xmrig | 4380a4b9a183ea3ac83457f0a0aa4b7b66aaf72d9a82dc90e5ac5979cd1de635

Analysis

max time kernel
77s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
Size

1.9MB
MD5

071f9161f87630cd090f45d7796250b8
SHA1

4e2d4cc9b77795e2061a093d5f0882ee91c03914
SHA256

4380a4b9a183ea3ac83457f0a0aa4b7b66aaf72d9a82dc90e5ac5979cd1de635
SHA512

4457434f31a2f6ff1291c42f871194ca04e869d863c3b6fe0243965897b05c39881a98b2d57af6ea1b4cf2b124ff67678acead0a13e2bebf04eb8b80c5d0f508
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1Z:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/3360-11-0x00007FF6B69D0000-0x00007FF6B6DC2000-memory.dmp	xmrig
behavioral2/memory/3928-156-0x00007FF70EF00000-0x00007FF70F2F2000-memory.dmp	xmrig
behavioral2/memory/1796-167-0x00007FF6BEF90000-0x00007FF6BF382000-memory.dmp	xmrig
behavioral2/memory/3580-177-0x00007FF7A9910000-0x00007FF7A9D02000-memory.dmp	xmrig
behavioral2/memory/4740-176-0x00007FF66EE30000-0x00007FF66F222000-memory.dmp	xmrig
behavioral2/memory/1948-175-0x00007FF6AEE30000-0x00007FF6AF222000-memory.dmp	xmrig
behavioral2/memory/2972-174-0x00007FF749050000-0x00007FF749442000-memory.dmp	xmrig
behavioral2/memory/2476-172-0x00007FF773930000-0x00007FF773D22000-memory.dmp	xmrig
behavioral2/memory/4676-171-0x00007FF75ABB0000-0x00007FF75AFA2000-memory.dmp	xmrig
behavioral2/memory/3276-170-0x00007FF698580000-0x00007FF698972000-memory.dmp	xmrig
behavioral2/memory/2220-169-0x00007FF695D90000-0x00007FF696182000-memory.dmp	xmrig
behavioral2/memory/1876-168-0x00007FF6C55F0000-0x00007FF6C59E2000-memory.dmp	xmrig
behavioral2/memory/840-151-0x00007FF6B3ED0000-0x00007FF6B42C2000-memory.dmp	xmrig
behavioral2/memory/2132-138-0x00007FF78FC20000-0x00007FF790012000-memory.dmp	xmrig
behavioral2/memory/2980-137-0x00007FF6AF750000-0x00007FF6AFB42000-memory.dmp	xmrig
behavioral2/memory/4628-125-0x00007FF74B420000-0x00007FF74B812000-memory.dmp	xmrig
behavioral2/memory/3956-111-0x00007FF6EAC40000-0x00007FF6EB032000-memory.dmp	xmrig
behavioral2/memory/5040-110-0x00007FF6222E0000-0x00007FF6226D2000-memory.dmp	xmrig
behavioral2/memory/1180-94-0x00007FF6DF490000-0x00007FF6DF882000-memory.dmp	xmrig
behavioral2/memory/3956-2027-0x00007FF6EAC40000-0x00007FF6EB032000-memory.dmp	xmrig
behavioral2/memory/1888-2063-0x00007FF7ABC90000-0x00007FF7AC082000-memory.dmp	xmrig
behavioral2/memory/1876-2060-0x00007FF6C55F0000-0x00007FF6C59E2000-memory.dmp	xmrig
behavioral2/memory/840-2053-0x00007FF6B3ED0000-0x00007FF6B42C2000-memory.dmp	xmrig
behavioral2/memory/2476-2048-0x00007FF773930000-0x00007FF773D22000-memory.dmp	xmrig
behavioral2/memory/2972-2046-0x00007FF749050000-0x00007FF749442000-memory.dmp	xmrig
behavioral2/memory/2980-2043-0x00007FF6AF750000-0x00007FF6AFB42000-memory.dmp	xmrig
behavioral2/memory/2220-2201-0x00007FF695D90000-0x00007FF696182000-memory.dmp	xmrig
behavioral2/memory/3580-2222-0x00007FF7A9910000-0x00007FF7A9D02000-memory.dmp	xmrig
behavioral2/memory/3276-2129-0x00007FF698580000-0x00007FF698972000-memory.dmp	xmrig
behavioral2/memory/1948-2081-0x00007FF6AEE30000-0x00007FF6AF222000-memory.dmp	xmrig
behavioral2/memory/4676-2101-0x00007FF75ABB0000-0x00007FF75AFA2000-memory.dmp	xmrig
behavioral2/memory/2360-2062-0x00007FF6CC730000-0x00007FF6CCB22000-memory.dmp	xmrig
behavioral2/memory/1180-2058-0x00007FF6DF490000-0x00007FF6DF882000-memory.dmp	xmrig
behavioral2/memory/5040-2055-0x00007FF6222E0000-0x00007FF6226D2000-memory.dmp	xmrig
behavioral2/memory/2132-2041-0x00007FF78FC20000-0x00007FF790012000-memory.dmp	xmrig
behavioral2/memory/3928-2038-0x00007FF70EF00000-0x00007FF70F2F2000-memory.dmp	xmrig
behavioral2/memory/1796-2036-0x00007FF6BEF90000-0x00007FF6BF382000-memory.dmp	xmrig
behavioral2/memory/1448-6356-0x00007FF77F040000-0x00007FF77F432000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

flow	pid	Process
10	3908	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3360	LQCHvdl.exe
1888	ZuFihgi.exe
2360	hbkPGoQ.exe
2476	zbaKLsJ.exe
1180	GsUuYgW.exe
5040	FMskaRL.exe
3956	MEhivoV.exe
2972	oXJzdix.exe
4628	TspAjfb.exe
2980	TyHFPrw.exe
2132	tDLjRDC.exe
840	eSqHHGk.exe
3928	CwUJuOX.exe
1796	iXvSFDk.exe
1876	GkwBNvV.exe
1948	qpHJWYU.exe
2220	IIzWSXg.exe
3276	GErJBBH.exe
4676	jAzxkrs.exe
4740	LcEsnRh.exe
3580	NxJAUJc.exe
1256	yYOjfyI.exe
908	rWgQjbH.exe
2088	YqskHdu.exe
1896	yGIXgsk.exe
4520	YePPzDu.exe
2576	wxTzmkI.exe
5044	KgFLUtf.exe
4236	LTxQkIU.exe
3708	nQgKWPe.exe
4792	pkbKhCA.exe
3324	iKlvQdT.exe
5088	jExUjKm.exe
4788	KEgSijC.exe
924	LikwTiW.exe
1744	ccshHIh.exe
2676	RFJCjIH.exe
5020	YfIEiYH.exe
3792	KuZBcjs.exe
1248	PcHyCtU.exe
1168	jgsFyDl.exe
2816	VasqJNI.exe
404	cOPkwnu.exe
2468	IbMZKGb.exe
2988	DiHtwZR.exe
3412	jkeYiYH.exe
4648	wAOzmct.exe
3092	TYcrOmC.exe
3028	QmWIaWr.exe
1504	MzZAIyZ.exe
3136	EubWJwC.exe
572	mwviaAv.exe
4048	SEAxUMg.exe
436	JhlgkXv.exe
848	BUFneSt.exe
3600	YbrhoWr.exe
4120	KzDgSDo.exe
4308	pbYLhrB.exe
3764	XQmXprN.exe
3852	OjmbuYk.exe
984	prEXhIc.exe
3432	kMbMIAc.exe
1616	PttZXYe.exe
208	UhFtiKf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1448-0-0x00007FF77F040000-0x00007FF77F432000-memory.dmp	upx
behavioral2/files/0x000800000002323f-6.dat	upx
behavioral2/files/0x0008000000023245-9.dat	upx
behavioral2/files/0x0008000000023242-12.dat	upx
behavioral2/memory/1888-15-0x00007FF7ABC90000-0x00007FF7AC082000-memory.dmp	upx
behavioral2/memory/2360-19-0x00007FF6CC730000-0x00007FF6CCB22000-memory.dmp	upx
behavioral2/memory/3360-11-0x00007FF6B69D0000-0x00007FF6B6DC2000-memory.dmp	upx
behavioral2/files/0x0008000000023247-23.dat	upx
behavioral2/files/0x0008000000023243-25.dat	upx
behavioral2/files/0x0007000000023248-33.dat	upx
behavioral2/files/0x0007000000023249-47.dat	upx
behavioral2/files/0x000700000002324d-57.dat	upx
behavioral2/files/0x000700000002324a-61.dat	upx
behavioral2/files/0x000800000002324c-64.dat	upx
behavioral2/files/0x000700000002324e-79.dat	upx
behavioral2/files/0x0007000000023252-95.dat	upx
behavioral2/files/0x0007000000023251-105.dat	upx
behavioral2/files/0x000700000002325a-135.dat	upx
behavioral2/files/0x0007000000023257-147.dat	upx
behavioral2/memory/3928-156-0x00007FF70EF00000-0x00007FF70F2F2000-memory.dmp	upx
behavioral2/memory/1796-167-0x00007FF6BEF90000-0x00007FF6BF382000-memory.dmp	upx
behavioral2/memory/3580-177-0x00007FF7A9910000-0x00007FF7A9D02000-memory.dmp	upx
behavioral2/memory/4740-176-0x00007FF66EE30000-0x00007FF66F222000-memory.dmp	upx
behavioral2/memory/1948-175-0x00007FF6AEE30000-0x00007FF6AF222000-memory.dmp	upx
behavioral2/memory/2972-174-0x00007FF749050000-0x00007FF749442000-memory.dmp	upx
behavioral2/memory/2476-172-0x00007FF773930000-0x00007FF773D22000-memory.dmp	upx
behavioral2/memory/4676-171-0x00007FF75ABB0000-0x00007FF75AFA2000-memory.dmp	upx
behavioral2/memory/3276-170-0x00007FF698580000-0x00007FF698972000-memory.dmp	upx
behavioral2/memory/2220-169-0x00007FF695D90000-0x00007FF696182000-memory.dmp	upx
behavioral2/memory/1876-168-0x00007FF6C55F0000-0x00007FF6C59E2000-memory.dmp	upx
behavioral2/files/0x000700000002325e-189.dat	upx
behavioral2/files/0x0007000000023260-197.dat	upx
behavioral2/files/0x0007000000023264-196.dat	upx
behavioral2/files/0x0007000000023263-195.dat	upx
behavioral2/files/0x000700000002325f-191.dat	upx
behavioral2/files/0x0007000000023262-188.dat	upx
behavioral2/files/0x0007000000023261-187.dat	upx
behavioral2/files/0x000700000002325d-185.dat	upx
behavioral2/files/0x000700000002325c-180.dat	upx
behavioral2/files/0x000700000002325b-178.dat	upx
behavioral2/files/0x0007000000023258-153.dat	upx
behavioral2/memory/840-151-0x00007FF6B3ED0000-0x00007FF6B42C2000-memory.dmp	upx
behavioral2/files/0x0007000000023259-146.dat	upx
behavioral2/files/0x0007000000023256-144.dat	upx
behavioral2/memory/2132-138-0x00007FF78FC20000-0x00007FF790012000-memory.dmp	upx
behavioral2/memory/2980-137-0x00007FF6AF750000-0x00007FF6AFB42000-memory.dmp	upx
behavioral2/files/0x0007000000023254-130.dat	upx
behavioral2/memory/4628-125-0x00007FF74B420000-0x00007FF74B812000-memory.dmp	upx
behavioral2/files/0x0007000000023255-115.dat	upx
behavioral2/memory/3956-111-0x00007FF6EAC40000-0x00007FF6EB032000-memory.dmp	upx
behavioral2/memory/5040-110-0x00007FF6222E0000-0x00007FF6226D2000-memory.dmp	upx
behavioral2/files/0x0007000000023253-113.dat	upx
behavioral2/memory/1180-94-0x00007FF6DF490000-0x00007FF6DF882000-memory.dmp	upx
behavioral2/files/0x000800000002324b-86.dat	upx
behavioral2/files/0x000700000002324f-85.dat	upx
behavioral2/files/0x0007000000023250-76.dat	upx
behavioral2/memory/3956-2027-0x00007FF6EAC40000-0x00007FF6EB032000-memory.dmp	upx
behavioral2/memory/1888-2063-0x00007FF7ABC90000-0x00007FF7AC082000-memory.dmp	upx
behavioral2/memory/1876-2060-0x00007FF6C55F0000-0x00007FF6C59E2000-memory.dmp	upx
behavioral2/memory/840-2053-0x00007FF6B3ED0000-0x00007FF6B42C2000-memory.dmp	upx
behavioral2/memory/2476-2048-0x00007FF773930000-0x00007FF773D22000-memory.dmp	upx
behavioral2/memory/2972-2046-0x00007FF749050000-0x00007FF749442000-memory.dmp	upx
behavioral2/memory/2980-2043-0x00007FF6AF750000-0x00007FF6AFB42000-memory.dmp	upx
behavioral2/memory/2220-2201-0x00007FF695D90000-0x00007FF696182000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mlaOjbD.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\tNzLQxG.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\ASZWWyL.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\cJCnqdR.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\CXrhqio.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\gaipTXZ.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\DHKuaSb.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\qfxnwuu.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\sUWzWek.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\Pynbbaa.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\pgThkun.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\igxUMaq.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\KAIbzdr.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\UJIRFfQ.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\ddcIfNt.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\IjoJvOt.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\GlTkqHK.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\rvAtFZG.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\viGNNSa.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\oICrmii.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\VLgtStG.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\STkWUtL.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\DflEvxi.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\mYyuVrJ.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\YLXMUSr.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\qZodjWT.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\FqbMaBM.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\VXeiKLP.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\YgHwVcu.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\rrkXtPO.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\npmNMEL.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\gYiKJqt.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\aTyFGJe.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\QIwVlqM.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\EJzqlIC.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\gzYAfJN.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\mSeHUNQ.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\HFEgYKL.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\CEPGyfP.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\zoCBTfY.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\pgolksp.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\NxIxJPP.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\mLlJGUS.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\nshcTkb.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\nvDuetO.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\uYUcPNt.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\UyqJOTd.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\csGvYEz.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\bHSbanq.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\pXiyfWJ.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\IaFGAOW.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\edjebiW.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\XBeESEn.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\VasqJNI.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\ynHjPlM.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\xOiWTkx.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\ZEFqDNa.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\dViABfa.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\EMiEECN.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\AvqjkhI.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\sCqDjXt.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\RVvKJfh.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\SRWwArW.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\oZcRTOs.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3908	powershell.exe
3908	powershell.exe
3908	powershell.exe
3908	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
Token: SeDebugPrivilege	3908	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 3908	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	92
PID 1448 wrote to memory of 3908	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	92
PID 1448 wrote to memory of 3360	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	93
PID 1448 wrote to memory of 3360	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	93
PID 1448 wrote to memory of 1888	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	94
PID 1448 wrote to memory of 1888	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	94
PID 1448 wrote to memory of 2360	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	95
PID 1448 wrote to memory of 2360	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	95
PID 1448 wrote to memory of 2476	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	96
PID 1448 wrote to memory of 2476	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	96
PID 1448 wrote to memory of 1180	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	97
PID 1448 wrote to memory of 1180	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	97
PID 1448 wrote to memory of 5040	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	98
PID 1448 wrote to memory of 5040	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	98
PID 1448 wrote to memory of 3956	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	99
PID 1448 wrote to memory of 3956	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	99
PID 1448 wrote to memory of 2980	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	100
PID 1448 wrote to memory of 2980	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	100
PID 1448 wrote to memory of 2972	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	101
PID 1448 wrote to memory of 2972	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	101
PID 1448 wrote to memory of 4628	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	102
PID 1448 wrote to memory of 4628	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	102
PID 1448 wrote to memory of 2132	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	103
PID 1448 wrote to memory of 2132	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	103
PID 1448 wrote to memory of 840	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	104
PID 1448 wrote to memory of 840	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	104
PID 1448 wrote to memory of 3928	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	105
PID 1448 wrote to memory of 3928	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	105
PID 1448 wrote to memory of 1796	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	106
PID 1448 wrote to memory of 1796	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	106
PID 1448 wrote to memory of 1876	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	107
PID 1448 wrote to memory of 1876	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	107
PID 1448 wrote to memory of 1948	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	108
PID 1448 wrote to memory of 1948	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	108
PID 1448 wrote to memory of 2220	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	109
PID 1448 wrote to memory of 2220	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	109
PID 1448 wrote to memory of 3276	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	110
PID 1448 wrote to memory of 3276	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	110
PID 1448 wrote to memory of 4676	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	111
PID 1448 wrote to memory of 4676	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	111
PID 1448 wrote to memory of 3580	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	112
PID 1448 wrote to memory of 3580	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	112
PID 1448 wrote to memory of 4740	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	113
PID 1448 wrote to memory of 4740	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	113
PID 1448 wrote to memory of 1256	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	114
PID 1448 wrote to memory of 1256	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	114
PID 1448 wrote to memory of 908	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	115
PID 1448 wrote to memory of 908	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	115
PID 1448 wrote to memory of 2088	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	116
PID 1448 wrote to memory of 2088	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	116
PID 1448 wrote to memory of 1896	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	117
PID 1448 wrote to memory of 1896	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	117
PID 1448 wrote to memory of 4520	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	118
PID 1448 wrote to memory of 4520	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	118
PID 1448 wrote to memory of 2576	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	119
PID 1448 wrote to memory of 2576	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	119
PID 1448 wrote to memory of 5044	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	120
PID 1448 wrote to memory of 5044	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	120
PID 1448 wrote to memory of 4236	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	121
PID 1448 wrote to memory of 4236	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	121
PID 1448 wrote to memory of 3708	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	122
PID 1448 wrote to memory of 3708	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	122
PID 1448 wrote to memory of 4792	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	123
PID 1448 wrote to memory of 4792	1448	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\System\LQCHvdl.exe
  C:\Windows\System\LQCHvdl.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\ZuFihgi.exe
  C:\Windows\System\ZuFihgi.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\hbkPGoQ.exe
  C:\Windows\System\hbkPGoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\zbaKLsJ.exe
  C:\Windows\System\zbaKLsJ.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\GsUuYgW.exe
  C:\Windows\System\GsUuYgW.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\FMskaRL.exe
  C:\Windows\System\FMskaRL.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\MEhivoV.exe
  C:\Windows\System\MEhivoV.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\TyHFPrw.exe
  C:\Windows\System\TyHFPrw.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\oXJzdix.exe
  C:\Windows\System\oXJzdix.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\TspAjfb.exe
  C:\Windows\System\TspAjfb.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\tDLjRDC.exe
  C:\Windows\System\tDLjRDC.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\eSqHHGk.exe
  C:\Windows\System\eSqHHGk.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\CwUJuOX.exe
  C:\Windows\System\CwUJuOX.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\iXvSFDk.exe
  C:\Windows\System\iXvSFDk.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\GkwBNvV.exe
  C:\Windows\System\GkwBNvV.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\qpHJWYU.exe
  C:\Windows\System\qpHJWYU.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\IIzWSXg.exe
  C:\Windows\System\IIzWSXg.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\GErJBBH.exe
  C:\Windows\System\GErJBBH.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\jAzxkrs.exe
  C:\Windows\System\jAzxkrs.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\NxJAUJc.exe
  C:\Windows\System\NxJAUJc.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\LcEsnRh.exe
  C:\Windows\System\LcEsnRh.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\yYOjfyI.exe
  C:\Windows\System\yYOjfyI.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\rWgQjbH.exe
  C:\Windows\System\rWgQjbH.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\YqskHdu.exe
  C:\Windows\System\YqskHdu.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\yGIXgsk.exe
  C:\Windows\System\yGIXgsk.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\YePPzDu.exe
  C:\Windows\System\YePPzDu.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\wxTzmkI.exe
  C:\Windows\System\wxTzmkI.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\KgFLUtf.exe
  C:\Windows\System\KgFLUtf.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\LTxQkIU.exe
  C:\Windows\System\LTxQkIU.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\nQgKWPe.exe
  C:\Windows\System\nQgKWPe.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\pkbKhCA.exe
  C:\Windows\System\pkbKhCA.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\iKlvQdT.exe
  C:\Windows\System\iKlvQdT.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\jExUjKm.exe
  C:\Windows\System\jExUjKm.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\KEgSijC.exe
  C:\Windows\System\KEgSijC.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\LikwTiW.exe
  C:\Windows\System\LikwTiW.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\ccshHIh.exe
  C:\Windows\System\ccshHIh.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\RFJCjIH.exe
  C:\Windows\System\RFJCjIH.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\YfIEiYH.exe
  C:\Windows\System\YfIEiYH.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\KuZBcjs.exe
  C:\Windows\System\KuZBcjs.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\PcHyCtU.exe
  C:\Windows\System\PcHyCtU.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\jgsFyDl.exe
  C:\Windows\System\jgsFyDl.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\VasqJNI.exe
  C:\Windows\System\VasqJNI.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\cOPkwnu.exe
  C:\Windows\System\cOPkwnu.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\IbMZKGb.exe
  C:\Windows\System\IbMZKGb.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\DiHtwZR.exe
  C:\Windows\System\DiHtwZR.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\jkeYiYH.exe
  C:\Windows\System\jkeYiYH.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\wAOzmct.exe
  C:\Windows\System\wAOzmct.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\TYcrOmC.exe
  C:\Windows\System\TYcrOmC.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\QmWIaWr.exe
  C:\Windows\System\QmWIaWr.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\MzZAIyZ.exe
  C:\Windows\System\MzZAIyZ.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\EubWJwC.exe
  C:\Windows\System\EubWJwC.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\mwviaAv.exe
  C:\Windows\System\mwviaAv.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\SEAxUMg.exe
  C:\Windows\System\SEAxUMg.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\JhlgkXv.exe
  C:\Windows\System\JhlgkXv.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\BUFneSt.exe
  C:\Windows\System\BUFneSt.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\YbrhoWr.exe
  C:\Windows\System\YbrhoWr.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\XQmXprN.exe
  C:\Windows\System\XQmXprN.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\KzDgSDo.exe
  C:\Windows\System\KzDgSDo.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\pbYLhrB.exe
  C:\Windows\System\pbYLhrB.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\OjmbuYk.exe
  C:\Windows\System\OjmbuYk.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\prEXhIc.exe
  C:\Windows\System\prEXhIc.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\kMbMIAc.exe
  C:\Windows\System\kMbMIAc.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\PttZXYe.exe
  C:\Windows\System\PttZXYe.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\UhFtiKf.exe
  C:\Windows\System\UhFtiKf.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\EABkxch.exe
  C:\Windows\System\EABkxch.exe
  2⤵
  PID:3796
- C:\Windows\System\lGTRfEX.exe
  C:\Windows\System\lGTRfEX.exe
  2⤵
  PID:4700
- C:\Windows\System\ICDdGCS.exe
  C:\Windows\System\ICDdGCS.exe
  2⤵
  PID:3860
- C:\Windows\System\pBSQRQb.exe
  C:\Windows\System\pBSQRQb.exe
  2⤵
  PID:4784
- C:\Windows\System\JKUImXF.exe
  C:\Windows\System\JKUImXF.exe
  2⤵
  PID:4352
- C:\Windows\System\bGIbpsa.exe
  C:\Windows\System\bGIbpsa.exe
  2⤵
  PID:4312
- C:\Windows\System\CbdXndw.exe
  C:\Windows\System\CbdXndw.exe
  2⤵
  PID:3564
- C:\Windows\System\wtHAPjb.exe
  C:\Windows\System\wtHAPjb.exe
  2⤵
  PID:5124
- C:\Windows\System\bNlHjiV.exe
  C:\Windows\System\bNlHjiV.exe
  2⤵
  PID:5144
- C:\Windows\System\fCScVZz.exe
  C:\Windows\System\fCScVZz.exe
  2⤵
  PID:5164
- C:\Windows\System\gRdHaAj.exe
  C:\Windows\System\gRdHaAj.exe
  2⤵
  PID:5192
- C:\Windows\System\RqmlrKk.exe
  C:\Windows\System\RqmlrKk.exe
  2⤵
  PID:5232
- C:\Windows\System\jvCFQoD.exe
  C:\Windows\System\jvCFQoD.exe
  2⤵
  PID:5264
- C:\Windows\System\hmiqLDF.exe
  C:\Windows\System\hmiqLDF.exe
  2⤵
  PID:5296
- C:\Windows\System\FGnXAft.exe
  C:\Windows\System\FGnXAft.exe
  2⤵
  PID:5312
- C:\Windows\System\IJptZiz.exe
  C:\Windows\System\IJptZiz.exe
  2⤵
  PID:5336
- C:\Windows\System\SdPTMrk.exe
  C:\Windows\System\SdPTMrk.exe
  2⤵
  PID:5352
- C:\Windows\System\iOFBxSu.exe
  C:\Windows\System\iOFBxSu.exe
  2⤵
  PID:5380
- C:\Windows\System\tLwJRMT.exe
  C:\Windows\System\tLwJRMT.exe
  2⤵
  PID:5400
- C:\Windows\System\Cpstclv.exe
  C:\Windows\System\Cpstclv.exe
  2⤵
  PID:5428
- C:\Windows\System\UCTWTRx.exe
  C:\Windows\System\UCTWTRx.exe
  2⤵
  PID:5452
- C:\Windows\System\CEPGyfP.exe
  C:\Windows\System\CEPGyfP.exe
  2⤵
  PID:5496
- C:\Windows\System\sHPugyG.exe
  C:\Windows\System\sHPugyG.exe
  2⤵
  PID:5516
- C:\Windows\System\IfpRugX.exe
  C:\Windows\System\IfpRugX.exe
  2⤵
  PID:5536
- C:\Windows\System\vZSITSA.exe
  C:\Windows\System\vZSITSA.exe
  2⤵
  PID:5560
- C:\Windows\System\tDFcRnJ.exe
  C:\Windows\System\tDFcRnJ.exe
  2⤵
  PID:5576
- C:\Windows\System\LimtagM.exe
  C:\Windows\System\LimtagM.exe
  2⤵
  PID:5596
- C:\Windows\System\TiXLNbI.exe
  C:\Windows\System\TiXLNbI.exe
  2⤵
  PID:5612
- C:\Windows\System\AYPccPD.exe
  C:\Windows\System\AYPccPD.exe
  2⤵
  PID:5632
- C:\Windows\System\MQlAAJQ.exe
  C:\Windows\System\MQlAAJQ.exe
  2⤵
  PID:5668
- C:\Windows\System\ljLkvTz.exe
  C:\Windows\System\ljLkvTz.exe
  2⤵
  PID:5692
- C:\Windows\System\aLiroPr.exe
  C:\Windows\System\aLiroPr.exe
  2⤵
  PID:5712
- C:\Windows\System\kgJnWyP.exe
  C:\Windows\System\kgJnWyP.exe
  2⤵
  PID:5732
- C:\Windows\System\LhgQOVp.exe
  C:\Windows\System\LhgQOVp.exe
  2⤵
  PID:5760
- C:\Windows\System\AmhBpun.exe
  C:\Windows\System\AmhBpun.exe
  2⤵
  PID:5780
- C:\Windows\System\RVVOVRE.exe
  C:\Windows\System\RVVOVRE.exe
  2⤵
  PID:5800
- C:\Windows\System\jKdptXz.exe
  C:\Windows\System\jKdptXz.exe
  2⤵
  PID:5820
- C:\Windows\System\emklHAk.exe
  C:\Windows\System\emklHAk.exe
  2⤵
  PID:5844
- C:\Windows\System\ircjMiO.exe
  C:\Windows\System\ircjMiO.exe
  2⤵
  PID:5864
- C:\Windows\System\ZJJJAnh.exe
  C:\Windows\System\ZJJJAnh.exe
  2⤵
  PID:5888
- C:\Windows\System\MfrBUTc.exe
  C:\Windows\System\MfrBUTc.exe
  2⤵
  PID:5908
- C:\Windows\System\YjlXgSo.exe
  C:\Windows\System\YjlXgSo.exe
  2⤵
  PID:5928
- C:\Windows\System\aHFBsQn.exe
  C:\Windows\System\aHFBsQn.exe
  2⤵
  PID:5952
- C:\Windows\System\hIjkiBf.exe
  C:\Windows\System\hIjkiBf.exe
  2⤵
  PID:5968
- C:\Windows\System\KiPAAEw.exe
  C:\Windows\System\KiPAAEw.exe
  2⤵
  PID:5992
- C:\Windows\System\UdAlfPY.exe
  C:\Windows\System\UdAlfPY.exe
  2⤵
  PID:6012
- C:\Windows\System\veuwRRe.exe
  C:\Windows\System\veuwRRe.exe
  2⤵
  PID:6040
- C:\Windows\System\wcNRpba.exe
  C:\Windows\System\wcNRpba.exe
  2⤵
  PID:6056
- C:\Windows\System\uXjXCno.exe
  C:\Windows\System\uXjXCno.exe
  2⤵
  PID:6076
- C:\Windows\System\FSxLmpK.exe
  C:\Windows\System\FSxLmpK.exe
  2⤵
  PID:6096
- C:\Windows\System\WKVmPon.exe
  C:\Windows\System\WKVmPon.exe
  2⤵
  PID:6120
- C:\Windows\System\jgnIqhQ.exe
  C:\Windows\System\jgnIqhQ.exe
  2⤵
  PID:6140
- C:\Windows\System\DZygMAZ.exe
  C:\Windows\System\DZygMAZ.exe
  2⤵
  PID:3036
- C:\Windows\System\cwStZcX.exe
  C:\Windows\System\cwStZcX.exe
  2⤵
  PID:5208
- C:\Windows\System\HGSpCsU.exe
  C:\Windows\System\HGSpCsU.exe
  2⤵
  PID:5308
- C:\Windows\System\WJVcMCT.exe
  C:\Windows\System\WJVcMCT.exe
  2⤵
  PID:5136
- C:\Windows\System\aVWwqpR.exe
  C:\Windows\System\aVWwqpR.exe
  2⤵
  PID:5200
- C:\Windows\System\RuhDkHX.exe
  C:\Windows\System\RuhDkHX.exe
  2⤵
  PID:3192
- C:\Windows\System\QmLGZPZ.exe
  C:\Windows\System\QmLGZPZ.exe
  2⤵
  PID:5436
- C:\Windows\System\maKvnQB.exe
  C:\Windows\System\maKvnQB.exe
  2⤵
  PID:5372
- C:\Windows\System\LYgjSxB.exe
  C:\Windows\System\LYgjSxB.exe
  2⤵
  PID:5528
- C:\Windows\System\ozfueFK.exe
  C:\Windows\System\ozfueFK.exe
  2⤵
  PID:5480
- C:\Windows\System\PwVedDs.exe
  C:\Windows\System\PwVedDs.exe
  2⤵
  PID:5684
- C:\Windows\System\fhlvCEA.exe
  C:\Windows\System\fhlvCEA.exe
  2⤵
  PID:5548
- C:\Windows\System\toqtWME.exe
  C:\Windows\System\toqtWME.exe
  2⤵
  PID:5752
- C:\Windows\System\sQIPtLF.exe
  C:\Windows\System\sQIPtLF.exe
  2⤵
  PID:5796
- C:\Windows\System\efdFuvK.exe
  C:\Windows\System\efdFuvK.exe
  2⤵
  PID:5876
- C:\Windows\System\qmbOlXX.exe
  C:\Windows\System\qmbOlXX.exe
  2⤵
  PID:5964
- C:\Windows\System\GRnpJCx.exe
  C:\Windows\System\GRnpJCx.exe
  2⤵
  PID:6092
- C:\Windows\System\eZIifgA.exe
  C:\Windows\System\eZIifgA.exe
  2⤵
  PID:5840
- C:\Windows\System\JlDJaPN.exe
  C:\Windows\System\JlDJaPN.exe
  2⤵
  PID:6152
- C:\Windows\System\TjXPwrD.exe
  C:\Windows\System\TjXPwrD.exe
  2⤵
  PID:6172
- C:\Windows\System\OiSjjIr.exe
  C:\Windows\System\OiSjjIr.exe
  2⤵
  PID:6196
- C:\Windows\System\BFHrsWH.exe
  C:\Windows\System\BFHrsWH.exe
  2⤵
  PID:6224
- C:\Windows\System\JxiquJJ.exe
  C:\Windows\System\JxiquJJ.exe
  2⤵
  PID:6244
- C:\Windows\System\wGvcCjk.exe
  C:\Windows\System\wGvcCjk.exe
  2⤵
  PID:6260
- C:\Windows\System\OMXHGZV.exe
  C:\Windows\System\OMXHGZV.exe
  2⤵
  PID:6280
- C:\Windows\System\xIWDfMW.exe
  C:\Windows\System\xIWDfMW.exe
  2⤵
  PID:6308
- C:\Windows\System\EgDGUtk.exe
  C:\Windows\System\EgDGUtk.exe
  2⤵
  PID:6324
- C:\Windows\System\YfWwgzP.exe
  C:\Windows\System\YfWwgzP.exe
  2⤵
  PID:6348
- C:\Windows\System\ImdIwZe.exe
  C:\Windows\System\ImdIwZe.exe
  2⤵
  PID:6368
- C:\Windows\System\QNCTtXa.exe
  C:\Windows\System\QNCTtXa.exe
  2⤵
  PID:6392
- C:\Windows\System\wjgYJiH.exe
  C:\Windows\System\wjgYJiH.exe
  2⤵
  PID:6412
- C:\Windows\System\ykgJtvp.exe
  C:\Windows\System\ykgJtvp.exe
  2⤵
  PID:6448
- C:\Windows\System\QRpGrdH.exe
  C:\Windows\System\QRpGrdH.exe
  2⤵
  PID:6468
- C:\Windows\System\xPhBLBI.exe
  C:\Windows\System\xPhBLBI.exe
  2⤵
  PID:6488
- C:\Windows\System\IbXZcXl.exe
  C:\Windows\System\IbXZcXl.exe
  2⤵
  PID:6512
- C:\Windows\System\SmYwkhN.exe
  C:\Windows\System\SmYwkhN.exe
  2⤵
  PID:6532
- C:\Windows\System\NslBLnb.exe
  C:\Windows\System\NslBLnb.exe
  2⤵
  PID:6556
- C:\Windows\System\bkvpTzF.exe
  C:\Windows\System\bkvpTzF.exe
  2⤵
  PID:6584
- C:\Windows\System\MgENlcJ.exe
  C:\Windows\System\MgENlcJ.exe
  2⤵
  PID:6604
- C:\Windows\System\dUzrQDB.exe
  C:\Windows\System\dUzrQDB.exe
  2⤵
  PID:6628
- C:\Windows\System\arVzkmv.exe
  C:\Windows\System\arVzkmv.exe
  2⤵
  PID:6656
- C:\Windows\System\mVouhAN.exe
  C:\Windows\System\mVouhAN.exe
  2⤵
  PID:6680
- C:\Windows\System\pBwXWKm.exe
  C:\Windows\System\pBwXWKm.exe
  2⤵
  PID:6704
- C:\Windows\System\RClVINV.exe
  C:\Windows\System\RClVINV.exe
  2⤵
  PID:6724
- C:\Windows\System\xwGXQDX.exe
  C:\Windows\System\xwGXQDX.exe
  2⤵
  PID:6748
- C:\Windows\System\zMzxqqK.exe
  C:\Windows\System\zMzxqqK.exe
  2⤵
  PID:6912
- C:\Windows\System\XUJEctp.exe
  C:\Windows\System\XUJEctp.exe
  2⤵
  PID:6932
- C:\Windows\System\HOCaukW.exe
  C:\Windows\System\HOCaukW.exe
  2⤵
  PID:6952
- C:\Windows\System\DLfzgVA.exe
  C:\Windows\System\DLfzgVA.exe
  2⤵
  PID:6972
- C:\Windows\System\ZUhOpVz.exe
  C:\Windows\System\ZUhOpVz.exe
  2⤵
  PID:7000
- C:\Windows\System\jXkFuXz.exe
  C:\Windows\System\jXkFuXz.exe
  2⤵
  PID:7028
- C:\Windows\System\hLaifJc.exe
  C:\Windows\System\hLaifJc.exe
  2⤵
  PID:7048
- C:\Windows\System\dOGdnzu.exe
  C:\Windows\System\dOGdnzu.exe
  2⤵
  PID:7068
- C:\Windows\System\xppMbvJ.exe
  C:\Windows\System\xppMbvJ.exe
  2⤵
  PID:7092
- C:\Windows\System\yKuhtNC.exe
  C:\Windows\System\yKuhtNC.exe
  2⤵
  PID:5936
- C:\Windows\System\yWOjYdX.exe
  C:\Windows\System\yWOjYdX.exe
  2⤵
  PID:5184
- C:\Windows\System\GseCsXc.exe
  C:\Windows\System\GseCsXc.exe
  2⤵
  PID:6024
- C:\Windows\System\CxqyiSk.exe
  C:\Windows\System\CxqyiSk.exe
  2⤵
  PID:6064
- C:\Windows\System\ujapfvf.exe
  C:\Windows\System\ujapfvf.exe
  2⤵
  PID:6464
- C:\Windows\System\npmNMEL.exe
  C:\Windows\System\npmNMEL.exe
  2⤵
  PID:4144
- C:\Windows\System\UUdPbOB.exe
  C:\Windows\System\UUdPbOB.exe
  2⤵
  PID:5252
- C:\Windows\System\UibhgER.exe
  C:\Windows\System\UibhgER.exe
  2⤵
  PID:6720
- C:\Windows\System\nHnEiDO.exe
  C:\Windows\System\nHnEiDO.exe
  2⤵
  PID:6384
- C:\Windows\System\EPgzUAQ.exe
  C:\Windows\System\EPgzUAQ.exe
  2⤵
  PID:5648
- C:\Windows\System\xLsRTIz.exe
  C:\Windows\System\xLsRTIz.exe
  2⤵
  PID:6444
- C:\Windows\System\UPBHXny.exe
  C:\Windows\System\UPBHXny.exe
  2⤵
  PID:6504
- C:\Windows\System\iIZxVDd.exe
  C:\Windows\System\iIZxVDd.exe
  2⤵
  PID:6168
- C:\Windows\System\JwqvhiM.exe
  C:\Windows\System\JwqvhiM.exe
  2⤵
  PID:6204
- C:\Windows\System\auwJmQg.exe
  C:\Windows\System\auwJmQg.exe
  2⤵
  PID:6716
- C:\Windows\System\TPCJePU.exe
  C:\Windows\System\TPCJePU.exe
  2⤵
  PID:6944
- C:\Windows\System\wnQgsmn.exe
  C:\Windows\System\wnQgsmn.exe
  2⤵
  PID:6404
- C:\Windows\System\FqgPJXt.exe
  C:\Windows\System\FqgPJXt.exe
  2⤵
  PID:6524
- C:\Windows\System\HQSxYaU.exe
  C:\Windows\System\HQSxYaU.exe
  2⤵
  PID:6592
- C:\Windows\System\YdcoCjf.exe
  C:\Windows\System\YdcoCjf.exe
  2⤵
  PID:6668
- C:\Windows\System\bujrWjo.exe
  C:\Windows\System\bujrWjo.exe
  2⤵
  PID:7108
- C:\Windows\System\EqMKqmq.exe
  C:\Windows\System\EqMKqmq.exe
  2⤵
  PID:2648
- C:\Windows\System\OwfHJfa.exe
  C:\Windows\System\OwfHJfa.exe
  2⤵
  PID:7104
- C:\Windows\System\oMILsSk.exe
  C:\Windows\System\oMILsSk.exe
  2⤵
  PID:5676
- C:\Windows\System\SBzoOtu.exe
  C:\Windows\System\SBzoOtu.exe
  2⤵
  PID:6920
- C:\Windows\System\ASZWWyL.exe
  C:\Windows\System\ASZWWyL.exe
  2⤵
  PID:6520
- C:\Windows\System\VeGQLgL.exe
  C:\Windows\System\VeGQLgL.exe
  2⤵
  PID:7012
- C:\Windows\System\kbSGybp.exe
  C:\Windows\System\kbSGybp.exe
  2⤵
  PID:6364
- C:\Windows\System\EzxkTjC.exe
  C:\Windows\System\EzxkTjC.exe
  2⤵
  PID:5704
- C:\Windows\System\YJSQJuQ.exe
  C:\Windows\System\YJSQJuQ.exe
  2⤵
  PID:7156
- C:\Windows\System\KzzcuEB.exe
  C:\Windows\System\KzzcuEB.exe
  2⤵
  PID:7216
- C:\Windows\System\ZfPlXOt.exe
  C:\Windows\System\ZfPlXOt.exe
  2⤵
  PID:7232
- C:\Windows\System\UmbbLNM.exe
  C:\Windows\System\UmbbLNM.exe
  2⤵
  PID:7256
- C:\Windows\System\MdBcbSf.exe
  C:\Windows\System\MdBcbSf.exe
  2⤵
  PID:7272
- C:\Windows\System\ozQAABk.exe
  C:\Windows\System\ozQAABk.exe
  2⤵
  PID:7296
- C:\Windows\System\dmUJdal.exe
  C:\Windows\System\dmUJdal.exe
  2⤵
  PID:7312
- C:\Windows\System\fpUFKkf.exe
  C:\Windows\System\fpUFKkf.exe
  2⤵
  PID:7336
- C:\Windows\System\OPSabPd.exe
  C:\Windows\System\OPSabPd.exe
  2⤵
  PID:7356
- C:\Windows\System\SrICOBw.exe
  C:\Windows\System\SrICOBw.exe
  2⤵
  PID:7372
- C:\Windows\System\kCKsyMT.exe
  C:\Windows\System\kCKsyMT.exe
  2⤵
  PID:7396
- C:\Windows\System\adTZFLs.exe
  C:\Windows\System\adTZFLs.exe
  2⤵
  PID:7412
- C:\Windows\System\jYSrUqv.exe
  C:\Windows\System\jYSrUqv.exe
  2⤵
  PID:7436
- C:\Windows\System\ynjZKol.exe
  C:\Windows\System\ynjZKol.exe
  2⤵
  PID:7452
- C:\Windows\System\hKAZnkx.exe
  C:\Windows\System\hKAZnkx.exe
  2⤵
  PID:7472
- C:\Windows\System\RTcpBVe.exe
  C:\Windows\System\RTcpBVe.exe
  2⤵
  PID:7488
- C:\Windows\System\uWHlvXw.exe
  C:\Windows\System\uWHlvXw.exe
  2⤵
  PID:7508
- C:\Windows\System\OLCHSlu.exe
  C:\Windows\System\OLCHSlu.exe
  2⤵
  PID:7528
- C:\Windows\System\gogcpLi.exe
  C:\Windows\System\gogcpLi.exe
  2⤵
  PID:7548
- C:\Windows\System\QkRspTH.exe
  C:\Windows\System\QkRspTH.exe
  2⤵
  PID:7568
- C:\Windows\System\CZbPZYY.exe
  C:\Windows\System\CZbPZYY.exe
  2⤵
  PID:7588
- C:\Windows\System\nvJAsVQ.exe
  C:\Windows\System\nvJAsVQ.exe
  2⤵
  PID:7608
- C:\Windows\System\QVLhkVa.exe
  C:\Windows\System\QVLhkVa.exe
  2⤵
  PID:7632
- C:\Windows\System\RveuInt.exe
  C:\Windows\System\RveuInt.exe
  2⤵
  PID:7648
- C:\Windows\System\JmIywTo.exe
  C:\Windows\System\JmIywTo.exe
  2⤵
  PID:7664
- C:\Windows\System\WTITMGf.exe
  C:\Windows\System\WTITMGf.exe
  2⤵
  PID:7684
- C:\Windows\System\dIpBWSj.exe
  C:\Windows\System\dIpBWSj.exe
  2⤵
  PID:7704
- C:\Windows\System\krnCyUp.exe
  C:\Windows\System\krnCyUp.exe
  2⤵
  PID:7724
- C:\Windows\System\RWNkRtr.exe
  C:\Windows\System\RWNkRtr.exe
  2⤵
  PID:7744
- C:\Windows\System\NjxAzbu.exe
  C:\Windows\System\NjxAzbu.exe
  2⤵
  PID:7764
- C:\Windows\System\npItGQS.exe
  C:\Windows\System\npItGQS.exe
  2⤵
  PID:7788
- C:\Windows\System\cWJwpOH.exe
  C:\Windows\System\cWJwpOH.exe
  2⤵
  PID:7808
- C:\Windows\System\XCufiun.exe
  C:\Windows\System\XCufiun.exe
  2⤵
  PID:7832
- C:\Windows\System\DpmCsaj.exe
  C:\Windows\System\DpmCsaj.exe
  2⤵
  PID:7856
- C:\Windows\System\EllyKzn.exe
  C:\Windows\System\EllyKzn.exe
  2⤵
  PID:7880
- C:\Windows\System\suOchRy.exe
  C:\Windows\System\suOchRy.exe
  2⤵
  PID:7900
- C:\Windows\System\sHGnAPN.exe
  C:\Windows\System\sHGnAPN.exe
  2⤵
  PID:7916
- C:\Windows\System\kbQOcRp.exe
  C:\Windows\System\kbQOcRp.exe
  2⤵
  PID:7936
- C:\Windows\System\IZWYMIT.exe
  C:\Windows\System\IZWYMIT.exe
  2⤵
  PID:7956
- C:\Windows\System\iEILiLH.exe
  C:\Windows\System\iEILiLH.exe
  2⤵
  PID:7976
- C:\Windows\System\MfRgfQl.exe
  C:\Windows\System\MfRgfQl.exe
  2⤵
  PID:7996
- C:\Windows\System\mYhLKyE.exe
  C:\Windows\System\mYhLKyE.exe
  2⤵
  PID:8016
- C:\Windows\System\lYZhabt.exe
  C:\Windows\System\lYZhabt.exe
  2⤵
  PID:8036
- C:\Windows\System\xxMcgWB.exe
  C:\Windows\System\xxMcgWB.exe
  2⤵
  PID:8060
- C:\Windows\System\cuaPxAz.exe
  C:\Windows\System\cuaPxAz.exe
  2⤵
  PID:8080
- C:\Windows\System\uXJRbTW.exe
  C:\Windows\System\uXJRbTW.exe
  2⤵
  PID:8104
- C:\Windows\System\jStlToR.exe
  C:\Windows\System\jStlToR.exe
  2⤵
  PID:8124
- C:\Windows\System\VKkhBov.exe
  C:\Windows\System\VKkhBov.exe
  2⤵
  PID:8148
- C:\Windows\System\CFOjyRW.exe
  C:\Windows\System\CFOjyRW.exe
  2⤵
  PID:8168
- C:\Windows\System\hPvrkld.exe
  C:\Windows\System\hPvrkld.exe
  2⤵
  PID:8184
- C:\Windows\System\rBrasSN.exe
  C:\Windows\System\rBrasSN.exe
  2⤵
  PID:6148
- C:\Windows\System\vWBkIiy.exe
  C:\Windows\System\vWBkIiy.exe
  2⤵
  PID:6484
- C:\Windows\System\oxXINPU.exe
  C:\Windows\System\oxXINPU.exe
  2⤵
  PID:5772
- C:\Windows\System\RAUeamj.exe
  C:\Windows\System\RAUeamj.exe
  2⤵
  PID:6964
- C:\Windows\System\znCfUnr.exe
  C:\Windows\System\znCfUnr.exe
  2⤵
  PID:5188
- C:\Windows\System\DwaxpIc.exe
  C:\Windows\System\DwaxpIc.exe
  2⤵
  PID:6052
- C:\Windows\System\EVONaQS.exe
  C:\Windows\System\EVONaQS.exe
  2⤵
  PID:6776
- C:\Windows\System\DHKuaSb.exe
  C:\Windows\System\DHKuaSb.exe
  2⤵
  PID:7180
- C:\Windows\System\vlsTKMY.exe
  C:\Windows\System\vlsTKMY.exe
  2⤵
  PID:5948
- C:\Windows\System\YpXVfFI.exe
  C:\Windows\System\YpXVfFI.exe
  2⤵
  PID:6564
- C:\Windows\System\uOAhCUW.exe
  C:\Windows\System\uOAhCUW.exe
  2⤵
  PID:6696
- C:\Windows\System\jkXCWaJ.exe
  C:\Windows\System\jkXCWaJ.exe
  2⤵
  PID:6320
- C:\Windows\System\HYlSomJ.exe
  C:\Windows\System\HYlSomJ.exe
  2⤵
  PID:7380
- C:\Windows\System\fNdTmYm.exe
  C:\Windows\System\fNdTmYm.exe
  2⤵
  PID:6780
- C:\Windows\System\rmorlpq.exe
  C:\Windows\System\rmorlpq.exe
  2⤵
  PID:6288
- C:\Windows\System\BnfdadR.exe
  C:\Windows\System\BnfdadR.exe
  2⤵
  PID:7580
- C:\Windows\System\vRKJiuE.exe
  C:\Windows\System\vRKJiuE.exe
  2⤵
  PID:7208
- C:\Windows\System\lxKnQNE.exe
  C:\Windows\System\lxKnQNE.exe
  2⤵
  PID:7240
- C:\Windows\System\PcoMWjB.exe
  C:\Windows\System\PcoMWjB.exe
  2⤵
  PID:7816
- C:\Windows\System\vHAgmdE.exe
  C:\Windows\System\vHAgmdE.exe
  2⤵
  PID:7868
- C:\Windows\System\tQOXybs.exe
  C:\Windows\System\tQOXybs.exe
  2⤵
  PID:8200
- C:\Windows\System\uemVXFk.exe
  C:\Windows\System\uemVXFk.exe
  2⤵
  PID:8216
- C:\Windows\System\GFtyOYf.exe
  C:\Windows\System\GFtyOYf.exe
  2⤵
  PID:8240
- C:\Windows\System\IjoJvOt.exe
  C:\Windows\System\IjoJvOt.exe
  2⤵
  PID:8260
- C:\Windows\System\fdFEOVF.exe
  C:\Windows\System\fdFEOVF.exe
  2⤵
  PID:8284
- C:\Windows\System\ZgFVeAG.exe
  C:\Windows\System\ZgFVeAG.exe
  2⤵
  PID:8304
- C:\Windows\System\UDANSTc.exe
  C:\Windows\System\UDANSTc.exe
  2⤵
  PID:8336
- C:\Windows\System\CVnXeDx.exe
  C:\Windows\System\CVnXeDx.exe
  2⤵
  PID:8364
- C:\Windows\System\cEcCAFB.exe
  C:\Windows\System\cEcCAFB.exe
  2⤵
  PID:8384
- C:\Windows\System\WyeVhZD.exe
  C:\Windows\System\WyeVhZD.exe
  2⤵
  PID:8408
- C:\Windows\System\BERZicJ.exe
  C:\Windows\System\BERZicJ.exe
  2⤵
  PID:8432
- C:\Windows\System\vJDKjRj.exe
  C:\Windows\System\vJDKjRj.exe
  2⤵
  PID:8460
- C:\Windows\System\npcunGU.exe
  C:\Windows\System\npcunGU.exe
  2⤵
  PID:8492
- C:\Windows\System\uZhtxib.exe
  C:\Windows\System\uZhtxib.exe
  2⤵
  PID:8516
- C:\Windows\System\wdgRRzr.exe
  C:\Windows\System\wdgRRzr.exe
  2⤵
  PID:8540
- C:\Windows\System\WYQMsbm.exe
  C:\Windows\System\WYQMsbm.exe
  2⤵
  PID:8560
- C:\Windows\System\uAAEhcW.exe
  C:\Windows\System\uAAEhcW.exe
  2⤵
  PID:8924
- C:\Windows\System\RZKzUqe.exe
  C:\Windows\System\RZKzUqe.exe
  2⤵
  PID:8940
- C:\Windows\System\kUyaUkk.exe
  C:\Windows\System\kUyaUkk.exe
  2⤵
  PID:8960
- C:\Windows\System\jPvECnO.exe
  C:\Windows\System\jPvECnO.exe
  2⤵
  PID:8976
- C:\Windows\System\waisTva.exe
  C:\Windows\System\waisTva.exe
  2⤵
  PID:9000
- C:\Windows\System\TMxrJHZ.exe
  C:\Windows\System\TMxrJHZ.exe
  2⤵
  PID:9016
- C:\Windows\System\vChuqrz.exe
  C:\Windows\System\vChuqrz.exe
  2⤵
  PID:9040
- C:\Windows\System\OgjzCRN.exe
  C:\Windows\System\OgjzCRN.exe
  2⤵
  PID:9060
- C:\Windows\System\uLHnptr.exe
  C:\Windows\System\uLHnptr.exe
  2⤵
  PID:9080
- C:\Windows\System\pKUcTCH.exe
  C:\Windows\System\pKUcTCH.exe
  2⤵
  PID:9096
- C:\Windows\System\fwmasrc.exe
  C:\Windows\System\fwmasrc.exe
  2⤵
  PID:9128
- C:\Windows\System\kjMUMqz.exe
  C:\Windows\System\kjMUMqz.exe
  2⤵
  PID:9144
- C:\Windows\System\mDYkVPH.exe
  C:\Windows\System\mDYkVPH.exe
  2⤵
  PID:9160
- C:\Windows\System\AgNdSFe.exe
  C:\Windows\System\AgNdSFe.exe
  2⤵
  PID:8012
- C:\Windows\System\OTUjeOb.exe
  C:\Windows\System\OTUjeOb.exe
  2⤵
  PID:7556
- C:\Windows\System\RoKNQLM.exe
  C:\Windows\System\RoKNQLM.exe
  2⤵
  PID:6300
- C:\Windows\System\GMjzXfR.exe
  C:\Windows\System\GMjzXfR.exe
  2⤵
  PID:7292
- C:\Windows\System\dFHdcRO.exe
  C:\Windows\System\dFHdcRO.exe
  2⤵
  PID:7852
- C:\Windows\System\vHMRSRQ.exe
  C:\Windows\System\vHMRSRQ.exe
  2⤵
  PID:7420
- C:\Windows\System\wsFMEkS.exe
  C:\Windows\System\wsFMEkS.exe
  2⤵
  PID:8280
- C:\Windows\System\RECgFxC.exe
  C:\Windows\System\RECgFxC.exe
  2⤵
  PID:7504
- C:\Windows\System\OyvEXVO.exe
  C:\Windows\System\OyvEXVO.exe
  2⤵
  PID:7536
- C:\Windows\System\FhNjvFF.exe
  C:\Windows\System\FhNjvFF.exe
  2⤵
  PID:6216
- C:\Windows\System\tpNUzFD.exe
  C:\Windows\System\tpNUzFD.exe
  2⤵
  PID:6164
- C:\Windows\System\TAuQeiS.exe
  C:\Windows\System\TAuQeiS.exe
  2⤵
  PID:5904
- C:\Windows\System\AXdGUHj.exe
  C:\Windows\System\AXdGUHj.exe
  2⤵
  PID:6960
- C:\Windows\System\iQOPToR.exe
  C:\Windows\System\iQOPToR.exe
  2⤵
  PID:7736
- C:\Windows\System\UTSaMAa.exe
  C:\Windows\System\UTSaMAa.exe
  2⤵
  PID:8396
- C:\Windows\System\cxuxqVI.exe
  C:\Windows\System\cxuxqVI.exe
  2⤵
  PID:8776
- C:\Windows\System\wqVfwgC.exe
  C:\Windows\System\wqVfwgC.exe
  2⤵
  PID:8508
- C:\Windows\System\UTPqItu.exe
  C:\Windows\System\UTPqItu.exe
  2⤵
  PID:8556
- C:\Windows\System\dftxJKg.exe
  C:\Windows\System\dftxJKg.exe
  2⤵
  PID:7804
- C:\Windows\System\TIxLIYW.exe
  C:\Windows\System\TIxLIYW.exe
  2⤵
  PID:8608
- C:\Windows\System\jRWTaTX.exe
  C:\Windows\System\jRWTaTX.exe
  2⤵
  PID:8656
- C:\Windows\System\JqUOKxa.exe
  C:\Windows\System\JqUOKxa.exe
  2⤵
  PID:8744
- C:\Windows\System\wSZhpMP.exe
  C:\Windows\System\wSZhpMP.exe
  2⤵
  PID:7408
- C:\Windows\System\EMiEECN.exe
  C:\Windows\System\EMiEECN.exe
  2⤵
  PID:8936
- C:\Windows\System\JnDJYyj.exe
  C:\Windows\System\JnDJYyj.exe
  2⤵
  PID:8992
- C:\Windows\System\DGFuobQ.exe
  C:\Windows\System\DGFuobQ.exe
  2⤵
  PID:7384
- C:\Windows\System\uwMPFsh.exe
  C:\Windows\System\uwMPFsh.exe
  2⤵
  PID:9092
- C:\Windows\System\GFZoscs.exe
  C:\Windows\System\GFZoscs.exe
  2⤵
  PID:9140
- C:\Windows\System\qiinnol.exe
  C:\Windows\System\qiinnol.exe
  2⤵
  PID:9236
- C:\Windows\System\oEtBOYd.exe
  C:\Windows\System\oEtBOYd.exe
  2⤵
  PID:9264
- C:\Windows\System\IUvndgd.exe
  C:\Windows\System\IUvndgd.exe
  2⤵
  PID:9280
- C:\Windows\System\EmhnWiU.exe
  C:\Windows\System\EmhnWiU.exe
  2⤵
  PID:9320
- C:\Windows\System\wGhBRlJ.exe
  C:\Windows\System\wGhBRlJ.exe
  2⤵
  PID:9348
- C:\Windows\System\jyURLRC.exe
  C:\Windows\System\jyURLRC.exe
  2⤵
  PID:9368
- C:\Windows\System\RVSWUZZ.exe
  C:\Windows\System\RVSWUZZ.exe
  2⤵
  PID:9392
- C:\Windows\System\hdJqssy.exe
  C:\Windows\System\hdJqssy.exe
  2⤵
  PID:9412
- C:\Windows\System\eOdyZwh.exe
  C:\Windows\System\eOdyZwh.exe
  2⤵
  PID:9432
- C:\Windows\System\MAHdNvT.exe
  C:\Windows\System\MAHdNvT.exe
  2⤵
  PID:9452
- C:\Windows\System\KvRUZZt.exe
  C:\Windows\System\KvRUZZt.exe
  2⤵
  PID:9468
- C:\Windows\System\bpMCfll.exe
  C:\Windows\System\bpMCfll.exe
  2⤵
  PID:9488
- C:\Windows\System\XluoLkV.exe
  C:\Windows\System\XluoLkV.exe
  2⤵
  PID:9504
- C:\Windows\System\NBYvdWL.exe
  C:\Windows\System\NBYvdWL.exe
  2⤵
  PID:9528
- C:\Windows\System\cyCfmia.exe
  C:\Windows\System\cyCfmia.exe
  2⤵
  PID:9552
- C:\Windows\System\UedfkMQ.exe
  C:\Windows\System\UedfkMQ.exe
  2⤵
  PID:9568
- C:\Windows\System\TxZSuPD.exe
  C:\Windows\System\TxZSuPD.exe
  2⤵
  PID:9600
- C:\Windows\System\WMxMFwu.exe
  C:\Windows\System\WMxMFwu.exe
  2⤵
  PID:9620
- C:\Windows\System\BbdRKSM.exe
  C:\Windows\System\BbdRKSM.exe
  2⤵
  PID:9660
- C:\Windows\System\AsLutAw.exe
  C:\Windows\System\AsLutAw.exe
  2⤵
  PID:9684
- C:\Windows\System\lUVCBdE.exe
  C:\Windows\System\lUVCBdE.exe
  2⤵
  PID:9704
- C:\Windows\System\CybPPMV.exe
  C:\Windows\System\CybPPMV.exe
  2⤵
  PID:9728
- C:\Windows\System\DgPHEhN.exe
  C:\Windows\System\DgPHEhN.exe
  2⤵
  PID:9748
- C:\Windows\System\YECAYUc.exe
  C:\Windows\System\YECAYUc.exe
  2⤵
  PID:9768
- C:\Windows\System\JuWzrOe.exe
  C:\Windows\System\JuWzrOe.exe
  2⤵
  PID:9784
- C:\Windows\System\osDFsZt.exe
  C:\Windows\System\osDFsZt.exe
  2⤵
  PID:9812
- C:\Windows\System\cRIFiBT.exe
  C:\Windows\System\cRIFiBT.exe
  2⤵
  PID:9836
- C:\Windows\System\qWelbXe.exe
  C:\Windows\System\qWelbXe.exe
  2⤵
  PID:9852
- C:\Windows\System\dayKIuL.exe
  C:\Windows\System\dayKIuL.exe
  2⤵
  PID:9872
- C:\Windows\System\hKRJhHv.exe
  C:\Windows\System\hKRJhHv.exe
  2⤵
  PID:9896
- C:\Windows\System\kHvhVDh.exe
  C:\Windows\System\kHvhVDh.exe
  2⤵
  PID:9916
- C:\Windows\System\dUMfKbk.exe
  C:\Windows\System\dUMfKbk.exe
  2⤵
  PID:9948
- C:\Windows\System\CFXMssl.exe
  C:\Windows\System\CFXMssl.exe
  2⤵
  PID:9972
- C:\Windows\System\JjZzfce.exe
  C:\Windows\System\JjZzfce.exe
  2⤵
  PID:10000
- C:\Windows\System\uVXiZcf.exe
  C:\Windows\System\uVXiZcf.exe
  2⤵
  PID:10020
- C:\Windows\System\BSlwMXY.exe
  C:\Windows\System\BSlwMXY.exe
  2⤵
  PID:10036
- C:\Windows\System\GbLlPRw.exe
  C:\Windows\System\GbLlPRw.exe
  2⤵
  PID:10060
- C:\Windows\System\fobMOHz.exe
  C:\Windows\System\fobMOHz.exe
  2⤵
  PID:10080
- C:\Windows\System\rbSCxhX.exe
  C:\Windows\System\rbSCxhX.exe
  2⤵
  PID:10100
- C:\Windows\System\EbluZPv.exe
  C:\Windows\System\EbluZPv.exe
  2⤵
  PID:10120
- C:\Windows\System\ARmAHtA.exe
  C:\Windows\System\ARmAHtA.exe
  2⤵
  PID:10144
- C:\Windows\System\AdiRhgU.exe
  C:\Windows\System\AdiRhgU.exe
  2⤵
  PID:10164
- C:\Windows\System\nMTaLMw.exe
  C:\Windows\System\nMTaLMw.exe
  2⤵
  PID:10184
- C:\Windows\System\mlSyrno.exe
  C:\Windows\System\mlSyrno.exe
  2⤵
  PID:10200
- C:\Windows\System\VUGGWHM.exe
  C:\Windows\System\VUGGWHM.exe
  2⤵
  PID:10216
- C:\Windows\System\SMdoAJW.exe
  C:\Windows\System\SMdoAJW.exe
  2⤵
  PID:10232
- C:\Windows\System\eIgSXsI.exe
  C:\Windows\System\eIgSXsI.exe
  2⤵
  PID:7464
- C:\Windows\System\DWsgepz.exe
  C:\Windows\System\DWsgepz.exe
  2⤵
  PID:7544
- C:\Windows\System\oQKLIwq.exe
  C:\Windows\System\oQKLIwq.exe
  2⤵
  PID:8252
- C:\Windows\System\YYkJAqp.exe
  C:\Windows\System\YYkJAqp.exe
  2⤵
  PID:7284
- C:\Windows\System\IHruaUv.exe
  C:\Windows\System\IHruaUv.exe
  2⤵
  PID:8680
- C:\Windows\System\AnlnUQk.exe
  C:\Windows\System\AnlnUQk.exe
  2⤵
  PID:8844
- C:\Windows\System\zEgdQbX.exe
  C:\Windows\System\zEgdQbX.exe
  2⤵
  PID:7796
- C:\Windows\System\YxQghUc.exe
  C:\Windows\System\YxQghUc.exe
  2⤵
  PID:9228
- C:\Windows\System\PLCzbmy.exe
  C:\Windows\System\PLCzbmy.exe
  2⤵
  PID:9248
- C:\Windows\System\wNeIiHM.exe
  C:\Windows\System\wNeIiHM.exe
  2⤵
  PID:9344
- C:\Windows\System\UznyNAV.exe
  C:\Windows\System\UznyNAV.exe
  2⤵
  PID:9388
- C:\Windows\System\JIsaGNY.exe
  C:\Windows\System\JIsaGNY.exe
  2⤵
  PID:9536
- C:\Windows\System\RIGNSfy.exe
  C:\Windows\System\RIGNSfy.exe
  2⤵
  PID:9580
- C:\Windows\System\XRIhjcv.exe
  C:\Windows\System\XRIhjcv.exe
  2⤵
  PID:9696
- C:\Windows\System\TCtXoSD.exe
  C:\Windows\System\TCtXoSD.exe
  2⤵
  PID:10152
- C:\Windows\System\idubtYR.exe
  C:\Windows\System\idubtYR.exe
  2⤵
  PID:9424
- C:\Windows\System\chQWoNe.exe
  C:\Windows\System\chQWoNe.exe
  2⤵
  PID:9480
- C:\Windows\System\pqnhHHn.exe
  C:\Windows\System\pqnhHHn.exe
  2⤵
  PID:8196
- C:\Windows\System\RjQnGQT.exe
  C:\Windows\System\RjQnGQT.exe
  2⤵
  PID:8296
- C:\Windows\System\nINODmG.exe
  C:\Windows\System\nINODmG.exe
  2⤵
  PID:8888
- C:\Windows\System\UPMONJY.exe
  C:\Windows\System\UPMONJY.exe
  2⤵
  PID:8704
- C:\Windows\System\ageJxmh.exe
  C:\Windows\System\ageJxmh.exe
  2⤵
  PID:9676
- C:\Windows\System\ysjLKQU.exe
  C:\Windows\System\ysjLKQU.exe
  2⤵
  PID:9232
- C:\Windows\System\HIVymly.exe
  C:\Windows\System\HIVymly.exe
  2⤵
  PID:9744
- C:\Windows\System\gVAGutv.exe
  C:\Windows\System\gVAGutv.exe
  2⤵
  PID:9820
- C:\Windows\System\BuKGtAb.exe
  C:\Windows\System\BuKGtAb.exe
  2⤵
  PID:8648
- C:\Windows\System\RaafGkR.exe
  C:\Windows\System\RaafGkR.exe
  2⤵
  PID:9956
- C:\Windows\System\kgYOcPc.exe
  C:\Windows\System\kgYOcPc.exe
  2⤵
  PID:10028
- C:\Windows\System\dqLQaNE.exe
  C:\Windows\System\dqLQaNE.exe
  2⤵
  PID:9564
- C:\Windows\System\SDVDfkl.exe
  C:\Windows\System\SDVDfkl.exe
  2⤵
  PID:10268
- C:\Windows\System\DQnVEcV.exe
  C:\Windows\System\DQnVEcV.exe
  2⤵
  PID:10296
- C:\Windows\System\SsNCHSi.exe
  C:\Windows\System\SsNCHSi.exe
  2⤵
  PID:10324
- C:\Windows\System\AgRiWUk.exe
  C:\Windows\System\AgRiWUk.exe
  2⤵
  PID:10344
- C:\Windows\System\kQslZVa.exe
  C:\Windows\System\kQslZVa.exe
  2⤵
  PID:10364
- C:\Windows\System\lYZgyqZ.exe
  C:\Windows\System\lYZgyqZ.exe
  2⤵
  PID:10396
- C:\Windows\System\QRVKEhJ.exe
  C:\Windows\System\QRVKEhJ.exe
  2⤵
  PID:10420
- C:\Windows\System\KxBtTZj.exe
  C:\Windows\System\KxBtTZj.exe
  2⤵
  PID:10440
- C:\Windows\System\vZdxDPk.exe
  C:\Windows\System\vZdxDPk.exe
  2⤵
  PID:10472
- C:\Windows\System\vtjcZfF.exe
  C:\Windows\System\vtjcZfF.exe
  2⤵
  PID:10488
- C:\Windows\System\HKepeKu.exe
  C:\Windows\System\HKepeKu.exe
  2⤵
  PID:10508
- C:\Windows\System\LBpFpmC.exe
  C:\Windows\System\LBpFpmC.exe
  2⤵
  PID:10524
- C:\Windows\System\mqlxVyC.exe
  C:\Windows\System\mqlxVyC.exe
  2⤵
  PID:10548
- C:\Windows\System\izgtrnC.exe
  C:\Windows\System\izgtrnC.exe
  2⤵
  PID:10568
- C:\Windows\System\DFPqQtf.exe
  C:\Windows\System\DFPqQtf.exe
  2⤵
  PID:10600
- C:\Windows\System\OghnoRQ.exe
  C:\Windows\System\OghnoRQ.exe
  2⤵
  PID:10620
- C:\Windows\System\acpggaC.exe
  C:\Windows\System\acpggaC.exe
  2⤵
  PID:10916
- C:\Windows\System\YTPgCHJ.exe
  C:\Windows\System\YTPgCHJ.exe
  2⤵
  PID:10936
- C:\Windows\System\bZLUvVG.exe
  C:\Windows\System\bZLUvVG.exe
  2⤵
  PID:10960
- C:\Windows\System\VLeBAkD.exe
  C:\Windows\System\VLeBAkD.exe
  2⤵
  PID:10992
- C:\Windows\System\kUGLFzw.exe
  C:\Windows\System\kUGLFzw.exe
  2⤵
  PID:11008
- C:\Windows\System\fcUEiQD.exe
  C:\Windows\System\fcUEiQD.exe
  2⤵
  PID:11028
- C:\Windows\System\lnSbfcZ.exe
  C:\Windows\System\lnSbfcZ.exe
  2⤵
  PID:11052
- C:\Windows\System\HXnNJLF.exe
  C:\Windows\System\HXnNJLF.exe
  2⤵
  PID:11072
- C:\Windows\System\fnOvMyd.exe
  C:\Windows\System\fnOvMyd.exe
  2⤵
  PID:11088
- C:\Windows\System\rkEjUUT.exe
  C:\Windows\System\rkEjUUT.exe
  2⤵
  PID:11112
- C:\Windows\System\lQrqUmP.exe
  C:\Windows\System\lQrqUmP.exe
  2⤵
  PID:11140
- C:\Windows\System\ofBGRqU.exe
  C:\Windows\System\ofBGRqU.exe
  2⤵
  PID:11168
- C:\Windows\System\CyAaFWr.exe
  C:\Windows\System\CyAaFWr.exe
  2⤵
  PID:11192
- C:\Windows\System\gNLvxWK.exe
  C:\Windows\System\gNLvxWK.exe
  2⤵
  PID:11216
- C:\Windows\System\XRXgRMG.exe
  C:\Windows\System\XRXgRMG.exe
  2⤵
  PID:11236
- C:\Windows\System\tTawZBA.exe
  C:\Windows\System\tTawZBA.exe
  2⤵
  PID:11256
- C:\Windows\System\GUxeagD.exe
  C:\Windows\System\GUxeagD.exe
  2⤵
  PID:9576
- C:\Windows\System\STkWUtL.exe
  C:\Windows\System\STkWUtL.exe
  2⤵
  PID:4416
- C:\Windows\System\bKyyLOn.exe
  C:\Windows\System\bKyyLOn.exe
  2⤵
  PID:9376
- C:\Windows\System\VpWuPaj.exe
  C:\Windows\System\VpWuPaj.exe
  2⤵
  PID:10660
- C:\Windows\System\nEjkRGj.exe
  C:\Windows\System\nEjkRGj.exe
  2⤵
  PID:9152
- C:\Windows\System\LJptvOd.exe
  C:\Windows\System\LJptvOd.exe
  2⤵
  PID:3308
- C:\Windows\System\YqeadEm.exe
  C:\Windows\System\YqeadEm.exe
  2⤵
  PID:10984
- C:\Windows\System\wOeKmZm.exe
  C:\Windows\System\wOeKmZm.exe
  2⤵
  PID:9032
- C:\Windows\System\iGjrjit.exe
  C:\Windows\System\iGjrjit.exe
  2⤵
  PID:9804
- C:\Windows\System\czKxoNK.exe
  C:\Windows\System\czKxoNK.exe
  2⤵
  PID:10052
- C:\Windows\System\AvqjkhI.exe
  C:\Windows\System\AvqjkhI.exe
  2⤵
  PID:10208
- C:\Windows\System\rZlsFRF.exe
  C:\Windows\System\rZlsFRF.exe
  2⤵
  PID:10280
- C:\Windows\System\UqjxKYm.exe
  C:\Windows\System\UqjxKYm.exe
  2⤵
  PID:10340
- C:\Windows\System\Ujxurfi.exe
  C:\Windows\System\Ujxurfi.exe
  2⤵
  PID:10832
- C:\Windows\System\jQoMLRy.exe
  C:\Windows\System\jQoMLRy.exe
  2⤵
  PID:10504
- C:\Windows\System\rPkJNMl.exe
  C:\Windows\System\rPkJNMl.exe
  2⤵
  PID:11272
- C:\Windows\System\gPNLuNL.exe
  C:\Windows\System\gPNLuNL.exe
  2⤵
  PID:11292
- C:\Windows\System\oDvxFOh.exe
  C:\Windows\System\oDvxFOh.exe
  2⤵
  PID:11320
- C:\Windows\System\EAtdvSF.exe
  C:\Windows\System\EAtdvSF.exe
  2⤵
  PID:11352
- C:\Windows\System\glqEIyo.exe
  C:\Windows\System\glqEIyo.exe
  2⤵
  PID:11376
- C:\Windows\System\ICBcvYg.exe
  C:\Windows\System\ICBcvYg.exe
  2⤵
  PID:11404
- C:\Windows\System\RPDwvDc.exe
  C:\Windows\System\RPDwvDc.exe
  2⤵
  PID:11420
- C:\Windows\System\ohxiZYX.exe
  C:\Windows\System\ohxiZYX.exe
  2⤵
  PID:11440
- C:\Windows\System\wLCtIba.exe
  C:\Windows\System\wLCtIba.exe
  2⤵
  PID:11464
- C:\Windows\System\nwmhMtE.exe
  C:\Windows\System\nwmhMtE.exe
  2⤵
  PID:11484
- C:\Windows\System\hkAGbPn.exe
  C:\Windows\System\hkAGbPn.exe
  2⤵
  PID:11504
- C:\Windows\System\DaoYQyW.exe
  C:\Windows\System\DaoYQyW.exe
  2⤵
  PID:11520
- C:\Windows\System\GuhiBky.exe
  C:\Windows\System\GuhiBky.exe
  2⤵
  PID:11544
- C:\Windows\System\lrQykdX.exe
  C:\Windows\System\lrQykdX.exe
  2⤵
  PID:11560
- C:\Windows\System\dWvhRyz.exe
  C:\Windows\System\dWvhRyz.exe
  2⤵
  PID:11580
- C:\Windows\System\enVyEym.exe
  C:\Windows\System\enVyEym.exe
  2⤵
  PID:11600
- C:\Windows\System\TFalJXa.exe
  C:\Windows\System\TFalJXa.exe
  2⤵
  PID:11620
- C:\Windows\System\CTuPIkv.exe
  C:\Windows\System\CTuPIkv.exe
  2⤵
  PID:11644
- C:\Windows\System\hEKlkoD.exe
  C:\Windows\System\hEKlkoD.exe
  2⤵
  PID:11664
- C:\Windows\System\jyCCfUc.exe
  C:\Windows\System\jyCCfUc.exe
  2⤵
  PID:11684
- C:\Windows\System\ynHjPlM.exe
  C:\Windows\System\ynHjPlM.exe
  2⤵
  PID:11700
- C:\Windows\System\gNoklXo.exe
  C:\Windows\System\gNoklXo.exe
  2⤵
  PID:11724
- C:\Windows\System\qiPuIbn.exe
  C:\Windows\System\qiPuIbn.exe
  2⤵
  PID:11752
- C:\Windows\System\psRGXMh.exe
  C:\Windows\System\psRGXMh.exe
  2⤵
  PID:11772
- C:\Windows\System\IimlnNK.exe
  C:\Windows\System\IimlnNK.exe
  2⤵
  PID:11792
- C:\Windows\System\IPKjWpO.exe
  C:\Windows\System\IPKjWpO.exe
  2⤵
  PID:11816
- C:\Windows\System\HHhKxhI.exe
  C:\Windows\System\HHhKxhI.exe
  2⤵
  PID:11840
- C:\Windows\System\FRnQcGW.exe
  C:\Windows\System\FRnQcGW.exe
  2⤵
  PID:11864
- C:\Windows\System\MbGJJHr.exe
  C:\Windows\System\MbGJJHr.exe
  2⤵
  PID:11884
- C:\Windows\System\ZxJLcFT.exe
  C:\Windows\System\ZxJLcFT.exe
  2⤵
  PID:11916
- C:\Windows\System\vYjXdnE.exe
  C:\Windows\System\vYjXdnE.exe
  2⤵
  PID:11932
- C:\Windows\System\InOJZtO.exe
  C:\Windows\System\InOJZtO.exe
  2⤵
  PID:11952
- C:\Windows\System\TmkKszA.exe
  C:\Windows\System\TmkKszA.exe
  2⤵
  PID:11976
- C:\Windows\System\EzoeZxw.exe
  C:\Windows\System\EzoeZxw.exe
  2⤵
  PID:11996
- C:\Windows\System\ykmlJNZ.exe
  C:\Windows\System\ykmlJNZ.exe
  2⤵
  PID:12016
- C:\Windows\System\BvnUWoz.exe
  C:\Windows\System\BvnUWoz.exe
  2⤵
  PID:12040
- C:\Windows\System\cdVoPcB.exe
  C:\Windows\System\cdVoPcB.exe
  2⤵
  PID:12056
- C:\Windows\System\nshcTkb.exe
  C:\Windows\System\nshcTkb.exe
  2⤵
  PID:12072
- C:\Windows\System\RWGeSBA.exe
  C:\Windows\System\RWGeSBA.exe
  2⤵
  PID:12088
- C:\Windows\System\IhbamQp.exe
  C:\Windows\System\IhbamQp.exe
  2⤵
  PID:12104
- C:\Windows\System\lQcRPwP.exe
  C:\Windows\System\lQcRPwP.exe
  2⤵
  PID:12124
- C:\Windows\System\SqGYTBM.exe
  C:\Windows\System\SqGYTBM.exe
  2⤵
  PID:12140
- C:\Windows\System\dHlAmnI.exe
  C:\Windows\System\dHlAmnI.exe
  2⤵
  PID:12164
- C:\Windows\System\jDQxlym.exe
  C:\Windows\System\jDQxlym.exe
  2⤵
  PID:12184
- C:\Windows\System\TBcBxDi.exe
  C:\Windows\System\TBcBxDi.exe
  2⤵
  PID:9868
- C:\Windows\System\NBpnKeD.exe
  C:\Windows\System\NBpnKeD.exe
  2⤵
  PID:11636
- C:\Windows\System\MAZQpoe.exe
  C:\Windows\System\MAZQpoe.exe
  2⤵
  PID:7460
- C:\Windows\System\ZqrNcXM.exe
  C:\Windows\System\ZqrNcXM.exe
  2⤵
  PID:11692
- C:\Windows\System\vuNfpYU.exe
  C:\Windows\System\vuNfpYU.exe
  2⤵
  PID:11740
- C:\Windows\System\nQvVtqX.exe
  C:\Windows\System\nQvVtqX.exe
  2⤵
  PID:11784
- C:\Windows\System\VkBRHun.exe
  C:\Windows\System\VkBRHun.exe
  2⤵
  PID:8916
- C:\Windows\System\VXBwwlS.exe
  C:\Windows\System\VXBwwlS.exe
  2⤵
  PID:10336
- C:\Windows\System\DLnpcff.exe
  C:\Windows\System\DLnpcff.exe
  2⤵
  PID:12048
- C:\Windows\System\TFnlWlq.exe
  C:\Windows\System\TFnlWlq.exe
  2⤵
  PID:12180
- C:\Windows\System\WxNDEBe.exe
  C:\Windows\System\WxNDEBe.exe
  2⤵
  PID:11540
- C:\Windows\System\qKqpuCJ.exe
  C:\Windows\System\qKqpuCJ.exe
  2⤵
  PID:9512
- C:\Windows\System\vVFepJI.exe
  C:\Windows\System\vVFepJI.exe
  2⤵
  PID:11832
- C:\Windows\System\XXzGBAn.exe
  C:\Windows\System\XXzGBAn.exe
  2⤵
  PID:10580
- C:\Windows\System\LwLjwTh.exe
  C:\Windows\System\LwLjwTh.exe
  2⤵
  PID:3872
- C:\Windows\System\MApGhgw.exe
  C:\Windows\System\MApGhgw.exe
  2⤵
  PID:12172
- C:\Windows\System\xojTsgZ.exe
  C:\Windows\System\xojTsgZ.exe
  2⤵
  PID:12200
- C:\Windows\System\cyKrAGS.exe
  C:\Windows\System\cyKrAGS.exe
  2⤵
  PID:11804
- C:\Windows\System\pIxbKrW.exe
  C:\Windows\System\pIxbKrW.exe
  2⤵
  PID:11828
- C:\Windows\System\zKXBTlC.exe
  C:\Windows\System\zKXBTlC.exe
  2⤵
  PID:11900
- C:\Windows\System\cwsuaqK.exe
  C:\Windows\System\cwsuaqK.exe
  2⤵
  PID:11992
- C:\Windows\System\bTdhxyX.exe
  C:\Windows\System\bTdhxyX.exe
  2⤵
  PID:12028
- C:\Windows\System\KqkAqZv.exe
  C:\Windows\System\KqkAqZv.exe
  2⤵
  PID:12068
- C:\Windows\System\WDVzQaN.exe
  C:\Windows\System\WDVzQaN.exe
  2⤵
  PID:12100
- C:\Windows\System\yVBcnSn.exe
  C:\Windows\System\yVBcnSn.exe
  2⤵
  PID:12132
- C:\Windows\System\PeRPtWt.exe
  C:\Windows\System\PeRPtWt.exe
  2⤵
  PID:12296
- C:\Windows\System\krfCfPd.exe
  C:\Windows\System\krfCfPd.exe
  2⤵
  PID:12312
- C:\Windows\System\AELQuyi.exe
  C:\Windows\System\AELQuyi.exe
  2⤵
  PID:12328
- C:\Windows\System\wSqhJjf.exe
  C:\Windows\System\wSqhJjf.exe
  2⤵
  PID:12344
- C:\Windows\System\xBCcAvH.exe
  C:\Windows\System\xBCcAvH.exe
  2⤵
  PID:12364
- C:\Windows\System\TFUBIKM.exe
  C:\Windows\System\TFUBIKM.exe
  2⤵
  PID:12392
- C:\Windows\System\fDbDXNc.exe
  C:\Windows\System\fDbDXNc.exe
  2⤵
  PID:12420
- C:\Windows\System\OxmYLyL.exe
  C:\Windows\System\OxmYLyL.exe
  2⤵
  PID:12440
- C:\Windows\System\SfjDlkr.exe
  C:\Windows\System\SfjDlkr.exe
  2⤵
  PID:12464
- C:\Windows\System\cJCnqdR.exe
  C:\Windows\System\cJCnqdR.exe
  2⤵
  PID:12484
- C:\Windows\System\znMlfJJ.exe
  C:\Windows\System\znMlfJJ.exe
  2⤵
  PID:12504
- C:\Windows\System\esrGqnr.exe
  C:\Windows\System\esrGqnr.exe
  2⤵
  PID:12524
- C:\Windows\System\NklVduW.exe
  C:\Windows\System\NklVduW.exe
  2⤵
  PID:12544
- C:\Windows\System\ZSBLqzi.exe
  C:\Windows\System\ZSBLqzi.exe
  2⤵
  PID:12564
- C:\Windows\System\AnxflLF.exe
  C:\Windows\System\AnxflLF.exe
  2⤵
  PID:12584
- C:\Windows\System\rMDHvrU.exe
  C:\Windows\System\rMDHvrU.exe
  2⤵
  PID:12604
- C:\Windows\System\YmkDjSU.exe
  C:\Windows\System\YmkDjSU.exe
  2⤵
  PID:12628
- C:\Windows\System\QcVRcNt.exe
  C:\Windows\System\QcVRcNt.exe
  2⤵
  PID:12768
- C:\Windows\System\wcnBukK.exe
  C:\Windows\System\wcnBukK.exe
  2⤵
  PID:12788
- C:\Windows\System\SPzGEAo.exe
  C:\Windows\System\SPzGEAo.exe
  2⤵
  PID:12812
- C:\Windows\System\Librwud.exe
  C:\Windows\System\Librwud.exe
  2⤵
  PID:12836
- C:\Windows\System\WTGaJCQ.exe
  C:\Windows\System\WTGaJCQ.exe
  2⤵
  PID:12852
- C:\Windows\System\TdVwMnu.exe
  C:\Windows\System\TdVwMnu.exe
  2⤵
  PID:12872
- C:\Windows\System\bHSbanq.exe
  C:\Windows\System\bHSbanq.exe
  2⤵
  PID:12888
- C:\Windows\System\zTORejP.exe
  C:\Windows\System\zTORejP.exe
  2⤵
  PID:12928
- C:\Windows\System\HAjRKra.exe
  C:\Windows\System\HAjRKra.exe
  2⤵
  PID:12944
- C:\Windows\System\LYdwaNv.exe
  C:\Windows\System\LYdwaNv.exe
  2⤵
  PID:12960
- C:\Windows\System\hTwhPSL.exe
  C:\Windows\System\hTwhPSL.exe
  2⤵
  PID:12976
- C:\Windows\System\RDpneAr.exe
  C:\Windows\System\RDpneAr.exe
  2⤵
  PID:12992
- C:\Windows\System\REUooOG.exe
  C:\Windows\System\REUooOG.exe
  2⤵
  PID:13132
- C:\Windows\System\rCPpIxE.exe
  C:\Windows\System\rCPpIxE.exe
  2⤵
  PID:13152
- C:\Windows\System\pxWenVV.exe
  C:\Windows\System\pxWenVV.exe
  2⤵
  PID:13172
- C:\Windows\System\eUhpSEG.exe
  C:\Windows\System\eUhpSEG.exe
  2⤵
  PID:13216
- C:\Windows\System\ysUIRgr.exe
  C:\Windows\System\ysUIRgr.exe
  2⤵
  PID:13244
- C:\Windows\System\cdDzVHy.exe
  C:\Windows\System\cdDzVHy.exe
  2⤵
  PID:13264
- C:\Windows\System\zoCBTfY.exe
  C:\Windows\System\zoCBTfY.exe
  2⤵
  PID:13288
- C:\Windows\System\UixUrsg.exe
  C:\Windows\System\UixUrsg.exe
  2⤵
  PID:12224
- C:\Windows\System\OnwUHhV.exe
  C:\Windows\System\OnwUHhV.exe
  2⤵
  PID:11656
- C:\Windows\System\BqyovoY.exe
  C:\Windows\System\BqyovoY.exe
  2⤵
  PID:11396
- C:\Windows\System\kxaGmTt.exe
  C:\Windows\System\kxaGmTt.exe
  2⤵
  PID:12372
- C:\Windows\System\fzBUEah.exe
  C:\Windows\System\fzBUEah.exe
  2⤵
  PID:12452
- C:\Windows\System\cVVQujU.exe
  C:\Windows\System\cVVQujU.exe
  2⤵
  PID:12844
- C:\Windows\System\ZAnKvWv.exe
  C:\Windows\System\ZAnKvWv.exe
  2⤵
  PID:13164
- C:\Windows\System\QokzhpA.exe
  C:\Windows\System\QokzhpA.exe
  2⤵
  PID:13300
- C:\Windows\System\nRUgHxE.exe
  C:\Windows\System\nRUgHxE.exe
  2⤵
  PID:9608
- C:\Windows\System\GzLbhdm.exe
  C:\Windows\System\GzLbhdm.exe
  2⤵
  PID:12244
- C:\Windows\System\ceXEnlU.exe
  C:\Windows\System\ceXEnlU.exe
  2⤵
  PID:13024
- C:\Windows\System\KxCownV.exe
  C:\Windows\System\KxCownV.exe
  2⤵
  PID:6672
- C:\Windows\System\FwxMacZ.exe
  C:\Windows\System\FwxMacZ.exe
  2⤵
  PID:12352
- C:\Windows\System\dJhRDto.exe
  C:\Windows\System\dJhRDto.exe
  2⤵
  PID:12340
- C:\Windows\System\utqeaJA.exe
  C:\Windows\System\utqeaJA.exe
  2⤵
  PID:4948
- C:\Windows\System\qZodjWT.exe
  C:\Windows\System\qZodjWT.exe
  2⤵
  PID:12264
- C:\Windows\System\SAVjFNF.exe
  C:\Windows\System\SAVjFNF.exe
  2⤵
  PID:2428
- C:\Windows\System\SZMLFnE.exe
  C:\Windows\System\SZMLFnE.exe
  2⤵
  PID:13104
- C:\Windows\System\MBIdobq.exe
  C:\Windows\System\MBIdobq.exe
  2⤵
  PID:12720
- C:\Windows\System\DIrhyej.exe
  C:\Windows\System\DIrhyej.exe
  2⤵
  PID:12532
- C:\Windows\System\zlDIEjy.exe
  C:\Windows\System\zlDIEjy.exe
  2⤵
  PID:10788
- C:\Windows\System\qCwKvQp.exe
  C:\Windows\System\qCwKvQp.exe
  2⤵
  PID:12580
- C:\Windows\System\jwcTcrC.exe
  C:\Windows\System\jwcTcrC.exe
  2⤵
  PID:12036
- C:\Windows\System\lvKNIVm.exe
  C:\Windows\System\lvKNIVm.exe
  2⤵
  PID:13076
- C:\Windows\System\GtkxhyI.exe
  C:\Windows\System\GtkxhyI.exe
  2⤵
  PID:11060
- C:\Windows\System\OFiqfXX.exe
  C:\Windows\System\OFiqfXX.exe
  2⤵
  PID:468
- C:\Windows\System\TfXBmPC.exe
  C:\Windows\System\TfXBmPC.exe
  2⤵
  PID:9824
- C:\Windows\System\GOrQoGb.exe
  C:\Windows\System\GOrQoGb.exe
  2⤵
  PID:12828
- C:\Windows\System\GNnpeur.exe
  C:\Windows\System\GNnpeur.exe
  2⤵
  PID:12664
- C:\Windows\System\ZWhGDYN.exe
  C:\Windows\System\ZWhGDYN.exe
  2⤵
  PID:13120
- C:\Windows\System\QIwVlqM.exe
  C:\Windows\System\QIwVlqM.exe
  2⤵
  PID:12324
- C:\Windows\System\OVvgRDd.exe
  C:\Windows\System\OVvgRDd.exe
  2⤵
  PID:932
- C:\Windows\System\kuTtzuJ.exe
  C:\Windows\System\kuTtzuJ.exe
  2⤵
  PID:12500
- C:\Windows\System\orQbmfZ.exe
  C:\Windows\System\orQbmfZ.exe
  2⤵
  PID:13308
- C:\Windows\System\ZEFqDNa.exe
  C:\Windows\System\ZEFqDNa.exe
  2⤵
  PID:4776
- C:\Windows\System\IisIkav.exe
  C:\Windows\System\IisIkav.exe
  2⤵
  PID:4024
- C:\Windows\System\sUWzWek.exe
  C:\Windows\System\sUWzWek.exe
  2⤵
  PID:3848
- C:\Windows\System\jEgOuzG.exe
  C:\Windows\System\jEgOuzG.exe
  2⤵
  PID:2268
- C:\Windows\System\ieTLtOX.exe
  C:\Windows\System\ieTLtOX.exe
  2⤵
  PID:4816
- C:\Windows\System\iYPNmuN.exe
  C:\Windows\System\iYPNmuN.exe
  2⤵
  PID:13324
- C:\Windows\System\GHdFHuY.exe
  C:\Windows\System\GHdFHuY.exe
  2⤵
  PID:13352
- C:\Windows\System\Hrrdvua.exe
  C:\Windows\System\Hrrdvua.exe
  2⤵
  PID:13400
- C:\Windows\System\sVZJKpi.exe
  C:\Windows\System\sVZJKpi.exe
  2⤵
  PID:13416
- C:\Windows\System\KGtutvf.exe
  C:\Windows\System\KGtutvf.exe
  2⤵
  PID:13432
- C:\Windows\System\FxunPVH.exe
  C:\Windows\System\FxunPVH.exe
  2⤵
  PID:13448
- C:\Windows\System\RplwmGK.exe
  C:\Windows\System\RplwmGK.exe
  2⤵
  PID:13464
- C:\Windows\System\tvaoite.exe
  C:\Windows\System\tvaoite.exe
  2⤵
  PID:13480
- C:\Windows\System\lyuDKob.exe
  C:\Windows\System\lyuDKob.exe
  2⤵
  PID:13544
- C:\Windows\System\qoZPpOv.exe
  C:\Windows\System\qoZPpOv.exe
  2⤵
  PID:13580
- C:\Windows\System\wonHXXR.exe
  C:\Windows\System\wonHXXR.exe
  2⤵
  PID:13596
- C:\Windows\System\FvCiqxJ.exe
  C:\Windows\System\FvCiqxJ.exe
  2⤵
  PID:13648
- C:\Windows\System\qzOalVA.exe
  C:\Windows\System\qzOalVA.exe
  2⤵
  PID:13948
- C:\Windows\System\jhatRDd.exe
  C:\Windows\System\jhatRDd.exe
  2⤵
  PID:13964
- C:\Windows\System\TNIhlhU.exe
  C:\Windows\System\TNIhlhU.exe
  2⤵
  PID:13988
- C:\Windows\System\DlMLPdY.exe
  C:\Windows\System\DlMLPdY.exe
  2⤵
  PID:14024
- C:\Windows\System\ynAkTFd.exe
  C:\Windows\System\ynAkTFd.exe
  2⤵
  PID:14040
- C:\Windows\System\wkFxBaC.exe
  C:\Windows\System\wkFxBaC.exe
  2⤵
  PID:14056
- C:\Windows\System\rvAtFZG.exe
  C:\Windows\System\rvAtFZG.exe
  2⤵
  PID:14312
- C:\Windows\System\KhSnxTE.exe
  C:\Windows\System\KhSnxTE.exe
  2⤵
  PID:5104
- C:\Windows\System\viGNNSa.exe
  C:\Windows\System\viGNNSa.exe
  2⤵
  PID:1196
- C:\Windows\System\pxclmqq.exe
  C:\Windows\System\pxclmqq.exe
  2⤵
  PID:13224
- C:\Windows\System\tkImPJW.exe
  C:\Windows\System\tkImPJW.exe
  2⤵
  PID:13720
- C:\Windows\System\aEQOpsy.exe
  C:\Windows\System\aEQOpsy.exe
  2⤵
  PID:13664
- C:\Windows\System\YaXUeBE.exe
  C:\Windows\System\YaXUeBE.exe
  2⤵
  PID:13700
- C:\Windows\System\WpVMWHE.exe
  C:\Windows\System\WpVMWHE.exe
  2⤵
  PID:13972
- C:\Windows\System\dKBwYnD.exe
  C:\Windows\System\dKBwYnD.exe
  2⤵
  PID:13728
- C:\Windows\System\oICrmii.exe
  C:\Windows\System\oICrmii.exe
  2⤵
  PID:14032
- C:\Windows\System\XsFJyJC.exe
  C:\Windows\System\XsFJyJC.exe
  2⤵
  PID:14092
- C:\Windows\System\BZsvKTv.exe
  C:\Windows\System\BZsvKTv.exe
  2⤵
  PID:13828
- C:\Windows\System\rPXsLdy.exe
  C:\Windows\System\rPXsLdy.exe
  2⤵
  PID:13908
- C:\Windows\System\JRgfjgz.exe
  C:\Windows\System\JRgfjgz.exe
  2⤵
  PID:14052
- C:\Windows\System\vokXwow.exe
  C:\Windows\System\vokXwow.exe
  2⤵
  PID:14216
- C:\Windows\System\nvocixN.exe
  C:\Windows\System\nvocixN.exe
  2⤵
  PID:13372
- C:\Windows\System\kjusGur.exe
  C:\Windows\System\kjusGur.exe
  2⤵
  PID:14144
- C:\Windows\System\NVpSqoa.exe
  C:\Windows\System\NVpSqoa.exe
  2⤵
  PID:14176
- C:\Windows\System\IaFGAOW.exe
  C:\Windows\System\IaFGAOW.exe
  2⤵
  PID:13040
- C:\Windows\System\CSfPGAS.exe
  C:\Windows\System\CSfPGAS.exe
  2⤵
  PID:876
- C:\Windows\System\gyipKlQ.exe
  C:\Windows\System\gyipKlQ.exe
  2⤵
  PID:11960
- C:\Windows\System\kfdiizV.exe
  C:\Windows\System\kfdiizV.exe
  2⤵
  PID:3196
- C:\Windows\System\fylCcYD.exe
  C:\Windows\System\fylCcYD.exe
  2⤵
  PID:13496
- C:\Windows\System\Yvkqtjt.exe
  C:\Windows\System\Yvkqtjt.exe
  2⤵
  PID:8792
- C:\Windows\System\akeTwqH.exe
  C:\Windows\System\akeTwqH.exe
  2⤵
  PID:12764
- C:\Windows\System\FpKaWsh.exe
  C:\Windows\System\FpKaWsh.exe
  2⤵
  PID:3168
- C:\Windows\System\vGlDOXP.exe
  C:\Windows\System\vGlDOXP.exe
  2⤵
  PID:7204
- C:\Windows\System\yPuwZRx.exe
  C:\Windows\System\yPuwZRx.exe
  2⤵
  PID:7876
- C:\Windows\System\SUmsbcd.exe
  C:\Windows\System\SUmsbcd.exe
  2⤵
  PID:3920
- C:\Windows\System\iWVonOF.exe
  C:\Windows\System\iWVonOF.exe
  2⤵
  PID:7424
- C:\Windows\System\JoYhagT.exe
  C:\Windows\System\JoYhagT.exe
  2⤵
  PID:7516
- C:\Windows\System\gFMtYwm.exe
  C:\Windows\System\gFMtYwm.exe
  2⤵
  PID:7692
- C:\Windows\System\KGcEnVC.exe
  C:\Windows\System\KGcEnVC.exe
  2⤵
  PID:6652
- C:\Windows\System\pnHxAys.exe
  C:\Windows\System\pnHxAys.exe
  2⤵
  PID:7712
- C:\Windows\System\ozAdkJx.exe
  C:\Windows\System\ozAdkJx.exe
  2⤵
  PID:8328
- C:\Windows\System\sIeiQfg.exe
  C:\Windows\System\sIeiQfg.exe
  2⤵
  PID:4404
- C:\Windows\System\XpfFKah.exe
  C:\Windows\System\XpfFKah.exe
  2⤵
  PID:7348
- C:\Windows\System\gZWlMOh.exe
  C:\Windows\System\gZWlMOh.exe
  2⤵
  PID:8224
- C:\Windows\System\PMxzppS.exe
  C:\Windows\System\PMxzppS.exe
  2⤵
  PID:13424
- C:\Windows\System\fvAjosG.exe
  C:\Windows\System\fvAjosG.exe
  2⤵
  PID:1384
- C:\Windows\System\UtzDCGX.exe
  C:\Windows\System\UtzDCGX.exe
  2⤵
  PID:12052
- C:\Windows\System\ejMfRPB.exe
  C:\Windows\System\ejMfRPB.exe
  2⤵
  PID:12336
- C:\Windows\System\xlGSNNM.exe
  C:\Windows\System\xlGSNNM.exe
  2⤵
  PID:13768
- C:\Windows\System\HoYGVIl.exe
  C:\Windows\System\HoYGVIl.exe
  2⤵
  PID:13536
- C:\Windows\System\zmmYcPB.exe
  C:\Windows\System\zmmYcPB.exe
  2⤵
  PID:3248
- C:\Windows\System\uWGlvHN.exe
  C:\Windows\System\uWGlvHN.exe
  2⤵
  PID:2692
- C:\Windows\System\EhHmxRt.exe
  C:\Windows\System\EhHmxRt.exe
  2⤵
  PID:1020
- C:\Windows\System\ACKVnyZ.exe
  C:\Windows\System\ACKVnyZ.exe
  2⤵
  PID:2396
- C:\Windows\System\FtCmbhc.exe
  C:\Windows\System\FtCmbhc.exe
  2⤵
  PID:1984
- C:\Windows\System\EdZeEQT.exe
  C:\Windows\System\EdZeEQT.exe
  2⤵
  PID:13780
- C:\Windows\System\KwwTlGp.exe
  C:\Windows\System\KwwTlGp.exe
  2⤵
  PID:12356
- C:\Windows\System\WBchSsu.exe
  C:\Windows\System\WBchSsu.exe
  2⤵
  PID:13800
- C:\Windows\System\bwpCOQh.exe
  C:\Windows\System\bwpCOQh.exe
  2⤵
  PID:13872
- C:\Windows\System\htBzXRg.exe
  C:\Windows\System\htBzXRg.exe
  2⤵
  PID:13028
- C:\Windows\System\GCNwQBT.exe
  C:\Windows\System\GCNwQBT.exe
  2⤵
  PID:628
- C:\Windows\System\TKTRlcK.exe
  C:\Windows\System\TKTRlcK.exe
  2⤵
  PID:5744
- C:\Windows\System\GlTkqHK.exe
  C:\Windows\System\GlTkqHK.exe
  2⤵
  PID:13604
- C:\Windows\System\uRVztOG.exe
  C:\Windows\System\uRVztOG.exe
  2⤵
  PID:4636
- C:\Windows\System\UJnZNiD.exe
  C:\Windows\System\UJnZNiD.exe
  2⤵
  PID:14088
- C:\Windows\System\fBwsVPu.exe
  C:\Windows\System\fBwsVPu.exe
  2⤵
  PID:14068
- C:\Windows\System\eAXLdrm.exe
  C:\Windows\System\eAXLdrm.exe
  2⤵
  PID:14284
- C:\Windows\System\qhEMmLd.exe
  C:\Windows\System\qhEMmLd.exe
  2⤵
  PID:14208
- C:\Windows\System\PKuDxJw.exe
  C:\Windows\System\PKuDxJw.exe
  2⤵
  PID:13928
- C:\Windows\System\rDGflZs.exe
  C:\Windows\System\rDGflZs.exe
  2⤵
  PID:8068
- C:\Windows\System\lzYAigJ.exe
  C:\Windows\System\lzYAigJ.exe
  2⤵
  PID:7468
- C:\Windows\System\DqkXJyb.exe
  C:\Windows\System\DqkXJyb.exe
  2⤵
  PID:7524
- C:\Windows\System\Pynbbaa.exe
  C:\Windows\System\Pynbbaa.exe
  2⤵
  PID:12376
- C:\Windows\System\rEnPHil.exe
  C:\Windows\System\rEnPHil.exe
  2⤵
  PID:60
- C:\Windows\System\tpMARfz.exe
  C:\Windows\System\tpMARfz.exe
  2⤵
  PID:7732
- C:\Windows\System\xlPHAUX.exe
  C:\Windows\System\xlPHAUX.exe
  2⤵
  PID:5224
- C:\Windows\System\EzOEcBM.exe
  C:\Windows\System\EzOEcBM.exe
  2⤵
  PID:4584
- C:\Windows\System\echrXtX.exe
  C:\Windows\System\echrXtX.exe
  2⤵
  PID:3608
- C:\Windows\System\UnEllJd.exe
  C:\Windows\System\UnEllJd.exe
  2⤵
  PID:2164
- C:\Windows\System\ZYvCCQd.exe
  C:\Windows\System\ZYvCCQd.exe
  2⤵
  PID:3980
- C:\Windows\System\COLJYbJ.exe
  C:\Windows\System\COLJYbJ.exe
  2⤵
  PID:5292
- C:\Windows\System\cwyZxFC.exe
  C:\Windows\System\cwyZxFC.exe
  2⤵
  PID:7344
- C:\Windows\System\noCqjKX.exe
  C:\Windows\System\noCqjKX.exe
  2⤵
  PID:744
- C:\Windows\System\NZUwJKX.exe
  C:\Windows\System\NZUwJKX.exe
  2⤵
  PID:13776
- C:\Windows\System\uhohtHH.exe
  C:\Windows\System\uhohtHH.exe
  2⤵
  PID:4928
- C:\Windows\System\torLsIB.exe
  C:\Windows\System\torLsIB.exe
  2⤵
  PID:7352
- C:\Windows\System\JXCefGG.exe
  C:\Windows\System\JXCefGG.exe
  2⤵
  PID:5220
- C:\Windows\System\OaqONwt.exe
  C:\Windows\System\OaqONwt.exe
  2⤵
  PID:5544
- C:\Windows\System\DUfgeYi.exe
  C:\Windows\System\DUfgeYi.exe
  2⤵
  PID:5332
- C:\Windows\System\kASorjX.exe
  C:\Windows\System\kASorjX.exe
  2⤵
  PID:2124
- C:\Windows\System\IpciFEO.exe
  C:\Windows\System\IpciFEO.exe
  2⤵
  PID:5664
- C:\Windows\System\qydDnPy.exe
  C:\Windows\System\qydDnPy.exe
  2⤵
  PID:4640
- C:\Windows\System\rOqPkLj.exe
  C:\Windows\System\rOqPkLj.exe
  2⤵
  PID:1800
- C:\Windows\System\rfbpKNO.exe
  C:\Windows\System\rfbpKNO.exe
  2⤵
  PID:4392
- C:\Windows\System\ncmNGon.exe
  C:\Windows\System\ncmNGon.exe
  2⤵
  PID:4828
- C:\Windows\System\kqjyXGq.exe
  C:\Windows\System\kqjyXGq.exe
  2⤵
  PID:5524
- C:\Windows\System\NXPhgSA.exe
  C:\Windows\System\NXPhgSA.exe
  2⤵
  PID:5916
- C:\Windows\System\qCdRxIg.exe
  C:\Windows\System\qCdRxIg.exe
  2⤵
  PID:13296
- C:\Windows\System\exqagFH.exe
  C:\Windows\System\exqagFH.exe
  2⤵
  PID:14004
- C:\Windows\System\xlmKTTx.exe
  C:\Windows\System\xlmKTTx.exe
  2⤵
  PID:2728
- C:\Windows\System\hNmVXdr.exe
  C:\Windows\System\hNmVXdr.exe
  2⤵
  PID:13820
- C:\Windows\System\EMMiWnf.exe
  C:\Windows\System\EMMiWnf.exe
  2⤵
  PID:7496
- C:\Windows\System\ItttTNM.exe
  C:\Windows\System\ItttTNM.exe
  2⤵
  PID:14156
- C:\Windows\System\qrtjNvG.exe
  C:\Windows\System\qrtjNvG.exe
  2⤵
  PID:5172
- C:\Windows\System\CHlITKw.exe
  C:\Windows\System\CHlITKw.exe
  2⤵
  PID:7228
- C:\Windows\System\UyqJOTd.exe
  C:\Windows\System\UyqJOTd.exe
  2⤵
  PID:3456
- C:\Windows\System\VLXcFVh.exe
  C:\Windows\System\VLXcFVh.exe
  2⤵
  PID:13844
- C:\Windows\System\LrViGNh.exe
  C:\Windows\System\LrViGNh.exe
  2⤵
  PID:3252
- C:\Windows\System\VUaHERm.exe
  C:\Windows\System\VUaHERm.exe
  2⤵
  PID:6908
- C:\Windows\System\IojKhpa.exe
  C:\Windows\System\IojKhpa.exe
  2⤵
  PID:6088
- C:\Windows\System\dyZmOHx.exe
  C:\Windows\System\dyZmOHx.exe
  2⤵
  PID:6208
- C:\Windows\System\fcikpRZ.exe
  C:\Windows\System\fcikpRZ.exe
  2⤵
  PID:6240
- C:\Windows\System\aJyLIiQ.exe
  C:\Windows\System\aJyLIiQ.exe
  2⤵
  PID:4104
- C:\Windows\System\lNyMIqv.exe
  C:\Windows\System\lNyMIqv.exe
  2⤵
  PID:2388
- C:\Windows\System\NnaDFSO.exe
  C:\Windows\System\NnaDFSO.exe
  2⤵
  PID:6700
- C:\Windows\System\fBXlOfM.exe
  C:\Windows\System\fBXlOfM.exe
  2⤵
  PID:1868
- C:\Windows\System\UbGsKnw.exe
  C:\Windows\System\UbGsKnw.exe
  2⤵
  PID:2244
- C:\Windows\System\HTNXGBA.exe
  C:\Windows\System\HTNXGBA.exe
  2⤵
  PID:13644
- C:\Windows\System\wBuCcJn.exe
  C:\Windows\System\wBuCcJn.exe
  2⤵
  PID:5880
- C:\Windows\System\UySUyMj.exe
  C:\Windows\System\UySUyMj.exe
  2⤵
  PID:5420
- C:\Windows\System\AJiERxD.exe
  C:\Windows\System\AJiERxD.exe
  2⤵
  PID:3372
- C:\Windows\System\GQWABMh.exe
  C:\Windows\System\GQWABMh.exe
  2⤵
  PID:3444
- C:\Windows\System\MDmNCGD.exe
  C:\Windows\System\MDmNCGD.exe
  2⤵
  PID:4240
- C:\Windows\System\pZqZNCn.exe
  C:\Windows\System\pZqZNCn.exe
  2⤵
  PID:5160
- C:\Windows\System\OnwYvKz.exe
  C:\Windows\System\OnwYvKz.exe
  2⤵
  PID:8236
- C:\Windows\System\qSGFuUi.exe
  C:\Windows\System\qSGFuUi.exe
  2⤵
  PID:14196
- C:\Windows\System\LSRBYnn.exe
  C:\Windows\System\LSRBYnn.exe
  2⤵
  PID:6760
- C:\Windows\System\nAVvqMu.exe
  C:\Windows\System\nAVvqMu.exe
  2⤵
  PID:6376
- C:\Windows\System\kaKjavl.exe
  C:\Windows\System\kaKjavl.exe
  2⤵
  PID:6676
- C:\Windows\System\kNghmDV.exe
  C:\Windows\System\kNghmDV.exe
  2⤵
  PID:9188
- C:\Windows\System\tgsLabQ.exe
  C:\Windows\System\tgsLabQ.exe
  2⤵
  PID:6940
- C:\Windows\System\cJQkJIf.exe
  C:\Windows\System\cJQkJIf.exe
  2⤵
  PID:5240
- C:\Windows\System\SzIycCN.exe
  C:\Windows\System\SzIycCN.exe
  2⤵
  PID:8524
- C:\Windows\System\IMloWYz.exe
  C:\Windows\System\IMloWYz.exe
  2⤵
  PID:8752
- C:\Windows\System\IRUbIkQ.exe
  C:\Windows\System\IRUbIkQ.exe
  2⤵
  PID:8732
- C:\Windows\System\eioBVzO.exe
  C:\Windows\System\eioBVzO.exe
  2⤵
  PID:8468
- C:\Windows\System\fwPjeoc.exe
  C:\Windows\System\fwPjeoc.exe
  2⤵
  PID:8584
- C:\Windows\System\MQrWYrD.exe
  C:\Windows\System\MQrWYrD.exe
  2⤵
  PID:8588
- C:\Windows\System\AnOnEME.exe
  C:\Windows\System\AnOnEME.exe
  2⤵
  PID:13680
- C:\Windows\System\ljSLvGR.exe
  C:\Windows\System\ljSLvGR.exe
  2⤵
  PID:2620
- C:\Windows\System\QIetdwU.exe
  C:\Windows\System\QIetdwU.exe
  2⤵
  PID:6252
- C:\Windows\System\rfNBjWf.exe
  C:\Windows\System\rfNBjWf.exe
  2⤵
  PID:7140
- C:\Windows\System\lXAjaGg.exe
  C:\Windows\System\lXAjaGg.exe
  2⤵
  PID:8392
- C:\Windows\System\BgBNgTj.exe
  C:\Windows\System\BgBNgTj.exe
  2⤵
  PID:6996
- C:\Windows\System\QZIEIMJ.exe
  C:\Windows\System\QZIEIMJ.exe
  2⤵
  PID:9172
- C:\Windows\System\FuhGYvi.exe
  C:\Windows\System\FuhGYvi.exe
  2⤵
  PID:9184
- C:\Windows\System\DBZwuAn.exe
  C:\Windows\System\DBZwuAn.exe
  2⤵
  PID:6008
- C:\Windows\System\kGNHvGc.exe
  C:\Windows\System\kGNHvGc.exe
  2⤵
  PID:5984
- C:\Windows\System\goXzVwH.exe
  C:\Windows\System\goXzVwH.exe
  2⤵
  PID:9208
- C:\Windows\System\UxtqJaM.exe
  C:\Windows\System\UxtqJaM.exe
  2⤵
  PID:5440
- C:\Windows\System\zcyRoVv.exe
  C:\Windows\System\zcyRoVv.exe
  2⤵
  PID:6344
- C:\Windows\System\wWLjLVr.exe
  C:\Windows\System\wWLjLVr.exe
  2⤵
  PID:8572
- C:\Windows\System\moHcrrf.exe
  C:\Windows\System\moHcrrf.exe
  2⤵
  PID:7368
- C:\Windows\System\jZHtXTP.exe
  C:\Windows\System\jZHtXTP.exe
  2⤵
  PID:4600
- C:\Windows\System\UYyZlzU.exe
  C:\Windows\System\UYyZlzU.exe
  2⤵
  PID:5808
- C:\Windows\System\HwsSpRq.exe
  C:\Windows\System\HwsSpRq.exe
  2⤵
  PID:8044
- C:\Windows\System\kolZrFk.exe
  C:\Windows\System\kolZrFk.exe
  2⤵
  PID:7576
- C:\Windows\System\ATfxtHS.exe
  C:\Windows\System\ATfxtHS.exe
  2⤵
  PID:14020
- C:\Windows\System\LdPDFPW.exe
  C:\Windows\System\LdPDFPW.exe
  2⤵
  PID:11572
- C:\Windows\System\LtIbRvM.exe
  C:\Windows\System\LtIbRvM.exe
  2⤵
  PID:3660
- C:\Windows\System\LGqJIHP.exe
  C:\Windows\System\LGqJIHP.exe
  2⤵
  PID:14100
- C:\Windows\System\ZNdXcIB.exe
  C:\Windows\System\ZNdXcIB.exe
  2⤵
  PID:3368
- C:\Windows\System\PqZWgiu.exe
  C:\Windows\System\PqZWgiu.exe
  2⤵
  PID:6496
- C:\Windows\System\CFbToOL.exe
  C:\Windows\System\CFbToOL.exe
  2⤵
  PID:6856
- C:\Windows\System\rqEvZNn.exe
  C:\Windows\System\rqEvZNn.exe
  2⤵
  PID:6432
- C:\Windows\System\nMTczfs.exe
  C:\Windows\System\nMTczfs.exe
  2⤵
  PID:216
- C:\Windows\System\cZpqbiw.exe
  C:\Windows\System\cZpqbiw.exe
  2⤵
  PID:5368
- C:\Windows\System\BHcyTwT.exe
  C:\Windows\System\BHcyTwT.exe
  2⤵
  PID:13088
- C:\Windows\System\KrmiTXx.exe
  C:\Windows\System\KrmiTXx.exe
  2⤵
  PID:13824
- C:\Windows\System\iiHGQHP.exe
  C:\Windows\System\iiHGQHP.exe
  2⤵
  PID:2488
- C:\Windows\System\CiErsbW.exe
  C:\Windows\System\CiErsbW.exe
  2⤵
  PID:6580
- C:\Windows\System\utYvsRH.exe
  C:\Windows\System\utYvsRH.exe
  2⤵
  PID:6772
- C:\Windows\System\FPVlSKV.exe
  C:\Windows\System\FPVlSKV.exe
  2⤵
  PID:13740
- C:\Windows\System\yNKTMcD.exe
  C:\Windows\System\yNKTMcD.exe
  2⤵
  PID:8692
- C:\Windows\System\oGJuXmg.exe
  C:\Windows\System\oGJuXmg.exe
  2⤵
  PID:2872
- C:\Windows\System\mWjLdPQ.exe
  C:\Windows\System\mWjLdPQ.exe
  2⤵
  PID:7388
- C:\Windows\System\pntnRGc.exe
  C:\Windows\System\pntnRGc.exe
  2⤵
  PID:7060
- C:\Windows\System\mOCqEcx.exe
  C:\Windows\System\mOCqEcx.exe
  2⤵
  PID:2992
- C:\Windows\System\wSTFxIS.exe
  C:\Windows\System\wSTFxIS.exe
  2⤵
  PID:5856
- C:\Windows\System\KAIbzdr.exe
  C:\Windows\System\KAIbzdr.exe
  2⤵
  PID:6712
- C:\Windows\System\WNMFcfp.exe
  C:\Windows\System\WNMFcfp.exe
  2⤵
  PID:8096
- C:\Windows\System\yoKxzID.exe
  C:\Windows\System\yoKxzID.exe
  2⤵
  PID:8740
- C:\Windows\System\WRLThAL.exe
  C:\Windows\System\WRLThAL.exe
  2⤵
  PID:7620
- C:\Windows\System\ingptdU.exe
  C:\Windows\System\ingptdU.exe
  2⤵
  PID:7024
- C:\Windows\System\vYtTkfl.exe
  C:\Windows\System\vYtTkfl.exe
  2⤵
  PID:6596
- C:\Windows\System\HZqhyyG.exe
  C:\Windows\System\HZqhyyG.exe
  2⤵
  PID:14320
- C:\Windows\System\pIUwVDO.exe
  C:\Windows\System\pIUwVDO.exe
  2⤵
  PID:6268
- C:\Windows\System\klYgSUK.exe
  C:\Windows\System\klYgSUK.exe
  2⤵
  PID:9292
- C:\Windows\System\VXeiKLP.exe
  C:\Windows\System\VXeiKLP.exe
  2⤵
  PID:10072
- C:\Windows\System\htCXBor.exe
  C:\Windows\System\htCXBor.exe
  2⤵
  PID:7444
- C:\Windows\System\YceFlIr.exe
  C:\Windows\System\YceFlIr.exe
  2⤵
  PID:9304
- C:\Windows\System\VSNVPiP.exe
  C:\Windows\System\VSNVPiP.exe
  2⤵
  PID:7800
- C:\Windows\System\jAGCSkY.exe
  C:\Windows\System\jAGCSkY.exe
  2⤵
  PID:8176
- C:\Windows\System\gOjqfin.exe
  C:\Windows\System\gOjqfin.exe
  2⤵
  PID:8672
- C:\Windows\System\uSnDmdR.exe
  C:\Windows\System\uSnDmdR.exe
  2⤵
  PID:9964
- C:\Windows\System\ufdMzKY.exe
  C:\Windows\System\ufdMzKY.exe
  2⤵
  PID:3284
- C:\Windows\System\wPVnYfs.exe
  C:\Windows\System\wPVnYfs.exe
  2⤵
  PID:8660
- C:\Windows\System\ZDMrTmi.exe
  C:\Windows\System\ZDMrTmi.exe
  2⤵
  PID:8768
- C:\Windows\System\yJNPMrq.exe
  C:\Windows\System\yJNPMrq.exe
  2⤵
  PID:6576
- C:\Windows\System\JXkBInr.exe
  C:\Windows\System\JXkBInr.exe
  2⤵
  PID:5700
- C:\Windows\System\ogzSAwi.exe
  C:\Windows\System\ogzSAwi.exe
  2⤵
  PID:9720
- C:\Windows\System\dLbPXPq.exe
  C:\Windows\System\dLbPXPq.exe
  2⤵
  PID:6508
- C:\Windows\System\tulICLF.exe
  C:\Windows\System\tulICLF.exe
  2⤵
  PID:8228
- C:\Windows\System\dAvsZOt.exe
  C:\Windows\System\dAvsZOt.exe
  2⤵
  PID:7100
- C:\Windows\System\XmREzMX.exe
  C:\Windows\System\XmREzMX.exe
  2⤵
  PID:8488
- C:\Windows\System\eEQlXWa.exe
  C:\Windows\System\eEQlXWa.exe
  2⤵
  PID:9808
- C:\Windows\System\RjoeFZB.exe
  C:\Windows\System\RjoeFZB.exe
  2⤵
  PID:9192
- C:\Windows\System\wdyRUoA.exe
  C:\Windows\System\wdyRUoA.exe
  2⤵
  PID:8592
- C:\Windows\System\xsikUXd.exe
  C:\Windows\System\xsikUXd.exe
  2⤵
  PID:8856
- C:\Windows\System\pyRAYRc.exe
  C:\Windows\System\pyRAYRc.exe
  2⤵
  PID:4536
- C:\Windows\System\jcndkJH.exe
  C:\Windows\System\jcndkJH.exe
  2⤵
  PID:8452
- C:\Windows\System\UmXnSQc.exe
  C:\Windows\System\UmXnSQc.exe
  2⤵
  PID:8688
- C:\Windows\System\YXLbZqv.exe
  C:\Windows\System\YXLbZqv.exe
  2⤵
  PID:7212
- C:\Windows\System\xEBhlvG.exe
  C:\Windows\System\xEBhlvG.exe
  2⤵
  PID:10140
- C:\Windows\System\raZulzm.exe
  C:\Windows\System\raZulzm.exe
  2⤵
  PID:8528
- C:\Windows\System\eFwIQHC.exe
  C:\Windows\System\eFwIQHC.exe
  2⤵
  PID:9024
- C:\Windows\System\FYWVzeS.exe
  C:\Windows\System\FYWVzeS.exe
  2⤵
  PID:8812
- C:\Windows\System\yWRlufK.exe
  C:\Windows\System\yWRlufK.exe
  2⤵
  PID:13512
- C:\Windows\System\AncGdjz.exe
  C:\Windows\System\AncGdjz.exe
  2⤵
  PID:8456
- C:\Windows\System\jgABFSk.exe
  C:\Windows\System\jgABFSk.exe
  2⤵
  PID:7324
- C:\Windows\System\JXOkirA.exe
  C:\Windows\System\JXOkirA.exe
  2⤵
  PID:7008
- C:\Windows\System\UVcttAd.exe
  C:\Windows\System\UVcttAd.exe
  2⤵
  PID:8896
- C:\Windows\System\QCYejVi.exe
  C:\Windows\System\QCYejVi.exe
  2⤵
  PID:9912
- C:\Windows\System\RfQGqBe.exe
  C:\Windows\System\RfQGqBe.exe
  2⤵
  PID:8504
- C:\Windows\System\kSAAHmV.exe
  C:\Windows\System\kSAAHmV.exe
  2⤵
  PID:13732
- C:\Windows\System\UJIRFfQ.exe
  C:\Windows\System\UJIRFfQ.exe
  2⤵
  PID:10108
- C:\Windows\System\IJxySXy.exe
  C:\Windows\System\IJxySXy.exe
  2⤵
  PID:9036
- C:\Windows\System\IvIesMh.exe
  C:\Windows\System\IvIesMh.exe
  2⤵
  PID:6904
- C:\Windows\System\iWYEPdl.exe
  C:\Windows\System\iWYEPdl.exe
  2⤵
  PID:9560
- C:\Windows\System\yhdYkrz.exe
  C:\Windows\System\yhdYkrz.exe
  2⤵
  PID:8876
- C:\Windows\System\kbsiSAm.exe
  C:\Windows\System\kbsiSAm.exe
  2⤵
  PID:9224
- C:\Windows\System\VJmekuH.exe
  C:\Windows\System\VJmekuH.exe
  2⤵
  PID:14356
- C:\Windows\System\njGcSLQ.exe
  C:\Windows\System\njGcSLQ.exe
  2⤵
  PID:14596
- C:\Windows\System\sJJfyhF.exe
  C:\Windows\System\sJJfyhF.exe
  2⤵
  PID:14612
- C:\Windows\System\ncuNGew.exe
  C:\Windows\System\ncuNGew.exe
  2⤵
  PID:14636
- C:\Windows\System\YgHwVcu.exe
  C:\Windows\System\YgHwVcu.exe
  2⤵
  PID:14652
- C:\Windows\System\LwOaUWx.exe
  C:\Windows\System\LwOaUWx.exe
  2⤵
  PID:14672
- C:\Windows\System\tvOdxdU.exe
  C:\Windows\System\tvOdxdU.exe
  2⤵
  PID:14692
- C:\Windows\System\IWKqTvP.exe
  C:\Windows\System\IWKqTvP.exe
  2⤵
  PID:14712
- C:\Windows\System\UeIQdTt.exe
  C:\Windows\System\UeIQdTt.exe
  2⤵
  PID:14732
- C:\Windows\System\csGvYEz.exe
  C:\Windows\System\csGvYEz.exe
  2⤵
  PID:14752
- C:\Windows\System\GBWisNr.exe
  C:\Windows\System\GBWisNr.exe
  2⤵
  PID:14768
- C:\Windows\System\QnWBduQ.exe
  C:\Windows\System\QnWBduQ.exe
  2⤵
  PID:14788
- C:\Windows\System\WXeynww.exe
  C:\Windows\System\WXeynww.exe
  2⤵
  PID:14804
- C:\Windows\System\btplfCf.exe
  C:\Windows\System\btplfCf.exe
  2⤵
  PID:14824
- C:\Windows\System\BkRoaoF.exe
  C:\Windows\System\BkRoaoF.exe
  2⤵
  PID:14844
- C:\Windows\System\pgolksp.exe
  C:\Windows\System\pgolksp.exe
  2⤵
  PID:14864
- C:\Windows\System\lSSqcKt.exe
  C:\Windows\System\lSSqcKt.exe
  2⤵
  PID:14884
- C:\Windows\System\rrkXtPO.exe
  C:\Windows\System\rrkXtPO.exe
  2⤵
  PID:14908
- C:\Windows\System\vMSZkcY.exe
  C:\Windows\System\vMSZkcY.exe
  2⤵
  PID:14932
- C:\Windows\System\kCKmQrl.exe
  C:\Windows\System\kCKmQrl.exe
  2⤵
  PID:14952
- C:\Windows\System\KPngVXk.exe
  C:\Windows\System\KPngVXk.exe
  2⤵
  PID:14972
- C:\Windows\System\dUiuFoc.exe
  C:\Windows\System\dUiuFoc.exe
  2⤵
  PID:14992
- C:\Windows\System\pjHhGHf.exe
  C:\Windows\System\pjHhGHf.exe
  2⤵
  PID:15016
- C:\Windows\System\kBrJPKl.exe
  C:\Windows\System\kBrJPKl.exe
  2⤵
  PID:15036
- C:\Windows\System\eLAmhcV.exe
  C:\Windows\System\eLAmhcV.exe
  2⤵
  PID:15060
- C:\Windows\System\edjebiW.exe
  C:\Windows\System\edjebiW.exe
  2⤵
  PID:15080
- C:\Windows\System\ayFtAdL.exe
  C:\Windows\System\ayFtAdL.exe
  2⤵
  PID:15100
- C:\Windows\System\wWsOKHr.exe
  C:\Windows\System\wWsOKHr.exe
  2⤵
  PID:15124
- C:\Windows\System\lNahYMf.exe
  C:\Windows\System\lNahYMf.exe
  2⤵
  PID:15148
- C:\Windows\System\EAGnBZZ.exe
  C:\Windows\System\EAGnBZZ.exe
  2⤵
  PID:15164
- C:\Windows\System\axtrrJZ.exe
  C:\Windows\System\axtrrJZ.exe
  2⤵
  PID:15184
- C:\Windows\System\AMeIScY.exe
  C:\Windows\System\AMeIScY.exe
  2⤵
  PID:15208
- C:\Windows\System\GCQMjMR.exe
  C:\Windows\System\GCQMjMR.exe
  2⤵
  PID:15232
- C:\Windows\System\QgouddT.exe
  C:\Windows\System\QgouddT.exe
  2⤵
  PID:15256
- C:\Windows\System\MLHYbni.exe
  C:\Windows\System\MLHYbni.exe
  2⤵
  PID:15276
- C:\Windows\System\cHrjcjA.exe
  C:\Windows\System\cHrjcjA.exe
  2⤵
  PID:15296
- C:\Windows\System\NxIxJPP.exe
  C:\Windows\System\NxIxJPP.exe
  2⤵
  PID:15324
- C:\Windows\System\kpuLRMr.exe
  C:\Windows\System\kpuLRMr.exe
  2⤵
  PID:15344
- C:\Windows\System\lJQZmso.exe
  C:\Windows\System\lJQZmso.exe
  2⤵
  PID:9428
- C:\Windows\System\QbpEdDN.exe
  C:\Windows\System\QbpEdDN.exe
  2⤵
  PID:9932
- C:\Windows\System\oYZrYRF.exe
  C:\Windows\System\oYZrYRF.exe
  2⤵
  PID:9960
- C:\Windows\System\abBdyEj.exe
  C:\Windows\System\abBdyEj.exe
  2⤵
  PID:5852
- C:\Windows\System\oPQNAWX.exe
  C:\Windows\System\oPQNAWX.exe
  2⤵
  PID:10392
- C:\Windows\System\kJsQbpL.exe
  C:\Windows\System\kJsQbpL.exe
  2⤵
  PID:6828
- C:\Windows\System\XBeESEn.exe
  C:\Windows\System\XBeESEn.exe
  2⤵
  PID:7844
- C:\Windows\System\qjBCtLY.exe
  C:\Windows\System\qjBCtLY.exe
  2⤵
  PID:8728
- C:\Windows\System\iuGUHfI.exe
  C:\Windows\System\iuGUHfI.exe
  2⤵
  PID:3416
- C:\Windows\System\bAZQPnk.exe
  C:\Windows\System\bAZQPnk.exe
  2⤵
  PID:8848
- C:\Windows\System\zBfLpqi.exe
  C:\Windows\System\zBfLpqi.exe
  2⤵
  PID:5508
- C:\Windows\System\Rmqblbd.exe
  C:\Windows\System\Rmqblbd.exe
  2⤵
  PID:7776
- C:\Windows\System\WWGoCOL.exe
  C:\Windows\System\WWGoCOL.exe
  2⤵
  PID:8788
- C:\Windows\System\lgBBoHn.exe
  C:\Windows\System\lgBBoHn.exe
  2⤵
  PID:9104
- C:\Windows\System\bliiPoR.exe
  C:\Windows\System\bliiPoR.exe
  2⤵
  PID:14488
- C:\Windows\System\hrWCGoq.exe
  C:\Windows\System\hrWCGoq.exe
  2⤵
  PID:9616
- C:\Windows\System\IjlyXwS.exe
  C:\Windows\System\IjlyXwS.exe
  2⤵
  PID:6568
- C:\Windows\System\AnPIjLy.exe
  C:\Windows\System\AnPIjLy.exe
  2⤵
  PID:8772
- C:\Windows\System\gaipTXZ.exe
  C:\Windows\System\gaipTXZ.exe
  2⤵
  PID:10680
- C:\Windows\System\dZnczLe.exe
  C:\Windows\System\dZnczLe.exe
  2⤵
  PID:11136
- C:\Windows\System\ZnJKepY.exe
  C:\Windows\System\ZnJKepY.exe
  2⤵
  PID:14648
- C:\Windows\System\MBUUBTD.exe
  C:\Windows\System\MBUUBTD.exe
  2⤵
  PID:2424
- C:\Windows\System\XVSVqPm.exe
  C:\Windows\System\XVSVqPm.exe
  2⤵
  PID:10712
- C:\Windows\System\jMGXVYo.exe
  C:\Windows\System\jMGXVYo.exe
  2⤵
  PID:8624
- C:\Windows\System\ddcIfNt.exe
  C:\Windows\System\ddcIfNt.exe
  2⤵
  PID:10748
- C:\Windows\System\oAoEfkr.exe
  C:\Windows\System\oAoEfkr.exe
  2⤵
  PID:10196
- C:\Windows\System\jpjEFRf.exe
  C:\Windows\System\jpjEFRf.exe
  2⤵
  PID:10172
- C:\Windows\System\IznyYFn.exe
  C:\Windows\System\IznyYFn.exe
  2⤵
  PID:7124
- C:\Windows\System\weBybrj.exe
  C:\Windows\System\weBybrj.exe
  2⤵
  PID:9356
- C:\Windows\System\dHoiJRb.exe
  C:\Windows\System\dHoiJRb.exe
  2⤵
  PID:15096
- C:\Windows\System\DDjaMMQ.exe
  C:\Windows\System\DDjaMMQ.exe
  2⤵
  PID:8268
- C:\Windows\System\HmjCSGh.exe
  C:\Windows\System\HmjCSGh.exe
  2⤵
  PID:14680
- C:\Windows\System\MbbcZQL.exe
  C:\Windows\System\MbbcZQL.exe
  2⤵
  PID:14376
- C:\Windows\System\PqHLshE.exe
  C:\Windows\System\PqHLshE.exe
  2⤵
  PID:8824
- C:\Windows\System\ATfDdgX.exe
  C:\Windows\System\ATfDdgX.exe
  2⤵
  PID:14928
- C:\Windows\System\wVkxhPB.exe
  C:\Windows\System\wVkxhPB.exe
  2⤵
  PID:6276
- C:\Windows\System\PxAcsjb.exe
  C:\Windows\System\PxAcsjb.exe
  2⤵
  PID:15140
- C:\Windows\System\fFhcVAn.exe
  C:\Windows\System\fFhcVAn.exe
  2⤵
  PID:15240
- C:\Windows\System\xOieYZp.exe
  C:\Windows\System\xOieYZp.exe
  2⤵
  PID:14580
- C:\Windows\System\WKlfhdG.exe
  C:\Windows\System\WKlfhdG.exe
  2⤵
  PID:14724
- C:\Windows\System\kcYDLay.exe
  C:\Windows\System\kcYDLay.exe
  2⤵
  PID:14412
- C:\Windows\System\jEDUCOD.exe
  C:\Windows\System\jEDUCOD.exe
  2⤵
  PID:8332
- C:\Windows\System\rvPMPyY.exe
  C:\Windows\System\rvPMPyY.exe
  2⤵
  PID:9796
- C:\Windows\System\vGpvUoT.exe
  C:\Windows\System\vGpvUoT.exe
  2⤵
  PID:14924
- C:\Windows\System\pkQvBFT.exe
  C:\Windows\System\pkQvBFT.exe
  2⤵
  PID:10800
- C:\Windows\System\YKumgPt.exe
  C:\Windows\System\YKumgPt.exe
  2⤵
  PID:14964
- C:\Windows\System\wCspLMp.exe
  C:\Windows\System\wCspLMp.exe
  2⤵
  PID:15400
- C:\Windows\System\sHGNsNO.exe
  C:\Windows\System\sHGNsNO.exe
  2⤵
  PID:15428
- C:\Windows\System\tBSTxjX.exe
  C:\Windows\System\tBSTxjX.exe
  2⤵
  PID:15576
- C:\Windows\System\VFLLASG.exe
  C:\Windows\System\VFLLASG.exe
  2⤵
  PID:15592
- C:\Windows\System\oAeiyBg.exe
  C:\Windows\System\oAeiyBg.exe
  2⤵
  PID:15620
- C:\Windows\System\RKlerKT.exe
  C:\Windows\System\RKlerKT.exe
  2⤵
  PID:16000
- C:\Windows\System\DGSshTQ.exe
  C:\Windows\System\DGSshTQ.exe
  2⤵
  PID:16016
- C:\Windows\System\QvAfSJC.exe
  C:\Windows\System\QvAfSJC.exe
  2⤵
  PID:16032
- C:\Windows\System\XfNWzdm.exe
  C:\Windows\System\XfNWzdm.exe
  2⤵
  PID:16048
- C:\Windows\System\jjGWlim.exe
  C:\Windows\System\jjGWlim.exe
  2⤵
  PID:16068
- C:\Windows\System\LzaQIhn.exe
  C:\Windows\System\LzaQIhn.exe
  2⤵
  PID:16084
- C:\Windows\System\XHdJGbQ.exe
  C:\Windows\System\XHdJGbQ.exe
  2⤵
  PID:16100
- C:\Windows\System\FSLamQg.exe
  C:\Windows\System\FSLamQg.exe
  2⤵
  PID:16116
- C:\Windows\System\VnRrPQj.exe
  C:\Windows\System\VnRrPQj.exe
  2⤵
  PID:16132
- C:\Windows\System\BYNyeuI.exe
  C:\Windows\System\BYNyeuI.exe
  2⤵
  PID:16148
- C:\Windows\System\tdtBjmM.exe
  C:\Windows\System\tdtBjmM.exe
  2⤵
  PID:16164
- C:\Windows\System\phzPbzN.exe
  C:\Windows\System\phzPbzN.exe
  2⤵
  PID:16184
- C:\Windows\System\frjfYko.exe
  C:\Windows\System\frjfYko.exe
  2⤵
  PID:16200
- C:\Windows\System\YOWunQp.exe
  C:\Windows\System\YOWunQp.exe
  2⤵
  PID:16216
- C:\Windows\System\omcgHyE.exe
  C:\Windows\System\omcgHyE.exe
  2⤵
  PID:16232
- C:\Windows\System\UQQYttE.exe
  C:\Windows\System\UQQYttE.exe
  2⤵
  PID:16248
- C:\Windows\System\YKiOmeN.exe
  C:\Windows\System\YKiOmeN.exe
  2⤵
  PID:16264
- C:\Windows\System\NbqBQzL.exe
  C:\Windows\System\NbqBQzL.exe
  2⤵
  PID:16280
- C:\Windows\System\ssgiNoZ.exe
  C:\Windows\System\ssgiNoZ.exe
  2⤵
  PID:16300
- C:\Windows\System\LHKetqG.exe
  C:\Windows\System\LHKetqG.exe
  2⤵
  PID:16320
- C:\Windows\System\yeLzKcN.exe
  C:\Windows\System\yeLzKcN.exe
  2⤵
  PID:16340
- C:\Windows\System\HEwDXsl.exe
  C:\Windows\System\HEwDXsl.exe
  2⤵
  PID:16372
- C:\Windows\System\kJuvkwu.exe
  C:\Windows\System\kJuvkwu.exe
  2⤵
  PID:15248
- C:\Windows\System\luFFmQI.exe
  C:\Windows\System\luFFmQI.exe
  2⤵
  PID:14632
- C:\Windows\System\ZtomlJT.exe
  C:\Windows\System\ZtomlJT.exe
  2⤵
  PID:13924
- C:\Windows\System\tDmtJeQ.exe
  C:\Windows\System\tDmtJeQ.exe
  2⤵
  PID:9800
- C:\Windows\System\tLZzUzM.exe
  C:\Windows\System\tLZzUzM.exe
  2⤵
  PID:9420
- C:\Windows\System\YhZbUbC.exe
  C:\Windows\System\YhZbUbC.exe
  2⤵
  PID:14984
- C:\Windows\System\ewyWdQV.exe
  C:\Windows\System\ewyWdQV.exe
  2⤵
  PID:10720
- C:\Windows\System\kYgbncr.exe
  C:\Windows\System\kYgbncr.exe
  2⤵
  PID:10736
- C:\Windows\System\NTbAVIp.exe
  C:\Windows\System\NTbAVIp.exe
  2⤵
  PID:11204
- C:\Windows\System\OTQVVsU.exe
  C:\Windows\System\OTQVVsU.exe
  2⤵
  PID:10460
- C:\Windows\System\nohnHsW.exe
  C:\Windows\System\nohnHsW.exe
  2⤵
  PID:8248
- C:\Windows\System\fVCxctN.exe
  C:\Windows\System\fVCxctN.exe
  2⤵
  PID:14500
- C:\Windows\System\KmVCyMS.exe
  C:\Windows\System\KmVCyMS.exe
  2⤵
  PID:15424
- C:\Windows\System\vevygQi.exe
  C:\Windows\System\vevygQi.exe
  2⤵
  PID:15112
- C:\Windows\System\HLZZkgg.exe
  C:\Windows\System\HLZZkgg.exe
  2⤵
  PID:15564
- C:\Windows\System\IoCdSyP.exe
  C:\Windows\System\IoCdSyP.exe
  2⤵
  PID:15664
- C:\Windows\System\RICdMPl.exe
  C:\Windows\System\RICdMPl.exe
  2⤵
  PID:15692
- C:\Windows\System\rBEfwIi.exe
  C:\Windows\System\rBEfwIi.exe
  2⤵
  PID:11768
- C:\Windows\System\HYAsOmL.exe
  C:\Windows\System\HYAsOmL.exe
  2⤵
  PID:11824
- C:\Windows\System\hHvPxWE.exe
  C:\Windows\System\hHvPxWE.exe
  2⤵
  PID:15756
- C:\Windows\System\WKvyGOY.exe
  C:\Windows\System\WKvyGOY.exe
  2⤵
  PID:11360
- C:\Windows\System\zgTExfq.exe
  C:\Windows\System\zgTExfq.exe
  2⤵
  PID:11856
- C:\Windows\System\keSDarj.exe
  C:\Windows\System\keSDarj.exe
  2⤵
  PID:12160
- C:\Windows\System\jouNzXL.exe
  C:\Windows\System\jouNzXL.exe
  2⤵
  PID:12232
- C:\Windows\System\LsdyDul.exe
  C:\Windows\System\LsdyDul.exe
  2⤵
  PID:12240
- C:\Windows\System\MbJrwmV.exe
  C:\Windows\System\MbJrwmV.exe
  2⤵
  PID:15800
- C:\Windows\System\duhDukR.exe
  C:\Windows\System\duhDukR.exe
  2⤵
  PID:11492
- C:\Windows\System\iBzwjfX.exe
  C:\Windows\System\iBzwjfX.exe
  2⤵
  PID:12360
- C:\Windows\System\FYvMEqB.exe
  C:\Windows\System\FYvMEqB.exe
  2⤵
  PID:15868
- C:\Windows\System\ESsvILP.exe
  C:\Windows\System\ESsvILP.exe
  2⤵
  PID:15536
- C:\Windows\System\tJaovlS.exe
  C:\Windows\System\tJaovlS.exe
  2⤵
  PID:15904
- C:\Windows\System\LGcXDuL.exe
  C:\Windows\System\LGcXDuL.exe
  2⤵
  PID:12688
- C:\Windows\System\CodkFzP.exe
  C:\Windows\System\CodkFzP.exe
  2⤵
  PID:15628
- C:\Windows\System\oIFTWGV.exe
  C:\Windows\System\oIFTWGV.exe
  2⤵
  PID:12704
- C:\Windows\System\RBJhwvJ.exe
  C:\Windows\System\RBJhwvJ.exe
  2⤵
  PID:15676
- C:\Windows\System\ROuQwDU.exe
  C:\Windows\System\ROuQwDU.exe
  2⤵
  PID:16064
- C:\Windows\System\eAQOVAF.exe
  C:\Windows\System\eAQOVAF.exe
  2⤵
  PID:16228
- C:\Windows\System\DLFMIMS.exe
  C:\Windows\System\DLFMIMS.exe
  2⤵
  PID:15748
- C:\Windows\System\NkacyFa.exe
  C:\Windows\System\NkacyFa.exe
  2⤵
  PID:11304
- C:\Windows\System\xhiiawN.exe
  C:\Windows\System\xhiiawN.exe
  2⤵
  PID:15768
- C:\Windows\System\udqJvHO.exe
  C:\Windows\System\udqJvHO.exe
  2⤵
  PID:11536
- C:\Windows\System\wOKHivb.exe
  C:\Windows\System\wOKHivb.exe
  2⤵
  PID:10664
- C:\Windows\System\HSIouxJ.exe
  C:\Windows\System\HSIouxJ.exe
  2⤵
  PID:15780
- C:\Windows\System\MlTgUnT.exe
  C:\Windows\System\MlTgUnT.exe
  2⤵
  PID:11588
- C:\Windows\System\FaqghBH.exe
  C:\Windows\System\FaqghBH.exe
  2⤵
  PID:8948
- C:\Windows\System\ZILJcOC.exe
  C:\Windows\System\ZILJcOC.exe
  2⤵
  PID:15820
- C:\Windows\System\AfTkkYs.exe
  C:\Windows\System\AfTkkYs.exe
  2⤵
  PID:15880
- C:\Windows\System\KljTTIz.exe
  C:\Windows\System\KljTTIz.exe
  2⤵
  PID:15940
- C:\Windows\System\HtHwpdP.exe
  C:\Windows\System\HtHwpdP.exe
  2⤵
  PID:15972
- C:\Windows\System\ItIHXNg.exe
  C:\Windows\System\ItIHXNg.exe
  2⤵
  PID:10876
- C:\Windows\System\pNPkxeB.exe
  C:\Windows\System\pNPkxeB.exe
  2⤵
  PID:16024
- C:\Windows\System\ENROiKu.exe
  C:\Windows\System\ENROiKu.exe
  2⤵
  PID:16096
- C:\Windows\System\iazmHRS.exe
  C:\Windows\System\iazmHRS.exe
  2⤵
  PID:16124
- C:\Windows\System\RLGiTxs.exe
  C:\Windows\System\RLGiTxs.exe
  2⤵
  PID:16160
- C:\Windows\System\uWBhhYT.exe
  C:\Windows\System\uWBhhYT.exe
  2⤵
  PID:2632
- C:\Windows\System\XAZjXHG.exe
  C:\Windows\System\XAZjXHG.exe
  2⤵
  PID:16336
- C:\Windows\System\YhlAXZJ.exe
  C:\Windows\System\YhlAXZJ.exe
  2⤵
  PID:16360
- C:\Windows\System\ScwVUFo.exe
  C:\Windows\System\ScwVUFo.exe
  2⤵
  PID:10808
- C:\Windows\System\kKwIGTw.exe
  C:\Windows\System\kKwIGTw.exe
  2⤵
  PID:10820
- C:\Windows\System\GbHYhur.exe
  C:\Windows\System\GbHYhur.exe
  2⤵
  PID:8676
- C:\Windows\System\ipZVCZh.exe
  C:\Windows\System\ipZVCZh.exe
  2⤵
  PID:14456
- C:\Windows\System\gSOCKiW.exe
  C:\Windows\System\gSOCKiW.exe
  2⤵
  PID:8028
- C:\Windows\System\xQmMkNZ.exe
  C:\Windows\System\xQmMkNZ.exe
  2⤵
  PID:7560
- C:\Windows\System\VfToJtc.exe
  C:\Windows\System\VfToJtc.exe
  2⤵
  PID:11456
- C:\Windows\System\RraZwbR.exe
  C:\Windows\System\RraZwbR.exe
  2⤵
  PID:8116
- C:\Windows\System\xBoirFB.exe
  C:\Windows\System\xBoirFB.exe
  2⤵
  PID:9360
- C:\Windows\System\oglXyxo.exe
  C:\Windows\System\oglXyxo.exe
  2⤵
  PID:10972
- C:\Windows\System\NOZsLFG.exe
  C:\Windows\System\NOZsLFG.exe
  2⤵
  PID:11020
- C:\Windows\System\iMeUHow.exe
  C:\Windows\System\iMeUHow.exe
  2⤵
  PID:15484
- C:\Windows\System\KdaZRad.exe
  C:\Windows\System\KdaZRad.exe
  2⤵
  PID:10948
- C:\Windows\System\rdsFqlM.exe
  C:\Windows\System\rdsFqlM.exe
  2⤵
  PID:10816
- C:\Windows\System\gPOnyWM.exe
  C:\Windows\System\gPOnyWM.exe
  2⤵
  PID:10356
- C:\Windows\System\ATeTUqO.exe
  C:\Windows\System\ATeTUqO.exe
  2⤵
  PID:13192
- C:\Windows\System\xknQXJi.exe
  C:\Windows\System\xknQXJi.exe
  2⤵
  PID:13008
- C:\Windows\System\eYsjTiU.exe
  C:\Windows\System\eYsjTiU.exe
  2⤵
  PID:13100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5680 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:13716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pgcmkivv.nht.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CwUJuOX.exe

Filesize
1.9MB

MD5
6cb08037f8c753c3add207b2f6c91918

SHA1
60b5bb3fdaa6ac7224194b2f1f22fc83ad8660a1

SHA256
50a7d79237cc6b7e336a6fec3853e61ec517394045ee7ff4a62dffad89ee5fbe

SHA512
bc671896ae15c7992309161a1d89917a595e155835e02e87f2ac0b4149c57079024ebd9568a7c3e66831ddb2c394ef758d4d1533621d05da93e7c3061fbdf91c

Download Submit
C:\Windows\System\FMskaRL.exe

Filesize
1.9MB

MD5
d3878c9e6cfa61ced973e26e66e57e83

SHA1
61fd11ba7d5f05487ac851217b1ad493105b0927

SHA256
64cfb5cd98cc802fb6c95d687da972181329ba3044147c494785382847ac9215

SHA512
c412abd10067ce54cbbdda13a08dd618e3c9dbc46bcfbd7bbb64cb422f1ce216001d44c7a345186e76920db5e91cba76672a67e88ed00d34402061f3f753dd60

Download Submit
C:\Windows\System\GErJBBH.exe

Filesize
1.9MB

MD5
9b5e217cc7c175463ad1fdbfeef24c19

SHA1
6e8df2e03676d64a89f4ef624c6e11d2b91b9a07

SHA256
fe1fd0a2922ef6518f7d3e2ee968f7e169abf36bd3d23a2c244026d45d358e19

SHA512
79cff12ef8916d4e817cb182b1dfe9291f3d2828aa0c925a88900400cf2ceac8ce130f1b358b4740d6b244bbc2ad35e1a43e5a7dbdd8132b593d4513cdee1a1b

Download Submit
C:\Windows\System\GkwBNvV.exe

Filesize
1.9MB

MD5
c07298e98d7c68a005f9db8bbbc3094e

SHA1
73afbee88d775ad4565b5e7cd3c049eaeab9f842

SHA256
40523ff1adadeb917b3b94c0b77e0a4c9ab558bed19720092c392b9961d0a501

SHA512
06851d6d799a26eff7ba0ef22efcc3dbf80b4c44b61047d54eca8d14f013b49b2f0ab53c12592f74b482c4f0ffe0e6f302951072ad16f879e3c1795e90bd8d94

Download Submit
C:\Windows\System\GsUuYgW.exe

Filesize
1.9MB

MD5
6b9427c3bcb4e53cb6d26ac6377e5990

SHA1
b5b903692f91edb910a33acfc126558b6cdd855a

SHA256
699bd0c43a8096c146067d4c5b3515755c19064880d2e257314388eb8fc890be

SHA512
8031199474ba60115e133704ac012861360741c1798f53fc93cfcd9dd6d56a9ddc63847ab186408ebb2d3236cd3b54892e9daec51017a5858aa1b08e469d8964

Download Submit
C:\Windows\System\IIzWSXg.exe

Filesize
1.9MB

MD5
4d4327a1408b17e72dd94ac1ec86b7f6

SHA1
3ea113bbe86f31d57066416dbd1a4cb2d5502811

SHA256
bc71fc7562604666782aeb4bd4c004a4518f46de0717fbc3be843bfa07436d42

SHA512
eabf77af0e7c2f8978d13352c586a33f3ae272d1f6d3b79b72f9f3a466b3e1fcce566c2dee4e5aca84346ee33c6e8f5656017f0b1aafb79adc7b059432780c5b

Download Submit
C:\Windows\System\KEgSijC.exe

Filesize
1.9MB

MD5
a021dd2d43b3e54394163d1ad6448e5e

SHA1
ede6f303af89e858c025dcd0f3b3789f266495de

SHA256
811f3fd1dfb3b9bd9c9c1dccd538274e60f69c582d1d5434dba9e77fdae2f49b

SHA512
a8b3eaca9bdd28ce75aa69e3c2a53297a9f4fa097340e597db2204c3c0f0350240c06e8c69cc5c0ba2054063d5f676a629489560ce983285fc7ec9421b59bb22

Download Submit
C:\Windows\System\KgFLUtf.exe

Filesize
1.9MB

MD5
03d5afd9d6c89107b12a22f31222147b

SHA1
4adce8af799f19b3fde2ee25b6cee4e51bab7398

SHA256
914db95988ab1dc8cd6b9c64f1e31ba3e44b9e9e821364d25935d048d338668a

SHA512
672ee9ca0bfd9f7ae5470c3f1d1ded4d24c54de128aeb0ecde30b25c574f7fcad887f73ac68b79125465a59493c9800357bb670443612d83dec543dbfc2885f3

Download Submit
C:\Windows\System\LQCHvdl.exe

Filesize
1.9MB

MD5
587852f728f8e8bd56cb939100e2a2c3

SHA1
2dced6b155f35454e96296a60a1981a46863bf3c

SHA256
a5f74ae12e0adda19fb5e0cda82cab547a5fafc9027f5af2b02645dfadcb7e76

SHA512
6c0b49ebcde96443154a57e0ed7ce98bea98b5c1d6dac268f885b464b8e0246272d892f19ba34ea655a5812cf3bfcb1c0a00babd14d2d49b03020f31c6652314

Download Submit
C:\Windows\System\LTxQkIU.exe

Filesize
1.9MB

MD5
b0827aada4a33a40703ddb2b7a261be7

SHA1
c8434d854333f6b611f271f0daf67f33efa287ce

SHA256
856b945cd69d6cab04d6f2c7b03bc2b327852b2b37ea19ff22da9fc56f45bcd9

SHA512
05a81f30c391ff8c81d6506daef71b77a2c612ee1c8df1465f1ae402c27d9b3aed8900c498236c0292c5208ef474688393322881d19d396985a0c4ff214132d7

Download Submit
C:\Windows\System\LcEsnRh.exe

Filesize
1.9MB

MD5
b268c3d4b6285a2faaaffdb431c2d536

SHA1
5f09d9f51a722dcf50a28d5c8e5a908d51edc1b3

SHA256
73e83a5c546d6d98561401cc18669a577247522b850c7f0bd05fe9e685e1118c

SHA512
0014ec81b4a352a4c9997f6e6375309db35d8c9a7657ddadfe5641526fafe90c7798a5581881d88e9dd97f57537f784e4374c3b8a48a5f037e3875ba453cb45b

Download Submit
C:\Windows\System\MEhivoV.exe

Filesize
1.9MB

MD5
cf5a3b915674ed90540ccbe27dd7cac8

SHA1
8e21af8e235ae63ea7a4f5bc6188aec6b1ba0621

SHA256
284573fd6d0d28685a76c5885359b43e18a2422d7abf9aa46ecd1725d89eda87

SHA512
3e4ea9c0fb42a96bbcddf1b60ffb1ec7d6136b44689e4581c7e8ec0e3c6742c97b4122bee26244f9836afb63c81b388019ef2fbc7aef0217091138903333a386

Download Submit
C:\Windows\System\NxJAUJc.exe

Filesize
1.9MB

MD5
b91b861143accf5eed2a6151e46183e3

SHA1
3563293703dfd7b4cc80c23b9260a144dc6aac10

SHA256
6d61e03041d2b8ea13aac2768f1e5b8e101849e6ab825947718e0ea182139808

SHA512
2450618d8d48137b01941adf50752e5a7edd273368eff7b467ce0aec625ca1e0b5632b7ec1aa2ccf126002babf6a650b0afdc13bfa90a189a30281bd9501557e

Download Submit
C:\Windows\System\TspAjfb.exe

Filesize
1.9MB

MD5
7048f46da60b41f6a1f16eeef727dc68

SHA1
39b419e4419a68ae742907ee84ac20a958d64037

SHA256
41b6eee990ed620cc2cf2aa9338a0336eaf8acdf194495e74294e605b0669073

SHA512
65ab3840f37099fe33304dc31e3ddd3f08da1352a00f5ab81759388f3937689e5ae1cbb1fb77cccf82c548dfcb42580542325cdc124bb0fefcd7f605fbcf1714

Download Submit
C:\Windows\System\TyHFPrw.exe

Filesize
1.9MB

MD5
64539dfeadd5abf4a2d9d0211308ae35

SHA1
e0a0e8834fc5a14b9927527d3357b9835ea14261

SHA256
a70474d2febd0c6c73b7d75a547431122cd37ab3c95a4a943118b6ce0a2050a8

SHA512
7ad4747ff57a00b9f371acba248cb7925ac229ecf1e9d9417b058db06465957a0db50a46cd86bd338b0facf5c7fc8847083f8402275b8a356c29d436215bb310

Download Submit
C:\Windows\System\YePPzDu.exe

Filesize
1.9MB

MD5
d5b92eaad61e8ee819373e8c84d167c7

SHA1
22179206df8930cee18c1eb371420b943e41ca8c

SHA256
75462189e85bb4d408845ad32584255812e3c4adb02efd87dc87629ed608ca46

SHA512
9279560539e24c90c0b945082813ee41ec2061bc09b8eef5ef3cff355598fb53a5ae873e4d6b5af76bf49ff787d8aad90e38adfc0c3099d39ae3b59a7c781aa5

Download Submit
C:\Windows\System\YqskHdu.exe

Filesize
1.9MB

MD5
2390163b7f270b0ff85afef1774190aa

SHA1
c1d3dd97e157fbeb00a26e4231f8318d9a8840c8

SHA256
ed6ca9cac7167beb7b6affe44007e33fe3eaff7b248b56f1d9bac61410105cb5

SHA512
f0eab4246194b5cc0c2a69d8a3bd0af637afbf204be7e4e9b83b78980d5938c214a859e42da847530f965295c6501d5f889d2251be8ceb2fce9180a98dad22ea

Download Submit
C:\Windows\System\ZuFihgi.exe

Filesize
1.9MB

MD5
510ab7ca683bdf12c34d745a0259f7bd

SHA1
af9b90f2840c12e3d13b08e9f43d90e40ecd423e

SHA256
34c344a53c13e7cebaa027ccfd026010b7c3061aa362e324184616119b599fbb

SHA512
69bddbb1b6fb5672b2bc2151f82e2944fcb06d19c08384c39a55c081c71cf10410851d9b7efa1f679a45b2afce665aeb4b8c6078b1d13b72c559d30549e77c5b

Download Submit
C:\Windows\System\eSqHHGk.exe

Filesize
1.9MB

MD5
dea1bda72a6e520103336d05c0a0d7ee

SHA1
9c8e4d1e670823a17793f8be37b466eca5ed9748

SHA256
ffc3ecf181b0825322d61beed196c924955ad113b5f23cf6314cdc0c67cefe62

SHA512
f110ea8524b5d26fd38e3696acbec1dbece694b528c25e28b402031e1c2a8820a609160be6b9ea4c60197088b026a10f9fbba834872e0cf7b41fc3217fde0510

Download Submit
C:\Windows\System\hbkPGoQ.exe

Filesize
1.9MB

MD5
51246e81ce1d9af3b2a02e7467b46180

SHA1
8f7e0520f268f86fa1e5f8f417da44062704b73c

SHA256
6b024718e467340d76b34dd48da644fe31660b7201e51e194772b1d0db6b8b50

SHA512
5ae8cb5616524be77b01d9a4dfce0f72ad252769e8f5623a96109bf581bc137f48ea297ce3cdc86b44104404cd26b28dfb6335c8d585b1059e11249add488027

Download Submit
C:\Windows\System\iKlvQdT.exe

Filesize
1.9MB

MD5
b2d6a197ab1ab1f525deda2ba9fd2255

SHA1
a8633e7469788ee1b78fa03355893613fdafa57f

SHA256
8489b2a5723fa762d366197f1dcd36bd674b34f5a51a9ce06b81f964dedaf35f

SHA512
b7aecc95e2850fe7e2ae17dc8864c29e1599d551d36949de94131efe8496e099dca1ea3d36c7bb5af2818dda4187859691255d833ced4a7dea71e7046afe9f91

Download Submit
C:\Windows\System\iXvSFDk.exe

Filesize
1.9MB

MD5
f7e0fb1f7711ee82e35f36088d6499de

SHA1
886ab0565be07edef72c00f7b403bb18d56e12c7

SHA256
4f866450fc60d22ce01b37ebf9d4e2e5241fcbf1e47b9bb6440461abfb35d3b0

SHA512
58f60a0a5d29dfc45f52b00c904f703c041a0dbd9339d853c5d8c70cfdee341028ae6282f67b799717fce8fe5e83083ddfd0794dd3c4eeaf9980b257fdda0b51

Download Submit
C:\Windows\System\jAzxkrs.exe

Filesize
1.9MB

MD5
40be467f3bcd8ca65d4d06062fe517d6

SHA1
7ac1d5de85ad6954e64034d4d2cd45b1911ccb5e

SHA256
31f6bd96bde18883eb523dc911f4b9983d8d2bd02dc7786853abf49f4bbe470c

SHA512
60cd54e93e933c89f9b95a55f654ba79a4304425b2fcf4a440f80c1d3d6ca5940d9044b83fa3ab91f6118f55b5467cefed767d5181598d04f8f7c863070a5d1b

Download Submit
C:\Windows\System\jExUjKm.exe

Filesize
1.9MB

MD5
ca9755c45917364ee0a02d9d7839184d

SHA1
ba50f7372f9e7875cf74bca11a9e1e65de471cb4

SHA256
5db05b2a66a1d9f131bc6f8b314947e1d9e2428a29fe28018c351739dedb89c8

SHA512
719f6868b3490c423ac56857eceae852e7430c880343f09b949b6eb8366c6f5299f59dce574169aab045a10dcb37ddf90d988272f27660ff07167dacda4c8f58

Download Submit
C:\Windows\System\nQgKWPe.exe

Filesize
1.9MB

MD5
7cf470c7082a933bbb547f4a53fde21e

SHA1
da759d9df615d9074ffb3ff4d75955d5cfa4290a

SHA256
1e52acb15424234866ca3b0025cdff945dddcbfe1b3509c92b1e0c3777d21051

SHA512
e85cf56f8e7c1b5bb6f3b208bed23f974d57644f63f67e355d9c9bf43b66dfb168bc86a6cbb7254c514ea56677cb69335697ae607ccda1dc4a2197e25e54ceb8

Download Submit
C:\Windows\System\oXJzdix.exe

Filesize
1.9MB

MD5
d20aa248f9e574af2157ad1a51ce15e4

SHA1
2bf2037b87bc665410c7c0aa0db4e1955652a30e

SHA256
2572ccef9b15746f873bc950e5d85eaadf8c42ace73ff612df1a39480c737a7e

SHA512
a5da092f55df310f7e866871ebb7b999294fef77f4fb29ed042e7c6df0693b328ca5e84e774d65ba03cfaa3f9261c1aa87447ed910a2755bf389c7f4112e8d99

Download Submit
C:\Windows\System\pkbKhCA.exe

Filesize
1.9MB

MD5
2f7983330877567a781bbda3136fa433

SHA1
2667cb98a6bcef33ef7c7e917bfd39f2c074d1ab

SHA256
207c8e67839f27ef0344e9e7d034d550aba41babdd03a2697566c885c453151d

SHA512
a0be8c2d4397074d62ea0487a4c538efffee18934bb286540a33930cbb5aa4d34118af1a601b7008b5397771c4fa5f800b210d1bd6fcd336fc5977b2a517e901

Download Submit
C:\Windows\System\qpHJWYU.exe

Filesize
1.9MB

MD5
cf096d4ce813164ab41bdeb67552167a

SHA1
39f2212714708c481d561e9568abf9eb815c7cae

SHA256
1fd9dfad959d13dbd9faf11825604c9b79d1a8f84693b5bb8dc03ebf4adb5611

SHA512
a50222855718c9ede21cabdfb492afe2c9de55aaae3516bd1bb85938d31a2c15f3aeacf3498b1e8c22052320dd71851f64c59348fcaef8b48f4d08ad2cd5fa7b

Download Submit
C:\Windows\System\rWgQjbH.exe

Filesize
1.9MB

MD5
8d87344c783a20be8f67695cc2f29516

SHA1
97299eae056d6e0426a0a04e5375eb5b5bae4234

SHA256
f1548ca25bdca19b1df92dee3d3ee22cd596475db39ad0b3f27bcfba43b2e963

SHA512
291d78a8008897c6389d6517b9cbccbefc2511bf1954b36eca214b67075a3a3dc509058f778aecafa9b9cb2f7bce3c8ec2f305eeb1943e5c90120eb41a7bc680

Download Submit
C:\Windows\System\tDLjRDC.exe

Filesize
1.9MB

MD5
fb0123d129e954255d708eaba351d004

SHA1
f516398e85e63159f2e8deb72c79fe74689989e2

SHA256
3383c924582ac1fdaae1bc7cf1f1aa5e9ee3f9a909a5f29eff9ccb66734563bb

SHA512
07273354f0343ed5d928f79aa4bbfed8bc5510513c7390e4873b5e8d64bafc9f87cd5e6e85f5e6fbc59a311f6394e81e77a3393b78920ee4421213e3380b41cc

Download Submit
C:\Windows\System\wxTzmkI.exe

Filesize
1.9MB

MD5
9ee5cebbb5338a49dcf00a266bfcb29c

SHA1
5ba57af4befd24600bf46fbb2db9b4d28c877f12

SHA256
a5ee4a6aadfb2070a89597e3fed38e2de890a7611784184cd0479f18e42578c8

SHA512
92b5936c83dff06d0c42a407fc286ba69a55f8b06168a961c79216e12d96e0649d2406986f6fa658229fb9788a727c8bea3c7f30b406b3447f003a6992eee363

Download Submit
C:\Windows\System\yGIXgsk.exe

Filesize
1.9MB

MD5
69d927e9594bfd7dfec03cdaf31ce362

SHA1
4bfa35af191459a019a815dafa6296ac0e972009

SHA256
953065fb17648fb1c62a46557cb6767a8966e9ba759fb2f1ade2c5a1a8be09c1

SHA512
99a9be3e967923b3ef745793b691824e7e58641daa2b9d5f3d55b25fb0597d9e349102f774ae2f920f5ecb508b661b6d109cfb4512106ac7021417ff8dcf4f83

Download Submit
C:\Windows\System\yYOjfyI.exe

Filesize
1.9MB

MD5
794cdca092be0b67bf3bdb2636587e75

SHA1
409ac566e29016cc016cfee39a5954847d775da2

SHA256
08dca9ccbb2423b62ef7a5ddebfbdf4c7d5b34e477dc062e109a94f8abb1dfeb

SHA512
978be74bf2ede0bcd0ec5c3a08e5d32bea026b12444daf8b607fd8c70da4af4e18cca3b5d4fe31c18fc2859a3fd98b3a36dae95590bad75e695cd1f5f30cac7b

Download Submit
C:\Windows\System\zbaKLsJ.exe

Filesize
1.9MB

MD5
b1fc1f15ad26c7b6bdacc8d687e9c76c

SHA1
cd4c7516a501cb15eab140951eed72a3110bbe2b

SHA256
1f7bafa0bab0dd4731e1696d79b4680d905fde604d7671ca45e5bd9f2a3ef474

SHA512
aee04e5cf3134caa028933c9e88376590488c834bbcd9606594b3a5ea5a656065503bb93d58c8c7703ed796536f33080bbbfa1a8984982f467ed4c21837df4c1

Download Submit
memory/840-2053-0x00007FF6B3ED0000-0x00007FF6B42C2000-memory.dmp

Filesize
3.9MB

Download
memory/840-151-0x00007FF6B3ED0000-0x00007FF6B42C2000-memory.dmp

Filesize
3.9MB

Download
memory/1180-2058-0x00007FF6DF490000-0x00007FF6DF882000-memory.dmp

Filesize
3.9MB

Download
memory/1180-94-0x00007FF6DF490000-0x00007FF6DF882000-memory.dmp

Filesize
3.9MB

Download
memory/1448-0-0x00007FF77F040000-0x00007FF77F432000-memory.dmp

Filesize
3.9MB

Download
memory/1448-6356-0x00007FF77F040000-0x00007FF77F432000-memory.dmp

Filesize
3.9MB

Download
memory/1448-1-0x000001E2D9B20000-0x000001E2D9B30000-memory.dmp

Filesize
64KB

Download
memory/1796-167-0x00007FF6BEF90000-0x00007FF6BF382000-memory.dmp

Filesize
3.9MB

Download
memory/1796-2036-0x00007FF6BEF90000-0x00007FF6BF382000-memory.dmp

Filesize
3.9MB

Download
memory/1876-168-0x00007FF6C55F0000-0x00007FF6C59E2000-memory.dmp

Filesize
3.9MB

Download
memory/1876-2060-0x00007FF6C55F0000-0x00007FF6C59E2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-15-0x00007FF7ABC90000-0x00007FF7AC082000-memory.dmp

Filesize
3.9MB

Download
memory/1888-2063-0x00007FF7ABC90000-0x00007FF7AC082000-memory.dmp

Filesize
3.9MB

Download
memory/1948-175-0x00007FF6AEE30000-0x00007FF6AF222000-memory.dmp

Filesize
3.9MB

Download
memory/1948-2081-0x00007FF6AEE30000-0x00007FF6AF222000-memory.dmp

Filesize
3.9MB

Download
memory/2132-138-0x00007FF78FC20000-0x00007FF790012000-memory.dmp

Filesize
3.9MB

Download
memory/2132-2041-0x00007FF78FC20000-0x00007FF790012000-memory.dmp

Filesize
3.9MB

Download
memory/2220-169-0x00007FF695D90000-0x00007FF696182000-memory.dmp

Filesize
3.9MB

Download
memory/2220-2201-0x00007FF695D90000-0x00007FF696182000-memory.dmp

Filesize
3.9MB

Download
memory/2360-19-0x00007FF6CC730000-0x00007FF6CCB22000-memory.dmp

Filesize
3.9MB

Download
memory/2360-2062-0x00007FF6CC730000-0x00007FF6CCB22000-memory.dmp

Filesize
3.9MB

Download
memory/2476-172-0x00007FF773930000-0x00007FF773D22000-memory.dmp

Filesize
3.9MB

Download
memory/2476-2048-0x00007FF773930000-0x00007FF773D22000-memory.dmp

Filesize
3.9MB

Download
memory/2972-174-0x00007FF749050000-0x00007FF749442000-memory.dmp

Filesize
3.9MB

Download
memory/2972-2046-0x00007FF749050000-0x00007FF749442000-memory.dmp

Filesize
3.9MB

Download
memory/2980-2043-0x00007FF6AF750000-0x00007FF6AFB42000-memory.dmp

Filesize
3.9MB

Download
memory/2980-137-0x00007FF6AF750000-0x00007FF6AFB42000-memory.dmp

Filesize
3.9MB

Download
memory/3276-170-0x00007FF698580000-0x00007FF698972000-memory.dmp

Filesize
3.9MB

Download
memory/3276-2129-0x00007FF698580000-0x00007FF698972000-memory.dmp

Filesize
3.9MB

Download
memory/3360-11-0x00007FF6B69D0000-0x00007FF6B6DC2000-memory.dmp

Filesize
3.9MB

Download
memory/3580-2222-0x00007FF7A9910000-0x00007FF7A9D02000-memory.dmp

Filesize
3.9MB

Download
memory/3580-177-0x00007FF7A9910000-0x00007FF7A9D02000-memory.dmp

Filesize
3.9MB

Download
memory/3908-38-0x00000224CB9D0000-0x00000224CB9F2000-memory.dmp

Filesize
136KB

Download
memory/3908-53-0x00007FFFA5280000-0x00007FFFA5D41000-memory.dmp

Filesize
10.8MB

Download
memory/3908-56-0x00000224B1290000-0x00000224B12A0000-memory.dmp

Filesize
64KB

Download
memory/3908-173-0x00000224B1290000-0x00000224B12A0000-memory.dmp

Filesize
64KB

Download
memory/3908-2581-0x00007FFFA5280000-0x00007FFFA5D41000-memory.dmp

Filesize
10.8MB

Download
memory/3928-2038-0x00007FF70EF00000-0x00007FF70F2F2000-memory.dmp

Filesize
3.9MB

Download
memory/3928-156-0x00007FF70EF00000-0x00007FF70F2F2000-memory.dmp

Filesize
3.9MB

Download
memory/3956-111-0x00007FF6EAC40000-0x00007FF6EB032000-memory.dmp

Filesize
3.9MB

Download
memory/3956-2027-0x00007FF6EAC40000-0x00007FF6EB032000-memory.dmp

Filesize
3.9MB

Download
memory/4628-125-0x00007FF74B420000-0x00007FF74B812000-memory.dmp

Filesize
3.9MB

Download
memory/4676-2101-0x00007FF75ABB0000-0x00007FF75AFA2000-memory.dmp

Filesize
3.9MB

Download
memory/4676-171-0x00007FF75ABB0000-0x00007FF75AFA2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-176-0x00007FF66EE30000-0x00007FF66F222000-memory.dmp

Filesize
3.9MB

Download
memory/5040-110-0x00007FF6222E0000-0x00007FF6226D2000-memory.dmp

Filesize
3.9MB

Download
memory/5040-2055-0x00007FF6222E0000-0x00007FF6226D2000-memory.dmp

Filesize
3.9MB

Download