:13540
- C:\Windows\System\qmeAKIp.exe
  C:\Windows\System\qmeAKIp.exe
  2⤵
  PID:13596
- C:\Windows\System\bOUbaho.exe
  C:\Windows\System\bOUbaho.exe
  2⤵
  PID:13620
- C:\Windows\System\tvBkwQa.exe
  C:\Windows\System\tvBkwQa.exe
  2⤵
  PID:12344
- C:\Windows\System\nVvYdXb.exe
  C:\Windows\System\nVvYdXb.exe
  2⤵
  PID:13744
- C:\Windows\System\twvNDtt.exe
  C:\Windows\System\twvNDtt.exe
  2⤵
  PID:13716
- C:\Windows\System\nrdumCN.exe
  C:\Windows\System\nrdumCN.exe
  2⤵
  PID:13756
- C:\Windows\System\mRkjEuE.exe
  C:\Windows\System\mRkjEuE.exe
  2⤵
  PID:3532
- C:\Windows\System\HJcZkuN.exe
  C:\Windows\System\HJcZkuN.exe
  2⤵
  PID:13664
- C:\Windows\System\kHARYzq.exe
  C:\Windows\System\kHARYzq.exe
  2⤵
  PID:12500
- C:\Windows\System\PVnNiCb.exe
  C:\Windows\System\PVnNiCb.exe
  2⤵
  PID:14240
- C:\Windows\System\AGYdcPl.exe
  C:\Windows\System\AGYdcPl.exe
  2⤵
  PID:13332
- C:\Windows\System\WSmSbBK.exe
  C:\Windows\System\WSmSbBK.exe
  2⤵
  PID:13516
- C:\Windows\System\sZbubtk.exe
  C:\Windows\System\sZbubtk.exe
  2⤵
  PID:4640
- C:\Windows\System\EvXKnjK.exe
  C:\Windows\System\EvXKnjK.exe
  2⤵
  PID:14028
- C:\Windows\System\UxrILzL.exe
  C:\Windows\System\UxrILzL.exe
  2⤵
  PID:13604
- C:\Windows\System\LTSqlaj.exe
  C:\Windows\System\LTSqlaj.exe
  2⤵
  PID:13852
- C:\Windows\System\UmtgooM.exe
  C:\Windows\System\UmtgooM.exe
  2⤵
  PID:11424
- C:\Windows\System\MMGOIqa.exe
  C:\Windows\System\MMGOIqa.exe
  2⤵
  PID:13972
- C:\Windows\System\xuvwslx.exe
  C:\Windows\System\xuvwslx.exe
  2⤵
  PID:6136
- C:\Windows\System\sHJWFCy.exe
  C:\Windows\System\sHJWFCy.exe
  2⤵
  PID:13804
- C:\Windows\System\TrnIcPe.exe
  C:\Windows\System\TrnIcPe.exe
  2⤵
  PID:14060
- C:\Windows\System\SxfRBjL.exe
  C:\Windows\System\SxfRBjL.exe
  2⤵
  PID:13956
- C:\Windows\System\wXVxGFg.exe
  C:\Windows\System\wXVxGFg.exe
  2⤵
  PID:14032
- C:\Windows\System\VnZxhaH.exe
  C:\Windows\System\VnZxhaH.exe
  2⤵
  PID:3468
- C:\Windows\System\brDICqX.exe
  C:\Windows\System\brDICqX.exe
  2⤵
  PID:3828
- C:\Windows\System\kotLzbl.exe
  C:\Windows\System\kotLzbl.exe
  2⤵
  PID:3660
- C:\Windows\System\dBRMSHn.exe
  C:\Windows\System\dBRMSHn.exe
  2⤵
  PID:4396
- C:\Windows\System\RJRjSap.exe
  C:\Windows\System\RJRjSap.exe
  2⤵
  PID:5512
- C:\Windows\System\nCeLiCi.exe
  C:\Windows\System\nCeLiCi.exe
  2⤵
  PID:2060
- C:\Windows\System\hjTEspv.exe
  C:\Windows\System\hjTEspv.exe
  2⤵
  PID:14228
- C:\Windows\System\viNyJNN.exe
  C:\Windows\System\viNyJNN.exe
  2⤵
  PID:1632
- C:\Windows\System\YHYavsq.exe
  C:\Windows\System\YHYavsq.exe
  2⤵
  PID:5492
- C:\Windows\System\xJayPnY.exe
  C:\Windows\System\xJayPnY.exe
  2⤵
  PID:5732
- C:\Windows\System\JzspGCN.exe
  C:\Windows\System\JzspGCN.exe
  2⤵
  PID:5748
- C:\Windows\System\coWRtyU.exe
  C:\Windows\System\coWRtyU.exe
  2⤵
  PID:6220
- C:\Windows\System\BOxAgOA.exe
  C:\Windows\System\BOxAgOA.exe
  2⤵
  PID:14192
- C:\Windows\System\MiYVpTo.exe
  C:\Windows\System\MiYVpTo.exe
  2⤵
  PID:3404
- C:\Windows\System\cjNcOVV.exe
  C:\Windows\System\cjNcOVV.exe
  2⤵
  PID:6360
- C:\Windows\System\gwAMqBJ.exe
  C:\Windows\System\gwAMqBJ.exe
  2⤵
  PID:6492
- C:\Windows\System\SYYtpyZ.exe
  C:\Windows\System\SYYtpyZ.exe
  2⤵
  PID:6184
- C:\Windows\System\XcqQJWP.exe
  C:\Windows\System\XcqQJWP.exe
  2⤵
  PID:6396
- C:\Windows\System\qrPAMeY.exe
  C:\Windows\System\qrPAMeY.exe
  2⤵
  PID:9552
- C:\Windows\System\zdAPlvh.exe
  C:\Windows\System\zdAPlvh.exe
  2⤵
  PID:14212
- C:\Windows\System\gqIQyKe.exe
  C:\Windows\System\gqIQyKe.exe
  2⤵
  PID:13500
- C:\Windows\System\MyTThsj.exe
  C:\Windows\System\MyTThsj.exe
  2⤵
  PID:13520
- C:\Windows\System\LYxgowI.exe
  C:\Windows\System\LYxgowI.exe
  2⤵
  PID:13412
- C:\Windows\System\GtXBRLr.exe
  C:\Windows\System\GtXBRLr.exe
  2⤵
  PID:13668
- C:\Windows\System\TDuyeep.exe
  C:\Windows\System\TDuyeep.exe
  2⤵
  PID:6884
- C:\Windows\System\IBQfxzz.exe
  C:\Windows\System\IBQfxzz.exe
  2⤵
  PID:404
- C:\Windows\System\cutWJQn.exe
  C:\Windows\System\cutWJQn.exe
  2⤵
  PID:6116
- C:\Windows\System\RmOPBIV.exe
  C:\Windows\System\RmOPBIV.exe
  2⤵
  PID:1196
- C:\Windows\System\iLFAENw.exe
  C:\Windows\System\iLFAENw.exe
  2⤵
  PID:2400
- C:\Windows\System\oswcMRx.exe
  C:\Windows\System\oswcMRx.exe
  2⤵
  PID:9948
- C:\Windows\System\HAQxytr.exe
  C:\Windows\System\HAQxytr.exe
  2⤵
  PID:3736
- C:\Windows\System\nIkHTrd.exe
  C:\Windows\System\nIkHTrd.exe
  2⤵
  PID:6188
- C:\Windows\System\AKvzqCh.exe
  C:\Windows\System\AKvzqCh.exe
  2⤵
  PID:13888
- C:\Windows\System\fyUoiow.exe
  C:\Windows\System\fyUoiow.exe
  2⤵
  PID:6836
- C:\Windows\System\gMqGcKj.exe
  C:\Windows\System\gMqGcKj.exe
  2⤵
  PID:5560
- C:\Windows\System\FydvXus.exe
  C:\Windows\System\FydvXus.exe
  2⤵
  PID:14316
- C:\Windows\System\sUKsQrz.exe
  C:\Windows\System\sUKsQrz.exe
  2⤵
  PID:14236
- C:\Windows\System\ULydPhD.exe
  C:\Windows\System\ULydPhD.exe
  2⤵
  PID:14352
- C:\Windows\System\DiTAthu.exe
  C:\Windows\System\DiTAthu.exe
  2⤵
  PID:14372
- C:\Windows\System\OWndrhM.exe
  C:\Windows\System\OWndrhM.exe
  2⤵
  PID:14388
- C:\Windows\System\qTXtVKQ.exe
  C:\Windows\System\qTXtVKQ.exe
  2⤵
  PID:14408
- C:\Windows\System\FvgQyLi.exe
  C:\Windows\System\FvgQyLi.exe
  2⤵
  PID:14428
- C:\Windows\System\dUuSUDC.exe
  C:\Windows\System\dUuSUDC.exe
  2⤵
  PID:14448
- C:\Windows\System\QhsehES.exe
  C:\Windows\System\QhsehES.exe
  2⤵
  PID:14472
- C:\Windows\System\veKOwpo.exe
  C:\Windows\System\veKOwpo.exe
  2⤵
  PID:14576
- C:\Windows\System\nQsHWJP.exe
  C:\Windows\System\nQsHWJP.exe
  2⤵
  PID:14596
- C:\Windows\System\LvEstam.exe
  C:\Windows\System\LvEstam.exe
  2⤵
  PID:14616
- C:\Windows\System\JmDYvKz.exe
  C:\Windows\System\JmDYvKz.exe
  2⤵
  PID:14632
- C:\Windows\System\iBeTkKR.exe
  C:\Windows\System\iBeTkKR.exe
  2⤵
  PID:14992
- C:\Windows\System\WdiLGEV.exe
  C:\Windows\System\WdiLGEV.exe
  2⤵
  PID:15016
- C:\Windows\System\xkVRwUs.exe
  C:\Windows\System\xkVRwUs.exe
  2⤵
  PID:15140
- C:\Windows\System\seuWYhq.exe
  C:\Windows\System\seuWYhq.exe
  2⤵
  PID:15316
- C:\Windows\System\cqckkLQ.exe
  C:\Windows\System\cqckkLQ.exe
  2⤵
  PID:2688
- C:\Windows\System\bmAdFod.exe
  C:\Windows\System\bmAdFod.exe
  2⤵
  PID:6964
- C:\Windows\System\cZUNGat.exe
  C:\Windows\System\cZUNGat.exe
  2⤵
  PID:7080
- C:\Windows\System\GXwGwjR.exe
  C:\Windows\System\GXwGwjR.exe
  2⤵
  PID:6192
- C:\Windows\System\HmBZbLE.exe
  C:\Windows\System\HmBZbLE.exe
  2⤵
  PID:14360
- C:\Windows\System\DaxSrNZ.exe
  C:\Windows\System\DaxSrNZ.exe
  2⤵
  PID:14308
- C:\Windows\System\iOAOlDy.exe
  C:\Windows\System\iOAOlDy.exe
  2⤵
  PID:14464
- C:\Windows\System\rNdirPV.exe
  C:\Windows\System\rNdirPV.exe
  2⤵
  PID:13448
- C:\Windows\System\HAuJpfW.exe
  C:\Windows\System\HAuJpfW.exe
  2⤵
  PID:14516
- C:\Windows\System\woxMRpV.exe
  C:\Windows\System\woxMRpV.exe
  2⤵
  PID:14572
- C:\Windows\System\zFUatnd.exe
  C:\Windows\System\zFUatnd.exe
  2⤵
  PID:14644
- C:\Windows\System\gFGNtpL.exe
  C:\Windows\System\gFGNtpL.exe
  2⤵
  PID:6916
- C:\Windows\System\GAzdiGS.exe
  C:\Windows\System\GAzdiGS.exe
  2⤵
  PID:6924
- C:\Windows\System\MosQeGz.exe
  C:\Windows\System\MosQeGz.exe
  2⤵
  PID:14696
- C:\Windows\System\WYWFCha.exe
  C:\Windows\System\WYWFCha.exe
  2⤵
  PID:6372
- C:\Windows\System\OeLYzDU.exe
  C:\Windows\System\OeLYzDU.exe
  2⤵
  PID:6720
- C:\Windows\System\sjVMwtp.exe
  C:\Windows\System\sjVMwtp.exe
  2⤵
  PID:14744
- C:\Windows\System\THilJxr.exe
  C:\Windows\System\THilJxr.exe
  2⤵
  PID:7184
- C:\Windows\System\BNvqkem.exe
  C:\Windows\System\BNvqkem.exe
  2⤵
  PID:6556
- C:\Windows\System\MPFgHbn.exe
  C:\Windows\System\MPFgHbn.exe
  2⤵
  PID:4284
- C:\Windows\System\vxfelot.exe
  C:\Windows\System\vxfelot.exe
  2⤵
  PID:14460
- C:\Windows\System\GgTBHTi.exe
  C:\Windows\System\GgTBHTi.exe
  2⤵
  PID:15032
- C:\Windows\System\qUYtbEp.exe
  C:\Windows\System\qUYtbEp.exe
  2⤵
  PID:3912
- C:\Windows\System\staTGOJ.exe
  C:\Windows\System\staTGOJ.exe
  2⤵
  PID:15048
- C:\Windows\System\nhAylNd.exe
  C:\Windows\System\nhAylNd.exe
  2⤵
  PID:14664
- C:\Windows\System\JeouzxE.exe
  C:\Windows\System\JeouzxE.exe
  2⤵
  PID:14912
- C:\Windows\System\IpbUUUd.exe
  C:\Windows\System\IpbUUUd.exe
  2⤵
  PID:7252
- C:\Windows\System\OBbpAPs.exe
  C:\Windows\System\OBbpAPs.exe
  2⤵
  PID:7276
- C:\Windows\System\jSJbxAW.exe
  C:\Windows\System\jSJbxAW.exe
  2⤵
  PID:7616
- C:\Windows\System\XAdukBO.exe
  C:\Windows\System\XAdukBO.exe
  2⤵
  PID:14928
- C:\Windows\System\PVWNMHe.exe
  C:\Windows\System\PVWNMHe.exe
  2⤵
  PID:6060
- C:\Windows\System\JpKEeir.exe
  C:\Windows\System\JpKEeir.exe
  2⤵
  PID:7432
- C:\Windows\System\BsadVYR.exe
  C:\Windows\System\BsadVYR.exe
  2⤵
  PID:7924
- C:\Windows\System\LpJemLa.exe
  C:\Windows\System\LpJemLa.exe
  2⤵
  PID:15184
- C:\Windows\System\mVWwlbZ.exe
  C:\Windows\System\mVWwlbZ.exe
  2⤵
  PID:7888
- C:\Windows\System\dCzgfoB.exe
  C:\Windows\System\dCzgfoB.exe
  2⤵
  PID:15052
- C:\Windows\System\ZAKHOiE.exe
  C:\Windows\System\ZAKHOiE.exe
  2⤵
  PID:7232
- C:\Windows\System\cykgJce.exe
  C:\Windows\System\cykgJce.exe
  2⤵
  PID:7932
- C:\Windows\System\eUGtaAP.exe
  C:\Windows\System\eUGtaAP.exe
  2⤵
  PID:14832
- C:\Windows\System\IvOfCaU.exe
  C:\Windows\System\IvOfCaU.exe
  2⤵
  PID:15100
- C:\Windows\System\OWBaKGs.exe
  C:\Windows\System\OWBaKGs.exe
  2⤵
  PID:15120
- C:\Windows\System\zxplOZC.exe
  C:\Windows\System\zxplOZC.exe
  2⤵
  PID:15292
- C:\Windows\System\moMvlEH.exe
  C:\Windows\System\moMvlEH.exe
  2⤵
  PID:7368
- C:\Windows\System\mUrnDIF.exe
  C:\Windows\System\mUrnDIF.exe
  2⤵
  PID:7340
- C:\Windows\System\BNrqBOe.exe
  C:\Windows\System\BNrqBOe.exe
  2⤵
  PID:6156
- C:\Windows\System\rNRnAQm.exe
  C:\Windows\System\rNRnAQm.exe
  2⤵
  PID:6868
- C:\Windows\System\yCsSjMZ.exe
  C:\Windows\System\yCsSjMZ.exe
  2⤵
  PID:14896
- C:\Windows\System\vgvYWle.exe
  C:\Windows\System\vgvYWle.exe
  2⤵
  PID:7408
- C:\Windows\System\DiElGgB.exe
  C:\Windows\System\DiElGgB.exe
  2⤵
  PID:7364
- C:\Windows\System\PwkOjft.exe
  C:\Windows\System\PwkOjft.exe
  2⤵
  PID:8364
- C:\Windows\System\oMlhJRD.exe
  C:\Windows\System\oMlhJRD.exe
  2⤵
  PID:8852
- C:\Windows\System\yixphCX.exe
  C:\Windows\System\yixphCX.exe
  2⤵
  PID:8832
- C:\Windows\System\AKPnhUs.exe
  C:\Windows\System\AKPnhUs.exe
  2⤵
  PID:8976
- C:\Windows\System\AuxYAMt.exe
  C:\Windows\System\AuxYAMt.exe
  2⤵
  PID:15296
- C:\Windows\System\NoGgMKB.exe
  C:\Windows\System\NoGgMKB.exe
  2⤵
  PID:7676
- C:\Windows\System\KbcLHNv.exe
  C:\Windows\System\KbcLHNv.exe
  2⤵
  PID:14888
- C:\Windows\System\fVKuywy.exe
  C:\Windows\System\fVKuywy.exe
  2⤵
  PID:9208
- C:\Windows\System\umfSYsY.exe
  C:\Windows\System\umfSYsY.exe
  2⤵
  PID:6704
- C:\Windows\System\WgrAcjw.exe
  C:\Windows\System\WgrAcjw.exe
  2⤵
  PID:7256
- C:\Windows\System\avjZDTD.exe
  C:\Windows\System\avjZDTD.exe
  2⤵
  PID:9412
- C:\Windows\System\DTbVceF.exe
  C:\Windows\System\DTbVceF.exe
  2⤵
  PID:15036
- C:\Windows\System\uRwSXQm.exe
  C:\Windows\System\uRwSXQm.exe
  2⤵
  PID:9308
- C:\Windows\System\vEmXTVt.exe
  C:\Windows\System\vEmXTVt.exe
  2⤵
  PID:9492
- C:\Windows\System\WDVNiCj.exe
  C:\Windows\System\WDVNiCj.exe
  2⤵
  PID:8076
- C:\Windows\System\FdrMWQw.exe
  C:\Windows\System\FdrMWQw.exe
  2⤵
  PID:9392
- C:\Windows\System\WAuZtDy.exe
  C:\Windows\System\WAuZtDy.exe
  2⤵
  PID:9200
- C:\Windows\System\QWYZiPp.exe
  C:\Windows\System\QWYZiPp.exe
  2⤵
  PID:14716
- C:\Windows\System\UAVaLkK.exe
  C:\Windows\System\UAVaLkK.exe
  2⤵
  PID:14144
- C:\Windows\System\QsXsZpX.exe
  C:\Windows\System\QsXsZpX.exe
  2⤵
  PID:4392
- C:\Windows\System\ZzKpJvV.exe
  C:\Windows\System\ZzKpJvV.exe
  2⤵
  PID:1596
- C:\Windows\System\SkXPICX.exe
  C:\Windows\System\SkXPICX.exe
  2⤵
  PID:9540
- C:\Windows\System\yLtSqzi.exe
  C:\Windows\System\yLtSqzi.exe
  2⤵
  PID:9708
- C:\Windows\System\SpFCSAZ.exe
  C:\Windows\System\SpFCSAZ.exe
  2⤵
  PID:14812
- C:\Windows\System\JWUqHmq.exe
  C:\Windows\System\JWUqHmq.exe
  2⤵
  PID:8400
- C:\Windows\System\TYoIRxW.exe
  C:\Windows\System\TYoIRxW.exe
  2⤵
  PID:5744
- C:\Windows\System\VMfIamn.exe
  C:\Windows\System\VMfIamn.exe
  2⤵
  PID:12952
- C:\Windows\System\XqsyYQs.exe
  C:\Windows\System\XqsyYQs.exe
  2⤵
  PID:7716
- C:\Windows\System\iskNNaW.exe
  C:\Windows\System\iskNNaW.exe
  2⤵
  PID:15312
- C:\Windows\System\dknnWiO.exe
  C:\Windows\System\dknnWiO.exe
  2⤵
  PID:14120
- C:\Windows\System\QmHPrer.exe
  C:\Windows\System\QmHPrer.exe
  2⤵
  PID:14384
- C:\Windows\System\myYCTIT.exe
  C:\Windows\System\myYCTIT.exe
  2⤵
  PID:7700
- C:\Windows\System\mOUWLvq.exe
  C:\Windows\System\mOUWLvq.exe
  2⤵
  PID:7264
- C:\Windows\System\UegBpzT.exe
  C:\Windows\System\UegBpzT.exe
  2⤵
  PID:15008
- C:\Windows\System\WxMkLzQ.exe
  C:\Windows\System\WxMkLzQ.exe
  2⤵
  PID:8464
- C:\Windows\System\xhsYgmn.exe
  C:\Windows\System\xhsYgmn.exe
  2⤵
  PID:15240
- C:\Windows\System\mcoebFY.exe
  C:\Windows\System\mcoebFY.exe
  2⤵
  PID:8240
- C:\Windows\System\kjBuhBy.exe
  C:\Windows\System\kjBuhBy.exe
  2⤵
  PID:9824
- C:\Windows\System\viZadcJ.exe
  C:\Windows\System\viZadcJ.exe
  2⤵
  PID:10172
- C:\Windows\System\AzzdFGF.exe
  C:\Windows\System\AzzdFGF.exe
  2⤵
  PID:5104
- C:\Windows\System\HbTEtdE.exe
  C:\Windows\System\HbTEtdE.exe
  2⤵
  PID:6024
- C:\Windows\System\LctDBRo.exe
  C:\Windows\System\LctDBRo.exe
  2⤵
  PID:8600
- C:\Windows\System\YYGelmL.exe
  C:\Windows\System\YYGelmL.exe
  2⤵
  PID:8896
- C:\Windows\System\DZBEqhv.exe
  C:\Windows\System\DZBEqhv.exe
  2⤵
  PID:9996
- C:\Windows\System\aEMPLaP.exe
  C:\Windows\System\aEMPLaP.exe
  2⤵
  PID:9608
- C:\Windows\System\MZPhxZn.exe
  C:\Windows\System\MZPhxZn.exe
  2⤵
  PID:10776
- C:\Windows\System\HRLFbig.exe
  C:\Windows\System\HRLFbig.exe
  2⤵
  PID:9224
- C:\Windows\System\oxYddch.exe
  C:\Windows\System\oxYddch.exe
  2⤵
  PID:10924
- C:\Windows\System\zuFzkcG.exe
  C:\Windows\System\zuFzkcG.exe
  2⤵
  PID:9000
- C:\Windows\System\ZNHjgSU.exe
  C:\Windows\System\ZNHjgSU.exe
  2⤵
  PID:10608
- C:\Windows\System\USBQGBe.exe
  C:\Windows\System\USBQGBe.exe
  2⤵
  PID:14648
- C:\Windows\System\UeZKMrP.exe
  C:\Windows\System\UeZKMrP.exe
  2⤵
  PID:10100
- C:\Windows\System\qrzRbGW.exe
  C:\Windows\System\qrzRbGW.exe
  2⤵
  PID:9944
- C:\Windows\System\XrBkQNB.exe
  C:\Windows\System\XrBkQNB.exe
  2⤵
  PID:12796
- C:\Windows\System\mHuwjEN.exe
  C:\Windows\System\mHuwjEN.exe
  2⤵
  PID:3708
- C:\Windows\System\BfBVETZ.exe
  C:\Windows\System\BfBVETZ.exe
  2⤵
  PID:8912
- C:\Windows\System\hDbqmsT.exe
  C:\Windows\System\hDbqmsT.exe
  2⤵
  PID:15232
- C:\Windows\System\zIXhbvm.exe
  C:\Windows\System\zIXhbvm.exe
  2⤵
  PID:10860
- C:\Windows\System\hkzsEMQ.exe
  C:\Windows\System\hkzsEMQ.exe
  2⤵
  PID:10372
- C:\Windows\System\OnDcWuO.exe
  C:\Windows\System\OnDcWuO.exe
  2⤵
  PID:14984
- C:\Windows\System\hIjaMVc.exe
  C:\Windows\System\hIjaMVc.exe
  2⤵
  PID:8880
- C:\Windows\System\fGVZPTZ.exe
  C:\Windows\System\fGVZPTZ.exe
  2⤵
  PID:6300
- C:\Windows\System\avxzjuL.exe
  C:\Windows\System\avxzjuL.exe
  2⤵
  PID:10640
- C:\Windows\System\eOyMxJQ.exe
  C:\Windows\System\eOyMxJQ.exe
  2⤵
  PID:9568
- C:\Windows\System\BqvWtpu.exe
  C:\Windows\System\BqvWtpu.exe
  2⤵
  PID:7260
- C:\Windows\System\SsNEGJH.exe
  C:\Windows\System\SsNEGJH.exe
  2⤵
  PID:10996
- C:\Windows\System\BCncirb.exe
  C:\Windows\System\BCncirb.exe
  2⤵
  PID:10884
- C:\Windows\System\scUpzEs.exe
  C:\Windows\System\scUpzEs.exe
  2⤵
  PID:9692
- C:\Windows\System\lspPJXM.exe
  C:\Windows\System\lspPJXM.exe
  2⤵
  PID:9596
- C:\Windows\System\IljJTSd.exe
  C:\Windows\System\IljJTSd.exe
  2⤵
  PID:6668
- C:\Windows\System\wJBGwJe.exe
  C:\Windows\System\wJBGwJe.exe
  2⤵
  PID:11408
- C:\Windows\System\bbfwkOs.exe
  C:\Windows\System\bbfwkOs.exe
  2⤵
  PID:9404
- C:\Windows\System\bWkIBoz.exe
  C:\Windows\System\bWkIBoz.exe
  2⤵
  PID:9376
- C:\Windows\System\dPosCCU.exe
  C:\Windows\System\dPosCCU.exe
  2⤵
  PID:11448
- C:\Windows\System\UKSkRHQ.exe
  C:\Windows\System\UKSkRHQ.exe
  2⤵
  PID:14200
- C:\Windows\System\OVurSvq.exe
  C:\Windows\System\OVurSvq.exe
  2⤵
  PID:7764
- C:\Windows\System\RNPKTeY.exe
  C:\Windows\System\RNPKTeY.exe
  2⤵
  PID:7420
- C:\Windows\System\mOpfjmq.exe
  C:\Windows\System\mOpfjmq.exe
  2⤵
  PID:9220
- C:\Windows\System\drvZAQa.exe
  C:\Windows\System\drvZAQa.exe
  2⤵
  PID:7108
- C:\Windows\System\aMYECzk.exe
  C:\Windows\System\aMYECzk.exe
  2⤵
  PID:14592
- C:\Windows\System\dYSTvkL.exe
  C:\Windows\System\dYSTvkL.exe
  2⤵
  PID:7392
- C:\Windows\System\WJlxVLI.exe
  C:\Windows\System\WJlxVLI.exe
  2⤵
  PID:3916
- C:\Windows\System\leuqtba.exe
  C:\Windows\System\leuqtba.exe
  2⤵
  PID:7436
- C:\Windows\System\oKbCdbl.exe
  C:\Windows\System\oKbCdbl.exe
  2⤵
  PID:9296
- C:\Windows\System\ZWoOvFE.exe
  C:\Windows\System\ZWoOvFE.exe
  2⤵
  PID:12100
- C:\Windows\System\PZypfoK.exe
  C:\Windows\System\PZypfoK.exe
  2⤵
  PID:11440
- C:\Windows\System\HWtsQwf.exe
  C:\Windows\System\HWtsQwf.exe
  2⤵
  PID:6788
- C:\Windows\System\BOiSxCI.exe
  C:\Windows\System\BOiSxCI.exe
  2⤵
  PID:12052
- C:\Windows\System\XdXHliV.exe
  C:\Windows\System\XdXHliV.exe
  2⤵
  PID:9660
- C:\Windows\System\BcsOyuQ.exe
  C:\Windows\System\BcsOyuQ.exe
  2⤵
  PID:9432
- C:\Windows\System\BXYrETP.exe
  C:\Windows\System\BXYrETP.exe
  2⤵
  PID:9696
- C:\Windows\System\CDAyFcR.exe
  C:\Windows\System\CDAyFcR.exe
  2⤵
  PID:9668
- C:\Windows\System\knuzmLh.exe
  C:\Windows\System\knuzmLh.exe
  2⤵
  PID:14672
- C:\Windows\System\IyjCNXu.exe
  C:\Windows\System\IyjCNXu.exe
  2⤵
  PID:6876
- C:\Windows\System\VSjaVhD.exe
  C:\Windows\System\VSjaVhD.exe
  2⤵
  PID:14892
- C:\Windows\System\cExVKzN.exe
  C:\Windows\System\cExVKzN.exe
  2⤵
  PID:9768
- C:\Windows\System\UWivFIR.exe
  C:\Windows\System\UWivFIR.exe
  2⤵
  PID:6760
- C:\Windows\System\hdPhCLX.exe
  C:\Windows\System\hdPhCLX.exe
  2⤵
  PID:11516
- C:\Windows\System\bDBrzDU.exe
  C:\Windows\System\bDBrzDU.exe
  2⤵
  PID:10416
- C:\Windows\System\GziWAEt.exe
  C:\Windows\System\GziWAEt.exe
  2⤵
  PID:14508
- C:\Windows\System\CgahzHj.exe
  C:\Windows\System\CgahzHj.exe
  2⤵
  PID:13904
- C:\Windows\System\vgnGGiE.exe
  C:\Windows\System\vgnGGiE.exe
  2⤵
  PID:11760
- C:\Windows\System\JbCqxUJ.exe
  C:\Windows\System\JbCqxUJ.exe
  2⤵
  PID:8324
- C:\Windows\System\MappXxf.exe
  C:\Windows\System\MappXxf.exe
  2⤵
  PID:7104
- C:\Windows\System\gXyNxHi.exe
  C:\Windows\System\gXyNxHi.exe
  2⤵
  PID:1104
- C:\Windows\System\zwsTmBq.exe
  C:\Windows\System\zwsTmBq.exe
  2⤵
  PID:1200
- C:\Windows\System\WOiHMKh.exe
  C:\Windows\System\WOiHMKh.exe
  2⤵
  PID:7704
- C:\Windows\System\VqzcMWg.exe
  C:\Windows\System\VqzcMWg.exe
  2⤵
  PID:10800
- C:\Windows\System\BgkyoFy.exe
  C:\Windows\System\BgkyoFy.exe
  2⤵
  PID:12148
- C:\Windows\System\FMhRlVw.exe
  C:\Windows\System\FMhRlVw.exe
  2⤵
  PID:11860
- C:\Windows\System\DyWpTfO.exe
  C:\Windows\System\DyWpTfO.exe
  2⤵
  PID:12204
- C:\Windows\System\DSPaEGh.exe
  C:\Windows\System\DSPaEGh.exe
  2⤵
  PID:10408
- C:\Windows\System\xhZOeMM.exe
  C:\Windows\System\xhZOeMM.exe
  2⤵
  PID:11248
- C:\Windows\System\PmrNcJf.exe
  C:\Windows\System\PmrNcJf.exe
  2⤵
  PID:11188
- C:\Windows\System\TLktHjW.exe
  C:\Windows\System\TLktHjW.exe
  2⤵
  PID:12292
- C:\Windows\System\JOuQyTf.exe
  C:\Windows\System\JOuQyTf.exe
  2⤵
  PID:10264
- C:\Windows\System\LkPCYSZ.exe
  C:\Windows\System\LkPCYSZ.exe
  2⤵
  PID:6592
- C:\Windows\System\vEUgszi.exe
  C:\Windows\System\vEUgszi.exe
  2⤵
  PID:10952
- C:\Windows\System\aIpnlQy.exe
  C:\Windows\System\aIpnlQy.exe
  2⤵
  PID:12440
- C:\Windows\System\skjHIyO.exe
  C:\Windows\System\skjHIyO.exe
  2⤵
  PID:5592
- C:\Windows\System\QXvKOZh.exe
  C:\Windows\System\QXvKOZh.exe
  2⤵
  PID:7592
- C:\Windows\System\OZlWeCH.exe
  C:\Windows\System\OZlWeCH.exe
  2⤵
  PID:9364
- C:\Windows\System\InEiuiq.exe
  C:\Windows\System\InEiuiq.exe
  2⤵
  PID:9560
- C:\Windows\System\cyOubSs.exe
  C:\Windows\System\cyOubSs.exe
  2⤵
  PID:11136
- C:\Windows\System\zbSDjLR.exe
  C:\Windows\System\zbSDjLR.exe
  2⤵
  PID:12656
- C:\Windows\System\YlsVVbx.exe
  C:\Windows\System\YlsVVbx.exe
  2⤵
  PID:11104
- C:\Windows\System\IwKuzam.exe
  C:\Windows\System\IwKuzam.exe
  2⤵
  PID:12792
- C:\Windows\System\yDOXuji.exe
  C:\Windows\System\yDOXuji.exe
  2⤵
  PID:12632
- C:\Windows\System\idtFAup.exe
  C:\Windows\System\idtFAup.exe
  2⤵
  PID:10704
- C:\Windows\System\WqQVblE.exe
  C:\Windows\System\WqQVblE.exe
  2⤵
  PID:7088
- C:\Windows\System\oquMCWK.exe
  C:\Windows\System\oquMCWK.exe
  2⤵
  PID:8972
- C:\Windows\System\jrzqlsE.exe
  C:\Windows\System\jrzqlsE.exe
  2⤵
  PID:10060
- C:\Windows\System\rRNAQMa.exe
  C:\Windows\System\rRNAQMa.exe
  2⤵
  PID:13600
- C:\Windows\System\gJqMdAw.exe
  C:\Windows\System\gJqMdAw.exe
  2⤵
  PID:14824
- C:\Windows\System\FdKHdJD.exe
  C:\Windows\System\FdKHdJD.exe
  2⤵
  PID:7496
- C:\Windows\System\ntiTrOo.exe
  C:\Windows\System\ntiTrOo.exe
  2⤵
  PID:7860
- C:\Windows\System\GXYofMP.exe
  C:\Windows\System\GXYofMP.exe
  2⤵
  PID:13076
- C:\Windows\System\SPInVQU.exe
  C:\Windows\System\SPInVQU.exe
  2⤵
  PID:12280
- C:\Windows\System\nkfMJcM.exe
  C:\Windows\System\nkfMJcM.exe
  2⤵
  PID:116
- C:\Windows\System\rgQkgst.exe
  C:\Windows\System\rgQkgst.exe
  2⤵
  PID:13044
- C:\Windows\System\glnWpCl.exe
  C:\Windows\System\glnWpCl.exe
  2⤵
  PID:6904
- C:\Windows\System\NXykSli.exe
  C:\Windows\System\NXykSli.exe
  2⤵
  PID:9864
- C:\Windows\System\LCwMTDr.exe
  C:\Windows\System\LCwMTDr.exe
  2⤵
  PID:5084
- C:\Windows\System\ICKVwIX.exe
  C:\Windows\System\ICKVwIX.exe
  2⤵
  PID:9284
- C:\Windows\System\PpVQIkJ.exe
  C:\Windows\System\PpVQIkJ.exe
  2⤵
  PID:560
- C:\Windows\System\bRdshhw.exe
  C:\Windows\System\bRdshhw.exe
  2⤵
  PID:2320
- C:\Windows\System\aIzExUu.exe
  C:\Windows\System\aIzExUu.exe
  2⤵
  PID:13220
- C:\Windows\System\aDawpdc.exe
  C:\Windows\System\aDawpdc.exe
  2⤵
  PID:11712
- C:\Windows\System\kFuLqPj.exe
  C:\Windows\System\kFuLqPj.exe
  2⤵
  PID:14176
- C:\Windows\System\PLijEnh.exe
  C:\Windows\System\PLijEnh.exe
  2⤵
  PID:11808
- C:\Windows\System\aaYBKgF.exe
  C:\Windows\System\aaYBKgF.exe
  2⤵
  PID:9892
- C:\Windows\System\EHQwSaq.exe
  C:\Windows\System\EHQwSaq.exe
  2⤵
  PID:5372
- C:\Windows\System\PNiSDim.exe
  C:\Windows\System\PNiSDim.exe
  2⤵
  PID:11632
- C:\Windows\System\yOkWiyT.exe
  C:\Windows\System\yOkWiyT.exe
  2⤵
  PID:9744
- C:\Windows\System\gDJXzOP.exe
  C:\Windows\System\gDJXzOP.exe
  2⤵
  PID:12568
- C:\Windows\System\YhmQikT.exe
  C:\Windows\System\YhmQikT.exe
  2⤵
  PID:10124
- C:\Windows\System\CCSROCI.exe
  C:\Windows\System\CCSROCI.exe
  2⤵
  PID:13416
- C:\Windows\System\frQyeTh.exe
  C:\Windows\System\frQyeTh.exe
  2⤵
  PID:7792
- C:\Windows\System\okxLovE.exe
  C:\Windows\System\okxLovE.exe
  2⤵
  PID:7268
- C:\Windows\System\BuAFGgT.exe
  C:\Windows\System\BuAFGgT.exe
  2⤵
  PID:4012
- C:\Windows\System\QMYkEqE.exe
  C:\Windows\System\QMYkEqE.exe
  2⤵
  PID:12640
- C:\Windows\System\FWywrTw.exe
  C:\Windows\System\FWywrTw.exe
  2⤵
  PID:11772
- C:\Windows\System\sRPsmAW.exe
  C:\Windows\System\sRPsmAW.exe
  2⤵
  PID:10992
- C:\Windows\System\OPLmMuw.exe
  C:\Windows\System\OPLmMuw.exe
  2⤵
  PID:11900
- C:\Windows\System\teFSJaQ.exe
  C:\Windows\System\teFSJaQ.exe
  2⤵
  PID:10564
- C:\Windows\System\exXeoEk.exe
  C:\Windows\System\exXeoEk.exe
  2⤵
  PID:14900
- C:\Windows\System\YBBsCnv.exe
  C:\Windows\System\YBBsCnv.exe
  2⤵
  PID:7712
- C:\Windows\System\kbcnkex.exe
  C:\Windows\System\kbcnkex.exe
  2⤵
  PID:12256
- C:\Windows\System\stUpRoR.exe
  C:\Windows\System\stUpRoR.exe
  2⤵
  PID:1544
- C:\Windows\System\JFFybuq.exe
  C:\Windows\System\JFFybuq.exe
  2⤵
  PID:12412
- C:\Windows\System\tsvextD.exe
  C:\Windows\System\tsvextD.exe
  2⤵
  PID:12660
- C:\Windows\System\FcsaSDL.exe
  C:\Windows\System\FcsaSDL.exe
  2⤵
  PID:7384
- C:\Windows\System\JflkTJt.exe
  C:\Windows\System\JflkTJt.exe
  2⤵
  PID:12312
- C:\Windows\System\SbcGnPA.exe
  C:\Windows\System\SbcGnPA.exe
  2⤵
  PID:2420
- C:\Windows\System\llkHLfx.exe
  C:\Windows\System\llkHLfx.exe
  2⤵
  PID:12400
- C:\Windows\System\rasjBhr.exe
  C:\Windows\System\rasjBhr.exe
  2⤵
  PID:12940
- C:\Windows\System\SJHoPAL.exe
  C:\Windows\System\SJHoPAL.exe
  2⤵
  PID:7416
- C:\Windows\System\LpTxYcc.exe
  C:\Windows\System\LpTxYcc.exe
  2⤵
  PID:12972
- C:\Windows\System\mSgebbq.exe
  C:\Windows\System\mSgebbq.exe
  2⤵
  PID:12944
- C:\Windows\System\ozHxMzg.exe
  C:\Windows\System\ozHxMzg.exe
  2⤵
  PID:9804
- C:\Windows\System\NRBPOYX.exe
  C:\Windows\System\NRBPOYX.exe
  2⤵
  PID:14804
- C:\Windows\System\bOtBWLL.exe
  C:\Windows\System\bOtBWLL.exe
  2⤵
  PID:7076
- C:\Windows\System\gzIRrxR.exe
  C:\Windows\System\gzIRrxR.exe
  2⤵
  PID:11464
- C:\Windows\System\HdNnmua.exe
  C:\Windows\System\HdNnmua.exe
  2⤵
  PID:8172
- C:\Windows\System\JIXdmzw.exe
  C:\Windows\System\JIXdmzw.exe
  2⤵
  PID:3528
- C:\Windows\System\rvGFsYY.exe
  C:\Windows\System\rvGFsYY.exe
  2⤵
  PID:1708
- C:\Windows\System\QGLkLGb.exe
  C:\Windows\System\QGLkLGb.exe
  2⤵
  PID:9084
- C:\Windows\System\NHcpAJC.exe
  C:\Windows\System\NHcpAJC.exe
  2⤵
  PID:10964
- C:\Windows\System\mxGssqi.exe
  C:\Windows\System\mxGssqi.exe
  2⤵
  PID:5292
- C:\Windows\System\RYHxNBL.exe
  C:\Windows\System\RYHxNBL.exe
  2⤵
  PID:13060
- C:\Windows\System\wyabAGZ.exe
  C:\Windows\System\wyabAGZ.exe
  2⤵
  PID:12316
- C:\Windows\System\pDnwGuM.exe
  C:\Windows\System\pDnwGuM.exe
  2⤵
  PID:9984
- C:\Windows\System\RxPDXnK.exe
  C:\Windows\System\RxPDXnK.exe
  2⤵
  PID:7016
- C:\Windows\System\tZmJkxB.exe
  C:\Windows\System\tZmJkxB.exe
  2⤵
  PID:7320
- C:\Windows\System\keCNDOQ.exe
  C:\Windows\System\keCNDOQ.exe
  2⤵
  PID:2468
- C:\Windows\System\bXxJsMO.exe
  C:\Windows\System\bXxJsMO.exe
  2⤵
  PID:5420
- C:\Windows\System\FZrIlmH.exe
  C:\Windows\System\FZrIlmH.exe
  2⤵
  PID:12072
- C:\Windows\System\rCeWQHi.exe
  C:\Windows\System\rCeWQHi.exe
  2⤵
  PID:15356
- C:\Windows\System\zXJCloh.exe
  C:\Windows\System\zXJCloh.exe
  2⤵
  PID:464
- C:\Windows\System\PXxjdAT.exe
  C:\Windows\System\PXxjdAT.exe
  2⤵
  PID:11520
- C:\Windows\System\LOcrhch.exe
  C:\Windows\System\LOcrhch.exe
  2⤵
  PID:9468
- C:\Windows\System\JNndvCS.exe
  C:\Windows\System\JNndvCS.exe
  2⤵
  PID:14884
- C:\Windows\System\VuJITny.exe
  C:\Windows\System\VuJITny.exe
  2⤵
  PID:4980
- C:\Windows\System\iVdAOQw.exe
  C:\Windows\System\iVdAOQw.exe
  2⤵
  PID:12252
- C:\Windows\System\bUFIdzV.exe
  C:\Windows\System\bUFIdzV.exe
  2⤵
  PID:8472
- C:\Windows\System\EwjNjKZ.exe
  C:\Windows\System\EwjNjKZ.exe
  2⤵
  PID:10780
- C:\Windows\System\KloWpdJ.exe
  C:\Windows\System\KloWpdJ.exe
  2⤵
  PID:12836
- C:\Windows\System\RQpXgal.exe
  C:\Windows\System\RQpXgal.exe
  2⤵
  PID:1568
- C:\Windows\System\KIjnuIp.exe
  C:\Windows\System\KIjnuIp.exe
  2⤵
  PID:11828
- C:\Windows\System\ePgyhcV.exe
  C:\Windows\System\ePgyhcV.exe
  2⤵
  PID:12684
- C:\Windows\System\DCWJXrV.exe
  C:\Windows\System\DCWJXrV.exe
  2⤵
  PID:2652
- C:\Windows\System\Clkcqno.exe
  C:\Windows\System\Clkcqno.exe
  2⤵
  PID:13184
- C:\Windows\System\gsCVkMR.exe
  C:\Windows\System\gsCVkMR.exe
  2⤵
  PID:9848
- C:\Windows\System\rEHmPwj.exe
  C:\Windows\System\rEHmPwj.exe
  2⤵
  PID:9748
- C:\Windows\System\EQCEDBc.exe
  C:\Windows\System\EQCEDBc.exe
  2⤵
  PID:14268
- C:\Windows\System\DXLtVvA.exe
  C:\Windows\System\DXLtVvA.exe
  2⤵
  PID:3436
- C:\Windows\System\Kzjohlw.exe
  C:\Windows\System\Kzjohlw.exe
  2⤵
  PID:12456
- C:\Windows\System\cRLEbjj.exe
  C:\Windows\System\cRLEbjj.exe
  2⤵
  PID:5688
- C:\Windows\System\kBYcBql.exe
  C:\Windows\System\kBYcBql.exe
  2⤵
  PID:13592
- C:\Windows\System\DUsdDbR.exe
  C:\Windows\System\DUsdDbR.exe
  2⤵
  PID:13172
- C:\Windows\System\RsPtEHu.exe
  C:\Windows\System\RsPtEHu.exe
  2⤵
  PID:5832
- C:\Windows\System\TsmSVbL.exe
  C:\Windows\System\TsmSVbL.exe
  2⤵
  PID:5148
- C:\Windows\System\ErXICFS.exe
  C:\Windows\System\ErXICFS.exe
  2⤵
  PID:13368
- C:\Windows\System\DQXeZOc.exe
  C:\Windows\System\DQXeZOc.exe
  2⤵
  PID:11152
- C:\Windows\System\moFbrLN.exe
  C:\Windows\System\moFbrLN.exe
  2⤵
  PID:13032
- C:\Windows\System\GQoxwiz.exe
  C:\Windows\System\GQoxwiz.exe
  2⤵
  PID:752
- C:\Windows\System\ySZtKEY.exe
  C:\Windows\System\ySZtKEY.exe
  2⤵
  PID:11916
- C:\Windows\System\nArVgbl.exe
  C:\Windows\System\nArVgbl.exe
  2⤵
  PID:13924
- C:\Windows\System\VFdnJnZ.exe
  C:\Windows\System\VFdnJnZ.exe
  2⤵
  PID:15248
- C:\Windows\System\uZPctEU.exe
  C:\Windows\System\uZPctEU.exe
  2⤵
  PID:8408
- C:\Windows\System\WpIxjeV.exe
  C:\Windows\System\WpIxjeV.exe
  2⤵
  PID:13648
- C:\Windows\System\kdlAKpK.exe
  C:\Windows\System\kdlAKpK.exe
  2⤵
  PID:13640
- C:\Windows\System\qEZMJOx.exe
  C:\Windows\System\qEZMJOx.exe
  2⤵
  PID:13320
- C:\Windows\System\hwNnvuu.exe
  C:\Windows\System\hwNnvuu.exe
  2⤵
  PID:12928
- C:\Windows\System\vWFEtcL.exe
  C:\Windows\System\vWFEtcL.exe
  2⤵
  PID:13564
- C:\Windows\System\nExrAbr.exe
  C:\Windows\System\nExrAbr.exe
  2⤵
  PID:3844
- C:\Windows\System\AfDYUPy.exe
  C:\Windows\System\AfDYUPy.exe
  2⤵
  PID:13672
- C:\Windows\System\XmUkqqS.exe
  C:\Windows\System\XmUkqqS.exe
  2⤵
  PID:14780
- C:\Windows\System\dCisIrF.exe
  C:\Windows\System\dCisIrF.exe
  2⤵
  PID:2832
- C:\Windows\System\LdplNep.exe
  C:\Windows\System\LdplNep.exe
  2⤵
  PID:5076
- C:\Windows\System\IXRwxYL.exe
  C:\Windows\System\IXRwxYL.exe
  2⤵
  PID:12348
- C:\Windows\System\xqpkAKZ.exe
  C:\Windows\System\xqpkAKZ.exe
  2⤵
  PID:820
- C:\Windows\System\SaFwklE.exe
  C:\Windows\System\SaFwklE.exe
  2⤵
  PID:13856
- C:\Windows\System\xuPoSGf.exe
  C:\Windows\System\xuPoSGf.exe
  2⤵
  PID:13272
- C:\Windows\System\WpHSbbg.exe
  C:\Windows\System\WpHSbbg.exe
  2⤵
  PID:12244
- C:\Windows\System\EmmmPpy.exe
  C:\Windows\System\EmmmPpy.exe
  2⤵
  PID:13532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5680 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:13244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\site-d059d883a114[1].css

Filesize
66KB

MD5
06ad9bc6321c6fed15c64dd375c36d90

SHA1
2abef97ab0621a1d832c6ca784721adad5bc8315

SHA256
74439e916848a6d30f2933b4e7c5a88b41d8ca3a1593f68a82596379806d4ae6

SHA512
d059d883a114193dd05c54c9d3db4f1552bba29320d529b3abed354152a17bcd773dfdec46afc8c2f2d7fd7f13ff85042fa697d761cb7a3447a8488349c81e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jxcysgty.mdk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AtiiBCd.exe

Filesize
2.2MB

MD5
18120ed5696e5382a736e0a4d35c03e9

SHA1
85b917b9f96fbc9ff711d9c26c5e675dec4c0f7b

SHA256
0b91d32cec8144d0649ff194264fef64fde7e7680364a304d972f0745a11a4d7

SHA512
6a897b0fec64a948591401d13cf45ec063df9d6546335419d94347ece5081a34c9a780eba982b372d68f982c8662af6ba3d55a77198745647a5db80996eea6cf

Download Submit
C:\Windows\System\BwKjgZj.exe

Filesize
2.2MB

MD5
43f2644bced155576192a88899028527

SHA1
eb647beb8edc903820eea5f7e6d2b0c4c9a4861f

SHA256
f832a04621469dba1618747c31194fca5eb2c770d2d0ffad7b8cb845a2d9330c

SHA512
15dbe3ccb5d9b3339f1250adfe3e276cb3119af53e72e450e20a2efcc0fd6e189bbc54c42b40a3a929502420f2a1168af36c43c6c732b4f3d6994883a98513c2

Download Submit
C:\Windows\System\CjUocLQ.exe

Filesize
2.2MB

MD5
87d3d531169c88d8fae539815f26358f

SHA1
0f2a6ee250b91c2f5057ba9d13c7b21774a11c49

SHA256
c8703b9afcb6a1c3942d075592ac9774c56ac6b407dfb403d2c9ac94fddb0de3

SHA512
c76cf0be45c20481fde9cb18be97759947866a673b7ba21a6d35f3732d220d5b22c8b19531580e9b0f69f7c5098af3b145b37ebb34fc73c624f921af0b8be12f

Download Submit
C:\Windows\System\DNLitsK.exe

Filesize
2.2MB

MD5
d5a1492469bef7ff53ddbf4bd79f47cd

SHA1
71e9800a30ef1efda75796085531d8082ee4e774

SHA256
035e27bb1f1741247674dd1491a64445c6e1fa9543485c64dc817455ab871ff6

SHA512
104f5ac4665bb2cc1076f505a4da7316869e165b1618e0cd9dd6c35597e643bb26cfebc7198e2314a081fbf1a719f006ad28b22e7fce0c8b0dacddb274504e00

Download Submit
C:\Windows\System\HByomct.exe

Filesize
2.2MB

MD5
4388850b40ec91b5222c4ecebbd79498

SHA1
372aa8d22328a8697f067f5035f43eeeb11a4029

SHA256
1bc07c9516f3ebcfae17bb871feb93bb662a6e9ad0f20c8ddba155c9d8ec3126

SHA512
06d13442a3cc09423535718681c270b95693ed44cd7b4d401014ce9a194755d79be769d5a2d2c309c0f6f28198b80817df2389aa662d059d50737d57a41bd423

Download Submit
C:\Windows\System\LZRboBX.exe

Filesize
2.2MB

MD5
5c8af7f3051eaa82ab20cfccae459c8b

SHA1
a6e8b3700a31620fe81147752baf0a354f5b2fc6

SHA256
726ddda02826618e276c702e94a544e4db862728a0e9bddcc39bd52351e41bc7

SHA512
7fbbd6a259e3ff039629193960a363ab1ba7e481fe402f5d97f353955f166ad26ce07b9dc7acf378e664e248981a6ffce023e90d83a94d30c8fde813173a0e6d

Download Submit
C:\Windows\System\NxlYpim.exe

Filesize
2.2MB

MD5
a1860e5a951732d194183c78e72f62a3

SHA1
8b98e6ee7c4b9d6db587092fa139aed962622cb1

SHA256
dffdfb634043b53b6d8088d16dce94e2cf1ba31c0eb44ed80e69986df7678b5f

SHA512
fd1f526a9f48603d847303a8c0fcf3b27450f08ed33c58dfd91e9961ed8454fa39eabbfd0c30916e5413fdf92f913f67a16772169ccbafeb849bbbe71e6cc009

Download Submit
C:\Windows\System\ObVnSdQ.exe

Filesize
2.2MB

MD5
7def03b29a52c18145ac8022b6ce4d71

SHA1
590fd7786aab3a2771644395aa4aa9571e0ca97c

SHA256
6bb474cc0b5fba94af209acce9021f6f541a296f48b52afd66c98ee277f932f1

SHA512
7b3a22eea4386d666fb79ea18b93ce53c1084f3e5f22b5dc5940cde4c507a25407f08e3ecd6c026a444a443ed2424417c8769c9f066406792c9e41e077d09f94

Download Submit
C:\Windows\System\SUgzAlz.exe

Filesize
2.2MB

MD5
a2734f25d23f83b9b10922d4ca4cca50

SHA1
a16038e99fcdb949e9d12e34db6fa836d9881d6e

SHA256
a8f1fc2e3b87ec026633900a4891fb40f35fe44089d6cebbb9e5ef1e32c9f990

SHA512
9095802cf6875380601c823f7fd6ffba7fffbd326bbabb8eeaaed1c13ade9294e7849814eb4d8b799cacce2d68c9040c0919b4f8097564c5d52c9cd7b8cc025d

Download Submit
C:\Windows\System\UHEUMiZ.exe

Filesize
2.2MB

MD5
07ca8008ad88142fd15f01b33fbcce36

SHA1
98e77243b985b742ee1e9e1fc5369d383360f552

SHA256
6aed8140568fe3bb00344e97cf39d2a7b130458d32c3437f1b58cbb3c62c0111

SHA512
1afe7ba28456d5d90b99946a9e9c3227aff080e225f7d6cac4da5cb8ee0fac276045df742b7d33850ef6355abbc2ac2176a01d3dea4e3accb20169948fc9b850

Download Submit
C:\Windows\System\aXlChOA.exe

Filesize
2.2MB

MD5
b29ecfe4b48087a38746cbb463129436

SHA1
6298e688b520562c1f46886f0461d56519f9f956

SHA256
69f232353e3fc8e317d23fe16f4bdd8a818aca5ce9d759e5824481df48110584

SHA512
e51162ca3149cc52df43481de327bcd512f559b26f740c9b9a0034614143de089f6de2c35f9863ba6957e76f7e5a34b11c98bc9c509f2824a7ead3b8166f0bb0

Download Submit
C:\Windows\System\bGsMCjP.exe

Filesize
2.2MB

MD5
e3f1cd851208bffe27910b3f621bc663

SHA1
c57937cdc960d60e07a80af05c6f97b0794b7da8

SHA256
e104a5161d58fd4dd3138f19b26ae7e4882707b64a600c6e2f4e20453a702397

SHA512
1cfeafe7bd3c59df686391cf617170ae4f56dba0683a72c6d64937e643377b490be6b3540fb48c1f77f81fdc54669e61e619a442fed4e5aa7aa3e55857b7b295

Download Submit
C:\Windows\System\btedYdP.exe

Filesize
2.2MB

MD5
1021e73767caa48c7f8d6b2e733b8dd3

SHA1
58ff91201462d4155f30e916deabbee3baee1bee

SHA256
3c1acff53766fce6cbe697a00c348b5609823facfe2f437a231319f6f6b64687

SHA512
f91d9b9857a84537cd760da177c34653bc58fa3d71cc86ff4165142589eea54b8de90f7939a1c1e026c7b81e756444f5ed566b53e79b02e4cdb68df94ccc0402

Download Submit
C:\Windows\System\ctMqJkf.exe

Filesize
2.2MB

MD5
8e694b890f11ae3147a94eb533f84ce1

SHA1
7d5f356226dd8d8a0a97e9891fd7206d3d5e32af

SHA256
41de656117d41998498e27385a1495ac3d932003c778a8fff7346f9936d35d0d

SHA512
b21c6f4cfe3e76526dded26df5fdc7a82035cfa7451ff3a40c36b2eeb37ee55ff83a994b7d6b276db33181b5edf27945824fb86e21ac9be3c8b82ea9de985dc5

Download Submit
C:\Windows\System\eBkieAB.exe

Filesize
2.2MB

MD5
02de580c0675af828c84896927de4322

SHA1
48710ad9d4ef72f14620e797d5949dc7a8642a2d

SHA256
7c19e15c63f1c961ee96429510217703ecb2fdb44b1daa427c6826b395bf27ab

SHA512
d35f5a3e5f204b9bcdc383edc3b6ef592aae3d4570947603a6ebe37d3ff13c8fb49f263bf8c1d48f7043fe5858fd1d64c710bb1d2bd8b4025f12f59acf6425fb

Download Submit
C:\Windows\System\fHFDtCN.exe

Filesize
2.2MB

MD5
8af602f90eba918bae27080e2da3af53

SHA1
96f4939694f750ab14247d52a08c5ff8fdcf2b81

SHA256
c27af2ca3b36ca7187b14a7046b7e91be1e1696bc8c3dd6191f3149c4161aa2c

SHA512
edc0cb0d952efa0c6b2dc433860d2cdb0c74e3f83819be4890796b807a5aecdddfffc635c1fb7d55d17b5e46a87a06cad1e605a8c4f6cf62f6546e3308a26a77

Download Submit
C:\Windows\System\fKNCTRq.exe

Filesize
2.2MB

MD5
247677c484a43a055360340ae74c082f

SHA1
e5a3fc808101f640b4293f471e9f358561039d1f

SHA256
77aa2e7a4fef2d12793101a58b265f15ca25f5aea778058ca8413131ab9e2b93

SHA512
e7cc68be4c39667c8a0cbb5625d1c707105e2585de0c4b6cefc9b277476177d9d30e756e7021910d50efb998cef807adc90222690f01b7e188f8cabf5ae8767b

Download Submit
C:\Windows\System\hxAYVOA.exe

Filesize
2.2MB

MD5
4a575d89c1d62dbeeb3d55f21d88eab3

SHA1
d3b8e12d8e03ee6db3825a007fd5a31fc2310550

SHA256
1dce92b1154c78fd193512c5c4c80d168648140f5a4f10b5ac0fb546e26fb77e

SHA512
464a542a0d5f71d58abfe6e1b2e9740bf104a54a312e3dc6647c41cc6811c08f69629ffbc9760dbe642c2d9d6bcf1937d77bec9af3d36334c4fe4a5d59c0c075

Download Submit
C:\Windows\System\jivftRP.exe

Filesize
2.2MB

MD5
8e47fe6cb5f00f2325ea8399ad6db15b

SHA1
7143798fe8b572030ae026959478bc7f06ab1145

SHA256
07a6d6060a3ad22f6446a1a09e92a30649c652c8349314165da58ec6f209c151

SHA512
9825e247ceff1e279e1e2ca8e1ac1dba02b4a1d69188b95b87cc2acc81c838ecf47fdd54d0d34ef097662a54c3991d07967e94a297b7ec1e3f4d9e0369118445

Download Submit
C:\Windows\System\jjpwXJd.exe

Filesize
2.2MB

MD5
4ca1aaa30c0c9f8127f32489a9efbf13

SHA1
deaf06ce9a2e2963b8cba27a4a63a3e61506c71f

SHA256
f4d2eddc7c1e85e36a480417b57e9d1ac73656ac2f3d791108f3e81924b63adb

SHA512
ef335e73119cf79b241f558c1d7b4f927ce071470d4480c650cb1ab55e0cf5945978d599157d7922dec63b3c41866024931a09bed50e52705d0e8851ea3ac4bc

Download Submit
C:\Windows\System\jqJdPsh.exe

Filesize
2.2MB

MD5
0ba4e76d9734fccddd57b589707107f5

SHA1
94c4f51c6ba970bdc280c690d275414c086e4075

SHA256
dba1038c5b61f97ac32d9fa7d22cad6659ab0d75c76ee685f3c945f96f2a28ac

SHA512
576dab3c9b8aa7bf4ff515b7cee5e8e4f32b301da3509a06fa4acbb9367819dcf2054875f0cb342c90598e6ee4d671c11126accff7550558cbb48265132191e0

Download Submit
C:\Windows\System\lAQHzIr.exe

Filesize
2.2MB

MD5
7b6f300c011a30d07b6fdd34f96887f3

SHA1
2d3db1bf9295e0e3bbede4d32bcb4cdddf768566

SHA256
05079616a1b148655d3182ed6deed578bad66acd76f2982b3fbbd681be92d552

SHA512
e9bdbb29c39bf4dacc3d25354d489b8f23d6d7c65e3f1071faffa1d4b827c699065dd0dbccf11f82031aa3e27157b43e84086d7e937be195f2b4b7c75f1abe9e

Download Submit
C:\Windows\System\lIHIXAP.exe

Filesize
2.2MB

MD5
7511a988530c62f17d3e9daae24a0595

SHA1
e97a43bdfe0d4490342b7205cb2f62eb99edfb35

SHA256
438145ca130855906307fbcac2558383c89b005e7affae5c3a84e2349578771a

SHA512
2e72a4ae8670be30e3106f1d0cccbf2be578b270fbbd1894076a38103f7aaa7901d93b91d11a97d41914dcad8c9ac542f1a48236aaf35455dad108b8dcc37d3e

Download Submit
C:\Windows\System\ovLpAEX.exe

Filesize
2.2MB

MD5
5673b51f515420a8c86793615befddb0

SHA1
4c7bed55ca977adece3ee2550f9c040e9188527e

SHA256
f67f0ee5d49642b6be8714bb9c5662565bb50e6944884e99a1d914cab3799209

SHA512
1e4ff01471be93bc43bad8c23d3e3eb980a2e2d5f486c1618df214396c7cca233273159eab344f92d22d4fcd9bd36510ca049823e2a24192b1d684f46116d5c8

Download Submit
C:\Windows\System\sMgesmx.exe

Filesize
2.2MB

MD5
2f696e837f56c6b37e7193a1c9095a19

SHA1
4948783d0ff599fc052d96a56c53398bc0baba16

SHA256
7e37ce418868ac3600ba09cd9c94f56d70602c5a08f0afa814109a4c46b1f824

SHA512
4dab3aceb428a462c25d24a6ec5285317cff2e5e6beea4db842738fee81453abe8f60a10306106ccd82fe510aba117da62583974f7906b6644536d8a3a6273fd

Download Submit
C:\Windows\System\sRHaFQE.exe

Filesize
2.2MB

MD5
9c1553836bcd2251a70e8f5106a1842d

SHA1
f7371fa745422acf7f2c9a2ef8e07ff703458ed5

SHA256
d52ea0367fe446c790644930ca95b37d56d961ef5de605adca2c5b460ef7a1cb

SHA512
09f4b64becffe187ca78e34391fb0cc4371cbac5d7f329626c38784d840014a0c1e35827b11945b9cbaf6431bbe79116a4ebcb48bf4613d5534741dc706a6630

Download Submit
C:\Windows\System\uFMzvlx.exe

Filesize
2.2MB

MD5
a2a1ef98ab512643ed5a1dece34bd20b

SHA1
006c5b53c100cdebb23c4927eced76e06688889b

SHA256
7b1428c7f6d2edd908c6a040dea8f37ce813c8ff8c5756ec7a302a1e96594931

SHA512
b721eab8323d37ed4f24419981708612ac9c099aed2fb276a37e03984ef767c04b7e573d9b9cf5ffba46f69d5ca46b434466680a1e5495d0b7aea67eae13b290

Download Submit
C:\Windows\System\ulVcLmj.exe

Filesize
2.2MB

MD5
7d6af9f1d9a05d2f5d129d544165c232

SHA1
4e00db146f48ec4deff085e904ddb21660988454

SHA256
bf2a550822bf71280cd614c9faecf8cae1d079cf6429b52081aa12873ddfc68c

SHA512
d113c42e435a7f9581293e2eb3cb1a7c69bbc00e553b16f66e8f74bfb6b2ae6e703b85bfba617d8c29d739384bf51387c04fd7b59fb8c76710d0bfbba0ede439

Download Submit
C:\Windows\System\urVNzHQ.exe

Filesize
2.2MB

MD5
cc94981ffcc1a7cfc00b8253fe7d08ce

SHA1
8e999d4fd8cab2d1ca79203509c2afc6ecfd46d6

SHA256
540f1cc2c2d3dc89f8f80cb5a14fc8ffa41e51c8f9ef1a7fb29fdb7bb887b7c7

SHA512
5d5d3a26b2e2c8312020d6181572d37a1691610c2f25a323d3ad298ef2a27977e683467f5d94597e640e4f339943335d5e4966a025f9a6ba2cd68f05a1c14293

Download Submit
C:\Windows\System\vUwOSPP.exe

Filesize
2.2MB

MD5
16828a82c955554d5c20940465cb6843

SHA1
6461d84fc476234546fe8162254b38fd85ed2c30

SHA256
a8b1024b8b1bf0ce3b64ad4b250401b537bdbb20a3803b990748ff7d0e6c8ef8

SHA512
77b2e4689adeb62573b523624d2bf713ebc2d2a51c07708566aae13c59a049475905a5d68b2ac369a427487dd32b35f278c995521d881f202fea713b88548466

Download Submit
C:\Windows\System\wfHxiIZ.exe

Filesize
2.2MB

MD5
e1835f25280dc959922a319d1000bf75

SHA1
0900ad3520bb0e0c3b132de0771b8e8415f57abe

SHA256
ff3a66f980b2cb0b38a3ca70a626672ba55fef6ee9b7bf98de58b7e153d935e8

SHA512
ea97b648f6d0056b3c1a5a2d81b0d55c69b05c7093c3a5f851517b1da275927d5660ecd882151b0351d21262867f05ba3325336b5f582b79f1d4720fcabb9468

Download Submit
C:\Windows\System\zasLGwX.exe

Filesize
2.2MB

MD5
0c658263deceaa6ef7470275df634489

SHA1
803fc3a01387d25191494c667fad7c341828d50f

SHA256
83e0234dc38904e73d1ccc0375f1a71465bcdbb1ac3e18977b4342ad184daeb8

SHA512
e83640b11023e1e8148b16b68a8f28fdd37c16abf292c57a5d1f992e4d83bbbe5422e04a988fd028103a5cffc76ae7f30d6bc04195857c392e6e6c56c2799c4a

Download Submit
C:\Windows\System\zjihbxj.exe

Filesize
2.2MB

MD5
3249918696dfa3bba6cc24cafa686ece

SHA1
c72e6bae46d161f62308c12415033d51e2a05522

SHA256
a7d41d6ea7406773046793e67cf965321ef0ef0aad2a5d92e29633ee09118802

SHA512
42bf1ec0cf7e0739e9c422d775dd25263505e0b4e0c81f9823e65f759c0b671e06daa5005f8a1be7d1d6027a2e207b761d551fc8d02c5f91c9596b24ce111e59

Download Submit
C:\Windows\System\znktKSV.exe

Filesize
2.2MB

MD5
83f636870af2913dd401a3a93f031fc4

SHA1
f52c23bcd8c1bd1dcc0b9b74e54a15999b3be10d

SHA256
a31a57053bcd63ae8c5d05a9495b4440f02fc4c5d4e6e57ce8d9e2a38bf38c7e

SHA512
876c4146263dc8e66131d71a4486a198929e6e3015593bacd9ae6b2adf5c5d6a70abb3c0f63ea70e8c1161d47ec94c0c89cf902b20807666d6719a934ba0bd4f

Download Submit
C:\Windows\System\ztLgzbH.exe

Filesize
2.2MB

MD5
be572a42500afe1fbf8bd2ba98c020bb

SHA1
3d330261beb9127854607a8af495e779badfee07

SHA256
d49e74065e87ef9ea476e818941393ff710ffa0f6fa48b977d5836abb195dc12

SHA512
d615031343481c2059130a06a566e70473f611fb54ba3632438d23a026205149f46d39046b39d70275884a4c8e8a0b9a7f9589883992f5c3713acf0ded0bd240

Download Submit
memory/224-1692-0x00007FF6F4350000-0x00007FF6F4742000-memory.dmp

Filesize
3.9MB

Download
memory/224-152-0x00007FF6F4350000-0x00007FF6F4742000-memory.dmp

Filesize
3.9MB

Download
memory/336-1623-0x00007FF64C6A0000-0x00007FF64CA92000-memory.dmp

Filesize
3.9MB

Download
memory/336-153-0x00007FF64C6A0000-0x00007FF64CA92000-memory.dmp

Filesize
3.9MB

Download
memory/956-0-0x00007FF781160000-0x00007FF781552000-memory.dmp

Filesize
3.9MB

Download
memory/956-1-0x000001986CEA0000-0x000001986CEB0000-memory.dmp

Filesize
64KB

Download
memory/956-3224-0x00007FF781160000-0x00007FF781552000-memory.dmp

Filesize
3.9MB

Download
memory/1092-1594-0x00007FF779A90000-0x00007FF779E82000-memory.dmp

Filesize
3.9MB

Download
memory/1092-70-0x00007FF779A90000-0x00007FF779E82000-memory.dmp

Filesize
3.9MB

Download
memory/1112-155-0x00007FF76FD30000-0x00007FF770122000-memory.dmp

Filesize
3.9MB

Download
memory/1112-1635-0x00007FF76FD30000-0x00007FF770122000-memory.dmp

Filesize
3.9MB

Download
memory/1336-154-0x00007FF6024F0000-0x00007FF6028E2000-memory.dmp

Filesize
3.9MB

Download
memory/1336-1592-0x00007FF6024F0000-0x00007FF6028E2000-memory.dmp

Filesize
3.9MB

Download
memory/1344-158-0x00007FF79F780000-0x00007FF79FB72000-memory.dmp

Filesize
3.9MB

Download
memory/1344-1720-0x00007FF79F780000-0x00007FF79FB72000-memory.dmp

Filesize
3.9MB

Download
memory/1960-172-0x00000130FC440000-0x00000130FC462000-memory.dmp

Filesize
136KB

Download
memory/1960-319-0x00000130FF1B0000-0x00000130FF956000-memory.dmp

Filesize
7.6MB

Download
memory/2260-1552-0x00007FF7FBB80000-0x00007FF7FBF72000-memory.dmp

Filesize
3.9MB

Download
memory/2260-42-0x00007FF7FBB80000-0x00007FF7FBF72000-memory.dmp

Filesize
3.9MB

Download
memory/2268-156-0x00007FF7A2000000-0x00007FF7A23F2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-1629-0x00007FF7A2000000-0x00007FF7A23F2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-1546-0x00007FF7F1420000-0x00007FF7F1812000-memory.dmp

Filesize
3.9MB

Download
memory/2728-36-0x00007FF7F1420000-0x00007FF7F1812000-memory.dmp

Filesize
3.9MB

Download
memory/2800-133-0x00007FF7DF440000-0x00007FF7DF832000-memory.dmp

Filesize
3.9MB

Download
memory/2800-1631-0x00007FF7DF440000-0x00007FF7DF832000-memory.dmp

Filesize
3.9MB

Download
memory/3092-71-0x00007FF6A89B0000-0x00007FF6A8DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3092-1595-0x00007FF6A89B0000-0x00007FF6A8DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-150-0x00007FF746F90000-0x00007FF747382000-memory.dmp

Filesize
3.9MB

Download
memory/3192-1648-0x00007FF746F90000-0x00007FF747382000-memory.dmp

Filesize
3.9MB

Download
memory/3416-1539-0x00007FF686410000-0x00007FF686802000-memory.dmp

Filesize
3.9MB

Download
memory/3416-22-0x00007FF686410000-0x00007FF686802000-memory.dmp

Filesize
3.9MB

Download
memory/3524-1544-0x00007FF613EE0000-0x00007FF6142D2000-memory.dmp

Filesize
3.9MB

Download
memory/3524-28-0x00007FF613EE0000-0x00007FF6142D2000-memory.dmp

Filesize
3.9MB

Download
memory/3548-149-0x00007FF6A72F0000-0x00007FF6A76E2000-memory.dmp

Filesize
3.9MB

Download
memory/3548-1633-0x00007FF6A72F0000-0x00007FF6A76E2000-memory.dmp

Filesize
3.9MB

Download
memory/3552-151-0x00007FF606780000-0x00007FF606B72000-memory.dmp

Filesize
3.9MB

Download
memory/3552-1649-0x00007FF606780000-0x00007FF606B72000-memory.dmp

Filesize
3.9MB

Download
memory/3688-1529-0x00007FF7A1A40000-0x00007FF7A1E32000-memory.dmp

Filesize
3.9MB

Download
memory/3688-21-0x00007FF7A1A40000-0x00007FF7A1E32000-memory.dmp

Filesize
3.9MB

Download
memory/3744-115-0x00007FF771B90000-0x00007FF771F82000-memory.dmp

Filesize
3.9MB

Download
memory/3744-1640-0x00007FF771B90000-0x00007FF771F82000-memory.dmp

Filesize
3.9MB

Download
memory/3884-1584-0x00007FF763D20000-0x00007FF764112000-memory.dmp

Filesize
3.9MB

Download
memory/3884-83-0x00007FF763D20000-0x00007FF764112000-memory.dmp

Filesize
3.9MB

Download
memory/3908-6-0x00007FF7D8630000-0x00007FF7D8A22000-memory.dmp

Filesize
3.9MB

Download
memory/3908-1543-0x00007FF7D8630000-0x00007FF7D8A22000-memory.dmp

Filesize
3.9MB

Download
memory/4024-157-0x00007FF62C830000-0x00007FF62CC22000-memory.dmp

Filesize
3.9MB

Download
memory/4024-1642-0x00007FF62C830000-0x00007FF62CC22000-memory.dmp

Filesize
3.9MB

Download
memory/4128-1545-0x00007FF745D10000-0x00007FF746102000-memory.dmp

Filesize
3.9MB

Download
memory/4128-39-0x00007FF745D10000-0x00007FF746102000-memory.dmp

Filesize
3.9MB

Download
memory/4644-105-0x00007FF6A52E0000-0x00007FF6A56D2000-memory.dmp

Filesize
3.9MB

Download
memory/4644-1636-0x00007FF6A52E0000-0x00007FF6A56D2000-memory.dmp

Filesize
3.9MB

Download
memory/5008-66-0x00007FF782EC0000-0x00007FF7832B2000-memory.dmp

Filesize
3.9MB

Download
memory/5008-1549-0x00007FF782EC0000-0x00007FF7832B2000-memory.dmp

Filesize
3.9MB

Download