xmrig | bd90bb000e4aef1a76d41148e13625ca51962193796ae8e30fd6fc7ab9766df6

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
Size

2.2MB
MD5

05dfb24904cbb848b3ff725937100c20
SHA1

b4104e41bc5b9235b75d753fa3e648b1f15a04a2
SHA256

bd90bb000e4aef1a76d41148e13625ca51962193796ae8e30fd6fc7ab9766df6
SHA512

0283748e7af9f3e0238d761de1c2b327d8838e8be20a32aa5ab62df6b7d2732f8d74747473c5dc11d2cb4d5ff4f9b417e8b718b63434fc24c13b52bccb1cb5ff
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqA:NABh

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral2/memory/448-30-0x00007FF6359F0000-0x00007FF635DE2000-memory.dmp	xmrig
behavioral2/memory/4900-87-0x00007FF6229C0000-0x00007FF622DB2000-memory.dmp	xmrig
behavioral2/memory/1624-110-0x00007FF75BA90000-0x00007FF75BE82000-memory.dmp	xmrig
behavioral2/memory/1180-1441-0x00007FF668050000-0x00007FF668442000-memory.dmp	xmrig
behavioral2/memory/216-149-0x00007FF656120000-0x00007FF656512000-memory.dmp	xmrig
behavioral2/memory/664-145-0x00007FF73E640000-0x00007FF73EA32000-memory.dmp	xmrig
behavioral2/memory/4516-144-0x00007FF701970000-0x00007FF701D62000-memory.dmp	xmrig
behavioral2/memory/364-140-0x00007FF692E70000-0x00007FF693262000-memory.dmp	xmrig
behavioral2/memory/1928-92-0x00007FF608DB0000-0x00007FF6091A2000-memory.dmp	xmrig
behavioral2/memory/1688-98-0x00007FF617FB0000-0x00007FF6183A2000-memory.dmp	xmrig
behavioral2/memory/3752-86-0x00007FF7993F0000-0x00007FF7997E2000-memory.dmp	xmrig
behavioral2/memory/4188-83-0x00007FF61F130000-0x00007FF61F522000-memory.dmp	xmrig
behavioral2/memory/4364-71-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp	xmrig
behavioral2/memory/724-48-0x00007FF609530000-0x00007FF609922000-memory.dmp	xmrig
behavioral2/memory/752-10-0x00007FF635A10000-0x00007FF635E02000-memory.dmp	xmrig
behavioral2/memory/3100-1969-0x00007FF749210000-0x00007FF749602000-memory.dmp	xmrig
behavioral2/memory/4832-1974-0x00007FF6AE430000-0x00007FF6AE822000-memory.dmp	xmrig
behavioral2/memory/4364-1977-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp	xmrig
behavioral2/memory/5084-2270-0x00007FF7CEB90000-0x00007FF7CEF82000-memory.dmp	xmrig
behavioral2/memory/3156-2553-0x00007FF6D0D20000-0x00007FF6D1112000-memory.dmp	xmrig
behavioral2/memory/664-5249-0x00007FF73E640000-0x00007FF73EA32000-memory.dmp	xmrig
behavioral2/memory/448-7000-0x00007FF6359F0000-0x00007FF635DE2000-memory.dmp	xmrig
behavioral2/memory/1688-7147-0x00007FF617FB0000-0x00007FF6183A2000-memory.dmp	xmrig
behavioral2/memory/5084-7158-0x00007FF7CEB90000-0x00007FF7CEF82000-memory.dmp	xmrig
behavioral2/memory/4336-7199-0x00007FF6D5930000-0x00007FF6D5D22000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1244	powershell.exe
5	1244	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
752	mtOwTQL.exe
724	cJsBOgZ.exe
448	nQOGdgp.exe
3100	DtzZJMZ.exe
4832	jslVZhX.exe
3752	zCioVib.exe
4900	zogBkWF.exe
4364	OqWkAQT.exe
1928	eddLhqP.exe
1824	rNvjGmV.exe
4188	bGUPhZl.exe
1688	QJXwrlN.exe
5084	CKjzywl.exe
3156	ynjXFrJ.exe
1624	qPKYUCI.exe
1460	GVPVwie.exe
4336	QFZvtdl.exe
364	yPDZBxh.exe
4516	ISOdHuH.exe
664	QxuzOwC.exe
216	DHMxBlq.exe
3024	miOPifF.exe
1792	eQbBhhQ.exe
5080	vkekPbP.exe
5036	lYsmCHy.exe
924	jRkfxBr.exe
2992	inqTeEj.exe
4880	tyCrCqo.exe
2328	oQwOxYk.exe
2428	hGlinuk.exe
2552	dLwiZCe.exe
4372	QSSFFIn.exe
4296	aJtEXsP.exe
2952	kTsxCUE.exe
4456	cyRUlIU.exe
1920	mBdWGNQ.exe
636	kZkyUHE.exe
1684	JqSsCtH.exe
4404	jtmAKyg.exe
4804	oxXvREZ.exe
1296	SpduXGA.exe
4432	OzIVcgw.exe
4192	oFqUEQk.exe
2268	xAJQUzP.exe
4360	kxbPfZE.exe
4008	tZAIcxp.exe
776	SJlBvGo.exe
4568	UtBfZwa.exe
2976	ilaPDrE.exe
4976	vdyIBLb.exe
4168	rckcNJH.exe
3924	ymnwGpp.exe
2004	AQevwZu.exe
2560	mqojISo.exe
2132	KnZnlBc.exe
2404	lYUekGH.exe
3256	YNvDVLU.exe
3944	gWGEszs.exe
3988	nEYobVE.exe
2316	vyMefkL.exe
2460	QqvSqGI.exe
8	rUIVcFf.exe
3420	MBZXuFU.exe
4680	DCvsipP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1180-0-0x00007FF668050000-0x00007FF668442000-memory.dmp	upx
behavioral2/files/0x0009000000023297-5.dat	upx
behavioral2/files/0x000800000002341f-14.dat	upx
behavioral2/files/0x0007000000023421-23.dat	upx
behavioral2/memory/448-30-0x00007FF6359F0000-0x00007FF635DE2000-memory.dmp	upx
behavioral2/files/0x0007000000023423-44.dat	upx
behavioral2/files/0x0008000000023426-59.dat	upx
behavioral2/files/0x0007000000023424-57.dat	upx
behavioral2/files/0x0007000000023429-72.dat	upx
behavioral2/memory/1824-78-0x00007FF6B92E0000-0x00007FF6B96D2000-memory.dmp	upx
behavioral2/memory/4900-87-0x00007FF6229C0000-0x00007FF622DB2000-memory.dmp	upx
behavioral2/files/0x000700000002342a-96.dat	upx
behavioral2/files/0x000700000002342c-99.dat	upx
behavioral2/files/0x000700000002342b-105.dat	upx
behavioral2/memory/1624-110-0x00007FF75BA90000-0x00007FF75BE82000-memory.dmp	upx
behavioral2/files/0x000700000002342d-113.dat	upx
behavioral2/files/0x000700000002342f-123.dat	upx
behavioral2/files/0x0007000000023431-133.dat	upx
behavioral2/files/0x0007000000023434-150.dat	upx
behavioral2/files/0x0007000000023435-170.dat	upx
behavioral2/files/0x000700000002343a-182.dat	upx
behavioral2/files/0x000700000002343b-192.dat	upx
behavioral2/memory/1180-1441-0x00007FF668050000-0x00007FF668442000-memory.dmp	upx
behavioral2/files/0x000700000002343d-197.dat	upx
behavioral2/files/0x000700000002343c-194.dat	upx
behavioral2/files/0x0007000000023439-183.dat	upx
behavioral2/files/0x0007000000023438-175.dat	upx
behavioral2/files/0x0007000000023437-168.dat	upx
behavioral2/files/0x0007000000023436-166.dat	upx
behavioral2/files/0x0007000000023432-157.dat	upx
behavioral2/files/0x0007000000023433-155.dat	upx
behavioral2/memory/216-149-0x00007FF656120000-0x00007FF656512000-memory.dmp	upx
behavioral2/memory/664-145-0x00007FF73E640000-0x00007FF73EA32000-memory.dmp	upx
behavioral2/memory/4516-144-0x00007FF701970000-0x00007FF701D62000-memory.dmp	upx
behavioral2/memory/364-140-0x00007FF692E70000-0x00007FF693262000-memory.dmp	upx
behavioral2/files/0x0007000000023430-136.dat	upx
behavioral2/files/0x000700000002342e-124.dat	upx
behavioral2/files/0x000800000002341d-116.dat	upx
behavioral2/memory/4336-115-0x00007FF6D5930000-0x00007FF6D5D22000-memory.dmp	upx
behavioral2/memory/1460-112-0x00007FF6C3440000-0x00007FF6C3832000-memory.dmp	upx
behavioral2/memory/3156-104-0x00007FF6D0D20000-0x00007FF6D1112000-memory.dmp	upx
behavioral2/memory/1928-92-0x00007FF608DB0000-0x00007FF6091A2000-memory.dmp	upx
behavioral2/memory/1688-98-0x00007FF617FB0000-0x00007FF6183A2000-memory.dmp	upx
behavioral2/memory/3752-86-0x00007FF7993F0000-0x00007FF7997E2000-memory.dmp	upx
behavioral2/memory/5084-85-0x00007FF7CEB90000-0x00007FF7CEF82000-memory.dmp	upx
behavioral2/files/0x0008000000023425-88.dat	upx
behavioral2/memory/4188-83-0x00007FF61F130000-0x00007FF61F522000-memory.dmp	upx
behavioral2/files/0x0007000000023428-77.dat	upx
behavioral2/memory/4364-71-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp	upx
behavioral2/files/0x0007000000023427-62.dat	upx
behavioral2/memory/4832-55-0x00007FF6AE430000-0x00007FF6AE822000-memory.dmp	upx
behavioral2/memory/724-48-0x00007FF609530000-0x00007FF609922000-memory.dmp	upx
behavioral2/files/0x0007000000023422-47.dat	upx
behavioral2/memory/3100-32-0x00007FF749210000-0x00007FF749602000-memory.dmp	upx
behavioral2/files/0x0007000000023420-17.dat	upx
behavioral2/memory/752-10-0x00007FF635A10000-0x00007FF635E02000-memory.dmp	upx
behavioral2/memory/3100-1969-0x00007FF749210000-0x00007FF749602000-memory.dmp	upx
behavioral2/memory/4832-1974-0x00007FF6AE430000-0x00007FF6AE822000-memory.dmp	upx
behavioral2/memory/4364-1977-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp	upx
behavioral2/memory/5084-2270-0x00007FF7CEB90000-0x00007FF7CEF82000-memory.dmp	upx
behavioral2/memory/3156-2553-0x00007FF6D0D20000-0x00007FF6D1112000-memory.dmp	upx
behavioral2/memory/664-5249-0x00007FF73E640000-0x00007FF73EA32000-memory.dmp	upx
behavioral2/memory/448-7000-0x00007FF6359F0000-0x00007FF635DE2000-memory.dmp	upx
behavioral2/memory/1688-7147-0x00007FF617FB0000-0x00007FF6183A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DLPgvfD.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\DTlHQgE.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\WfulnDz.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\CngdBui.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\TrxpGyi.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\sRemgJe.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\vllklED.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\fYNeRSb.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\EUBvpKd.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\CbSypck.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\KgtoNXX.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\BIrljPv.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\HNhyDcG.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\pYeorCT.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\eeOImPa.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\vfePtSX.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\nCfYFOX.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\NraAKqC.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\kvBRnRO.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\dVRRqfy.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\aebtjDX.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\NGVzlym.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\APnoauq.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\CfoUwnS.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\tPZtxdV.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\HGdrkuu.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\JTazxyW.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\TQzolrp.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\iwxNAzK.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\tbCkdED.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\TuewPmb.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\voztRrc.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\ZBCTACM.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\jRRjDcF.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\ajzHRaG.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\kkRTqjV.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\ixMqxsf.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\oAzWUWd.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\zaBVeFI.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\uxNHFml.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\bJOJJXH.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\CruiFot.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\unTUBlW.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\IEGPUiE.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\QuwopHQ.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\gMTtpyg.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\hLdxalA.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\SkAuaVi.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\ntOwger.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\hEoJDyv.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\aydYjUO.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\iQorFBN.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\ZAssYKk.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\uBwPSPg.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\JGBceym.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\wjktmSs.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\IoGsgja.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\ONRUwGf.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\uMurVzE.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\ffTtGtw.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\LGezybC.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\fMgjHQj.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\nAgdfXf.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
File created	C:\Windows\System\dDqamKf.exe	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1244	powershell.exe
1244	powershell.exe
1244	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeLockMemoryPrivilege	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1244	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	84
PID 1180 wrote to memory of 1244	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	84
PID 1180 wrote to memory of 752	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	85
PID 1180 wrote to memory of 752	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	85
PID 1180 wrote to memory of 724	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	86
PID 1180 wrote to memory of 724	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	86
PID 1180 wrote to memory of 448	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	87
PID 1180 wrote to memory of 448	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	87
PID 1180 wrote to memory of 3100	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	88
PID 1180 wrote to memory of 3100	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	88
PID 1180 wrote to memory of 4832	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	89
PID 1180 wrote to memory of 4832	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	89
PID 1180 wrote to memory of 3752	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	90
PID 1180 wrote to memory of 3752	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	90
PID 1180 wrote to memory of 4364	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	91
PID 1180 wrote to memory of 4364	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	91
PID 1180 wrote to memory of 4900	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	92
PID 1180 wrote to memory of 4900	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	92
PID 1180 wrote to memory of 1928	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	93
PID 1180 wrote to memory of 1928	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	93
PID 1180 wrote to memory of 1824	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	94
PID 1180 wrote to memory of 1824	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	94
PID 1180 wrote to memory of 4188	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	95
PID 1180 wrote to memory of 4188	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	95
PID 1180 wrote to memory of 1688	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	96
PID 1180 wrote to memory of 1688	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	96
PID 1180 wrote to memory of 5084	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	97
PID 1180 wrote to memory of 5084	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	97
PID 1180 wrote to memory of 3156	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	98
PID 1180 wrote to memory of 3156	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	98
PID 1180 wrote to memory of 1624	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	99
PID 1180 wrote to memory of 1624	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	99
PID 1180 wrote to memory of 1460	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	100
PID 1180 wrote to memory of 1460	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	100
PID 1180 wrote to memory of 4336	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	101
PID 1180 wrote to memory of 4336	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	101
PID 1180 wrote to memory of 364	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	102
PID 1180 wrote to memory of 364	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	102
PID 1180 wrote to memory of 4516	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	103
PID 1180 wrote to memory of 4516	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	103
PID 1180 wrote to memory of 664	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	104
PID 1180 wrote to memory of 664	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	104
PID 1180 wrote to memory of 216	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	105
PID 1180 wrote to memory of 216	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	105
PID 1180 wrote to memory of 3024	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	106
PID 1180 wrote to memory of 3024	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	106
PID 1180 wrote to memory of 1792	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	107
PID 1180 wrote to memory of 1792	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	107
PID 1180 wrote to memory of 5080	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	108
PID 1180 wrote to memory of 5080	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	108
PID 1180 wrote to memory of 2992	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	109
PID 1180 wrote to memory of 2992	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	109
PID 1180 wrote to memory of 5036	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	110
PID 1180 wrote to memory of 5036	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	110
PID 1180 wrote to memory of 924	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	111
PID 1180 wrote to memory of 924	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	111
PID 1180 wrote to memory of 4880	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	112
PID 1180 wrote to memory of 4880	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	112
PID 1180 wrote to memory of 2328	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	113
PID 1180 wrote to memory of 2328	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	113
PID 1180 wrote to memory of 2428	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	114
PID 1180 wrote to memory of 2428	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	114
PID 1180 wrote to memory of 2552	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	115
PID 1180 wrote to memory of 2552	1180	05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05dfb24904cbb848b3ff725937100c20_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\System\mtOwTQL.exe
  C:\Windows\System\mtOwTQL.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\cJsBOgZ.exe
  C:\Windows\System\cJsBOgZ.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\nQOGdgp.exe
  C:\Windows\System\nQOGdgp.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\DtzZJMZ.exe
  C:\Windows\System\DtzZJMZ.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\jslVZhX.exe
  C:\Windows\System\jslVZhX.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\zCioVib.exe
  C:\Windows\System\zCioVib.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\OqWkAQT.exe
  C:\Windows\System\OqWkAQT.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\zogBkWF.exe
  C:\Windows\System\zogBkWF.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\eddLhqP.exe
  C:\Windows\System\eddLhqP.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\rNvjGmV.exe
  C:\Windows\System\rNvjGmV.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\bGUPhZl.exe
  C:\Windows\System\bGUPhZl.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\QJXwrlN.exe
  C:\Windows\System\QJXwrlN.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\CKjzywl.exe
  C:\Windows\System\CKjzywl.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\ynjXFrJ.exe
  C:\Windows\System\ynjXFrJ.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\qPKYUCI.exe
  C:\Windows\System\qPKYUCI.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\GVPVwie.exe
  C:\Windows\System\GVPVwie.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\QFZvtdl.exe
  C:\Windows\System\QFZvtdl.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\yPDZBxh.exe
  C:\Windows\System\yPDZBxh.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\ISOdHuH.exe
  C:\Windows\System\ISOdHuH.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\QxuzOwC.exe
  C:\Windows\System\QxuzOwC.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\DHMxBlq.exe
  C:\Windows\System\DHMxBlq.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\miOPifF.exe
  C:\Windows\System\miOPifF.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\eQbBhhQ.exe
  C:\Windows\System\eQbBhhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\vkekPbP.exe
  C:\Windows\System\vkekPbP.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\inqTeEj.exe
  C:\Windows\System\inqTeEj.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\lYsmCHy.exe
  C:\Windows\System\lYsmCHy.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\jRkfxBr.exe
  C:\Windows\System\jRkfxBr.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\tyCrCqo.exe
  C:\Windows\System\tyCrCqo.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\oQwOxYk.exe
  C:\Windows\System\oQwOxYk.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\hGlinuk.exe
  C:\Windows\System\hGlinuk.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\dLwiZCe.exe
  C:\Windows\System\dLwiZCe.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\QSSFFIn.exe
  C:\Windows\System\QSSFFIn.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\aJtEXsP.exe
  C:\Windows\System\aJtEXsP.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\kTsxCUE.exe
  C:\Windows\System\kTsxCUE.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\cyRUlIU.exe
  C:\Windows\System\cyRUlIU.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\mBdWGNQ.exe
  C:\Windows\System\mBdWGNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\kZkyUHE.exe
  C:\Windows\System\kZkyUHE.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\JqSsCtH.exe
  C:\Windows\System\JqSsCtH.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\jtmAKyg.exe
  C:\Windows\System\jtmAKyg.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\oxXvREZ.exe
  C:\Windows\System\oxXvREZ.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\SpduXGA.exe
  C:\Windows\System\SpduXGA.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\OzIVcgw.exe
  C:\Windows\System\OzIVcgw.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\oFqUEQk.exe
  C:\Windows\System\oFqUEQk.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\xAJQUzP.exe
  C:\Windows\System\xAJQUzP.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\kxbPfZE.exe
  C:\Windows\System\kxbPfZE.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\tZAIcxp.exe
  C:\Windows\System\tZAIcxp.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\SJlBvGo.exe
  C:\Windows\System\SJlBvGo.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\UtBfZwa.exe
  C:\Windows\System\UtBfZwa.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\ilaPDrE.exe
  C:\Windows\System\ilaPDrE.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\vdyIBLb.exe
  C:\Windows\System\vdyIBLb.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\rckcNJH.exe
  C:\Windows\System\rckcNJH.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\ymnwGpp.exe
  C:\Windows\System\ymnwGpp.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\AQevwZu.exe
  C:\Windows\System\AQevwZu.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\mqojISo.exe
  C:\Windows\System\mqojISo.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\KnZnlBc.exe
  C:\Windows\System\KnZnlBc.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\lYUekGH.exe
  C:\Windows\System\lYUekGH.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\YNvDVLU.exe
  C:\Windows\System\YNvDVLU.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\gWGEszs.exe
  C:\Windows\System\gWGEszs.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\nEYobVE.exe
  C:\Windows\System\nEYobVE.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\vyMefkL.exe
  C:\Windows\System\vyMefkL.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\QqvSqGI.exe
  C:\Windows\System\QqvSqGI.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\rUIVcFf.exe
  C:\Windows\System\rUIVcFf.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\MBZXuFU.exe
  C:\Windows\System\MBZXuFU.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\DCvsipP.exe
  C:\Windows\System\DCvsipP.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\IzUosiu.exe
  C:\Windows\System\IzUosiu.exe
  2⤵
  PID:2296
- C:\Windows\System\wpzNUYz.exe
  C:\Windows\System\wpzNUYz.exe
  2⤵
  PID:1564
- C:\Windows\System\BvXqlwJ.exe
  C:\Windows\System\BvXqlwJ.exe
  2⤵
  PID:4896
- C:\Windows\System\mbfHkty.exe
  C:\Windows\System\mbfHkty.exe
  2⤵
  PID:968
- C:\Windows\System\YQgdlPV.exe
  C:\Windows\System\YQgdlPV.exe
  2⤵
  PID:3732
- C:\Windows\System\dMeRbAl.exe
  C:\Windows\System\dMeRbAl.exe
  2⤵
  PID:2556
- C:\Windows\System\YBdSQDe.exe
  C:\Windows\System\YBdSQDe.exe
  2⤵
  PID:5152
- C:\Windows\System\MjOMzkY.exe
  C:\Windows\System\MjOMzkY.exe
  2⤵
  PID:5180
- C:\Windows\System\KCjXXJY.exe
  C:\Windows\System\KCjXXJY.exe
  2⤵
  PID:5212
- C:\Windows\System\SqIlyKC.exe
  C:\Windows\System\SqIlyKC.exe
  2⤵
  PID:5240
- C:\Windows\System\cGdAleb.exe
  C:\Windows\System\cGdAleb.exe
  2⤵
  PID:5272
- C:\Windows\System\DcXLEQb.exe
  C:\Windows\System\DcXLEQb.exe
  2⤵
  PID:5304
- C:\Windows\System\LLiTuOo.exe
  C:\Windows\System\LLiTuOo.exe
  2⤵
  PID:5332
- C:\Windows\System\zrmlFug.exe
  C:\Windows\System\zrmlFug.exe
  2⤵
  PID:5356
- C:\Windows\System\RnDoEDc.exe
  C:\Windows\System\RnDoEDc.exe
  2⤵
  PID:5388
- C:\Windows\System\PVoDerZ.exe
  C:\Windows\System\PVoDerZ.exe
  2⤵
  PID:5416
- C:\Windows\System\MiIQvDH.exe
  C:\Windows\System\MiIQvDH.exe
  2⤵
  PID:5444
- C:\Windows\System\fXeRffh.exe
  C:\Windows\System\fXeRffh.exe
  2⤵
  PID:5468
- C:\Windows\System\VDMNshH.exe
  C:\Windows\System\VDMNshH.exe
  2⤵
  PID:5500
- C:\Windows\System\hNlXAft.exe
  C:\Windows\System\hNlXAft.exe
  2⤵
  PID:5524
- C:\Windows\System\EOyigGZ.exe
  C:\Windows\System\EOyigGZ.exe
  2⤵
  PID:5552
- C:\Windows\System\XschZCb.exe
  C:\Windows\System\XschZCb.exe
  2⤵
  PID:5580
- C:\Windows\System\UgIirlM.exe
  C:\Windows\System\UgIirlM.exe
  2⤵
  PID:5612
- C:\Windows\System\lPsUNts.exe
  C:\Windows\System\lPsUNts.exe
  2⤵
  PID:5644
- C:\Windows\System\elrVvEY.exe
  C:\Windows\System\elrVvEY.exe
  2⤵
  PID:5668
- C:\Windows\System\CWObyEm.exe
  C:\Windows\System\CWObyEm.exe
  2⤵
  PID:5692
- C:\Windows\System\hXvKmPs.exe
  C:\Windows\System\hXvKmPs.exe
  2⤵
  PID:5720
- C:\Windows\System\DmULmSu.exe
  C:\Windows\System\DmULmSu.exe
  2⤵
  PID:5752
- C:\Windows\System\nVnkVuW.exe
  C:\Windows\System\nVnkVuW.exe
  2⤵
  PID:5776
- C:\Windows\System\ijmmFqD.exe
  C:\Windows\System\ijmmFqD.exe
  2⤵
  PID:5808
- C:\Windows\System\EeCDrQc.exe
  C:\Windows\System\EeCDrQc.exe
  2⤵
  PID:5836
- C:\Windows\System\JAiDCkb.exe
  C:\Windows\System\JAiDCkb.exe
  2⤵
  PID:5864
- C:\Windows\System\jkDcsEL.exe
  C:\Windows\System\jkDcsEL.exe
  2⤵
  PID:5888
- C:\Windows\System\pGlRNAg.exe
  C:\Windows\System\pGlRNAg.exe
  2⤵
  PID:5920
- C:\Windows\System\rvDRacW.exe
  C:\Windows\System\rvDRacW.exe
  2⤵
  PID:5944
- C:\Windows\System\ZdlXyIW.exe
  C:\Windows\System\ZdlXyIW.exe
  2⤵
  PID:5972
- C:\Windows\System\bSeMPCS.exe
  C:\Windows\System\bSeMPCS.exe
  2⤵
  PID:6004
- C:\Windows\System\DdTxxDy.exe
  C:\Windows\System\DdTxxDy.exe
  2⤵
  PID:6032
- C:\Windows\System\LvjYJde.exe
  C:\Windows\System\LvjYJde.exe
  2⤵
  PID:6060
- C:\Windows\System\SXWLZdC.exe
  C:\Windows\System\SXWLZdC.exe
  2⤵
  PID:6088
- C:\Windows\System\ZhyUQtL.exe
  C:\Windows\System\ZhyUQtL.exe
  2⤵
  PID:6116
- C:\Windows\System\ctUPrBt.exe
  C:\Windows\System\ctUPrBt.exe
  2⤵
  PID:5012
- C:\Windows\System\jWrIUyy.exe
  C:\Windows\System\jWrIUyy.exe
  2⤵
  PID:3388
- C:\Windows\System\dJXErrZ.exe
  C:\Windows\System\dJXErrZ.exe
  2⤵
  PID:3628
- C:\Windows\System\qBksQWe.exe
  C:\Windows\System\qBksQWe.exe
  2⤵
  PID:5176
- C:\Windows\System\zEesOAH.exe
  C:\Windows\System\zEesOAH.exe
  2⤵
  PID:5236
- C:\Windows\System\BuuJnSk.exe
  C:\Windows\System\BuuJnSk.exe
  2⤵
  PID:64
- C:\Windows\System\bRSczKG.exe
  C:\Windows\System\bRSczKG.exe
  2⤵
  PID:5380
- C:\Windows\System\aspDBAz.exe
  C:\Windows\System\aspDBAz.exe
  2⤵
  PID:5436
- C:\Windows\System\mjKJwcR.exe
  C:\Windows\System\mjKJwcR.exe
  2⤵
  PID:5492
- C:\Windows\System\CfoUwnS.exe
  C:\Windows\System\CfoUwnS.exe
  2⤵
  PID:5572
- C:\Windows\System\yYqwsKB.exe
  C:\Windows\System\yYqwsKB.exe
  2⤵
  PID:5624
- C:\Windows\System\QYjODwF.exe
  C:\Windows\System\QYjODwF.exe
  2⤵
  PID:5684
- C:\Windows\System\TmlccPb.exe
  C:\Windows\System\TmlccPb.exe
  2⤵
  PID:4952
- C:\Windows\System\dKoySSr.exe
  C:\Windows\System\dKoySSr.exe
  2⤵
  PID:5792
- C:\Windows\System\INLrcsy.exe
  C:\Windows\System\INLrcsy.exe
  2⤵
  PID:5848
- C:\Windows\System\yqtKMrM.exe
  C:\Windows\System\yqtKMrM.exe
  2⤵
  PID:5880
- C:\Windows\System\nUDsnBY.exe
  C:\Windows\System\nUDsnBY.exe
  2⤵
  PID:4120
- C:\Windows\System\dytqkRa.exe
  C:\Windows\System\dytqkRa.exe
  2⤵
  PID:5964
- C:\Windows\System\DVAwtIp.exe
  C:\Windows\System\DVAwtIp.exe
  2⤵
  PID:6072
- C:\Windows\System\UePQcgT.exe
  C:\Windows\System\UePQcgT.exe
  2⤵
  PID:6104
- C:\Windows\System\xkAroBp.exe
  C:\Windows\System\xkAroBp.exe
  2⤵
  PID:3984
- C:\Windows\System\KKjvEqP.exe
  C:\Windows\System\KKjvEqP.exe
  2⤵
  PID:6108
- C:\Windows\System\SNutbKX.exe
  C:\Windows\System\SNutbKX.exe
  2⤵
  PID:2912
- C:\Windows\System\gQCstdH.exe
  C:\Windows\System\gQCstdH.exe
  2⤵
  PID:2712
- C:\Windows\System\uSVCpce.exe
  C:\Windows\System\uSVCpce.exe
  2⤵
  PID:1348
- C:\Windows\System\heekHrR.exe
  C:\Windows\System\heekHrR.exe
  2⤵
  PID:1060
- C:\Windows\System\hAvckqF.exe
  C:\Windows\System\hAvckqF.exe
  2⤵
  PID:5352
- C:\Windows\System\plejYQX.exe
  C:\Windows\System\plejYQX.exe
  2⤵
  PID:2420
- C:\Windows\System\uRjZqsC.exe
  C:\Windows\System\uRjZqsC.exe
  2⤵
  PID:5544
- C:\Windows\System\evsJRuA.exe
  C:\Windows\System\evsJRuA.exe
  2⤵
  PID:5652
- C:\Windows\System\yvvJYos.exe
  C:\Windows\System\yvvJYos.exe
  2⤵
  PID:5744
- C:\Windows\System\ONqhPUv.exe
  C:\Windows\System\ONqhPUv.exe
  2⤵
  PID:2080
- C:\Windows\System\KHvawsb.exe
  C:\Windows\System\KHvawsb.exe
  2⤵
  PID:5904
- C:\Windows\System\SclLtli.exe
  C:\Windows\System\SclLtli.exe
  2⤵
  PID:3716
- C:\Windows\System\YVLwqMc.exe
  C:\Windows\System\YVLwqMc.exe
  2⤵
  PID:6100
- C:\Windows\System\SuwNtyE.exe
  C:\Windows\System\SuwNtyE.exe
  2⤵
  PID:6132
- C:\Windows\System\qSCsFax.exe
  C:\Windows\System\qSCsFax.exe
  2⤵
  PID:2020
- C:\Windows\System\QJcnBaR.exe
  C:\Windows\System\QJcnBaR.exe
  2⤵
  PID:5148
- C:\Windows\System\MlnLXBs.exe
  C:\Windows\System\MlnLXBs.exe
  2⤵
  PID:5296
- C:\Windows\System\jzYlBmU.exe
  C:\Windows\System\jzYlBmU.exe
  2⤵
  PID:5540
- C:\Windows\System\qcXYDqJ.exe
  C:\Windows\System\qcXYDqJ.exe
  2⤵
  PID:2348
- C:\Windows\System\tQouwSb.exe
  C:\Windows\System\tQouwSb.exe
  2⤵
  PID:3568
- C:\Windows\System\wIIzTuK.exe
  C:\Windows\System\wIIzTuK.exe
  2⤵
  PID:4464
- C:\Windows\System\CayYiPM.exe
  C:\Windows\System\CayYiPM.exe
  2⤵
  PID:4992
- C:\Windows\System\DsVuien.exe
  C:\Windows\System\DsVuien.exe
  2⤵
  PID:1672
- C:\Windows\System\xzwuiui.exe
  C:\Windows\System\xzwuiui.exe
  2⤵
  PID:1980
- C:\Windows\System\ovAynmp.exe
  C:\Windows\System\ovAynmp.exe
  2⤵
  PID:2516
- C:\Windows\System\eZnCJcb.exe
  C:\Windows\System\eZnCJcb.exe
  2⤵
  PID:2480
- C:\Windows\System\sdlpmwm.exe
  C:\Windows\System\sdlpmwm.exe
  2⤵
  PID:3584
- C:\Windows\System\hmjwuQC.exe
  C:\Windows\System\hmjwuQC.exe
  2⤵
  PID:1648
- C:\Windows\System\RPGqyLH.exe
  C:\Windows\System\RPGqyLH.exe
  2⤵
  PID:3736
- C:\Windows\System\jMgPcjn.exe
  C:\Windows\System\jMgPcjn.exe
  2⤵
  PID:6184
- C:\Windows\System\RaUDAit.exe
  C:\Windows\System\RaUDAit.exe
  2⤵
  PID:6208
- C:\Windows\System\FIcYFTN.exe
  C:\Windows\System\FIcYFTN.exe
  2⤵
  PID:6240
- C:\Windows\System\zzvPRHH.exe
  C:\Windows\System\zzvPRHH.exe
  2⤵
  PID:6264
- C:\Windows\System\viikuVC.exe
  C:\Windows\System\viikuVC.exe
  2⤵
  PID:6296
- C:\Windows\System\HNnzYng.exe
  C:\Windows\System\HNnzYng.exe
  2⤵
  PID:6332
- C:\Windows\System\rAPcLSA.exe
  C:\Windows\System\rAPcLSA.exe
  2⤵
  PID:6352
- C:\Windows\System\DnNMCPK.exe
  C:\Windows\System\DnNMCPK.exe
  2⤵
  PID:6372
- C:\Windows\System\ffTtGtw.exe
  C:\Windows\System\ffTtGtw.exe
  2⤵
  PID:6392
- C:\Windows\System\kQLwIZA.exe
  C:\Windows\System\kQLwIZA.exe
  2⤵
  PID:6420
- C:\Windows\System\StUJstD.exe
  C:\Windows\System\StUJstD.exe
  2⤵
  PID:6444
- C:\Windows\System\QpswItA.exe
  C:\Windows\System\QpswItA.exe
  2⤵
  PID:6504
- C:\Windows\System\isHwjYp.exe
  C:\Windows\System\isHwjYp.exe
  2⤵
  PID:6532
- C:\Windows\System\muSyRoO.exe
  C:\Windows\System\muSyRoO.exe
  2⤵
  PID:6560
- C:\Windows\System\vUSmEHx.exe
  C:\Windows\System\vUSmEHx.exe
  2⤵
  PID:6588
- C:\Windows\System\MqJMwLE.exe
  C:\Windows\System\MqJMwLE.exe
  2⤵
  PID:6616
- C:\Windows\System\ehPeRer.exe
  C:\Windows\System\ehPeRer.exe
  2⤵
  PID:6636
- C:\Windows\System\oSwoGoz.exe
  C:\Windows\System\oSwoGoz.exe
  2⤵
  PID:6688
- C:\Windows\System\PqHUNTa.exe
  C:\Windows\System\PqHUNTa.exe
  2⤵
  PID:6712
- C:\Windows\System\ztwDbmB.exe
  C:\Windows\System\ztwDbmB.exe
  2⤵
  PID:6740
- C:\Windows\System\ByEYwlp.exe
  C:\Windows\System\ByEYwlp.exe
  2⤵
  PID:6768
- C:\Windows\System\deRdLbM.exe
  C:\Windows\System\deRdLbM.exe
  2⤵
  PID:6796
- C:\Windows\System\RPdaSwA.exe
  C:\Windows\System\RPdaSwA.exe
  2⤵
  PID:6824
- C:\Windows\System\yAVAAUD.exe
  C:\Windows\System\yAVAAUD.exe
  2⤵
  PID:6844
- C:\Windows\System\ZBCTACM.exe
  C:\Windows\System\ZBCTACM.exe
  2⤵
  PID:6864
- C:\Windows\System\LAvtlJE.exe
  C:\Windows\System\LAvtlJE.exe
  2⤵
  PID:6908
- C:\Windows\System\MkyMQvF.exe
  C:\Windows\System\MkyMQvF.exe
  2⤵
  PID:6936
- C:\Windows\System\MQQmQYN.exe
  C:\Windows\System\MQQmQYN.exe
  2⤵
  PID:6964
- C:\Windows\System\LhIABYr.exe
  C:\Windows\System\LhIABYr.exe
  2⤵
  PID:6992
- C:\Windows\System\QzyWeWI.exe
  C:\Windows\System\QzyWeWI.exe
  2⤵
  PID:7020
- C:\Windows\System\DRpiMnr.exe
  C:\Windows\System\DRpiMnr.exe
  2⤵
  PID:7040
- C:\Windows\System\VmoWMdd.exe
  C:\Windows\System\VmoWMdd.exe
  2⤵
  PID:7060
- C:\Windows\System\lLyUpsu.exe
  C:\Windows\System\lLyUpsu.exe
  2⤵
  PID:7088
- C:\Windows\System\eOzVCWC.exe
  C:\Windows\System\eOzVCWC.exe
  2⤵
  PID:7116
- C:\Windows\System\PxxAnvt.exe
  C:\Windows\System\PxxAnvt.exe
  2⤵
  PID:7156
- C:\Windows\System\TcvYCyL.exe
  C:\Windows\System\TcvYCyL.exe
  2⤵
  PID:1708
- C:\Windows\System\UzlbjAi.exe
  C:\Windows\System\UzlbjAi.exe
  2⤵
  PID:4876
- C:\Windows\System\pzQsJVw.exe
  C:\Windows\System\pzQsJVw.exe
  2⤵
  PID:6200
- C:\Windows\System\ambchwF.exe
  C:\Windows\System\ambchwF.exe
  2⤵
  PID:6316
- C:\Windows\System\TkjRZQi.exe
  C:\Windows\System\TkjRZQi.exe
  2⤵
  PID:6344
- C:\Windows\System\MTeauMN.exe
  C:\Windows\System\MTeauMN.exe
  2⤵
  PID:6384
- C:\Windows\System\jdXobYZ.exe
  C:\Windows\System\jdXobYZ.exe
  2⤵
  PID:6440
- C:\Windows\System\Ssanrag.exe
  C:\Windows\System\Ssanrag.exe
  2⤵
  PID:3416
- C:\Windows\System\NLtjxDj.exe
  C:\Windows\System\NLtjxDj.exe
  2⤵
  PID:6580
- C:\Windows\System\FzEUMED.exe
  C:\Windows\System\FzEUMED.exe
  2⤵
  PID:1108
- C:\Windows\System\TNYwSpQ.exe
  C:\Windows\System\TNYwSpQ.exe
  2⤵
  PID:6708
- C:\Windows\System\kGbkozQ.exe
  C:\Windows\System\kGbkozQ.exe
  2⤵
  PID:6760
- C:\Windows\System\JhPKVYu.exe
  C:\Windows\System\JhPKVYu.exe
  2⤵
  PID:6812
- C:\Windows\System\yggAYtn.exe
  C:\Windows\System\yggAYtn.exe
  2⤵
  PID:6900
- C:\Windows\System\RXGyjKl.exe
  C:\Windows\System\RXGyjKl.exe
  2⤵
  PID:6956
- C:\Windows\System\afNDsFw.exe
  C:\Windows\System\afNDsFw.exe
  2⤵
  PID:7012
- C:\Windows\System\zZdEzXk.exe
  C:\Windows\System\zZdEzXk.exe
  2⤵
  PID:7084
- C:\Windows\System\GGXJxRX.exe
  C:\Windows\System\GGXJxRX.exe
  2⤵
  PID:7164
- C:\Windows\System\eVmMXhB.exe
  C:\Windows\System\eVmMXhB.exe
  2⤵
  PID:6216
- C:\Windows\System\VyTxUis.exe
  C:\Windows\System\VyTxUis.exe
  2⤵
  PID:3136
- C:\Windows\System\jlUrEet.exe
  C:\Windows\System\jlUrEet.exe
  2⤵
  PID:6520
- C:\Windows\System\tvZsbCb.exe
  C:\Windows\System\tvZsbCb.exe
  2⤵
  PID:792
- C:\Windows\System\PwLOTeO.exe
  C:\Windows\System\PwLOTeO.exe
  2⤵
  PID:6732
- C:\Windows\System\SMRSvkq.exe
  C:\Windows\System\SMRSvkq.exe
  2⤵
  PID:6876
- C:\Windows\System\cnKSPRK.exe
  C:\Windows\System\cnKSPRK.exe
  2⤵
  PID:6972
- C:\Windows\System\ArwagxA.exe
  C:\Windows\System\ArwagxA.exe
  2⤵
  PID:5516
- C:\Windows\System\Ucrukny.exe
  C:\Windows\System\Ucrukny.exe
  2⤵
  PID:6232
- C:\Windows\System\qhuTuUr.exe
  C:\Windows\System\qhuTuUr.exe
  2⤵
  PID:6608
- C:\Windows\System\dowiHMq.exe
  C:\Windows\System\dowiHMq.exe
  2⤵
  PID:6288
- C:\Windows\System\gTQcSjo.exe
  C:\Windows\System\gTQcSjo.exe
  2⤵
  PID:6804
- C:\Windows\System\IEemAkl.exe
  C:\Windows\System\IEemAkl.exe
  2⤵
  PID:7056
- C:\Windows\System\epqkZKM.exe
  C:\Windows\System\epqkZKM.exe
  2⤵
  PID:7188
- C:\Windows\System\WDHtAos.exe
  C:\Windows\System\WDHtAos.exe
  2⤵
  PID:7228
- C:\Windows\System\LPozxyG.exe
  C:\Windows\System\LPozxyG.exe
  2⤵
  PID:7252
- C:\Windows\System\eMcmZgt.exe
  C:\Windows\System\eMcmZgt.exe
  2⤵
  PID:7284
- C:\Windows\System\patAifn.exe
  C:\Windows\System\patAifn.exe
  2⤵
  PID:7324
- C:\Windows\System\lwORcMh.exe
  C:\Windows\System\lwORcMh.exe
  2⤵
  PID:7348
- C:\Windows\System\pBKXMhq.exe
  C:\Windows\System\pBKXMhq.exe
  2⤵
  PID:7376
- C:\Windows\System\kBwMFbE.exe
  C:\Windows\System\kBwMFbE.exe
  2⤵
  PID:7404
- C:\Windows\System\QpoRFaG.exe
  C:\Windows\System\QpoRFaG.exe
  2⤵
  PID:7424
- C:\Windows\System\YPzHnrh.exe
  C:\Windows\System\YPzHnrh.exe
  2⤵
  PID:7448
- C:\Windows\System\aRXRSZh.exe
  C:\Windows\System\aRXRSZh.exe
  2⤵
  PID:7492
- C:\Windows\System\eduTyqv.exe
  C:\Windows\System\eduTyqv.exe
  2⤵
  PID:7516
- C:\Windows\System\ZbPRGmY.exe
  C:\Windows\System\ZbPRGmY.exe
  2⤵
  PID:7544
- C:\Windows\System\WBvjxDR.exe
  C:\Windows\System\WBvjxDR.exe
  2⤵
  PID:7572
- C:\Windows\System\arjXRUY.exe
  C:\Windows\System\arjXRUY.exe
  2⤵
  PID:7592
- C:\Windows\System\cjiAiMq.exe
  C:\Windows\System\cjiAiMq.exe
  2⤵
  PID:7656
- C:\Windows\System\AoAHsoz.exe
  C:\Windows\System\AoAHsoz.exe
  2⤵
  PID:7684
- C:\Windows\System\FOhaPEJ.exe
  C:\Windows\System\FOhaPEJ.exe
  2⤵
  PID:7708
- C:\Windows\System\PKgwgmB.exe
  C:\Windows\System\PKgwgmB.exe
  2⤵
  PID:7732
- C:\Windows\System\uyNdsMC.exe
  C:\Windows\System\uyNdsMC.exe
  2⤵
  PID:7748
- C:\Windows\System\yHtKTTm.exe
  C:\Windows\System\yHtKTTm.exe
  2⤵
  PID:7776
- C:\Windows\System\IrQIdWr.exe
  C:\Windows\System\IrQIdWr.exe
  2⤵
  PID:7800
- C:\Windows\System\maDqVSs.exe
  C:\Windows\System\maDqVSs.exe
  2⤵
  PID:7824
- C:\Windows\System\aIFeogH.exe
  C:\Windows\System\aIFeogH.exe
  2⤵
  PID:7868
- C:\Windows\System\mgVGPsA.exe
  C:\Windows\System\mgVGPsA.exe
  2⤵
  PID:7900
- C:\Windows\System\hSvOiqw.exe
  C:\Windows\System\hSvOiqw.exe
  2⤵
  PID:7920
- C:\Windows\System\zzPXfhn.exe
  C:\Windows\System\zzPXfhn.exe
  2⤵
  PID:7952
- C:\Windows\System\uziFAyM.exe
  C:\Windows\System\uziFAyM.exe
  2⤵
  PID:7972
- C:\Windows\System\rJWUUst.exe
  C:\Windows\System\rJWUUst.exe
  2⤵
  PID:8012
- C:\Windows\System\nmoLsrP.exe
  C:\Windows\System\nmoLsrP.exe
  2⤵
  PID:8048
- C:\Windows\System\eouWQzS.exe
  C:\Windows\System\eouWQzS.exe
  2⤵
  PID:8072
- C:\Windows\System\SAXDxjl.exe
  C:\Windows\System\SAXDxjl.exe
  2⤵
  PID:8092
- C:\Windows\System\jHPUDER.exe
  C:\Windows\System\jHPUDER.exe
  2⤵
  PID:8136
- C:\Windows\System\VQStQco.exe
  C:\Windows\System\VQStQco.exe
  2⤵
  PID:8164
- C:\Windows\System\jJHubXM.exe
  C:\Windows\System\jJHubXM.exe
  2⤵
  PID:6524
- C:\Windows\System\NtWIgme.exe
  C:\Windows\System\NtWIgme.exe
  2⤵
  PID:7208
- C:\Windows\System\oWedmBS.exe
  C:\Windows\System\oWedmBS.exe
  2⤵
  PID:7244
- C:\Windows\System\wzAZTvK.exe
  C:\Windows\System\wzAZTvK.exe
  2⤵
  PID:7300
- C:\Windows\System\wRHzMGn.exe
  C:\Windows\System\wRHzMGn.exe
  2⤵
  PID:7412
- C:\Windows\System\fbsgYRm.exe
  C:\Windows\System\fbsgYRm.exe
  2⤵
  PID:7468
- C:\Windows\System\CfBFuzO.exe
  C:\Windows\System\CfBFuzO.exe
  2⤵
  PID:7532
- C:\Windows\System\xgevVsW.exe
  C:\Windows\System\xgevVsW.exe
  2⤵
  PID:7568
- C:\Windows\System\HzXealS.exe
  C:\Windows\System\HzXealS.exe
  2⤵
  PID:7672
- C:\Windows\System\WcgTuwJ.exe
  C:\Windows\System\WcgTuwJ.exe
  2⤵
  PID:7744
- C:\Windows\System\AZHGSsL.exe
  C:\Windows\System\AZHGSsL.exe
  2⤵
  PID:7788
- C:\Windows\System\orPzdJP.exe
  C:\Windows\System\orPzdJP.exe
  2⤵
  PID:7876
- C:\Windows\System\zYmZyLX.exe
  C:\Windows\System\zYmZyLX.exe
  2⤵
  PID:7948
- C:\Windows\System\HDWLqOy.exe
  C:\Windows\System\HDWLqOy.exe
  2⤵
  PID:8000
- C:\Windows\System\HmCGPlN.exe
  C:\Windows\System\HmCGPlN.exe
  2⤵
  PID:8060
- C:\Windows\System\XjITCPI.exe
  C:\Windows\System\XjITCPI.exe
  2⤵
  PID:8132
- C:\Windows\System\kXbhapL.exe
  C:\Windows\System\kXbhapL.exe
  2⤵
  PID:6556
- C:\Windows\System\XfkpWeG.exe
  C:\Windows\System\XfkpWeG.exe
  2⤵
  PID:7396
- C:\Windows\System\KlvGOJM.exe
  C:\Windows\System\KlvGOJM.exe
  2⤵
  PID:7484
- C:\Windows\System\lpXuxfq.exe
  C:\Windows\System\lpXuxfq.exe
  2⤵
  PID:7608
- C:\Windows\System\dgdNLYa.exe
  C:\Windows\System\dgdNLYa.exe
  2⤵
  PID:7836
- C:\Windows\System\xBpfmDm.exe
  C:\Windows\System\xBpfmDm.exe
  2⤵
  PID:8056
- C:\Windows\System\dISKgeJ.exe
  C:\Windows\System\dISKgeJ.exe
  2⤵
  PID:8044
- C:\Windows\System\yZmnbrI.exe
  C:\Windows\System\yZmnbrI.exe
  2⤵
  PID:8188
- C:\Windows\System\KpdyIDz.exe
  C:\Windows\System\KpdyIDz.exe
  2⤵
  PID:7772
- C:\Windows\System\cMLsSsu.exe
  C:\Windows\System\cMLsSsu.exe
  2⤵
  PID:8040
- C:\Windows\System\ExiDdqp.exe
  C:\Windows\System\ExiDdqp.exe
  2⤵
  PID:3212
- C:\Windows\System\AvuNSWX.exe
  C:\Windows\System\AvuNSWX.exe
  2⤵
  PID:7456
- C:\Windows\System\WXBavZO.exe
  C:\Windows\System\WXBavZO.exe
  2⤵
  PID:8204
- C:\Windows\System\JpAqxlP.exe
  C:\Windows\System\JpAqxlP.exe
  2⤵
  PID:8224
- C:\Windows\System\logwOCl.exe
  C:\Windows\System\logwOCl.exe
  2⤵
  PID:8244
- C:\Windows\System\PUmcqHc.exe
  C:\Windows\System\PUmcqHc.exe
  2⤵
  PID:8276
- C:\Windows\System\tyPqFMo.exe
  C:\Windows\System\tyPqFMo.exe
  2⤵
  PID:8312
- C:\Windows\System\TwDfqHV.exe
  C:\Windows\System\TwDfqHV.exe
  2⤵
  PID:8336
- C:\Windows\System\DpFaUqt.exe
  C:\Windows\System\DpFaUqt.exe
  2⤵
  PID:8360
- C:\Windows\System\ZAWJfZG.exe
  C:\Windows\System\ZAWJfZG.exe
  2⤵
  PID:8380
- C:\Windows\System\boPTNBg.exe
  C:\Windows\System\boPTNBg.exe
  2⤵
  PID:8400
- C:\Windows\System\HQRLnaW.exe
  C:\Windows\System\HQRLnaW.exe
  2⤵
  PID:8452
- C:\Windows\System\ZjJIbTD.exe
  C:\Windows\System\ZjJIbTD.exe
  2⤵
  PID:8476
- C:\Windows\System\IrJodrW.exe
  C:\Windows\System\IrJodrW.exe
  2⤵
  PID:8520
- C:\Windows\System\KZkhbBv.exe
  C:\Windows\System\KZkhbBv.exe
  2⤵
  PID:8544
- C:\Windows\System\PglJuDl.exe
  C:\Windows\System\PglJuDl.exe
  2⤵
  PID:8568
- C:\Windows\System\naCykcC.exe
  C:\Windows\System\naCykcC.exe
  2⤵
  PID:8592
- C:\Windows\System\fnZGEpN.exe
  C:\Windows\System\fnZGEpN.exe
  2⤵
  PID:8616
- C:\Windows\System\odqgNli.exe
  C:\Windows\System\odqgNli.exe
  2⤵
  PID:8660
- C:\Windows\System\gyUXHBy.exe
  C:\Windows\System\gyUXHBy.exe
  2⤵
  PID:8684
- C:\Windows\System\ZBqmZat.exe
  C:\Windows\System\ZBqmZat.exe
  2⤵
  PID:8712
- C:\Windows\System\DUvgSag.exe
  C:\Windows\System\DUvgSag.exe
  2⤵
  PID:8740
- C:\Windows\System\UZskiQH.exe
  C:\Windows\System\UZskiQH.exe
  2⤵
  PID:8768
- C:\Windows\System\HajMwJw.exe
  C:\Windows\System\HajMwJw.exe
  2⤵
  PID:8796
- C:\Windows\System\sIeUXZx.exe
  C:\Windows\System\sIeUXZx.exe
  2⤵
  PID:8824
- C:\Windows\System\Zswvndx.exe
  C:\Windows\System\Zswvndx.exe
  2⤵
  PID:8852
- C:\Windows\System\lzrKxqH.exe
  C:\Windows\System\lzrKxqH.exe
  2⤵
  PID:8872
- C:\Windows\System\Arnmbzd.exe
  C:\Windows\System\Arnmbzd.exe
  2⤵
  PID:8896
- C:\Windows\System\vzgjvzx.exe
  C:\Windows\System\vzgjvzx.exe
  2⤵
  PID:8920
- C:\Windows\System\ruUYrkE.exe
  C:\Windows\System\ruUYrkE.exe
  2⤵
  PID:8948
- C:\Windows\System\KkSIFTd.exe
  C:\Windows\System\KkSIFTd.exe
  2⤵
  PID:8968
- C:\Windows\System\VPBmdwQ.exe
  C:\Windows\System\VPBmdwQ.exe
  2⤵
  PID:8996
- C:\Windows\System\XtKsuoP.exe
  C:\Windows\System\XtKsuoP.exe
  2⤵
  PID:9052
- C:\Windows\System\AgQUtaz.exe
  C:\Windows\System\AgQUtaz.exe
  2⤵
  PID:9076
- C:\Windows\System\NywVTdp.exe
  C:\Windows\System\NywVTdp.exe
  2⤵
  PID:9104
- C:\Windows\System\JfDksey.exe
  C:\Windows\System\JfDksey.exe
  2⤵
  PID:9128
- C:\Windows\System\ispEpif.exe
  C:\Windows\System\ispEpif.exe
  2⤵
  PID:9152
- C:\Windows\System\MRDzitF.exe
  C:\Windows\System\MRDzitF.exe
  2⤵
  PID:9172
- C:\Windows\System\diaNQkb.exe
  C:\Windows\System\diaNQkb.exe
  2⤵
  PID:9196
- C:\Windows\System\VHeOmVJ.exe
  C:\Windows\System\VHeOmVJ.exe
  2⤵
  PID:8196
- C:\Windows\System\HvDEaba.exe
  C:\Windows\System\HvDEaba.exe
  2⤵
  PID:8272
- C:\Windows\System\YsQNTGQ.exe
  C:\Windows\System\YsQNTGQ.exe
  2⤵
  PID:8304
- C:\Windows\System\ysraAOR.exe
  C:\Windows\System\ysraAOR.exe
  2⤵
  PID:8396
- C:\Windows\System\qQBbjXV.exe
  C:\Windows\System\qQBbjXV.exe
  2⤵
  PID:3476
- C:\Windows\System\RNUautK.exe
  C:\Windows\System\RNUautK.exe
  2⤵
  PID:8512
- C:\Windows\System\qyEQZIe.exe
  C:\Windows\System\qyEQZIe.exe
  2⤵
  PID:8564
- C:\Windows\System\kjCklqT.exe
  C:\Windows\System\kjCklqT.exe
  2⤵
  PID:8612
- C:\Windows\System\FkdJiKa.exe
  C:\Windows\System\FkdJiKa.exe
  2⤵
  PID:8672
- C:\Windows\System\pEKyLLS.exe
  C:\Windows\System\pEKyLLS.exe
  2⤵
  PID:8756
- C:\Windows\System\XonACjJ.exe
  C:\Windows\System\XonACjJ.exe
  2⤵
  PID:8804
- C:\Windows\System\pwOQOnW.exe
  C:\Windows\System\pwOQOnW.exe
  2⤵
  PID:8904
- C:\Windows\System\cZGgaAK.exe
  C:\Windows\System\cZGgaAK.exe
  2⤵
  PID:8964
- C:\Windows\System\XBHwQpR.exe
  C:\Windows\System\XBHwQpR.exe
  2⤵
  PID:8984
- C:\Windows\System\RJmfxRL.exe
  C:\Windows\System\RJmfxRL.exe
  2⤵
  PID:9048
- C:\Windows\System\cAeMEZm.exe
  C:\Windows\System\cAeMEZm.exe
  2⤵
  PID:9204
- C:\Windows\System\KSrMYRq.exe
  C:\Windows\System\KSrMYRq.exe
  2⤵
  PID:8288
- C:\Windows\System\QUSAwiB.exe
  C:\Windows\System\QUSAwiB.exe
  2⤵
  PID:8368
- C:\Windows\System\SMbRMZl.exe
  C:\Windows\System\SMbRMZl.exe
  2⤵
  PID:8536
- C:\Windows\System\vSQoyQS.exe
  C:\Windows\System\vSQoyQS.exe
  2⤵
  PID:8656
- C:\Windows\System\bWueWxd.exe
  C:\Windows\System\bWueWxd.exe
  2⤵
  PID:8732
- C:\Windows\System\oGLdbEd.exe
  C:\Windows\System\oGLdbEd.exe
  2⤵
  PID:8864
- C:\Windows\System\AuwWqEV.exe
  C:\Windows\System\AuwWqEV.exe
  2⤵
  PID:9028
- C:\Windows\System\LIyGuVp.exe
  C:\Windows\System\LIyGuVp.exe
  2⤵
  PID:9192
- C:\Windows\System\asdzacP.exe
  C:\Windows\System\asdzacP.exe
  2⤵
  PID:920
- C:\Windows\System\wxhBXnX.exe
  C:\Windows\System\wxhBXnX.exe
  2⤵
  PID:8784
- C:\Windows\System\PNksxdv.exe
  C:\Windows\System\PNksxdv.exe
  2⤵
  PID:8868
- C:\Windows\System\uzkeMCA.exe
  C:\Windows\System\uzkeMCA.exe
  2⤵
  PID:8932
- C:\Windows\System\aoSFXAz.exe
  C:\Windows\System\aoSFXAz.exe
  2⤵
  PID:9224
- C:\Windows\System\wTyrMOI.exe
  C:\Windows\System\wTyrMOI.exe
  2⤵
  PID:9252
- C:\Windows\System\EZKlPZR.exe
  C:\Windows\System\EZKlPZR.exe
  2⤵
  PID:9280
- C:\Windows\System\DkRUOPx.exe
  C:\Windows\System\DkRUOPx.exe
  2⤵
  PID:9308
- C:\Windows\System\URYOtmq.exe
  C:\Windows\System\URYOtmq.exe
  2⤵
  PID:9348
- C:\Windows\System\bxneKcw.exe
  C:\Windows\System\bxneKcw.exe
  2⤵
  PID:9380
- C:\Windows\System\RuTpLKY.exe
  C:\Windows\System\RuTpLKY.exe
  2⤵
  PID:9412
- C:\Windows\System\bLKBVzD.exe
  C:\Windows\System\bLKBVzD.exe
  2⤵
  PID:9440
- C:\Windows\System\euBWXiS.exe
  C:\Windows\System\euBWXiS.exe
  2⤵
  PID:9464
- C:\Windows\System\eQGvVxm.exe
  C:\Windows\System\eQGvVxm.exe
  2⤵
  PID:9488
- C:\Windows\System\WucihDc.exe
  C:\Windows\System\WucihDc.exe
  2⤵
  PID:9524
- C:\Windows\System\kcFksPL.exe
  C:\Windows\System\kcFksPL.exe
  2⤵
  PID:9548
- C:\Windows\System\JjdZGeC.exe
  C:\Windows\System\JjdZGeC.exe
  2⤵
  PID:9572
- C:\Windows\System\rdPlctB.exe
  C:\Windows\System\rdPlctB.exe
  2⤵
  PID:9592
- C:\Windows\System\EfkoYDn.exe
  C:\Windows\System\EfkoYDn.exe
  2⤵
  PID:9620
- C:\Windows\System\GfXUXxc.exe
  C:\Windows\System\GfXUXxc.exe
  2⤵
  PID:9644
- C:\Windows\System\vQiKirl.exe
  C:\Windows\System\vQiKirl.exe
  2⤵
  PID:9676
- C:\Windows\System\YlbIadm.exe
  C:\Windows\System\YlbIadm.exe
  2⤵
  PID:9704
- C:\Windows\System\beYTbFY.exe
  C:\Windows\System\beYTbFY.exe
  2⤵
  PID:9728
- C:\Windows\System\cXTjcrb.exe
  C:\Windows\System\cXTjcrb.exe
  2⤵
  PID:9748
- C:\Windows\System\mPYkowb.exe
  C:\Windows\System\mPYkowb.exe
  2⤵
  PID:9772
- C:\Windows\System\zeyDuxQ.exe
  C:\Windows\System\zeyDuxQ.exe
  2⤵
  PID:9800
- C:\Windows\System\uAjuXZZ.exe
  C:\Windows\System\uAjuXZZ.exe
  2⤵
  PID:9832
- C:\Windows\System\ZyEoMrn.exe
  C:\Windows\System\ZyEoMrn.exe
  2⤵
  PID:9860
- C:\Windows\System\VVkxbDF.exe
  C:\Windows\System\VVkxbDF.exe
  2⤵
  PID:9884
- C:\Windows\System\UtbIoGd.exe
  C:\Windows\System\UtbIoGd.exe
  2⤵
  PID:9916
- C:\Windows\System\SWjUckP.exe
  C:\Windows\System\SWjUckP.exe
  2⤵
  PID:9940
- C:\Windows\System\RDdmVWK.exe
  C:\Windows\System\RDdmVWK.exe
  2⤵
  PID:9984
- C:\Windows\System\OEyoNpZ.exe
  C:\Windows\System\OEyoNpZ.exe
  2⤵
  PID:10012
- C:\Windows\System\VqwZXqx.exe
  C:\Windows\System\VqwZXqx.exe
  2⤵
  PID:10040
- C:\Windows\System\EFhcXFx.exe
  C:\Windows\System\EFhcXFx.exe
  2⤵
  PID:10068
- C:\Windows\System\JRFGNFt.exe
  C:\Windows\System\JRFGNFt.exe
  2⤵
  PID:10096
- C:\Windows\System\giwVJIp.exe
  C:\Windows\System\giwVJIp.exe
  2⤵
  PID:10140
- C:\Windows\System\Aobfblr.exe
  C:\Windows\System\Aobfblr.exe
  2⤵
  PID:10160
- C:\Windows\System\IveaGtK.exe
  C:\Windows\System\IveaGtK.exe
  2⤵
  PID:10180
- C:\Windows\System\yRVPOpt.exe
  C:\Windows\System\yRVPOpt.exe
  2⤵
  PID:10228
- C:\Windows\System\USchLeH.exe
  C:\Windows\System\USchLeH.exe
  2⤵
  PID:8832
- C:\Windows\System\bFCQtwT.exe
  C:\Windows\System\bFCQtwT.exe
  2⤵
  PID:9272
- C:\Windows\System\bXdVPWT.exe
  C:\Windows\System\bXdVPWT.exe
  2⤵
  PID:9360
- C:\Windows\System\QoJeQGw.exe
  C:\Windows\System\QoJeQGw.exe
  2⤵
  PID:9428
- C:\Windows\System\ELiVnNq.exe
  C:\Windows\System\ELiVnNq.exe
  2⤵
  PID:9480
- C:\Windows\System\vFsHkXk.exe
  C:\Windows\System\vFsHkXk.exe
  2⤵
  PID:9532
- C:\Windows\System\lIhTrLF.exe
  C:\Windows\System\lIhTrLF.exe
  2⤵
  PID:9628
- C:\Windows\System\YAZVFwK.exe
  C:\Windows\System\YAZVFwK.exe
  2⤵
  PID:9692
- C:\Windows\System\dUJbpjk.exe
  C:\Windows\System\dUJbpjk.exe
  2⤵
  PID:9764
- C:\Windows\System\TUWnLdB.exe
  C:\Windows\System\TUWnLdB.exe
  2⤵
  PID:9828
- C:\Windows\System\hszQxBy.exe
  C:\Windows\System\hszQxBy.exe
  2⤵
  PID:9900
- C:\Windows\System\shwomCe.exe
  C:\Windows\System\shwomCe.exe
  2⤵
  PID:9924
- C:\Windows\System\oSmljSn.exe
  C:\Windows\System\oSmljSn.exe
  2⤵
  PID:10000
- C:\Windows\System\WCByWuj.exe
  C:\Windows\System\WCByWuj.exe
  2⤵
  PID:10060
- C:\Windows\System\bzONumn.exe
  C:\Windows\System\bzONumn.exe
  2⤵
  PID:10136
- C:\Windows\System\cfCULOf.exe
  C:\Windows\System\cfCULOf.exe
  2⤵
  PID:10172
- C:\Windows\System\FRRdtQr.exe
  C:\Windows\System\FRRdtQr.exe
  2⤵
  PID:10220
- C:\Windows\System\AUTAZGG.exe
  C:\Windows\System\AUTAZGG.exe
  2⤵
  PID:9372
- C:\Windows\System\GRKUgDC.exe
  C:\Windows\System\GRKUgDC.exe
  2⤵
  PID:9540
- C:\Windows\System\VJgZpfB.exe
  C:\Windows\System\VJgZpfB.exe
  2⤵
  PID:9640
- C:\Windows\System\ghIuXDB.exe
  C:\Windows\System\ghIuXDB.exe
  2⤵
  PID:9780
- C:\Windows\System\WgcgOLc.exe
  C:\Windows\System\WgcgOLc.exe
  2⤵
  PID:9952
- C:\Windows\System\wdobYHf.exe
  C:\Windows\System\wdobYHf.exe
  2⤵
  PID:10088
- C:\Windows\System\TPvJMkA.exe
  C:\Windows\System\TPvJMkA.exe
  2⤵
  PID:9336
- C:\Windows\System\hFVFOOL.exe
  C:\Windows\System\hFVFOOL.exe
  2⤵
  PID:9688
- C:\Windows\System\QPmZACh.exe
  C:\Windows\System\QPmZACh.exe
  2⤵
  PID:9072
- C:\Windows\System\JhrWuVk.exe
  C:\Windows\System\JhrWuVk.exe
  2⤵
  PID:9840
- C:\Windows\System\qEyYwtl.exe
  C:\Windows\System\qEyYwtl.exe
  2⤵
  PID:10244
- C:\Windows\System\qOEYzvN.exe
  C:\Windows\System\qOEYzvN.exe
  2⤵
  PID:10272
- C:\Windows\System\KrVqPHV.exe
  C:\Windows\System\KrVqPHV.exe
  2⤵
  PID:10300
- C:\Windows\System\zPETDyq.exe
  C:\Windows\System\zPETDyq.exe
  2⤵
  PID:10328
- C:\Windows\System\XhIuVan.exe
  C:\Windows\System\XhIuVan.exe
  2⤵
  PID:10356
- C:\Windows\System\bHTewvm.exe
  C:\Windows\System\bHTewvm.exe
  2⤵
  PID:10376
- C:\Windows\System\QtEHaBD.exe
  C:\Windows\System\QtEHaBD.exe
  2⤵
  PID:10400
- C:\Windows\System\APnkMdZ.exe
  C:\Windows\System\APnkMdZ.exe
  2⤵
  PID:10428
- C:\Windows\System\EPXcBnN.exe
  C:\Windows\System\EPXcBnN.exe
  2⤵
  PID:10472
- C:\Windows\System\rbbgnqt.exe
  C:\Windows\System\rbbgnqt.exe
  2⤵
  PID:10496
- C:\Windows\System\dUcitrT.exe
  C:\Windows\System\dUcitrT.exe
  2⤵
  PID:10524
- C:\Windows\System\hzGiBpW.exe
  C:\Windows\System\hzGiBpW.exe
  2⤵
  PID:10552
- C:\Windows\System\KhiDTRN.exe
  C:\Windows\System\KhiDTRN.exe
  2⤵
  PID:10576
- C:\Windows\System\MEEbcsn.exe
  C:\Windows\System\MEEbcsn.exe
  2⤵
  PID:10700
- C:\Windows\System\rWCNgYA.exe
  C:\Windows\System\rWCNgYA.exe
  2⤵
  PID:10716
- C:\Windows\System\POafxBj.exe
  C:\Windows\System\POafxBj.exe
  2⤵
  PID:10732
- C:\Windows\System\WmLlUjW.exe
  C:\Windows\System\WmLlUjW.exe
  2⤵
  PID:10748
- C:\Windows\System\gQktSNS.exe
  C:\Windows\System\gQktSNS.exe
  2⤵
  PID:10764
- C:\Windows\System\nndugAw.exe
  C:\Windows\System\nndugAw.exe
  2⤵
  PID:10780
- C:\Windows\System\EZXMggQ.exe
  C:\Windows\System\EZXMggQ.exe
  2⤵
  PID:10796
- C:\Windows\System\cnbKcfB.exe
  C:\Windows\System\cnbKcfB.exe
  2⤵
  PID:10812
- C:\Windows\System\mlehahm.exe
  C:\Windows\System\mlehahm.exe
  2⤵
  PID:10828
- C:\Windows\System\vEszVti.exe
  C:\Windows\System\vEszVti.exe
  2⤵
  PID:10844
- C:\Windows\System\NHrkbtg.exe
  C:\Windows\System\NHrkbtg.exe
  2⤵
  PID:10860
- C:\Windows\System\DxwvizC.exe
  C:\Windows\System\DxwvizC.exe
  2⤵
  PID:10876
- C:\Windows\System\mKLtFgv.exe
  C:\Windows\System\mKLtFgv.exe
  2⤵
  PID:10892
- C:\Windows\System\fOfZytr.exe
  C:\Windows\System\fOfZytr.exe
  2⤵
  PID:10908
- C:\Windows\System\iDkxjaL.exe
  C:\Windows\System\iDkxjaL.exe
  2⤵
  PID:10924
- C:\Windows\System\yNUDudd.exe
  C:\Windows\System\yNUDudd.exe
  2⤵
  PID:10952
- C:\Windows\System\zpxgclx.exe
  C:\Windows\System\zpxgclx.exe
  2⤵
  PID:10992
- C:\Windows\System\wLgrojj.exe
  C:\Windows\System\wLgrojj.exe
  2⤵
  PID:11052
- C:\Windows\System\oJdsewC.exe
  C:\Windows\System\oJdsewC.exe
  2⤵
  PID:11176
- C:\Windows\System\OgwYLot.exe
  C:\Windows\System\OgwYLot.exe
  2⤵
  PID:11196
- C:\Windows\System\ZnYhvwn.exe
  C:\Windows\System\ZnYhvwn.exe
  2⤵
  PID:11216
- C:\Windows\System\iSaqbke.exe
  C:\Windows\System\iSaqbke.exe
  2⤵
  PID:10320
- C:\Windows\System\hdAfujf.exe
  C:\Windows\System\hdAfujf.exe
  2⤵
  PID:10392
- C:\Windows\System\yvUFIOw.exe
  C:\Windows\System\yvUFIOw.exe
  2⤵
  PID:10504
- C:\Windows\System\LaoyQue.exe
  C:\Windows\System\LaoyQue.exe
  2⤵
  PID:10596
- C:\Windows\System\VLoOLcs.exe
  C:\Windows\System\VLoOLcs.exe
  2⤵
  PID:10632
- C:\Windows\System\OmuwJOd.exe
  C:\Windows\System\OmuwJOd.exe
  2⤵
  PID:10672
- C:\Windows\System\goWkrAX.exe
  C:\Windows\System\goWkrAX.exe
  2⤵
  PID:10624
- C:\Windows\System\ZJjTQPa.exe
  C:\Windows\System\ZJjTQPa.exe
  2⤵
  PID:10696
- C:\Windows\System\MMHseOo.exe
  C:\Windows\System\MMHseOo.exe
  2⤵
  PID:10744
- C:\Windows\System\wTAgwgZ.exe
  C:\Windows\System\wTAgwgZ.exe
  2⤵
  PID:10692
- C:\Windows\System\vtQiymr.exe
  C:\Windows\System\vtQiymr.exe
  2⤵
  PID:10756
- C:\Windows\System\TsGQPql.exe
  C:\Windows\System\TsGQPql.exe
  2⤵
  PID:10836
- C:\Windows\System\vdFaPRQ.exe
  C:\Windows\System\vdFaPRQ.exe
  2⤵
  PID:10884
- C:\Windows\System\aWMMYQx.exe
  C:\Windows\System\aWMMYQx.exe
  2⤵
  PID:10980
- C:\Windows\System\dmUGxwK.exe
  C:\Windows\System\dmUGxwK.exe
  2⤵
  PID:11092
- C:\Windows\System\LSnJOUL.exe
  C:\Windows\System\LSnJOUL.exe
  2⤵
  PID:11236
- C:\Windows\System\MJyEhXD.exe
  C:\Windows\System\MJyEhXD.exe
  2⤵
  PID:11168
- C:\Windows\System\WaQpLeP.exe
  C:\Windows\System\WaQpLeP.exe
  2⤵
  PID:10348
- C:\Windows\System\TAKOHIb.exe
  C:\Windows\System\TAKOHIb.exe
  2⤵
  PID:10560
- C:\Windows\System\uZYcRlQ.exe
  C:\Windows\System\uZYcRlQ.exe
  2⤵
  PID:10660
- C:\Windows\System\NFyNtBe.exe
  C:\Windows\System\NFyNtBe.exe
  2⤵
  PID:10972
- C:\Windows\System\tJKWJRi.exe
  C:\Windows\System\tJKWJRi.exe
  2⤵
  PID:10776
- C:\Windows\System\dUPTfdN.exe
  C:\Windows\System\dUPTfdN.exe
  2⤵
  PID:10872
- C:\Windows\System\PfXFdCI.exe
  C:\Windows\System\PfXFdCI.exe
  2⤵
  PID:11028
- C:\Windows\System\PHaDbLl.exe
  C:\Windows\System\PHaDbLl.exe
  2⤵
  PID:11204
- C:\Windows\System\FwPRlRR.exe
  C:\Windows\System\FwPRlRR.exe
  2⤵
  PID:10648
- C:\Windows\System\OoMYIoy.exe
  C:\Windows\System\OoMYIoy.exe
  2⤵
  PID:10820
- C:\Windows\System\tLnAVLU.exe
  C:\Windows\System\tLnAVLU.exe
  2⤵
  PID:10960
- C:\Windows\System\iwRPMkz.exe
  C:\Windows\System\iwRPMkz.exe
  2⤵
  PID:10656
- C:\Windows\System\NEhsEhT.exe
  C:\Windows\System\NEhsEhT.exe
  2⤵
  PID:11124
- C:\Windows\System\UKWPSEf.exe
  C:\Windows\System\UKWPSEf.exe
  2⤵
  PID:11280
- C:\Windows\System\NObenbG.exe
  C:\Windows\System\NObenbG.exe
  2⤵
  PID:11300
- C:\Windows\System\zHblHld.exe
  C:\Windows\System\zHblHld.exe
  2⤵
  PID:11316
- C:\Windows\System\Sphjjen.exe
  C:\Windows\System\Sphjjen.exe
  2⤵
  PID:11364
- C:\Windows\System\vcvIUek.exe
  C:\Windows\System\vcvIUek.exe
  2⤵
  PID:11396
- C:\Windows\System\PJcguuj.exe
  C:\Windows\System\PJcguuj.exe
  2⤵
  PID:11428
- C:\Windows\System\CZeWmYG.exe
  C:\Windows\System\CZeWmYG.exe
  2⤵
  PID:11452
- C:\Windows\System\WvwUSXs.exe
  C:\Windows\System\WvwUSXs.exe
  2⤵
  PID:11480
- C:\Windows\System\WPGwHXw.exe
  C:\Windows\System\WPGwHXw.exe
  2⤵
  PID:11512
- C:\Windows\System\wfYuhEJ.exe
  C:\Windows\System\wfYuhEJ.exe
  2⤵
  PID:11532
- C:\Windows\System\EaBBXuP.exe
  C:\Windows\System\EaBBXuP.exe
  2⤵
  PID:11548
- C:\Windows\System\ZMmMoNv.exe
  C:\Windows\System\ZMmMoNv.exe
  2⤵
  PID:11584
- C:\Windows\System\bFfSfEh.exe
  C:\Windows\System\bFfSfEh.exe
  2⤵
  PID:11604
- C:\Windows\System\kxQKipt.exe
  C:\Windows\System\kxQKipt.exe
  2⤵
  PID:11632
- C:\Windows\System\JroTPhw.exe
  C:\Windows\System\JroTPhw.exe
  2⤵
  PID:11664
- C:\Windows\System\ygdUjsp.exe
  C:\Windows\System\ygdUjsp.exe
  2⤵
  PID:11696
- C:\Windows\System\fSsnZos.exe
  C:\Windows\System\fSsnZos.exe
  2⤵
  PID:11728
- C:\Windows\System\ZvyvLks.exe
  C:\Windows\System\ZvyvLks.exe
  2⤵
  PID:11752
- C:\Windows\System\BkSokkF.exe
  C:\Windows\System\BkSokkF.exe
  2⤵
  PID:11776
- C:\Windows\System\CUczRNo.exe
  C:\Windows\System\CUczRNo.exe
  2⤵
  PID:11816
- C:\Windows\System\yqvotfB.exe
  C:\Windows\System\yqvotfB.exe
  2⤵
  PID:11836
- C:\Windows\System\HzjNMip.exe
  C:\Windows\System\HzjNMip.exe
  2⤵
  PID:11864
- C:\Windows\System\kvUCmfh.exe
  C:\Windows\System\kvUCmfh.exe
  2⤵
  PID:11888
- C:\Windows\System\MEjedSw.exe
  C:\Windows\System\MEjedSw.exe
  2⤵
  PID:11936
- C:\Windows\System\hIqobSi.exe
  C:\Windows\System\hIqobSi.exe
  2⤵
  PID:11956
- C:\Windows\System\FVVnAFb.exe
  C:\Windows\System\FVVnAFb.exe
  2⤵
  PID:11988
- C:\Windows\System\ppaNCqz.exe
  C:\Windows\System\ppaNCqz.exe
  2⤵
  PID:12008
- C:\Windows\System\kwckicX.exe
  C:\Windows\System\kwckicX.exe
  2⤵
  PID:12048
- C:\Windows\System\PhDAVBN.exe
  C:\Windows\System\PhDAVBN.exe
  2⤵
  PID:12076
- C:\Windows\System\BnbWTjW.exe
  C:\Windows\System\BnbWTjW.exe
  2⤵
  PID:12104
- C:\Windows\System\MSujQSV.exe
  C:\Windows\System\MSujQSV.exe
  2⤵
  PID:12124
- C:\Windows\System\KzCcGZc.exe
  C:\Windows\System\KzCcGZc.exe
  2⤵
  PID:12168
- C:\Windows\System\cswkLdd.exe
  C:\Windows\System\cswkLdd.exe
  2⤵
  PID:12184
- C:\Windows\System\GXUJbwG.exe
  C:\Windows\System\GXUJbwG.exe
  2⤵
  PID:12208
- C:\Windows\System\WGVwocm.exe
  C:\Windows\System\WGVwocm.exe
  2⤵
  PID:12260
- C:\Windows\System\jLbedcA.exe
  C:\Windows\System\jLbedcA.exe
  2⤵
  PID:11276
- C:\Windows\System\CELzZRe.exe
  C:\Windows\System\CELzZRe.exe
  2⤵
  PID:11312
- C:\Windows\System\vHidnJl.exe
  C:\Windows\System\vHidnJl.exe
  2⤵
  PID:11416
- C:\Windows\System\XeLmMbZ.exe
  C:\Windows\System\XeLmMbZ.exe
  2⤵
  PID:11468
- C:\Windows\System\LWCLUoF.exe
  C:\Windows\System\LWCLUoF.exe
  2⤵
  PID:11540
- C:\Windows\System\kwgAlEh.exe
  C:\Windows\System\kwgAlEh.exe
  2⤵
  PID:11600
- C:\Windows\System\NCcZmvT.exe
  C:\Windows\System\NCcZmvT.exe
  2⤵
  PID:11644
- C:\Windows\System\xqWYChT.exe
  C:\Windows\System\xqWYChT.exe
  2⤵
  PID:11724
- C:\Windows\System\BfFetcN.exe
  C:\Windows\System\BfFetcN.exe
  2⤵
  PID:11804
- C:\Windows\System\WszTxBb.exe
  C:\Windows\System\WszTxBb.exe
  2⤵
  PID:11856
- C:\Windows\System\WJuuUUv.exe
  C:\Windows\System\WJuuUUv.exe
  2⤵
  PID:11904
- C:\Windows\System\PutnRkz.exe
  C:\Windows\System\PutnRkz.exe
  2⤵
  PID:11944
- C:\Windows\System\ujgYFLK.exe
  C:\Windows\System\ujgYFLK.exe
  2⤵
  PID:12092
- C:\Windows\System\ugClnky.exe
  C:\Windows\System\ugClnky.exe
  2⤵
  PID:11000
- C:\Windows\System\mUXlZzt.exe
  C:\Windows\System\mUXlZzt.exe
  2⤵
  PID:12176
- C:\Windows\System\hgEOFmE.exe
  C:\Windows\System\hgEOFmE.exe
  2⤵
  PID:12224
- C:\Windows\System\TSsGyxb.exe
  C:\Windows\System\TSsGyxb.exe
  2⤵
  PID:12276
- C:\Windows\System\tIWxFmg.exe
  C:\Windows\System\tIWxFmg.exe
  2⤵
  PID:11384
- C:\Windows\System\PuKkogl.exe
  C:\Windows\System\PuKkogl.exe
  2⤵
  PID:11528
- C:\Windows\System\mePtsiP.exe
  C:\Windows\System\mePtsiP.exe
  2⤵
  PID:11676
- C:\Windows\System\PkGQHxj.exe
  C:\Windows\System\PkGQHxj.exe
  2⤵
  PID:1508
- C:\Windows\System\CsoPDNB.exe
  C:\Windows\System\CsoPDNB.exe
  2⤵
  PID:11876
- C:\Windows\System\GrxcNdR.exe
  C:\Windows\System\GrxcNdR.exe
  2⤵
  PID:12040
- C:\Windows\System\vmPldEE.exe
  C:\Windows\System\vmPldEE.exe
  2⤵
  PID:12252
- C:\Windows\System\PHzIWiu.exe
  C:\Windows\System\PHzIWiu.exe
  2⤵
  PID:3688
- C:\Windows\System\wslrxMq.exe
  C:\Windows\System\wslrxMq.exe
  2⤵
  PID:11576
- C:\Windows\System\aWEIvLY.exe
  C:\Windows\System\aWEIvLY.exe
  2⤵
  PID:11744
- C:\Windows\System\MDOarVF.exe
  C:\Windows\System\MDOarVF.exe
  2⤵
  PID:12200
- C:\Windows\System\BSYRHhJ.exe
  C:\Windows\System\BSYRHhJ.exe
  2⤵
  PID:12132
- C:\Windows\System\PQkcYcG.exe
  C:\Windows\System\PQkcYcG.exe
  2⤵
  PID:11924
- C:\Windows\System\zVBsRDw.exe
  C:\Windows\System\zVBsRDw.exe
  2⤵
  PID:12308
- C:\Windows\System\vMqgZva.exe
  C:\Windows\System\vMqgZva.exe
  2⤵
  PID:12340
- C:\Windows\System\TsnNFMo.exe
  C:\Windows\System\TsnNFMo.exe
  2⤵
  PID:12368
- C:\Windows\System\GSSNdif.exe
  C:\Windows\System\GSSNdif.exe
  2⤵
  PID:12412
- C:\Windows\System\YsrTTww.exe
  C:\Windows\System\YsrTTww.exe
  2⤵
  PID:12444
- C:\Windows\System\RPHvpOJ.exe
  C:\Windows\System\RPHvpOJ.exe
  2⤵
  PID:12464
- C:\Windows\System\DtFOVzJ.exe
  C:\Windows\System\DtFOVzJ.exe
  2⤵
  PID:12488
- C:\Windows\System\doXHhlv.exe
  C:\Windows\System\doXHhlv.exe
  2⤵
  PID:12516
- C:\Windows\System\YNpQnFw.exe
  C:\Windows\System\YNpQnFw.exe
  2⤵
  PID:12544
- C:\Windows\System\uvGvpCg.exe
  C:\Windows\System\uvGvpCg.exe
  2⤵
  PID:12568
- C:\Windows\System\LCMHWMt.exe
  C:\Windows\System\LCMHWMt.exe
  2⤵
  PID:12596
- C:\Windows\System\bbptwLg.exe
  C:\Windows\System\bbptwLg.exe
  2⤵
  PID:12624
- C:\Windows\System\JmznWkz.exe
  C:\Windows\System\JmznWkz.exe
  2⤵
  PID:12652
- C:\Windows\System\MIUmNeH.exe
  C:\Windows\System\MIUmNeH.exe
  2⤵
  PID:12676
- C:\Windows\System\LYLeKgZ.exe
  C:\Windows\System\LYLeKgZ.exe
  2⤵
  PID:12696
- C:\Windows\System\JyrIBvy.exe
  C:\Windows\System\JyrIBvy.exe
  2⤵
  PID:12720
- C:\Windows\System\ZVRxBPS.exe
  C:\Windows\System\ZVRxBPS.exe
  2⤵
  PID:12764
- C:\Windows\System\yYMZYNE.exe
  C:\Windows\System\yYMZYNE.exe
  2⤵
  PID:12788
- C:\Windows\System\BcHjwhY.exe
  C:\Windows\System\BcHjwhY.exe
  2⤵
  PID:12808
- C:\Windows\System\oDLLnfE.exe
  C:\Windows\System\oDLLnfE.exe
  2⤵
  PID:12856
- C:\Windows\System\xKqddEU.exe
  C:\Windows\System\xKqddEU.exe
  2⤵
  PID:12876
- C:\Windows\System\TGuaLLk.exe
  C:\Windows\System\TGuaLLk.exe
  2⤵
  PID:12924
- C:\Windows\System\OQzofkf.exe
  C:\Windows\System\OQzofkf.exe
  2⤵
  PID:12948
- C:\Windows\System\owSLDcK.exe
  C:\Windows\System\owSLDcK.exe
  2⤵
  PID:12968
- C:\Windows\System\IDfGAXJ.exe
  C:\Windows\System\IDfGAXJ.exe
  2⤵
  PID:12988
- C:\Windows\System\TyJdiaF.exe
  C:\Windows\System\TyJdiaF.exe
  2⤵
  PID:13016
- C:\Windows\System\mKqRMvP.exe
  C:\Windows\System\mKqRMvP.exe
  2⤵
  PID:13044
- C:\Windows\System\nACMYZE.exe
  C:\Windows\System\nACMYZE.exe
  2⤵
  PID:13068
- C:\Windows\System\dGKNgAD.exe
  C:\Windows\System\dGKNgAD.exe
  2⤵
  PID:13088
- C:\Windows\System\aMaxKUD.exe
  C:\Windows\System\aMaxKUD.exe
  2⤵
  PID:13112
- C:\Windows\System\Qgvbgql.exe
  C:\Windows\System\Qgvbgql.exe
  2⤵
  PID:13156
- C:\Windows\System\wtraSlp.exe
  C:\Windows\System\wtraSlp.exe
  2⤵
  PID:13188
- C:\Windows\System\xlFJPAM.exe
  C:\Windows\System\xlFJPAM.exe
  2⤵
  PID:13208
- C:\Windows\System\CdrTGFp.exe
  C:\Windows\System\CdrTGFp.exe
  2⤵
  PID:13232
- C:\Windows\System\nLVLrbx.exe
  C:\Windows\System\nLVLrbx.exe
  2⤵
  PID:13252
- C:\Windows\System\EHGoyvK.exe
  C:\Windows\System\EHGoyvK.exe
  2⤵
  PID:13280
- C:\Windows\System\BgnxOnk.exe
  C:\Windows\System\BgnxOnk.exe
  2⤵
  PID:13304
- C:\Windows\System\vGFjVsO.exe
  C:\Windows\System\vGFjVsO.exe
  2⤵
  PID:12320
- C:\Windows\System\wOfJnFs.exe
  C:\Windows\System\wOfJnFs.exe
  2⤵
  PID:12388
- C:\Windows\System\CWAdqMA.exe
  C:\Windows\System\CWAdqMA.exe
  2⤵
  PID:12436
- C:\Windows\System\EeqbdPn.exe
  C:\Windows\System\EeqbdPn.exe
  2⤵
  PID:12480
- C:\Windows\System\EWyczhT.exe
  C:\Windows\System\EWyczhT.exe
  2⤵
  PID:12532
- C:\Windows\System\PvcyEKl.exe
  C:\Windows\System\PvcyEKl.exe
  2⤵
  PID:12668
- C:\Windows\System\zmLvhNo.exe
  C:\Windows\System\zmLvhNo.exe
  2⤵
  PID:12760
- C:\Windows\System\CfEiNdt.exe
  C:\Windows\System\CfEiNdt.exe
  2⤵
  PID:12864
- C:\Windows\System\hEoJDyv.exe
  C:\Windows\System\hEoJDyv.exe
  2⤵
  PID:12916
- C:\Windows\System\YyxKdXU.exe
  C:\Windows\System\YyxKdXU.exe
  2⤵
  PID:11524
- C:\Windows\System\jVzoPVa.exe
  C:\Windows\System\jVzoPVa.exe
  2⤵
  PID:13148
- C:\Windows\System\dBSXxVg.exe
  C:\Windows\System\dBSXxVg.exe
  2⤵
  PID:13180
- C:\Windows\System\Nkainci.exe
  C:\Windows\System\Nkainci.exe
  2⤵
  PID:13272
- C:\Windows\System\MiyIlun.exe
  C:\Windows\System\MiyIlun.exe
  2⤵
  PID:12800
- C:\Windows\System\SNLlxIF.exe
  C:\Windows\System\SNLlxIF.exe
  2⤵
  PID:13064
- C:\Windows\System\YVyBNQv.exe
  C:\Windows\System\YVyBNQv.exe
  2⤵
  PID:13176
- C:\Windows\System\GydeLNo.exe
  C:\Windows\System\GydeLNo.exe
  2⤵
  PID:13288
- C:\Windows\System\kKoixrn.exe
  C:\Windows\System\kKoixrn.exe
  2⤵
  PID:12432
- C:\Windows\System\FjqOpwQ.exe
  C:\Windows\System\FjqOpwQ.exe
  2⤵
  PID:12660
- C:\Windows\System\KfYlxRg.exe
  C:\Windows\System\KfYlxRg.exe
  2⤵
  PID:12828
- C:\Windows\System\HhkhgAJ.exe
  C:\Windows\System\HhkhgAJ.exe
  2⤵
  PID:6668
- C:\Windows\System\EBJJAxg.exe
  C:\Windows\System\EBJJAxg.exe
  2⤵
  PID:12908
- C:\Windows\System\JfdRCwb.exe
  C:\Windows\System\JfdRCwb.exe
  2⤵
  PID:12964
- C:\Windows\System\mVIeAcR.exe
  C:\Windows\System\mVIeAcR.exe
  2⤵
  PID:3092
- C:\Windows\System\yxlXAOD.exe
  C:\Windows\System\yxlXAOD.exe
  2⤵
  PID:4904
- C:\Windows\System\HTFffQK.exe
  C:\Windows\System\HTFffQK.exe
  2⤵
  PID:12476
- C:\Windows\System\YgfTguT.exe
  C:\Windows\System\YgfTguT.exe
  2⤵
  PID:4496
- C:\Windows\System\kanyLug.exe
  C:\Windows\System\kanyLug.exe
  2⤵
  PID:12816
- C:\Windows\System\RKsmISo.exe
  C:\Windows\System\RKsmISo.exe
  2⤵
  PID:12240
- C:\Windows\System\chmMkjn.exe
  C:\Windows\System\chmMkjn.exe
  2⤵
  PID:13244
- C:\Windows\System\xsCJMuh.exe
  C:\Windows\System\xsCJMuh.exe
  2⤵
  PID:4428
- C:\Windows\System\XRsfwun.exe
  C:\Windows\System\XRsfwun.exe
  2⤵
  PID:4236
- C:\Windows\System\CnvuOrB.exe
  C:\Windows\System\CnvuOrB.exe
  2⤵
  PID:4552
- C:\Windows\System\IlXRXqn.exe
  C:\Windows\System\IlXRXqn.exe
  2⤵
  PID:668
- C:\Windows\System\dgOVPPr.exe
  C:\Windows\System\dgOVPPr.exe
  2⤵
  PID:5984
- C:\Windows\System\ugyvdzi.exe
  C:\Windows\System\ugyvdzi.exe
  2⤵
  PID:6324
- C:\Windows\System\Ipfrlao.exe
  C:\Windows\System\Ipfrlao.exe
  2⤵
  PID:7556
- C:\Windows\System\uFhaPnO.exe
  C:\Windows\System\uFhaPnO.exe
  2⤵
  PID:4012
- C:\Windows\System\AOkfXZh.exe
  C:\Windows\System\AOkfXZh.exe
  2⤵
  PID:7888
- C:\Windows\System\wVodFiv.exe
  C:\Windows\System\wVodFiv.exe
  2⤵
  PID:7724
- C:\Windows\System\OIxtgkV.exe
  C:\Windows\System\OIxtgkV.exe
  2⤵
  PID:2492
- C:\Windows\System\AZSRhdN.exe
  C:\Windows\System\AZSRhdN.exe
  2⤵
  PID:6856
- C:\Windows\System\DsmCCVh.exe
  C:\Windows\System\DsmCCVh.exe
  2⤵
  PID:9024
- C:\Windows\System\hTPLFYi.exe
  C:\Windows\System\hTPLFYi.exe
  2⤵
  PID:6280
- C:\Windows\System\oaUjzBL.exe
  C:\Windows\System\oaUjzBL.exe
  2⤵
  PID:7240
- C:\Windows\System\yYFPRXC.exe
  C:\Windows\System\yYFPRXC.exe
  2⤵
  PID:2228
- C:\Windows\System\ZEIrXCh.exe
  C:\Windows\System\ZEIrXCh.exe
  2⤵
  PID:7392
- C:\Windows\System\WzxIanH.exe
  C:\Windows\System\WzxIanH.exe
  2⤵
  PID:8200
- C:\Windows\System\QkBOLYD.exe
  C:\Windows\System\QkBOLYD.exe
  2⤵
  PID:3756
- C:\Windows\System\MLCGgPu.exe
  C:\Windows\System\MLCGgPu.exe
  2⤵
  PID:6552
- C:\Windows\System\kdVCxpy.exe
  C:\Windows\System\kdVCxpy.exe
  2⤵
  PID:8692
- C:\Windows\System\OpngrgR.exe
  C:\Windows\System\OpngrgR.exe
  2⤵
  PID:8748
- C:\Windows\System\JawVego.exe
  C:\Windows\System\JawVego.exe
  2⤵
  PID:6432
- C:\Windows\System\vXMkzLs.exe
  C:\Windows\System\vXMkzLs.exe
  2⤵
  PID:6684
- C:\Windows\System\VipzSUb.exe
  C:\Windows\System\VipzSUb.exe
  2⤵
  PID:6644
- C:\Windows\System\XfPlcdR.exe
  C:\Windows\System\XfPlcdR.exe
  2⤵
  PID:6160
- C:\Windows\System\junbxmO.exe
  C:\Windows\System\junbxmO.exe
  2⤵
  PID:8880
- C:\Windows\System\WKlEVul.exe
  C:\Windows\System\WKlEVul.exe
  2⤵
  PID:3296
- C:\Windows\System\cdKpNVR.exe
  C:\Windows\System\cdKpNVR.exe
  2⤵
  PID:5712
- C:\Windows\System\xkGeNmx.exe
  C:\Windows\System\xkGeNmx.exe
  2⤵
  PID:7740
- C:\Windows\System\cSnrajf.exe
  C:\Windows\System\cSnrajf.exe
  2⤵
  PID:9364
- C:\Windows\System\XTNDRCh.exe
  C:\Windows\System\XTNDRCh.exe
  2⤵
  PID:9460
- C:\Windows\System\DccgZBZ.exe
  C:\Windows\System\DccgZBZ.exe
  2⤵
  PID:6236
- C:\Windows\System\qAFiNgD.exe
  C:\Windows\System\qAFiNgD.exe
  2⤵
  PID:6852
- C:\Windows\System\rVBHcvj.exe
  C:\Windows\System\rVBHcvj.exe
  2⤵
  PID:7480
- C:\Windows\System\zWVmXLD.exe
  C:\Windows\System\zWVmXLD.exe
  2⤵
  PID:764
- C:\Windows\System\kGYIZxo.exe
  C:\Windows\System\kGYIZxo.exe
  2⤵
  PID:6284
- C:\Windows\System\NsKscWu.exe
  C:\Windows\System\NsKscWu.exe
  2⤵
  PID:9248
- C:\Windows\System\twBLNkP.exe
  C:\Windows\System\twBLNkP.exe
  2⤵
  PID:9484
- C:\Windows\System\aGtsOII.exe
  C:\Windows\System\aGtsOII.exe
  2⤵
  PID:4724
- C:\Windows\System\pnVpiHN.exe
  C:\Windows\System\pnVpiHN.exe
  2⤵
  PID:9656
- C:\Windows\System\zxlJjQB.exe
  C:\Windows\System\zxlJjQB.exe
  2⤵
  PID:9792
- C:\Windows\System\zvqyqil.exe
  C:\Windows\System\zvqyqil.exe
  2⤵
  PID:7272
- C:\Windows\System\DwWpgCt.exe
  C:\Windows\System\DwWpgCt.exe
  2⤵
  PID:8424
- C:\Windows\System\IMYEeOn.exe
  C:\Windows\System\IMYEeOn.exe
  2⤵
  PID:9456
- C:\Windows\System\CpuKXOR.exe
  C:\Windows\System\CpuKXOR.exe
  2⤵
  PID:4600
- C:\Windows\System\fYnthWA.exe
  C:\Windows\System\fYnthWA.exe
  2⤵
  PID:2504
- C:\Windows\System\TUTsWOF.exe
  C:\Windows\System\TUTsWOF.exe
  2⤵
  PID:13132
- C:\Windows\System\hEfgcoE.exe
  C:\Windows\System\hEfgcoE.exe
  2⤵
  PID:9260
- C:\Windows\System\aDRHHEM.exe
  C:\Windows\System\aDRHHEM.exe
  2⤵
  PID:5112
- C:\Windows\System\kuXMSSp.exe
  C:\Windows\System\kuXMSSp.exe
  2⤵
  PID:7016
- C:\Windows\System\robpgYN.exe
  C:\Windows\System\robpgYN.exe
  2⤵
  PID:8724
- C:\Windows\System\qvLyVli.exe
  C:\Windows\System\qvLyVli.exe
  2⤵
  PID:10268
- C:\Windows\System\hTYGIXq.exe
  C:\Windows\System\hTYGIXq.exe
  2⤵
  PID:7004
- C:\Windows\System\lXzoRrl.exe
  C:\Windows\System\lXzoRrl.exe
  2⤵
  PID:8780
- C:\Windows\System\kUbfPKJ.exe
  C:\Windows\System\kUbfPKJ.exe
  2⤵
  PID:10340
- C:\Windows\System\bkIlMKl.exe
  C:\Windows\System\bkIlMKl.exe
  2⤵
  PID:6696
- C:\Windows\System\ahuIJFC.exe
  C:\Windows\System\ahuIJFC.exe
  2⤵
  PID:8588
- C:\Windows\System\QpYMCfB.exe
  C:\Windows\System\QpYMCfB.exe
  2⤵
  PID:10456
- C:\Windows\System\ZjwPEDC.exe
  C:\Windows\System\ZjwPEDC.exe
  2⤵
  PID:4556
- C:\Windows\System\lxBPIWC.exe
  C:\Windows\System\lxBPIWC.exe
  2⤵
  PID:10480
- C:\Windows\System\PjroZcz.exe
  C:\Windows\System\PjroZcz.exe
  2⤵
  PID:7892
- C:\Windows\System\LIuiBsC.exe
  C:\Windows\System\LIuiBsC.exe
  2⤵
  PID:8236
- C:\Windows\System\roYzqeA.exe
  C:\Windows\System\roYzqeA.exe
  2⤵
  PID:8392
- C:\Windows\System\XtzaOJZ.exe
  C:\Windows\System\XtzaOJZ.exe
  2⤵
  PID:10592
- C:\Windows\System\DEQZjIV.exe
  C:\Windows\System\DEQZjIV.exe
  2⤵
  PID:2940
- C:\Windows\System\UnlTQUZ.exe
  C:\Windows\System\UnlTQUZ.exe
  2⤵
  PID:1076
- C:\Windows\System\tDBruGw.exe
  C:\Windows\System\tDBruGw.exe
  2⤵
  PID:7132
- C:\Windows\System\GLagiZK.exe
  C:\Windows\System\GLagiZK.exe
  2⤵
  PID:4856
- C:\Windows\System\VKrQjHP.exe
  C:\Windows\System\VKrQjHP.exe
  2⤵
  PID:4092
- C:\Windows\System\tfffFmm.exe
  C:\Windows\System\tfffFmm.exe
  2⤵
  PID:2768
- C:\Windows\System\eZZVBpz.exe
  C:\Windows\System\eZZVBpz.exe
  2⤵
  PID:3372
- C:\Windows\System\HHOatFs.exe
  C:\Windows\System\HHOatFs.exe
  2⤵
  PID:9368
- C:\Windows\System\PkJRyCL.exe
  C:\Windows\System\PkJRyCL.exe
  2⤵
  PID:6048
- C:\Windows\System\IniUDYJ.exe
  C:\Windows\System\IniUDYJ.exe
  2⤵
  PID:9508
- C:\Windows\System\qgCstDD.exe
  C:\Windows\System\qgCstDD.exe
  2⤵
  PID:7360
- C:\Windows\System\oVNeZhx.exe
  C:\Windows\System\oVNeZhx.exe
  2⤵
  PID:4560
- C:\Windows\System\TibmIwn.exe
  C:\Windows\System\TibmIwn.exe
  2⤵
  PID:3612
- C:\Windows\System\JXOAsVT.exe
  C:\Windows\System\JXOAsVT.exe
  2⤵
  PID:3776
- C:\Windows\System\NOVtuhI.exe
  C:\Windows\System\NOVtuhI.exe
  2⤵
  PID:7080
- C:\Windows\System\ZiggKiR.exe
  C:\Windows\System\ZiggKiR.exe
  2⤵
  PID:4664
- C:\Windows\System\CRCsgqn.exe
  C:\Windows\System\CRCsgqn.exe
  2⤵
  PID:8148
- C:\Windows\System\VKQASto.exe
  C:\Windows\System\VKQASto.exe
  2⤵
  PID:4564
- C:\Windows\System\xAlyZCw.exe
  C:\Windows\System\xAlyZCw.exe
  2⤵
  PID:4588
- C:\Windows\System\DjstOfj.exe
  C:\Windows\System\DjstOfj.exe
  2⤵
  PID:3780
- C:\Windows\System\vBGnTkr.exe
  C:\Windows\System\vBGnTkr.exe
  2⤵
  PID:5704
- C:\Windows\System\krcmfcl.exe
  C:\Windows\System\krcmfcl.exe
  2⤵
  PID:8284
- C:\Windows\System\icmQKgB.exe
  C:\Windows\System\icmQKgB.exe
  2⤵
  PID:4612
- C:\Windows\System\hPDyEOo.exe
  C:\Windows\System\hPDyEOo.exe
  2⤵
  PID:9236
- C:\Windows\System\SDKORKs.exe
  C:\Windows\System\SDKORKs.exe
  2⤵
  PID:10616
- C:\Windows\System\fUAjKIM.exe
  C:\Windows\System\fUAjKIM.exe
  2⤵
  PID:4940
- C:\Windows\System\OyItDnr.exe
  C:\Windows\System\OyItDnr.exe
  2⤵
  PID:1712
- C:\Windows\System\qgbWQAo.exe
  C:\Windows\System\qgbWQAo.exe
  2⤵
  PID:6364
- C:\Windows\System\QbGcuZq.exe
  C:\Windows\System\QbGcuZq.exe
  2⤵
  PID:3228
- C:\Windows\System\ILzJpPb.exe
  C:\Windows\System\ILzJpPb.exe
  2⤵
  PID:9668
- C:\Windows\System\aQzGNYU.exe
  C:\Windows\System\aQzGNYU.exe
  2⤵
  PID:3796
- C:\Windows\System\irWrkaJ.exe
  C:\Windows\System\irWrkaJ.exe
  2⤵
  PID:6656
- C:\Windows\System\yxUAMhm.exe
  C:\Windows\System\yxUAMhm.exe
  2⤵
  PID:10740
- C:\Windows\System\MqgoGPl.exe
  C:\Windows\System\MqgoGPl.exe
  2⤵
  PID:10916
- C:\Windows\System\rJZovXI.exe
  C:\Windows\System\rJZovXI.exe
  2⤵
  PID:11332
- C:\Windows\System\dlhtbxs.exe
  C:\Windows\System\dlhtbxs.exe
  2⤵
  PID:11440
- C:\Windows\System\XlfUDFp.exe
  C:\Windows\System\XlfUDFp.exe
  2⤵
  PID:5340
- C:\Windows\System\fybAoax.exe
  C:\Windows\System\fybAoax.exe
  2⤵
  PID:11984
- C:\Windows\System\aQCUvOo.exe
  C:\Windows\System\aQCUvOo.exe
  2⤵
  PID:12140
- C:\Windows\System\KEyOETD.exe
  C:\Windows\System\KEyOETD.exe
  2⤵
  PID:5632
- C:\Windows\System\clXSwjS.exe
  C:\Windows\System\clXSwjS.exe
  2⤵
  PID:1068
- C:\Windows\System\qCXcvRo.exe
  C:\Windows\System\qCXcvRo.exe
  2⤵
  PID:7612
- C:\Windows\System\gegaCFn.exe
  C:\Windows\System\gegaCFn.exe
  2⤵
  PID:5508
- C:\Windows\System\FiPeixC.exe
  C:\Windows\System\FiPeixC.exe
  2⤵
  PID:992
- C:\Windows\System\wJDLLAg.exe
  C:\Windows\System\wJDLLAg.exe
  2⤵
  PID:10156
- C:\Windows\System\FbnUspP.exe
  C:\Windows\System\FbnUspP.exe
  2⤵
  PID:12148
- C:\Windows\System\lOdhTcZ.exe
  C:\Windows\System\lOdhTcZ.exe
  2⤵
  PID:5916
- C:\Windows\System\CDraKCI.exe
  C:\Windows\System\CDraKCI.exe
  2⤵
  PID:8504
- C:\Windows\System\lLOarff.exe
  C:\Windows\System\lLOarff.exe
  2⤵
  PID:5860
- C:\Windows\System\mmLmzdn.exe
  C:\Windows\System\mmLmzdn.exe
  2⤵
  PID:9868
- C:\Windows\System\JraWVVk.exe
  C:\Windows\System\JraWVVk.exe
  2⤵
  PID:2828
- C:\Windows\System\viUGFRK.exe
  C:\Windows\System\viUGFRK.exe
  2⤵
  PID:5476
- C:\Windows\System\ihhytss.exe
  C:\Windows\System\ihhytss.exe
  2⤵
  PID:6040
- C:\Windows\System\evLFEQv.exe
  C:\Windows\System\evLFEQv.exe
  2⤵
  PID:5564
- C:\Windows\System\XpLNKUD.exe
  C:\Windows\System\XpLNKUD.exe
  2⤵
  PID:7700
- C:\Windows\System\JkpAtwV.exe
  C:\Windows\System\JkpAtwV.exe
  2⤵
  PID:4520
- C:\Windows\System\aAXIgzR.exe
  C:\Windows\System\aAXIgzR.exe
  2⤵
  PID:4596
- C:\Windows\System\tAfBzOZ.exe
  C:\Windows\System\tAfBzOZ.exe
  2⤵
  PID:10116
- C:\Windows\System\wocmOWM.exe
  C:\Windows\System\wocmOWM.exe
  2⤵
  PID:12708
- C:\Windows\System\JRLmhNq.exe
  C:\Windows\System\JRLmhNq.exe
  2⤵
  PID:3672
- C:\Windows\System\mlqXEdm.exe
  C:\Windows\System\mlqXEdm.exe
  2⤵
  PID:2064
- C:\Windows\System\gmtTaaT.exe
  C:\Windows\System\gmtTaaT.exe
  2⤵
  PID:13032
- C:\Windows\System\XsEJIHx.exe
  C:\Windows\System\XsEJIHx.exe
  2⤵
  PID:7852
- C:\Windows\System\cNnwXYL.exe
  C:\Windows\System\cNnwXYL.exe
  2⤵
  PID:5192
- C:\Windows\System\ugZPFwj.exe
  C:\Windows\System\ugZPFwj.exe
  2⤵
  PID:2896
- C:\Windows\System\cfPxhYr.exe
  C:\Windows\System\cfPxhYr.exe
  2⤵
  PID:7248
- C:\Windows\System\oRpquuG.exe
  C:\Windows\System\oRpquuG.exe
  2⤵
  PID:5432
- C:\Windows\System\xvxFTzL.exe
  C:\Windows\System\xvxFTzL.exe
  2⤵
  PID:12872
- C:\Windows\System\kUSfLol.exe
  C:\Windows\System\kUSfLol.exe
  2⤵
  PID:7100
- C:\Windows\System\WiEcGzb.exe
  C:\Windows\System\WiEcGzb.exe
  2⤵
  PID:9020
- C:\Windows\System\SnXbEQh.exe
  C:\Windows\System\SnXbEQh.exe
  2⤵
  PID:4492
- C:\Windows\System\DHagkQW.exe
  C:\Windows\System\DHagkQW.exe
  2⤵
  PID:1520
- C:\Windows\System\MPnpEOh.exe
  C:\Windows\System\MPnpEOh.exe
  2⤵
  PID:412
- C:\Windows\System\dTBtKBP.exe
  C:\Windows\System\dTBtKBP.exe
  2⤵
  PID:6980
- C:\Windows\System\JvhgFgz.exe
  C:\Windows\System\JvhgFgz.exe
  2⤵
  PID:3384
- C:\Windows\System\GrAdhdp.exe
  C:\Windows\System\GrAdhdp.exe
  2⤵
  PID:2216
- C:\Windows\System\EhEFMxv.exe
  C:\Windows\System\EhEFMxv.exe
  2⤵
  PID:4752
- C:\Windows\System\rBSNVYE.exe
  C:\Windows\System\rBSNVYE.exe
  2⤵
  PID:4936
- C:\Windows\System\JahDubM.exe
  C:\Windows\System\JahDubM.exe
  2⤵
  PID:1964
- C:\Windows\System\ruuFuIz.exe
  C:\Windows\System\ruuFuIz.exe
  2⤵
  PID:4960
- C:\Windows\System\yDufbsd.exe
  C:\Windows\System\yDufbsd.exe
  2⤵
  PID:4860
- C:\Windows\System\CxTfncm.exe
  C:\Windows\System\CxTfncm.exe
  2⤵
  PID:7440
- C:\Windows\System\nSgxZTD.exe
  C:\Windows\System\nSgxZTD.exe
  2⤵
  PID:2436
- C:\Windows\System\GvfxyCa.exe
  C:\Windows\System\GvfxyCa.exe
  2⤵
  PID:10028
- C:\Windows\System\OYgLJug.exe
  C:\Windows\System\OYgLJug.exe
  2⤵
  PID:4332
- C:\Windows\System\qJibWbv.exe
  C:\Windows\System\qJibWbv.exe
  2⤵
  PID:7944
- C:\Windows\System\RJqsaPt.exe
  C:\Windows\System\RJqsaPt.exe
  2⤵
  PID:6224
- C:\Windows\System\majyFAJ.exe
  C:\Windows\System\majyFAJ.exe
  2⤵
  PID:8432
- C:\Windows\System\itEERBM.exe
  C:\Windows\System\itEERBM.exe
  2⤵
  PID:6480
- C:\Windows\System\hgZPVwv.exe
  C:\Windows\System\hgZPVwv.exe
  2⤵
  PID:10684
- C:\Windows\System\qVNkYws.exe
  C:\Windows\System\qVNkYws.exe
  2⤵
  PID:6544
- C:\Windows\System\Osqkekl.exe
  C:\Windows\System\Osqkekl.exe
  2⤵
  PID:9608
- C:\Windows\System\CgIYSti.exe
  C:\Windows\System\CgIYSti.exe
  2⤵
  PID:9716
- C:\Windows\System\JFykfqF.exe
  C:\Windows\System\JFykfqF.exe
  2⤵
  PID:11184
- C:\Windows\System\lCGJqIN.exe
  C:\Windows\System\lCGJqIN.exe
  2⤵
  PID:10920
- C:\Windows\System\UMbEvDO.exe
  C:\Windows\System\UMbEvDO.exe
  2⤵
  PID:6252
- C:\Windows\System\ubwyGbg.exe
  C:\Windows\System\ubwyGbg.exe
  2⤵
  PID:5496
- C:\Windows\System\sqinrHE.exe
  C:\Windows\System\sqinrHE.exe
  2⤵
  PID:12116
- C:\Windows\System\tClcLue.exe
  C:\Windows\System\tClcLue.exe
  2⤵
  PID:5108
- C:\Windows\System\SPWSrGU.exe
  C:\Windows\System\SPWSrGU.exe
  2⤵
  PID:7128
- C:\Windows\System\rzXOZcC.exe
  C:\Windows\System\rzXOZcC.exe
  2⤵
  PID:5804
- C:\Windows\System\uEKJoJt.exe
  C:\Windows\System\uEKJoJt.exe
  2⤵
  PID:9180
- C:\Windows\System\qGUVGrc.exe
  C:\Windows\System\qGUVGrc.exe
  2⤵
  PID:7388
- C:\Windows\System\CiVVXOR.exe
  C:\Windows\System\CiVVXOR.exe
  2⤵
  PID:7648
- C:\Windows\System\xkuwozt.exe
  C:\Windows\System\xkuwozt.exe
  2⤵
  PID:12424
- C:\Windows\System\UjzNArl.exe
  C:\Windows\System\UjzNArl.exe
  2⤵
  PID:5328
- C:\Windows\System\EutlVoC.exe
  C:\Windows\System\EutlVoC.exe
  2⤵
  PID:6084
- C:\Windows\System\ODeUnin.exe
  C:\Windows\System\ODeUnin.exe
  2⤵
  PID:7728
- C:\Windows\System\Yawjjhw.exe
  C:\Windows\System\Yawjjhw.exe
  2⤵
  PID:6976
- C:\Windows\System\cpQfmup.exe
  C:\Windows\System\cpQfmup.exe
  2⤵
  PID:5980
- C:\Windows\System\AsAnCBd.exe
  C:\Windows\System\AsAnCBd.exe
  2⤵
  PID:6124
- C:\Windows\System\dPmqZqC.exe
  C:\Windows\System\dPmqZqC.exe
  2⤵
  PID:1468
- C:\Windows\System\HeIqtwq.exe
  C:\Windows\System\HeIqtwq.exe
  2⤵
  PID:12752
- C:\Windows\System\KjSbrki.exe
  C:\Windows\System\KjSbrki.exe
  2⤵
  PID:7812
- C:\Windows\System\WEEWSFf.exe
  C:\Windows\System\WEEWSFf.exe
  2⤵
  PID:10352
- C:\Windows\System\drGuoiI.exe
  C:\Windows\System\drGuoiI.exe
  2⤵
  PID:7200
- C:\Windows\System\GCdFxkT.exe
  C:\Windows\System\GCdFxkT.exe
  2⤵
  PID:5488
- C:\Windows\System\mqtMteR.exe
  C:\Windows\System\mqtMteR.exe
  2⤵
  PID:9012
- C:\Windows\System\KbgcrYw.exe
  C:\Windows\System\KbgcrYw.exe
  2⤵
  PID:5640
- C:\Windows\System\hdZwSmP.exe
  C:\Windows\System\hdZwSmP.exe
  2⤵
  PID:4928
- C:\Windows\System\mypjZTq.exe
  C:\Windows\System\mypjZTq.exe
  2⤵
  PID:8580
- C:\Windows\System\wgptIcq.exe
  C:\Windows\System\wgptIcq.exe
  2⤵
  PID:5800
- C:\Windows\System\dEvkcpr.exe
  C:\Windows\System\dEvkcpr.exe
  2⤵
  PID:7072
- C:\Windows\System\udCmwxh.exe
  C:\Windows\System\udCmwxh.exe
  2⤵
  PID:8944
- C:\Windows\System\vZctjZN.exe
  C:\Windows\System\vZctjZN.exe
  2⤵
  PID:4220
- C:\Windows\System\qbFcSKW.exe
  C:\Windows\System\qbFcSKW.exe
  2⤵
  PID:4448
- C:\Windows\System\AMlkgaV.exe
  C:\Windows\System\AMlkgaV.exe
  2⤵
  PID:5324
- C:\Windows\System\Pzutgzj.exe
  C:\Windows\System\Pzutgzj.exe
  2⤵
  PID:8444
- C:\Windows\System\EXgtCNE.exe
  C:\Windows\System\EXgtCNE.exe
  2⤵
  PID:4968
- C:\Windows\System\HpFivYf.exe
  C:\Windows\System\HpFivYf.exe
  2⤵
  PID:8888
- C:\Windows\System\pQIXeFV.exe
  C:\Windows\System\pQIXeFV.exe
  2⤵
  PID:8332
- C:\Windows\System\QrlTXru.exe
  C:\Windows\System\QrlTXru.exe
  2⤵
  PID:6044
- C:\Windows\System\hbfcAkU.exe
  C:\Windows\System\hbfcAkU.exe
  2⤵
  PID:4396
- C:\Windows\System\zaBVeFI.exe
  C:\Windows\System\zaBVeFI.exe
  2⤵
  PID:6460
- C:\Windows\System\iBJKoOi.exe
  C:\Windows\System\iBJKoOi.exe
  2⤵
  PID:8388
- C:\Windows\System\KZBsqbN.exe
  C:\Windows\System\KZBsqbN.exe
  2⤵
  PID:7336
- C:\Windows\System\JiHpALf.exe
  C:\Windows\System\JiHpALf.exe
  2⤵
  PID:11496
- C:\Windows\System\rNGlpBe.exe
  C:\Windows\System\rNGlpBe.exe
  2⤵
  PID:11788
- C:\Windows\System\dIQWOxB.exe
  C:\Windows\System\dIQWOxB.exe
  2⤵
  PID:5284
- C:\Windows\System\zcFJAXE.exe
  C:\Windows\System\zcFJAXE.exe
  2⤵
  PID:11980
- C:\Windows\System\kpoucvM.exe
  C:\Windows\System\kpoucvM.exe
  2⤵
  PID:12060
- C:\Windows\System\KjcbkmT.exe
  C:\Windows\System\KjcbkmT.exe
  2⤵
  PID:6920
- C:\Windows\System\SVuJYiP.exe
  C:\Windows\System\SVuJYiP.exe
  2⤵
  PID:11720
- C:\Windows\System\XHOAfXb.exe
  C:\Windows\System\XHOAfXb.exe
  2⤵
  PID:7052
- C:\Windows\System\ngWnIAj.exe
  C:\Windows\System\ngWnIAj.exe
  2⤵
  PID:2732
- C:\Windows\System\VFiVgnR.exe
  C:\Windows\System\VFiVgnR.exe
  2⤵
  PID:6932
- C:\Windows\System\fGOWufz.exe
  C:\Windows\System\fGOWufz.exe
  2⤵
  PID:12648
- C:\Windows\System\KPbJPaU.exe
  C:\Windows\System\KPbJPaU.exe
  2⤵
  PID:9956
- C:\Windows\System\ONqVUZB.exe
  C:\Windows\System\ONqVUZB.exe
  2⤵
  PID:3576
- C:\Windows\System\NSeKWgg.exe
  C:\Windows\System\NSeKWgg.exe
  2⤵
  PID:8624
- C:\Windows\System\kaMNoPX.exe
  C:\Windows\System\kaMNoPX.exe
  2⤵
  PID:10188
- C:\Windows\System\pSPwiqr.exe
  C:\Windows\System\pSPwiqr.exe
  2⤵
  PID:3216
- C:\Windows\System\OPzGHtT.exe
  C:\Windows\System\OPzGHtT.exe
  2⤵
  PID:5872
- C:\Windows\System\RJQiAUn.exe
  C:\Windows\System\RJQiAUn.exe
  2⤵
  PID:10196
- C:\Windows\System\ARNJMBW.exe
  C:\Windows\System\ARNJMBW.exe
  2⤵
  PID:12636
- C:\Windows\System\LAtqaZi.exe
  C:\Windows\System\LAtqaZi.exe
  2⤵
  PID:12932
- C:\Windows\System\yKhHpte.exe
  C:\Windows\System\yKhHpte.exe
  2⤵
  PID:9992
- C:\Windows\System\Ltvjzuq.exe
  C:\Windows\System\Ltvjzuq.exe
  2⤵
  PID:7992
- C:\Windows\System\kfGcltF.exe
  C:\Windows\System\kfGcltF.exe
  2⤵
  PID:7224
- C:\Windows\System\kuMlCnl.exe
  C:\Windows\System\kuMlCnl.exe
  2⤵
  PID:7276
- C:\Windows\System\rQFBxPY.exe
  C:\Windows\System\rQFBxPY.exe
  2⤵
  PID:7968
- C:\Windows\System\degtxDF.exe
  C:\Windows\System\degtxDF.exe
  2⤵
  PID:4816
- C:\Windows\System\xUvfuNJ.exe
  C:\Windows\System\xUvfuNJ.exe
  2⤵
  PID:8680
- C:\Windows\System\gUNgNND.exe
  C:\Windows\System\gUNgNND.exe
  2⤵
  PID:13204
- C:\Windows\System\dkGyEGP.exe
  C:\Windows\System\dkGyEGP.exe
  2⤵
  PID:9296
- C:\Windows\System\RZOKDqB.exe
  C:\Windows\System\RZOKDqB.exe
  2⤵
  PID:5064
- C:\Windows\System\aAjuMli.exe
  C:\Windows\System\aAjuMli.exe
  2⤵
  PID:1056
- C:\Windows\System\wTwWlAd.exe
  C:\Windows\System\wTwWlAd.exe
  2⤵
  PID:11036
- C:\Windows\System\nXWeRFY.exe
  C:\Windows\System\nXWeRFY.exe
  2⤵
  PID:11016
- C:\Windows\System\XqaEtpv.exe
  C:\Windows\System\XqaEtpv.exe
  2⤵
  PID:6464
- C:\Windows\System\VTSXLHO.exe
  C:\Windows\System\VTSXLHO.exe
  2⤵
  PID:11172
- C:\Windows\System\ogrmLgw.exe
  C:\Windows\System\ogrmLgw.exe
  2⤵
  PID:11232
- C:\Windows\System\nJciwiW.exe
  C:\Windows\System\nJciwiW.exe
  2⤵
  PID:10900
- C:\Windows\System\yXOHSQW.exe
  C:\Windows\System\yXOHSQW.exe
  2⤵
  PID:10448
- C:\Windows\System\PBglQPT.exe
  C:\Windows\System\PBglQPT.exe
  2⤵
  PID:10424
- C:\Windows\System\SRoJUPE.exe
  C:\Windows\System\SRoJUPE.exe
  2⤵
  PID:5132
- C:\Windows\System\NlwCxaT.exe
  C:\Windows\System\NlwCxaT.exe
  2⤵
  PID:10984
- C:\Windows\System\gHULImW.exe
  C:\Windows\System\gHULImW.exe
  2⤵
  PID:10788
- C:\Windows\System\xXlUKtz.exe
  C:\Windows\System\xXlUKtz.exe
  2⤵
  PID:12236
- C:\Windows\System\KBNfMuW.exe
  C:\Windows\System\KBNfMuW.exe
  2⤵
  PID:6788
- C:\Windows\System\XPYSqcu.exe
  C:\Windows\System\XPYSqcu.exe
  2⤵
  PID:3492
- C:\Windows\System\Tlveslt.exe
  C:\Windows\System\Tlveslt.exe
  2⤵
  PID:10680
- C:\Windows\System\RvfvSZY.exe
  C:\Windows\System\RvfvSZY.exe
  2⤵
  PID:9856
- C:\Windows\System\UgNMwnK.exe
  C:\Windows\System\UgNMwnK.exe
  2⤵
  PID:6068
- C:\Windows\System\yccEkcH.exe
  C:\Windows\System\yccEkcH.exe
  2⤵
  PID:12984
- C:\Windows\System\ReGDhuY.exe
  C:\Windows\System\ReGDhuY.exe
  2⤵
  PID:11356
- C:\Windows\System\YIVpTko.exe
  C:\Windows\System\YIVpTko.exe
  2⤵
  PID:11500
- C:\Windows\System\WVTfFnI.exe
  C:\Windows\System\WVTfFnI.exe
  2⤵
  PID:6840
- C:\Windows\System\WaotDpG.exe
  C:\Windows\System\WaotDpG.exe
  2⤵
  PID:11628
- C:\Windows\System\HgaWXnx.exe
  C:\Windows\System\HgaWXnx.exe
  2⤵
  PID:9744
- C:\Windows\System\VPLoeiI.exe
  C:\Windows\System\VPLoeiI.exe
  2⤵
  PID:10508
- C:\Windows\System\XyQAFBM.exe
  C:\Windows\System\XyQAFBM.exe
  2⤵
  PID:3572
- C:\Windows\System\DGvlgTs.exe
  C:\Windows\System\DGvlgTs.exe
  2⤵
  PID:11916
- C:\Windows\System\TFORNgU.exe
  C:\Windows\System\TFORNgU.exe
  2⤵
  PID:4508
- C:\Windows\System\hxyTlMU.exe
  C:\Windows\System\hxyTlMU.exe
  2⤵
  PID:4144
- C:\Windows\System\UOClwJs.exe
  C:\Windows\System\UOClwJs.exe
  2⤵
  PID:13296
- C:\Windows\System\ExUAhVI.exe
  C:\Windows\System\ExUAhVI.exe
  2⤵
  PID:11012
- C:\Windows\System\ntIfwxf.exe
  C:\Windows\System\ntIfwxf.exe
  2⤵
  PID:9096
- C:\Windows\System\GrVJDcy.exe
  C:\Windows\System\GrVJDcy.exe
  2⤵
  PID:11800
- C:\Windows\System\nUgDEqZ.exe
  C:\Windows\System\nUgDEqZ.exe
  2⤵
  PID:11852
- C:\Windows\System\etfhbqv.exe
  C:\Windows\System\etfhbqv.exe
  2⤵
  PID:10292
- C:\Windows\System\kJHQYAz.exe
  C:\Windows\System\kJHQYAz.exe
  2⤵
  PID:11256
- C:\Windows\System\MiaYSys.exe
  C:\Windows\System\MiaYSys.exe
  2⤵
  PID:10452
- C:\Windows\System\tUiuBWy.exe
  C:\Windows\System\tUiuBWy.exe
  2⤵
  PID:11148
- C:\Windows\System\tSISJre.exe
  C:\Windows\System\tSISJre.exe
  2⤵
  PID:936
- C:\Windows\System\VZCVFFS.exe
  C:\Windows\System\VZCVFFS.exe
  2⤵
  PID:11764
- C:\Windows\System\fFVzZPR.exe
  C:\Windows\System\fFVzZPR.exe
  2⤵
  PID:12376
- C:\Windows\System\RNabEtE.exe
  C:\Windows\System\RNabEtE.exe
  2⤵
  PID:6572
- C:\Windows\System\fRgXDxl.exe
  C:\Windows\System\fRgXDxl.exe
  2⤵
  PID:5536
- C:\Windows\System\CfbWdee.exe
  C:\Windows\System\CfbWdee.exe
  2⤵
  PID:11156
- C:\Windows\System\szyqDjY.exe
  C:\Windows\System\szyqDjY.exe
  2⤵
  PID:9632
- C:\Windows\System\JiBbbcG.exe
  C:\Windows\System\JiBbbcG.exe
  2⤵
  PID:12664
- C:\Windows\System\VYWdXbv.exe
  C:\Windows\System\VYWdXbv.exe
  2⤵
  PID:9740
- C:\Windows\System\wfXdYic.exe
  C:\Windows\System\wfXdYic.exe
  2⤵
  PID:11716
- C:\Windows\System\AyvOMuh.exe
  C:\Windows\System\AyvOMuh.exe
  2⤵
  PID:11640
- C:\Windows\System\CLCYzrr.exe
  C:\Windows\System\CLCYzrr.exe
  2⤵
  PID:11808
- C:\Windows\System\LAyNrLN.exe
  C:\Windows\System\LAyNrLN.exe
  2⤵
  PID:12832
- C:\Windows\System\gQbDvUv.exe
  C:\Windows\System\gQbDvUv.exe
  2⤵
  PID:7124
- C:\Windows\System\sihNVGR.exe
  C:\Windows\System\sihNVGR.exe
  2⤵
  PID:9520
- C:\Windows\System\nUiJhbK.exe
  C:\Windows\System\nUiJhbK.exe
  2⤵
  PID:13216
- C:\Windows\System\wapldpb.exe
  C:\Windows\System\wapldpb.exe
  2⤵
  PID:12712
- C:\Windows\System\ImpcRxT.exe
  C:\Windows\System\ImpcRxT.exe
  2⤵
  PID:10568
- C:\Windows\System\rkjAusc.exe
  C:\Windows\System\rkjAusc.exe
  2⤵
  PID:11160
- C:\Windows\System\KeTbBHI.exe
  C:\Windows\System\KeTbBHI.exe
  2⤵
  PID:11360
- C:\Windows\System\fpzpzto.exe
  C:\Windows\System\fpzpzto.exe
  2⤵
  PID:6412
- C:\Windows\System\ZRAJjOO.exe
  C:\Windows\System\ZRAJjOO.exe
  2⤵
  PID:9016
- C:\Windows\System\nDpRagi.exe
  C:\Windows\System\nDpRagi.exe
  2⤵
  PID:12164
- C:\Windows\System\pyJWGal.exe
  C:\Windows\System\pyJWGal.exe
  2⤵
  PID:10492
- C:\Windows\System\JmhmTsC.exe
  C:\Windows\System\JmhmTsC.exe
  2⤵
  PID:7364
- C:\Windows\System\PiHIwhA.exe
  C:\Windows\System\PiHIwhA.exe
  2⤵
  PID:10792
- C:\Windows\System\LNzPwkc.exe
  C:\Windows\System\LNzPwkc.exe
  2⤵
  PID:11324
- C:\Windows\System\XZlHPjN.exe
  C:\Windows\System\XZlHPjN.exe
  2⤵
  PID:5784
- C:\Windows\System\MlntNki.exe
  C:\Windows\System\MlntNki.exe
  2⤵
  PID:12472
- C:\Windows\System\paxeWXi.exe
  C:\Windows\System\paxeWXi.exe
  2⤵
  PID:12740
- C:\Windows\System\FOFAKxb.exe
  C:\Windows\System\FOFAKxb.exe
  2⤵
  PID:11564
- C:\Windows\System\eRNKFYr.exe
  C:\Windows\System\eRNKFYr.exe
  2⤵
  PID:10204
- C:\Windows\System\vRvXAzQ.exe
  C:\Windows\System\vRvXAzQ.exe
  2⤵
  PID:12272
- C:\Windows\System\FQpEIQe.exe
  C:\Windows\System\FQpEIQe.exe
  2⤵
  PID:7372
- C:\Windows\System\uvhscSJ.exe
  C:\Windows\System\uvhscSJ.exe
  2⤵
  PID:11860
- C:\Windows\System\VYRewvw.exe
  C:\Windows\System\VYRewvw.exe
  2⤵
  PID:11072
- C:\Windows\System\EsArzes.exe
  C:\Windows\System\EsArzes.exe
  2⤵
  PID:13228
- C:\Windows\System\tTltZxq.exe
  C:\Windows\System\tTltZxq.exe
  2⤵
  PID:12064
- C:\Windows\System\GrOqXNN.exe
  C:\Windows\System\GrOqXNN.exe
  2⤵
  PID:12632
- C:\Windows\System\fyZhfKb.exe
  C:\Windows\System\fyZhfKb.exe
  2⤵
  PID:6428
- C:\Windows\System\HjyarcX.exe
  C:\Windows\System\HjyarcX.exe
  2⤵
  PID:2868
- C:\Windows\System\IAamejh.exe
  C:\Windows\System\IAamejh.exe
  2⤵
  PID:12380
- C:\Windows\System\gMyDXsj.exe
  C:\Windows\System\gMyDXsj.exe
  2⤵
  PID:10108
- C:\Windows\System\sAruFYm.exe
  C:\Windows\System\sAruFYm.exe
  2⤵
  PID:7884
- C:\Windows\System\fpJFhXP.exe
  C:\Windows\System\fpJFhXP.exe
  2⤵
  PID:12268
- C:\Windows\System\xmSnyrQ.exe
  C:\Windows\System\xmSnyrQ.exe
  2⤵
  PID:13264
- C:\Windows\System\Jfmguep.exe
  C:\Windows\System\Jfmguep.exe
  2⤵
  PID:9388
- C:\Windows\System\vAIxByp.exe
  C:\Windows\System\vAIxByp.exe
  2⤵
  PID:2000
- C:\Windows\System\vFMsjxQ.exe
  C:\Windows\System\vFMsjxQ.exe
  2⤵
  PID:9448
- C:\Windows\System\xwQlqHn.exe
  C:\Windows\System\xwQlqHn.exe
  2⤵
  PID:5428
- C:\Windows\System\qWHISoD.exe
  C:\Windows\System\qWHISoD.exe
  2⤵
  PID:11596
- C:\Windows\System\arNCeTB.exe
  C:\Windows\System\arNCeTB.exe
  2⤵
  PID:13248
- C:\Windows\System\FlYtFMc.exe
  C:\Windows\System\FlYtFMc.exe
  2⤵
  PID:11388
- C:\Windows\System\qmujonz.exe
  C:\Windows\System\qmujonz.exe
  2⤵
  PID:4996
- C:\Windows\System\OnYuFal.exe
  C:\Windows\System\OnYuFal.exe
  2⤵
  PID:13332
- C:\Windows\System\naIozsu.exe
  C:\Windows\System\naIozsu.exe
  2⤵
  PID:13364
- C:\Windows\System\BUMLGwx.exe
  C:\Windows\System\BUMLGwx.exe
  2⤵
  PID:13400
- C:\Windows\System\ETHKYbu.exe
  C:\Windows\System\ETHKYbu.exe
  2⤵
  PID:13428
- C:\Windows\System\LUmNTpl.exe
  C:\Windows\System\LUmNTpl.exe
  2⤵
  PID:13456
- C:\Windows\System\eVhxLwC.exe
  C:\Windows\System\eVhxLwC.exe
  2⤵
  PID:13484
- C:\Windows\System\gLhfkuH.exe
  C:\Windows\System\gLhfkuH.exe
  2⤵
  PID:13512
- C:\Windows\System\HaXSYoR.exe
  C:\Windows\System\HaXSYoR.exe
  2⤵
  PID:13540
- C:\Windows\System\tiTjLSD.exe
  C:\Windows\System\tiTjLSD.exe
  2⤵
  PID:13648
- C:\Windows\System\OpFQcXX.exe
  C:\Windows\System\OpFQcXX.exe
  2⤵
  PID:13664
- C:\Windows\System\JGStKsF.exe
  C:\Windows\System\JGStKsF.exe
  2⤵
  PID:13680
- C:\Windows\System\HKOgsJr.exe
  C:\Windows\System\HKOgsJr.exe
  2⤵
  PID:13696
- C:\Windows\System\tHdvkZP.exe
  C:\Windows\System\tHdvkZP.exe
  2⤵
  PID:13712
- C:\Windows\System\KuZXGHO.exe
  C:\Windows\System\KuZXGHO.exe
  2⤵
  PID:13740
- C:\Windows\System\kKwYVDN.exe
  C:\Windows\System\kKwYVDN.exe
  2⤵
  PID:13784
- C:\Windows\System\NHwaKcj.exe
  C:\Windows\System\NHwaKcj.exe
  2⤵
  PID:13800
- C:\Windows\System\UmWYAWS.exe
  C:\Windows\System\UmWYAWS.exe
  2⤵
  PID:13824
- C:\Windows\System\ZtDJxMG.exe
  C:\Windows\System\ZtDJxMG.exe
  2⤵
  PID:13872
- C:\Windows\System\qgSQapv.exe
  C:\Windows\System\qgSQapv.exe
  2⤵
  PID:13904
- C:\Windows\System\zIdVxyA.exe
  C:\Windows\System\zIdVxyA.exe
  2⤵
  PID:14004
- C:\Windows\System\jnDEmeu.exe
  C:\Windows\System\jnDEmeu.exe
  2⤵
  PID:14028
- C:\Windows\System\KiYEZAX.exe
  C:\Windows\System\KiYEZAX.exe
  2⤵
  PID:14060
- C:\Windows\System\bqoYWDv.exe
  C:\Windows\System\bqoYWDv.exe
  2⤵
  PID:14088
- C:\Windows\System\kYZLPbx.exe
  C:\Windows\System\kYZLPbx.exe
  2⤵
  PID:14116
- C:\Windows\System\HmDEmKd.exe
  C:\Windows\System\HmDEmKd.exe
  2⤵
  PID:14144
- C:\Windows\System\krwFNnZ.exe
  C:\Windows\System\krwFNnZ.exe
  2⤵
  PID:14172
- C:\Windows\System\QohJEcB.exe
  C:\Windows\System\QohJEcB.exe
  2⤵
  PID:14200
- C:\Windows\System\uSUtuBm.exe
  C:\Windows\System\uSUtuBm.exe
  2⤵
  PID:14228
- C:\Windows\System\DVpUiBC.exe
  C:\Windows\System\DVpUiBC.exe
  2⤵
  PID:14256
- C:\Windows\System\CEKhgvM.exe
  C:\Windows\System\CEKhgvM.exe
  2⤵
  PID:14284
- C:\Windows\System\spbZrsz.exe
  C:\Windows\System\spbZrsz.exe
  2⤵
  PID:14312
- C:\Windows\System\fpvISFt.exe
  C:\Windows\System\fpvISFt.exe
  2⤵
  PID:13320
- C:\Windows\System\gIWxKav.exe
  C:\Windows\System\gIWxKav.exe
  2⤵
  PID:13388
- C:\Windows\System\zWNNMUv.exe
  C:\Windows\System\zWNNMUv.exe
  2⤵
  PID:13452
- C:\Windows\System\cmCneui.exe
  C:\Windows\System\cmCneui.exe
  2⤵
  PID:13520
- C:\Windows\System\KixTDOT.exe
  C:\Windows\System\KixTDOT.exe
  2⤵
  PID:13656
- C:\Windows\System\vCdZdmJ.exe
  C:\Windows\System\vCdZdmJ.exe
  2⤵
  PID:13672
- C:\Windows\System\FwaiCRv.exe
  C:\Windows\System\FwaiCRv.exe
  2⤵
  PID:13600
- C:\Windows\System\hzppTeI.exe
  C:\Windows\System\hzppTeI.exe
  2⤵
  PID:13636
- C:\Windows\System\xwXXEYq.exe
  C:\Windows\System\xwXXEYq.exe
  2⤵
  PID:13720
- C:\Windows\System\vPDDxAV.exe
  C:\Windows\System\vPDDxAV.exe
  2⤵
  PID:13808
- C:\Windows\System\vFJtVJK.exe
  C:\Windows\System\vFJtVJK.exe
  2⤵
  PID:13752
- C:\Windows\System\uYhflHI.exe
  C:\Windows\System\uYhflHI.exe
  2⤵
  PID:13948
- C:\Windows\System\gOplkZy.exe
  C:\Windows\System\gOplkZy.exe
  2⤵
  PID:13976
- C:\Windows\System\iLgEJLG.exe
  C:\Windows\System\iLgEJLG.exe
  2⤵
  PID:14048
- C:\Windows\System\XRWWXWo.exe
  C:\Windows\System\XRWWXWo.exe
  2⤵
  PID:14104
- C:\Windows\System\vWmgkEg.exe
  C:\Windows\System\vWmgkEg.exe
  2⤵
  PID:14168
- C:\Windows\System\LiZxzOc.exe
  C:\Windows\System\LiZxzOc.exe
  2⤵
  PID:14236
- C:\Windows\System\EkxhYsI.exe
  C:\Windows\System\EkxhYsI.exe
  2⤵
  PID:14300
- C:\Windows\System\FjKDMlz.exe
  C:\Windows\System\FjKDMlz.exe
  2⤵
  PID:13380
- C:\Windows\System\BkHkMsV.exe
  C:\Windows\System\BkHkMsV.exe
  2⤵
  PID:13536
- C:\Windows\System\BezyNRk.exe
  C:\Windows\System\BezyNRk.exe
  2⤵
  PID:13584
- C:\Windows\System\cjjHmpK.exe
  C:\Windows\System\cjjHmpK.exe
  2⤵
  PID:13704
- C:\Windows\System\jixijZX.exe
  C:\Windows\System\jixijZX.exe
  2⤵
  PID:13760
- C:\Windows\System\TSiHosO.exe
  C:\Windows\System\TSiHosO.exe
  2⤵
  PID:5548
- C:\Windows\System\arSzAcc.exe
  C:\Windows\System\arSzAcc.exe
  2⤵
  PID:13940
- C:\Windows\System\dzCaJIY.exe
  C:\Windows\System\dzCaJIY.exe
  2⤵
  PID:14096
- C:\Windows\System\ovqzWfK.exe
  C:\Windows\System\ovqzWfK.exe
  2⤵
  PID:14272
- C:\Windows\System\qmDxisv.exe
  C:\Windows\System\qmDxisv.exe
  2⤵
  PID:13568
- C:\Windows\System\nEbYQrI.exe
  C:\Windows\System\nEbYQrI.exe
  2⤵
  PID:13844
- C:\Windows\System\otoMFIp.exe
  C:\Windows\System\otoMFIp.exe
  2⤵
  PID:14036
- C:\Windows\System\fhaffoA.exe
  C:\Windows\System\fhaffoA.exe
  2⤵
  PID:13472
- C:\Windows\System\QbulIyb.exe
  C:\Windows\System\QbulIyb.exe
  2⤵
  PID:14000
- C:\Windows\System\PJBTKiu.exe
  C:\Windows\System\PJBTKiu.exe
  2⤵
  PID:13944
- C:\Windows\System\RLMQywv.exe
  C:\Windows\System\RLMQywv.exe
  2⤵
  PID:5016
- C:\Windows\System\HssfdFP.exe
  C:\Windows\System\HssfdFP.exe
  2⤵
  PID:14364
- C:\Windows\System\AMXoDso.exe
  C:\Windows\System\AMXoDso.exe
  2⤵
  PID:14432
- C:\Windows\System\yyIVWqX.exe
  C:\Windows\System\yyIVWqX.exe
  2⤵
  PID:14484
- C:\Windows\System\Xhgtenf.exe
  C:\Windows\System\Xhgtenf.exe
  2⤵
  PID:14500
- C:\Windows\System\vLdNlNg.exe
  C:\Windows\System\vLdNlNg.exe
  2⤵
  PID:14516
- C:\Windows\System\ttUcjIx.exe
  C:\Windows\System\ttUcjIx.exe
  2⤵
  PID:14532
- C:\Windows\System\wtraPrX.exe
  C:\Windows\System\wtraPrX.exe
  2⤵
  PID:14552
- C:\Windows\System\IgHqYus.exe
  C:\Windows\System\IgHqYus.exe
  2⤵
  PID:14580
- C:\Windows\System\kpVyddU.exe
  C:\Windows\System\kpVyddU.exe
  2⤵
  PID:14596
- C:\Windows\System\HvomDYJ.exe
  C:\Windows\System\HvomDYJ.exe
  2⤵
  PID:14612
- C:\Windows\System\qfuvNoU.exe
  C:\Windows\System\qfuvNoU.exe
  2⤵
  PID:14628
- C:\Windows\System\eaKrdRv.exe
  C:\Windows\System\eaKrdRv.exe
  2⤵
  PID:14644
- C:\Windows\System\AfnvPMG.exe
  C:\Windows\System\AfnvPMG.exe
  2⤵
  PID:14688
- C:\Windows\System\pWYmUsQ.exe
  C:\Windows\System\pWYmUsQ.exe
  2⤵
  PID:14716
- C:\Windows\System\TYsAnxO.exe
  C:\Windows\System\TYsAnxO.exe
  2⤵
  PID:14744
- C:\Windows\System\CSWZRxS.exe
  C:\Windows\System\CSWZRxS.exe
  2⤵
  PID:14788
- C:\Windows\System\cUnjxJS.exe
  C:\Windows\System\cUnjxJS.exe
  2⤵
  PID:14832
- C:\Windows\System\ZWJitGT.exe
  C:\Windows\System\ZWJitGT.exe
  2⤵
  PID:14868
- C:\Windows\System\yMcdnwe.exe
  C:\Windows\System\yMcdnwe.exe
  2⤵
  PID:14920
- C:\Windows\System\DylfPPi.exe
  C:\Windows\System\DylfPPi.exe
  2⤵
  PID:14968
- C:\Windows\System\XbdWnxp.exe
  C:\Windows\System\XbdWnxp.exe
  2⤵
  PID:15004
- C:\Windows\System\MyWwqwP.exe
  C:\Windows\System\MyWwqwP.exe
  2⤵
  PID:15032
- C:\Windows\System\yfieyqg.exe
  C:\Windows\System\yfieyqg.exe
  2⤵
  PID:15064
- C:\Windows\System\nHxNXCi.exe
  C:\Windows\System\nHxNXCi.exe
  2⤵
  PID:15092
- C:\Windows\System\VeHVYxH.exe
  C:\Windows\System\VeHVYxH.exe
  2⤵
  PID:15120

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 3848 -i 3848 -h 472 -j 476 -s 484 -d 456
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g43n4j42.41s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CKjzywl.exe

Filesize
2.2MB

MD5
2e5e36e346bedad17bc96b27ceaa1298

SHA1
d2bb291ffb81fed087c8a0d6f692ec100fb8bb2c

SHA256
89ca1724026c378c5fdaccfb26c253892b919386c7694ca1ded3c0400fe897f3

SHA512
901d7a2529dc14c86c0f2ae0ab2b062dee7fc1e39222fb6a6cc02f3802108d2ff1a836e7887da458b050fa76950ec551ff396826529976144924b1dd343eb891

Download Submit
C:\Windows\System\DHMxBlq.exe

Filesize
2.2MB

MD5
9f3531737ef78e661836288a001cd960

SHA1
6de0899490b044bd32211a3f37facc986d260dd6

SHA256
48fd01a93a1aa98fbb1501a67375215b381267472bbbc5b8fca7bfe406adaf24

SHA512
2cfa592436781106e71eb8181ea1c3e5483abb4b425a518479b1cb10d9d45629b571afa173383aba28cd2c58cc85843c1a6a169a51d84c91464e5a824878eff9

Download Submit
C:\Windows\System\DtzZJMZ.exe

Filesize
2.2MB

MD5
ee895ea53cc636ad1da35fdaf8ab9d86

SHA1
80438ae1f97a81307abc52d85fca88c6c41ca87d

SHA256
9084450e57d217bcf9c8c6b2c39ab1030677d8bc2d8c0f1f6c2f16bf08b7aece

SHA512
2e384db3f58fa1fd478f45975bd3076eb7e0eead259e24da8e15beca45f63960ee7bba801186e4bc08e133df1fc3fa315950a9c08feb7f1f101bd567d53cae6a

Download Submit
C:\Windows\System\GVPVwie.exe

Filesize
2.2MB

MD5
087caa141cd28c5977fe142392b26859

SHA1
e1084ee3d7acb77009aac3c3b02d54cb974711cd

SHA256
50c39fe9a3cc75a12093c743f0849e5ca54b9916e87f047cafdf5f6e1a3ac6aa

SHA512
32232af3489bf62088916a04a76df889e4affcb6a99653f9a887f68844166289591cb19b3ca229329a451da1d534e7e9432d21851ffacb2a24e8fc88cf1eb35c

Download Submit
C:\Windows\System\ISOdHuH.exe

Filesize
2.2MB

MD5
1c8bc67e0677574912668ccd3d232e2d

SHA1
405f510097e3f026e4f4cd5f75440eb5f940663d

SHA256
48e639058e8b85807c77a5e3689502a4065886e4e31d4c8760ad8bd60f185019

SHA512
8d49df594a42526c21356334a9daf59e30500c4f95ab78e0f34aad439a6711bd668533d3c23c4909c14813011a74b4cadc42ffb2033ea56699b60766ea5bee00

Download Submit
C:\Windows\System\OqWkAQT.exe

Filesize
2.2MB

MD5
e51cf8a1337b129a64e0072b5f00745c

SHA1
97ceafc50f840d8d46f9d2ac01b91df2d9fa1457

SHA256
798365f0e8f8a95951b85cff140974e23eb1cf8d09a20ee0feb9eac5379bca42

SHA512
96de9a5c8fd74896e203e06dd4d4bb3fbc5cb1b6d7040612aa1362164f63388138d5f029a191aa3ee88b2f2c588b7a3c59726444a84d9ae8dd7879e239eee73c

Download Submit
C:\Windows\System\QFZvtdl.exe

Filesize
2.2MB

MD5
72b29b43b6ccfe1cf4b9888eef6de9b2

SHA1
51ae28a88e39344a64593e6efa6873addcda0df4

SHA256
5214c6f3fd0305ab128ce601e30388a0fc5ebc5135a5e9a22eca37958207fd2c

SHA512
294f91914deca8e528be50f9e6fbf84dcf0a909d8274490910ff293be34874cb1756508b5388fac36ef474e4f6f6d5aafbdc489054a20ce955d070e9825cbd05

Download Submit
C:\Windows\System\QJXwrlN.exe

Filesize
2.2MB

MD5
6e3653f68345cde2f9aade66bc10a325

SHA1
87179a3e0da2c227fcc3d936b0d14e1a5d1e0a28

SHA256
b69bd6452fd811b16161ef40be7d4e62b0b11703c950b1e129302f6e96a9894b

SHA512
4b0de1a99dd90f407681f45094426fcb11276837fbd80ee70b56af53672d11e0c3c51e60d5582b6097f713b5c6b14615354acc966684966a1a972efaab212576

Download Submit
C:\Windows\System\QSSFFIn.exe

Filesize
2.2MB

MD5
1d2c7a7ac292751c42d1ed5e2ac09d78

SHA1
1b23c497a8c5d67af0abce74988a68cfb233f726

SHA256
287196b65483c8bbe0fae69a34e3819c056fc24884f2338f809042b64c9aa961

SHA512
84ef68f268d8e43125eb3a2897af9f36ab04f6ec9261fa07aa45e14ec86b7a9d99c1307bb0b19df913e27dcdf00b3836d40f56c9bf7efaafea0bc0e1f8c5729a

Download Submit
C:\Windows\System\QxuzOwC.exe

Filesize
2.2MB

MD5
bc0180baae564db454a5024d1e7340d6

SHA1
1e7d8fa793dfb057b20fb03f2f30715643630d60

SHA256
bb8c5b8a890b6c55a4ff7a9befba2e17adb845134cdce70c3ef7e794587473b6

SHA512
c55ae8d15551f6c1c729ee1ea95db7143f41704a1192a1579fd979c3e94ac03e0470fd568007f59683876b4390ee5905da40b5b36107d414a603c38687419242

Download Submit
C:\Windows\System\aJtEXsP.exe

Filesize
2.2MB

MD5
f275f62536a84472d7bd5c981921ca1d

SHA1
6ee03078a9702a301b36298db262421c7f90cb51

SHA256
7471ae677be177a43a92cf01ee09497f8c9fb1dfa8db4e44dac4f6368a94f652

SHA512
e612a5e063340178a8aa4ddb0af55eaf7c6698410163861fcb57a067223fb5f77419b7933b01e4ede9e18c36561525d10b71d2a1667bb38bdcc0207a1bc63ce2

Download Submit
C:\Windows\System\bGUPhZl.exe

Filesize
2.2MB

MD5
cbcb0083121827b1bbfab7443e5fd26f

SHA1
c01949240304863d6ed7dc5104bab72293c5b2b4

SHA256
25a96cafdba81169bcc79868f591fb87aa4c5a6be8c183e823c582aba7b72f5b

SHA512
4dbde4f6732289e1f2a1b956e5bff2fac3f0260e98f25e456f044ee2a4e75fef802132f86aca1791e2aa66778a953e1f8d90085dd30869de6234808c0700114d

Download Submit
C:\Windows\System\cJsBOgZ.exe

Filesize
2.2MB

MD5
967cbc0890af6337fe7490b9a8c8bf92

SHA1
a916887324af47912ad5c4aad8444c712d8b3438

SHA256
3aa1f1441d00737019166b3e2901f981d72395dc9ae4e20d3444b6bae93db8a3

SHA512
b81cbef293d7987a4c48b16154e6742c96b0da6f21c14ffc5d38cc145bb88a6ee493aaeddba60cead6ab844d3689f392dcc5c640feac22b495c3a5093c065995

Download Submit
C:\Windows\System\dLwiZCe.exe

Filesize
2.2MB

MD5
996883f42123a2d5b282e257d1aecc14

SHA1
2c1a0dbb731b4102c90cbb8fb5045f132fe4c528

SHA256
952a62df675429f9a580457f098dd29d71a686d94609d804bdb8310f764699c3

SHA512
319e4bb2d61b5bd9618f5d831afd5ba592561855dad65fd2dc23185e06b72fece72e9176d0aeff43e544b2c2b2eacc01d7c6eb35cb7ba35b140157e2ebeb29d5

Download Submit
C:\Windows\System\eQbBhhQ.exe

Filesize
2.2MB

MD5
70741a7d6bb2697779a9664f90446080

SHA1
7fb3f046450b6308b91be69409522c40ea5e2a74

SHA256
52dc7029edc1005accb116a64f3cb1597dc0a70c86b2246fccfcfa2e1388fcae

SHA512
4084be110f90e56d8d20e5e76284e16643833f88ca74b2e61b88b18e270b158613ed1643b01a400d905aeb6969636fbc9c847b13f70bb0614bd5187d89f32fca

Download Submit
C:\Windows\System\eUiUpWE.exe

Filesize
8B

MD5
ce98e4fb0d1b3e55b413072afff0d9b0

SHA1
ea92124ca4b7f582ca9bded1d03be27e59b4ea59

SHA256
ff9bed5abd6e63c0617526102c0f954cef8653d22647e6d0cc15dd6455af1a78

SHA512
b03d5e8e2563e87b69e649ee452bd2c1714db6cee8c57a2d9c80350a9bfea4a14df4deeed12085a7535561f33b8025c13820b94443ecdbd732b098776b2234a9

Download Submit
C:\Windows\System\eddLhqP.exe

Filesize
2.2MB

MD5
2b1a4b24fee263e6a8560a8bd2fecebf

SHA1
f38b4cfdd16899c025e6f45e611efb4495324ea7

SHA256
10632a1e1faef24f0c374ffe314e4ff2d3060e407982a0bfb2c78e11a7982b1e

SHA512
793b5d0ae867180e3cdd2178f877c17e98a7096a358435042bbba46c4f502b872f97c9949ca6b7d75c5dd8a69ac6382e0fe4957b23817fe89e3ad6e26ecd9e01

Download Submit
C:\Windows\System\hGlinuk.exe

Filesize
2.2MB

MD5
7e6f0f4fa1e01bf7fbcc25d13aa9eca9

SHA1
c0e13e31ec61bee58cd0b46457653ff093e5e6b2

SHA256
24738d0ea50e4570334b7003c4fb43874a31512a0b741bd533cbc7292a5eba47

SHA512
ce0d95012ad8cf5de5b7eac932fe2aa60ba3862e2a42de33c53c0ebc771321bf71b1946d67f47c3bc442b8c9f1d29f0965596c1cae7551df161170e12fd84538

Download Submit
C:\Windows\System\inqTeEj.exe

Filesize
2.2MB

MD5
f7e1da7259230a8d2d03d92bf7e7ded7

SHA1
f81e769f8099fe1b62f9e125d9fdc1c23648dbdd

SHA256
65fdc13153817661928b3e3b99d73704ed7bf0df762cf995dd8a694e504c96d5

SHA512
c4c66b63beee9012ec8f90133387a692beea9b941433cb97b48bfc6ccc189f35692dcf4ee9333c8800d8d940502285c2ef1a4661b9a02cffb5dc3150b277dbe6

Download Submit
C:\Windows\System\jRkfxBr.exe

Filesize
2.2MB

MD5
f619dd41204cd831ad4ca79fbb420510

SHA1
ba2c11fbde0222f3db77b6023a17c0b9368f2f61

SHA256
de57712bb614c1ad91adb1e6b25d973bb61e59ca38244c96988047b9fd7ca64b

SHA512
9083e6d15bd558d342e726ad50d78a21f07e978b56e26988ee30b819b0ca63f10957c43158646805ca5dc4c61f7a67a9436a646e3e1f389fe43bdc08d617fd4d

Download Submit
C:\Windows\System\jslVZhX.exe

Filesize
2.2MB

MD5
e5c6c7782423291db03da2d040ce234d

SHA1
547f59dc9fe8b82af8cc5c9501e09b97c6219af0

SHA256
fa96b5c70bef09e1a957c0e0e852f80923e9ed453182ec3b7bf9de1b229bd0ea

SHA512
9ddbae91340165af5e2cea1cb2a9972066afe86407aa55aff190d54507e409c5e11a64b4ef8d221f196c5a9ff1693eaaca4d57ecf7d3fc5728710624db5f1262

Download Submit
C:\Windows\System\lYsmCHy.exe

Filesize
2.2MB

MD5
a96f2c0abb924b31f354b54c8c5b8954

SHA1
124b50a0748004b0ccddc7fefffd16cea94af605

SHA256
f154a3d96e3408c472a495805c678302f2bdd9280add07f9c8ca2fdf5808f7a9

SHA512
d81b8c0259aeabd7ad4c5640a253bbb1e6e9cd6d0d35871caaa7c2037c824f365db05ca3c1838060a910ef736374574168ee01eb029dc80bdfd72f11e3bd180e

Download Submit
C:\Windows\System\miOPifF.exe

Filesize
2.2MB

MD5
f6f3a52fc9306a46dffae1dca96ffde7

SHA1
eef2bc158c72e3f7a4152b4b0cd918db62c55d8d

SHA256
f9a57d617d4ac63d77062077acf1ede0dc571714e2971817aa5a1299e52eac3c

SHA512
bb488d3af2033e1ab5f525446f666b3b9079cc0dabb536bd78998910a1705f6cc314604eb05ac900ee87e8a06ad3ef7e2bc0d082f9a4ed569c6c7e0c03ba2c93

Download Submit
C:\Windows\System\mtOwTQL.exe

Filesize
2.2MB

MD5
f24287731924f9973a9fe77dee95f75a

SHA1
da9b0ebdf081d600755046a2fc125b68b6043ddb

SHA256
337e9b98240e83ddd47503ed66ddcb78c088dfaca5da6c21bd593c6c656216a3

SHA512
e13f289cbc089853c19cf6d59cdd45bf4792960bba4b3dbf1904586b9f69a6ba6cbbbf66f88e1c520107c0cf55e53085648d7b8c29abaedd5e808c97f71e76a2

Download Submit
C:\Windows\System\nQOGdgp.exe

Filesize
2.2MB

MD5
b3bde8811698b96d4afadace7ac4a7cb

SHA1
8ad4c74800c23ff800da3a0171f4cfb67e2f95c8

SHA256
e3f1161e78a62aab6e48f031582b179e86cf0d8f096bdfc4d7fb4def4b9475b4

SHA512
3d785058e08371d79ed16b8036c396e5e19c85473ae14d762a0f1bd739c5340f156501c6e2ca42afd4b60a326e83acd238da044b5cda4b9d68ad588bffacf937

Download Submit
C:\Windows\System\oQwOxYk.exe

Filesize
2.2MB

MD5
a1fb022f3b50c20a4638f7d6ae596a7c

SHA1
154ed367a7886f912eaa9909667f6a8ae9fc345b

SHA256
135939cf1a5415b493e12bb16c4cbdb0eb4cef244a2f4b9398571235f4d50fad

SHA512
ab8671393b5cbd9a467d4343cb62dae85e646a7c200a5851257edf0562663c8a2527b6afe9548ada58bfcf5d6138f917a5667605615e1a1a2eb220ea46d27120

Download Submit
C:\Windows\System\qPKYUCI.exe

Filesize
2.2MB

MD5
6e406b8b15fcc2a9bfbc14b0f927e789

SHA1
4e354f73d6445a38ba34192604655a8bc80c35fe

SHA256
1df008e73f4c01786eccc97093c6d9e91c29b05cf7606b4ab5123b8f99681194

SHA512
973557d8d8c8726b14e20a712067b81b5777663b3c1f767e5661285e36732b704008d6862b2e0df2012d0593237e5c9d4eb230ad40d28778e4b589cd339cacc1

Download Submit
C:\Windows\System\rNvjGmV.exe

Filesize
2.2MB

MD5
1764e1ee2e3aeb7712b50ca4e8dcb952

SHA1
194e4e330126f7cd7ffecdab86961df107f3f7f5

SHA256
6c4db1435cc1572d52461aabb3a5692ead03012d45e80bc86408c23cd8de2f78

SHA512
c07d04b10bfe7048912652df88a2171e0bac9a4fb8024f110f677d223743630824bbf746f45e0166784140c7ed2d860e8fe8c55a1e47c267d00727380296cab9

Download Submit
C:\Windows\System\tyCrCqo.exe

Filesize
2.2MB

MD5
39fc18e5de7361539ad6a52cf24b0b7f

SHA1
93f45c77df80f0bd621f145d16f0204cf41d8c8f

SHA256
5e33b9154cc79b857be6e36f949b20370311513b4089be7929c752d60d6b522f

SHA512
5a11ee63fb3b214b63106051988fa2f073b02e6e9b6bfdf6455b50c8fe87aa8d5890f7b8327d48c4e6aae8b8a1276aa7bd276cf5881f572ffb11da2d2b80022b

Download Submit
C:\Windows\System\ukTjTzv.exe

Filesize
18B

MD5
b0ce6cfd7adfa2a2ac8258485a5cb279

SHA1
7b40a580431de17fbac688fb86de9bd5a156cd21

SHA256
bd650a2baf71609d723ebd75e0c6c938067406e57d5e80cec86bd9162ab5b10c

SHA512
107fc307e13b0ac2fdfd2a988662ef1274a95d78ff717c971632ef49ca9c9ef1a3e2bfaf20cde619c9ddc0ce2412de1ca0af65582b8a143eef4fd273e3c869f6

Download Submit
C:\Windows\System\vkekPbP.exe

Filesize
2.2MB

MD5
a78fac2483222faa8f82e6463af6579d

SHA1
15b26eed0619c1dd3cd348f442ca84307ee4f9f9

SHA256
ff0dd8330ec8deeca1af97cee050a94df22f736588b659b06aa1c8910a464205

SHA512
d40b0d0326d2d6acbcb43866dd64e8c07882d7db066c47492cc1c285cd585670b30112e4b3313113b63d4757eb20802b3ff5726d2b4da5e1ebed33ab83af8ad4

Download Submit
C:\Windows\System\yPDZBxh.exe

Filesize
2.2MB

MD5
ae480b21b36a5cc8fdbb97c50a1ea3fe

SHA1
d1bc691fae09efced75a3f70107b0f1907b7ca94

SHA256
4847cb0674d10f9eefe7c33e25f3f8a937ceab18d6cfe4039c18aae1a4ad6bad

SHA512
cc8b55dc463daccb8059c849cb630832945b031133402e71f0cfac15571349b411cb21f10d91e3e01884cbb1e31c8be59f7f971e68f8c94da2054cf0474af783

Download Submit
C:\Windows\System\ynjXFrJ.exe

Filesize
2.2MB

MD5
ae8fd73c411facab376c334dc05f07e9

SHA1
6acff80e008b066d53b226aefdd926cd02544c84

SHA256
592b9847906d5d1fefcac4838c0d1d2f5f7f1cc7b70c4e7890b01109a2572f4f

SHA512
a0010f8d86fadce835f29fdd5245a5bdb64d0b9fc0e93c8dfd84ab0947b35a469adef00b3a22eb1bdf049d62188b863a93c9e29ad83ccfa7f9124a9d39c42ec3

Download Submit
C:\Windows\System\zCioVib.exe

Filesize
2.2MB

MD5
88faa7e4cc66e760cf162d7fdd22ef61

SHA1
1b282c443c32e8c2643885e830b12b8be1bf98aa

SHA256
6ba59f269b44027c015000ca1bf8192a984c88d320af29f2c31ba7ace71671e5

SHA512
47b09bc0a0bce962eaea39f567c0d26bca1433cf01d3cacb7c0062e6271fad0abe95759db2fbac9ec4c615885d6dc5a314f34935506f79dd9bb3ca7dff90743b

Download Submit
C:\Windows\System\zogBkWF.exe

Filesize
2.2MB

MD5
c054dd12fd73aa322cda1da6861c8b93

SHA1
5e7dea778e1ec6434967923cf81f32a9a9ce7519

SHA256
239be0ac0598c072e967d0cc929c41ed4cd2f5ceb4cc2eaac7d177276fdecbbf

SHA512
6827b9cb5f24cddb498b51416a1cfb243ddcccdd7015896d88604d329dea91786582a8ddc4f192c467744c003f31eaec31d71187436f31838376c990d46c7597

Download Submit
memory/216-149-0x00007FF656120000-0x00007FF656512000-memory.dmp

Filesize
3.9MB

Download
memory/364-140-0x00007FF692E70000-0x00007FF693262000-memory.dmp

Filesize
3.9MB

Download
memory/448-7000-0x00007FF6359F0000-0x00007FF635DE2000-memory.dmp

Filesize
3.9MB

Download
memory/448-30-0x00007FF6359F0000-0x00007FF635DE2000-memory.dmp

Filesize
3.9MB

Download
memory/664-145-0x00007FF73E640000-0x00007FF73EA32000-memory.dmp

Filesize
3.9MB

Download
memory/664-5249-0x00007FF73E640000-0x00007FF73EA32000-memory.dmp

Filesize
3.9MB

Download
memory/724-48-0x00007FF609530000-0x00007FF609922000-memory.dmp

Filesize
3.9MB

Download
memory/752-10-0x00007FF635A10000-0x00007FF635E02000-memory.dmp

Filesize
3.9MB

Download
memory/1180-1-0x0000014C72F00000-0x0000014C72F10000-memory.dmp

Filesize
64KB

Download
memory/1180-1441-0x00007FF668050000-0x00007FF668442000-memory.dmp

Filesize
3.9MB

Download
memory/1180-0-0x00007FF668050000-0x00007FF668442000-memory.dmp

Filesize
3.9MB

Download
memory/1244-25-0x000001E1EDE20000-0x000001E1EDE30000-memory.dmp

Filesize
64KB

Download
memory/1244-43-0x000001E1EDC90000-0x000001E1EDCB2000-memory.dmp

Filesize
136KB

Download
memory/1244-26-0x000001E1EDE20000-0x000001E1EDE30000-memory.dmp

Filesize
64KB

Download
memory/1244-306-0x000001E1EEC40000-0x000001E1EF3E6000-memory.dmp

Filesize
7.6MB

Download
memory/1244-1449-0x00007FFFBA0C0000-0x00007FFFBAB81000-memory.dmp

Filesize
10.8MB

Download
memory/1244-1965-0x000001E1EDE20000-0x000001E1EDE30000-memory.dmp

Filesize
64KB

Download
memory/1244-24-0x00007FFFBA0C0000-0x00007FFFBAB81000-memory.dmp

Filesize
10.8MB

Download
memory/1460-112-0x00007FF6C3440000-0x00007FF6C3832000-memory.dmp

Filesize
3.9MB

Download
memory/1624-110-0x00007FF75BA90000-0x00007FF75BE82000-memory.dmp

Filesize
3.9MB

Download
memory/1688-98-0x00007FF617FB0000-0x00007FF6183A2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-7147-0x00007FF617FB0000-0x00007FF6183A2000-memory.dmp

Filesize
3.9MB

Download
memory/1824-78-0x00007FF6B92E0000-0x00007FF6B96D2000-memory.dmp

Filesize
3.9MB

Download
memory/1928-92-0x00007FF608DB0000-0x00007FF6091A2000-memory.dmp

Filesize
3.9MB

Download
memory/3100-32-0x00007FF749210000-0x00007FF749602000-memory.dmp

Filesize
3.9MB

Download
memory/3100-1969-0x00007FF749210000-0x00007FF749602000-memory.dmp

Filesize
3.9MB

Download
memory/3156-2553-0x00007FF6D0D20000-0x00007FF6D1112000-memory.dmp

Filesize
3.9MB

Download
memory/3156-104-0x00007FF6D0D20000-0x00007FF6D1112000-memory.dmp

Filesize
3.9MB

Download
memory/3752-86-0x00007FF7993F0000-0x00007FF7997E2000-memory.dmp

Filesize
3.9MB

Download
memory/4188-83-0x00007FF61F130000-0x00007FF61F522000-memory.dmp

Filesize
3.9MB

Download
memory/4336-115-0x00007FF6D5930000-0x00007FF6D5D22000-memory.dmp

Filesize
3.9MB

Download
memory/4336-7199-0x00007FF6D5930000-0x00007FF6D5D22000-memory.dmp

Filesize
3.9MB

Download
memory/4364-71-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp

Filesize
3.9MB

Download
memory/4364-1977-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp

Filesize
3.9MB

Download
memory/4516-144-0x00007FF701970000-0x00007FF701D62000-memory.dmp

Filesize
3.9MB

Download
memory/4832-1974-0x00007FF6AE430000-0x00007FF6AE822000-memory.dmp

Filesize
3.9MB

Download
memory/4832-55-0x00007FF6AE430000-0x00007FF6AE822000-memory.dmp

Filesize
3.9MB

Download
memory/4900-87-0x00007FF6229C0000-0x00007FF622DB2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-2270-0x00007FF7CEB90000-0x00007FF7CEF82000-memory.dmp

Filesize
3.9MB

Download
memory/5084-7158-0x00007FF7CEB90000-0x00007FF7CEF82000-memory.dmp

Filesize
3.9MB

Download
memory/5084-85-0x00007FF7CEB90000-0x00007FF7CEF82000-memory.dmp

Filesize
3.9MB

Download