xmrig | 1381bf81d77477dc1d08f83a89ff98b42a1df87887f633d82e9d9202c9025802

Analysis

max time kernel
152s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
Size

2.3MB
MD5

06da40cbdefec1cc179fe6ca2ceb0a49
SHA1

f4149b57a944b94006e7fdb0c8709cba74bb4148
SHA256

1381bf81d77477dc1d08f83a89ff98b42a1df87887f633d82e9d9202c9025802
SHA512

acaeea9c1157c4b998ac9ba69509338abc5440fe23845e198f1e54a12650d5e281446586999c2ebcd2321598c46b2342f7a16bcc761bd7f1010c3b0b24524e79
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTKUANMXc:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1432-37-0x00007FF7AEFF0000-0x00007FF7AF3E2000-memory.dmp	xmrig
behavioral2/memory/1568-40-0x00007FF786F70000-0x00007FF787362000-memory.dmp	xmrig
behavioral2/memory/3704-42-0x00007FF7DCD20000-0x00007FF7DD112000-memory.dmp	xmrig
behavioral2/memory/3764-35-0x00007FF6940B0000-0x00007FF6944A2000-memory.dmp	xmrig
behavioral2/memory/528-51-0x00007FF7B3AD0000-0x00007FF7B3EC2000-memory.dmp	xmrig
behavioral2/memory/2276-115-0x00007FF733A00000-0x00007FF733DF2000-memory.dmp	xmrig
behavioral2/memory/3752-124-0x00007FF64F420000-0x00007FF64F812000-memory.dmp	xmrig
behavioral2/memory/3380-129-0x00007FF7147E0000-0x00007FF714BD2000-memory.dmp	xmrig
behavioral2/memory/4632-132-0x00007FF665090000-0x00007FF665482000-memory.dmp	xmrig
behavioral2/memory/3916-135-0x00007FF66A8D0000-0x00007FF66ACC2000-memory.dmp	xmrig
behavioral2/memory/640-134-0x00007FF7F6AE0000-0x00007FF7F6ED2000-memory.dmp	xmrig
behavioral2/memory/2672-133-0x00007FF6F8150000-0x00007FF6F8542000-memory.dmp	xmrig
behavioral2/memory/380-131-0x00007FF7022E0000-0x00007FF7026D2000-memory.dmp	xmrig
behavioral2/memory/1220-130-0x00007FF646570000-0x00007FF646962000-memory.dmp	xmrig
behavioral2/memory/1216-128-0x00007FF7CE370000-0x00007FF7CE762000-memory.dmp	xmrig
behavioral2/memory/1628-125-0x00007FF7ED910000-0x00007FF7EDD02000-memory.dmp	xmrig
behavioral2/memory/4092-123-0x00007FF6C8C70000-0x00007FF6C9062000-memory.dmp	xmrig
behavioral2/memory/4924-122-0x00007FF6E0880000-0x00007FF6E0C72000-memory.dmp	xmrig
behavioral2/memory/3844-118-0x00007FF76D920000-0x00007FF76DD12000-memory.dmp	xmrig
behavioral2/memory/4972-141-0x00007FF70F700000-0x00007FF70FAF2000-memory.dmp	xmrig
behavioral2/memory/3880-150-0x00007FF7CB510000-0x00007FF7CB902000-memory.dmp	xmrig
behavioral2/memory/4980-261-0x00007FF648D90000-0x00007FF649182000-memory.dmp	xmrig
behavioral2/memory/4980-1796-0x00007FF648D90000-0x00007FF649182000-memory.dmp	xmrig
behavioral2/memory/3844-1798-0x00007FF76D920000-0x00007FF76DD12000-memory.dmp	xmrig
behavioral2/memory/4632-1802-0x00007FF665090000-0x00007FF665482000-memory.dmp	xmrig
behavioral2/memory/1220-1839-0x00007FF646570000-0x00007FF646962000-memory.dmp	xmrig
behavioral2/memory/380-1837-0x00007FF7022E0000-0x00007FF7026D2000-memory.dmp	xmrig
behavioral2/memory/640-1833-0x00007FF7F6AE0000-0x00007FF7F6ED2000-memory.dmp	xmrig
behavioral2/memory/3752-1820-0x00007FF64F420000-0x00007FF64F812000-memory.dmp	xmrig
behavioral2/memory/4092-1814-0x00007FF6C8C70000-0x00007FF6C9062000-memory.dmp	xmrig
behavioral2/memory/1432-1812-0x00007FF7AEFF0000-0x00007FF7AF3E2000-memory.dmp	xmrig
behavioral2/memory/3704-1809-0x00007FF7DCD20000-0x00007FF7DD112000-memory.dmp	xmrig
behavioral2/memory/1628-1863-0x00007FF7ED910000-0x00007FF7EDD02000-memory.dmp	xmrig
behavioral2/memory/2672-1835-0x00007FF6F8150000-0x00007FF6F8542000-memory.dmp	xmrig
behavioral2/memory/3916-1831-0x00007FF66A8D0000-0x00007FF66ACC2000-memory.dmp	xmrig
behavioral2/memory/3764-1818-0x00007FF6940B0000-0x00007FF6944A2000-memory.dmp	xmrig
behavioral2/memory/1568-1816-0x00007FF786F70000-0x00007FF787362000-memory.dmp	xmrig
behavioral2/memory/3380-1806-0x00007FF7147E0000-0x00007FF714BD2000-memory.dmp	xmrig
behavioral2/memory/528-1865-0x00007FF7B3AD0000-0x00007FF7B3EC2000-memory.dmp	xmrig
behavioral2/memory/4972-2072-0x00007FF70F700000-0x00007FF70FAF2000-memory.dmp	xmrig
behavioral2/memory/3880-2071-0x00007FF7CB510000-0x00007FF7CB902000-memory.dmp	xmrig
behavioral2/memory/1216-1864-0x00007FF7CE370000-0x00007FF7CE762000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	5084	powershell.exe
9	5084	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3764	eqXnmFV.exe
1432	EusvhFG.exe
1568	ezXtFYM.exe
3704	ViIGfoU.exe
4980	IkLUoUe.exe
528	JQQymyE.exe
2276	xLzNHsX.exe
3844	RnkPQaW.exe
4924	DQPqtex.exe
4092	pPAfFMU.exe
3752	jvqCPil.exe
1628	lxHVvsY.exe
1216	qAUOMWA.exe
3380	CwHxJCt.exe
1220	TGrFDwo.exe
380	MXKvDFQ.exe
4632	VPGPAUx.exe
2672	uwEoiTw.exe
640	lvIHcwI.exe
3916	UiLLWAG.exe
3880	AABbDbT.exe
1444	ztrnJRW.exe
2192	FYIwcpt.exe
4472	xavdJxH.exe
1184	ncuGmNs.exe
3452	iVuVIdY.exe
3364	NQMAigz.exe
4392	ACWWedO.exe
4200	gTZktjB.exe
1780	mxaKtbF.exe
2060	bKpDiHS.exe
2168	QjdLZaH.exe
1996	UWSiQWo.exe
2084	Hqrjzxy.exe
408	NKszROt.exe
4108	TnBKzOW.exe
4940	GSELHed.exe
2120	lwFCaza.exe
2200	EXCgGzY.exe
1972	wLlWAJw.exe
1620	fBwHdoQ.exe
872	NPqamBb.exe
4308	yoQKSMN.exe
3984	EQHWHnq.exe
2352	lWCdqGL.exe
2140	DcwDtfr.exe
1888	ptmcdih.exe
4272	RRodTYT.exe
2456	TElpGCB.exe
5068	xZAAEnk.exe
4080	PFRXxfu.exe
448	iuALGEi.exe
4316	fnNyPBy.exe
1464	afXiRCp.exe
2288	eLoyUSC.exe
1808	QHBUhgh.exe
4820	qYzuNOI.exe
4988	yRuSOFS.exe
2972	gBsaSwA.exe
4956	rlulCPa.exe
3464	fpUkgQH.exe
3596	GEUHzYn.exe
2696	MPHFTdp.exe
1924	WeDFKRU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4972-0-0x00007FF70F700000-0x00007FF70FAF2000-memory.dmp	upx
behavioral2/files/0x000b000000023242-5.dat	upx
behavioral2/files/0x0008000000023272-21.dat	upx
behavioral2/files/0x0008000000023273-19.dat	upx
behavioral2/files/0x0008000000023274-30.dat	upx
behavioral2/files/0x0008000000023270-39.dat	upx
behavioral2/memory/1432-37-0x00007FF7AEFF0000-0x00007FF7AF3E2000-memory.dmp	upx
behavioral2/memory/1568-40-0x00007FF786F70000-0x00007FF787362000-memory.dmp	upx
behavioral2/memory/4980-44-0x00007FF648D90000-0x00007FF649182000-memory.dmp	upx
behavioral2/memory/3704-42-0x00007FF7DCD20000-0x00007FF7DD112000-memory.dmp	upx
behavioral2/files/0x0007000000023275-48.dat	upx
behavioral2/memory/3764-35-0x00007FF6940B0000-0x00007FF6944A2000-memory.dmp	upx
behavioral2/memory/528-51-0x00007FF7B3AD0000-0x00007FF7B3EC2000-memory.dmp	upx
behavioral2/files/0x0007000000023276-55.dat	upx
behavioral2/files/0x0007000000023277-60.dat	upx
behavioral2/files/0x0007000000023278-65.dat	upx
behavioral2/files/0x000700000002327c-85.dat	upx
behavioral2/files/0x000700000002327d-89.dat	upx
behavioral2/files/0x0007000000023281-109.dat	upx
behavioral2/files/0x0007000000023282-114.dat	upx
behavioral2/memory/2276-115-0x00007FF733A00000-0x00007FF733DF2000-memory.dmp	upx
behavioral2/memory/3752-124-0x00007FF64F420000-0x00007FF64F812000-memory.dmp	upx
behavioral2/memory/3380-129-0x00007FF7147E0000-0x00007FF714BD2000-memory.dmp	upx
behavioral2/memory/4632-132-0x00007FF665090000-0x00007FF665482000-memory.dmp	upx
behavioral2/memory/3916-135-0x00007FF66A8D0000-0x00007FF66ACC2000-memory.dmp	upx
behavioral2/memory/640-134-0x00007FF7F6AE0000-0x00007FF7F6ED2000-memory.dmp	upx
behavioral2/memory/2672-133-0x00007FF6F8150000-0x00007FF6F8542000-memory.dmp	upx
behavioral2/memory/380-131-0x00007FF7022E0000-0x00007FF7026D2000-memory.dmp	upx
behavioral2/memory/1220-130-0x00007FF646570000-0x00007FF646962000-memory.dmp	upx
behavioral2/memory/1216-128-0x00007FF7CE370000-0x00007FF7CE762000-memory.dmp	upx
behavioral2/files/0x0007000000023283-126.dat	upx
behavioral2/memory/1628-125-0x00007FF7ED910000-0x00007FF7EDD02000-memory.dmp	upx
behavioral2/memory/4092-123-0x00007FF6C8C70000-0x00007FF6C9062000-memory.dmp	upx
behavioral2/memory/4924-122-0x00007FF6E0880000-0x00007FF6E0C72000-memory.dmp	upx
behavioral2/memory/3844-118-0x00007FF76D920000-0x00007FF76DD12000-memory.dmp	upx
behavioral2/files/0x0007000000023280-105.dat	upx
behavioral2/files/0x000700000002327f-100.dat	upx
behavioral2/files/0x000700000002327e-95.dat	upx
behavioral2/files/0x000700000002327b-80.dat	upx
behavioral2/files/0x000700000002327a-75.dat	upx
behavioral2/files/0x0007000000023279-70.dat	upx
behavioral2/files/0x0007000000023284-140.dat	upx
behavioral2/memory/4972-141-0x00007FF70F700000-0x00007FF70FAF2000-memory.dmp	upx
behavioral2/files/0x0007000000023284-143.dat	upx
behavioral2/files/0x0007000000023285-149.dat	upx
behavioral2/files/0x0007000000023286-154.dat	upx
behavioral2/files/0x0007000000023287-160.dat	upx
behavioral2/files/0x0007000000023288-165.dat	upx
behavioral2/memory/3880-150-0x00007FF7CB510000-0x00007FF7CB902000-memory.dmp	upx
behavioral2/files/0x0007000000023289-169.dat	upx
behavioral2/files/0x000700000002328a-176.dat	upx
behavioral2/files/0x000700000002328b-181.dat	upx
behavioral2/files/0x000700000002328d-189.dat	upx
behavioral2/files/0x000700000002328e-193.dat	upx
behavioral2/files/0x000700000002328f-201.dat	upx
behavioral2/files/0x000700000002328c-186.dat	upx
behavioral2/memory/4980-261-0x00007FF648D90000-0x00007FF649182000-memory.dmp	upx
behavioral2/memory/4980-1796-0x00007FF648D90000-0x00007FF649182000-memory.dmp	upx
behavioral2/memory/3844-1798-0x00007FF76D920000-0x00007FF76DD12000-memory.dmp	upx
behavioral2/memory/4632-1802-0x00007FF665090000-0x00007FF665482000-memory.dmp	upx
behavioral2/memory/1220-1839-0x00007FF646570000-0x00007FF646962000-memory.dmp	upx
behavioral2/memory/380-1837-0x00007FF7022E0000-0x00007FF7026D2000-memory.dmp	upx
behavioral2/memory/640-1833-0x00007FF7F6AE0000-0x00007FF7F6ED2000-memory.dmp	upx
behavioral2/memory/3752-1820-0x00007FF64F420000-0x00007FF64F812000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lwFCaza.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\xcDcryC.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\RfSARvH.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\ZBRzsdd.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\HkXQYLC.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\MvNNfnG.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\kbTeLBj.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\NKszROt.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\LPyrPpA.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\KzszCyV.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\pPAfFMU.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\wtljODH.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\VAjouEr.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\TkSJVNu.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\ZNSCkjJ.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\afXiRCp.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\hyUZuyl.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\yurKnWy.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\nafrqnr.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\AEJoYJp.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\RnOqhFY.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\nRBomuv.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\mOkgREh.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\EjFVhLy.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\mypjvmu.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\xLVNjbQ.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\XWehUFL.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\USkpAaH.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\MPHFTdp.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\pEHNvUh.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\DXyrrQt.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\oSLAxaj.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\XzoeSoC.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\YpieRWF.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\buJJTRF.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\eEcJrky.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\MMGEQOY.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\WtsLXVv.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\GJrXebS.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\DoJWDsQ.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\WyHrDxl.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\uwGeJcc.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\DcwDtfr.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\lpBUNfN.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\DkzZjZg.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\VdSRnXI.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\MfGCjXK.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\jZfoloE.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\FYIwcpt.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\bAJQtPO.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\VRDKwxc.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\gjURvBO.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\qbXHZDQ.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\ulhgcCT.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\FSncuRX.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\orYCGDQ.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\AyJAjCE.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\lFUBYdH.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\VihgXrf.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\xaxFxjs.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\AAiDbcv.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\RoiWxMI.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\QNBlUOF.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\tVFnZmE.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5084	powershell.exe
5084	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeLockMemoryPrivilege	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 5084	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	90
PID 4972 wrote to memory of 5084	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	90
PID 4972 wrote to memory of 3764	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	91
PID 4972 wrote to memory of 3764	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	91
PID 4972 wrote to memory of 1432	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	92
PID 4972 wrote to memory of 1432	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	92
PID 4972 wrote to memory of 1568	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	93
PID 4972 wrote to memory of 1568	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	93
PID 4972 wrote to memory of 3704	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	94
PID 4972 wrote to memory of 3704	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	94
PID 4972 wrote to memory of 4980	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	95
PID 4972 wrote to memory of 4980	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	95
PID 4972 wrote to memory of 528	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	96
PID 4972 wrote to memory of 528	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	96
PID 4972 wrote to memory of 2276	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	97
PID 4972 wrote to memory of 2276	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	97
PID 4972 wrote to memory of 3844	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	98
PID 4972 wrote to memory of 3844	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	98
PID 4972 wrote to memory of 4924	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	99
PID 4972 wrote to memory of 4924	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	99
PID 4972 wrote to memory of 4092	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	100
PID 4972 wrote to memory of 4092	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	100
PID 4972 wrote to memory of 3752	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	101
PID 4972 wrote to memory of 3752	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	101
PID 4972 wrote to memory of 1628	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	102
PID 4972 wrote to memory of 1628	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	102
PID 4972 wrote to memory of 1216	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	103
PID 4972 wrote to memory of 1216	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	103
PID 4972 wrote to memory of 3380	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	104
PID 4972 wrote to memory of 3380	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	104
PID 4972 wrote to memory of 1220	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	105
PID 4972 wrote to memory of 1220	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	105
PID 4972 wrote to memory of 380	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	106
PID 4972 wrote to memory of 380	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	106
PID 4972 wrote to memory of 4632	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	107
PID 4972 wrote to memory of 4632	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	107
PID 4972 wrote to memory of 2672	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	108
PID 4972 wrote to memory of 2672	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	108
PID 4972 wrote to memory of 640	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	109
PID 4972 wrote to memory of 640	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	109
PID 4972 wrote to memory of 3916	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	110
PID 4972 wrote to memory of 3916	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	110
PID 4972 wrote to memory of 3880	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	111
PID 4972 wrote to memory of 3880	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	111
PID 4972 wrote to memory of 1444	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	112
PID 4972 wrote to memory of 1444	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	112
PID 4972 wrote to memory of 2192	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	113
PID 4972 wrote to memory of 2192	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	113
PID 4972 wrote to memory of 4472	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	114
PID 4972 wrote to memory of 4472	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	114
PID 4972 wrote to memory of 1184	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	115
PID 4972 wrote to memory of 1184	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	115
PID 4972 wrote to memory of 3452	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	116
PID 4972 wrote to memory of 3452	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	116
PID 4972 wrote to memory of 3364	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	117
PID 4972 wrote to memory of 3364	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	117
PID 4972 wrote to memory of 4392	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	118
PID 4972 wrote to memory of 4392	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	118
PID 4972 wrote to memory of 4200	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	119
PID 4972 wrote to memory of 4200	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	119
PID 4972 wrote to memory of 1780	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	120
PID 4972 wrote to memory of 1780	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	120
PID 4972 wrote to memory of 2060	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	121
PID 4972 wrote to memory of 2060	4972	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	121

C:\Users\Admin\AppData\Local\Temp\06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\System\eqXnmFV.exe
  C:\Windows\System\eqXnmFV.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\EusvhFG.exe
  C:\Windows\System\EusvhFG.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\ezXtFYM.exe
  C:\Windows\System\ezXtFYM.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\ViIGfoU.exe
  C:\Windows\System\ViIGfoU.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\IkLUoUe.exe
  C:\Windows\System\IkLUoUe.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\JQQymyE.exe
  C:\Windows\System\JQQymyE.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\xLzNHsX.exe
  C:\Windows\System\xLzNHsX.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\RnkPQaW.exe
  C:\Windows\System\RnkPQaW.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\DQPqtex.exe
  C:\Windows\System\DQPqtex.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\pPAfFMU.exe
  C:\Windows\System\pPAfFMU.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\jvqCPil.exe
  C:\Windows\System\jvqCPil.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\lxHVvsY.exe
  C:\Windows\System\lxHVvsY.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\qAUOMWA.exe
  C:\Windows\System\qAUOMWA.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\CwHxJCt.exe
  C:\Windows\System\CwHxJCt.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\TGrFDwo.exe
  C:\Windows\System\TGrFDwo.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\MXKvDFQ.exe
  C:\Windows\System\MXKvDFQ.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\VPGPAUx.exe
  C:\Windows\System\VPGPAUx.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\uwEoiTw.exe
  C:\Windows\System\uwEoiTw.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\lvIHcwI.exe
  C:\Windows\System\lvIHcwI.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\UiLLWAG.exe
  C:\Windows\System\UiLLWAG.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\AABbDbT.exe
  C:\Windows\System\AABbDbT.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\ztrnJRW.exe
  C:\Windows\System\ztrnJRW.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\FYIwcpt.exe
  C:\Windows\System\FYIwcpt.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\xavdJxH.exe
  C:\Windows\System\xavdJxH.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\ncuGmNs.exe
  C:\Windows\System\ncuGmNs.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\iVuVIdY.exe
  C:\Windows\System\iVuVIdY.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\NQMAigz.exe
  C:\Windows\System\NQMAigz.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\ACWWedO.exe
  C:\Windows\System\ACWWedO.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\gTZktjB.exe
  C:\Windows\System\gTZktjB.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\mxaKtbF.exe
  C:\Windows\System\mxaKtbF.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\bKpDiHS.exe
  C:\Windows\System\bKpDiHS.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\QjdLZaH.exe
  C:\Windows\System\QjdLZaH.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\UWSiQWo.exe
  C:\Windows\System\UWSiQWo.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\Hqrjzxy.exe
  C:\Windows\System\Hqrjzxy.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\NKszROt.exe
  C:\Windows\System\NKszROt.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\TnBKzOW.exe
  C:\Windows\System\TnBKzOW.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\GSELHed.exe
  C:\Windows\System\GSELHed.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\lwFCaza.exe
  C:\Windows\System\lwFCaza.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\EXCgGzY.exe
  C:\Windows\System\EXCgGzY.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\wLlWAJw.exe
  C:\Windows\System\wLlWAJw.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\fBwHdoQ.exe
  C:\Windows\System\fBwHdoQ.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\NPqamBb.exe
  C:\Windows\System\NPqamBb.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\yoQKSMN.exe
  C:\Windows\System\yoQKSMN.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\EQHWHnq.exe
  C:\Windows\System\EQHWHnq.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\lWCdqGL.exe
  C:\Windows\System\lWCdqGL.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\DcwDtfr.exe
  C:\Windows\System\DcwDtfr.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\ptmcdih.exe
  C:\Windows\System\ptmcdih.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\RRodTYT.exe
  C:\Windows\System\RRodTYT.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\TElpGCB.exe
  C:\Windows\System\TElpGCB.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\xZAAEnk.exe
  C:\Windows\System\xZAAEnk.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\PFRXxfu.exe
  C:\Windows\System\PFRXxfu.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\iuALGEi.exe
  C:\Windows\System\iuALGEi.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\fnNyPBy.exe
  C:\Windows\System\fnNyPBy.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\afXiRCp.exe
  C:\Windows\System\afXiRCp.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\eLoyUSC.exe
  C:\Windows\System\eLoyUSC.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\QHBUhgh.exe
  C:\Windows\System\QHBUhgh.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\qYzuNOI.exe
  C:\Windows\System\qYzuNOI.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\yRuSOFS.exe
  C:\Windows\System\yRuSOFS.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\gBsaSwA.exe
  C:\Windows\System\gBsaSwA.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\rlulCPa.exe
  C:\Windows\System\rlulCPa.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\fpUkgQH.exe
  C:\Windows\System\fpUkgQH.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\GEUHzYn.exe
  C:\Windows\System\GEUHzYn.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\MPHFTdp.exe
  C:\Windows\System\MPHFTdp.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\WeDFKRU.exe
  C:\Windows\System\WeDFKRU.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\LKpkbnT.exe
  C:\Windows\System\LKpkbnT.exe
  2⤵
  PID:4444
- C:\Windows\System\nRBomuv.exe
  C:\Windows\System\nRBomuv.exe
  2⤵
  PID:2300
- C:\Windows\System\vpeLqiq.exe
  C:\Windows\System\vpeLqiq.exe
  2⤵
  PID:2556
- C:\Windows\System\RJJYSUP.exe
  C:\Windows\System\RJJYSUP.exe
  2⤵
  PID:696
- C:\Windows\System\XqMnLyv.exe
  C:\Windows\System\XqMnLyv.exe
  2⤵
  PID:2884
- C:\Windows\System\QdSpviH.exe
  C:\Windows\System\QdSpviH.exe
  2⤵
  PID:3128
- C:\Windows\System\WfTAPYH.exe
  C:\Windows\System\WfTAPYH.exe
  2⤵
  PID:736
- C:\Windows\System\pEHNvUh.exe
  C:\Windows\System\pEHNvUh.exe
  2⤵
  PID:2496
- C:\Windows\System\kfKBiBv.exe
  C:\Windows\System\kfKBiBv.exe
  2⤵
  PID:1856
- C:\Windows\System\DDwalda.exe
  C:\Windows\System\DDwalda.exe
  2⤵
  PID:2852
- C:\Windows\System\puirweS.exe
  C:\Windows\System\puirweS.exe
  2⤵
  PID:5136
- C:\Windows\System\WSaRPZb.exe
  C:\Windows\System\WSaRPZb.exe
  2⤵
  PID:5164
- C:\Windows\System\ZmQyinm.exe
  C:\Windows\System\ZmQyinm.exe
  2⤵
  PID:5188
- C:\Windows\System\WSNwJzu.exe
  C:\Windows\System\WSNwJzu.exe
  2⤵
  PID:5216
- C:\Windows\System\dDSAVQw.exe
  C:\Windows\System\dDSAVQw.exe
  2⤵
  PID:5232
- C:\Windows\System\rPUFZKI.exe
  C:\Windows\System\rPUFZKI.exe
  2⤵
  PID:5280
- C:\Windows\System\zkdUmhX.exe
  C:\Windows\System\zkdUmhX.exe
  2⤵
  PID:5316
- C:\Windows\System\OLKjBiK.exe
  C:\Windows\System\OLKjBiK.exe
  2⤵
  PID:5360
- C:\Windows\System\ZHqJxTu.exe
  C:\Windows\System\ZHqJxTu.exe
  2⤵
  PID:5376
- C:\Windows\System\HsiDghn.exe
  C:\Windows\System\HsiDghn.exe
  2⤵
  PID:5400
- C:\Windows\System\ABxTiOD.exe
  C:\Windows\System\ABxTiOD.exe
  2⤵
  PID:5468
- C:\Windows\System\GAFFYAB.exe
  C:\Windows\System\GAFFYAB.exe
  2⤵
  PID:5484
- C:\Windows\System\UrdESiC.exe
  C:\Windows\System\UrdESiC.exe
  2⤵
  PID:5512
- C:\Windows\System\anrhexI.exe
  C:\Windows\System\anrhexI.exe
  2⤵
  PID:5548
- C:\Windows\System\xQCmIZT.exe
  C:\Windows\System\xQCmIZT.exe
  2⤵
  PID:5576
- C:\Windows\System\qeUDztc.exe
  C:\Windows\System\qeUDztc.exe
  2⤵
  PID:5596
- C:\Windows\System\RFSrHXa.exe
  C:\Windows\System\RFSrHXa.exe
  2⤵
  PID:5616
- C:\Windows\System\ulGOkSr.exe
  C:\Windows\System\ulGOkSr.exe
  2⤵
  PID:5640
- C:\Windows\System\ZZxOtbA.exe
  C:\Windows\System\ZZxOtbA.exe
  2⤵
  PID:5688
- C:\Windows\System\QmVNsgw.exe
  C:\Windows\System\QmVNsgw.exe
  2⤵
  PID:5708
- C:\Windows\System\CVtyByz.exe
  C:\Windows\System\CVtyByz.exe
  2⤵
  PID:5748
- C:\Windows\System\bqXHYoQ.exe
  C:\Windows\System\bqXHYoQ.exe
  2⤵
  PID:5768
- C:\Windows\System\eTzZylZ.exe
  C:\Windows\System\eTzZylZ.exe
  2⤵
  PID:5800
- C:\Windows\System\rCzJBAD.exe
  C:\Windows\System\rCzJBAD.exe
  2⤵
  PID:5828
- C:\Windows\System\qKTjncb.exe
  C:\Windows\System\qKTjncb.exe
  2⤵
  PID:5848
- C:\Windows\System\Pvodqco.exe
  C:\Windows\System\Pvodqco.exe
  2⤵
  PID:5868
- C:\Windows\System\srKeJpA.exe
  C:\Windows\System\srKeJpA.exe
  2⤵
  PID:5892
- C:\Windows\System\uyJuIEg.exe
  C:\Windows\System\uyJuIEg.exe
  2⤵
  PID:5912
- C:\Windows\System\fvmipmc.exe
  C:\Windows\System\fvmipmc.exe
  2⤵
  PID:5936
- C:\Windows\System\ENEuVyc.exe
  C:\Windows\System\ENEuVyc.exe
  2⤵
  PID:5964
- C:\Windows\System\hOIeEOe.exe
  C:\Windows\System\hOIeEOe.exe
  2⤵
  PID:6000
- C:\Windows\System\mjfBzbj.exe
  C:\Windows\System\mjfBzbj.exe
  2⤵
  PID:6020
- C:\Windows\System\DXyrrQt.exe
  C:\Windows\System\DXyrrQt.exe
  2⤵
  PID:6072
- C:\Windows\System\KTClCQH.exe
  C:\Windows\System\KTClCQH.exe
  2⤵
  PID:6096
- C:\Windows\System\mypjvmu.exe
  C:\Windows\System\mypjvmu.exe
  2⤵
  PID:6140
- C:\Windows\System\xdtRraO.exe
  C:\Windows\System\xdtRraO.exe
  2⤵
  PID:3152
- C:\Windows\System\LTjMfLN.exe
  C:\Windows\System\LTjMfLN.exe
  2⤵
  PID:4524
- C:\Windows\System\KwDjJFm.exe
  C:\Windows\System\KwDjJFm.exe
  2⤵
  PID:5260
- C:\Windows\System\teWYJdT.exe
  C:\Windows\System\teWYJdT.exe
  2⤵
  PID:5240
- C:\Windows\System\KVRkREy.exe
  C:\Windows\System\KVRkREy.exe
  2⤵
  PID:5340
- C:\Windows\System\IGCDfdc.exe
  C:\Windows\System\IGCDfdc.exe
  2⤵
  PID:2320
- C:\Windows\System\JYRvpTW.exe
  C:\Windows\System\JYRvpTW.exe
  2⤵
  PID:3256
- C:\Windows\System\urSKCVB.exe
  C:\Windows\System\urSKCVB.exe
  2⤵
  PID:5504
- C:\Windows\System\tynBZnQ.exe
  C:\Windows\System\tynBZnQ.exe
  2⤵
  PID:5568
- C:\Windows\System\DMqNaGY.exe
  C:\Windows\System\DMqNaGY.exe
  2⤵
  PID:5624
- C:\Windows\System\NpoHcTi.exe
  C:\Windows\System\NpoHcTi.exe
  2⤵
  PID:2772
- C:\Windows\System\bkUIbJw.exe
  C:\Windows\System\bkUIbJw.exe
  2⤵
  PID:5808
- C:\Windows\System\imRUNax.exe
  C:\Windows\System\imRUNax.exe
  2⤵
  PID:5864
- C:\Windows\System\flwWmTi.exe
  C:\Windows\System\flwWmTi.exe
  2⤵
  PID:5904
- C:\Windows\System\LPyrPpA.exe
  C:\Windows\System\LPyrPpA.exe
  2⤵
  PID:5928
- C:\Windows\System\pZMsqmX.exe
  C:\Windows\System\pZMsqmX.exe
  2⤵
  PID:6016
- C:\Windows\System\unDSMFL.exe
  C:\Windows\System\unDSMFL.exe
  2⤵
  PID:5996
- C:\Windows\System\wuVlrqJ.exe
  C:\Windows\System\wuVlrqJ.exe
  2⤵
  PID:6088
- C:\Windows\System\bAJQtPO.exe
  C:\Windows\System\bAJQtPO.exe
  2⤵
  PID:3628
- C:\Windows\System\UTAAJDM.exe
  C:\Windows\System\UTAAJDM.exe
  2⤵
  PID:5172
- C:\Windows\System\PndYyLc.exe
  C:\Windows\System\PndYyLc.exe
  2⤵
  PID:5420
- C:\Windows\System\hyUZuyl.exe
  C:\Windows\System\hyUZuyl.exe
  2⤵
  PID:5336
- C:\Windows\System\ERuRaSQ.exe
  C:\Windows\System\ERuRaSQ.exe
  2⤵
  PID:5680
- C:\Windows\System\kPXpUdE.exe
  C:\Windows\System\kPXpUdE.exe
  2⤵
  PID:5816
- C:\Windows\System\ZXYCGYx.exe
  C:\Windows\System\ZXYCGYx.exe
  2⤵
  PID:5876
- C:\Windows\System\TNsWtas.exe
  C:\Windows\System\TNsWtas.exe
  2⤵
  PID:6128
- C:\Windows\System\uYlDSHt.exe
  C:\Windows\System\uYlDSHt.exe
  2⤵
  PID:5992
- C:\Windows\System\IaNOMTe.exe
  C:\Windows\System\IaNOMTe.exe
  2⤵
  PID:5384
- C:\Windows\System\DLLBiLV.exe
  C:\Windows\System\DLLBiLV.exe
  2⤵
  PID:5160
- C:\Windows\System\UpUbWKn.exe
  C:\Windows\System\UpUbWKn.exe
  2⤵
  PID:5952
- C:\Windows\System\uoJeIQd.exe
  C:\Windows\System\uoJeIQd.exe
  2⤵
  PID:6184
- C:\Windows\System\OEzaouR.exe
  C:\Windows\System\OEzaouR.exe
  2⤵
  PID:6208
- C:\Windows\System\yurKnWy.exe
  C:\Windows\System\yurKnWy.exe
  2⤵
  PID:6228
- C:\Windows\System\rNmxECX.exe
  C:\Windows\System\rNmxECX.exe
  2⤵
  PID:6268
- C:\Windows\System\zmYjzDh.exe
  C:\Windows\System\zmYjzDh.exe
  2⤵
  PID:6292
- C:\Windows\System\VbMUelN.exe
  C:\Windows\System\VbMUelN.exe
  2⤵
  PID:6320
- C:\Windows\System\gQyRwOw.exe
  C:\Windows\System\gQyRwOw.exe
  2⤵
  PID:6344
- C:\Windows\System\PeDQBbk.exe
  C:\Windows\System\PeDQBbk.exe
  2⤵
  PID:6380
- C:\Windows\System\afhFoiz.exe
  C:\Windows\System\afhFoiz.exe
  2⤵
  PID:6396
- C:\Windows\System\VBMbACR.exe
  C:\Windows\System\VBMbACR.exe
  2⤵
  PID:6416
- C:\Windows\System\FfHCMio.exe
  C:\Windows\System\FfHCMio.exe
  2⤵
  PID:6464
- C:\Windows\System\bXniXWS.exe
  C:\Windows\System\bXniXWS.exe
  2⤵
  PID:6492
- C:\Windows\System\ZmNdfrt.exe
  C:\Windows\System\ZmNdfrt.exe
  2⤵
  PID:6512
- C:\Windows\System\TibItMg.exe
  C:\Windows\System\TibItMg.exe
  2⤵
  PID:6552
- C:\Windows\System\hHEZzfd.exe
  C:\Windows\System\hHEZzfd.exe
  2⤵
  PID:6672
- C:\Windows\System\vMKCLym.exe
  C:\Windows\System\vMKCLym.exe
  2⤵
  PID:6688
- C:\Windows\System\VSGoHnu.exe
  C:\Windows\System\VSGoHnu.exe
  2⤵
  PID:6704
- C:\Windows\System\TmJwdgY.exe
  C:\Windows\System\TmJwdgY.exe
  2⤵
  PID:6724
- C:\Windows\System\qgIjEkp.exe
  C:\Windows\System\qgIjEkp.exe
  2⤵
  PID:6748
- C:\Windows\System\pAEWuFz.exe
  C:\Windows\System\pAEWuFz.exe
  2⤵
  PID:6768
- C:\Windows\System\vQrKDnh.exe
  C:\Windows\System\vQrKDnh.exe
  2⤵
  PID:6792
- C:\Windows\System\zZEeFwB.exe
  C:\Windows\System\zZEeFwB.exe
  2⤵
  PID:6836
- C:\Windows\System\ImGUMko.exe
  C:\Windows\System\ImGUMko.exe
  2⤵
  PID:6856
- C:\Windows\System\ZlZXBKi.exe
  C:\Windows\System\ZlZXBKi.exe
  2⤵
  PID:6880
- C:\Windows\System\OzDPnAY.exe
  C:\Windows\System\OzDPnAY.exe
  2⤵
  PID:6932
- C:\Windows\System\MYLpfBT.exe
  C:\Windows\System\MYLpfBT.exe
  2⤵
  PID:6952
- C:\Windows\System\otOYkkV.exe
  C:\Windows\System\otOYkkV.exe
  2⤵
  PID:6980
- C:\Windows\System\KTsfxBn.exe
  C:\Windows\System\KTsfxBn.exe
  2⤵
  PID:7000
- C:\Windows\System\yfFbWEU.exe
  C:\Windows\System\yfFbWEU.exe
  2⤵
  PID:7020
- C:\Windows\System\kYgWRgn.exe
  C:\Windows\System\kYgWRgn.exe
  2⤵
  PID:7044
- C:\Windows\System\haHETif.exe
  C:\Windows\System\haHETif.exe
  2⤵
  PID:7060
- C:\Windows\System\lRmfwMt.exe
  C:\Windows\System\lRmfwMt.exe
  2⤵
  PID:7092
- C:\Windows\System\xIytunm.exe
  C:\Windows\System\xIytunm.exe
  2⤵
  PID:7108
- C:\Windows\System\IdzWqbF.exe
  C:\Windows\System\IdzWqbF.exe
  2⤵
  PID:7136
- C:\Windows\System\jsomfBf.exe
  C:\Windows\System\jsomfBf.exe
  2⤵
  PID:7156
- C:\Windows\System\hylCITP.exe
  C:\Windows\System\hylCITP.exe
  2⤵
  PID:5368
- C:\Windows\System\VvJqHnt.exe
  C:\Windows\System\VvJqHnt.exe
  2⤵
  PID:6176
- C:\Windows\System\LhzMGjg.exe
  C:\Windows\System\LhzMGjg.exe
  2⤵
  PID:6200
- C:\Windows\System\VEptxeU.exe
  C:\Windows\System\VEptxeU.exe
  2⤵
  PID:6284
- C:\Windows\System\XfmjNQi.exe
  C:\Windows\System\XfmjNQi.exe
  2⤵
  PID:6312
- C:\Windows\System\wcGqphx.exe
  C:\Windows\System\wcGqphx.exe
  2⤵
  PID:6376
- C:\Windows\System\SaTqFmN.exe
  C:\Windows\System\SaTqFmN.exe
  2⤵
  PID:6392
- C:\Windows\System\vjIDGrB.exe
  C:\Windows\System\vjIDGrB.exe
  2⤵
  PID:4788
- C:\Windows\System\czhCVFM.exe
  C:\Windows\System\czhCVFM.exe
  2⤵
  PID:2828
- C:\Windows\System\NKGdvHI.exe
  C:\Windows\System\NKGdvHI.exe
  2⤵
  PID:6588
- C:\Windows\System\nYBSqsj.exe
  C:\Windows\System\nYBSqsj.exe
  2⤵
  PID:6604
- C:\Windows\System\LeTqkAc.exe
  C:\Windows\System\LeTqkAc.exe
  2⤵
  PID:6644
- C:\Windows\System\kXNRyEs.exe
  C:\Windows\System\kXNRyEs.exe
  2⤵
  PID:6568
- C:\Windows\System\DmfUJdN.exe
  C:\Windows\System\DmfUJdN.exe
  2⤵
  PID:6764
- C:\Windows\System\MTDkYJk.exe
  C:\Windows\System\MTDkYJk.exe
  2⤵
  PID:6820
- C:\Windows\System\RMffPIm.exe
  C:\Windows\System\RMffPIm.exe
  2⤵
  PID:6852
- C:\Windows\System\OCHepeQ.exe
  C:\Windows\System\OCHepeQ.exe
  2⤵
  PID:6872
- C:\Windows\System\rdzUYPC.exe
  C:\Windows\System\rdzUYPC.exe
  2⤵
  PID:6992
- C:\Windows\System\xCjGaHP.exe
  C:\Windows\System\xCjGaHP.exe
  2⤵
  PID:7016
- C:\Windows\System\JorILyV.exe
  C:\Windows\System\JorILyV.exe
  2⤵
  PID:7068
- C:\Windows\System\pbZfOTc.exe
  C:\Windows\System\pbZfOTc.exe
  2⤵
  PID:6248
- C:\Windows\System\IGDHIsc.exe
  C:\Windows\System\IGDHIsc.exe
  2⤵
  PID:7152
- C:\Windows\System\zLBkGNC.exe
  C:\Windows\System\zLBkGNC.exe
  2⤵
  PID:6336
- C:\Windows\System\nrHRiip.exe
  C:\Windows\System\nrHRiip.exe
  2⤵
  PID:6196
- C:\Windows\System\gIRSJhx.exe
  C:\Windows\System\gIRSJhx.exe
  2⤵
  PID:6456
- C:\Windows\System\djmBRbK.exe
  C:\Windows\System\djmBRbK.exe
  2⤵
  PID:6680
- C:\Windows\System\Qfearhh.exe
  C:\Windows\System\Qfearhh.exe
  2⤵
  PID:6740
- C:\Windows\System\dZkEijU.exe
  C:\Windows\System\dZkEijU.exe
  2⤵
  PID:6948
- C:\Windows\System\pHavXnl.exe
  C:\Windows\System\pHavXnl.exe
  2⤵
  PID:4356
- C:\Windows\System\WzNifkN.exe
  C:\Windows\System\WzNifkN.exe
  2⤵
  PID:7052
- C:\Windows\System\JQUiyBB.exe
  C:\Windows\System\JQUiyBB.exe
  2⤵
  PID:5480
- C:\Windows\System\VbtlWgU.exe
  C:\Windows\System\VbtlWgU.exe
  2⤵
  PID:6988
- C:\Windows\System\JcOAhIB.exe
  C:\Windows\System\JcOAhIB.exe
  2⤵
  PID:6388
- C:\Windows\System\IwzKJyO.exe
  C:\Windows\System\IwzKJyO.exe
  2⤵
  PID:6668
- C:\Windows\System\TCDtkdp.exe
  C:\Windows\System\TCDtkdp.exe
  2⤵
  PID:6564
- C:\Windows\System\wtljODH.exe
  C:\Windows\System\wtljODH.exe
  2⤵
  PID:7184
- C:\Windows\System\mhLmoAW.exe
  C:\Windows\System\mhLmoAW.exe
  2⤵
  PID:7204
- C:\Windows\System\UQBtNFx.exe
  C:\Windows\System\UQBtNFx.exe
  2⤵
  PID:7228
- C:\Windows\System\AAiDbcv.exe
  C:\Windows\System\AAiDbcv.exe
  2⤵
  PID:7252
- C:\Windows\System\HMqgugJ.exe
  C:\Windows\System\HMqgugJ.exe
  2⤵
  PID:7268
- C:\Windows\System\RoiWxMI.exe
  C:\Windows\System\RoiWxMI.exe
  2⤵
  PID:7296
- C:\Windows\System\RdayTxL.exe
  C:\Windows\System\RdayTxL.exe
  2⤵
  PID:7320
- C:\Windows\System\VVVgbuQ.exe
  C:\Windows\System\VVVgbuQ.exe
  2⤵
  PID:7404
- C:\Windows\System\JeDnmaK.exe
  C:\Windows\System\JeDnmaK.exe
  2⤵
  PID:7428
- C:\Windows\System\OfpGrXr.exe
  C:\Windows\System\OfpGrXr.exe
  2⤵
  PID:7448
- C:\Windows\System\LbrgoHc.exe
  C:\Windows\System\LbrgoHc.exe
  2⤵
  PID:7468
- C:\Windows\System\LWHDRSd.exe
  C:\Windows\System\LWHDRSd.exe
  2⤵
  PID:7492
- C:\Windows\System\cngbZje.exe
  C:\Windows\System\cngbZje.exe
  2⤵
  PID:7604
- C:\Windows\System\QNBlUOF.exe
  C:\Windows\System\QNBlUOF.exe
  2⤵
  PID:7624
- C:\Windows\System\aNdKdPO.exe
  C:\Windows\System\aNdKdPO.exe
  2⤵
  PID:7648
- C:\Windows\System\TPepKhY.exe
  C:\Windows\System\TPepKhY.exe
  2⤵
  PID:7672
- C:\Windows\System\HcMaeFa.exe
  C:\Windows\System\HcMaeFa.exe
  2⤵
  PID:7704
- C:\Windows\System\aHdgLmm.exe
  C:\Windows\System\aHdgLmm.exe
  2⤵
  PID:7724
- C:\Windows\System\FBbKmvj.exe
  C:\Windows\System\FBbKmvj.exe
  2⤵
  PID:7748
- C:\Windows\System\SMqooZc.exe
  C:\Windows\System\SMqooZc.exe
  2⤵
  PID:7772
- C:\Windows\System\JxTEZzp.exe
  C:\Windows\System\JxTEZzp.exe
  2⤵
  PID:7792
- C:\Windows\System\oNKuUmx.exe
  C:\Windows\System\oNKuUmx.exe
  2⤵
  PID:7812
- C:\Windows\System\KzszCyV.exe
  C:\Windows\System\KzszCyV.exe
  2⤵
  PID:7836
- C:\Windows\System\NToNrpf.exe
  C:\Windows\System\NToNrpf.exe
  2⤵
  PID:7936
- C:\Windows\System\igOfrel.exe
  C:\Windows\System\igOfrel.exe
  2⤵
  PID:7968
- C:\Windows\System\VywYBiN.exe
  C:\Windows\System\VywYBiN.exe
  2⤵
  PID:8004
- C:\Windows\System\HRacbWH.exe
  C:\Windows\System\HRacbWH.exe
  2⤵
  PID:8024
- C:\Windows\System\DisAqpZ.exe
  C:\Windows\System\DisAqpZ.exe
  2⤵
  PID:8044
- C:\Windows\System\ofDAlby.exe
  C:\Windows\System\ofDAlby.exe
  2⤵
  PID:8068
- C:\Windows\System\LpkWRSc.exe
  C:\Windows\System\LpkWRSc.exe
  2⤵
  PID:8088
- C:\Windows\System\lpBUNfN.exe
  C:\Windows\System\lpBUNfN.exe
  2⤵
  PID:8108
- C:\Windows\System\ReZXgUr.exe
  C:\Windows\System\ReZXgUr.exe
  2⤵
  PID:8132
- C:\Windows\System\FznhJuj.exe
  C:\Windows\System\FznhJuj.exe
  2⤵
  PID:8152
- C:\Windows\System\zXhXrUF.exe
  C:\Windows\System\zXhXrUF.exe
  2⤵
  PID:7276
- C:\Windows\System\mCksTSf.exe
  C:\Windows\System\mCksTSf.exe
  2⤵
  PID:7528
- C:\Windows\System\wJNqvsZ.exe
  C:\Windows\System\wJNqvsZ.exe
  2⤵
  PID:7592
- C:\Windows\System\dEdaVii.exe
  C:\Windows\System\dEdaVii.exe
  2⤵
  PID:7688
- C:\Windows\System\orYCGDQ.exe
  C:\Windows\System\orYCGDQ.exe
  2⤵
  PID:7764
- C:\Windows\System\SvOHlkG.exe
  C:\Windows\System\SvOHlkG.exe
  2⤵
  PID:7832
- C:\Windows\System\fmvhPic.exe
  C:\Windows\System\fmvhPic.exe
  2⤵
  PID:7644
- C:\Windows\System\KRTMfcn.exe
  C:\Windows\System\KRTMfcn.exe
  2⤵
  PID:7556
- C:\Windows\System\KCutKFT.exe
  C:\Windows\System\KCutKFT.exe
  2⤵
  PID:7744
- C:\Windows\System\DKcsZIg.exe
  C:\Windows\System\DKcsZIg.exe
  2⤵
  PID:7932
- C:\Windows\System\NdogNOJ.exe
  C:\Windows\System\NdogNOJ.exe
  2⤵
  PID:8080
- C:\Windows\System\RuruLXc.exe
  C:\Windows\System\RuruLXc.exe
  2⤵
  PID:8052
- C:\Windows\System\dQeiIBx.exe
  C:\Windows\System\dQeiIBx.exe
  2⤵
  PID:8124
- C:\Windows\System\ouXkKvO.exe
  C:\Windows\System\ouXkKvO.exe
  2⤵
  PID:6404
- C:\Windows\System\VtYPEaB.exe
  C:\Windows\System\VtYPEaB.exe
  2⤵
  PID:7572
- C:\Windows\System\pgMRSiw.exe
  C:\Windows\System\pgMRSiw.exe
  2⤵
  PID:7264
- C:\Windows\System\HbkFZxI.exe
  C:\Windows\System\HbkFZxI.exe
  2⤵
  PID:8120
- C:\Windows\System\nNasEJS.exe
  C:\Windows\System\nNasEJS.exe
  2⤵
  PID:7244
- C:\Windows\System\AyJAjCE.exe
  C:\Windows\System\AyJAjCE.exe
  2⤵
  PID:7668
- C:\Windows\System\MsCalXE.exe
  C:\Windows\System\MsCalXE.exe
  2⤵
  PID:7632
- C:\Windows\System\sEQrqeI.exe
  C:\Windows\System\sEQrqeI.exe
  2⤵
  PID:7876
- C:\Windows\System\phRsrNr.exe
  C:\Windows\System\phRsrNr.exe
  2⤵
  PID:8084
- C:\Windows\System\AVTkJRi.exe
  C:\Windows\System\AVTkJRi.exe
  2⤵
  PID:8000
- C:\Windows\System\kLxwBfD.exe
  C:\Windows\System\kLxwBfD.exe
  2⤵
  PID:7664
- C:\Windows\System\MMGEQOY.exe
  C:\Windows\System\MMGEQOY.exe
  2⤵
  PID:7288
- C:\Windows\System\uDeHbmI.exe
  C:\Windows\System\uDeHbmI.exe
  2⤵
  PID:7680
- C:\Windows\System\yoUTXux.exe
  C:\Windows\System\yoUTXux.exe
  2⤵
  PID:8200
- C:\Windows\System\VdRvmyB.exe
  C:\Windows\System\VdRvmyB.exe
  2⤵
  PID:8220
- C:\Windows\System\eNDJQFl.exe
  C:\Windows\System\eNDJQFl.exe
  2⤵
  PID:8240
- C:\Windows\System\gxcZWKo.exe
  C:\Windows\System\gxcZWKo.exe
  2⤵
  PID:8260
- C:\Windows\System\EfwNvbb.exe
  C:\Windows\System\EfwNvbb.exe
  2⤵
  PID:8284
- C:\Windows\System\hBnOYdi.exe
  C:\Windows\System\hBnOYdi.exe
  2⤵
  PID:8304
- C:\Windows\System\nmVswHh.exe
  C:\Windows\System\nmVswHh.exe
  2⤵
  PID:8328
- C:\Windows\System\GKdrIcy.exe
  C:\Windows\System\GKdrIcy.exe
  2⤵
  PID:8348
- C:\Windows\System\demPJTF.exe
  C:\Windows\System\demPJTF.exe
  2⤵
  PID:8372
- C:\Windows\System\hmeJihw.exe
  C:\Windows\System\hmeJihw.exe
  2⤵
  PID:8392
- C:\Windows\System\bXVUceg.exe
  C:\Windows\System\bXVUceg.exe
  2⤵
  PID:8408
- C:\Windows\System\jjmGrBJ.exe
  C:\Windows\System\jjmGrBJ.exe
  2⤵
  PID:8432
- C:\Windows\System\zxLjvjf.exe
  C:\Windows\System\zxLjvjf.exe
  2⤵
  PID:8456
- C:\Windows\System\qBVRImk.exe
  C:\Windows\System\qBVRImk.exe
  2⤵
  PID:8580
- C:\Windows\System\DkzZjZg.exe
  C:\Windows\System\DkzZjZg.exe
  2⤵
  PID:8608
- C:\Windows\System\cKFDXCt.exe
  C:\Windows\System\cKFDXCt.exe
  2⤵
  PID:8636
- C:\Windows\System\lFUBYdH.exe
  C:\Windows\System\lFUBYdH.exe
  2⤵
  PID:8668
- C:\Windows\System\FYEGIRs.exe
  C:\Windows\System\FYEGIRs.exe
  2⤵
  PID:8692
- C:\Windows\System\qPGesTe.exe
  C:\Windows\System\qPGesTe.exe
  2⤵
  PID:8716
- C:\Windows\System\BNWeIQA.exe
  C:\Windows\System\BNWeIQA.exe
  2⤵
  PID:8736
- C:\Windows\System\vrcnVdp.exe
  C:\Windows\System\vrcnVdp.exe
  2⤵
  PID:8764
- C:\Windows\System\suoFoLR.exe
  C:\Windows\System\suoFoLR.exe
  2⤵
  PID:8784
- C:\Windows\System\YdroQOe.exe
  C:\Windows\System\YdroQOe.exe
  2⤵
  PID:8944
- C:\Windows\System\YkUguSJ.exe
  C:\Windows\System\YkUguSJ.exe
  2⤵
  PID:8968
- C:\Windows\System\tLDXtrk.exe
  C:\Windows\System\tLDXtrk.exe
  2⤵
  PID:8992
- C:\Windows\System\OSNOgln.exe
  C:\Windows\System\OSNOgln.exe
  2⤵
  PID:9008
- C:\Windows\System\yDUjEzV.exe
  C:\Windows\System\yDUjEzV.exe
  2⤵
  PID:9032
- C:\Windows\System\bXXYWeL.exe
  C:\Windows\System\bXXYWeL.exe
  2⤵
  PID:9056
- C:\Windows\System\ngxaERl.exe
  C:\Windows\System\ngxaERl.exe
  2⤵
  PID:9080
- C:\Windows\System\waMWejL.exe
  C:\Windows\System\waMWejL.exe
  2⤵
  PID:9108
- C:\Windows\System\GnmwqeK.exe
  C:\Windows\System\GnmwqeK.exe
  2⤵
  PID:9132
- C:\Windows\System\QwPVTzU.exe
  C:\Windows\System\QwPVTzU.exe
  2⤵
  PID:9152
- C:\Windows\System\QUcuVoK.exe
  C:\Windows\System\QUcuVoK.exe
  2⤵
  PID:9180
- C:\Windows\System\pUiRlcR.exe
  C:\Windows\System\pUiRlcR.exe
  2⤵
  PID:9196
- C:\Windows\System\oLLdRkn.exe
  C:\Windows\System\oLLdRkn.exe
  2⤵
  PID:4044
- C:\Windows\System\MKMLqLJ.exe
  C:\Windows\System\MKMLqLJ.exe
  2⤵
  PID:7460
- C:\Windows\System\mToAMIB.exe
  C:\Windows\System\mToAMIB.exe
  2⤵
  PID:8056
- C:\Windows\System\zQAqlyb.exe
  C:\Windows\System\zQAqlyb.exe
  2⤵
  PID:2424
- C:\Windows\System\FGqIIlM.exe
  C:\Windows\System\FGqIIlM.exe
  2⤵
  PID:7948
- C:\Windows\System\cQjjzrD.exe
  C:\Windows\System\cQjjzrD.exe
  2⤵
  PID:8216
- C:\Windows\System\kzXudzK.exe
  C:\Windows\System\kzXudzK.exe
  2⤵
  PID:8236
- C:\Windows\System\jLrMREh.exe
  C:\Windows\System\jLrMREh.exe
  2⤵
  PID:8280
- C:\Windows\System\koDrQZS.exe
  C:\Windows\System\koDrQZS.exe
  2⤵
  PID:8504
- C:\Windows\System\kidSKHk.exe
  C:\Windows\System\kidSKHk.exe
  2⤵
  PID:8344
- C:\Windows\System\igpKibA.exe
  C:\Windows\System\igpKibA.exe
  2⤵
  PID:8600
- C:\Windows\System\eTGfdon.exe
  C:\Windows\System\eTGfdon.exe
  2⤵
  PID:8684
- C:\Windows\System\aXQwivW.exe
  C:\Windows\System\aXQwivW.exe
  2⤵
  PID:8756
- C:\Windows\System\jDmNTHa.exe
  C:\Windows\System\jDmNTHa.exe
  2⤵
  PID:8616
- C:\Windows\System\YmkBSjX.exe
  C:\Windows\System\YmkBSjX.exe
  2⤵
  PID:8536
- C:\Windows\System\vNkzpRw.exe
  C:\Windows\System\vNkzpRw.exe
  2⤵
  PID:8772
- C:\Windows\System\ziWURDN.exe
  C:\Windows\System\ziWURDN.exe
  2⤵
  PID:8744
- C:\Windows\System\yxtwgNy.exe
  C:\Windows\System\yxtwgNy.exe
  2⤵
  PID:8904
- C:\Windows\System\leAhXwB.exe
  C:\Windows\System\leAhXwB.exe
  2⤵
  PID:8964
- C:\Windows\System\fTcdGaH.exe
  C:\Windows\System\fTcdGaH.exe
  2⤵
  PID:8932
- C:\Windows\System\aeSAAhV.exe
  C:\Windows\System\aeSAAhV.exe
  2⤵
  PID:9104
- C:\Windows\System\qwdnFRX.exe
  C:\Windows\System\qwdnFRX.exe
  2⤵
  PID:8984
- C:\Windows\System\WtsLXVv.exe
  C:\Windows\System\WtsLXVv.exe
  2⤵
  PID:3980
- C:\Windows\System\YNCpNHy.exe
  C:\Windows\System\YNCpNHy.exe
  2⤵
  PID:9176
- C:\Windows\System\wpzrpuZ.exe
  C:\Windows\System\wpzrpuZ.exe
  2⤵
  PID:8340
- C:\Windows\System\HqCiYDZ.exe
  C:\Windows\System\HqCiYDZ.exe
  2⤵
  PID:3392
- C:\Windows\System\jQYwoRd.exe
  C:\Windows\System\jQYwoRd.exe
  2⤵
  PID:8404
- C:\Windows\System\VgPTddn.exe
  C:\Windows\System\VgPTddn.exe
  2⤵
  PID:8644
- C:\Windows\System\UMUVclY.exe
  C:\Windows\System\UMUVclY.exe
  2⤵
  PID:8384
- C:\Windows\System\RRHbhPe.exe
  C:\Windows\System\RRHbhPe.exe
  2⤵
  PID:6412
- C:\Windows\System\vWDbEUG.exe
  C:\Windows\System\vWDbEUG.exe
  2⤵
  PID:9232
- C:\Windows\System\DwkqxWR.exe
  C:\Windows\System\DwkqxWR.exe
  2⤵
  PID:9260
- C:\Windows\System\vydRAhv.exe
  C:\Windows\System\vydRAhv.exe
  2⤵
  PID:9280
- C:\Windows\System\VihgXrf.exe
  C:\Windows\System\VihgXrf.exe
  2⤵
  PID:9308
- C:\Windows\System\ZBRzsdd.exe
  C:\Windows\System\ZBRzsdd.exe
  2⤵
  PID:9428
- C:\Windows\System\QkvExcC.exe
  C:\Windows\System\QkvExcC.exe
  2⤵
  PID:9448
- C:\Windows\System\KvhjXel.exe
  C:\Windows\System\KvhjXel.exe
  2⤵
  PID:9468
- C:\Windows\System\LQKDhey.exe
  C:\Windows\System\LQKDhey.exe
  2⤵
  PID:9496
- C:\Windows\System\nXcHGuQ.exe
  C:\Windows\System\nXcHGuQ.exe
  2⤵
  PID:9528
- C:\Windows\System\GFyMHYO.exe
  C:\Windows\System\GFyMHYO.exe
  2⤵
  PID:9948
- C:\Windows\System\xaxFxjs.exe
  C:\Windows\System\xaxFxjs.exe
  2⤵
  PID:9968
- C:\Windows\System\WcsbvqY.exe
  C:\Windows\System\WcsbvqY.exe
  2⤵
  PID:10004
- C:\Windows\System\MjpfYkc.exe
  C:\Windows\System\MjpfYkc.exe
  2⤵
  PID:10020
- C:\Windows\System\SmCgmzW.exe
  C:\Windows\System\SmCgmzW.exe
  2⤵
  PID:10036
- C:\Windows\System\yJPlaMh.exe
  C:\Windows\System\yJPlaMh.exe
  2⤵
  PID:10052
- C:\Windows\System\mxnXoIk.exe
  C:\Windows\System\mxnXoIk.exe
  2⤵
  PID:10068
- C:\Windows\System\sDzwHZN.exe
  C:\Windows\System\sDzwHZN.exe
  2⤵
  PID:10088
- C:\Windows\System\xxNOBbR.exe
  C:\Windows\System\xxNOBbR.exe
  2⤵
  PID:10132
- C:\Windows\System\sGolGKJ.exe
  C:\Windows\System\sGolGKJ.exe
  2⤵
  PID:10156
- C:\Windows\System\XUSqlqf.exe
  C:\Windows\System\XUSqlqf.exe
  2⤵
  PID:10176
- C:\Windows\System\HRLyptt.exe
  C:\Windows\System\HRLyptt.exe
  2⤵
  PID:10196
- C:\Windows\System\qbXHZDQ.exe
  C:\Windows\System\qbXHZDQ.exe
  2⤵
  PID:10220
- C:\Windows\System\QNFAFML.exe
  C:\Windows\System\QNFAFML.exe
  2⤵
  PID:10236
- C:\Windows\System\TMRMwUl.exe
  C:\Windows\System\TMRMwUl.exe
  2⤵
  PID:9076
- C:\Windows\System\yNgHuyC.exe
  C:\Windows\System\yNgHuyC.exe
  2⤵
  PID:8300
- C:\Windows\System\eBXGtHg.exe
  C:\Windows\System\eBXGtHg.exe
  2⤵
  PID:8840
- C:\Windows\System\cPPKJfk.exe
  C:\Windows\System\cPPKJfk.exe
  2⤵
  PID:4232
- C:\Windows\System\mOkgREh.exe
  C:\Windows\System\mOkgREh.exe
  2⤵
  PID:9296
- C:\Windows\System\gZLNZwa.exe
  C:\Windows\System\gZLNZwa.exe
  2⤵
  PID:8776
- C:\Windows\System\zWcOFJh.exe
  C:\Windows\System\zWcOFJh.exe
  2⤵
  PID:8752
- C:\Windows\System\BWWdSaE.exe
  C:\Windows\System\BWWdSaE.exe
  2⤵
  PID:8568
- C:\Windows\System\NYlfzon.exe
  C:\Windows\System\NYlfzon.exe
  2⤵
  PID:9316
- C:\Windows\System\nsCBopn.exe
  C:\Windows\System\nsCBopn.exe
  2⤵
  PID:6780
- C:\Windows\System\ySDMyEa.exe
  C:\Windows\System\ySDMyEa.exe
  2⤵
  PID:9388
- C:\Windows\System\AFzhOWN.exe
  C:\Windows\System\AFzhOWN.exe
  2⤵
  PID:8428
- C:\Windows\System\YSaWuBu.exe
  C:\Windows\System\YSaWuBu.exe
  2⤵
  PID:9252
- C:\Windows\System\GJrXebS.exe
  C:\Windows\System\GJrXebS.exe
  2⤵
  PID:9424
- C:\Windows\System\XRwWYcg.exe
  C:\Windows\System\XRwWYcg.exe
  2⤵
  PID:9488
- C:\Windows\System\YIKAtXQ.exe
  C:\Windows\System\YIKAtXQ.exe
  2⤵
  PID:9520
- C:\Windows\System\ZPWEgeK.exe
  C:\Windows\System\ZPWEgeK.exe
  2⤵
  PID:9440
- C:\Windows\System\hszXesA.exe
  C:\Windows\System\hszXesA.exe
  2⤵
  PID:9736
- C:\Windows\System\AiKoDdS.exe
  C:\Windows\System\AiKoDdS.exe
  2⤵
  PID:9652
- C:\Windows\System\nGcWkmi.exe
  C:\Windows\System\nGcWkmi.exe
  2⤵
  PID:9836
- C:\Windows\System\ZdzJYKA.exe
  C:\Windows\System\ZdzJYKA.exe
  2⤵
  PID:9856
- C:\Windows\System\hggxijj.exe
  C:\Windows\System\hggxijj.exe
  2⤵
  PID:9876
- C:\Windows\System\QwcdHyk.exe
  C:\Windows\System\QwcdHyk.exe
  2⤵
  PID:2920
- C:\Windows\System\fbGoZDS.exe
  C:\Windows\System\fbGoZDS.exe
  2⤵
  PID:9896
- C:\Windows\System\KBVESsL.exe
  C:\Windows\System\KBVESsL.exe
  2⤵
  PID:9904
- C:\Windows\System\EiLybeF.exe
  C:\Windows\System\EiLybeF.exe
  2⤵
  PID:9988
- C:\Windows\System\ihRaoSG.exe
  C:\Windows\System\ihRaoSG.exe
  2⤵
  PID:10016
- C:\Windows\System\FleQDYA.exe
  C:\Windows\System\FleQDYA.exe
  2⤵
  PID:10084
- C:\Windows\System\jMuYmoU.exe
  C:\Windows\System\jMuYmoU.exe
  2⤵
  PID:10168
- C:\Windows\System\tcmFcRB.exe
  C:\Windows\System\tcmFcRB.exe
  2⤵
  PID:10208
- C:\Windows\System\qaqOFky.exe
  C:\Windows\System\qaqOFky.exe
  2⤵
  PID:10048
- C:\Windows\System\jzPWvNW.exe
  C:\Windows\System\jzPWvNW.exe
  2⤵
  PID:8780
- C:\Windows\System\YBwYoRr.exe
  C:\Windows\System\YBwYoRr.exe
  2⤵
  PID:9292
- C:\Windows\System\dOSKkIv.exe
  C:\Windows\System\dOSKkIv.exe
  2⤵
  PID:9376
- C:\Windows\System\YkTGOua.exe
  C:\Windows\System\YkTGOua.exe
  2⤵
  PID:1928
- C:\Windows\System\TkSJVNu.exe
  C:\Windows\System\TkSJVNu.exe
  2⤵
  PID:8400
- C:\Windows\System\vHSBCLI.exe
  C:\Windows\System\vHSBCLI.exe
  2⤵
  PID:9572
- C:\Windows\System\xkumczw.exe
  C:\Windows\System\xkumczw.exe
  2⤵
  PID:9100
- C:\Windows\System\DoJWDsQ.exe
  C:\Windows\System\DoJWDsQ.exe
  2⤵
  PID:9636
- C:\Windows\System\ZTiKYKo.exe
  C:\Windows\System\ZTiKYKo.exe
  2⤵
  PID:9352
- C:\Windows\System\EjFVhLy.exe
  C:\Windows\System\EjFVhLy.exe
  2⤵
  PID:9848
- C:\Windows\System\fosgkDg.exe
  C:\Windows\System\fosgkDg.exe
  2⤵
  PID:10248
- C:\Windows\System\ulhgcCT.exe
  C:\Windows\System\ulhgcCT.exe
  2⤵
  PID:10272
- C:\Windows\System\khTSisN.exe
  C:\Windows\System\khTSisN.exe
  2⤵
  PID:10292
- C:\Windows\System\UFXHMdD.exe
  C:\Windows\System\UFXHMdD.exe
  2⤵
  PID:10316
- C:\Windows\System\NQuHGeF.exe
  C:\Windows\System\NQuHGeF.exe
  2⤵
  PID:10368
- C:\Windows\System\cySHqIr.exe
  C:\Windows\System\cySHqIr.exe
  2⤵
  PID:10388
- C:\Windows\System\OihhNru.exe
  C:\Windows\System\OihhNru.exe
  2⤵
  PID:10412
- C:\Windows\System\pYImjXI.exe
  C:\Windows\System\pYImjXI.exe
  2⤵
  PID:10436
- C:\Windows\System\gEmEkfo.exe
  C:\Windows\System\gEmEkfo.exe
  2⤵
  PID:10524
- C:\Windows\System\cFXBern.exe
  C:\Windows\System\cFXBern.exe
  2⤵
  PID:10544
- C:\Windows\System\yTiYsgG.exe
  C:\Windows\System\yTiYsgG.exe
  2⤵
  PID:10564
- C:\Windows\System\zQpIyQk.exe
  C:\Windows\System\zQpIyQk.exe
  2⤵
  PID:10600
- C:\Windows\System\kpJNvzo.exe
  C:\Windows\System\kpJNvzo.exe
  2⤵
  PID:10620
- C:\Windows\System\zfleUJR.exe
  C:\Windows\System\zfleUJR.exe
  2⤵
  PID:10640
- C:\Windows\System\mZOBtEE.exe
  C:\Windows\System\mZOBtEE.exe
  2⤵
  PID:10660
- C:\Windows\System\nOWduVS.exe
  C:\Windows\System\nOWduVS.exe
  2⤵
  PID:10680
- C:\Windows\System\htFqxij.exe
  C:\Windows\System\htFqxij.exe
  2⤵
  PID:10696
- C:\Windows\System\OIPojfp.exe
  C:\Windows\System\OIPojfp.exe
  2⤵
  PID:10712
- C:\Windows\System\RKzqJpj.exe
  C:\Windows\System\RKzqJpj.exe
  2⤵
  PID:10740
- C:\Windows\System\yaJKLVD.exe
  C:\Windows\System\yaJKLVD.exe
  2⤵
  PID:10760
- C:\Windows\System\rPnwPUI.exe
  C:\Windows\System\rPnwPUI.exe
  2⤵
  PID:10780
- C:\Windows\System\qXVyGLk.exe
  C:\Windows\System\qXVyGLk.exe
  2⤵
  PID:10800
- C:\Windows\System\SxVteLJ.exe
  C:\Windows\System\SxVteLJ.exe
  2⤵
  PID:10824
- C:\Windows\System\VRDKwxc.exe
  C:\Windows\System\VRDKwxc.exe
  2⤵
  PID:10852
- C:\Windows\System\EyzWeLU.exe
  C:\Windows\System\EyzWeLU.exe
  2⤵
  PID:10884
- C:\Windows\System\qAmFXgL.exe
  C:\Windows\System\qAmFXgL.exe
  2⤵
  PID:10912
- C:\Windows\System\xMvvsGq.exe
  C:\Windows\System\xMvvsGq.exe
  2⤵
  PID:10940
- C:\Windows\System\iQzRdao.exe
  C:\Windows\System\iQzRdao.exe
  2⤵
  PID:10960
- C:\Windows\System\sAqyZqa.exe
  C:\Windows\System\sAqyZqa.exe
  2⤵
  PID:10984
- C:\Windows\System\lGeVgNp.exe
  C:\Windows\System\lGeVgNp.exe
  2⤵
  PID:11004
- C:\Windows\System\atsiKTf.exe
  C:\Windows\System\atsiKTf.exe
  2⤵
  PID:11024
- C:\Windows\System\GZPsmII.exe
  C:\Windows\System\GZPsmII.exe
  2⤵
  PID:11048
- C:\Windows\System\rzOAuuF.exe
  C:\Windows\System\rzOAuuF.exe
  2⤵
  PID:11068
- C:\Windows\System\iZQZVoN.exe
  C:\Windows\System\iZQZVoN.exe
  2⤵
  PID:11088
- C:\Windows\System\ZkQYkyy.exe
  C:\Windows\System\ZkQYkyy.exe
  2⤵
  PID:11104
- C:\Windows\System\VdSRnXI.exe
  C:\Windows\System\VdSRnXI.exe
  2⤵
  PID:11128
- C:\Windows\System\HdHcZaV.exe
  C:\Windows\System\HdHcZaV.exe
  2⤵
  PID:11144
- C:\Windows\System\AZynXTJ.exe
  C:\Windows\System\AZynXTJ.exe
  2⤵
  PID:11168
- C:\Windows\System\OZlVJOl.exe
  C:\Windows\System\OZlVJOl.exe
  2⤵
  PID:11188
- C:\Windows\System\egKgrxg.exe
  C:\Windows\System\egKgrxg.exe
  2⤵
  PID:11208
- C:\Windows\System\YnlzbZW.exe
  C:\Windows\System\YnlzbZW.exe
  2⤵
  PID:11236
- C:\Windows\System\xDJeHeG.exe
  C:\Windows\System\xDJeHeG.exe
  2⤵
  PID:11260
- C:\Windows\System\OJJchBG.exe
  C:\Windows\System\OJJchBG.exe
  2⤵
  PID:10108
- C:\Windows\System\HvvvJbg.exe
  C:\Windows\System\HvvvJbg.exe
  2⤵
  PID:9920
- C:\Windows\System\DBwnwuE.exe
  C:\Windows\System\DBwnwuE.exe
  2⤵
  PID:8712
- C:\Windows\System\MYUAxsd.exe
  C:\Windows\System\MYUAxsd.exe
  2⤵
  PID:8544
- C:\Windows\System\eeqEfDD.exe
  C:\Windows\System\eeqEfDD.exe
  2⤵
  PID:10304
- C:\Windows\System\AhEGbVm.exe
  C:\Windows\System\AhEGbVm.exe
  2⤵
  PID:9840
- C:\Windows\System\aRcaTaY.exe
  C:\Windows\System\aRcaTaY.exe
  2⤵
  PID:10428
- C:\Windows\System\oSLAxaj.exe
  C:\Windows\System\oSLAxaj.exe
  2⤵
  PID:9940
- C:\Windows\System\aGfSPpl.exe
  C:\Windows\System\aGfSPpl.exe
  2⤵
  PID:10516
- C:\Windows\System\MOuUjjx.exe
  C:\Windows\System\MOuUjjx.exe
  2⤵
  PID:10576
- C:\Windows\System\cGocjhL.exe
  C:\Windows\System\cGocjhL.exe
  2⤵
  PID:9360
- C:\Windows\System\Wjzjcni.exe
  C:\Windows\System\Wjzjcni.exe
  2⤵
  PID:10228
- C:\Windows\System\KBSthTg.exe
  C:\Windows\System\KBSthTg.exe
  2⤵
  PID:9868
- C:\Windows\System\OforczN.exe
  C:\Windows\System\OforczN.exe
  2⤵
  PID:10288
- C:\Windows\System\DTuCUhT.exe
  C:\Windows\System\DTuCUhT.exe
  2⤵
  PID:10344
- C:\Windows\System\YsIShYl.exe
  C:\Windows\System\YsIShYl.exe
  2⤵
  PID:11280
- C:\Windows\System\efCFbkt.exe
  C:\Windows\System\efCFbkt.exe
  2⤵
  PID:11300
- C:\Windows\System\ImlYmYX.exe
  C:\Windows\System\ImlYmYX.exe
  2⤵
  PID:11324
- C:\Windows\System\EpNmbtV.exe
  C:\Windows\System\EpNmbtV.exe
  2⤵
  PID:11344
- C:\Windows\System\XzoeSoC.exe
  C:\Windows\System\XzoeSoC.exe
  2⤵
  PID:11360
- C:\Windows\System\NNVPHAt.exe
  C:\Windows\System\NNVPHAt.exe
  2⤵
  PID:11380
- C:\Windows\System\PPThGLV.exe
  C:\Windows\System\PPThGLV.exe
  2⤵
  PID:11400
- C:\Windows\System\UBYFMLu.exe
  C:\Windows\System\UBYFMLu.exe
  2⤵
  PID:11424
- C:\Windows\System\AOiAidg.exe
  C:\Windows\System\AOiAidg.exe
  2⤵
  PID:11460
- C:\Windows\System\YpieRWF.exe
  C:\Windows\System\YpieRWF.exe
  2⤵
  PID:11648
- C:\Windows\System\ckFOEgb.exe
  C:\Windows\System\ckFOEgb.exe
  2⤵
  PID:11668
- C:\Windows\System\GIwtfKz.exe
  C:\Windows\System\GIwtfKz.exe
  2⤵
  PID:11704
- C:\Windows\System\ecfKbpU.exe
  C:\Windows\System\ecfKbpU.exe
  2⤵
  PID:11724
- C:\Windows\System\UhbUUZb.exe
  C:\Windows\System\UhbUUZb.exe
  2⤵
  PID:11748
- C:\Windows\System\NVGuDnN.exe
  C:\Windows\System\NVGuDnN.exe
  2⤵
  PID:11768
- C:\Windows\System\xrOUElp.exe
  C:\Windows\System\xrOUElp.exe
  2⤵
  PID:11800
- C:\Windows\System\ETwseNH.exe
  C:\Windows\System\ETwseNH.exe
  2⤵
  PID:11828
- C:\Windows\System\HkXQYLC.exe
  C:\Windows\System\HkXQYLC.exe
  2⤵
  PID:11848
- C:\Windows\System\SQNQtzY.exe
  C:\Windows\System\SQNQtzY.exe
  2⤵
  PID:11912
- C:\Windows\System\ZdxqISz.exe
  C:\Windows\System\ZdxqISz.exe
  2⤵
  PID:11932
- C:\Windows\System\JbKpqYh.exe
  C:\Windows\System\JbKpqYh.exe
  2⤵
  PID:11952
- C:\Windows\System\wAHNvpz.exe
  C:\Windows\System\wAHNvpz.exe
  2⤵
  PID:11976
- C:\Windows\System\bgCqhRH.exe
  C:\Windows\System\bgCqhRH.exe
  2⤵
  PID:12000
- C:\Windows\System\kKVxPtH.exe
  C:\Windows\System\kKVxPtH.exe
  2⤵
  PID:12016
- C:\Windows\System\KnNVnLI.exe
  C:\Windows\System\KnNVnLI.exe
  2⤵
  PID:12032
- C:\Windows\System\SvGRuDk.exe
  C:\Windows\System\SvGRuDk.exe
  2⤵
  PID:12052
- C:\Windows\System\XkymAqf.exe
  C:\Windows\System\XkymAqf.exe
  2⤵
  PID:12068
- C:\Windows\System\WyHrDxl.exe
  C:\Windows\System\WyHrDxl.exe
  2⤵
  PID:12084
- C:\Windows\System\buJJTRF.exe
  C:\Windows\System\buJJTRF.exe
  2⤵
  PID:12120
- C:\Windows\System\ZjLCKbP.exe
  C:\Windows\System\ZjLCKbP.exe
  2⤵
  PID:12140
- C:\Windows\System\vEtuRxS.exe
  C:\Windows\System\vEtuRxS.exe
  2⤵
  PID:12164
- C:\Windows\System\AukaBIG.exe
  C:\Windows\System\AukaBIG.exe
  2⤵
  PID:12184
- C:\Windows\System\StStbHd.exe
  C:\Windows\System\StStbHd.exe
  2⤵
  PID:12216
- C:\Windows\System\aqvGxAy.exe
  C:\Windows\System\aqvGxAy.exe
  2⤵
  PID:12236
- C:\Windows\System\AtVinVc.exe
  C:\Windows\System\AtVinVc.exe
  2⤵
  PID:12260
- C:\Windows\System\cgNVqks.exe
  C:\Windows\System\cgNVqks.exe
  2⤵
  PID:12280
- C:\Windows\System\YZHZOds.exe
  C:\Windows\System\YZHZOds.exe
  2⤵
  PID:10432
- C:\Windows\System\sXtTFCW.exe
  C:\Windows\System\sXtTFCW.exe
  2⤵
  PID:10676
- C:\Windows\System\fEuAqrc.exe
  C:\Windows\System\fEuAqrc.exe
  2⤵
  PID:11160
- C:\Windows\System\JhBzcxL.exe
  C:\Windows\System\JhBzcxL.exe
  2⤵
  PID:4596
- C:\Windows\System\ytxsVCP.exe
  C:\Windows\System\ytxsVCP.exe
  2⤵
  PID:10012
- C:\Windows\System\lcVtpqt.exe
  C:\Windows\System\lcVtpqt.exe
  2⤵
  PID:10044
- C:\Windows\System\MvNNfnG.exe
  C:\Windows\System\MvNNfnG.exe
  2⤵
  PID:10076
- C:\Windows\System\nafrqnr.exe
  C:\Windows\System\nafrqnr.exe
  2⤵
  PID:9936
- C:\Windows\System\nPLwqfm.exe
  C:\Windows\System\nPLwqfm.exe
  2⤵
  PID:10844
- C:\Windows\System\suySdyS.exe
  C:\Windows\System\suySdyS.exe
  2⤵
  PID:10956
- C:\Windows\System\nJzdMOw.exe
  C:\Windows\System\nJzdMOw.exe
  2⤵
  PID:11096
- C:\Windows\System\ojToUQl.exe
  C:\Windows\System\ojToUQl.exe
  2⤵
  PID:11248
- C:\Windows\System\VhVyUtl.exe
  C:\Windows\System\VhVyUtl.exe
  2⤵
  PID:11204
- C:\Windows\System\tJuEdcr.exe
  C:\Windows\System\tJuEdcr.exe
  2⤵
  PID:11468
- C:\Windows\System\uwGeJcc.exe
  C:\Windows\System\uwGeJcc.exe
  2⤵
  PID:10148
- C:\Windows\System\VjUbzMo.exe
  C:\Windows\System\VjUbzMo.exe
  2⤵
  PID:11716
- C:\Windows\System\NkHCKYb.exe
  C:\Windows\System\NkHCKYb.exe
  2⤵
  PID:11788
- C:\Windows\System\fVhAtFs.exe
  C:\Windows\System\fVhAtFs.exe
  2⤵
  PID:10364
- C:\Windows\System\LxEZtBk.exe
  C:\Windows\System\LxEZtBk.exe
  2⤵
  PID:11296
- C:\Windows\System\VDAXPPE.exe
  C:\Windows\System\VDAXPPE.exe
  2⤵
  PID:11340
- C:\Windows\System\SIKrwNr.exe
  C:\Windows\System\SIKrwNr.exe
  2⤵
  PID:11896
- C:\Windows\System\fEwGhsJ.exe
  C:\Windows\System\fEwGhsJ.exe
  2⤵
  PID:11920
- C:\Windows\System\kTwwMlk.exe
  C:\Windows\System\kTwwMlk.exe
  2⤵
  PID:11504
- C:\Windows\System\bOetzYv.exe
  C:\Windows\System\bOetzYv.exe
  2⤵
  PID:3488
- C:\Windows\System\VAjouEr.exe
  C:\Windows\System\VAjouEr.exe
  2⤵
  PID:12300
- C:\Windows\System\KVwUPtq.exe
  C:\Windows\System\KVwUPtq.exe
  2⤵
  PID:12320
- C:\Windows\System\ztVYmBS.exe
  C:\Windows\System\ztVYmBS.exe
  2⤵
  PID:12344
- C:\Windows\System\xLVNjbQ.exe
  C:\Windows\System\xLVNjbQ.exe
  2⤵
  PID:12364
- C:\Windows\System\IOCHmqS.exe
  C:\Windows\System\IOCHmqS.exe
  2⤵
  PID:12380
- C:\Windows\System\xcDcryC.exe
  C:\Windows\System\xcDcryC.exe
  2⤵
  PID:12408
- C:\Windows\System\bNTbHei.exe
  C:\Windows\System\bNTbHei.exe
  2⤵
  PID:12424
- C:\Windows\System\WkJQaCQ.exe
  C:\Windows\System\WkJQaCQ.exe
  2⤵
  PID:12440
- C:\Windows\System\FiDWoVw.exe
  C:\Windows\System\FiDWoVw.exe
  2⤵
  PID:12460
- C:\Windows\System\OukguHC.exe
  C:\Windows\System\OukguHC.exe
  2⤵
  PID:12476
- C:\Windows\System\tYCrNyr.exe
  C:\Windows\System\tYCrNyr.exe
  2⤵
  PID:12492
- C:\Windows\System\PZWWQUF.exe
  C:\Windows\System\PZWWQUF.exe
  2⤵
  PID:12512
- C:\Windows\System\VpEuBvs.exe
  C:\Windows\System\VpEuBvs.exe
  2⤵
  PID:12528
- C:\Windows\System\oyKsSLn.exe
  C:\Windows\System\oyKsSLn.exe
  2⤵
  PID:12544
- C:\Windows\System\aKBFncn.exe
  C:\Windows\System\aKBFncn.exe
  2⤵
  PID:12568
- C:\Windows\System\hVrFIJE.exe
  C:\Windows\System\hVrFIJE.exe
  2⤵
  PID:12588
- C:\Windows\System\eEcJrky.exe
  C:\Windows\System\eEcJrky.exe
  2⤵
  PID:12804
- C:\Windows\System\XzbrmEU.exe
  C:\Windows\System\XzbrmEU.exe
  2⤵
  PID:12840
- C:\Windows\System\SwFNMXx.exe
  C:\Windows\System\SwFNMXx.exe
  2⤵
  PID:12872
- C:\Windows\System\cCMNdEu.exe
  C:\Windows\System\cCMNdEu.exe
  2⤵
  PID:12888
- C:\Windows\System\VdfVoKx.exe
  C:\Windows\System\VdfVoKx.exe
  2⤵
  PID:12908
- C:\Windows\System\cztjSZZ.exe
  C:\Windows\System\cztjSZZ.exe
  2⤵
  PID:12924
- C:\Windows\System\TanlvLB.exe
  C:\Windows\System\TanlvLB.exe
  2⤵
  PID:12944
- C:\Windows\System\lBJRick.exe
  C:\Windows\System\lBJRick.exe
  2⤵
  PID:12960
- C:\Windows\System\ByiADsx.exe
  C:\Windows\System\ByiADsx.exe
  2⤵
  PID:12976
- C:\Windows\System\jaXlJru.exe
  C:\Windows\System\jaXlJru.exe
  2⤵
  PID:12992
- C:\Windows\System\zHihzdy.exe
  C:\Windows\System\zHihzdy.exe
  2⤵
  PID:13008
- C:\Windows\System\MNJwdoz.exe
  C:\Windows\System\MNJwdoz.exe
  2⤵
  PID:13024
- C:\Windows\System\lgYrtZJ.exe
  C:\Windows\System\lgYrtZJ.exe
  2⤵
  PID:13040
- C:\Windows\System\rRBWwor.exe
  C:\Windows\System\rRBWwor.exe
  2⤵
  PID:13056
- C:\Windows\System\tgamMHs.exe
  C:\Windows\System\tgamMHs.exe
  2⤵
  PID:13072
- C:\Windows\System\QXIBQyZ.exe
  C:\Windows\System\QXIBQyZ.exe
  2⤵
  PID:13088
- C:\Windows\System\GogIrEW.exe
  C:\Windows\System\GogIrEW.exe
  2⤵
  PID:13104
- C:\Windows\System\eFZjadG.exe
  C:\Windows\System\eFZjadG.exe
  2⤵
  PID:13120
- C:\Windows\System\UTUIskW.exe
  C:\Windows\System\UTUIskW.exe
  2⤵
  PID:13136
- C:\Windows\System\qiFpZym.exe
  C:\Windows\System\qiFpZym.exe
  2⤵
  PID:13160
- C:\Windows\System\dfecJuK.exe
  C:\Windows\System\dfecJuK.exe
  2⤵
  PID:13180
- C:\Windows\System\iVYvQtJ.exe
  C:\Windows\System\iVYvQtJ.exe
  2⤵
  PID:13196
- C:\Windows\System\EJqXieg.exe
  C:\Windows\System\EJqXieg.exe
  2⤵
  PID:13220
- C:\Windows\System\gJlewYt.exe
  C:\Windows\System\gJlewYt.exe
  2⤵
  PID:13248
- C:\Windows\System\oifVsDZ.exe
  C:\Windows\System\oifVsDZ.exe
  2⤵
  PID:13272
- C:\Windows\System\AEJoYJp.exe
  C:\Windows\System\AEJoYJp.exe
  2⤵
  PID:13292
- C:\Windows\System\XnpNAiX.exe
  C:\Windows\System\XnpNAiX.exe
  2⤵
  PID:12024
- C:\Windows\System\tfzexly.exe
  C:\Windows\System\tfzexly.exe
  2⤵
  PID:11616
- C:\Windows\System\qODdnYw.exe
  C:\Windows\System\qODdnYw.exe
  2⤵
  PID:12176
- C:\Windows\System\FSncuRX.exe
  C:\Windows\System\FSncuRX.exe
  2⤵
  PID:12232
- C:\Windows\System\tcKAeMZ.exe
  C:\Windows\System\tcKAeMZ.exe
  2⤵
  PID:12272
- C:\Windows\System\ajIgBsH.exe
  C:\Windows\System\ajIgBsH.exe
  2⤵
  PID:1428
- C:\Windows\System\EByxUoV.exe
  C:\Windows\System\EByxUoV.exe
  2⤵
  PID:12640
- C:\Windows\System\FteHVAZ.exe
  C:\Windows\System\FteHVAZ.exe
  2⤵
  PID:12540
- C:\Windows\System\XYERyXT.exe
  C:\Windows\System\XYERyXT.exe
  2⤵
  PID:12580
- C:\Windows\System\KFzBwvs.exe
  C:\Windows\System\KFzBwvs.exe
  2⤵
  PID:12988
- C:\Windows\System\KgdYTAW.exe
  C:\Windows\System\KgdYTAW.exe
  2⤵
  PID:13032
- C:\Windows\System\jbcCqew.exe
  C:\Windows\System\jbcCqew.exe
  2⤵
  PID:13080
- C:\Windows\System\jYQCGnu.exe
  C:\Windows\System\jYQCGnu.exe
  2⤵
  PID:12400
- C:\Windows\System\jmthEJe.exe
  C:\Windows\System\jmthEJe.exe
  2⤵
  PID:1768
- C:\Windows\System\gjURvBO.exe
  C:\Windows\System\gjURvBO.exe
  2⤵
  PID:13304
- C:\Windows\System\NLqAvIK.exe
  C:\Windows\System\NLqAvIK.exe
  2⤵
  PID:8628
- C:\Windows\System\xbdjWYY.exe
  C:\Windows\System\xbdjWYY.exe
  2⤵
  PID:3516
- C:\Windows\System\OMPsyJs.exe
  C:\Windows\System\OMPsyJs.exe
  2⤵
  PID:4620
- C:\Windows\System\HIdZsUG.exe
  C:\Windows\System\HIdZsUG.exe
  2⤵
  PID:2512
- C:\Windows\System\rGORsro.exe
  C:\Windows\System\rGORsro.exe
  2⤵
  PID:212
- C:\Windows\System\RfSARvH.exe
  C:\Windows\System\RfSARvH.exe
  2⤵
  PID:4264
- C:\Windows\System\NbpYNPW.exe
  C:\Windows\System\NbpYNPW.exe
  2⤵
  PID:3576
- C:\Windows\System\koZBUxF.exe
  C:\Windows\System\koZBUxF.exe
  2⤵
  PID:3508
- C:\Windows\System\LQBTdpO.exe
  C:\Windows\System\LQBTdpO.exe
  2⤵
  PID:3500
- C:\Windows\System\Uxvvexa.exe
  C:\Windows\System\Uxvvexa.exe
  2⤵
  PID:416
- C:\Windows\System\SabpCiq.exe
  C:\Windows\System\SabpCiq.exe
  2⤵
  PID:732
- C:\Windows\System\nwlHEOO.exe
  C:\Windows\System\nwlHEOO.exe
  2⤵
  PID:1920
- C:\Windows\System\byAQIii.exe
  C:\Windows\System\byAQIii.exe
  2⤵
  PID:3480
- C:\Windows\System\kbTeLBj.exe
  C:\Windows\System\kbTeLBj.exe
  2⤵
  PID:12468
- C:\Windows\System\AzBEQuO.exe
  C:\Windows\System\AzBEQuO.exe
  2⤵
  PID:12448
- C:\Windows\System\IHwaqjT.exe
  C:\Windows\System\IHwaqjT.exe
  2⤵
  PID:11968
- C:\Windows\System\xHJFRrg.exe
  C:\Windows\System\xHJFRrg.exe
  2⤵
  PID:3972
- C:\Windows\System\naiUejL.exe
  C:\Windows\System\naiUejL.exe
  2⤵
  PID:4348
- C:\Windows\System\YUEvIvQ.exe
  C:\Windows\System\YUEvIvQ.exe
  2⤵
  PID:11880
- C:\Windows\System\HMyfmYC.exe
  C:\Windows\System\HMyfmYC.exe
  2⤵
  PID:12156
- C:\Windows\System\rYSUhcR.exe
  C:\Windows\System\rYSUhcR.exe
  2⤵
  PID:10924
- C:\Windows\System\JzgdTGw.exe
  C:\Windows\System\JzgdTGw.exe
  2⤵
  PID:2240
- C:\Windows\System\JYacQHQ.exe
  C:\Windows\System\JYacQHQ.exe
  2⤵
  PID:11396
- C:\Windows\System\fciYvrp.exe
  C:\Windows\System\fciYvrp.exe
  2⤵
  PID:12916
- C:\Windows\System\sMaijkn.exe
  C:\Windows\System\sMaijkn.exe
  2⤵
  PID:9924
- C:\Windows\System\USkpAaH.exe
  C:\Windows\System\USkpAaH.exe
  2⤵
  PID:13240
- C:\Windows\System\IqTNwzQ.exe
  C:\Windows\System\IqTNwzQ.exe
  2⤵
  PID:6328
- C:\Windows\System\pYvWuOM.exe
  C:\Windows\System\pYvWuOM.exe
  2⤵
  PID:5764
- C:\Windows\System\UaXtoWZ.exe
  C:\Windows\System\UaXtoWZ.exe
  2⤵
  PID:4360
- C:\Windows\System\KECPlVS.exe
  C:\Windows\System\KECPlVS.exe
  2⤵
  PID:3920
- C:\Windows\System\PHkqljv.exe
  C:\Windows\System\PHkqljv.exe
  2⤵
  PID:12564
- C:\Windows\System\dUxCMWw.exe
  C:\Windows\System\dUxCMWw.exe
  2⤵
  PID:6576
- C:\Windows\System\xRXLqEZ.exe
  C:\Windows\System\xRXLqEZ.exe
  2⤵
  PID:4716
- C:\Windows\System\zHSrVMX.exe
  C:\Windows\System\zHSrVMX.exe
  2⤵
  PID:2124
- C:\Windows\System\lwVYldN.exe
  C:\Windows\System\lwVYldN.exe
  2⤵
  PID:1248
- C:\Windows\System\HCOVfKn.exe
  C:\Windows\System\HCOVfKn.exe
  2⤵
  PID:6160
- C:\Windows\System\uhVMAjY.exe
  C:\Windows\System\uhVMAjY.exe
  2⤵
  PID:13376
- C:\Windows\System\BMtDVxz.exe
  C:\Windows\System\BMtDVxz.exe
  2⤵
  PID:13392
- C:\Windows\System\XwVJxYm.exe
  C:\Windows\System\XwVJxYm.exe
  2⤵
  PID:13464
- C:\Windows\System\nUsJkiX.exe
  C:\Windows\System\nUsJkiX.exe
  2⤵
  PID:13528
- C:\Windows\System\GFFUiCG.exe
  C:\Windows\System\GFFUiCG.exe
  2⤵
  PID:13636
- C:\Windows\System\JIhbhLH.exe
  C:\Windows\System\JIhbhLH.exe
  2⤵
  PID:13700
- C:\Windows\System\hreXcuo.exe
  C:\Windows\System\hreXcuo.exe
  2⤵
  PID:13716
- C:\Windows\System\CMcddJj.exe
  C:\Windows\System\CMcddJj.exe
  2⤵
  PID:13732
- C:\Windows\System\eAcwzKg.exe
  C:\Windows\System\eAcwzKg.exe
  2⤵
  PID:13752
- C:\Windows\System\tPDWEJO.exe
  C:\Windows\System\tPDWEJO.exe
  2⤵
  PID:13844
- C:\Windows\System\VQobERK.exe
  C:\Windows\System\VQobERK.exe
  2⤵
  PID:13868
- C:\Windows\System\pWRAIOU.exe
  C:\Windows\System\pWRAIOU.exe
  2⤵
  PID:13964
- C:\Windows\System\AjEPEwA.exe
  C:\Windows\System\AjEPEwA.exe
  2⤵
  PID:14064
- C:\Windows\System\MMdwtev.exe
  C:\Windows\System\MMdwtev.exe
  2⤵
  PID:14232
- C:\Windows\System\fkUzEDe.exe
  C:\Windows\System\fkUzEDe.exe
  2⤵
  PID:14248
- C:\Windows\System\yPmanXw.exe
  C:\Windows\System\yPmanXw.exe
  2⤵
  PID:5824
- C:\Windows\System\ZeOqjCS.exe
  C:\Windows\System\ZeOqjCS.exe
  2⤵
  PID:13408
- C:\Windows\System\fQMKRZt.exe
  C:\Windows\System\fQMKRZt.exe
  2⤵
  PID:13452
- C:\Windows\System\CoOySpt.exe
  C:\Windows\System\CoOySpt.exe
  2⤵
  PID:2280
- C:\Windows\System\jCizqHu.exe
  C:\Windows\System\jCizqHu.exe
  2⤵
  PID:6372
- C:\Windows\System\ToRuyiU.exe
  C:\Windows\System\ToRuyiU.exe
  2⤵
  PID:13340
- C:\Windows\System\ITZlVCe.exe
  C:\Windows\System\ITZlVCe.exe
  2⤵
  PID:13548
- C:\Windows\System\CYaemkR.exe
  C:\Windows\System\CYaemkR.exe
  2⤵
  PID:608
- C:\Windows\System\pbukqab.exe
  C:\Windows\System\pbukqab.exe
  2⤵
  PID:13568
- C:\Windows\System\GrmISma.exe
  C:\Windows\System\GrmISma.exe
  2⤵
  PID:4948
- C:\Windows\System\HHEqQtN.exe
  C:\Windows\System\HHEqQtN.exe
  2⤵
  PID:13624
- C:\Windows\System\wnjNlsT.exe
  C:\Windows\System\wnjNlsT.exe
  2⤵
  PID:2436
- C:\Windows\System\hdUGKKX.exe
  C:\Windows\System\hdUGKKX.exe
  2⤵
  PID:13864
- C:\Windows\System\DIEJtva.exe
  C:\Windows\System\DIEJtva.exe
  2⤵
  PID:13988
- C:\Windows\System\DsmvKMB.exe
  C:\Windows\System\DsmvKMB.exe
  2⤵
  PID:13916
- C:\Windows\System\ZOnjglf.exe
  C:\Windows\System\ZOnjglf.exe
  2⤵
  PID:14008
- C:\Windows\System\CCVcBjN.exe
  C:\Windows\System\CCVcBjN.exe
  2⤵
  PID:13940
- C:\Windows\System\vXPaLqo.exe
  C:\Windows\System\vXPaLqo.exe
  2⤵
  PID:13956
- C:\Windows\System\UmQaaux.exe
  C:\Windows\System\UmQaaux.exe
  2⤵
  PID:14060
- C:\Windows\System\PRQwvRY.exe
  C:\Windows\System\PRQwvRY.exe
  2⤵
  PID:14128
- C:\Windows\System\WdxSjMY.exe
  C:\Windows\System\WdxSjMY.exe
  2⤵
  PID:14044
- C:\Windows\System\EaSXcrE.exe
  C:\Windows\System\EaSXcrE.exe
  2⤵
  PID:14240
- C:\Windows\System\Dxvjikz.exe
  C:\Windows\System\Dxvjikz.exe
  2⤵
  PID:14280
- C:\Windows\System\ntsBsBL.exe
  C:\Windows\System\ntsBsBL.exe
  2⤵
  PID:14076
- C:\Windows\System\iphRoaq.exe
  C:\Windows\System\iphRoaq.exe
  2⤵
  PID:14100
- C:\Windows\System\ehrwSfD.exe
  C:\Windows\System\ehrwSfD.exe
  2⤵
  PID:13760
- C:\Windows\System\FEVIbFi.exe
  C:\Windows\System\FEVIbFi.exe
  2⤵
  PID:4084
- C:\Windows\System\VXzJZod.exe
  C:\Windows\System\VXzJZod.exe
  2⤵
  PID:13260
- C:\Windows\System\sicGNtF.exe
  C:\Windows\System\sicGNtF.exe
  2⤵
  PID:3276
- C:\Windows\System\DyqdQCH.exe
  C:\Windows\System\DyqdQCH.exe
  2⤵
  PID:13604
- C:\Windows\System\PyVVtlD.exe
  C:\Windows\System\PyVVtlD.exe
  2⤵
  PID:13436
- C:\Windows\System\pVPOrdV.exe
  C:\Windows\System\pVPOrdV.exe
  2⤵
  PID:13608
- C:\Windows\System\raWSGJY.exe
  C:\Windows\System\raWSGJY.exe
  2⤵
  PID:13460
- C:\Windows\System\llenqfz.exe
  C:\Windows\System\llenqfz.exe
  2⤵
  PID:13580
- C:\Windows\System\ShBcNke.exe
  C:\Windows\System\ShBcNke.exe
  2⤵
  PID:13632
- C:\Windows\System\KjxJWsu.exe
  C:\Windows\System\KjxJWsu.exe
  2⤵
  PID:13592
- C:\Windows\System\BJbsvDm.exe
  C:\Windows\System\BJbsvDm.exe
  2⤵
  PID:13892
- C:\Windows\System\vBJRopI.exe
  C:\Windows\System\vBJRopI.exe
  2⤵
  PID:6612
- C:\Windows\System\VfgjzZn.exe
  C:\Windows\System\VfgjzZn.exe
  2⤵
  PID:5040
- C:\Windows\System\AbUWBMT.exe
  C:\Windows\System\AbUWBMT.exe
  2⤵
  PID:14112
- C:\Windows\System\IRzUEPN.exe
  C:\Windows\System\IRzUEPN.exe
  2⤵
  PID:14088
- C:\Windows\System\oMvtEBv.exe
  C:\Windows\System\oMvtEBv.exe
  2⤵
  PID:456
- C:\Windows\System\SyKLYpR.exe
  C:\Windows\System\SyKLYpR.exe
  2⤵
  PID:14024
- C:\Windows\System\gujVsAo.exe
  C:\Windows\System\gujVsAo.exe
  2⤵
  PID:12452
- C:\Windows\System\xaQySIH.exe
  C:\Windows\System\xaQySIH.exe
  2⤵
  PID:5356
- C:\Windows\System\ogpBVWX.exe
  C:\Windows\System\ogpBVWX.exe
  2⤵
  PID:11276
- C:\Windows\System\EGcOGQR.exe
  C:\Windows\System\EGcOGQR.exe
  2⤵
  PID:13364
- C:\Windows\System\fuFlACz.exe
  C:\Windows\System\fuFlACz.exe
  2⤵
  PID:13404
- C:\Windows\System\YgUEgxU.exe
  C:\Windows\System\YgUEgxU.exe
  2⤵
  PID:5428
- C:\Windows\System\BiPZUxr.exe
  C:\Windows\System\BiPZUxr.exe
  2⤵
  PID:5732
- C:\Windows\System\zYNRAgU.exe
  C:\Windows\System\zYNRAgU.exe
  2⤵
  PID:1732
- C:\Windows\System\LiSttfP.exe
  C:\Windows\System\LiSttfP.exe
  2⤵
  PID:5212
- C:\Windows\System\SjXDtQr.exe
  C:\Windows\System\SjXDtQr.exe
  2⤵
  PID:5348
- C:\Windows\System\qcbcGRt.exe
  C:\Windows\System\qcbcGRt.exe
  2⤵
  PID:5244
- C:\Windows\System\zGWcxop.exe
  C:\Windows\System\zGWcxop.exe
  2⤵
  PID:11584
- C:\Windows\System\svfpyIH.exe
  C:\Windows\System\svfpyIH.exe
  2⤵
  PID:6444
- C:\Windows\System\LsKjMMR.exe
  C:\Windows\System\LsKjMMR.exe
  2⤵
  PID:6584
- C:\Windows\System\plbvozy.exe
  C:\Windows\System\plbvozy.exe
  2⤵
  PID:13512
- C:\Windows\System\vRiDtol.exe
  C:\Windows\System\vRiDtol.exe
  2⤵
  PID:5660
- C:\Windows\System\hIsHBTg.exe
  C:\Windows\System\hIsHBTg.exe
  2⤵
  PID:5560
- C:\Windows\System\IqdtRBs.exe
  C:\Windows\System\IqdtRBs.exe
  2⤵
  PID:5332
- C:\Windows\System\AiOgnaW.exe
  C:\Windows\System\AiOgnaW.exe
  2⤵
  PID:13980
- C:\Windows\System\OBiHcZp.exe
  C:\Windows\System\OBiHcZp.exe
  2⤵
  PID:5636
- C:\Windows\System\JjgIRBH.exe
  C:\Windows\System\JjgIRBH.exe
  2⤵
  PID:4140
- C:\Windows\System\nOUAPfi.exe
  C:\Windows\System\nOUAPfi.exe
  2⤵
  PID:4876
- C:\Windows\System\hDNZiZK.exe
  C:\Windows\System\hDNZiZK.exe
  2⤵
  PID:4604
- C:\Windows\System\PotNCwQ.exe
  C:\Windows\System\PotNCwQ.exe
  2⤵
  PID:5948
- C:\Windows\System\nDxDuUL.exe
  C:\Windows\System\nDxDuUL.exe
  2⤵
  PID:6428
- C:\Windows\System\GPOETdW.exe
  C:\Windows\System\GPOETdW.exe
  2⤵
  PID:12656
- C:\Windows\System\rczhHxU.exe
  C:\Windows\System\rczhHxU.exe
  2⤵
  PID:11960
- C:\Windows\System\RbzhIEI.exe
  C:\Windows\System\RbzhIEI.exe
  2⤵
  PID:2056
- C:\Windows\System\HnXUYNr.exe
  C:\Windows\System\HnXUYNr.exe
  2⤵
  PID:9536
- C:\Windows\System\iukPXDg.exe
  C:\Windows\System\iukPXDg.exe
  2⤵
  PID:14180
- C:\Windows\System\NhLToCC.exe
  C:\Windows\System\NhLToCC.exe
  2⤵
  PID:6112
- C:\Windows\System\sFTAkFY.exe
  C:\Windows\System\sFTAkFY.exe
  2⤵
  PID:6040
- C:\Windows\System\NPSAoQd.exe
  C:\Windows\System\NPSAoQd.exe
  2⤵
  PID:4268
- C:\Windows\System\KDkqZeM.exe
  C:\Windows\System\KDkqZeM.exe
  2⤵
  PID:5740
- C:\Windows\System\uDveGis.exe
  C:\Windows\System\uDveGis.exe
  2⤵
  PID:4340
- C:\Windows\System\zjknQSt.exe
  C:\Windows\System\zjknQSt.exe
  2⤵
  PID:5592
- C:\Windows\System\lIweEtS.exe
  C:\Windows\System\lIweEtS.exe
  2⤵
  PID:5208
- C:\Windows\System\TAfPBbb.exe
  C:\Windows\System\TAfPBbb.exe
  2⤵
  PID:6368
- C:\Windows\System\poWKFbN.exe
  C:\Windows\System\poWKFbN.exe
  2⤵
  PID:13420
- C:\Windows\System\tLdmSwB.exe
  C:\Windows\System\tLdmSwB.exe
  2⤵
  PID:5724
- C:\Windows\System\yyTgBLf.exe
  C:\Windows\System\yyTgBLf.exe
  2⤵
  PID:5264
- C:\Windows\System\QkLWsJA.exe
  C:\Windows\System\QkLWsJA.exe
  2⤵
  PID:3020
- C:\Windows\System\TyMIDGy.exe
  C:\Windows\System\TyMIDGy.exe
  2⤵
  PID:720
- C:\Windows\System\rOLfjmD.exe
  C:\Windows\System\rOLfjmD.exe
  2⤵
  PID:4388
- C:\Windows\System\BgEIfeH.exe
  C:\Windows\System\BgEIfeH.exe
  2⤵
  PID:6180
- C:\Windows\System\FxaINBv.exe
  C:\Windows\System\FxaINBv.exe
  2⤵
  PID:6152
- C:\Windows\System\NSStkEA.exe
  C:\Windows\System\NSStkEA.exe
  2⤵
  PID:100
- C:\Windows\System\SLxgMHZ.exe
  C:\Windows\System\SLxgMHZ.exe
  2⤵
  PID:6520
- C:\Windows\System\mJivXGf.exe
  C:\Windows\System\mJivXGf.exe
  2⤵
  PID:5276
- C:\Windows\System\neHurNy.exe
  C:\Windows\System\neHurNy.exe
  2⤵
  PID:5456
- C:\Windows\System\oJDHrzV.exe
  C:\Windows\System\oJDHrzV.exe
  2⤵
  PID:4476
- C:\Windows\System\FzYCrMO.exe
  C:\Windows\System\FzYCrMO.exe
  2⤵
  PID:13776
- C:\Windows\System\obHjKKF.exe
  C:\Windows\System\obHjKKF.exe
  2⤵
  PID:13884
- C:\Windows\System\pgBttWC.exe
  C:\Windows\System\pgBttWC.exe
  2⤵
  PID:5536
- C:\Windows\System\NmpahFV.exe
  C:\Windows\System\NmpahFV.exe
  2⤵
  PID:10396
- C:\Windows\System\jfRMwrU.exe
  C:\Windows\System\jfRMwrU.exe
  2⤵
  PID:14004
- C:\Windows\System\IdhuVKP.exe
  C:\Windows\System\IdhuVKP.exe
  2⤵
  PID:4780
- C:\Windows\System\fYVSFWQ.exe
  C:\Windows\System\fYVSFWQ.exe
  2⤵
  PID:7084
- C:\Windows\System\GhgRTtU.exe
  C:\Windows\System\GhgRTtU.exe
  2⤵
  PID:11664
- C:\Windows\System\oNZccBq.exe
  C:\Windows\System\oNZccBq.exe
  2⤵
  PID:13904
- C:\Windows\System\cMELXAT.exe
  C:\Windows\System\cMELXAT.exe
  2⤵
  PID:2296
- C:\Windows\System\rBlIAKu.exe
  C:\Windows\System\rBlIAKu.exe
  2⤵
  PID:6432
- C:\Windows\System\ZPVbQtX.exe
  C:\Windows\System\ZPVbQtX.exe
  2⤵
  PID:11984
- C:\Windows\System\LKXfowU.exe
  C:\Windows\System\LKXfowU.exe
  2⤵
  PID:13784
- C:\Windows\System\BClAJZx.exe
  C:\Windows\System\BClAJZx.exe
  2⤵
  PID:6656
- C:\Windows\System\EqJGnos.exe
  C:\Windows\System\EqJGnos.exe
  2⤵
  PID:14200
- C:\Windows\System\MHFIOFH.exe
  C:\Windows\System\MHFIOFH.exe
  2⤵
  PID:1536
- C:\Windows\System\RYTHPBS.exe
  C:\Windows\System\RYTHPBS.exe
  2⤵
  PID:6136
- C:\Windows\System\vNLuCkb.exe
  C:\Windows\System\vNLuCkb.exe
  2⤵
  PID:6064
- C:\Windows\System\GrPEuYh.exe
  C:\Windows\System\GrPEuYh.exe
  2⤵
  PID:6536
- C:\Windows\System\vVcRTxF.exe
  C:\Windows\System\vVcRTxF.exe
  2⤵
  PID:6240
- C:\Windows\System\PQDaICD.exe
  C:\Windows\System\PQDaICD.exe
  2⤵
  PID:3132
- C:\Windows\System\MCOHlDR.exe
  C:\Windows\System\MCOHlDR.exe
  2⤵
  PID:6156
- C:\Windows\System\tgmGPJB.exe
  C:\Windows\System\tgmGPJB.exe
  2⤵
  PID:13900
- C:\Windows\System\BGutzeD.exe
  C:\Windows\System\BGutzeD.exe
  2⤵
  PID:5632
- C:\Windows\System\xAGxKJR.exe
  C:\Windows\System\xAGxKJR.exe
  2⤵
  PID:5268
- C:\Windows\System\JwsBCgZ.exe
  C:\Windows\System\JwsBCgZ.exe
  2⤵
  PID:12560
- C:\Windows\System\SSRsfBq.exe
  C:\Windows\System\SSRsfBq.exe
  2⤵
  PID:6580
- C:\Windows\System\ZfhzGKo.exe
  C:\Windows\System\ZfhzGKo.exe
  2⤵
  PID:6964
- C:\Windows\System\RSwHhjr.exe
  C:\Windows\System\RSwHhjr.exe
  2⤵
  PID:6888
- C:\Windows\System\wRNaEND.exe
  C:\Windows\System\wRNaEND.exe
  2⤵
  PID:5448
- C:\Windows\System\ZAYiDom.exe
  C:\Windows\System\ZAYiDom.exe
  2⤵
  PID:7388
- C:\Windows\System\tziIYsl.exe
  C:\Windows\System\tziIYsl.exe
  2⤵
  PID:6808
- C:\Windows\System\RrXTpuS.exe
  C:\Windows\System\RrXTpuS.exe
  2⤵
  PID:6012
- C:\Windows\System\EJBmUzl.exe
  C:\Windows\System\EJBmUzl.exe
  2⤵
  PID:7376
- C:\Windows\System\PlYisFD.exe
  C:\Windows\System\PlYisFD.exe
  2⤵
  PID:6908
- C:\Windows\System\bSDkUGz.exe
  C:\Windows\System\bSDkUGz.exe
  2⤵
  PID:14260
- C:\Windows\System\LwrSVqh.exe
  C:\Windows\System\LwrSVqh.exe
  2⤵
  PID:7280
- C:\Windows\System\miGkqUu.exe
  C:\Windows\System\miGkqUu.exe
  2⤵
  PID:6300
- C:\Windows\System\suQEOxm.exe
  C:\Windows\System\suQEOxm.exe
  2⤵
  PID:6504
- C:\Windows\System\zBkwAie.exe
  C:\Windows\System\zBkwAie.exe
  2⤵
  PID:7192
- C:\Windows\System\DfHcNtf.exe
  C:\Windows\System\DfHcNtf.exe
  2⤵
  PID:908
- C:\Windows\System\RqKBJYC.exe
  C:\Windows\System\RqKBJYC.exe
  2⤵
  PID:5776
- C:\Windows\System\zEChHiW.exe
  C:\Windows\System\zEChHiW.exe
  2⤵
  PID:7328
- C:\Windows\System\WfaMGOQ.exe
  C:\Windows\System\WfaMGOQ.exe
  2⤵
  PID:13896
- C:\Windows\System\JxBnhAE.exe
  C:\Windows\System\JxBnhAE.exe
  2⤵
  PID:7512
- C:\Windows\System\oCkNNQU.exe
  C:\Windows\System\oCkNNQU.exe
  2⤵
  PID:11776
- C:\Windows\System\gtXCpAM.exe
  C:\Windows\System\gtXCpAM.exe
  2⤵
  PID:13984
- C:\Windows\System\FwmKPxh.exe
  C:\Windows\System\FwmKPxh.exe
  2⤵
  PID:6364
- C:\Windows\System\OqFQuxs.exe
  C:\Windows\System\OqFQuxs.exe
  2⤵
  PID:5736
- C:\Windows\System\kvGxfUL.exe
  C:\Windows\System\kvGxfUL.exe
  2⤵
  PID:1860
- C:\Windows\System\SUPOtUy.exe
  C:\Windows\System\SUPOtUy.exe
  2⤵
  PID:6940
- C:\Windows\System\ZJaifWX.exe
  C:\Windows\System\ZJaifWX.exe
  2⤵
  PID:6660
- C:\Windows\System\yheLdlL.exe
  C:\Windows\System\yheLdlL.exe
  2⤵
  PID:5248
- C:\Windows\System\VbMqHRx.exe
  C:\Windows\System\VbMqHRx.exe
  2⤵
  PID:14340
- C:\Windows\System\ElXiTnv.exe
  C:\Windows\System\ElXiTnv.exe
  2⤵
  PID:14360
- C:\Windows\System\DgcgGNc.exe
  C:\Windows\System\DgcgGNc.exe
  2⤵
  PID:14380
- C:\Windows\System\IeGJlsk.exe
  C:\Windows\System\IeGJlsk.exe
  2⤵
  PID:14408
- C:\Windows\System\rvjwOFR.exe
  C:\Windows\System\rvjwOFR.exe
  2⤵
  PID:14428
- C:\Windows\System\bmdvJGB.exe
  C:\Windows\System\bmdvJGB.exe
  2⤵
  PID:14444
- C:\Windows\System\pQIAHoX.exe
  C:\Windows\System\pQIAHoX.exe
  2⤵
  PID:14464
- C:\Windows\System\kAYuEAA.exe
  C:\Windows\System\kAYuEAA.exe
  2⤵
  PID:14488
- C:\Windows\System\ggObpXj.exe
  C:\Windows\System\ggObpXj.exe
  2⤵
  PID:14504
- C:\Windows\System\nxRcQGz.exe
  C:\Windows\System\nxRcQGz.exe
  2⤵
  PID:14524
- C:\Windows\System\nsXAwsx.exe
  C:\Windows\System\nsXAwsx.exe
  2⤵
  PID:14552
- C:\Windows\System\dlPFZrW.exe
  C:\Windows\System\dlPFZrW.exe
  2⤵
  PID:14576
- C:\Windows\System\WFFUbRh.exe
  C:\Windows\System\WFFUbRh.exe
  2⤵
  PID:14596
- C:\Windows\System\iPLvsqu.exe
  C:\Windows\System\iPLvsqu.exe
  2⤵
  PID:14616
- C:\Windows\System\yXaCGIa.exe
  C:\Windows\System\yXaCGIa.exe
  2⤵
  PID:14636
- C:\Windows\System\dUldmRk.exe
  C:\Windows\System\dUldmRk.exe
  2⤵
  PID:14656
- C:\Windows\System\lVAHbcA.exe
  C:\Windows\System\lVAHbcA.exe
  2⤵
  PID:14672
- C:\Windows\System\GMYBiYS.exe
  C:\Windows\System\GMYBiYS.exe
  2⤵
  PID:14696
- C:\Windows\System\bnmLjsm.exe
  C:\Windows\System\bnmLjsm.exe
  2⤵
  PID:14720
- C:\Windows\System\dkIsgSP.exe
  C:\Windows\System\dkIsgSP.exe
  2⤵
  PID:14740
- C:\Windows\System\QIVQTlx.exe
  C:\Windows\System\QIVQTlx.exe
  2⤵
  PID:14912
- C:\Windows\System\rGqnsIh.exe
  C:\Windows\System\rGqnsIh.exe
  2⤵
  PID:14928
- C:\Windows\System\WyJerqa.exe
  C:\Windows\System\WyJerqa.exe
  2⤵
  PID:14944
- C:\Windows\System\ktdgDzR.exe
  C:\Windows\System\ktdgDzR.exe
  2⤵
  PID:14968
- C:\Windows\System\TQfaHds.exe
  C:\Windows\System\TQfaHds.exe
  2⤵
  PID:14988
- C:\Windows\System\opjWayg.exe
  C:\Windows\System\opjWayg.exe
  2⤵
  PID:15008
- C:\Windows\System\xTUcDXJ.exe
  C:\Windows\System\xTUcDXJ.exe
  2⤵
  PID:15028
- C:\Windows\System\RolLnCE.exe
  C:\Windows\System\RolLnCE.exe
  2⤵
  PID:15056
- C:\Windows\System\KYCHuQy.exe
  C:\Windows\System\KYCHuQy.exe
  2⤵
  PID:15080
- C:\Windows\System\fgIOHSn.exe
  C:\Windows\System\fgIOHSn.exe
  2⤵
  PID:15100
- C:\Windows\System\ZwvukTf.exe
  C:\Windows\System\ZwvukTf.exe
  2⤵
  PID:15116
- C:\Windows\System\vXWISKc.exe
  C:\Windows\System\vXWISKc.exe
  2⤵
  PID:15140
- C:\Windows\System\gUtcabJ.exe
  C:\Windows\System\gUtcabJ.exe
  2⤵
  PID:15160
- C:\Windows\System\oYqsjjS.exe
  C:\Windows\System\oYqsjjS.exe
  2⤵
  PID:15184
- C:\Windows\System\iJYAQXT.exe
  C:\Windows\System\iJYAQXT.exe
  2⤵
  PID:15204
- C:\Windows\System\IgoUUWO.exe
  C:\Windows\System\IgoUUWO.exe
  2⤵
  PID:15224
- C:\Windows\System\plmhIGS.exe
  C:\Windows\System\plmhIGS.exe
  2⤵
  PID:15248
- C:\Windows\System\zyTZKKY.exe
  C:\Windows\System\zyTZKKY.exe
  2⤵
  PID:15268
- C:\Windows\System\ZggwuDJ.exe
  C:\Windows\System\ZggwuDJ.exe
  2⤵
  PID:15292
- C:\Windows\System\nebUfpw.exe
  C:\Windows\System\nebUfpw.exe
  2⤵
  PID:15316
- C:\Windows\System\VLxzrOb.exe
  C:\Windows\System\VLxzrOb.exe
  2⤵
  PID:15340
- C:\Windows\System\rJhLCQi.exe
  C:\Windows\System\rJhLCQi.exe
  2⤵
  PID:7316
- C:\Windows\System\HVeDcRi.exe
  C:\Windows\System\HVeDcRi.exe
  2⤵
  PID:912
- C:\Windows\System\CVjdVrk.exe
  C:\Windows\System\CVjdVrk.exe
  2⤵
  PID:4544
- C:\Windows\System\GPHuCeq.exe
  C:\Windows\System\GPHuCeq.exe
  2⤵
  PID:5980
- C:\Windows\System\hCsPWHF.exe
  C:\Windows\System\hCsPWHF.exe
  2⤵
  PID:6920
- C:\Windows\System\pVCgXsw.exe
  C:\Windows\System\pVCgXsw.exe
  2⤵
  PID:7612
- C:\Windows\System\bfyfReh.exe
  C:\Windows\System\bfyfReh.exe
  2⤵
  PID:13328
- C:\Windows\System\IXffDEW.exe
  C:\Windows\System\IXffDEW.exe
  2⤵
  PID:7868
- C:\Windows\System\HZfVsXQ.exe
  C:\Windows\System\HZfVsXQ.exe
  2⤵
  PID:7340
- C:\Windows\System\JcIKGfK.exe
  C:\Windows\System\JcIKGfK.exe
  2⤵
  PID:6436
- C:\Windows\System\DNGFOIc.exe
  C:\Windows\System\DNGFOIc.exe
  2⤵
  PID:7884
- C:\Windows\System\wsivQIE.exe
  C:\Windows\System\wsivQIE.exe
  2⤵
  PID:2620
- C:\Windows\System\roStrrN.exe
  C:\Windows\System\roStrrN.exe
  2⤵
  PID:6148
- C:\Windows\System\HuuJVQF.exe
  C:\Windows\System\HuuJVQF.exe
  2⤵
  PID:3900
- C:\Windows\System\aIHKYtH.exe
  C:\Windows\System\aIHKYtH.exe
  2⤵
  PID:5252
- C:\Windows\System\iTNonsL.exe
  C:\Windows\System\iTNonsL.exe
  2⤵
  PID:14456
- C:\Windows\System\VOczfxg.exe
  C:\Windows\System\VOczfxg.exe
  2⤵
  PID:7880
- C:\Windows\System\OPdYQbf.exe
  C:\Windows\System\OPdYQbf.exe
  2⤵
  PID:7384
- C:\Windows\System\neNDZrN.exe
  C:\Windows\System\neNDZrN.exe
  2⤵
  PID:8188
- C:\Windows\System\YBaQoVY.exe
  C:\Windows\System\YBaQoVY.exe
  2⤵
  PID:14704
- C:\Windows\System\MGWYwsv.exe
  C:\Windows\System\MGWYwsv.exe
  2⤵
  PID:15044
- C:\Windows\System\xusfjjt.exe
  C:\Windows\System\xusfjjt.exe
  2⤵
  PID:15152
- C:\Windows\System\oGLOrQM.exe
  C:\Windows\System\oGLOrQM.exe
  2⤵
  PID:8512
- C:\Windows\System\CtJmOPH.exe
  C:\Windows\System\CtJmOPH.exe
  2⤵
  PID:7584
- C:\Windows\System\rFToEKu.exe
  C:\Windows\System\rFToEKu.exe
  2⤵
  PID:14780
- C:\Windows\System\ZoQmKkC.exe
  C:\Windows\System\ZoQmKkC.exe
  2⤵
  PID:8488
- C:\Windows\System\yIIKHoy.exe
  C:\Windows\System\yIIKHoy.exe
  2⤵
  PID:8248
- C:\Windows\System\SNMlUue.exe
  C:\Windows\System\SNMlUue.exe
  2⤵
  PID:8360
- C:\Windows\System\LUqNwqL.exe
  C:\Windows\System\LUqNwqL.exe
  2⤵
  PID:14608
- C:\Windows\System\RJEcQSm.exe
  C:\Windows\System\RJEcQSm.exe
  2⤵
  PID:8676
- C:\Windows\System\uUjyLyj.exe
  C:\Windows\System\uUjyLyj.exe
  2⤵
  PID:7380
- C:\Windows\System\IKWqMAs.exe
  C:\Windows\System\IKWqMAs.exe
  2⤵
  PID:9320
- C:\Windows\System\iYkSuZD.exe
  C:\Windows\System\iYkSuZD.exe
  2⤵
  PID:14716
- C:\Windows\System\MaXkcBu.exe
  C:\Windows\System\MaXkcBu.exe
  2⤵
  PID:7660
- C:\Windows\System\AUYnEuH.exe
  C:\Windows\System\AUYnEuH.exe
  2⤵
  PID:6868
- C:\Windows\System\RbrtiJj.exe
  C:\Windows\System\RbrtiJj.exe
  2⤵
  PID:14964
- C:\Windows\System\ZhXzwin.exe
  C:\Windows\System\ZhXzwin.exe
  2⤵
  PID:14864
- C:\Windows\System\WsYmIFS.exe
  C:\Windows\System\WsYmIFS.exe
  2⤵
  PID:14888
- C:\Windows\System\fRbLCkE.exe
  C:\Windows\System\fRbLCkE.exe
  2⤵
  PID:9068
- C:\Windows\System\rDOeWiL.exe
  C:\Windows\System\rDOeWiL.exe
  2⤵
  PID:8928
- C:\Windows\System\gbbEsee.exe
  C:\Windows\System\gbbEsee.exe
  2⤵
  PID:9116
- C:\Windows\System\SqQtqfI.exe
  C:\Windows\System\SqQtqfI.exe
  2⤵
  PID:8472
- C:\Windows\System\gUrKlFg.exe
  C:\Windows\System\gUrKlFg.exe
  2⤵
  PID:9244
- C:\Windows\System\IlYelIj.exe
  C:\Windows\System\IlYelIj.exe
  2⤵
  PID:9724
- C:\Windows\System\WQzQMRA.exe
  C:\Windows\System\WQzQMRA.exe
  2⤵
  PID:14560
- C:\Windows\System\rYOeIpA.exe
  C:\Windows\System\rYOeIpA.exe
  2⤵
  PID:8808
- C:\Windows\System\RsQdPdl.exe
  C:\Windows\System\RsQdPdl.exe
  2⤵
  PID:9344
- C:\Windows\System\UoTPxRE.exe
  C:\Windows\System\UoTPxRE.exe
  2⤵
  PID:9516
- C:\Windows\System\MIWYjpr.exe
  C:\Windows\System\MIWYjpr.exe
  2⤵
  PID:9380
- C:\Windows\System\dpOQAVL.exe
  C:\Windows\System\dpOQAVL.exe
  2⤵
  PID:7636
- C:\Windows\System\LlTikWH.exe
  C:\Windows\System\LlTikWH.exe
  2⤵
  PID:9480
- C:\Windows\System\mXSMpKZ.exe
  C:\Windows\System\mXSMpKZ.exe
  2⤵
  PID:9708
- C:\Windows\System\uDwblAK.exe
  C:\Windows\System\uDwblAK.exe
  2⤵
  PID:9764
- C:\Windows\System\ACTHgSA.exe
  C:\Windows\System\ACTHgSA.exe
  2⤵
  PID:9776
- C:\Windows\System\fyerHXA.exe
  C:\Windows\System\fyerHXA.exe
  2⤵
  PID:6720
- C:\Windows\System\zjrUHrO.exe
  C:\Windows\System\zjrUHrO.exe
  2⤵
  PID:9800
- C:\Windows\System\ccfQFDq.exe
  C:\Windows\System\ccfQFDq.exe
  2⤵
  PID:9824
- C:\Windows\System\gqRGKwE.exe
  C:\Windows\System\gqRGKwE.exe
  2⤵
  PID:14484
- C:\Windows\System\CNduePJ.exe
  C:\Windows\System\CNduePJ.exe
  2⤵
  PID:7400
- C:\Windows\System\NhlGFyj.exe
  C:\Windows\System\NhlGFyj.exe
  2⤵
  PID:14688
- C:\Windows\System\KzQUibK.exe
  C:\Windows\System\KzQUibK.exe
  2⤵
  PID:9556
- C:\Windows\System\dGwexhZ.exe
  C:\Windows\System\dGwexhZ.exe
  2⤵
  PID:9604
- C:\Windows\System\lmkyPbI.exe
  C:\Windows\System\lmkyPbI.exe
  2⤵
  PID:8548
- C:\Windows\System\sLEvGLx.exe
  C:\Windows\System\sLEvGLx.exe
  2⤵
  PID:15288
- C:\Windows\System\RGuWkRC.exe
  C:\Windows\System\RGuWkRC.exe
  2⤵
  PID:14564
- C:\Windows\System\nSVIEJr.exe
  C:\Windows\System\nSVIEJr.exe
  2⤵
  PID:8988
- C:\Windows\System\SCynKQc.exe
  C:\Windows\System\SCynKQc.exe
  2⤵
  PID:9524
- C:\Windows\System\lkCtbne.exe
  C:\Windows\System\lkCtbne.exe
  2⤵
  PID:8828
- C:\Windows\System\BUiHLdZ.exe
  C:\Windows\System\BUiHLdZ.exe
  2⤵
  PID:9416
- C:\Windows\System\UXzsJYU.exe
  C:\Windows\System\UXzsJYU.exe
  2⤵
  PID:15020
- C:\Windows\System\jGXhQUR.exe
  C:\Windows\System\jGXhQUR.exe
  2⤵
  PID:15000
- C:\Windows\System\XKuGwDf.exe
  C:\Windows\System\XKuGwDf.exe
  2⤵
  PID:14536
- C:\Windows\System\tAEPIWm.exe
  C:\Windows\System\tAEPIWm.exe
  2⤵
  PID:7964
- C:\Windows\System\WEerHUf.exe
  C:\Windows\System\WEerHUf.exe
  2⤵
  PID:9740
- C:\Windows\System\JRIVXMe.exe
  C:\Windows\System\JRIVXMe.exe
  2⤵
  PID:8168
- C:\Windows\System\SSvBpmK.exe
  C:\Windows\System\SSvBpmK.exe
  2⤵
  PID:7292
- C:\Windows\System\gmmgoVS.exe
  C:\Windows\System\gmmgoVS.exe
  2⤵
  PID:388
- C:\Windows\System\AQvfbgJ.exe
  C:\Windows\System\AQvfbgJ.exe
  2⤵
  PID:8020
- C:\Windows\System\nvHFiXd.exe
  C:\Windows\System\nvHFiXd.exe
  2⤵
  PID:7956
- C:\Windows\System\FKluxoU.exe
  C:\Windows\System\FKluxoU.exe
  2⤵
  PID:2148
- C:\Windows\System\DbCEjnq.exe
  C:\Windows\System\DbCEjnq.exe
  2⤵
  PID:8660
- C:\Windows\System\NInwCkW.exe
  C:\Windows\System\NInwCkW.exe
  2⤵
  PID:14956
- C:\Windows\System\JsbZECX.exe
  C:\Windows\System\JsbZECX.exe
  2⤵
  PID:7196
- C:\Windows\System\oYigoQA.exe
  C:\Windows\System\oYigoQA.exe
  2⤵
  PID:9672
- C:\Windows\System\sSgswPA.exe
  C:\Windows\System\sSgswPA.exe
  2⤵
  PID:14588
- C:\Windows\System\mWOhGtN.exe
  C:\Windows\System\mWOhGtN.exe
  2⤵
  PID:9716
- C:\Windows\System\iqtRCUs.exe
  C:\Windows\System\iqtRCUs.exe
  2⤵
  PID:9020
- C:\Windows\System\xpABdwO.exe
  C:\Windows\System\xpABdwO.exe
  2⤵
  PID:9712
- C:\Windows\System\LohxzPM.exe
  C:\Windows\System\LohxzPM.exe
  2⤵
  PID:9804
- C:\Windows\System\ZKnERTB.exe
  C:\Windows\System\ZKnERTB.exe
  2⤵
  PID:8888
- C:\Windows\System\DMRVRBl.exe
  C:\Windows\System\DMRVRBl.exe
  2⤵
  PID:9508
- C:\Windows\System\QQReUVu.exe
  C:\Windows\System\QQReUVu.exe
  2⤵
  PID:9492
- C:\Windows\System\iELFXje.exe
  C:\Windows\System\iELFXje.exe
  2⤵
  PID:10172
- C:\Windows\System\NWIIkVj.exe
  C:\Windows\System\NWIIkVj.exe
  2⤵
  PID:9956
- C:\Windows\System\kEgxoJB.exe
  C:\Windows\System\kEgxoJB.exe
  2⤵
  PID:8016
- C:\Windows\System\ypArnhu.exe
  C:\Windows\System\ypArnhu.exe
  2⤵
  PID:6784
- C:\Windows\System\mzEYjRj.exe
  C:\Windows\System\mzEYjRj.exe
  2⤵
  PID:15376
- C:\Windows\System\slZCkec.exe
  C:\Windows\System\slZCkec.exe
  2⤵
  PID:15392
- C:\Windows\System\EyhUnAJ.exe
  C:\Windows\System\EyhUnAJ.exe
  2⤵
  PID:15416
- C:\Windows\System\IYPHvXl.exe
  C:\Windows\System\IYPHvXl.exe
  2⤵
  PID:15432
- C:\Windows\System\jbnyHpk.exe
  C:\Windows\System\jbnyHpk.exe
  2⤵
  PID:15456
- C:\Windows\System\uUbPZAF.exe
  C:\Windows\System\uUbPZAF.exe
  2⤵
  PID:15476
- C:\Windows\System\dFGVsUH.exe
  C:\Windows\System\dFGVsUH.exe
  2⤵
  PID:15496
- C:\Windows\System\YLsrJDv.exe
  C:\Windows\System\YLsrJDv.exe
  2⤵
  PID:15520
- C:\Windows\System\vNgYFPR.exe
  C:\Windows\System\vNgYFPR.exe
  2⤵
  PID:15536
- C:\Windows\System\MHERCyo.exe
  C:\Windows\System\MHERCyo.exe
  2⤵
  PID:15556
- C:\Windows\System\CrlIKNP.exe
  C:\Windows\System\CrlIKNP.exe
  2⤵
  PID:15580
- C:\Windows\System\JxgwNVs.exe
  C:\Windows\System\JxgwNVs.exe
  2⤵
  PID:15604
- C:\Windows\System\yFasdWV.exe
  C:\Windows\System\yFasdWV.exe
  2⤵
  PID:15624
- C:\Windows\System\kurmPyO.exe
  C:\Windows\System\kurmPyO.exe
  2⤵
  PID:15640
- C:\Windows\System\zvMLNwh.exe
  C:\Windows\System\zvMLNwh.exe
  2⤵
  PID:15660
- C:\Windows\System\adqeHUq.exe
  C:\Windows\System\adqeHUq.exe
  2⤵
  PID:15680
- C:\Windows\System\sLONSiR.exe
  C:\Windows\System\sLONSiR.exe
  2⤵
  PID:15704
- C:\Windows\System\DsLOeWG.exe
  C:\Windows\System\DsLOeWG.exe
  2⤵
  PID:15724
- C:\Windows\System\bzzPxWX.exe
  C:\Windows\System\bzzPxWX.exe
  2⤵
  PID:15752
- C:\Windows\System\WdXraee.exe
  C:\Windows\System\WdXraee.exe
  2⤵
  PID:15772
- C:\Windows\System\OvwXaiK.exe
  C:\Windows\System\OvwXaiK.exe
  2⤵
  PID:15788
- C:\Windows\System\GkoRpkk.exe
  C:\Windows\System\GkoRpkk.exe
  2⤵
  PID:15808
- C:\Windows\System\DUfuhqI.exe
  C:\Windows\System\DUfuhqI.exe
  2⤵
  PID:15824
- C:\Windows\System\zQIezSQ.exe
  C:\Windows\System\zQIezSQ.exe
  2⤵
  PID:15844
- C:\Windows\System\YnhMJJC.exe
  C:\Windows\System\YnhMJJC.exe
  2⤵
  PID:15868
- C:\Windows\System\VgZXctG.exe
  C:\Windows\System\VgZXctG.exe
  2⤵
  PID:15884
- C:\Windows\System\mTmrwbB.exe
  C:\Windows\System\mTmrwbB.exe
  2⤵
  PID:15900
- C:\Windows\System\GFJQILi.exe
  C:\Windows\System\GFJQILi.exe
  2⤵
  PID:15920
- C:\Windows\System\zdIuBfy.exe
  C:\Windows\System\zdIuBfy.exe
  2⤵
  PID:15936
- C:\Windows\System\RWlwJVF.exe
  C:\Windows\System\RWlwJVF.exe
  2⤵
  PID:15960
- C:\Windows\System\DyBABog.exe
  C:\Windows\System\DyBABog.exe
  2⤵
  PID:15980
- C:\Windows\System\WNKmVbD.exe
  C:\Windows\System\WNKmVbD.exe
  2⤵
  PID:16004
- C:\Windows\System\XDUBTcB.exe
  C:\Windows\System\XDUBTcB.exe
  2⤵
  PID:16028
- C:\Windows\System\uzHnESe.exe
  C:\Windows\System\uzHnESe.exe
  2⤵
  PID:16048
- C:\Windows\System\bYkarPJ.exe
  C:\Windows\System\bYkarPJ.exe
  2⤵
  PID:16068
- C:\Windows\System\MODetON.exe
  C:\Windows\System\MODetON.exe
  2⤵
  PID:16088
- C:\Windows\System\fHDRNuB.exe
  C:\Windows\System\fHDRNuB.exe
  2⤵
  PID:16380
- C:\Windows\System\qZcmRan.exe
  C:\Windows\System\qZcmRan.exe
  2⤵
  PID:10184
- C:\Windows\System\vEQfdzL.exe
  C:\Windows\System\vEQfdzL.exe
  2⤵
  PID:9628
- C:\Windows\System\tSpSBma.exe
  C:\Windows\System\tSpSBma.exe
  2⤵
  PID:9684
- C:\Windows\System\AilBhnP.exe
  C:\Windows\System\AilBhnP.exe
  2⤵
  PID:7128
- C:\Windows\System\EGFGZFp.exe
  C:\Windows\System\EGFGZFp.exe
  2⤵
  PID:8592
- C:\Windows\System\uClPwPR.exe
  C:\Windows\System\uClPwPR.exe
  2⤵
  PID:7212
- C:\Windows\System\NoxUdWC.exe
  C:\Windows\System\NoxUdWC.exe
  2⤵
  PID:8420
- C:\Windows\System\YdFVwaD.exe
  C:\Windows\System\YdFVwaD.exe
  2⤵
  PID:7480
- C:\Windows\System\GGaufeM.exe
  C:\Windows\System\GGaufeM.exe
  2⤵
  PID:9640
- C:\Windows\System\cVPqpny.exe
  C:\Windows\System\cVPqpny.exe
  2⤵
  PID:10332
- C:\Windows\System\HSECjPa.exe
  C:\Windows\System\HSECjPa.exe
  2⤵
  PID:1144
- C:\Windows\System\lsUCFiU.exe
  C:\Windows\System\lsUCFiU.exe
  2⤵
  PID:9620
- C:\Windows\System\mWXojVO.exe
  C:\Windows\System\mWXojVO.exe
  2⤵
  PID:10816
- C:\Windows\System\ezhJvUu.exe
  C:\Windows\System\ezhJvUu.exe
  2⤵
  PID:7424
- C:\Windows\System\kuscWcb.exe
  C:\Windows\System\kuscWcb.exe
  2⤵
  PID:10796
- C:\Windows\System\FrRDIbH.exe
  C:\Windows\System\FrRDIbH.exe
  2⤵
  PID:11872
- C:\Windows\System\iqCDaNh.exe
  C:\Windows\System\iqCDaNh.exe
  2⤵
  PID:6236
- C:\Windows\System\ArBcIeb.exe
  C:\Windows\System\ArBcIeb.exe
  2⤵
  PID:10584
- C:\Windows\System\zHPmvRH.exe
  C:\Windows\System\zHPmvRH.exe
  2⤵
  PID:11000
- C:\Windows\System\jczAgiB.exe
  C:\Windows\System\jczAgiB.exe
  2⤵
  PID:16200
- C:\Windows\System\rplEJCZ.exe
  C:\Windows\System\rplEJCZ.exe
  2⤵
  PID:11368
- C:\Windows\System\eKZTbZN.exe
  C:\Windows\System\eKZTbZN.exe
  2⤵
  PID:16260
- C:\Windows\System\DRzIllZ.exe
  C:\Windows\System\DRzIllZ.exe
  2⤵
  PID:15552
- C:\Windows\System\SirAPDn.exe
  C:\Windows\System\SirAPDn.exe
  2⤵
  PID:9960
- C:\Windows\System\uDKsJic.exe
  C:\Windows\System\uDKsJic.exe
  2⤵
  PID:10496
- C:\Windows\System\Kzievny.exe
  C:\Windows\System\Kzievny.exe
  2⤵
  PID:9484
- C:\Windows\System\ylqQOVl.exe
  C:\Windows\System\ylqQOVl.exe
  2⤵
  PID:15108
- C:\Windows\System\CyNPSbZ.exe
  C:\Windows\System\CyNPSbZ.exe
  2⤵
  PID:9852
- C:\Windows\System\FhjzBWA.exe
  C:\Windows\System\FhjzBWA.exe
  2⤵
  PID:15096
- C:\Windows\System\nJQzCeg.exe
  C:\Windows\System\nJQzCeg.exe
  2⤵
  PID:10424
- C:\Windows\System\qVseHnW.exe
  C:\Windows\System\qVseHnW.exe
  2⤵
  PID:16152
- C:\Windows\System\OsyknJT.exe
  C:\Windows\System\OsyknJT.exe
  2⤵
  PID:15408
- C:\Windows\System\nYjwEBg.exe
  C:\Windows\System\nYjwEBg.exe
  2⤵
  PID:8516
- C:\Windows\System\jCecIaR.exe
  C:\Windows\System\jCecIaR.exe
  2⤵
  PID:10980
- C:\Windows\System\zwoDMgE.exe
  C:\Windows\System\zwoDMgE.exe
  2⤵
  PID:11992
- C:\Windows\System\BPWJMhc.exe
  C:\Windows\System\BPWJMhc.exe
  2⤵
  PID:11268
- C:\Windows\System\rBwHNgI.exe
  C:\Windows\System\rBwHNgI.exe
  2⤵
  PID:11120
- C:\Windows\System\dOmrQkC.exe
  C:\Windows\System\dOmrQkC.exe
  2⤵
  PID:15912
- C:\Windows\System\KAgrEQc.exe
  C:\Windows\System\KAgrEQc.exe
  2⤵
  PID:10204
- C:\Windows\System\NXFzFLL.exe
  C:\Windows\System\NXFzFLL.exe
  2⤵
  PID:10840
- C:\Windows\System\JPOHswq.exe
  C:\Windows\System\JPOHswq.exe
  2⤵
  PID:16176
- C:\Windows\System\oelumQv.exe
  C:\Windows\System\oelumQv.exe
  2⤵
  PID:11608
- C:\Windows\System\HklMhfY.exe
  C:\Windows\System\HklMhfY.exe
  2⤵
  PID:10636
- C:\Windows\System\kVcQAwv.exe
  C:\Windows\System\kVcQAwv.exe
  2⤵
  PID:11228
- C:\Windows\System\btPCXPb.exe
  C:\Windows\System\btPCXPb.exe
  2⤵
  PID:16320
- C:\Windows\System\tcXPWqV.exe
  C:\Windows\System\tcXPWqV.exe
  2⤵
  PID:11900
- C:\Windows\System\ubhNNTX.exe
  C:\Windows\System\ubhNNTX.exe
  2⤵
  PID:11656
- C:\Windows\System\RdfhMnD.exe
  C:\Windows\System\RdfhMnD.exe
  2⤵
  PID:12800
- C:\Windows\System\JWnkdaI.exe
  C:\Windows\System\JWnkdaI.exe
  2⤵
  PID:12620
- C:\Windows\System\zaheCLL.exe
  C:\Windows\System\zaheCLL.exe
  2⤵
  PID:12556
- C:\Windows\System\FKETktP.exe
  C:\Windows\System\FKETktP.exe
  2⤵
  PID:11508
- C:\Windows\System\zCcFcJs.exe
  C:\Windows\System\zCcFcJs.exe
  2⤵
  PID:9372
- C:\Windows\System\tchqRhV.exe
  C:\Windows\System\tchqRhV.exe
  2⤵
  PID:15492
- C:\Windows\System\UHSKefe.exe
  C:\Windows\System\UHSKefe.exe
  2⤵
  PID:5944
- C:\Windows\System\fEWWRqF.exe
  C:\Windows\System\fEWWRqF.exe
  2⤵
  PID:12396
- C:\Windows\System\OGneJGc.exe
  C:\Windows\System\OGneJGc.exe
  2⤵
  PID:10992
- C:\Windows\System\KnTjczD.exe
  C:\Windows\System\KnTjczD.exe
  2⤵
  PID:12508
- C:\Windows\System\xxkDFiu.exe
  C:\Windows\System\xxkDFiu.exe
  2⤵
  PID:11740
- C:\Windows\System\VBAMEvr.exe
  C:\Windows\System\VBAMEvr.exe
  2⤵
  PID:11556
- C:\Windows\System\JbUQRdr.exe
  C:\Windows\System\JbUQRdr.exe
  2⤵
  PID:13228
- C:\Windows\System\CDwedCG.exe
  C:\Windows\System\CDwedCG.exe
  2⤵
  PID:15816
- C:\Windows\System\XgFVArm.exe
  C:\Windows\System\XgFVArm.exe
  2⤵
  PID:15956
- C:\Windows\System\nOwnlaT.exe
  C:\Windows\System\nOwnlaT.exe
  2⤵
  PID:9808
- C:\Windows\System\nhwKvvH.exe
  C:\Windows\System\nhwKvvH.exe
  2⤵
  PID:9928
- C:\Windows\System\ZXHjPVJ.exe
  C:\Windows\System\ZXHjPVJ.exe
  2⤵
  PID:9460
- C:\Windows\System\faCqYEF.exe
  C:\Windows\System\faCqYEF.exe
  2⤵
  PID:15652
- C:\Windows\System\dYrOBRB.exe
  C:\Windows\System\dYrOBRB.exe
  2⤵
  PID:10552
- C:\Windows\System\HYAQxmj.exe
  C:\Windows\System\HYAQxmj.exe
  2⤵
  PID:9980
- C:\Windows\System\ZhKYPth.exe
  C:\Windows\System\ZhKYPth.exe
  2⤵
  PID:10928
- C:\Windows\System\oYycNOl.exe
  C:\Windows\System\oYycNOl.exe
  2⤵
  PID:11884
- C:\Windows\System\vBtvSDy.exe
  C:\Windows\System\vBtvSDy.exe
  2⤵
  PID:12044
- C:\Windows\System\Sqwpprp.exe
  C:\Windows\System\Sqwpprp.exe
  2⤵
  PID:10720
- C:\Windows\System\rHxFVJi.exe
  C:\Windows\System\rHxFVJi.exe
  2⤵
  PID:10920
- C:\Windows\System\WkZnHMa.exe
  C:\Windows\System\WkZnHMa.exe
  2⤵
  PID:12676
- C:\Windows\System\TUuJZuV.exe
  C:\Windows\System\TUuJZuV.exe
  2⤵
  PID:11076
- C:\Windows\System\boMparp.exe
  C:\Windows\System\boMparp.exe
  2⤵
  PID:11376
- C:\Windows\System\ZarKVGD.exe
  C:\Windows\System\ZarKVGD.exe
  2⤵
  PID:12600
- C:\Windows\System\qMnsmlC.exe
  C:\Windows\System\qMnsmlC.exe
  2⤵
  PID:11044
- C:\Windows\System\kHTieGh.exe
  C:\Windows\System\kHTieGh.exe
  2⤵
  PID:16248
- C:\Windows\System\BStJzij.exe
  C:\Windows\System\BStJzij.exe
  2⤵
  PID:12896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qrb2agdt.srn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AABbDbT.exe

Filesize
2.3MB

MD5
48fba5b9af272beba32c71a59e7fd711

SHA1
7c0144fe9f7cdde76cb61a341f09941063f04465

SHA256
5dfbf66e88e95bfba2060c07d79260c3634a4d1ee02a4333f3d9f8c57647124d

SHA512
5c070955254191db74a5c76ed97a319c06649d7a125fae21023ed5605826012504f3a342f254c897c763d9a09902e25e766c74be0e70b02f0c3ccce03e0c5c58

Download Submit
C:\Windows\System\AABbDbT.exe

Filesize
1.1MB

MD5
d8da40f27ae4d81866316e9b078d4eb7

SHA1
be334525d900ff63c86dce95c86f3ae21fb82ee5

SHA256
c621317af75737dc842d5fee99c0441c4efb47ffa5321ac820e23508d2156030

SHA512
bb502234ebbe948ce77bd99e7582835a05158443cfd498fc7ba6806252a70ab79145fb6c67f8824885d7195c3926550cb60ba324240c8316500a63999426df0c

Download Submit
C:\Windows\System\ACWWedO.exe

Filesize
2.3MB

MD5
3302d1a891b76b7d7b013175638f584d

SHA1
5b08968bf5dbbd90035777f4876b129312e1ef38

SHA256
e00b321beb7b2624e3e006a454f3f58fede4d69918ea10b4fafd34a9dc3afd62

SHA512
0e96c32dc5e6ced077b2091b55bd167187642a5758a84966fbb5d2f06a565929e192067905f6978085d9f427a74bb1f14d324ffdff4076c9d0f608b332183860

Download Submit
C:\Windows\System\CwHxJCt.exe

Filesize
2.3MB

MD5
9cfdfb6611a146a76f7125978b8b3e93

SHA1
69ce9abb714881742aad8aa381257a4bd51a9641

SHA256
37d31295ff098f1cafa40177a1f93cca00de4687b6de56dfdc0db7ff4d8f9097

SHA512
b3f8c9e75bd742a96ecc225f97311d7f65f83bb3c9e0b039dba89af1c0edba57c73fd0f36563f25194c1d687539d14a41524ad2c5625e85420745302453a27b9

Download Submit
C:\Windows\System\DQPqtex.exe

Filesize
2.3MB

MD5
8f828b08bdcc7d29fb9ead957f0b2d7f

SHA1
d0e4fb70b15a2e4e7d05b0c303b647b83e0ab554

SHA256
8b9607a0a9849bd8d4b6a42a6e38ef2b87e78c919002959d41c6fe16c5fae261

SHA512
f574714c578002ce36aa5dc7dcf967b697c59e66098d4e584a7c3731c8f2798461dd93f29af4f1d1e810a31c258e5770fdab63c0a450baad1d39ddeddc9e5d2e

Download Submit
C:\Windows\System\EusvhFG.exe

Filesize
2.3MB

MD5
fde806706bba3e884055d0631c9e074d

SHA1
2732f3b91966a1236eb372b1d142b902fb4333c0

SHA256
46f180724fe4814c24129ad45d0b5387a23968f5420f3377e70d67fab5114817

SHA512
191e8538f6ca9590000da9b2b67acf550415e8222685f12d914eec25c3475782b7d9611c097460b0f1b4cc776211c340e2b8ffde36339db352656081d6bd621a

Download Submit
C:\Windows\System\FYIwcpt.exe

Filesize
2.3MB

MD5
ceab39266610a2ae31db9632f565a831

SHA1
47f6c23f5ab9316234b74a68d9b39cfba167d18b

SHA256
4fba93b6052250a9939b40f4f61f39b2cef6d25a229803dae7143630c066a031

SHA512
34c0bdc4a5261ebbba3c88ffed321abd99addf7977b739afce6d925ac94f1f78a5b38ed1683d7f22d7066bb6cd3740f7c758b0e4f618cb937a6d3980a69195f6

Download Submit
C:\Windows\System\IkLUoUe.exe

Filesize
2.3MB

MD5
32da0f046dbfd40d3da74d29ce8de6dc

SHA1
6725a3c0c779c4effeb8eb220c4a0255f74e1eb1

SHA256
3ab587d850ab4f6887738aada950ef3673c8987fb349a47512678bb86118ee11

SHA512
5c8311a533d5a4ea2a13a29f22f642bd0428bab44090034cbd847070d1ba86d0a42f50f3f099db155370b05eb6fc2466e043e82a5db6f008639ce8eb4ac5fbe6

Download Submit
C:\Windows\System\JQQymyE.exe

Filesize
2.3MB

MD5
9ee3be37a8e77416b1141eb40a90dca9

SHA1
056689fd4cf27cc03a90655a1a95d442c5285b52

SHA256
8e080c30976b456d160fccdf3100861ac05deef43f28139c960e0cfa56aae128

SHA512
c419464bd1fd3b8014f7399266f1502b74387382b30c4942d13385f3a4f99c050607b1b740bfaeb15a2f7b3f8b6f270b08136de808ea590f87164233c3e67a2f

Download Submit
C:\Windows\System\MXKvDFQ.exe

Filesize
2.3MB

MD5
ab26fbfe7f8f01feb4a58167fca666e4

SHA1
52a5cd63e15e50da0c93968b29d3b564490994d9

SHA256
4efe64972806a48de764e667ed5c5561f89716e4c08af62b2d2328331a729c99

SHA512
45e5fd34ed475308e223aea6cc6e8252a490923c8fbfa8786c8ab4c248e0e7356ececd95e410396625f71d86b1a7c6bce83f02ccbbee7ddd387253dd843a9d44

Download Submit
C:\Windows\System\NQMAigz.exe

Filesize
2.3MB

MD5
68c3f0fc8a88ed913723cd7caa69ab93

SHA1
5e77087259ee302920cbd65e745d8daacad0cb33

SHA256
971058a50a3253789cca83453193b2eecf749b22c51ebf7d4bee1bef157f04b2

SHA512
4bea16aa15c4582a1abcec2442d1619bce103f8448304566ee379bc08336e54fbefdcc9b7eae89184236235c6cd0fbe08251d9adbe559da9c94e53bd26bf5d30

Download Submit
C:\Windows\System\QjdLZaH.exe

Filesize
2.3MB

MD5
c5d5fe5cd07b893c99da2092494ba870

SHA1
a3a11ab4931372212bd5a5a034261d05a9eeeac5

SHA256
282e5e6ebd57a0636b0b4fcbe43a6f65961049275c4e53d9eabe0035a3d5b976

SHA512
4d747150b99872ff23fd4a8c40a5f1f63ad9c6acddbdc239beddc4023c9798224b178ae3bc0a608c3c86033d081ad75a865b168af4cc085d83e035d4a720d6ca

Download Submit
C:\Windows\System\RnkPQaW.exe

Filesize
2.3MB

MD5
8fc1fc7e5973ad783e09e2e2e70f9990

SHA1
fe5a8cfd8efdc5ac1ce16fe3913419d444b9bf7b

SHA256
1dd5aa513e875d9988dd0bc0f0c3ae958e1991390b99486075e00f378ba66fec

SHA512
e4f4a9206f4c382de97b9f6d0106fbc160d09f15b122c5a2d07fd3dc9fa676bc6cd000402151419cbf27ccbaa861ae4858b3bc7390f3790d665057a8aadbbe11

Download Submit
C:\Windows\System\TGrFDwo.exe

Filesize
2.3MB

MD5
e874e2e7546976242c96e159b918e96d

SHA1
f658f0629cb3698eacb071da1bdf8fcd9f603655

SHA256
b647cd9c7de7c98be74da1dacf6cb6d888b88c7c92e5767a87eea46cd8a98ce8

SHA512
c48dc1e75182445068ef08559018bb72ada71c73b0d3a3dce3da7cd61083f6911d47c893f302e9b13b9b583fdd6453001666e5962af9f8588709bdaeb9b9f9a3

Download Submit
C:\Windows\System\UiLLWAG.exe

Filesize
2.3MB

MD5
d06fbac1167a3bd4c74541fd119ac676

SHA1
90c99e4925d39a67e5c28a3ee0fe5de7bdd71a86

SHA256
b1fbc8b40258b03669470e11368347b3d5fb3777c48fa9c1b824e86153688e0c

SHA512
b88b2c177adf529f7fefcce86810c84306ac0cad6170b005c3cffe73bc5f5d3d385299428c44a6b3bab6d5ec19bdf4b61f94c94ebf31501c26d6ee2219b7c5c4

Download Submit
C:\Windows\System\VPGPAUx.exe

Filesize
2.3MB

MD5
2a22f76b83eeeaca1e30cf3415314bab

SHA1
e7b3846efd64d802f729fb683389394229cf248e

SHA256
dd37e466105eb57e7ccd14a10a942c4b2464948be78589b5c034414c3a53dd34

SHA512
00028611f1af751b63653b3749d6102216afb57e4d818152a0bafde4d8cbc83fd0c83bcecdfaefa0614593dcef0c025a9acdcd3414edb9c4aeba2b7fb358f69a

Download Submit
C:\Windows\System\ViIGfoU.exe

Filesize
2.3MB

MD5
727c7aa1689981aabd989b896af1c4d2

SHA1
183e19ecba63a18cc7b9f15e2f1fdbc0bbc40161

SHA256
ac00bc993505b3458048851768dbb729a81ca49161d869687723520064184f0c

SHA512
e9fce37540ef9a85df45a2a8249a1881580de0846119d4f6aecbda2a9e2fb29e12e2ecd7c9af06896275b89ff6eeb05d8c25458d770d1ac97c9887c2fa766f97

Download Submit
C:\Windows\System\bKpDiHS.exe

Filesize
2.3MB

MD5
4dcc845bd084a17f21399d41583ac18c

SHA1
5b704eec820e1b727e6388d30f8b932ac3feae9d

SHA256
0d1ad1e623fe57f288e74479f4ce9d07f1048bc2de3c9ccc96120fded89540ad

SHA512
ea522da2a9bdb494220cf630113acaa5f5a84d3f2cdeb17963b904bf5f748936195dc91cee3c48ae1db6f40234d0b9a75109846c67d539fb4f3004e3cf32aac3

Download Submit
C:\Windows\System\eqXnmFV.exe

Filesize
2.3MB

MD5
4cd2f9d88c17df80d3601557cc051e09

SHA1
cb1636efd88877408dcb6064e91c8512b626f41e

SHA256
0ae424b6c267b301587e38923fb2e3d7bc38f0201ec06cb41aa226899d4d7da5

SHA512
ee50f79ed61d919d5df77277fa6ad746abd8c985a2f2837bfeaa0db1c7be339c07546909d3a3c774d1628ff171cbca9f5dd9c9318fe436995425ecd58099f702

Download Submit
C:\Windows\System\ezXtFYM.exe

Filesize
2.3MB

MD5
dbd783419d513a27911561ac4cc57b90

SHA1
982eade8e271fbd208753fc4c753e1abc17ec89f

SHA256
45e962b681f93534e90dd78b26125c5bc4421931bc1be77e04942b199a95803a

SHA512
1de5d0d7a30927531bc55520aa2dc34a049ea183d1c2efb6c953eb9b2633b8cea4662f47d34840c8a58b4c680ebc4b9b0af49ffed2783ccb2f76df1ed06700e5

Download Submit
C:\Windows\System\gTZktjB.exe

Filesize
2.3MB

MD5
04154645c3876c8bd918249ec5aa02f3

SHA1
99ce1dedc7232000ab5a5718c17152aa16d00909

SHA256
b06f6b0143d3453cecd5ff8583eac8439573e465dc378f15184fa5aa0c5e7554

SHA512
bb3a13c343160e0a684b80436f9c4598ff2779fbc8ce9ae8a4eca3df4d888663c35af2c698fe42f42b507e8afd88b84490e5aea65323f7fb3d4b0cb2c2dc5a54

Download Submit
C:\Windows\System\iVuVIdY.exe

Filesize
2.3MB

MD5
328b0af1c9082e35017d62c4fa70ba15

SHA1
9b4b258c96359489023b27e420d51c4c80f1ced5

SHA256
d15789b60dd5fcf6b643e62e2745b7770d40b5a39b5c5fff9af2060ba9cf531d

SHA512
c1bb2d82d553380c383082700e55a7e3e9679cf24b5ece4d2f1798f9e5b4252b5bd60a774b33e9fb11f4c66d8e0904b0dd872af547264a469051c1fc3d204e04

Download Submit
C:\Windows\System\jvqCPil.exe

Filesize
2.3MB

MD5
0aed68d5ff1289031280714e218a6170

SHA1
7149913018e303c7f16d189493a589868849413a

SHA256
955a346b2dc460ced4933d169f8e010abd34cde58e8419b924d3c000cf9ffc2c

SHA512
e7f14593ef30b3d66028aa88a2765bd583ff8cca5a35c0588bda78c1f9d546408c48fce7be2384fc82d425f646d5f756c45cd114d9b24ced055c3c99df7dee64

Download Submit
C:\Windows\System\lvIHcwI.exe

Filesize
2.3MB

MD5
20f40aefbd41ccf93ecb15d5a7e9c36b

SHA1
302a5be4c303befcf6dee1499a2ce9a7599dfe87

SHA256
fbc16aef11995b6cb73aa3c63a9a650612707972417ac99bc0ef3f36681857cf

SHA512
4c0f08e33883d8d086e1ed2f71d9006fea1dc060e645627db05a50baff591329f42df457b02daf6f6b91e3b7227806f1a511b0cca0ba9b93d575dd7da803a8ed

Download Submit
C:\Windows\System\lxHVvsY.exe

Filesize
2.3MB

MD5
43c167de654bb27513fc096729393c3e

SHA1
f7aea53b36d367abe0fb307e3e22052cf6aeaeea

SHA256
b738e70a721f147b6241624c6b89d7335880b770b4541714b4527494e59cdc3e

SHA512
fd6293d4d70d1ea44ee491f1b41692338e0289dc99d480a1ebe51092daf904feb204ae5cc336b0fbb6a9364162c361aacfa69245d664be4509773132fea84f93

Download Submit
C:\Windows\System\mxaKtbF.exe

Filesize
2.3MB

MD5
840488c541330d09d927685d5030d04f

SHA1
c793b5320d0027b506eeff59b2da4edbcb20e5ad

SHA256
02b5628ea1e527f82d8217e49ed69218c6939366c56d7c44ca67297e40502798

SHA512
aacb7b57bd01c2e6cd4b4b3d2c4453c32930759ec8b973574b302f75cf4f48897d41ea47dac4a46f35651af90c110ea65a39af41ba280c31359ae23a653cd234

Download Submit
C:\Windows\System\ncuGmNs.exe

Filesize
2.3MB

MD5
da15af70e740f847b51fddd2efb36f02

SHA1
fd105fb88a9ba6977431fb5c94aceab7a8d49556

SHA256
e26cba7110cc76baa923a6fd13e63509004ae9f924c0860f9edcb3aa4bb6f3ed

SHA512
ec7873f729d3f58ab0f916ba5dcf805ca797ce9ad5d4965ad19b4266378dabfa0f45396f924c5f9eba8bcedf43126816eeed502f9e5a746ced75587a262057bc

Download Submit
C:\Windows\System\pPAfFMU.exe

Filesize
2.3MB

MD5
adcf0603a0ff2ac583d55741dc371446

SHA1
6846123d34fba2c76aa38c7ad6c3156b0438b770

SHA256
a0c2e8e644a4e4f51e2ee19d4d0d131d64ec473839f303c89497ce1bd3543c8c

SHA512
d4f39fe1e989f1084eb9946149f49b2ded2db60661c68c0de6d4aab2735aded7722088e4e27dfe52ba4ffc50cdc24341eb3332b4f2a95f2b9ac6850df6f3ad4f

Download Submit
C:\Windows\System\qAUOMWA.exe

Filesize
2.3MB

MD5
2eff7e0ae8e6f8b26661c03b8a10bfb5

SHA1
e417b02cc294c1fa47096028c65556ee4dbc4aab

SHA256
71287430dc3a63faaff8b80f84d98bd8b31b841611df93736c183e5dd699f706

SHA512
ae831fa62060857dd04dd553173d9302b9a1a996f233177370d36ef8dee213150dda6154716682dc39da30f0a0884bb9627492886bc8a5ef84fbd3e45ac53263

Download Submit
C:\Windows\System\uwEoiTw.exe

Filesize
2.3MB

MD5
8bae6172b11e14ed4f4cdb77bf3ee4b2

SHA1
b58210463f2ba879220af77c608f8cd75cd0cdcb

SHA256
c9506fede53a8093648de76140f0188c449ad351eba6a85a89139a0d28473513

SHA512
821320c1d06a601c8c178eb84e82e27157f3d48077ef52e3ee8b30d920ea8a5cdda93f1b41b0b97531410faaf3623cada8981261c0c73b179fc651856bcda450

Download Submit
C:\Windows\System\xLzNHsX.exe

Filesize
2.3MB

MD5
8f1e74acf66be37d718c6a82e46154b7

SHA1
69a7eb215690e647b9d3c0a60d7d299d7b185c84

SHA256
b1920ac7a02fb9db2f7128283d656c61d1899e061f772af90d7570fa8fe021fa

SHA512
fc6a99dd14eb2faea3dbe3e1a76851e90bd11be103bcaa04f7e40cdca5601e2a633aca08583e5b847af330b01ae9cb8f6b189298656b61a1cb82274c0bd0726b

Download Submit
C:\Windows\System\xavdJxH.exe

Filesize
2.3MB

MD5
42709dd5b61cd3b3da7055c1eefd5fd5

SHA1
dfc3a6b7b515f27fb223d77fbac74139f4dd8991

SHA256
4fbdc89373ddd1a3eff8384a976f5befb04c7abab82fbc1e28892f44f158a531

SHA512
38dbe2c1c8ace330d73834beacedc1f0a14c2ccc1b4c1af6931a57a85d0fe72696e657a4467cc42f796bed6eec5027568d53f673d38f47e914757c804e39e87c

Download Submit
C:\Windows\System\ztrnJRW.exe

Filesize
2.3MB

MD5
29c2aab2bd8bd2e0ccc98d036615aff1

SHA1
23241fb90a964ae1ea8a43d64ec0dda4392d174e

SHA256
bdf90a9bae3e474c01b4b9617168adf0d230f8632b4310bfee1ea6eccac8f982

SHA512
f24f101217a4879359029ac0f70d847cf6682e6c5afdf1b0495f1ed8d303514c17d9fb2b155d2233698f6a620b18dbc58de72afcaf866ee2d9c0879d1a7834f4

Download Submit
memory/380-1837-0x00007FF7022E0000-0x00007FF7026D2000-memory.dmp

Filesize
3.9MB

Download
memory/380-131-0x00007FF7022E0000-0x00007FF7026D2000-memory.dmp

Filesize
3.9MB

Download
memory/528-1865-0x00007FF7B3AD0000-0x00007FF7B3EC2000-memory.dmp

Filesize
3.9MB

Download
memory/528-51-0x00007FF7B3AD0000-0x00007FF7B3EC2000-memory.dmp

Filesize
3.9MB

Download
memory/640-134-0x00007FF7F6AE0000-0x00007FF7F6ED2000-memory.dmp

Filesize
3.9MB

Download
memory/640-1833-0x00007FF7F6AE0000-0x00007FF7F6ED2000-memory.dmp

Filesize
3.9MB

Download
memory/1216-128-0x00007FF7CE370000-0x00007FF7CE762000-memory.dmp

Filesize
3.9MB

Download
memory/1216-1864-0x00007FF7CE370000-0x00007FF7CE762000-memory.dmp

Filesize
3.9MB

Download
memory/1220-130-0x00007FF646570000-0x00007FF646962000-memory.dmp

Filesize
3.9MB

Download
memory/1220-1839-0x00007FF646570000-0x00007FF646962000-memory.dmp

Filesize
3.9MB

Download
memory/1432-37-0x00007FF7AEFF0000-0x00007FF7AF3E2000-memory.dmp

Filesize
3.9MB

Download
memory/1432-1812-0x00007FF7AEFF0000-0x00007FF7AF3E2000-memory.dmp

Filesize
3.9MB

Download
memory/1568-1816-0x00007FF786F70000-0x00007FF787362000-memory.dmp

Filesize
3.9MB

Download
memory/1568-40-0x00007FF786F70000-0x00007FF787362000-memory.dmp

Filesize
3.9MB

Download
memory/1628-125-0x00007FF7ED910000-0x00007FF7EDD02000-memory.dmp

Filesize
3.9MB

Download
memory/1628-1863-0x00007FF7ED910000-0x00007FF7EDD02000-memory.dmp

Filesize
3.9MB

Download
memory/2276-115-0x00007FF733A00000-0x00007FF733DF2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-1835-0x00007FF6F8150000-0x00007FF6F8542000-memory.dmp

Filesize
3.9MB

Download
memory/2672-133-0x00007FF6F8150000-0x00007FF6F8542000-memory.dmp

Filesize
3.9MB

Download
memory/3380-1806-0x00007FF7147E0000-0x00007FF714BD2000-memory.dmp

Filesize
3.9MB

Download
memory/3380-129-0x00007FF7147E0000-0x00007FF714BD2000-memory.dmp

Filesize
3.9MB

Download
memory/3704-1809-0x00007FF7DCD20000-0x00007FF7DD112000-memory.dmp

Filesize
3.9MB

Download
memory/3704-42-0x00007FF7DCD20000-0x00007FF7DD112000-memory.dmp

Filesize
3.9MB

Download
memory/3752-1820-0x00007FF64F420000-0x00007FF64F812000-memory.dmp

Filesize
3.9MB

Download
memory/3752-124-0x00007FF64F420000-0x00007FF64F812000-memory.dmp

Filesize
3.9MB

Download
memory/3764-1818-0x00007FF6940B0000-0x00007FF6944A2000-memory.dmp

Filesize
3.9MB

Download
memory/3764-35-0x00007FF6940B0000-0x00007FF6944A2000-memory.dmp

Filesize
3.9MB

Download
memory/3844-1798-0x00007FF76D920000-0x00007FF76DD12000-memory.dmp

Filesize
3.9MB

Download
memory/3844-118-0x00007FF76D920000-0x00007FF76DD12000-memory.dmp

Filesize
3.9MB

Download
memory/3880-2071-0x00007FF7CB510000-0x00007FF7CB902000-memory.dmp

Filesize
3.9MB

Download
memory/3880-150-0x00007FF7CB510000-0x00007FF7CB902000-memory.dmp

Filesize
3.9MB

Download
memory/3916-135-0x00007FF66A8D0000-0x00007FF66ACC2000-memory.dmp

Filesize
3.9MB

Download
memory/3916-1831-0x00007FF66A8D0000-0x00007FF66ACC2000-memory.dmp

Filesize
3.9MB

Download
memory/4092-1814-0x00007FF6C8C70000-0x00007FF6C9062000-memory.dmp

Filesize
3.9MB

Download
memory/4092-123-0x00007FF6C8C70000-0x00007FF6C9062000-memory.dmp

Filesize
3.9MB

Download
memory/4632-1802-0x00007FF665090000-0x00007FF665482000-memory.dmp

Filesize
3.9MB

Download
memory/4632-132-0x00007FF665090000-0x00007FF665482000-memory.dmp

Filesize
3.9MB

Download
memory/4924-122-0x00007FF6E0880000-0x00007FF6E0C72000-memory.dmp

Filesize
3.9MB

Download
memory/4972-141-0x00007FF70F700000-0x00007FF70FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-2072-0x00007FF70F700000-0x00007FF70FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-0-0x00007FF70F700000-0x00007FF70FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-1-0x0000012A01660000-0x0000012A01670000-memory.dmp

Filesize
64KB

Download
memory/4980-44-0x00007FF648D90000-0x00007FF649182000-memory.dmp

Filesize
3.9MB

Download
memory/4980-1796-0x00007FF648D90000-0x00007FF649182000-memory.dmp

Filesize
3.9MB

Download
memory/4980-261-0x00007FF648D90000-0x00007FF649182000-memory.dmp

Filesize
3.9MB

Download
memory/5084-17-0x00000201A8440000-0x00000201A8462000-memory.dmp

Filesize
136KB

Download
memory/5084-136-0x00000201AB1C0000-0x00000201AB966000-memory.dmp

Filesize
7.6MB

Download
memory/5084-26-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Filesize
10.8MB

Download
memory/5084-36-0x00000201A8480000-0x00000201A8490000-memory.dmp

Filesize
64KB

Download
memory/5084-29-0x00000201A8480000-0x00000201A8490000-memory.dmp

Filesize
64KB

Download
memory/5084-2435-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Filesize
10.8MB

Download