xmrig | 5df2d447337febed9b4763fc627836e58c7f252ad053946afd2a7136a6d036cd

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
Size

1.9MB
MD5

09c6d85fbf8658512caadc52a0720792
SHA1

0e014f4c7685fc4201fb4dfc002ab59bb8fd12c4
SHA256

5df2d447337febed9b4763fc627836e58c7f252ad053946afd2a7136a6d036cd
SHA512

9d6f80989fd3cbc8e5316fc969352c44c46d29293a0f34963947483aa2a29788a4422be87f87c56abba87202a3744fb9dc7a9089928d740016e29ee45a878611
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1y:NAB5

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/1976-48-0x00007FF70FA70000-0x00007FF70FE62000-memory.dmp	xmrig
behavioral2/memory/5516-136-0x00007FF6C0C90000-0x00007FF6C1082000-memory.dmp	xmrig
behavioral2/memory/5760-152-0x00007FF79FAA0000-0x00007FF79FE92000-memory.dmp	xmrig
behavioral2/memory/3016-156-0x00007FF64F500000-0x00007FF64F8F2000-memory.dmp	xmrig
behavioral2/memory/2188-158-0x00007FF6491B0000-0x00007FF6495A2000-memory.dmp	xmrig
behavioral2/memory/5972-157-0x00007FF710710000-0x00007FF710B02000-memory.dmp	xmrig
behavioral2/memory/4168-155-0x00007FF75C350000-0x00007FF75C742000-memory.dmp	xmrig
behavioral2/memory/4408-154-0x00007FF65D8D0000-0x00007FF65DCC2000-memory.dmp	xmrig
behavioral2/memory/1644-153-0x00007FF7CAAE0000-0x00007FF7CAED2000-memory.dmp	xmrig
behavioral2/memory/5992-150-0x00007FF680440000-0x00007FF680832000-memory.dmp	xmrig
behavioral2/memory/5896-147-0x00007FF6EE440000-0x00007FF6EE832000-memory.dmp	xmrig
behavioral2/memory/5948-143-0x00007FF68D8D0000-0x00007FF68DCC2000-memory.dmp	xmrig
behavioral2/memory/5380-132-0x00007FF7AF120000-0x00007FF7AF512000-memory.dmp	xmrig
behavioral2/memory/5344-123-0x00007FF635010000-0x00007FF635402000-memory.dmp	xmrig
behavioral2/memory/5340-112-0x00007FF7DE900000-0x00007FF7DECF2000-memory.dmp	xmrig
behavioral2/memory/2616-105-0x00007FF79CC60000-0x00007FF79D052000-memory.dmp	xmrig
behavioral2/memory/5392-96-0x00007FF6CA340000-0x00007FF6CA732000-memory.dmp	xmrig
behavioral2/memory/4252-79-0x00007FF7C14D0000-0x00007FF7C18C2000-memory.dmp	xmrig
behavioral2/memory/3548-78-0x00007FF6C5AC0000-0x00007FF6C5EB2000-memory.dmp	xmrig
behavioral2/memory/3204-72-0x00007FF7B7AD0000-0x00007FF7B7EC2000-memory.dmp	xmrig
behavioral2/memory/1976-1989-0x00007FF70FA70000-0x00007FF70FE62000-memory.dmp	xmrig
behavioral2/memory/5392-2038-0x00007FF6CA340000-0x00007FF6CA732000-memory.dmp	xmrig
behavioral2/memory/3548-2033-0x00007FF6C5AC0000-0x00007FF6C5EB2000-memory.dmp	xmrig
behavioral2/memory/2616-2099-0x00007FF79CC60000-0x00007FF79D052000-memory.dmp	xmrig
behavioral2/memory/5760-2135-0x00007FF79FAA0000-0x00007FF79FE92000-memory.dmp	xmrig
behavioral2/memory/5992-2143-0x00007FF680440000-0x00007FF680832000-memory.dmp	xmrig
behavioral2/memory/4168-2144-0x00007FF75C350000-0x00007FF75C742000-memory.dmp	xmrig
behavioral2/memory/1644-2147-0x00007FF7CAAE0000-0x00007FF7CAED2000-memory.dmp	xmrig
behavioral2/memory/5516-2146-0x00007FF6C0C90000-0x00007FF6C1082000-memory.dmp	xmrig
behavioral2/memory/5972-2148-0x00007FF710710000-0x00007FF710B02000-memory.dmp	xmrig
behavioral2/memory/4408-2150-0x00007FF65D8D0000-0x00007FF65DCC2000-memory.dmp	xmrig
behavioral2/memory/2188-2173-0x00007FF6491B0000-0x00007FF6495A2000-memory.dmp	xmrig
behavioral2/memory/3016-2187-0x00007FF64F500000-0x00007FF64F8F2000-memory.dmp	xmrig
behavioral2/memory/5896-2169-0x00007FF6EE440000-0x00007FF6EE832000-memory.dmp	xmrig
behavioral2/memory/5948-2167-0x00007FF68D8D0000-0x00007FF68DCC2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3236	powershell.exe
6	3236	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2484	NMGdeZa.exe
1976	PuEUVbH.exe
3204	mwIipeO.exe
3548	AFTnqna.exe
4252	HQffxjI.exe
5392	sCNetWU.exe
5760	qveFlLR.exe
1644	KRqCtuK.exe
2616	GaLgbqZ.exe
5340	ftoFuqe.exe
5344	OfkWBRA.exe
5380	FgWZixl.exe
5516	XTQngXp.exe
4408	DwwRSoC.exe
4168	GdZijVM.exe
3016	NTDDhpU.exe
5948	hwfBeCc.exe
5896	PUooSzM.exe
5972	OJOmvgf.exe
5992	DALuOKO.exe
2188	BKnzKDJ.exe
2180	oaXHQiS.exe
5492	UTUKsWO.exe
1004	XtdFsHH.exe
4508	FUaTfsu.exe
4256	choXTHi.exe
2440	DiTplmP.exe
2168	VWmfQNy.exe
3784	QnTScLj.exe
4892	ymOmzFd.exe
988	OnREVAR.exe
3388	WQKNaqn.exe
1280	PgztEjz.exe
2208	lLVSpGO.exe
3564	EaAYKVB.exe
3976	GyotcdC.exe
4636	iYUmJpr.exe
4568	wnXuMWf.exe
5088	VSAYrkP.exe
5060	tTArQlB.exe
2472	AMzCYUB.exe
3604	FXJpjqO.exe
2308	hBfzATY.exe
1480	phSviKx.exe
3980	xMcXvTi.exe
2932	pSDTEgh.exe
3396	csBSHrs.exe
5216	WBdRppt.exe
3188	YuvyPKR.exe
3952	grprwmf.exe
2264	hTLmOoz.exe
3728	yvwvFYs.exe
6136	RNNSMMp.exe
5212	pxFoXZc.exe
4884	fkNkRKv.exe
1096	VtizhSO.exe
5040	BGdGcnm.exe
968	pgBumuC.exe
4072	esmNCzD.exe
1712	TvqlcfW.exe
844	BfDfFTL.exe
4420	DCvSZNi.exe
5004	MzYWRdA.exe
6008	QgOnoQN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4620-0-0x00007FF7CC8C0000-0x00007FF7CCCB2000-memory.dmp	upx
behavioral2/files/0x0008000000023262-5.dat	upx
behavioral2/memory/2484-8-0x00007FF73A430000-0x00007FF73A822000-memory.dmp	upx
behavioral2/files/0x0008000000023265-11.dat	upx
behavioral2/files/0x0008000000023268-10.dat	upx
behavioral2/files/0x000800000002326b-32.dat	upx
behavioral2/files/0x0008000000023266-35.dat	upx
behavioral2/files/0x000900000002326a-40.dat	upx
behavioral2/memory/1976-48-0x00007FF70FA70000-0x00007FF70FE62000-memory.dmp	upx
behavioral2/files/0x000700000002326d-51.dat	upx
behavioral2/files/0x000700000002326e-54.dat	upx
behavioral2/files/0x000700000002326f-57.dat	upx
behavioral2/files/0x0007000000023270-60.dat	upx
behavioral2/files/0x000700000002326c-67.dat	upx
behavioral2/files/0x0007000000023274-92.dat	upx
behavioral2/files/0x0007000000023271-87.dat	upx
behavioral2/files/0x0007000000023278-109.dat	upx
behavioral2/files/0x0007000000023279-111.dat	upx
behavioral2/files/0x0007000000023276-117.dat	upx
behavioral2/files/0x000700000002327b-129.dat	upx
behavioral2/memory/5516-136-0x00007FF6C0C90000-0x00007FF6C1082000-memory.dmp	upx
behavioral2/files/0x000700000002327c-145.dat	upx
behavioral2/memory/5760-152-0x00007FF79FAA0000-0x00007FF79FE92000-memory.dmp	upx
behavioral2/memory/3016-156-0x00007FF64F500000-0x00007FF64F8F2000-memory.dmp	upx
behavioral2/files/0x000700000002327f-162.dat	upx
behavioral2/files/0x000700000002327e-164.dat	upx
behavioral2/files/0x0007000000023282-174.dat	upx
behavioral2/files/0x0007000000023284-184.dat	upx
behavioral2/files/0x0007000000023285-189.dat	upx
behavioral2/files/0x0007000000023287-196.dat	upx
behavioral2/files/0x0007000000023286-193.dat	upx
behavioral2/files/0x0007000000023283-179.dat	upx
behavioral2/files/0x0007000000023280-169.dat	upx
behavioral2/files/0x000700000002327d-159.dat	upx
behavioral2/memory/2188-158-0x00007FF6491B0000-0x00007FF6495A2000-memory.dmp	upx
behavioral2/memory/5972-157-0x00007FF710710000-0x00007FF710B02000-memory.dmp	upx
behavioral2/memory/4168-155-0x00007FF75C350000-0x00007FF75C742000-memory.dmp	upx
behavioral2/memory/4408-154-0x00007FF65D8D0000-0x00007FF65DCC2000-memory.dmp	upx
behavioral2/memory/1644-153-0x00007FF7CAAE0000-0x00007FF7CAED2000-memory.dmp	upx
behavioral2/memory/5992-150-0x00007FF680440000-0x00007FF680832000-memory.dmp	upx
behavioral2/memory/5896-147-0x00007FF6EE440000-0x00007FF6EE832000-memory.dmp	upx
behavioral2/memory/5948-143-0x00007FF68D8D0000-0x00007FF68DCC2000-memory.dmp	upx
behavioral2/memory/5380-132-0x00007FF7AF120000-0x00007FF7AF512000-memory.dmp	upx
behavioral2/files/0x000700000002327a-137.dat	upx
behavioral2/memory/5344-123-0x00007FF635010000-0x00007FF635402000-memory.dmp	upx
behavioral2/files/0x0007000000023275-114.dat	upx
behavioral2/memory/5340-112-0x00007FF7DE900000-0x00007FF7DECF2000-memory.dmp	upx
behavioral2/files/0x0007000000023277-108.dat	upx
behavioral2/memory/2616-105-0x00007FF79CC60000-0x00007FF79D052000-memory.dmp	upx
behavioral2/memory/5392-96-0x00007FF6CA340000-0x00007FF6CA732000-memory.dmp	upx
behavioral2/files/0x0007000000023273-95.dat	upx
behavioral2/memory/4252-79-0x00007FF7C14D0000-0x00007FF7C18C2000-memory.dmp	upx
behavioral2/memory/3548-78-0x00007FF6C5AC0000-0x00007FF6C5EB2000-memory.dmp	upx
behavioral2/memory/3204-72-0x00007FF7B7AD0000-0x00007FF7B7EC2000-memory.dmp	upx
behavioral2/files/0x0007000000023272-75.dat	upx
behavioral2/memory/1976-1989-0x00007FF70FA70000-0x00007FF70FE62000-memory.dmp	upx
behavioral2/memory/5392-2038-0x00007FF6CA340000-0x00007FF6CA732000-memory.dmp	upx
behavioral2/memory/3548-2033-0x00007FF6C5AC0000-0x00007FF6C5EB2000-memory.dmp	upx
behavioral2/memory/2616-2099-0x00007FF79CC60000-0x00007FF79D052000-memory.dmp	upx
behavioral2/memory/5760-2135-0x00007FF79FAA0000-0x00007FF79FE92000-memory.dmp	upx
behavioral2/memory/5992-2143-0x00007FF680440000-0x00007FF680832000-memory.dmp	upx
behavioral2/memory/4168-2144-0x00007FF75C350000-0x00007FF75C742000-memory.dmp	upx
behavioral2/memory/1644-2147-0x00007FF7CAAE0000-0x00007FF7CAED2000-memory.dmp	upx
behavioral2/memory/5516-2146-0x00007FF6C0C90000-0x00007FF6C1082000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\phSviKx.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\tgtIWLy.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\CYOUbsu.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\KNyptor.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\MrxyYAh.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\XEmpoAC.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\dVEjxWJ.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\PUooSzM.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\pSDTEgh.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\kaZgNBm.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\kwMqVnz.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\dtWQGon.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\fXevbCm.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\vzqkBqL.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\eczIVTO.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\XtdFsHH.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\VtizhSO.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\CQgPCKu.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\ctdleBf.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\yHYvZjt.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\tNNedbA.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\DNuBKdj.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\xzffuSD.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\DrrhluE.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\GeDsbRN.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\NMGdeZa.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\uvQCBaZ.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\CTxzdil.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\nywMvZt.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\dwOgfLq.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\mlqRRyG.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\IVpPusY.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\xuTsLhJ.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\afwfXlr.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\LTCdiOm.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\OZNstkj.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\uSJbYdr.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\zmRJRjP.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\nWjCxuN.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\dDNeXJJ.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\xcBRdoB.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\ftoFuqe.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\gIlELXT.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\BbboZtm.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\wYSECRp.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\EPopeSO.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\zzvDYzi.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\bTZHRtN.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\duGPVzg.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\VTzExFL.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\OhiiLZF.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\JLWgBlU.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\rOyvour.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\sCNetWU.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\vRQyoov.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\DUGooSR.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\Bcdthvf.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\asxFeml.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\xPIMsHg.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\KnTeQAE.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\SojiKLO.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\lOfxdAK.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\KjuBauI.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\HKYCVXO.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3236	powershell.exe
3236	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeLockMemoryPrivilege	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 3236	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	92
PID 4620 wrote to memory of 3236	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	92
PID 4620 wrote to memory of 2484	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	93
PID 4620 wrote to memory of 2484	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	93
PID 4620 wrote to memory of 1976	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	94
PID 4620 wrote to memory of 1976	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	94
PID 4620 wrote to memory of 3204	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	95
PID 4620 wrote to memory of 3204	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	95
PID 4620 wrote to memory of 3548	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	96
PID 4620 wrote to memory of 3548	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	96
PID 4620 wrote to memory of 4252	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	97
PID 4620 wrote to memory of 4252	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	97
PID 4620 wrote to memory of 5392	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	98
PID 4620 wrote to memory of 5392	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	98
PID 4620 wrote to memory of 5760	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	99
PID 4620 wrote to memory of 5760	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	99
PID 4620 wrote to memory of 1644	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	100
PID 4620 wrote to memory of 1644	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	100
PID 4620 wrote to memory of 2616	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	101
PID 4620 wrote to memory of 2616	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	101
PID 4620 wrote to memory of 5340	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	102
PID 4620 wrote to memory of 5340	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	102
PID 4620 wrote to memory of 5344	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	103
PID 4620 wrote to memory of 5344	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	103
PID 4620 wrote to memory of 5380	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	104
PID 4620 wrote to memory of 5380	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	104
PID 4620 wrote to memory of 5516	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	105
PID 4620 wrote to memory of 5516	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	105
PID 4620 wrote to memory of 4408	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	106
PID 4620 wrote to memory of 4408	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	106
PID 4620 wrote to memory of 4168	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	107
PID 4620 wrote to memory of 4168	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	107
PID 4620 wrote to memory of 3016	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	108
PID 4620 wrote to memory of 3016	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	108
PID 4620 wrote to memory of 5948	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	109
PID 4620 wrote to memory of 5948	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	109
PID 4620 wrote to memory of 5896	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	110
PID 4620 wrote to memory of 5896	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	110
PID 4620 wrote to memory of 5972	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	111
PID 4620 wrote to memory of 5972	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	111
PID 4620 wrote to memory of 5992	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	112
PID 4620 wrote to memory of 5992	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	112
PID 4620 wrote to memory of 2188	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	113
PID 4620 wrote to memory of 2188	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	113
PID 4620 wrote to memory of 2180	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	114
PID 4620 wrote to memory of 2180	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	114
PID 4620 wrote to memory of 5492	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	115
PID 4620 wrote to memory of 5492	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	115
PID 4620 wrote to memory of 1004	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	116
PID 4620 wrote to memory of 1004	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	116
PID 4620 wrote to memory of 4508	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	117
PID 4620 wrote to memory of 4508	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	117
PID 4620 wrote to memory of 4256	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	118
PID 4620 wrote to memory of 4256	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	118
PID 4620 wrote to memory of 2440	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	119
PID 4620 wrote to memory of 2440	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	119
PID 4620 wrote to memory of 2168	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	120
PID 4620 wrote to memory of 2168	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	120
PID 4620 wrote to memory of 3784	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	121
PID 4620 wrote to memory of 3784	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	121
PID 4620 wrote to memory of 4892	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	122
PID 4620 wrote to memory of 4892	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	122
PID 4620 wrote to memory of 988	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	123
PID 4620 wrote to memory of 988	4620	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3236
- C:\Windows\System\NMGdeZa.exe
  C:\Windows\System\NMGdeZa.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\PuEUVbH.exe
  C:\Windows\System\PuEUVbH.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\mwIipeO.exe
  C:\Windows\System\mwIipeO.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\AFTnqna.exe
  C:\Windows\System\AFTnqna.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\HQffxjI.exe
  C:\Windows\System\HQffxjI.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\sCNetWU.exe
  C:\Windows\System\sCNetWU.exe
  2⤵
  - Executes dropped EXE
  PID:5392
- C:\Windows\System\qveFlLR.exe
  C:\Windows\System\qveFlLR.exe
  2⤵
  - Executes dropped EXE
  PID:5760
- C:\Windows\System\KRqCtuK.exe
  C:\Windows\System\KRqCtuK.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\GaLgbqZ.exe
  C:\Windows\System\GaLgbqZ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\ftoFuqe.exe
  C:\Windows\System\ftoFuqe.exe
  2⤵
  - Executes dropped EXE
  PID:5340
- C:\Windows\System\OfkWBRA.exe
  C:\Windows\System\OfkWBRA.exe
  2⤵
  - Executes dropped EXE
  PID:5344
- C:\Windows\System\FgWZixl.exe
  C:\Windows\System\FgWZixl.exe
  2⤵
  - Executes dropped EXE
  PID:5380
- C:\Windows\System\XTQngXp.exe
  C:\Windows\System\XTQngXp.exe
  2⤵
  - Executes dropped EXE
  PID:5516
- C:\Windows\System\DwwRSoC.exe
  C:\Windows\System\DwwRSoC.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\GdZijVM.exe
  C:\Windows\System\GdZijVM.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\NTDDhpU.exe
  C:\Windows\System\NTDDhpU.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\hwfBeCc.exe
  C:\Windows\System\hwfBeCc.exe
  2⤵
  - Executes dropped EXE
  PID:5948
- C:\Windows\System\PUooSzM.exe
  C:\Windows\System\PUooSzM.exe
  2⤵
  - Executes dropped EXE
  PID:5896
- C:\Windows\System\OJOmvgf.exe
  C:\Windows\System\OJOmvgf.exe
  2⤵
  - Executes dropped EXE
  PID:5972
- C:\Windows\System\DALuOKO.exe
  C:\Windows\System\DALuOKO.exe
  2⤵
  - Executes dropped EXE
  PID:5992
- C:\Windows\System\BKnzKDJ.exe
  C:\Windows\System\BKnzKDJ.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\oaXHQiS.exe
  C:\Windows\System\oaXHQiS.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\UTUKsWO.exe
  C:\Windows\System\UTUKsWO.exe
  2⤵
  - Executes dropped EXE
  PID:5492
- C:\Windows\System\XtdFsHH.exe
  C:\Windows\System\XtdFsHH.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\FUaTfsu.exe
  C:\Windows\System\FUaTfsu.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\choXTHi.exe
  C:\Windows\System\choXTHi.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\DiTplmP.exe
  C:\Windows\System\DiTplmP.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\VWmfQNy.exe
  C:\Windows\System\VWmfQNy.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\QnTScLj.exe
  C:\Windows\System\QnTScLj.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\ymOmzFd.exe
  C:\Windows\System\ymOmzFd.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\OnREVAR.exe
  C:\Windows\System\OnREVAR.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\WQKNaqn.exe
  C:\Windows\System\WQKNaqn.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\PgztEjz.exe
  C:\Windows\System\PgztEjz.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\lLVSpGO.exe
  C:\Windows\System\lLVSpGO.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\EaAYKVB.exe
  C:\Windows\System\EaAYKVB.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\GyotcdC.exe
  C:\Windows\System\GyotcdC.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\iYUmJpr.exe
  C:\Windows\System\iYUmJpr.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\wnXuMWf.exe
  C:\Windows\System\wnXuMWf.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\VSAYrkP.exe
  C:\Windows\System\VSAYrkP.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\tTArQlB.exe
  C:\Windows\System\tTArQlB.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\AMzCYUB.exe
  C:\Windows\System\AMzCYUB.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\FXJpjqO.exe
  C:\Windows\System\FXJpjqO.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\hBfzATY.exe
  C:\Windows\System\hBfzATY.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\phSviKx.exe
  C:\Windows\System\phSviKx.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\xMcXvTi.exe
  C:\Windows\System\xMcXvTi.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\pSDTEgh.exe
  C:\Windows\System\pSDTEgh.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\csBSHrs.exe
  C:\Windows\System\csBSHrs.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\WBdRppt.exe
  C:\Windows\System\WBdRppt.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\YuvyPKR.exe
  C:\Windows\System\YuvyPKR.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\grprwmf.exe
  C:\Windows\System\grprwmf.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\hTLmOoz.exe
  C:\Windows\System\hTLmOoz.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\yvwvFYs.exe
  C:\Windows\System\yvwvFYs.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\RNNSMMp.exe
  C:\Windows\System\RNNSMMp.exe
  2⤵
  - Executes dropped EXE
  PID:6136
- C:\Windows\System\pxFoXZc.exe
  C:\Windows\System\pxFoXZc.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\fkNkRKv.exe
  C:\Windows\System\fkNkRKv.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\VtizhSO.exe
  C:\Windows\System\VtizhSO.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\BGdGcnm.exe
  C:\Windows\System\BGdGcnm.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\pgBumuC.exe
  C:\Windows\System\pgBumuC.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\esmNCzD.exe
  C:\Windows\System\esmNCzD.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\TvqlcfW.exe
  C:\Windows\System\TvqlcfW.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\BfDfFTL.exe
  C:\Windows\System\BfDfFTL.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\DCvSZNi.exe
  C:\Windows\System\DCvSZNi.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\MzYWRdA.exe
  C:\Windows\System\MzYWRdA.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\QgOnoQN.exe
  C:\Windows\System\QgOnoQN.exe
  2⤵
  - Executes dropped EXE
  PID:6008
- C:\Windows\System\rpfoFjc.exe
  C:\Windows\System\rpfoFjc.exe
  2⤵
  PID:2760
- C:\Windows\System\SCynNWS.exe
  C:\Windows\System\SCynNWS.exe
  2⤵
  PID:972
- C:\Windows\System\RPpMuVh.exe
  C:\Windows\System\RPpMuVh.exe
  2⤵
  PID:772
- C:\Windows\System\CHgTeyP.exe
  C:\Windows\System\CHgTeyP.exe
  2⤵
  PID:5308
- C:\Windows\System\wyoeIDN.exe
  C:\Windows\System\wyoeIDN.exe
  2⤵
  PID:5780
- C:\Windows\System\qIxGPaq.exe
  C:\Windows\System\qIxGPaq.exe
  2⤵
  PID:5320
- C:\Windows\System\uUFvIhp.exe
  C:\Windows\System\uUFvIhp.exe
  2⤵
  PID:5324
- C:\Windows\System\xhMGuru.exe
  C:\Windows\System\xhMGuru.exe
  2⤵
  PID:5960
- C:\Windows\System\LzjuSRu.exe
  C:\Windows\System\LzjuSRu.exe
  2⤵
  PID:5912
- C:\Windows\System\PcHGREo.exe
  C:\Windows\System\PcHGREo.exe
  2⤵
  PID:5488
- C:\Windows\System\DQRRGSv.exe
  C:\Windows\System\DQRRGSv.exe
  2⤵
  PID:3308
- C:\Windows\System\bRgslhQ.exe
  C:\Windows\System\bRgslhQ.exe
  2⤵
  PID:5496
- C:\Windows\System\RFpqmQT.exe
  C:\Windows\System\RFpqmQT.exe
  2⤵
  PID:5296
- C:\Windows\System\ulGSdoR.exe
  C:\Windows\System\ulGSdoR.exe
  2⤵
  PID:5616
- C:\Windows\System\mlqRRyG.exe
  C:\Windows\System\mlqRRyG.exe
  2⤵
  PID:4192
- C:\Windows\System\QqQrdCP.exe
  C:\Windows\System\QqQrdCP.exe
  2⤵
  PID:768
- C:\Windows\System\PatNsrs.exe
  C:\Windows\System\PatNsrs.exe
  2⤵
  PID:224
- C:\Windows\System\fkUaLcB.exe
  C:\Windows\System\fkUaLcB.exe
  2⤵
  PID:3520
- C:\Windows\System\ESnySfG.exe
  C:\Windows\System\ESnySfG.exe
  2⤵
  PID:2840
- C:\Windows\System\LoPKdiH.exe
  C:\Windows\System\LoPKdiH.exe
  2⤵
  PID:1164
- C:\Windows\System\JfskgML.exe
  C:\Windows\System\JfskgML.exe
  2⤵
  PID:3936
- C:\Windows\System\mpkLyac.exe
  C:\Windows\System\mpkLyac.exe
  2⤵
  PID:3332
- C:\Windows\System\leSrlVB.exe
  C:\Windows\System\leSrlVB.exe
  2⤵
  PID:5008
- C:\Windows\System\asxFeml.exe
  C:\Windows\System\asxFeml.exe
  2⤵
  PID:3108
- C:\Windows\System\zzvDYzi.exe
  C:\Windows\System\zzvDYzi.exe
  2⤵
  PID:3480
- C:\Windows\System\RYBwItD.exe
  C:\Windows\System\RYBwItD.exe
  2⤵
  PID:2344
- C:\Windows\System\GCjYnGq.exe
  C:\Windows\System\GCjYnGq.exe
  2⤵
  PID:4444
- C:\Windows\System\IVOIohj.exe
  C:\Windows\System\IVOIohj.exe
  2⤵
  PID:5124
- C:\Windows\System\ioZMbGW.exe
  C:\Windows\System\ioZMbGW.exe
  2⤵
  PID:4144
- C:\Windows\System\epuOuGz.exe
  C:\Windows\System\epuOuGz.exe
  2⤵
  PID:6140
- C:\Windows\System\ifDIIZs.exe
  C:\Windows\System\ifDIIZs.exe
  2⤵
  PID:1640
- C:\Windows\System\kFQHxnv.exe
  C:\Windows\System\kFQHxnv.exe
  2⤵
  PID:528
- C:\Windows\System\OdTUhRe.exe
  C:\Windows\System\OdTUhRe.exe
  2⤵
  PID:4356
- C:\Windows\System\vRQyoov.exe
  C:\Windows\System\vRQyoov.exe
  2⤵
  PID:4856
- C:\Windows\System\dTWbyNx.exe
  C:\Windows\System\dTWbyNx.exe
  2⤵
  PID:1820
- C:\Windows\System\dDNeXJJ.exe
  C:\Windows\System\dDNeXJJ.exe
  2⤵
  PID:4404
- C:\Windows\System\jdzslWI.exe
  C:\Windows\System\jdzslWI.exe
  2⤵
  PID:2220
- C:\Windows\System\DVXCFIt.exe
  C:\Windows\System\DVXCFIt.exe
  2⤵
  PID:532
- C:\Windows\System\EFpdLlO.exe
  C:\Windows\System\EFpdLlO.exe
  2⤵
  PID:4628
- C:\Windows\System\iYrJNEP.exe
  C:\Windows\System\iYrJNEP.exe
  2⤵
  PID:2016
- C:\Windows\System\pvUWQOl.exe
  C:\Windows\System\pvUWQOl.exe
  2⤵
  PID:5436
- C:\Windows\System\uMuWwAp.exe
  C:\Windows\System\uMuWwAp.exe
  2⤵
  PID:1448
- C:\Windows\System\DYTuLUr.exe
  C:\Windows\System\DYTuLUr.exe
  2⤵
  PID:5364
- C:\Windows\System\SIVgVtO.exe
  C:\Windows\System\SIVgVtO.exe
  2⤵
  PID:3272
- C:\Windows\System\lvVAdvx.exe
  C:\Windows\System\lvVAdvx.exe
  2⤵
  PID:2212
- C:\Windows\System\XVLTukD.exe
  C:\Windows\System\XVLTukD.exe
  2⤵
  PID:5916
- C:\Windows\System\yPltUiy.exe
  C:\Windows\System\yPltUiy.exe
  2⤵
  PID:4416
- C:\Windows\System\efhwaaE.exe
  C:\Windows\System\efhwaaE.exe
  2⤵
  PID:3208
- C:\Windows\System\LrUGDgh.exe
  C:\Windows\System\LrUGDgh.exe
  2⤵
  PID:3860
- C:\Windows\System\mBWrkda.exe
  C:\Windows\System\mBWrkda.exe
  2⤵
  PID:6024
- C:\Windows\System\opUrhUQ.exe
  C:\Windows\System\opUrhUQ.exe
  2⤵
  PID:2164
- C:\Windows\System\DbTLyhZ.exe
  C:\Windows\System\DbTLyhZ.exe
  2⤵
  PID:3884
- C:\Windows\System\xIVfUWX.exe
  C:\Windows\System\xIVfUWX.exe
  2⤵
  PID:4004
- C:\Windows\System\jENxHSb.exe
  C:\Windows\System\jENxHSb.exe
  2⤵
  PID:4668
- C:\Windows\System\LSQrKrt.exe
  C:\Windows\System\LSQrKrt.exe
  2⤵
  PID:4680
- C:\Windows\System\aRzliWK.exe
  C:\Windows\System\aRzliWK.exe
  2⤵
  PID:4520
- C:\Windows\System\bTZHRtN.exe
  C:\Windows\System\bTZHRtN.exe
  2⤵
  PID:4816
- C:\Windows\System\fuYQIjw.exe
  C:\Windows\System\fuYQIjw.exe
  2⤵
  PID:2036
- C:\Windows\System\tgtIWLy.exe
  C:\Windows\System\tgtIWLy.exe
  2⤵
  PID:2776
- C:\Windows\System\VMrEUfy.exe
  C:\Windows\System\VMrEUfy.exe
  2⤵
  PID:5956
- C:\Windows\System\RquHzJg.exe
  C:\Windows\System\RquHzJg.exe
  2⤵
  PID:3100
- C:\Windows\System\rbQkhFv.exe
  C:\Windows\System\rbQkhFv.exe
  2⤵
  PID:1732
- C:\Windows\System\CjBKOrY.exe
  C:\Windows\System\CjBKOrY.exe
  2⤵
  PID:4716
- C:\Windows\System\zkCAtWR.exe
  C:\Windows\System\zkCAtWR.exe
  2⤵
  PID:5084
- C:\Windows\System\QdPcAew.exe
  C:\Windows\System\QdPcAew.exe
  2⤵
  PID:5144
- C:\Windows\System\LZzNfaF.exe
  C:\Windows\System\LZzNfaF.exe
  2⤵
  PID:5292
- C:\Windows\System\tpHNdLH.exe
  C:\Windows\System\tpHNdLH.exe
  2⤵
  PID:4956
- C:\Windows\System\nUpZryv.exe
  C:\Windows\System\nUpZryv.exe
  2⤵
  PID:3080
- C:\Windows\System\lOSUNwy.exe
  C:\Windows\System\lOSUNwy.exe
  2⤵
  PID:4440
- C:\Windows\System\HuInGEY.exe
  C:\Windows\System\HuInGEY.exe
  2⤵
  PID:5528
- C:\Windows\System\EdIfgWP.exe
  C:\Windows\System\EdIfgWP.exe
  2⤵
  PID:4692
- C:\Windows\System\EXQhdTm.exe
  C:\Windows\System\EXQhdTm.exe
  2⤵
  PID:5768
- C:\Windows\System\LknsqGt.exe
  C:\Windows\System\LknsqGt.exe
  2⤵
  PID:2364
- C:\Windows\System\kcayDGj.exe
  C:\Windows\System\kcayDGj.exe
  2⤵
  PID:6148
- C:\Windows\System\ZWFQqDL.exe
  C:\Windows\System\ZWFQqDL.exe
  2⤵
  PID:6168
- C:\Windows\System\ESZHgbs.exe
  C:\Windows\System\ESZHgbs.exe
  2⤵
  PID:6192
- C:\Windows\System\oRDsXOQ.exe
  C:\Windows\System\oRDsXOQ.exe
  2⤵
  PID:6208
- C:\Windows\System\YqENEjD.exe
  C:\Windows\System\YqENEjD.exe
  2⤵
  PID:6248
- C:\Windows\System\lUSwoix.exe
  C:\Windows\System\lUSwoix.exe
  2⤵
  PID:6268
- C:\Windows\System\brfVjni.exe
  C:\Windows\System\brfVjni.exe
  2⤵
  PID:6284
- C:\Windows\System\gfaGkOd.exe
  C:\Windows\System\gfaGkOd.exe
  2⤵
  PID:6312
- C:\Windows\System\LTCdiOm.exe
  C:\Windows\System\LTCdiOm.exe
  2⤵
  PID:6332
- C:\Windows\System\uttJMRg.exe
  C:\Windows\System\uttJMRg.exe
  2⤵
  PID:6352
- C:\Windows\System\ptmnwUa.exe
  C:\Windows\System\ptmnwUa.exe
  2⤵
  PID:6372
- C:\Windows\System\JGTVlOF.exe
  C:\Windows\System\JGTVlOF.exe
  2⤵
  PID:6392
- C:\Windows\System\icQWKvl.exe
  C:\Windows\System\icQWKvl.exe
  2⤵
  PID:6416
- C:\Windows\System\QGflaxZ.exe
  C:\Windows\System\QGflaxZ.exe
  2⤵
  PID:6436
- C:\Windows\System\dtWQGon.exe
  C:\Windows\System\dtWQGon.exe
  2⤵
  PID:6456
- C:\Windows\System\MOVnppM.exe
  C:\Windows\System\MOVnppM.exe
  2⤵
  PID:6480
- C:\Windows\System\HlXhfyM.exe
  C:\Windows\System\HlXhfyM.exe
  2⤵
  PID:6500
- C:\Windows\System\txZzVKk.exe
  C:\Windows\System\txZzVKk.exe
  2⤵
  PID:6532
- C:\Windows\System\NplJwEW.exe
  C:\Windows\System\NplJwEW.exe
  2⤵
  PID:6548
- C:\Windows\System\BYhGhat.exe
  C:\Windows\System\BYhGhat.exe
  2⤵
  PID:6568
- C:\Windows\System\RMCemFz.exe
  C:\Windows\System\RMCemFz.exe
  2⤵
  PID:6596
- C:\Windows\System\EUwJjkF.exe
  C:\Windows\System\EUwJjkF.exe
  2⤵
  PID:6620
- C:\Windows\System\Xdcovtr.exe
  C:\Windows\System\Xdcovtr.exe
  2⤵
  PID:6640
- C:\Windows\System\RCTYKGr.exe
  C:\Windows\System\RCTYKGr.exe
  2⤵
  PID:6660
- C:\Windows\System\ltGiWBf.exe
  C:\Windows\System\ltGiWBf.exe
  2⤵
  PID:6684
- C:\Windows\System\IpdOcqR.exe
  C:\Windows\System\IpdOcqR.exe
  2⤵
  PID:6712
- C:\Windows\System\PtVYabp.exe
  C:\Windows\System\PtVYabp.exe
  2⤵
  PID:6732
- C:\Windows\System\NNgpgiR.exe
  C:\Windows\System\NNgpgiR.exe
  2⤵
  PID:6772
- C:\Windows\System\lPKUKTs.exe
  C:\Windows\System\lPKUKTs.exe
  2⤵
  PID:6788
- C:\Windows\System\iUyvgov.exe
  C:\Windows\System\iUyvgov.exe
  2⤵
  PID:6812
- C:\Windows\System\YeEaoCs.exe
  C:\Windows\System\YeEaoCs.exe
  2⤵
  PID:6832
- C:\Windows\System\ISOvcOP.exe
  C:\Windows\System\ISOvcOP.exe
  2⤵
  PID:6848
- C:\Windows\System\TsQtbjz.exe
  C:\Windows\System\TsQtbjz.exe
  2⤵
  PID:6884
- C:\Windows\System\NqaDUVz.exe
  C:\Windows\System\NqaDUVz.exe
  2⤵
  PID:6904
- C:\Windows\System\uvQCBaZ.exe
  C:\Windows\System\uvQCBaZ.exe
  2⤵
  PID:6928
- C:\Windows\System\mZIjlPc.exe
  C:\Windows\System\mZIjlPc.exe
  2⤵
  PID:6944
- C:\Windows\System\BMWMFSL.exe
  C:\Windows\System\BMWMFSL.exe
  2⤵
  PID:6964
- C:\Windows\System\WzxStrX.exe
  C:\Windows\System\WzxStrX.exe
  2⤵
  PID:6984
- C:\Windows\System\dPXOlOC.exe
  C:\Windows\System\dPXOlOC.exe
  2⤵
  PID:7008
- C:\Windows\System\OZNstkj.exe
  C:\Windows\System\OZNstkj.exe
  2⤵
  PID:7028
- C:\Windows\System\NtwjCJs.exe
  C:\Windows\System\NtwjCJs.exe
  2⤵
  PID:7052
- C:\Windows\System\EpvLOFc.exe
  C:\Windows\System\EpvLOFc.exe
  2⤵
  PID:7068
- C:\Windows\System\LgXgHIJ.exe
  C:\Windows\System\LgXgHIJ.exe
  2⤵
  PID:7092
- C:\Windows\System\iWaPKkF.exe
  C:\Windows\System\iWaPKkF.exe
  2⤵
  PID:7112
- C:\Windows\System\JLWgBlU.exe
  C:\Windows\System\JLWgBlU.exe
  2⤵
  PID:6616
- C:\Windows\System\ZzKsvPI.exe
  C:\Windows\System\ZzKsvPI.exe
  2⤵
  PID:6432
- C:\Windows\System\gINqqHR.exe
  C:\Windows\System\gINqqHR.exe
  2⤵
  PID:7088
- C:\Windows\System\CQgPCKu.exe
  C:\Windows\System\CQgPCKu.exe
  2⤵
  PID:7136
- C:\Windows\System\WeJohxd.exe
  C:\Windows\System\WeJohxd.exe
  2⤵
  PID:6592
- C:\Windows\System\duGPVzg.exe
  C:\Windows\System\duGPVzg.exe
  2⤵
  PID:5180
- C:\Windows\System\ZioEooP.exe
  C:\Windows\System\ZioEooP.exe
  2⤵
  PID:6912
- C:\Windows\System\DyemIfF.exe
  C:\Windows\System\DyemIfF.exe
  2⤵
  PID:7004
- C:\Windows\System\ZkyLSfK.exe
  C:\Windows\System\ZkyLSfK.exe
  2⤵
  PID:700
- C:\Windows\System\CYOUbsu.exe
  C:\Windows\System\CYOUbsu.exe
  2⤵
  PID:5632
- C:\Windows\System\qzAxQkc.exe
  C:\Windows\System\qzAxQkc.exe
  2⤵
  PID:4200
- C:\Windows\System\cenNXwq.exe
  C:\Windows\System\cenNXwq.exe
  2⤵
  PID:2192
- C:\Windows\System\HnFeNWv.exe
  C:\Windows\System\HnFeNWv.exe
  2⤵
  PID:6796
- C:\Windows\System\lMkBvml.exe
  C:\Windows\System\lMkBvml.exe
  2⤵
  PID:6920
- C:\Windows\System\uSJbYdr.exe
  C:\Windows\System\uSJbYdr.exe
  2⤵
  PID:7104
- C:\Windows\System\zxOspoH.exe
  C:\Windows\System\zxOspoH.exe
  2⤵
  PID:6824
- C:\Windows\System\SgoBaAx.exe
  C:\Windows\System\SgoBaAx.exe
  2⤵
  PID:6940
- C:\Windows\System\VqDDVIv.exe
  C:\Windows\System\VqDDVIv.exe
  2⤵
  PID:6412
- C:\Windows\System\sPCsIsl.exe
  C:\Windows\System\sPCsIsl.exe
  2⤵
  PID:7172
- C:\Windows\System\BpGfChe.exe
  C:\Windows\System\BpGfChe.exe
  2⤵
  PID:7188
- C:\Windows\System\KTcxzNt.exe
  C:\Windows\System\KTcxzNt.exe
  2⤵
  PID:7212
- C:\Windows\System\IjmJBkS.exe
  C:\Windows\System\IjmJBkS.exe
  2⤵
  PID:7232
- C:\Windows\System\DUGooSR.exe
  C:\Windows\System\DUGooSR.exe
  2⤵
  PID:7248
- C:\Windows\System\TDjNmwV.exe
  C:\Windows\System\TDjNmwV.exe
  2⤵
  PID:7272
- C:\Windows\System\hfhUPsW.exe
  C:\Windows\System\hfhUPsW.exe
  2⤵
  PID:7292
- C:\Windows\System\XEmpoAC.exe
  C:\Windows\System\XEmpoAC.exe
  2⤵
  PID:7320
- C:\Windows\System\gWcXAgc.exe
  C:\Windows\System\gWcXAgc.exe
  2⤵
  PID:7336
- C:\Windows\System\AJvYzDE.exe
  C:\Windows\System\AJvYzDE.exe
  2⤵
  PID:7364
- C:\Windows\System\AzVCUwa.exe
  C:\Windows\System\AzVCUwa.exe
  2⤵
  PID:7384
- C:\Windows\System\kKUvhkC.exe
  C:\Windows\System\kKUvhkC.exe
  2⤵
  PID:7404
- C:\Windows\System\KmFNANK.exe
  C:\Windows\System\KmFNANK.exe
  2⤵
  PID:7420
- C:\Windows\System\rGPZRnn.exe
  C:\Windows\System\rGPZRnn.exe
  2⤵
  PID:7440
- C:\Windows\System\hDVZSLm.exe
  C:\Windows\System\hDVZSLm.exe
  2⤵
  PID:7464
- C:\Windows\System\CNnggAz.exe
  C:\Windows\System\CNnggAz.exe
  2⤵
  PID:7484
- C:\Windows\System\tNNedbA.exe
  C:\Windows\System\tNNedbA.exe
  2⤵
  PID:7508
- C:\Windows\System\DNuBKdj.exe
  C:\Windows\System\DNuBKdj.exe
  2⤵
  PID:7532
- C:\Windows\System\GATZRoB.exe
  C:\Windows\System\GATZRoB.exe
  2⤵
  PID:7548
- C:\Windows\System\xKMGVva.exe
  C:\Windows\System\xKMGVva.exe
  2⤵
  PID:7568
- C:\Windows\System\RkEoxsi.exe
  C:\Windows\System\RkEoxsi.exe
  2⤵
  PID:7584
- C:\Windows\System\JtGPlGE.exe
  C:\Windows\System\JtGPlGE.exe
  2⤵
  PID:7604
- C:\Windows\System\iklMvbQ.exe
  C:\Windows\System\iklMvbQ.exe
  2⤵
  PID:7624
- C:\Windows\System\yIgXrir.exe
  C:\Windows\System\yIgXrir.exe
  2⤵
  PID:7648
- C:\Windows\System\eCRkUby.exe
  C:\Windows\System\eCRkUby.exe
  2⤵
  PID:7668
- C:\Windows\System\abfiodl.exe
  C:\Windows\System\abfiodl.exe
  2⤵
  PID:7692
- C:\Windows\System\JbJpPjT.exe
  C:\Windows\System\JbJpPjT.exe
  2⤵
  PID:7708
- C:\Windows\System\KiGkxbt.exe
  C:\Windows\System\KiGkxbt.exe
  2⤵
  PID:7732
- C:\Windows\System\gXxrODe.exe
  C:\Windows\System\gXxrODe.exe
  2⤵
  PID:7752
- C:\Windows\System\IKnWxjV.exe
  C:\Windows\System\IKnWxjV.exe
  2⤵
  PID:7772
- C:\Windows\System\mVdewoa.exe
  C:\Windows\System\mVdewoa.exe
  2⤵
  PID:7792
- C:\Windows\System\CsvCZpy.exe
  C:\Windows\System\CsvCZpy.exe
  2⤵
  PID:7812
- C:\Windows\System\uTSCldt.exe
  C:\Windows\System\uTSCldt.exe
  2⤵
  PID:7832
- C:\Windows\System\KNyptor.exe
  C:\Windows\System\KNyptor.exe
  2⤵
  PID:7848
- C:\Windows\System\JqdEMNs.exe
  C:\Windows\System\JqdEMNs.exe
  2⤵
  PID:7868
- C:\Windows\System\wNSIgPW.exe
  C:\Windows\System\wNSIgPW.exe
  2⤵
  PID:7888
- C:\Windows\System\BzbpNJt.exe
  C:\Windows\System\BzbpNJt.exe
  2⤵
  PID:7908
- C:\Windows\System\gsVSszL.exe
  C:\Windows\System\gsVSszL.exe
  2⤵
  PID:7928
- C:\Windows\System\JgpWlmt.exe
  C:\Windows\System\JgpWlmt.exe
  2⤵
  PID:7952
- C:\Windows\System\FzJbDeI.exe
  C:\Windows\System\FzJbDeI.exe
  2⤵
  PID:8008
- C:\Windows\System\CNKbrMN.exe
  C:\Windows\System\CNKbrMN.exe
  2⤵
  PID:8032
- C:\Windows\System\eTazXyz.exe
  C:\Windows\System\eTazXyz.exe
  2⤵
  PID:8056
- C:\Windows\System\cWFKvVO.exe
  C:\Windows\System\cWFKvVO.exe
  2⤵
  PID:8076
- C:\Windows\System\xzffuSD.exe
  C:\Windows\System\xzffuSD.exe
  2⤵
  PID:8096
- C:\Windows\System\dpGrdOW.exe
  C:\Windows\System\dpGrdOW.exe
  2⤵
  PID:8112
- C:\Windows\System\PGtCLFu.exe
  C:\Windows\System\PGtCLFu.exe
  2⤵
  PID:8128
- C:\Windows\System\ZWZkzWb.exe
  C:\Windows\System\ZWZkzWb.exe
  2⤵
  PID:8148
- C:\Windows\System\KwZthVV.exe
  C:\Windows\System\KwZthVV.exe
  2⤵
  PID:8168
- C:\Windows\System\ysZdwUw.exe
  C:\Windows\System\ysZdwUw.exe
  2⤵
  PID:8184
- C:\Windows\System\BGObkRQ.exe
  C:\Windows\System\BGObkRQ.exe
  2⤵
  PID:6892
- C:\Windows\System\lUozgGR.exe
  C:\Windows\System\lUozgGR.exe
  2⤵
  PID:4492
- C:\Windows\System\JuUkGky.exe
  C:\Windows\System\JuUkGky.exe
  2⤵
  PID:6956
- C:\Windows\System\dUhRqoS.exe
  C:\Windows\System\dUhRqoS.exe
  2⤵
  PID:6724
- C:\Windows\System\FFAsDlJ.exe
  C:\Windows\System\FFAsDlJ.exe
  2⤵
  PID:6700
- C:\Windows\System\BCDkHkq.exe
  C:\Windows\System\BCDkHkq.exe
  2⤵
  PID:7208
- C:\Windows\System\MgnPhGx.exe
  C:\Windows\System\MgnPhGx.exe
  2⤵
  PID:7308
- C:\Windows\System\ZXMxqGg.exe
  C:\Windows\System\ZXMxqGg.exe
  2⤵
  PID:7036
- C:\Windows\System\rnmzfgJ.exe
  C:\Windows\System\rnmzfgJ.exe
  2⤵
  PID:6632
- C:\Windows\System\RSVzgmF.exe
  C:\Windows\System\RSVzgmF.exe
  2⤵
  PID:7380
- C:\Windows\System\yypNbpa.exe
  C:\Windows\System\yypNbpa.exe
  2⤵
  PID:5476
- C:\Windows\System\QUFbvWS.exe
  C:\Windows\System\QUFbvWS.exe
  2⤵
  PID:7576
- C:\Windows\System\qpXUAlD.exe
  C:\Windows\System\qpXUAlD.exe
  2⤵
  PID:7064
- C:\Windows\System\oOqYSzD.exe
  C:\Windows\System\oOqYSzD.exe
  2⤵
  PID:7700
- C:\Windows\System\JYFNyUU.exe
  C:\Windows\System\JYFNyUU.exe
  2⤵
  PID:7820
- C:\Windows\System\NdFNFBo.exe
  C:\Windows\System\NdFNFBo.exe
  2⤵
  PID:7456
- C:\Windows\System\WukcPPl.exe
  C:\Windows\System\WukcPPl.exe
  2⤵
  PID:7492
- C:\Windows\System\oonnKcu.exe
  C:\Windows\System\oonnKcu.exe
  2⤵
  PID:7528
- C:\Windows\System\rRxBipx.exe
  C:\Windows\System\rRxBipx.exe
  2⤵
  PID:7544
- C:\Windows\System\pBbxgdl.exe
  C:\Windows\System\pBbxgdl.exe
  2⤵
  PID:7556
- C:\Windows\System\HfYZted.exe
  C:\Windows\System\HfYZted.exe
  2⤵
  PID:7964
- C:\Windows\System\wBGojba.exe
  C:\Windows\System\wBGojba.exe
  2⤵
  PID:7280
- C:\Windows\System\HfGsIgh.exe
  C:\Windows\System\HfGsIgh.exe
  2⤵
  PID:7704
- C:\Windows\System\EvyXvFz.exe
  C:\Windows\System\EvyXvFz.exe
  2⤵
  PID:7400
- C:\Windows\System\injjUew.exe
  C:\Windows\System\injjUew.exe
  2⤵
  PID:7828
- C:\Windows\System\ZqSKMWe.exe
  C:\Windows\System\ZqSKMWe.exe
  2⤵
  PID:8196
- C:\Windows\System\DFtcIjU.exe
  C:\Windows\System\DFtcIjU.exe
  2⤵
  PID:8220
- C:\Windows\System\xPIMsHg.exe
  C:\Windows\System\xPIMsHg.exe
  2⤵
  PID:8236
- C:\Windows\System\cldDrlk.exe
  C:\Windows\System\cldDrlk.exe
  2⤵
  PID:8256
- C:\Windows\System\yDAhOVO.exe
  C:\Windows\System\yDAhOVO.exe
  2⤵
  PID:8280
- C:\Windows\System\iIHwbJz.exe
  C:\Windows\System\iIHwbJz.exe
  2⤵
  PID:8296
- C:\Windows\System\uOKTLut.exe
  C:\Windows\System\uOKTLut.exe
  2⤵
  PID:8312
- C:\Windows\System\JZigoLQ.exe
  C:\Windows\System\JZigoLQ.exe
  2⤵
  PID:8336
- C:\Windows\System\yFsMydJ.exe
  C:\Windows\System\yFsMydJ.exe
  2⤵
  PID:8356
- C:\Windows\System\NFBjgXc.exe
  C:\Windows\System\NFBjgXc.exe
  2⤵
  PID:8376
- C:\Windows\System\YgDQzTk.exe
  C:\Windows\System\YgDQzTk.exe
  2⤵
  PID:8396
- C:\Windows\System\dxRjkue.exe
  C:\Windows\System\dxRjkue.exe
  2⤵
  PID:8412
- C:\Windows\System\yzELUKH.exe
  C:\Windows\System\yzELUKH.exe
  2⤵
  PID:8432
- C:\Windows\System\mlJzrFj.exe
  C:\Windows\System\mlJzrFj.exe
  2⤵
  PID:8456
- C:\Windows\System\GeDsbRN.exe
  C:\Windows\System\GeDsbRN.exe
  2⤵
  PID:8476
- C:\Windows\System\ScWAGih.exe
  C:\Windows\System\ScWAGih.exe
  2⤵
  PID:8496
- C:\Windows\System\MrpPKhr.exe
  C:\Windows\System\MrpPKhr.exe
  2⤵
  PID:8520
- C:\Windows\System\xcBRdoB.exe
  C:\Windows\System\xcBRdoB.exe
  2⤵
  PID:8536
- C:\Windows\System\PZJsOdJ.exe
  C:\Windows\System\PZJsOdJ.exe
  2⤵
  PID:8560
- C:\Windows\System\TxvBhgh.exe
  C:\Windows\System\TxvBhgh.exe
  2⤵
  PID:8580
- C:\Windows\System\BXYaXYN.exe
  C:\Windows\System\BXYaXYN.exe
  2⤵
  PID:8604
- C:\Windows\System\NnrXuNK.exe
  C:\Windows\System\NnrXuNK.exe
  2⤵
  PID:8628
- C:\Windows\System\xrDNZoW.exe
  C:\Windows\System\xrDNZoW.exe
  2⤵
  PID:8648
- C:\Windows\System\GFPgWZg.exe
  C:\Windows\System\GFPgWZg.exe
  2⤵
  PID:8668
- C:\Windows\System\MNfSZAa.exe
  C:\Windows\System\MNfSZAa.exe
  2⤵
  PID:8692
- C:\Windows\System\Yvvcicg.exe
  C:\Windows\System\Yvvcicg.exe
  2⤵
  PID:7180
- C:\Windows\System\KjuBauI.exe
  C:\Windows\System\KjuBauI.exe
  2⤵
  PID:7664
- C:\Windows\System\mFDfpXt.exe
  C:\Windows\System\mFDfpXt.exe
  2⤵
  PID:7768
- C:\Windows\System\UHERScN.exe
  C:\Windows\System\UHERScN.exe
  2⤵
  PID:8592
- C:\Windows\System\KmkSCTY.exe
  C:\Windows\System\KmkSCTY.exe
  2⤵
  PID:8660
- C:\Windows\System\rZvfwVf.exe
  C:\Windows\System\rZvfwVf.exe
  2⤵
  PID:5512
- C:\Windows\System\ihinCnI.exe
  C:\Windows\System\ihinCnI.exe
  2⤵
  PID:8052
- C:\Windows\System\QynfnNI.exe
  C:\Windows\System\QynfnNI.exe
  2⤵
  PID:8232
- C:\Windows\System\THlWArv.exe
  C:\Windows\System\THlWArv.exe
  2⤵
  PID:8988
- C:\Windows\System\CeoTYVY.exe
  C:\Windows\System\CeoTYVY.exe
  2⤵
  PID:8364
- C:\Windows\System\SgOkjvf.exe
  C:\Windows\System\SgOkjvf.exe
  2⤵
  PID:8820
- C:\Windows\System\ctdleBf.exe
  C:\Windows\System\ctdleBf.exe
  2⤵
  PID:8504
- C:\Windows\System\ymLMQdX.exe
  C:\Windows\System\ymLMQdX.exe
  2⤵
  PID:9064
- C:\Windows\System\VTzExFL.exe
  C:\Windows\System\VTzExFL.exe
  2⤵
  PID:9120
- C:\Windows\System\GDhAHyf.exe
  C:\Windows\System\GDhAHyf.exe
  2⤵
  PID:8656
- C:\Windows\System\VYwSmcW.exe
  C:\Windows\System\VYwSmcW.exe
  2⤵
  PID:8724
- C:\Windows\System\VAMBmUj.exe
  C:\Windows\System\VAMBmUj.exe
  2⤵
  PID:8488
- C:\Windows\System\qlpkklK.exe
  C:\Windows\System\qlpkklK.exe
  2⤵
  PID:8004
- C:\Windows\System\HKYCVXO.exe
  C:\Windows\System\HKYCVXO.exe
  2⤵
  PID:8136
- C:\Windows\System\VMcZgGM.exe
  C:\Windows\System\VMcZgGM.exe
  2⤵
  PID:8332
- C:\Windows\System\NdfbEPK.exe
  C:\Windows\System\NdfbEPK.exe
  2⤵
  PID:8572
- C:\Windows\System\aiGAmdi.exe
  C:\Windows\System\aiGAmdi.exe
  2⤵
  PID:8976
- C:\Windows\System\wEmqcKF.exe
  C:\Windows\System\wEmqcKF.exe
  2⤵
  PID:9028
- C:\Windows\System\fXevbCm.exe
  C:\Windows\System\fXevbCm.exe
  2⤵
  PID:7344
- C:\Windows\System\IVpPusY.exe
  C:\Windows\System\IVpPusY.exe
  2⤵
  PID:9212
- C:\Windows\System\kaZgNBm.exe
  C:\Windows\System\kaZgNBm.exe
  2⤵
  PID:8268
- C:\Windows\System\NDGktGT.exe
  C:\Windows\System\NDGktGT.exe
  2⤵
  PID:6844
- C:\Windows\System\gIlELXT.exe
  C:\Windows\System\gIlELXT.exe
  2⤵
  PID:5936
- C:\Windows\System\nZXkALT.exe
  C:\Windows\System\nZXkALT.exe
  2⤵
  PID:9236
- C:\Windows\System\yZGiUCj.exe
  C:\Windows\System\yZGiUCj.exe
  2⤵
  PID:9252
- C:\Windows\System\yQrNZaJ.exe
  C:\Windows\System\yQrNZaJ.exe
  2⤵
  PID:9272
- C:\Windows\System\zHQQomT.exe
  C:\Windows\System\zHQQomT.exe
  2⤵
  PID:9288
- C:\Windows\System\zmRJRjP.exe
  C:\Windows\System\zmRJRjP.exe
  2⤵
  PID:9312
- C:\Windows\System\BbboZtm.exe
  C:\Windows\System\BbboZtm.exe
  2⤵
  PID:9344
- C:\Windows\System\IinYVct.exe
  C:\Windows\System\IinYVct.exe
  2⤵
  PID:9364
- C:\Windows\System\KnTeQAE.exe
  C:\Windows\System\KnTeQAE.exe
  2⤵
  PID:9384
- C:\Windows\System\CTxzdil.exe
  C:\Windows\System\CTxzdil.exe
  2⤵
  PID:9408
- C:\Windows\System\eOevBuw.exe
  C:\Windows\System\eOevBuw.exe
  2⤵
  PID:9436
- C:\Windows\System\PFHodUO.exe
  C:\Windows\System\PFHodUO.exe
  2⤵
  PID:9456
- C:\Windows\System\MrxyYAh.exe
  C:\Windows\System\MrxyYAh.exe
  2⤵
  PID:9472
- C:\Windows\System\biwUOmF.exe
  C:\Windows\System\biwUOmF.exe
  2⤵
  PID:9496
- C:\Windows\System\McvUBgj.exe
  C:\Windows\System\McvUBgj.exe
  2⤵
  PID:9524
- C:\Windows\System\DyxdsPY.exe
  C:\Windows\System\DyxdsPY.exe
  2⤵
  PID:9540
- C:\Windows\System\OmwnDVf.exe
  C:\Windows\System\OmwnDVf.exe
  2⤵
  PID:9560
- C:\Windows\System\twvJegg.exe
  C:\Windows\System\twvJegg.exe
  2⤵
  PID:9580
- C:\Windows\System\nywMvZt.exe
  C:\Windows\System\nywMvZt.exe
  2⤵
  PID:9600
- C:\Windows\System\dwOgfLq.exe
  C:\Windows\System\dwOgfLq.exe
  2⤵
  PID:9628
- C:\Windows\System\udEWxHN.exe
  C:\Windows\System\udEWxHN.exe
  2⤵
  PID:9644
- C:\Windows\System\yHYvZjt.exe
  C:\Windows\System\yHYvZjt.exe
  2⤵
  PID:9664
- C:\Windows\System\Bcdthvf.exe
  C:\Windows\System\Bcdthvf.exe
  2⤵
  PID:9688
- C:\Windows\System\CfZytOE.exe
  C:\Windows\System\CfZytOE.exe
  2⤵
  PID:9708
- C:\Windows\System\VrGyycw.exe
  C:\Windows\System\VrGyycw.exe
  2⤵
  PID:9732
- C:\Windows\System\oSVjUrV.exe
  C:\Windows\System\oSVjUrV.exe
  2⤵
  PID:9756
- C:\Windows\System\fbACpkw.exe
  C:\Windows\System\fbACpkw.exe
  2⤵
  PID:9776
- C:\Windows\System\sdpQJZa.exe
  C:\Windows\System\sdpQJZa.exe
  2⤵
  PID:9796
- C:\Windows\System\xWbRcfq.exe
  C:\Windows\System\xWbRcfq.exe
  2⤵
  PID:9824
- C:\Windows\System\ZFFFwFA.exe
  C:\Windows\System\ZFFFwFA.exe
  2⤵
  PID:9840
- C:\Windows\System\VnMZcRm.exe
  C:\Windows\System\VnMZcRm.exe
  2⤵
  PID:9864
- C:\Windows\System\mDZATpA.exe
  C:\Windows\System\mDZATpA.exe
  2⤵
  PID:9880
- C:\Windows\System\OJWXyBd.exe
  C:\Windows\System\OJWXyBd.exe
  2⤵
  PID:9904
- C:\Windows\System\vzqkBqL.exe
  C:\Windows\System\vzqkBqL.exe
  2⤵
  PID:9924
- C:\Windows\System\kEsDUrO.exe
  C:\Windows\System\kEsDUrO.exe
  2⤵
  PID:9944
- C:\Windows\System\ZELkUPD.exe
  C:\Windows\System\ZELkUPD.exe
  2⤵
  PID:9964
- C:\Windows\System\rbubAHn.exe
  C:\Windows\System\rbubAHn.exe
  2⤵
  PID:9984
- C:\Windows\System\cXynrZy.exe
  C:\Windows\System\cXynrZy.exe
  2⤵
  PID:10000
- C:\Windows\System\afwfXlr.exe
  C:\Windows\System\afwfXlr.exe
  2⤵
  PID:10020
- C:\Windows\System\JJrIxjD.exe
  C:\Windows\System\JJrIxjD.exe
  2⤵
  PID:10040
- C:\Windows\System\BTTJrsy.exe
  C:\Windows\System\BTTJrsy.exe
  2⤵
  PID:10064
- C:\Windows\System\nWjCxuN.exe
  C:\Windows\System\nWjCxuN.exe
  2⤵
  PID:7048
- C:\Windows\System\ZHObPeY.exe
  C:\Windows\System\ZHObPeY.exe
  2⤵
  PID:7476
- C:\Windows\System\kMaABVb.exe
  C:\Windows\System\kMaABVb.exe
  2⤵
  PID:9020
- C:\Windows\System\wYSECRp.exe
  C:\Windows\System\wYSECRp.exe
  2⤵
  PID:6132
- C:\Windows\System\lqNARwe.exe
  C:\Windows\System\lqNARwe.exe
  2⤵
  PID:7516
- C:\Windows\System\uPTnbjw.exe
  C:\Windows\System\uPTnbjw.exe
  2⤵
  PID:9036
- C:\Windows\System\kcEeVBk.exe
  C:\Windows\System\kcEeVBk.exe
  2⤵
  PID:8544
- C:\Windows\System\dVEjxWJ.exe
  C:\Windows\System\dVEjxWJ.exe
  2⤵
  PID:8164
- C:\Windows\System\UPgboLn.exe
  C:\Windows\System\UPgboLn.exe
  2⤵
  PID:9004
- C:\Windows\System\wESCQCt.exe
  C:\Windows\System\wESCQCt.exe
  2⤵
  PID:9448
- C:\Windows\System\asLXGdd.exe
  C:\Windows\System\asLXGdd.exe
  2⤵
  PID:9228
- C:\Windows\System\xXGHOOB.exe
  C:\Windows\System\xXGHOOB.exe
  2⤵
  PID:9268
- C:\Windows\System\bxdFdEN.exe
  C:\Windows\System\bxdFdEN.exe
  2⤵
  PID:6128
- C:\Windows\System\zvdgWxd.exe
  C:\Windows\System\zvdgWxd.exe
  2⤵
  PID:9380
- C:\Windows\System\mxdWONh.exe
  C:\Windows\System\mxdWONh.exe
  2⤵
  PID:9416
- C:\Windows\System\zBAzKfn.exe
  C:\Windows\System\zBAzKfn.exe
  2⤵
  PID:6740
- C:\Windows\System\xuTsLhJ.exe
  C:\Windows\System\xuTsLhJ.exe
  2⤵
  PID:9592
- C:\Windows\System\PrtatHB.exe
  C:\Windows\System\PrtatHB.exe
  2⤵
  PID:9304
- C:\Windows\System\wSUjSGD.exe
  C:\Windows\System\wSUjSGD.exe
  2⤵
  PID:9804
- C:\Windows\System\yLdJUqr.exe
  C:\Windows\System\yLdJUqr.exe
  2⤵
  PID:10208
- C:\Windows\System\CjuZQjU.exe
  C:\Windows\System\CjuZQjU.exe
  2⤵
  PID:9480
- C:\Windows\System\kwMqVnz.exe
  C:\Windows\System\kwMqVnz.exe
  2⤵
  PID:9512
- C:\Windows\System\RYPaFny.exe
  C:\Windows\System\RYPaFny.exe
  2⤵
  PID:10236
- C:\Windows\System\DrrhluE.exe
  C:\Windows\System\DrrhluE.exe
  2⤵
  PID:9608
- C:\Windows\System\IPFUHMf.exe
  C:\Windows\System\IPFUHMf.exe
  2⤵
  PID:9656
- C:\Windows\System\vzBmOLp.exe
  C:\Windows\System\vzBmOLp.exe
  2⤵
  PID:9696
- C:\Windows\System\QhYsPcO.exe
  C:\Windows\System\QhYsPcO.exe
  2⤵
  PID:9716
- C:\Windows\System\TsexYtU.exe
  C:\Windows\System\TsexYtU.exe
  2⤵
  PID:9808
- C:\Windows\System\wpzgcQB.exe
  C:\Windows\System\wpzgcQB.exe
  2⤵
  PID:10264
- C:\Windows\System\BhDYPbE.exe
  C:\Windows\System\BhDYPbE.exe
  2⤵
  PID:10280
- C:\Windows\System\ZCITFzJ.exe
  C:\Windows\System\ZCITFzJ.exe
  2⤵
  PID:10300
- C:\Windows\System\LQDlSzw.exe
  C:\Windows\System\LQDlSzw.exe
  2⤵
  PID:10316
- C:\Windows\System\grTvSqT.exe
  C:\Windows\System\grTvSqT.exe
  2⤵
  PID:10340
- C:\Windows\System\obkKSAu.exe
  C:\Windows\System\obkKSAu.exe
  2⤵
  PID:10356
- C:\Windows\System\SojiKLO.exe
  C:\Windows\System\SojiKLO.exe
  2⤵
  PID:10384
- C:\Windows\System\OmRgliY.exe
  C:\Windows\System\OmRgliY.exe
  2⤵
  PID:10404
- C:\Windows\System\vdoYOil.exe
  C:\Windows\System\vdoYOil.exe
  2⤵
  PID:10616
- C:\Windows\System\QVBFKPk.exe
  C:\Windows\System\QVBFKPk.exe
  2⤵
  PID:10868
- C:\Windows\System\OhiiLZF.exe
  C:\Windows\System\OhiiLZF.exe
  2⤵
  PID:10892
- C:\Windows\System\lOfxdAK.exe
  C:\Windows\System\lOfxdAK.exe
  2⤵
  PID:10912
- C:\Windows\System\rQnLGVv.exe
  C:\Windows\System\rQnLGVv.exe
  2⤵
  PID:10928
- C:\Windows\System\VgYPlEl.exe
  C:\Windows\System\VgYPlEl.exe
  2⤵
  PID:11168
- C:\Windows\System\UcGhbJf.exe
  C:\Windows\System\UcGhbJf.exe
  2⤵
  PID:11184
- C:\Windows\System\mCofXdt.exe
  C:\Windows\System\mCofXdt.exe
  2⤵
  PID:11208
- C:\Windows\System\cKQftQS.exe
  C:\Windows\System\cKQftQS.exe
  2⤵
  PID:8960
- C:\Windows\System\BoDjkeI.exe
  C:\Windows\System\BoDjkeI.exe
  2⤵
  PID:9912
- C:\Windows\System\TfPwNTC.exe
  C:\Windows\System\TfPwNTC.exe
  2⤵
  PID:9960
- C:\Windows\System\KjNzpky.exe
  C:\Windows\System\KjNzpky.exe
  2⤵
  PID:10028
- C:\Windows\System\FHApNaI.exe
  C:\Windows\System\FHApNaI.exe
  2⤵
  PID:10072
- C:\Windows\System\oHygFCa.exe
  C:\Windows\System\oHygFCa.exe
  2⤵
  PID:10096
- C:\Windows\System\CiHhRCR.exe
  C:\Windows\System\CiHhRCR.exe
  2⤵
  PID:10140
- C:\Windows\System\GeTNkNh.exe
  C:\Windows\System\GeTNkNh.exe
  2⤵
  PID:8452
- C:\Windows\System\eczIVTO.exe
  C:\Windows\System\eczIVTO.exe
  2⤵
  PID:10192
- C:\Windows\System\ZpbYhrp.exe
  C:\Windows\System\ZpbYhrp.exe
  2⤵
  PID:9468
- C:\Windows\System\nuZSlCU.exe
  C:\Windows\System\nuZSlCU.exe
  2⤵
  PID:7716
- C:\Windows\System\zEcAiZv.exe
  C:\Windows\System\zEcAiZv.exe
  2⤵
  PID:7332
- C:\Windows\System\rOyvour.exe
  C:\Windows\System\rOyvour.exe
  2⤵
  PID:10336
- C:\Windows\System\EPopeSO.exe
  C:\Windows\System\EPopeSO.exe
  2⤵
  PID:9320
- C:\Windows\System\zUzdroT.exe
  C:\Windows\System\zUzdroT.exe
  2⤵
  PID:9520
- C:\Windows\System\WUPbNST.exe
  C:\Windows\System\WUPbNST.exe
  2⤵
  PID:10164
- C:\Windows\System\NAjynvg.exe
  C:\Windows\System\NAjynvg.exe
  2⤵
  PID:9772
- C:\Windows\System\ZeNpFSV.exe
  C:\Windows\System\ZeNpFSV.exe
  2⤵
  PID:9836
- C:\Windows\System\dbdQwrg.exe
  C:\Windows\System\dbdQwrg.exe
  2⤵
  PID:10288
- C:\Windows\System\dTNqZGw.exe
  C:\Windows\System\dTNqZGw.exe
  2⤵
  PID:10332
- C:\Windows\System\hyWPdbc.exe
  C:\Windows\System\hyWPdbc.exe
  2⤵
  PID:10964
- C:\Windows\System\fLuBpjd.exe
  C:\Windows\System\fLuBpjd.exe
  2⤵
  PID:10856
- C:\Windows\System\FGRqdGf.exe
  C:\Windows\System\FGRqdGf.exe
  2⤵
  PID:11196
- C:\Windows\System\aMzxTde.exe
  C:\Windows\System\aMzxTde.exe
  2⤵
  PID:11004
- C:\Windows\System\bayAxig.exe
  C:\Windows\System\bayAxig.exe
  2⤵
  PID:11048
- C:\Windows\System\oIBNnDa.exe
  C:\Windows\System\oIBNnDa.exe
  2⤵
  PID:10852
- C:\Windows\System\gycSebk.exe
  C:\Windows\System\gycSebk.exe
  2⤵
  PID:11176
- C:\Windows\System\tEjuSpR.exe
  C:\Windows\System\tEjuSpR.exe
  2⤵
  PID:11148
- C:\Windows\System\ZFSAYbJ.exe
  C:\Windows\System\ZFSAYbJ.exe
  2⤵
  PID:8492
- C:\Windows\System\ZvrLujL.exe
  C:\Windows\System\ZvrLujL.exe
  2⤵
  PID:7428
- C:\Windows\System\oyhaOik.exe
  C:\Windows\System\oyhaOik.exe
  2⤵
  PID:9920
- C:\Windows\System\aEmcWkt.exe
  C:\Windows\System\aEmcWkt.exe
  2⤵
  PID:9404
- C:\Windows\System\trwYGFR.exe
  C:\Windows\System\trwYGFR.exe
  2⤵
  PID:8264
- C:\Windows\System\upNgBPE.exe
  C:\Windows\System\upNgBPE.exe
  2⤵
  PID:9888
- C:\Windows\System\qCwOOnh.exe
  C:\Windows\System\qCwOOnh.exe
  2⤵
  PID:10276
- C:\Windows\System\bLcLBSc.exe
  C:\Windows\System\bLcLBSc.exe
  2⤵
  PID:3504
- C:\Windows\System\EnmiDmF.exe
  C:\Windows\System\EnmiDmF.exe
  2⤵
  PID:9788
- C:\Windows\System\UiqPTNf.exe
  C:\Windows\System\UiqPTNf.exe
  2⤵
  PID:10792
- C:\Windows\System\SDrQcoD.exe
  C:\Windows\System\SDrQcoD.exe
  2⤵
  PID:10644
- C:\Windows\System\FslvcGY.exe
  C:\Windows\System\FslvcGY.exe
  2⤵
  PID:10820
- C:\Windows\System\VrwxVLx.exe
  C:\Windows\System\VrwxVLx.exe
  2⤵
  PID:10224
- C:\Windows\System\lqSpFmT.exe
  C:\Windows\System\lqSpFmT.exe
  2⤵
  PID:9952
- C:\Windows\System\mLpbnkF.exe
  C:\Windows\System\mLpbnkF.exe
  2⤵
  PID:11144
- C:\Windows\System\BBxoTrf.exe
  C:\Windows\System\BBxoTrf.exe
  2⤵
  PID:2488
- C:\Windows\System\wZKJeGN.exe
  C:\Windows\System\wZKJeGN.exe
  2⤵
  PID:9652
- C:\Windows\System\WIlxTcr.exe
  C:\Windows\System\WIlxTcr.exe
  2⤵
  PID:11284
- C:\Windows\System\ZfWomUm.exe
  C:\Windows\System\ZfWomUm.exe
  2⤵
  PID:11308
- C:\Windows\System\HvegDgM.exe
  C:\Windows\System\HvegDgM.exe
  2⤵
  PID:11324
- C:\Windows\System\xmaWdqj.exe
  C:\Windows\System\xmaWdqj.exe
  2⤵
  PID:11348
- C:\Windows\System\fHXpWjB.exe
  C:\Windows\System\fHXpWjB.exe
  2⤵
  PID:11376
- C:\Windows\System\HRuEXlQ.exe
  C:\Windows\System\HRuEXlQ.exe
  2⤵
  PID:11400
- C:\Windows\System\qiDoklq.exe
  C:\Windows\System\qiDoklq.exe
  2⤵
  PID:11420
- C:\Windows\System\UHeJAkH.exe
  C:\Windows\System\UHeJAkH.exe
  2⤵
  PID:11448
- C:\Windows\System\bTnYVFv.exe
  C:\Windows\System\bTnYVFv.exe
  2⤵
  PID:11472
- C:\Windows\System\IuSARhr.exe
  C:\Windows\System\IuSARhr.exe
  2⤵
  PID:11492
- C:\Windows\System\CHPeOEu.exe
  C:\Windows\System\CHPeOEu.exe
  2⤵
  PID:11516
- C:\Windows\System\QbuqZhe.exe
  C:\Windows\System\QbuqZhe.exe
  2⤵
  PID:11548
- C:\Windows\System\IOWYdAD.exe
  C:\Windows\System\IOWYdAD.exe
  2⤵
  PID:11568
- C:\Windows\System\aikWZPJ.exe
  C:\Windows\System\aikWZPJ.exe
  2⤵
  PID:11592
- C:\Windows\System\uhZVTAS.exe
  C:\Windows\System\uhZVTAS.exe
  2⤵
  PID:11612
- C:\Windows\System\DHyKKRk.exe
  C:\Windows\System\DHyKKRk.exe
  2⤵
  PID:11632
- C:\Windows\System\vEyqHPt.exe
  C:\Windows\System\vEyqHPt.exe
  2⤵
  PID:11744
- C:\Windows\System\dHSXTFE.exe
  C:\Windows\System\dHSXTFE.exe
  2⤵
  PID:11768
- C:\Windows\System\XWzTXjU.exe
  C:\Windows\System\XWzTXjU.exe
  2⤵
  PID:11796
- C:\Windows\System\GsudYoL.exe
  C:\Windows\System\GsudYoL.exe
  2⤵
  PID:11812
- C:\Windows\System\PkETjTa.exe
  C:\Windows\System\PkETjTa.exe
  2⤵
  PID:11832
- C:\Windows\System\SeDVwHv.exe
  C:\Windows\System\SeDVwHv.exe
  2⤵
  PID:11852
- C:\Windows\System\CrOhIGW.exe
  C:\Windows\System\CrOhIGW.exe
  2⤵
  PID:11876
- C:\Windows\System\xQMUAcV.exe
  C:\Windows\System\xQMUAcV.exe
  2⤵
  PID:11900
- C:\Windows\System\GxNFsRA.exe
  C:\Windows\System\GxNFsRA.exe
  2⤵
  PID:12028
- C:\Windows\System\pASnOFG.exe
  C:\Windows\System\pASnOFG.exe
  2⤵
  PID:12048
- C:\Windows\System\PVUIDos.exe
  C:\Windows\System\PVUIDos.exe
  2⤵
  PID:12064
- C:\Windows\System\PVuCUsx.exe
  C:\Windows\System\PVuCUsx.exe
  2⤵
  PID:12080
- C:\Windows\System\UvifEEV.exe
  C:\Windows\System\UvifEEV.exe
  2⤵
  PID:12096
- C:\Windows\System\AcCWEDb.exe
  C:\Windows\System\AcCWEDb.exe
  2⤵
  PID:12168
- C:\Windows\System\ijlPPvH.exe
  C:\Windows\System\ijlPPvH.exe
  2⤵
  PID:12188
- C:\Windows\System\aGJOroI.exe
  C:\Windows\System\aGJOroI.exe
  2⤵
  PID:12204
- C:\Windows\System\xRFBWuG.exe
  C:\Windows\System\xRFBWuG.exe
  2⤵
  PID:12240
- C:\Windows\System\LLawibC.exe
  C:\Windows\System\LLawibC.exe
  2⤵
  PID:12256
- C:\Windows\System\TCOqRxv.exe
  C:\Windows\System\TCOqRxv.exe
  2⤵
  PID:12280
- C:\Windows\System\zEhHtdy.exe
  C:\Windows\System\zEhHtdy.exe
  2⤵
  PID:8588
- C:\Windows\System\qXnREmk.exe
  C:\Windows\System\qXnREmk.exe
  2⤵
  PID:11316
- C:\Windows\System\dCUfdwd.exe
  C:\Windows\System\dCUfdwd.exe
  2⤵
  PID:11412
- C:\Windows\System\DfScjDY.exe
  C:\Windows\System\DfScjDY.exe
  2⤵
  PID:11216
- C:\Windows\System\fWgFtmo.exe
  C:\Windows\System\fWgFtmo.exe
  2⤵
  PID:9992
- C:\Windows\System\SGcjaRu.exe
  C:\Windows\System\SGcjaRu.exe
  2⤵
  PID:2324
- C:\Windows\System\UMkdppK.exe
  C:\Windows\System\UMkdppK.exe
  2⤵
  PID:11292
- C:\Windows\System\bnOEnSS.exe
  C:\Windows\System\bnOEnSS.exe
  2⤵
  PID:11372
- C:\Windows\System\DlVMDfy.exe
  C:\Windows\System\DlVMDfy.exe
  2⤵
  PID:11628
- C:\Windows\System\caWEPhe.exe
  C:\Windows\System\caWEPhe.exe
  2⤵
  PID:11484
- C:\Windows\System\YSqKxRH.exe
  C:\Windows\System\YSqKxRH.exe
  2⤵
  PID:11276
- C:\Windows\System\ckxiKrO.exe
  C:\Windows\System\ckxiKrO.exe
  2⤵
  PID:11604
- C:\Windows\System\IrfCFuk.exe
  C:\Windows\System\IrfCFuk.exe
  2⤵
  PID:7396
- C:\Windows\System\RghQnpk.exe
  C:\Windows\System\RghQnpk.exe
  2⤵
  PID:11588
- C:\Windows\System\lYunqNM.exe
  C:\Windows\System\lYunqNM.exe
  2⤵
  PID:11740
- C:\Windows\System\bmvoPSs.exe
  C:\Windows\System\bmvoPSs.exe
  2⤵
  PID:11824
- C:\Windows\System\cQZmeeG.exe
  C:\Windows\System\cQZmeeG.exe
  2⤵
  PID:12004
- C:\Windows\System\IPMuxvW.exe
  C:\Windows\System\IPMuxvW.exe
  2⤵
  PID:12060
- C:\Windows\System\SKNlEOs.exe
  C:\Windows\System\SKNlEOs.exe
  2⤵
  PID:11752
- C:\Windows\System\ORYPJPn.exe
  C:\Windows\System\ORYPJPn.exe
  2⤵
  PID:11808
- C:\Windows\System\tsxZcZT.exe
  C:\Windows\System\tsxZcZT.exe
  2⤵
  PID:12000
- C:\Windows\System\evMQfwZ.exe
  C:\Windows\System\evMQfwZ.exe
  2⤵
  PID:11888
- C:\Windows\System\ntRjHRZ.exe
  C:\Windows\System\ntRjHRZ.exe
  2⤵
  PID:12176
- C:\Windows\System\dIjkGbY.exe
  C:\Windows\System\dIjkGbY.exe
  2⤵
  PID:12264
- C:\Windows\System\QtApIGp.exe
  C:\Windows\System\QtApIGp.exe
  2⤵
  PID:5876
- C:\Windows\System\moVWVUX.exe
  C:\Windows\System\moVWVUX.exe
  2⤵
  PID:11396
- C:\Windows\System\TbVcQmo.exe
  C:\Windows\System\TbVcQmo.exe
  2⤵
  PID:12016
- C:\Windows\System\hcGriKA.exe
  C:\Windows\System\hcGriKA.exe
  2⤵
  PID:12304
- C:\Windows\System\mDPzqHF.exe
  C:\Windows\System\mDPzqHF.exe
  2⤵
  PID:12320
- C:\Windows\System\ReDTiKw.exe
  C:\Windows\System\ReDTiKw.exe
  2⤵
  PID:12344
- C:\Windows\System\FZXZGFf.exe
  C:\Windows\System\FZXZGFf.exe
  2⤵
  PID:12384
- C:\Windows\System\ToMXsQs.exe
  C:\Windows\System\ToMXsQs.exe
  2⤵
  PID:12400
- C:\Windows\System\TFAKsLI.exe
  C:\Windows\System\TFAKsLI.exe
  2⤵
  PID:12416
- C:\Windows\System\XRSjNeO.exe
  C:\Windows\System\XRSjNeO.exe
  2⤵
  PID:12432
- C:\Windows\System\aSCRLof.exe
  C:\Windows\System\aSCRLof.exe
  2⤵
  PID:12448
- C:\Windows\System\YgnZKgB.exe
  C:\Windows\System\YgnZKgB.exe
  2⤵
  PID:12504
- C:\Windows\System\bTMTvpM.exe
  C:\Windows\System\bTMTvpM.exe
  2⤵
  PID:12524
- C:\Windows\System\OhspzfD.exe
  C:\Windows\System\OhspzfD.exe
  2⤵
  PID:12544
- C:\Windows\System\ptRojVu.exe
  C:\Windows\System\ptRojVu.exe
  2⤵
  PID:12568
- C:\Windows\System\ejTvRLN.exe
  C:\Windows\System\ejTvRLN.exe
  2⤵
  PID:12588
- C:\Windows\System\yHSMLNK.exe
  C:\Windows\System\yHSMLNK.exe
  2⤵
  PID:12608
- C:\Windows\System\iDQjrfj.exe
  C:\Windows\System\iDQjrfj.exe
  2⤵
  PID:12636
- C:\Windows\System\mapWWOI.exe
  C:\Windows\System\mapWWOI.exe
  2⤵
  PID:12660
- C:\Windows\System\SFTKCiM.exe
  C:\Windows\System\SFTKCiM.exe
  2⤵
  PID:12680
- C:\Windows\System\mHMDjay.exe
  C:\Windows\System\mHMDjay.exe
  2⤵
  PID:12700
- C:\Windows\System\PCBozfw.exe
  C:\Windows\System\PCBozfw.exe
  2⤵
  PID:12728
- C:\Windows\System\CTxSwfQ.exe
  C:\Windows\System\CTxSwfQ.exe
  2⤵
  PID:12748
- C:\Windows\System\dYHXWBH.exe
  C:\Windows\System\dYHXWBH.exe
  2⤵
  PID:12768
- C:\Windows\System\tfqbVtz.exe
  C:\Windows\System\tfqbVtz.exe
  2⤵
  PID:12792
- C:\Windows\System\owljHCL.exe
  C:\Windows\System\owljHCL.exe
  2⤵
  PID:12812
- C:\Windows\System\YGxlZMn.exe
  C:\Windows\System\YGxlZMn.exe
  2⤵
  PID:12832
- C:\Windows\System\AbwJomH.exe
  C:\Windows\System\AbwJomH.exe
  2⤵
  PID:12856
- C:\Windows\System\HlfgDUQ.exe
  C:\Windows\System\HlfgDUQ.exe
  2⤵
  PID:12884
- C:\Windows\System\BtShWrt.exe
  C:\Windows\System\BtShWrt.exe
  2⤵
  PID:12900
- C:\Windows\System\wZPGHTY.exe
  C:\Windows\System\wZPGHTY.exe
  2⤵
  PID:12920
- C:\Windows\System\JWPTlue.exe
  C:\Windows\System\JWPTlue.exe
  2⤵
  PID:12944
- C:\Windows\System\NUXjjSq.exe
  C:\Windows\System\NUXjjSq.exe
  2⤵
  PID:12964
- C:\Windows\System\WawgDSe.exe
  C:\Windows\System\WawgDSe.exe
  2⤵
  PID:12980
- C:\Windows\System\tUxPzsJ.exe
  C:\Windows\System\tUxPzsJ.exe
  2⤵
  PID:13000
- C:\Windows\System\XJuccDk.exe
  C:\Windows\System\XJuccDk.exe
  2⤵
  PID:13024
- C:\Windows\System\XSDrHQi.exe
  C:\Windows\System\XSDrHQi.exe
  2⤵
  PID:13048
- C:\Windows\System\qsXhMlN.exe
  C:\Windows\System\qsXhMlN.exe
  2⤵
  PID:13244
- C:\Windows\System\qPFHWwd.exe
  C:\Windows\System\qPFHWwd.exe
  2⤵
  PID:11668
- C:\Windows\System\gCTUUMr.exe
  C:\Windows\System\gCTUUMr.exe
  2⤵
  PID:11432
- C:\Windows\System\hPNkKqj.exe
  C:\Windows\System\hPNkKqj.exe
  2⤵
  PID:11344
- C:\Windows\System\abEtHEM.exe
  C:\Windows\System\abEtHEM.exe
  2⤵
  PID:11720
- C:\Windows\System\FmdBnAF.exe
  C:\Windows\System\FmdBnAF.exe
  2⤵
  PID:12296
- C:\Windows\System\iZkOJSv.exe
  C:\Windows\System\iZkOJSv.exe
  2⤵
  PID:12908
- C:\Windows\System\fwTLtFo.exe
  C:\Windows\System\fwTLtFo.exe
  2⤵
  PID:12940
- C:\Windows\System\zDlxgmA.exe
  C:\Windows\System\zDlxgmA.exe
  2⤵
  PID:13040
- C:\Windows\System\sQLnQCN.exe
  C:\Windows\System\sQLnQCN.exe
  2⤵
  PID:13240
- C:\Windows\System\CtsiuWc.exe
  C:\Windows\System\CtsiuWc.exe
  2⤵
  PID:13136
- C:\Windows\System\zEOtkpi.exe
  C:\Windows\System\zEOtkpi.exe
  2⤵
  PID:12116
- C:\Windows\System\AOrDSaA.exe
  C:\Windows\System\AOrDSaA.exe
  2⤵
  PID:13256
- C:\Windows\System\hJJZjuB.exe
  C:\Windows\System\hJJZjuB.exe
  2⤵
  PID:12092
- C:\Windows\System\Vncvamy.exe
  C:\Windows\System\Vncvamy.exe
  2⤵
  PID:9160
- C:\Windows\System\MhPqBVO.exe
  C:\Windows\System\MhPqBVO.exe
  2⤵
  PID:12668
- C:\Windows\System\ThdMoTF.exe
  C:\Windows\System\ThdMoTF.exe
  2⤵
  PID:11156
- C:\Windows\System\SDOaboO.exe
  C:\Windows\System\SDOaboO.exe
  2⤵
  PID:12180
- C:\Windows\System\gtDrnPt.exe
  C:\Windows\System\gtDrnPt.exe
  2⤵
  PID:12340
- C:\Windows\System\BVkfQrz.exe
  C:\Windows\System\BVkfQrz.exe
  2⤵
  PID:12828
- C:\Windows\System\cBkxqhf.exe
  C:\Windows\System\cBkxqhf.exe
  2⤵
  PID:13016
- C:\Windows\System\NPbaQUh.exe
  C:\Windows\System\NPbaQUh.exe
  2⤵
  PID:3020
- C:\Windows\System\JSqWusS.exe
  C:\Windows\System\JSqWusS.exe
  2⤵
  PID:2072
- C:\Windows\System\RLpNNrg.exe
  C:\Windows\System\RLpNNrg.exe
  2⤵
  PID:12960
- C:\Windows\System\FnDnTbk.exe
  C:\Windows\System\FnDnTbk.exe
  2⤵
  PID:12408
- C:\Windows\System\UVxOMdu.exe
  C:\Windows\System\UVxOMdu.exe
  2⤵
  PID:11556
- C:\Windows\System\hvBklEU.exe
  C:\Windows\System\hvBklEU.exe
  2⤵
  PID:1952
- C:\Windows\System\PFBcvtQ.exe
  C:\Windows\System\PFBcvtQ.exe
  2⤵
  PID:12740
- C:\Windows\System\LxgscJW.exe
  C:\Windows\System\LxgscJW.exe
  2⤵
  PID:13296
- C:\Windows\System\tCwfQIV.exe
  C:\Windows\System\tCwfQIV.exe
  2⤵
  PID:12600
- C:\Windows\System\EyVANiJ.exe
  C:\Windows\System\EyVANiJ.exe
  2⤵
  PID:5404
- C:\Windows\System\LguesDR.exe
  C:\Windows\System\LguesDR.exe
  2⤵
  PID:4476
- C:\Windows\System\SKFjHqO.exe
  C:\Windows\System\SKFjHqO.exe
  2⤵
  PID:12464
- C:\Windows\System\aNMyMKb.exe
  C:\Windows\System\aNMyMKb.exe
  2⤵
  PID:4924
- C:\Windows\System\GIQtvyy.exe
  C:\Windows\System\GIQtvyy.exe
  2⤵
  PID:12328
- C:\Windows\System\TnucGgF.exe
  C:\Windows\System\TnucGgF.exe
  2⤵
  PID:1452
- C:\Windows\System\xCQkMPr.exe
  C:\Windows\System\xCQkMPr.exe
  2⤵
  PID:9096
- C:\Windows\System\bWtWxnn.exe
  C:\Windows\System\bWtWxnn.exe
  2⤵
  PID:1716
- C:\Windows\System\tZnPvxY.exe
  C:\Windows\System\tZnPvxY.exe
  2⤵
  PID:1788
- C:\Windows\System\lbyMHyG.exe
  C:\Windows\System\lbyMHyG.exe
  2⤵
  PID:1372
- C:\Windows\System\lIDnArf.exe
  C:\Windows\System\lIDnArf.exe
  2⤵
  PID:3324
- C:\Windows\System\tVvxuNm.exe
  C:\Windows\System\tVvxuNm.exe
  2⤵
  PID:3888
- C:\Windows\System\jVnXjPa.exe
  C:\Windows\System\jVnXjPa.exe
  2⤵
  PID:13064
- C:\Windows\System\sgwqfQh.exe
  C:\Windows\System\sgwqfQh.exe
  2⤵
  PID:3284
- C:\Windows\System\UFNzazH.exe
  C:\Windows\System\UFNzazH.exe
  2⤵
  PID:12164
- C:\Windows\System\cviSjGQ.exe
  C:\Windows\System\cviSjGQ.exe
  2⤵
  PID:5420
- C:\Windows\System\mginUHG.exe
  C:\Windows\System\mginUHG.exe
  2⤵
  PID:5472
- C:\Windows\System\pwupcVt.exe
  C:\Windows\System\pwupcVt.exe
  2⤵
  PID:1484
- C:\Windows\System\OqwmfQM.exe
  C:\Windows\System\OqwmfQM.exe
  2⤵
  PID:3624
- C:\Windows\System\ISlbTAP.exe
  C:\Windows\System\ISlbTAP.exe
  2⤵
  PID:948
- C:\Windows\System\qyyGhjg.exe
  C:\Windows\System\qyyGhjg.exe
  2⤵
  PID:13316
- C:\Windows\System\TidNvXi.exe
  C:\Windows\System\TidNvXi.exe
  2⤵
  PID:13332
- C:\Windows\System\dKgZrbg.exe
  C:\Windows\System\dKgZrbg.exe
  2⤵
  PID:13348
- C:\Windows\System\wDvxYRW.exe
  C:\Windows\System\wDvxYRW.exe
  2⤵
  PID:13364
- C:\Windows\System\uCWNRqS.exe
  C:\Windows\System\uCWNRqS.exe
  2⤵
  PID:13404
- C:\Windows\System\yHfyvvW.exe
  C:\Windows\System\yHfyvvW.exe
  2⤵
  PID:13420
- C:\Windows\System\PuMcHgH.exe
  C:\Windows\System\PuMcHgH.exe
  2⤵
  PID:13436
- C:\Windows\System\kdgBInT.exe
  C:\Windows\System\kdgBInT.exe
  2⤵
  PID:13452
- C:\Windows\System\dZmlyDy.exe
  C:\Windows\System\dZmlyDy.exe
  2⤵
  PID:13468
- C:\Windows\System\rCXRxmh.exe
  C:\Windows\System\rCXRxmh.exe
  2⤵
  PID:13512
- C:\Windows\System\HLuksdl.exe
  C:\Windows\System\HLuksdl.exe
  2⤵
  PID:13540
- C:\Windows\System\pNPtjlT.exe
  C:\Windows\System\pNPtjlT.exe
  2⤵
  PID:13556
- C:\Windows\System\uoYtUxt.exe
  C:\Windows\System\uoYtUxt.exe
  2⤵
  PID:13576
- C:\Windows\System\umZZfsn.exe
  C:\Windows\System\umZZfsn.exe
  2⤵
  PID:13592
- C:\Windows\System\gcbWqTA.exe
  C:\Windows\System\gcbWqTA.exe
  2⤵
  PID:13616
- C:\Windows\System\hZxxIEh.exe
  C:\Windows\System\hZxxIEh.exe
  2⤵
  PID:13640
- C:\Windows\System\RVXJYRi.exe
  C:\Windows\System\RVXJYRi.exe
  2⤵
  PID:13660
- C:\Windows\System\kRYdtuw.exe
  C:\Windows\System\kRYdtuw.exe
  2⤵
  PID:13680
- C:\Windows\System\qpmFOrf.exe
  C:\Windows\System\qpmFOrf.exe
  2⤵
  PID:13696
- C:\Windows\System\iDKuTkp.exe
  C:\Windows\System\iDKuTkp.exe
  2⤵
  PID:13712
- C:\Windows\System\amTYKsG.exe
  C:\Windows\System\amTYKsG.exe
  2⤵
  PID:13732
- C:\Windows\System\yyGDdIi.exe
  C:\Windows\System\yyGDdIi.exe
  2⤵
  PID:13752
- C:\Windows\System\hhSefLh.exe
  C:\Windows\System\hhSefLh.exe
  2⤵
  PID:13772
- C:\Windows\System\UvqlKXw.exe
  C:\Windows\System\UvqlKXw.exe
  2⤵
  PID:13836
- C:\Windows\System\OmpKFJT.exe
  C:\Windows\System\OmpKFJT.exe
  2⤵
  PID:13860
- C:\Windows\System\qxGyCpL.exe
  C:\Windows\System\qxGyCpL.exe
  2⤵
  PID:13880
- C:\Windows\System\JSqGUdQ.exe
  C:\Windows\System\JSqGUdQ.exe
  2⤵
  PID:13940
- C:\Windows\System\ZpbVIEU.exe
  C:\Windows\System\ZpbVIEU.exe
  2⤵
  PID:14028
- C:\Windows\System\DXPucVK.exe
  C:\Windows\System\DXPucVK.exe
  2⤵
  PID:1516
- C:\Windows\System\XDaSLxq.exe
  C:\Windows\System\XDaSLxq.exe
  2⤵
  PID:5840
- C:\Windows\System\djBMamb.exe
  C:\Windows\System\djBMamb.exe
  2⤵
  PID:5788
- C:\Windows\System\gKjdvoi.exe
  C:\Windows\System\gKjdvoi.exe
  2⤵
  PID:1812
- C:\Windows\System\FYGmIwq.exe
  C:\Windows\System\FYGmIwq.exe
  2⤵
  PID:2032
- C:\Windows\System\hzZCDsC.exe
  C:\Windows\System\hzZCDsC.exe
  2⤵
  PID:3960
- C:\Windows\System\vvIlVbV.exe
  C:\Windows\System\vvIlVbV.exe
  2⤵
  PID:13232
- C:\Windows\System\pCWJAMr.exe
  C:\Windows\System\pCWJAMr.exe
  2⤵
  PID:4684
- C:\Windows\System\EBjjepW.exe
  C:\Windows\System\EBjjepW.exe
  2⤵
  PID:13484
- C:\Windows\System\wpioORq.exe
  C:\Windows\System\wpioORq.exe
  2⤵
  PID:13536
- C:\Windows\System\NDDcADD.exe
  C:\Windows\System\NDDcADD.exe
  2⤵
  PID:13564
- C:\Windows\System\xvmFJCs.exe
  C:\Windows\System\xvmFJCs.exe
  2⤵
  PID:3532
- C:\Windows\System\TMnkrkx.exe
  C:\Windows\System\TMnkrkx.exe
  2⤵
  PID:13888
- C:\Windows\System\zlkLHsF.exe
  C:\Windows\System\zlkLHsF.exe
  2⤵
  PID:3404
- C:\Windows\System\JTwxfxQ.exe
  C:\Windows\System\JTwxfxQ.exe
  2⤵
  PID:13396
- C:\Windows\System\ROZWBni.exe
  C:\Windows\System\ROZWBni.exe
  2⤵
  PID:5880
- C:\Windows\System\MIUrxcT.exe
  C:\Windows\System\MIUrxcT.exe
  2⤵
  PID:13032
- C:\Windows\System\jlNSJNo.exe
  C:\Windows\System\jlNSJNo.exe
  2⤵
  PID:4160
- C:\Windows\System\HSQOhCa.exe
  C:\Windows\System\HSQOhCa.exe
  2⤵
  PID:11600
- C:\Windows\System\AEKBIbY.exe
  C:\Windows\System\AEKBIbY.exe
  2⤵
  PID:5892
- C:\Windows\System\qzzjGcY.exe
  C:\Windows\System\qzzjGcY.exe
  2⤵
  PID:1900
- C:\Windows\System\HvlGksg.exe
  C:\Windows\System\HvlGksg.exe
  2⤵
  PID:13464
- C:\Windows\System\cvEXcoj.exe
  C:\Windows\System\cvEXcoj.exe
  2⤵
  PID:4960
- C:\Windows\System\UFtFHNX.exe
  C:\Windows\System\UFtFHNX.exe
  2⤵
  PID:4296
- C:\Windows\System\cRheJxf.exe
  C:\Windows\System\cRheJxf.exe
  2⤵
  PID:1956
- C:\Windows\System\TRPdPiJ.exe
  C:\Windows\System\TRPdPiJ.exe
  2⤵
  PID:13096
- C:\Windows\System\DaSfraF.exe
  C:\Windows\System\DaSfraF.exe
  2⤵
  PID:11532
- C:\Windows\System\iAIZzcq.exe
  C:\Windows\System\iAIZzcq.exe
  2⤵
  PID:404
- C:\Windows\System\VEbsEan.exe
  C:\Windows\System\VEbsEan.exe
  2⤵
  PID:5928
- C:\Windows\System\MIUVpaw.exe
  C:\Windows\System\MIUVpaw.exe
  2⤵
  PID:4260
- C:\Windows\System\SaUofSb.exe
  C:\Windows\System\SaUofSb.exe
  2⤵
  PID:13600
- C:\Windows\System\Vlidpdq.exe
  C:\Windows\System\Vlidpdq.exe
  2⤵
  PID:13672
- C:\Windows\System\gfnjdsE.exe
  C:\Windows\System\gfnjdsE.exe
  2⤵
  PID:2376
- C:\Windows\System\eWyGNja.exe
  C:\Windows\System\eWyGNja.exe
  2⤵
  PID:13588
- C:\Windows\System\RbYdlZS.exe
  C:\Windows\System\RbYdlZS.exe
  2⤵
  PID:5816
- C:\Windows\System\qgomYPU.exe
  C:\Windows\System\qgomYPU.exe
  2⤵
  PID:13360
- C:\Windows\System\HyIqPci.exe
  C:\Windows\System\HyIqPci.exe
  2⤵
  PID:13488
- C:\Windows\System\jOCSsIK.exe
  C:\Windows\System\jOCSsIK.exe
  2⤵
  PID:13444
- C:\Windows\System\hEuPSlD.exe
  C:\Windows\System\hEuPSlD.exe
  2⤵
  PID:4368
- C:\Windows\System\MTguHad.exe
  C:\Windows\System\MTguHad.exe
  2⤵
  PID:13656
- C:\Windows\System\SaVjcww.exe
  C:\Windows\System\SaVjcww.exe
  2⤵
  PID:13768
- C:\Windows\System\TfgMSKh.exe
  C:\Windows\System\TfgMSKh.exe
  2⤵
  PID:1416
- C:\Windows\System\mAgNaTk.exe
  C:\Windows\System\mAgNaTk.exe
  2⤵
  PID:5428
- C:\Windows\System\bmCDKVH.exe
  C:\Windows\System\bmCDKVH.exe
  2⤵
  PID:13872
- C:\Windows\System\KQelhpO.exe
  C:\Windows\System\KQelhpO.exe
  2⤵
  PID:13936
- C:\Windows\System\ZcrmVME.exe
  C:\Windows\System\ZcrmVME.exe
  2⤵
  PID:13964
- C:\Windows\System\NTJRsaH.exe
  C:\Windows\System\NTJRsaH.exe
  2⤵
  PID:13956
- C:\Windows\System\dNiUKxN.exe
  C:\Windows\System\dNiUKxN.exe
  2⤵
  PID:904
- C:\Windows\System\CsOgzcy.exe
  C:\Windows\System\CsOgzcy.exe
  2⤵
  PID:13808
- C:\Windows\System\bgXxztd.exe
  C:\Windows\System\bgXxztd.exe
  2⤵
  PID:14176
- C:\Windows\System\DxcMXQA.exe
  C:\Windows\System\DxcMXQA.exe
  2⤵
  PID:1080
- C:\Windows\System\lRmxKVs.exe
  C:\Windows\System\lRmxKVs.exe
  2⤵
  PID:6340
- C:\Windows\System\vnXVwFm.exe
  C:\Windows\System\vnXVwFm.exe
  2⤵
  PID:14000
- C:\Windows\System\zqhXavO.exe
  C:\Windows\System\zqhXavO.exe
  2⤵
  PID:12392
- C:\Windows\System\akJJNEL.exe
  C:\Windows\System\akJJNEL.exe
  2⤵
  PID:5256
- C:\Windows\System\WvUTncz.exe
  C:\Windows\System\WvUTncz.exe
  2⤵
  PID:2092
- C:\Windows\System\nPAAZNY.exe
  C:\Windows\System\nPAAZNY.exe
  2⤵
  PID:5944
- C:\Windows\System\tNZqEnz.exe
  C:\Windows\System\tNZqEnz.exe
  2⤵
  PID:648
- C:\Windows\System\giRmkjr.exe
  C:\Windows\System\giRmkjr.exe
  2⤵
  PID:4304
- C:\Windows\System\SkhIcSV.exe
  C:\Windows\System\SkhIcSV.exe
  2⤵
  PID:2088
- C:\Windows\System\qdVlszk.exe
  C:\Windows\System\qdVlszk.exe
  2⤵
  PID:3216
- C:\Windows\System\WktCZFu.exe
  C:\Windows\System\WktCZFu.exe
  2⤵
  PID:4148
- C:\Windows\System\kcwAVPD.exe
  C:\Windows\System\kcwAVPD.exe
  2⤵
  PID:5164
- C:\Windows\System\UKKDejJ.exe
  C:\Windows\System\UKKDejJ.exe
  2⤵
  PID:3576
- C:\Windows\System\YwvqMGB.exe
  C:\Windows\System\YwvqMGB.exe
  2⤵
  PID:14276
- C:\Windows\System\xyMmGEs.exe
  C:\Windows\System\xyMmGEs.exe
  2⤵
  PID:6972
- C:\Windows\System\bsTvYmD.exe
  C:\Windows\System\bsTvYmD.exe
  2⤵
  PID:12676
- C:\Windows\System\WQlrcXz.exe
  C:\Windows\System\WQlrcXz.exe
  2⤵
  PID:4888
- C:\Windows\System\JtZaXbS.exe
  C:\Windows\System\JtZaXbS.exe
  2⤵
  PID:13604
- C:\Windows\System\ljnxFBJ.exe
  C:\Windows\System\ljnxFBJ.exe
  2⤵
  PID:13708
- C:\Windows\System\UMIPaGJ.exe
  C:\Windows\System\UMIPaGJ.exe
  2⤵
  PID:6344
- C:\Windows\System\NFVJMAY.exe
  C:\Windows\System\NFVJMAY.exe
  2⤵
  PID:3104
- C:\Windows\System\uTfchVX.exe
  C:\Windows\System\uTfchVX.exe
  2⤵
  PID:1992
- C:\Windows\System\EAJvSTJ.exe
  C:\Windows\System\EAJvSTJ.exe
  2⤵
  PID:1964
- C:\Windows\System\GVXtIdu.exe
  C:\Windows\System\GVXtIdu.exe
  2⤵
  PID:4012
- C:\Windows\System\bHeDhcu.exe
  C:\Windows\System\bHeDhcu.exe
  2⤵
  PID:13876
- C:\Windows\System\PwiMiSS.exe
  C:\Windows\System\PwiMiSS.exe
  2⤵
  PID:5564
- C:\Windows\System\HXNelvH.exe
  C:\Windows\System\HXNelvH.exe
  2⤵
  PID:14212
- C:\Windows\System\AMtswrt.exe
  C:\Windows\System\AMtswrt.exe
  2⤵
  PID:14284
- C:\Windows\System\MBRQQEI.exe
  C:\Windows\System\MBRQQEI.exe
  2⤵
  PID:924
- C:\Windows\System\wXMbIJJ.exe
  C:\Windows\System\wXMbIJJ.exe
  2⤵
  PID:12744
- C:\Windows\System\eKUZEbN.exe
  C:\Windows\System\eKUZEbN.exe
  2⤵
  PID:1052
- C:\Windows\System\TDFlkNU.exe
  C:\Windows\System\TDFlkNU.exe
  2⤵
  PID:13724
- C:\Windows\System\oMINvKr.exe
  C:\Windows\System\oMINvKr.exe
  2⤵
  PID:5812
- C:\Windows\System\xmexVbp.exe
  C:\Windows\System\xmexVbp.exe
  2⤵
  PID:7256
- C:\Windows\System\GQXIWdk.exe
  C:\Windows\System\GQXIWdk.exe
  2⤵
  PID:5560
- C:\Windows\System\bGRVEKh.exe
  C:\Windows\System\bGRVEKh.exe
  2⤵
  PID:6240
- C:\Windows\System\SvkzyaX.exe
  C:\Windows\System\SvkzyaX.exe
  2⤵
  PID:6176
- C:\Windows\System\KHaogYM.exe
  C:\Windows\System\KHaogYM.exe
  2⤵
  PID:6020
- C:\Windows\System\xLbecVZ.exe
  C:\Windows\System\xLbecVZ.exe
  2⤵
  PID:6124
- C:\Windows\System\SyBoYzI.exe
  C:\Windows\System\SyBoYzI.exe
  2⤵
  PID:7300
- C:\Windows\System\WQRdsSa.exe
  C:\Windows\System\WQRdsSa.exe
  2⤵
  PID:7504
- C:\Windows\System\kEtnBEE.exe
  C:\Windows\System\kEtnBEE.exe
  2⤵
  PID:6368
- C:\Windows\System\FZFsDXJ.exe
  C:\Windows\System\FZFsDXJ.exe
  2⤵
  PID:6276
- C:\Windows\System\qlYdCPg.exe
  C:\Windows\System\qlYdCPg.exe
  2⤵
  PID:6236
- C:\Windows\System\QXWXlVp.exe
  C:\Windows\System\QXWXlVp.exe
  2⤵
  PID:5804
- C:\Windows\System\jPdxadk.exe
  C:\Windows\System\jPdxadk.exe
  2⤵
  PID:7140
- C:\Windows\System\vPxPElV.exe
  C:\Windows\System\vPxPElV.exe
  2⤵
  PID:7080
- C:\Windows\System\vanZHrJ.exe
  C:\Windows\System\vanZHrJ.exe
  2⤵
  PID:6668
- C:\Windows\System\nxuinJj.exe
  C:\Windows\System\nxuinJj.exe
  2⤵
  PID:6496
- C:\Windows\System\EIdbaDI.exe
  C:\Windows\System\EIdbaDI.exe
  2⤵
  PID:2280
- C:\Windows\System\aQsPncJ.exe
  C:\Windows\System\aQsPncJ.exe
  2⤵
  PID:4480
- C:\Windows\System\seReQHy.exe
  C:\Windows\System\seReQHy.exe
  2⤵
  PID:6576
- C:\Windows\System\YhYajdQ.exe
  C:\Windows\System\YhYajdQ.exe
  2⤵
  PID:4912
- C:\Windows\System\cWaxMJy.exe
  C:\Windows\System\cWaxMJy.exe
  2⤵
  PID:10664
- C:\Windows\System\SJMEQbe.exe
  C:\Windows\System\SJMEQbe.exe
  2⤵
  PID:13328
- C:\Windows\System\UGjlZlJ.exe
  C:\Windows\System\UGjlZlJ.exe
  2⤵
  PID:1936
- C:\Windows\System\hDSOvuk.exe
  C:\Windows\System\hDSOvuk.exe
  2⤵
  PID:12552
- C:\Windows\System\TdEJtZq.exe
  C:\Windows\System\TdEJtZq.exe
  2⤵
  PID:6444
- C:\Windows\System\MtNleCk.exe
  C:\Windows\System\MtNleCk.exe
  2⤵
  PID:8000
- C:\Windows\System\vDpmEDM.exe
  C:\Windows\System\vDpmEDM.exe
  2⤵
  PID:13804
- C:\Windows\System\yTGHCnQ.exe
  C:\Windows\System\yTGHCnQ.exe
  2⤵
  PID:7980
- C:\Windows\System\RRufgyV.exe
  C:\Windows\System\RRufgyV.exe
  2⤵
  PID:7412
- C:\Windows\System\MHdrOHP.exe
  C:\Windows\System\MHdrOHP.exe
  2⤵
  PID:8084
- C:\Windows\System\wANXlph.exe
  C:\Windows\System\wANXlph.exe
  2⤵
  PID:3872
- C:\Windows\System\BYOpiOL.exe
  C:\Windows\System\BYOpiOL.exe
  2⤵
  PID:6556
- C:\Windows\System\nQJEuPT.exe
  C:\Windows\System\nQJEuPT.exe
  2⤵
  PID:7720
- C:\Windows\System\ZExNzbT.exe
  C:\Windows\System\ZExNzbT.exe
  2⤵
  PID:7164
- C:\Windows\System\xLVKjek.exe
  C:\Windows\System\xLVKjek.exe
  2⤵
  PID:820
- C:\Windows\System\WnIlGOm.exe
  C:\Windows\System\WnIlGOm.exe
  2⤵
  PID:8064
- C:\Windows\System\cdHXzWK.exe
  C:\Windows\System\cdHXzWK.exe
  2⤵
  PID:13980
- C:\Windows\System\pYdJRJO.exe
  C:\Windows\System\pYdJRJO.exe
  2⤵
  PID:8228
- C:\Windows\System\PtQEpAw.exe
  C:\Windows\System\PtQEpAw.exe
  2⤵
  PID:8664
- C:\Windows\System\gFDNfhl.exe
  C:\Windows\System\gFDNfhl.exe
  2⤵
  PID:8020
- C:\Windows\System\rXGsEdy.exe
  C:\Windows\System\rXGsEdy.exe
  2⤵
  PID:3816
- C:\Windows\System\FhiIzoe.exe
  C:\Windows\System\FhiIzoe.exe
  2⤵
  PID:432
- C:\Windows\System\HBCCLLJ.exe
  C:\Windows\System\HBCCLLJ.exe
  2⤵
  PID:6752
- C:\Windows\System\WKbUQAL.exe
  C:\Windows\System\WKbUQAL.exe
  2⤵
  PID:6960
- C:\Windows\System\fNIABJj.exe
  C:\Windows\System\fNIABJj.exe
  2⤵
  PID:5360
- C:\Windows\System\lNOwvZf.exe
  C:\Windows\System\lNOwvZf.exe
  2⤵
  PID:6000
- C:\Windows\System\ZmTjsZo.exe
  C:\Windows\System\ZmTjsZo.exe
  2⤵
  PID:6188
- C:\Windows\System\FWIXMaJ.exe
  C:\Windows\System\FWIXMaJ.exe
  2⤵
  PID:6320
- C:\Windows\System\ZELxjEk.exe
  C:\Windows\System\ZELxjEk.exe
  2⤵
  PID:14104
- C:\Windows\System\lNMRkjH.exe
  C:\Windows\System\lNMRkjH.exe
  2⤵
  PID:6164
- C:\Windows\System\HwzMgop.exe
  C:\Windows\System\HwzMgop.exe
  2⤵
  PID:4948
- C:\Windows\System\IIDELQO.exe
  C:\Windows\System\IIDELQO.exe
  2⤵
  PID:11788
- C:\Windows\System\rsakFPO.exe
  C:\Windows\System\rsakFPO.exe
  2⤵
  PID:5368
- C:\Windows\System\xQxSwps.exe
  C:\Windows\System\xQxSwps.exe
  2⤵
  PID:5680
- C:\Windows\System\DvIcLUB.exe
  C:\Windows\System\DvIcLUB.exe
  2⤵
  PID:8704
- C:\Windows\System\DIhqWJT.exe
  C:\Windows\System\DIhqWJT.exe
  2⤵
  PID:8772
- C:\Windows\System\yIMHcNt.exe
  C:\Windows\System\yIMHcNt.exe
  2⤵
  PID:9108
- C:\Windows\System\UFYzTlh.exe
  C:\Windows\System\UFYzTlh.exe
  2⤵
  PID:13728
- C:\Windows\System\BGxtdat.exe
  C:\Windows\System\BGxtdat.exe
  2⤵
  PID:12036
- C:\Windows\System\orLJBpA.exe
  C:\Windows\System\orLJBpA.exe
  2⤵
  PID:3176
- C:\Windows\System\UsufqKI.exe
  C:\Windows\System\UsufqKI.exe
  2⤵
  PID:4768
- C:\Windows\System\IrrrIdt.exe
  C:\Windows\System\IrrrIdt.exe
  2⤵
  PID:6476
- C:\Windows\System\eetcmsV.exe
  C:\Windows\System\eetcmsV.exe
  2⤵
  PID:8908
- C:\Windows\System\kNrVsLq.exe
  C:\Windows\System\kNrVsLq.exe
  2⤵
  PID:8980
- C:\Windows\System\pwypUqd.exe
  C:\Windows\System\pwypUqd.exe
  2⤵
  PID:8892
- C:\Windows\System\gDPXxry.exe
  C:\Windows\System\gDPXxry.exe
  2⤵
  PID:10848
- C:\Windows\System\zWsQMqn.exe
  C:\Windows\System\zWsQMqn.exe
  2⤵
  PID:8776
- C:\Windows\System\uALyKBR.exe
  C:\Windows\System\uALyKBR.exe
  2⤵
  PID:6036
- C:\Windows\System\KlDmOmA.exe
  C:\Windows\System\KlDmOmA.exe
  2⤵
  PID:7884
- C:\Windows\System\RiWWSwL.exe
  C:\Windows\System\RiWWSwL.exe
  2⤵
  PID:9092
- C:\Windows\System\nIZVsYT.exe
  C:\Windows\System\nIZVsYT.exe
  2⤵
  PID:9136
- C:\Windows\System\hLjYUwa.exe
  C:\Windows\System\hLjYUwa.exe
  2⤵
  PID:8088
- C:\Windows\System\LASYMNc.exe
  C:\Windows\System\LASYMNc.exe
  2⤵
  PID:11708
- C:\Windows\System\PGQnKfY.exe
  C:\Windows\System\PGQnKfY.exe
  2⤵
  PID:4076
- C:\Windows\System\LCrbPsx.exe
  C:\Windows\System\LCrbPsx.exe
  2⤵
  PID:8748
- C:\Windows\System\EhHTmFg.exe
  C:\Windows\System\EhHTmFg.exe
  2⤵
  PID:6636
- C:\Windows\System\XdqFIin.exe
  C:\Windows\System\XdqFIin.exe
  2⤵
  PID:2908
- C:\Windows\System\xogEwRp.exe
  C:\Windows\System\xogEwRp.exe
  2⤵
  PID:11164
- C:\Windows\System\hZBxMkJ.exe
  C:\Windows\System\hZBxMkJ.exe
  2⤵
  PID:7000
- C:\Windows\System\FfGdWWE.exe
  C:\Windows\System\FfGdWWE.exe
  2⤵
  PID:5056
- C:\Windows\System\YXeHSGN.exe
  C:\Windows\System\YXeHSGN.exe
  2⤵
  PID:4988
- C:\Windows\System\ifpdQxc.exe
  C:\Windows\System\ifpdQxc.exe
  2⤵
  PID:6756
- C:\Windows\System\QbzGAMr.exe
  C:\Windows\System\QbzGAMr.exe
  2⤵
  PID:7900
- C:\Windows\System\mlpfGze.exe
  C:\Windows\System\mlpfGze.exe
  2⤵
  PID:9556
- C:\Windows\System\suelXIb.exe
  C:\Windows\System\suelXIb.exe
  2⤵
  PID:3592
- C:\Windows\System\LunkmHJ.exe
  C:\Windows\System\LunkmHJ.exe
  2⤵
  PID:8528
- C:\Windows\System\umcSvrV.exe
  C:\Windows\System\umcSvrV.exe
  2⤵
  PID:8804
- C:\Windows\System\FpwLuqt.exe
  C:\Windows\System\FpwLuqt.exe
  2⤵
  PID:12472
- C:\Windows\System\MnujCen.exe
  C:\Windows\System\MnujCen.exe
  2⤵
  PID:12352
- C:\Windows\System\IfumvpJ.exe
  C:\Windows\System\IfumvpJ.exe
  2⤵
  PID:14308
- C:\Windows\System\rtOaITL.exe
  C:\Windows\System\rtOaITL.exe
  2⤵
  PID:8252
- C:\Windows\System\QoQcJUV.exe
  C:\Windows\System\QoQcJUV.exe
  2⤵
  PID:7944
- C:\Windows\System\qbbVAGV.exe
  C:\Windows\System\qbbVAGV.exe
  2⤵
  PID:11456
- C:\Windows\System\cSAtYpx.exe
  C:\Windows\System\cSAtYpx.exe
  2⤵
  PID:9192
- C:\Windows\System\bAYnryV.exe
  C:\Windows\System\bAYnryV.exe
  2⤵
  PID:8304
- C:\Windows\System\rdeRSkX.exe
  C:\Windows\System\rdeRSkX.exe
  2⤵
  PID:6156
- C:\Windows\System\OHnZage.exe
  C:\Windows\System\OHnZage.exe
  2⤵
  PID:5684
- C:\Windows\System\clBObJc.exe
  C:\Windows\System\clBObJc.exe
  2⤵
  PID:6292
- C:\Windows\System\KQHItsy.exe
  C:\Windows\System\KQHItsy.exe
  2⤵
  PID:7916
- C:\Windows\System\uVNyjbQ.exe
  C:\Windows\System\uVNyjbQ.exe
  2⤵
  PID:8104
- C:\Windows\System\mbBSxdN.exe
  C:\Windows\System\mbBSxdN.exe
  2⤵
  PID:13072
- C:\Windows\System\VsuKzzL.exe
  C:\Windows\System\VsuKzzL.exe
  2⤵
  PID:8964
- C:\Windows\System\ByQoPlE.exe
  C:\Windows\System\ByQoPlE.exe
  2⤵
  PID:7680
- C:\Windows\System\UNgahyJ.exe
  C:\Windows\System\UNgahyJ.exe
  2⤵
  PID:8792
- C:\Windows\System\vurUJpW.exe
  C:\Windows\System\vurUJpW.exe
  2⤵
  PID:10084
- C:\Windows\System\mKzzisf.exe
  C:\Windows\System\mKzzisf.exe
  2⤵
  PID:10092
- C:\Windows\System\TmjMgYo.exe
  C:\Windows\System\TmjMgYo.exe
  2⤵
  PID:9784
- C:\Windows\System\pAUnUNc.exe
  C:\Windows\System\pAUnUNc.exe
  2⤵
  PID:10012
- C:\Windows\System\bwTatVm.exe
  C:\Windows\System\bwTatVm.exe
  2⤵
  PID:7356
- C:\Windows\System\xUlMmhw.exe
  C:\Windows\System\xUlMmhw.exe
  2⤵
  PID:9892
- C:\Windows\System\jJkICEj.exe
  C:\Windows\System\jJkICEj.exe
  2⤵
  PID:12484
- C:\Windows\System\OoxivbA.exe
  C:\Windows\System\OoxivbA.exe
  2⤵
  PID:12276
- C:\Windows\System\JQxtUhY.exe
  C:\Windows\System\JQxtUhY.exe
  2⤵
  PID:2008
- C:\Windows\System\ypsQmfe.exe
  C:\Windows\System\ypsQmfe.exe
  2⤵
  PID:11408
- C:\Windows\System\PDwCmbK.exe
  C:\Windows\System\PDwCmbK.exe
  2⤵
  PID:12540
- C:\Windows\System\mRPiTTf.exe
  C:\Windows\System\mRPiTTf.exe
  2⤵
  PID:12804
- C:\Windows\System\mgbAQrl.exe
  C:\Windows\System\mgbAQrl.exe
  2⤵
  PID:9060
- C:\Windows\System\mJSybiq.exe
  C:\Windows\System\mJSybiq.exe
  2⤵
  PID:10660
- C:\Windows\System\biZIIhO.exe
  C:\Windows\System\biZIIhO.exe
  2⤵
  PID:8900
- C:\Windows\System\QUWRqYg.exe
  C:\Windows\System\QUWRqYg.exe
  2⤵
  PID:10048
- C:\Windows\System\QaDgMOn.exe
  C:\Windows\System\QaDgMOn.exe
  2⤵
  PID:6608
- C:\Windows\System\ECKNEdg.exe
  C:\Windows\System\ECKNEdg.exe
  2⤵
  PID:8844
- C:\Windows\System\rcEeNna.exe
  C:\Windows\System\rcEeNna.exe
  2⤵
  PID:10116
- C:\Windows\System\QbFlzaS.exe
  C:\Windows\System\QbFlzaS.exe
  2⤵
  PID:7076
- C:\Windows\System\aHWXAdY.exe
  C:\Windows\System\aHWXAdY.exe
  2⤵
  PID:9200
- C:\Windows\System\ahjzQqM.exe
  C:\Windows\System\ahjzQqM.exe
  2⤵
  PID:2104
- C:\Windows\System\MmuJlTF.exe
  C:\Windows\System\MmuJlTF.exe
  2⤵
  PID:9740
- C:\Windows\System\pOYxUhx.exe
  C:\Windows\System\pOYxUhx.exe
  2⤵
  PID:13184
- C:\Windows\System\YTrPAJn.exe
  C:\Windows\System\YTrPAJn.exe
  2⤵
  PID:5660
- C:\Windows\System\VRaLvPP.exe
  C:\Windows\System\VRaLvPP.exe
  2⤵
  PID:7480
- C:\Windows\System\hZSALYF.exe
  C:\Windows\System\hZSALYF.exe
  2⤵
  PID:6868
- C:\Windows\System\JOzHEwn.exe
  C:\Windows\System\JOzHEwn.exe
  2⤵
  PID:9172
- C:\Windows\System\XCuhEZW.exe
  C:\Windows\System\XCuhEZW.exe
  2⤵
  PID:8860
- C:\Windows\System\lfdksLj.exe
  C:\Windows\System\lfdksLj.exe
  2⤵
  PID:13144
- C:\Windows\System\HAqQxwY.exe
  C:\Windows\System\HAqQxwY.exe
  2⤵
  PID:12708
- C:\Windows\System\JwzDVDG.exe
  C:\Windows\System\JwzDVDG.exe
  2⤵
  PID:448
- C:\Windows\System\NuEzQlN.exe
  C:\Windows\System\NuEzQlN.exe
  2⤵
  PID:10436
- C:\Windows\System\DOeZIbP.exe
  C:\Windows\System\DOeZIbP.exe
  2⤵
  PID:6324
- C:\Windows\System\anJtAhy.exe
  C:\Windows\System\anJtAhy.exe
  2⤵
  PID:7780
- C:\Windows\System\cNIJBNC.exe
  C:\Windows\System\cNIJBNC.exe
  2⤵
  PID:10760
- C:\Windows\System\YGsxWti.exe
  C:\Windows\System\YGsxWti.exe
  2⤵
  PID:12784
- C:\Windows\System\bKKXxhE.exe
  C:\Windows\System\bKKXxhE.exe
  2⤵
  PID:8612
- C:\Windows\System\jAVovsL.exe
  C:\Windows\System\jAVovsL.exe
  2⤵
  PID:10220
- C:\Windows\System\AcpFmDp.exe
  C:\Windows\System\AcpFmDp.exe
  2⤵
  PID:10016
- C:\Windows\System\kADoAhI.exe
  C:\Windows\System\kADoAhI.exe
  2⤵
  PID:13208
- C:\Windows\System\AxQrcbr.exe
  C:\Windows\System\AxQrcbr.exe
  2⤵
  PID:8956
- C:\Windows\System\dYbFbeA.exe
  C:\Windows\System\dYbFbeA.exe
  2⤵
  PID:7520
- C:\Windows\System\AnqqnDi.exe
  C:\Windows\System\AnqqnDi.exe
  2⤵
  PID:10128
- C:\Windows\System\ZultaMM.exe
  C:\Windows\System\ZultaMM.exe
  2⤵
  PID:9176
- C:\Windows\System\bwyCzWO.exe
  C:\Windows\System\bwyCzWO.exe
  2⤵
  PID:11152
- C:\Windows\System\FwWubEg.exe
  C:\Windows\System\FwWubEg.exe
  2⤵
  PID:11804
- C:\Windows\System\LnZQAfb.exe
  C:\Windows\System\LnZQAfb.exe
  2⤵
  PID:13088
- C:\Windows\System\cjljAfa.exe
  C:\Windows\System\cjljAfa.exe
  2⤵
  PID:9008
- C:\Windows\System\TsdQQZH.exe
  C:\Windows\System\TsdQQZH.exe
  2⤵
  PID:6760
- C:\Windows\System\IKmHQIG.exe
  C:\Windows\System\IKmHQIG.exe
  2⤵
  PID:7156
- C:\Windows\System\JLPyitl.exe
  C:\Windows\System\JLPyitl.exe
  2⤵
  PID:6428
- C:\Windows\System\pQXnUDN.exe
  C:\Windows\System\pQXnUDN.exe
  2⤵
  PID:10984
- C:\Windows\System\EbgsExR.exe
  C:\Windows\System\EbgsExR.exe
  2⤵
  PID:10572
- C:\Windows\System\uFoVHak.exe
  C:\Windows\System\uFoVHak.exe
  2⤵
  PID:9072
- C:\Windows\System\XcoKSfx.exe
  C:\Windows\System\XcoKSfx.exe
  2⤵
  PID:11024
- C:\Windows\System\VPSUnkM.exe
  C:\Windows\System\VPSUnkM.exe
  2⤵
  PID:4580
- C:\Windows\System\KsTgMjb.exe
  C:\Windows\System\KsTgMjb.exe
  2⤵
  PID:6680
- C:\Windows\System\xBYJPwx.exe
  C:\Windows\System\xBYJPwx.exe
  2⤵
  PID:10732
- C:\Windows\System\BbfYBnN.exe
  C:\Windows\System\BbfYBnN.exe
  2⤵
  PID:10756
- C:\Windows\System\SjZlWpl.exe
  C:\Windows\System\SjZlWpl.exe
  2⤵
  PID:10488
- C:\Windows\System\xODVWbP.exe
  C:\Windows\System\xODVWbP.exe
  2⤵
  PID:8180
- C:\Windows\System\sMZCjtT.exe
  C:\Windows\System\sMZCjtT.exe
  2⤵
  PID:10744
- C:\Windows\System\xYTzvDi.exe
  C:\Windows\System\xYTzvDi.exe
  2⤵
  PID:10592
- C:\Windows\System\zzhuUNN.exe
  C:\Windows\System\zzhuUNN.exe
  2⤵
  PID:10136
- C:\Windows\System\hhqBohB.exe
  C:\Windows\System\hhqBohB.exe
  2⤵
  PID:12088
- C:\Windows\System\cRuuIHj.exe
  C:\Windows\System\cRuuIHj.exe
  2⤵
  PID:11388
- C:\Windows\System\GCLVNcj.exe
  C:\Windows\System\GCLVNcj.exe
  2⤵
  PID:7260
- C:\Windows\System\BLtlpGp.exe
  C:\Windows\System\BLtlpGp.exe
  2⤵
  PID:7940
- C:\Windows\System\ZFAtqgo.exe
  C:\Windows\System\ZFAtqgo.exe
  2⤵
  PID:8144
- C:\Windows\System\MKecypt.exe
  C:\Windows\System\MKecypt.exe
  2⤵
  PID:1796
- C:\Windows\System\YgFNedD.exe
  C:\Windows\System\YgFNedD.exe
  2⤵
  PID:9980
- C:\Windows\System\ddhEzpy.exe
  C:\Windows\System\ddhEzpy.exe
  2⤵
  PID:10656
- C:\Windows\System\kxDMFni.exe
  C:\Windows\System\kxDMFni.exe
  2⤵
  PID:10748
- C:\Windows\System\KSvIPHk.exe
  C:\Windows\System\KSvIPHk.exe
  2⤵
  PID:10260
- C:\Windows\System\QHjiREn.exe
  C:\Windows\System\QHjiREn.exe
  2⤵
  PID:5268
- C:\Windows\System\OgjUmEU.exe
  C:\Windows\System\OgjUmEU.exe
  2⤵
  PID:9040
- C:\Windows\System\SAEhwyf.exe
  C:\Windows\System\SAEhwyf.exe
  2⤵
  PID:11392
- C:\Windows\System\TGPDryH.exe
  C:\Windows\System\TGPDryH.exe
  2⤵
  PID:11068
- C:\Windows\System\rEDAiYe.exe
  C:\Windows\System\rEDAiYe.exe
  2⤵
  PID:12144
- C:\Windows\System\qkuvBTA.exe
  C:\Windows\System\qkuvBTA.exe
  2⤵
  PID:11100
- C:\Windows\System\Rrbedtg.exe
  C:\Windows\System\Rrbedtg.exe
  2⤵
  PID:10780
- C:\Windows\System\PoJbgUr.exe
  C:\Windows\System\PoJbgUr.exe
  2⤵
  PID:11988
- C:\Windows\System\wstbnvo.exe
  C:\Windows\System\wstbnvo.exe
  2⤵
  PID:12008
- C:\Windows\System\NCBfSsM.exe
  C:\Windows\System\NCBfSsM.exe
  2⤵
  PID:8620
- C:\Windows\System\YoDiLmS.exe
  C:\Windows\System\YoDiLmS.exe
  2⤵
  PID:11648
- C:\Windows\System\nUocGYz.exe
  C:\Windows\System\nUocGYz.exe
  2⤵
  PID:11664
- C:\Windows\System\oZUGwIc.exe
  C:\Windows\System\oZUGwIc.exe
  2⤵
  PID:11692
- C:\Windows\System\jHhvqPZ.exe
  C:\Windows\System\jHhvqPZ.exe
  2⤵
  PID:10784
- C:\Windows\System\zzjnJAO.exe
  C:\Windows\System\zzjnJAO.exe
  2⤵
  PID:11984
- C:\Windows\System\tHiAHSg.exe
  C:\Windows\System\tHiAHSg.exe
  2⤵
  PID:9876
- C:\Windows\System\cdDHner.exe
  C:\Windows\System\cdDHner.exe
  2⤵
  PID:10968
- C:\Windows\System\FScUZZH.exe
  C:\Windows\System\FScUZZH.exe
  2⤵
  PID:11116
- C:\Windows\System\AJEgBWG.exe
  C:\Windows\System\AJEgBWG.exe
  2⤵
  PID:10228
- C:\Windows\System\zQvRoQY.exe
  C:\Windows\System\zQvRoQY.exe
  2⤵
  PID:10368
- C:\Windows\System\vFGOUnD.exe
  C:\Windows\System\vFGOUnD.exe
  2⤵
  PID:12024
- C:\Windows\System\fluhWBu.exe
  C:\Windows\System\fluhWBu.exe
  2⤵
  PID:12332
- C:\Windows\System\RRmLGxj.exe
  C:\Windows\System\RRmLGxj.exe
  2⤵
  PID:12596
- C:\Windows\System\yGCnNEY.exe
  C:\Windows\System\yGCnNEY.exe
  2⤵
  PID:12364
- C:\Windows\System\LyXmFAn.exe
  C:\Windows\System\LyXmFAn.exe
  2⤵
  PID:12492
- C:\Windows\System\CrqdYkt.exe
  C:\Windows\System\CrqdYkt.exe
  2⤵
  PID:13128
- C:\Windows\System\khiEwkN.exe
  C:\Windows\System\khiEwkN.exe
  2⤵
  PID:12212
- C:\Windows\System\AdZwPbc.exe
  C:\Windows\System\AdZwPbc.exe
  2⤵
  PID:13216
- C:\Windows\System\xsOwRyn.exe
  C:\Windows\System\xsOwRyn.exe
  2⤵
  PID:11332
- C:\Windows\System\IBMoUOy.exe
  C:\Windows\System\IBMoUOy.exe
  2⤵
  PID:9100
- C:\Windows\System\rKGIwvT.exe
  C:\Windows\System\rKGIwvT.exe
  2⤵
  PID:5776
- C:\Windows\System\AgyxSBy.exe
  C:\Windows\System\AgyxSBy.exe
  2⤵
  PID:12224
- C:\Windows\System\apQzKjV.exe
  C:\Windows\System\apQzKjV.exe
  2⤵
  PID:12496
- C:\Windows\System\JBKdwyq.exe
  C:\Windows\System\JBKdwyq.exe
  2⤵
  PID:12468
- C:\Windows\System\DrOhVoe.exe
  C:\Windows\System\DrOhVoe.exe
  2⤵
  PID:13176
- C:\Windows\System\nigDQUi.exe
  C:\Windows\System\nigDQUi.exe
  2⤵
  PID:13160
- C:\Windows\System\vPsqpWV.exe
  C:\Windows\System\vPsqpWV.exe
  2⤵
  PID:13308
- C:\Windows\System\QQVtBgx.exe
  C:\Windows\System\QQVtBgx.exe
  2⤵
  PID:10196
- C:\Windows\System\ngrptOh.exe
  C:\Windows\System\ngrptOh.exe
  2⤵
  PID:4536
- C:\Windows\System\vGoobyq.exe
  C:\Windows\System\vGoobyq.exe
  2⤵
  PID:11436
- C:\Windows\System\TaiTpkv.exe
  C:\Windows\System\TaiTpkv.exe
  2⤵
  PID:4056
- C:\Windows\System\RQViLxy.exe
  C:\Windows\System\RQViLxy.exe
  2⤵
  PID:12988
- C:\Windows\System\LsRVVNQ.exe
  C:\Windows\System\LsRVVNQ.exe
  2⤵
  PID:9428
- C:\Windows\System\MzImNZC.exe
  C:\Windows\System\MzImNZC.exe
  2⤵
  PID:6580
- C:\Windows\System\svdqWmX.exe
  C:\Windows\System\svdqWmX.exe
  2⤵
  PID:7376
- C:\Windows\System\QkuhmIF.exe
  C:\Windows\System\QkuhmIF.exe
  2⤵
  PID:12620
- C:\Windows\System\QDbaUfG.exe
  C:\Windows\System\QDbaUfG.exe
  2⤵
  PID:2868
- C:\Windows\System\xQYbYyc.exe
  C:\Windows\System\xQYbYyc.exe
  2⤵
  PID:13220
- C:\Windows\System\nrdESrF.exe
  C:\Windows\System\nrdESrF.exe
  2⤵
  PID:12292
- C:\Windows\System\cXwsIhl.exe
  C:\Windows\System\cXwsIhl.exe
  2⤵
  PID:11536
- C:\Windows\System\okxWUvZ.exe
  C:\Windows\System\okxWUvZ.exe
  2⤵
  PID:7496
- C:\Windows\System\NvDaxkY.exe
  C:\Windows\System\NvDaxkY.exe
  2⤵
  PID:10244
- C:\Windows\System\czpQpiL.exe
  C:\Windows\System\czpQpiL.exe
  2⤵
  PID:1868
- C:\Windows\System\bYYbEsT.exe
  C:\Windows\System\bYYbEsT.exe
  2⤵
  PID:7452
- C:\Windows\System\RQHoCsf.exe
  C:\Windows\System\RQHoCsf.exe
  2⤵
  PID:2268
- C:\Windows\System\fgFYRGn.exe
  C:\Windows\System\fgFYRGn.exe
  2⤵
  PID:11368
- C:\Windows\System\TOxQwux.exe
  C:\Windows\System\TOxQwux.exe
  2⤵
  PID:10312
- C:\Windows\System\YFKrwcR.exe
  C:\Windows\System\YFKrwcR.exe
  2⤵
  PID:1152
- C:\Windows\System\QrMBobH.exe
  C:\Windows\System\QrMBobH.exe
  2⤵
  PID:10684
- C:\Windows\System\tbAZHOl.exe
  C:\Windows\System\tbAZHOl.exe
  2⤵
  PID:10776
- C:\Windows\System\QwcdBww.exe
  C:\Windows\System\QwcdBww.exe
  2⤵
  PID:12656
- C:\Windows\System\FDxUnIU.exe
  C:\Windows\System\FDxUnIU.exe
  2⤵
  PID:14356
- C:\Windows\System\pcgMjVa.exe
  C:\Windows\System\pcgMjVa.exe
  2⤵
  PID:14392
- C:\Windows\System\djupcVf.exe
  C:\Windows\System\djupcVf.exe
  2⤵
  PID:14412
- C:\Windows\System\dSzAtmh.exe
  C:\Windows\System\dSzAtmh.exe
  2⤵
  PID:14432
- C:\Windows\System\IXyEICh.exe
  C:\Windows\System\IXyEICh.exe
  2⤵
  PID:14452
- C:\Windows\System\egKWXaa.exe
  C:\Windows\System\egKWXaa.exe
  2⤵
  PID:14476
- C:\Windows\System\PUaQnWh.exe
  C:\Windows\System\PUaQnWh.exe
  2⤵
  PID:14540
- C:\Windows\System\nCZMqtA.exe
  C:\Windows\System\nCZMqtA.exe
  2⤵
  PID:14560
- C:\Windows\System\AAOAwGg.exe
  C:\Windows\System\AAOAwGg.exe
  2⤵
  PID:14588
- C:\Windows\System\MSOAdrp.exe
  C:\Windows\System\MSOAdrp.exe
  2⤵
  PID:14612
- C:\Windows\System\RssAUTa.exe
  C:\Windows\System\RssAUTa.exe
  2⤵
  PID:14640
- C:\Windows\System\DdYXMCn.exe
  C:\Windows\System\DdYXMCn.exe
  2⤵
  PID:14660
- C:\Windows\System\GfSDfhB.exe
  C:\Windows\System\GfSDfhB.exe
  2⤵
  PID:14680
- C:\Windows\System\BcEKzVe.exe
  C:\Windows\System\BcEKzVe.exe
  2⤵
  PID:14712
- C:\Windows\System\RjehhJU.exe
  C:\Windows\System\RjehhJU.exe
  2⤵
  PID:14732
- C:\Windows\System\QLyeAlJ.exe
  C:\Windows\System\QLyeAlJ.exe
  2⤵
  PID:14756
- C:\Windows\System\ZRXWmsN.exe
  C:\Windows\System\ZRXWmsN.exe
  2⤵
  PID:14780
- C:\Windows\System\SLHKTid.exe
  C:\Windows\System\SLHKTid.exe
  2⤵
  PID:14800
- C:\Windows\System\yoxfqqU.exe
  C:\Windows\System\yoxfqqU.exe
  2⤵
  PID:14824
- C:\Windows\System\aFzQEDy.exe
  C:\Windows\System\aFzQEDy.exe
  2⤵
  PID:14852
- C:\Windows\System\yGEEGWy.exe
  C:\Windows\System\yGEEGWy.exe
  2⤵
  PID:14908
- C:\Windows\System\vkNbzPs.exe
  C:\Windows\System\vkNbzPs.exe
  2⤵
  PID:14928
- C:\Windows\System\DOJtpPK.exe
  C:\Windows\System\DOJtpPK.exe
  2⤵
  PID:14952
- C:\Windows\System\rdztwUx.exe
  C:\Windows\System\rdztwUx.exe
  2⤵
  PID:14972
- C:\Windows\System\UAdtVvl.exe
  C:\Windows\System\UAdtVvl.exe
  2⤵
  PID:14992
- C:\Windows\System\ovxWrcQ.exe
  C:\Windows\System\ovxWrcQ.exe
  2⤵
  PID:15012
- C:\Windows\System\QkKFtYK.exe
  C:\Windows\System\QkKFtYK.exe
  2⤵
  PID:15052
- C:\Windows\System\eJCQfKa.exe
  C:\Windows\System\eJCQfKa.exe
  2⤵
  PID:15164
- C:\Windows\System\byyKVFW.exe
  C:\Windows\System\byyKVFW.exe
  2⤵
  PID:15188
- C:\Windows\System\VaiDxKJ.exe
  C:\Windows\System\VaiDxKJ.exe
  2⤵
  PID:15304
- C:\Windows\System\JnpjWuP.exe
  C:\Windows\System\JnpjWuP.exe
  2⤵
  PID:15324
- C:\Windows\System\EPqYnNd.exe
  C:\Windows\System\EPqYnNd.exe
  2⤵
  PID:15352
- C:\Windows\System\nMiRRfj.exe
  C:\Windows\System\nMiRRfj.exe
  2⤵
  PID:11256
- C:\Windows\System\sCfGAnH.exe
  C:\Windows\System\sCfGAnH.exe
  2⤵
  PID:7600
- C:\Windows\System\FfHFBoR.exe
  C:\Windows\System\FfHFBoR.exe
  2⤵
  PID:14348
- C:\Windows\System\bpbuOpi.exe
  C:\Windows\System\bpbuOpi.exe
  2⤵
  PID:14408
- C:\Windows\System\trHpWhl.exe
  C:\Windows\System\trHpWhl.exe
  2⤵
  PID:11920
- C:\Windows\System\XXHHctA.exe
  C:\Windows\System\XXHHctA.exe
  2⤵
  PID:14628
- C:\Windows\System\QGbDjsq.exe
  C:\Windows\System\QGbDjsq.exe
  2⤵
  PID:14724
- C:\Windows\System\ULavnpc.exe
  C:\Windows\System\ULavnpc.exe
  2⤵
  PID:14864
- C:\Windows\System\DadlSvZ.exe
  C:\Windows\System\DadlSvZ.exe
  2⤵
  PID:14924
- C:\Windows\System\cfwLuIH.exe
  C:\Windows\System\cfwLuIH.exe
  2⤵
  PID:14796
- C:\Windows\System\QFRdCez.exe
  C:\Windows\System\QFRdCez.exe
  2⤵
  PID:14832
- C:\Windows\System\ACrLFzk.exe
  C:\Windows\System\ACrLFzk.exe
  2⤵
  PID:14880
- C:\Windows\System\ynlYeUn.exe
  C:\Windows\System\ynlYeUn.exe
  2⤵
  PID:14884
- C:\Windows\System\WvKVwva.exe
  C:\Windows\System\WvKVwva.exe
  2⤵
  PID:14988
- C:\Windows\System\hWUcdba.exe
  C:\Windows\System\hWUcdba.exe
  2⤵
  PID:15064
- C:\Windows\System\DZJjSvG.exe
  C:\Windows\System\DZJjSvG.exe
  2⤵
  PID:15152
- C:\Windows\System\qWWUvOg.exe
  C:\Windows\System\qWWUvOg.exe
  2⤵
  PID:15272
- C:\Windows\System\hGKYDjl.exe
  C:\Windows\System\hGKYDjl.exe
  2⤵
  PID:15340
- C:\Windows\System\DrKFdck.exe
  C:\Windows\System\DrKFdck.exe
  2⤵
  PID:14752
- C:\Windows\System\VsknjtP.exe
  C:\Windows\System\VsknjtP.exe
  2⤵
  PID:14548
- C:\Windows\System\TSyfxzq.exe
  C:\Windows\System\TSyfxzq.exe
  2⤵
  PID:14968
- C:\Windows\System\GwIeLGG.exe
  C:\Windows\System\GwIeLGG.exe
  2⤵
  PID:14708
- C:\Windows\System\rLBBMvQ.exe
  C:\Windows\System\rLBBMvQ.exe
  2⤵
  PID:14860
- C:\Windows\System\FpeWyuh.exe
  C:\Windows\System\FpeWyuh.exe
  2⤵
  PID:14444
- C:\Windows\System\DWHaXiL.exe
  C:\Windows\System\DWHaXiL.exe
  2⤵
  PID:14744
- C:\Windows\System\rOsjXry.exe
  C:\Windows\System\rOsjXry.exe
  2⤵
  PID:15028
- C:\Windows\System\cuJuRXc.exe
  C:\Windows\System\cuJuRXc.exe
  2⤵
  PID:14520
- C:\Windows\System\QHEGxAy.exe
  C:\Windows\System\QHEGxAy.exe
  2⤵
  PID:14688
- C:\Windows\System\WqFxLzK.exe
  C:\Windows\System\WqFxLzK.exe
  2⤵
  PID:15376
- C:\Windows\System\HKljjQo.exe
  C:\Windows\System\HKljjQo.exe
  2⤵
  PID:15392
- C:\Windows\System\OGDFCus.exe
  C:\Windows\System\OGDFCus.exe
  2⤵
  PID:15420
- C:\Windows\System\WTJlPVo.exe
  C:\Windows\System\WTJlPVo.exe
  2⤵
  PID:15452
- C:\Windows\System\IbNfeuv.exe
  C:\Windows\System\IbNfeuv.exe
  2⤵
  PID:15500
- C:\Windows\System\WikEQIG.exe
  C:\Windows\System\WikEQIG.exe
  2⤵
  PID:15528
- C:\Windows\System\XUDvRPa.exe
  C:\Windows\System\XUDvRPa.exe
  2⤵
  PID:15616
- C:\Windows\System\XCYAKKZ.exe
  C:\Windows\System\XCYAKKZ.exe
  2⤵
  PID:15648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=1717989458112 --process=260 /prefetch:7 --thread=5748
1⤵
PID:13200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kcoi3kcv.u2w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AFTnqna.exe

Filesize
1.9MB

MD5
470cdff73093ec6e0d8a4a77cf775bae

SHA1
b75a8962098e16bbc5be3574d7638fdb9d419ce6

SHA256
f682be35c1a90d3a889d4a1620de42add42c458e7b5e88859ba86abad856fde0

SHA512
cfbbb90c20276f4e7b3881fc0cbb90cf3e88296e4bf3cb024a650d51ef0577ce32d7397d291e5082164a36b9ffa264750dfd70326cf49c6260cfe4596f0890be

Download Submit
C:\Windows\System\BKnzKDJ.exe

Filesize
1.9MB

MD5
f6154e272594780f5273338c2ab919f9

SHA1
a0992b61e4cd410b9a16384f8d57480be288f6a9

SHA256
a6791357a7459a010acafe0e0b0e9eaa14f0a547eea69729834facc9bdf77f0a

SHA512
3597e41bedf6da4e0ad406dc2f0950fff9879838fd76d43feaef9a0869e38230b9c902c8819f8df46d8378d66eb64065a1434b2e553dae80fe3a7bd19d3e3fc0

Download Submit
C:\Windows\System\DALuOKO.exe

Filesize
1.9MB

MD5
e9cbf85ee3c1ee59bab92bbcb8bb1956

SHA1
13c4f3fd95feb80b50a4bc2835a7a274094bef54

SHA256
54f54f1aa6451538fceabd38d11bacbd03eb13ed914ebd46a07131fe7cb62920

SHA512
e49b2937aa600b738e4255a2cdcc06f237a0fb3fe086ba18d999b1889bce9414c5897985ceedef9ba657457771ed13df3d88eb406690d18dfea1bf33ba023eeb

Download Submit
C:\Windows\System\DiTplmP.exe

Filesize
1.9MB

MD5
dbb56b4519e7f770702bfe16b3a8bc13

SHA1
d15053e7a2052d8c6a46635b7412084217331868

SHA256
366a4adb1e727f16742f75248380e20567b880d9c88dcc2d527268517a50b9e0

SHA512
9f803da85ead46d88fbcf78dc964bdb4b85015099551332a42dd0580fd001d3c13e735c315678cc356ca8ff2b3fd991cdafd3c79c5ba7dbabdfc28d7490e09dd

Download Submit
C:\Windows\System\DwwRSoC.exe

Filesize
1.9MB

MD5
8deae16ec3baa4aa7984183fa75f9483

SHA1
ae766ed76c79aeb6ad3a6392654775466c027dc6

SHA256
8e894422e5c4637be98633ffc762da15d249a770f45401faaef9a177117201a0

SHA512
b700db7d35d4f0133e28aee7ff8be395630a13a9129625f85bea7f7d50e69566cdeebfa7fd4dbfb00a7b921f96cf5832119c87e4c8c69eb35ec59d23df82b21e

Download Submit
C:\Windows\System\FUaTfsu.exe

Filesize
1.9MB

MD5
6bd71f9fc4971cce0b54749931a95547

SHA1
e77efc4ad40abe129d0583e17d9777d823859f50

SHA256
b0802b6b4238aede3dd8b03ab227d7fdf4b4f8a7d550fb5b9f4c28b6aec94515

SHA512
38172e0ba17345910cd105a4dae6e53f243c8a3a2df350852cd63119e7fc665db3479be59ba8ae52726aa49ee61c12844d066741603d3d87c1b66ee56eabc62e

Download Submit
C:\Windows\System\FgWZixl.exe

Filesize
1.9MB

MD5
117408934a03502923aaab40a0525ba5

SHA1
22f15745f1f648c6986b774e1c48a146b0248d06

SHA256
cda86fa8377134436f9dc15f7d1329075c037e875a25b956acaabe01cc60edb4

SHA512
7152808f3aad08c59c83d9aa7a3e56209667650346b488d017c0805c20872378cf83f8f83d8ddd5ae91a6f91037cf490af0752b8c4cd243db34f92a020d09390

Download Submit
C:\Windows\System\GaLgbqZ.exe

Filesize
1.9MB

MD5
f29b9cf22d4bf4120cec1c7e70faf485

SHA1
e1f130226b8bba21035daba37424b2593e1b7de6

SHA256
0ac328e5d945acf2f5b0af0b7887d090484a9550cd3bec1485b6cd1b41ab6583

SHA512
c25fe235fd568ba99ccae93e26d2bcbbd46d2fc45e81cd707a368c81372661f1f618ba012131f025e19ae82c4d86500482adc490ff9f1fa3c5fedf9c31c07b75

Download Submit
C:\Windows\System\GdZijVM.exe

Filesize
1.9MB

MD5
f065f8cc61bb4ebee5e81369c005d777

SHA1
4509f292d87904f8903a2392fafb013967868cd1

SHA256
d8a50b34320cb8013e36f66b844260f8efcea3618b3e314601a04b14eaf63565

SHA512
fe3133e7fb5da5376bc6499e802aa1bf94fb6b4d755134b6647f4ec704bee56eb6bbedb1478438b7f82d7a13f370d3d8c29c130e97ea8ff005caf3fbff6c52f8

Download Submit
C:\Windows\System\HQffxjI.exe

Filesize
1.9MB

MD5
c07cb7a2f07b9573af8c1abd2f666bdb

SHA1
63447f28a06dc7758b91f2863e5071079545e09b

SHA256
bc3a1e21a2c6c6158c871d0b2916ab88425c52fc3bc529166b4c5d370bce1d32

SHA512
f768469f0fc6b11f51fd5d769a78123fc9da25ded365c73113a0c71c5618e743113083b63c95899ae409090a6aa8612dc05f7bc5db57afb9e74ccd2b7c0340e4

Download Submit
C:\Windows\System\KRqCtuK.exe

Filesize
1.9MB

MD5
f5724e6aa8d76039ab82f5a785adee55

SHA1
ee0978843623fb6fd568d746925ef4a31acb34b8

SHA256
e73f538c4a5b2adb29ca14458927aa8b6e648e2c5c0d7f8ba499561bc1f8e148

SHA512
e11ae4ca5f3f5c2619f64d93bcc85ed2a1639322b9c12d46139d2d433e59473b6da177fe754f0a06725e164b219496bff7b3543fa795c8c55f626613a86ac650

Download Submit
C:\Windows\System\NMGdeZa.exe

Filesize
1.9MB

MD5
a159e6637a5cc07b62be8ee3ce519795

SHA1
cbbbc669a232f54693c648a0a98b1b197b03bc19

SHA256
26df45693c12453d03a66b987d9891e2b3edd06b41db26665b8ecdafbc869f13

SHA512
2a59d161d67ce86b0914784ee33f666dc678d0eb2ad3ce6f13482ac492b0f93aa3d5a65c802935569f96c2603e54ea67a8259912996a0c6e1f35fee47dd3fc34

Download Submit
C:\Windows\System\NTDDhpU.exe

Filesize
1.9MB

MD5
cd858b5ac895f57cb8ce1e9925a33c20

SHA1
6c26f23e8b4c5adaf9cc7b1118ef78c0ba8208c9

SHA256
820340bf0a2218d012856cd7c57fbd0a67f705776a2685d8a0f9052c1c417df6

SHA512
96d7a88d2b4d68cb77785fdf07b55f90f82a13d654f9bdf9e4ab81aa4d7c66608c0214a1e6a7b2aae96d6bea7d847720b93941abba068906f0860ffc3f7b2067

Download Submit
C:\Windows\System\OJOmvgf.exe

Filesize
1.9MB

MD5
ac2d9108525369b2c6890215bf36ba67

SHA1
c4ba19d2d4f101184ab85e43ab78f65449750b14

SHA256
9ace06278f421807ab436eabd639e37d7893adbda4af2c57d816f322be375ecc

SHA512
7a02bb4d4530c0ac22323e55c09f36cc5c66ff884cec4c38029695c51c246b1eb2da021fe881429b7f9ab5786e2ed215b7681b7b89f4674e48d2d8d5ba3aceb2

Download Submit
C:\Windows\System\OfkWBRA.exe

Filesize
1.9MB

MD5
5b542db57fc28dd9f6dce0f951971f99

SHA1
b43e09959030aa44364791c42746236c66e16ed7

SHA256
dce4aad96b577177311693e7204f001134a5c0cbbce2309011769d7d10b3d9a3

SHA512
8493f31db553780e837ab0b20aace710f564fbb5c55e8e3d5ff2d958e49788b3da41ff23e89042bcdd8208318ee07b7af4c1f670154c7d52a71bc1b96a2abd60

Download Submit
C:\Windows\System\OnREVAR.exe

Filesize
1.9MB

MD5
46ff2b08e5c3f8f7237260fc043cd7f1

SHA1
0eb9ed119d4a9310145efdd7e106762aef9164c7

SHA256
35929cb87a765d5097d5c42ccfc58fe6ae7a2b65a062f4de6b7f3623a0c6aae5

SHA512
d3dd93b8b5af174590551c5999809acf359bf89eb58edc7550d58d158e42db9ddd95497cc597af4620f43283ac8c2ab970df543f0839e11da31a3e320faa5dbd

Download Submit
C:\Windows\System\PUooSzM.exe

Filesize
1.9MB

MD5
fc1f871eeb70afae2055fad2600ab5d6

SHA1
465b4db68fe3e0e42c9ae83b9d934d034d8b784e

SHA256
cab39dc322fd7f3d7269ad0c4aac3e214c2d18f878f4c27cd4e4ab433af1d47b

SHA512
b2802654892c7e1a9ebf941e9288c29f96fac356fa87c512e81f666a311bedc290836b72b344f622554a6e935c1fa3829d656a55b9e0925e63c4165dc47243d8

Download Submit
C:\Windows\System\PgztEjz.exe

Filesize
1.9MB

MD5
bce1c00a66f9fd54a33684076ad4a9fc

SHA1
0fb59172267943bf20248de0c52de9e8f5f6fc73

SHA256
15fd6ec7bdb5ede423ac5f1435876a6e68e13729e67c1b658e1047559e72b96b

SHA512
ef35a402ebf78a885fa857e1638ff103ca3f43365e3f0c684a624b2e13e18cbcfb3a48724352c68306c99d30b242c2dfdb70e077c3dfa20527dd319b8064f132

Download Submit
C:\Windows\System\PuEUVbH.exe

Filesize
1.9MB

MD5
359fd4e5430a7d00d5827033d21e9450

SHA1
11d359eedd408eb5806a5a8d52270423c738f4e1

SHA256
a1b2fed9df1ba7e45c54f96e10d46e86c6b10b0df717adc69c8bc0f5f5018eb5

SHA512
f3c54513201d1e452859a3f0b7c3b3108fa840101ce4186f0db8dac7c867e81b53c69e00e91b968c50dd28747c35660170c5d914f041bef0b9fddb9bd73af20d

Download Submit
C:\Windows\System\QnTScLj.exe

Filesize
1.9MB

MD5
84eb24a874253c75a9320df91d1f092f

SHA1
32e414a5fcb101f9425baae1e55a9fa409e8e957

SHA256
32ba4ce9f85a0281b3536a058c77b075086e6bd929a73bc6b6d3657e998f7bb2

SHA512
a895d5ba8610a08c086b6344f4e6cb9463b40ba01434ceb1e4e10e7eacb804414b64c4295fda51ec356cc44bb7a38e7a75cc52c347ded908a1c67b782e3d43ec

Download Submit
C:\Windows\System\UTUKsWO.exe

Filesize
1.9MB

MD5
d41ce5e8ce002fe367410f992a62a8ad

SHA1
4b175b3b156701937862480b532e2ebfe8f89030

SHA256
2f7733ed33052effcbb11a66f38f3adb25e8d635d34b573903c5ea5b6738c4f3

SHA512
c46d875cb7624344fa4c73f0484249197597e25b307fbff748c48fb071ca56e5f42010c81464bc52d666269b8e9037281aa8b490d31a762e8061ec0f59466d81

Download Submit
C:\Windows\System\VWmfQNy.exe

Filesize
1.9MB

MD5
52622bc6f0075eb6daaef48c6fcb84c3

SHA1
df8529f50682029ace596fa638b676f7627a7a41

SHA256
9faffa47239c2c5eeb4bc5cf570310df656ae028dd5970f9be7bc20a11d467ff

SHA512
c245dac4962d31c58f3203dd058933290140cb347f9dcd7a26818c03a3ca6cf3e2e8488f338fcdbe6d2d3ecaceea6ce3c96e0660708785c51636961878127c6f

Download Submit
C:\Windows\System\WQKNaqn.exe

Filesize
1.9MB

MD5
ee8020349a761a949499b412f2905557

SHA1
1545f4c6ea550e32890d5f15b7d0f62c3514b152

SHA256
478946b81b1ee31fb9972f7e9369f16e2d5c34f0c2e284a98050f7f1fabf9104

SHA512
572e2936e5e3d2ce85ed302858ac987fa758197b40494cc179ab29e508d7429b579bf0894eca3a3919ca94852ed8812e9820ad856223cb8b3b48297d2571e741

Download Submit
C:\Windows\System\XTQngXp.exe

Filesize
1.9MB

MD5
9edd87c66abe5a1fe6520f58c3ba21e0

SHA1
ba02e54533ac0219eca16449121019b08a4f4d65

SHA256
c66150f703e57891c148e233fc4dc0d29750c9e451b7926c143fd8bc2b700b7f

SHA512
f3277325a50dfe6f7e7f2f9d3ecf7d2a96f48dc035560478021fa83bf99fb032bb34e0f136fa7fe45ce9893cc1bf3fde385a30892faf62caede21dc6bc69a68d

Download Submit
C:\Windows\System\XtdFsHH.exe

Filesize
1.9MB

MD5
a0e2f4bf057e042260a495b1193b1aee

SHA1
df0a69de18681ebd66eeed6b0e0fa0e855ead505

SHA256
4eed0a24f75be2a2c4fd9dd2dc97f28e0ad735b984ad536949c9401700a24ce1

SHA512
2a5c384e9c1f0d4bcef11935ed5502f220f92a03308aa509a962c27d3345cf0f93bcc0968fcffdc4b3139024b3c48e2892a185cee2f4e67f8ad2123b49e96612

Download Submit
C:\Windows\System\choXTHi.exe

Filesize
1.9MB

MD5
5164db9ce5c249be82478ef2bf06ea5c

SHA1
e47a0b458262b58e38ebf4c6f08e19a1050639e3

SHA256
97d98222a75e0ade182461a490776282384cf2d29d4fdb7c572ce3fad1096700

SHA512
4f6f1f4b8330e781520221de816b4d105d81293bea81f1d6e07de31ff0ddab1714b2f4c76d20876981af0f8967c865ba5d2caff490ef206d455961921beb79af

Download Submit
C:\Windows\System\ftoFuqe.exe

Filesize
1.9MB

MD5
0724d0622ed555a06bb1652d3c06823d

SHA1
a978dee84037af9b0f404e09a1377e7fe651319d

SHA256
2b04412a0040193ad23c3a7afe0d0acda2b362d657753a67be6c729f89271ea6

SHA512
0f2dc49db9e27bf8f1ffd062a653fca4ec641816fb34734ce788ebd582ac040be4048b2ba1aed27db989ca9c284b72bd82949bf64cedb64bc33fedc4c516664e

Download Submit
C:\Windows\System\hwfBeCc.exe

Filesize
1.9MB

MD5
254edb9d2024ec5b97ecaa219dea68f3

SHA1
e519da5aa5b89b54ed5e55fc4e207911755c3cbb

SHA256
610a0d39ec664ba7763272ae805eb34c8e9a7ec168bb3b1c07bde482fbb5e248

SHA512
fc507045ad4902f50899421f31db1a9f4c10b6b103b7d07c730aeac7bec9318f41537f6c538f127b0435986a61d7aa7800550bf8f0144e6f80940cec032e5393

Download Submit
C:\Windows\System\mwIipeO.exe

Filesize
1.9MB

MD5
13128724c6e062e066c6ce75acf09047

SHA1
68f94f1a443d6d420ac26d607045d8b8d531913f

SHA256
e48406d431992853272f34632e50fc01358945eff75d4727dc686e8963b4cc2e

SHA512
e6732ce8187ee2bf91fcbea1d09f49815ca591174d30e8af2ee6f57bde1121f58641ece26d9a2c5c86b54d078959f875b66bb5637ac5a79b1b42a2ed4432e153

Download Submit
C:\Windows\System\oaXHQiS.exe

Filesize
1.9MB

MD5
f5c71804f178a78d9b38d9b4f8438260

SHA1
552d16ce10780668cd3acc8a7e61646d7d0e9de7

SHA256
da2c0095babf28979582f03a4148204070cfd7a4ed4286060b1e304799e82e38

SHA512
935fe2f45a8b72866cb70063c52d40c385ea79129c3d50ca39697639e26ede91cd01c15cfae56fa602473dc70d2cfa4a29a5ca643fecafc3458a0520a5956af9

Download Submit
C:\Windows\System\qveFlLR.exe

Filesize
1.9MB

MD5
e4cbe53baa7e5e4a35a1b41bdba6dab7

SHA1
55b94f33ea80e40282ba6e22cc26cfc8aec0c6d3

SHA256
34f2cd623ffb1d748b0bfb86e1a09d475e28f637be0c92ce65ad46ed6bfc6b62

SHA512
bed81214eea64e67013af3a1c3205dd90c3352cf223d9af6256e65cba25728dde68a68f9a2526faeada71b7bef761c54a5a6f3986fe9436f5e46d746fbd65788

Download Submit
C:\Windows\System\sCNetWU.exe

Filesize
1.9MB

MD5
610c567d0cc7c22952703ccb411ed302

SHA1
34a049368ba959577d37c65da3c2a700eb739e6e

SHA256
363593e3adc77db031794f2364252651c53e0dd7a9226ca47354b2610a273ec3

SHA512
72465a5bc113404c6896fb886aeaded24d5ecd46f6a4e0b66844cd3f5c11ed1a7bbff7e9b46fa12320f3cee4fb91e9802fd395a55cdf174c5ca1496557b1fb6a

Download Submit
C:\Windows\System\ymOmzFd.exe

Filesize
1.9MB

MD5
19e67cba92582aaf106c56818e7d8f6d

SHA1
e3bf3c0fb1d7210d690dfa5b9cb7a8ccdf2410ca

SHA256
6414f8570b03bb730c9b2c18b834c120ab4adbf6e18a4c01f7b0efda49c7b99f

SHA512
4296bfb287e6f9f8f81a096cddc3b934ecdb96d155ad0044f0c44d20777edef672e04c1046d6a75ed39d64564927d143c4564a024dac79af4ee60de9d71b4be4

Download Submit
memory/1644-2147-0x00007FF7CAAE0000-0x00007FF7CAED2000-memory.dmp

Filesize
3.9MB

Download
memory/1644-153-0x00007FF7CAAE0000-0x00007FF7CAED2000-memory.dmp

Filesize
3.9MB

Download
memory/1976-1989-0x00007FF70FA70000-0x00007FF70FE62000-memory.dmp

Filesize
3.9MB

Download
memory/1976-48-0x00007FF70FA70000-0x00007FF70FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2188-158-0x00007FF6491B0000-0x00007FF6495A2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-2173-0x00007FF6491B0000-0x00007FF6495A2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-8-0x00007FF73A430000-0x00007FF73A822000-memory.dmp

Filesize
3.9MB

Download
memory/2616-105-0x00007FF79CC60000-0x00007FF79D052000-memory.dmp

Filesize
3.9MB

Download
memory/2616-2099-0x00007FF79CC60000-0x00007FF79D052000-memory.dmp

Filesize
3.9MB

Download
memory/3016-156-0x00007FF64F500000-0x00007FF64F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-2187-0x00007FF64F500000-0x00007FF64F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3204-72-0x00007FF7B7AD0000-0x00007FF7B7EC2000-memory.dmp

Filesize
3.9MB

Download
memory/3236-13-0x000001CDF9E60000-0x000001CDF9E82000-memory.dmp

Filesize
136KB

Download
memory/3236-151-0x000001CDF7BB0000-0x000001CDF7BC0000-memory.dmp

Filesize
64KB

Download
memory/3236-327-0x000001CDFAB10000-0x000001CDFB2B6000-memory.dmp

Filesize
7.6MB

Download
memory/3236-44-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Filesize
10.8MB

Download
memory/3548-78-0x00007FF6C5AC0000-0x00007FF6C5EB2000-memory.dmp

Filesize
3.9MB

Download
memory/3548-2033-0x00007FF6C5AC0000-0x00007FF6C5EB2000-memory.dmp

Filesize
3.9MB

Download
memory/4168-2144-0x00007FF75C350000-0x00007FF75C742000-memory.dmp

Filesize
3.9MB

Download
memory/4168-155-0x00007FF75C350000-0x00007FF75C742000-memory.dmp

Filesize
3.9MB

Download
memory/4252-79-0x00007FF7C14D0000-0x00007FF7C18C2000-memory.dmp

Filesize
3.9MB

Download
memory/4408-154-0x00007FF65D8D0000-0x00007FF65DCC2000-memory.dmp

Filesize
3.9MB

Download
memory/4408-2150-0x00007FF65D8D0000-0x00007FF65DCC2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-0-0x00007FF7CC8C0000-0x00007FF7CCCB2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-1-0x00000210E40D0000-0x00000210E40E0000-memory.dmp

Filesize
64KB

Download
memory/5340-112-0x00007FF7DE900000-0x00007FF7DECF2000-memory.dmp

Filesize
3.9MB

Download
memory/5344-123-0x00007FF635010000-0x00007FF635402000-memory.dmp

Filesize
3.9MB

Download
memory/5380-132-0x00007FF7AF120000-0x00007FF7AF512000-memory.dmp

Filesize
3.9MB

Download
memory/5392-96-0x00007FF6CA340000-0x00007FF6CA732000-memory.dmp

Filesize
3.9MB

Download
memory/5392-2038-0x00007FF6CA340000-0x00007FF6CA732000-memory.dmp

Filesize
3.9MB

Download
memory/5516-2146-0x00007FF6C0C90000-0x00007FF6C1082000-memory.dmp

Filesize
3.9MB

Download
memory/5516-136-0x00007FF6C0C90000-0x00007FF6C1082000-memory.dmp

Filesize
3.9MB

Download
memory/5760-2135-0x00007FF79FAA0000-0x00007FF79FE92000-memory.dmp

Filesize
3.9MB

Download
memory/5760-152-0x00007FF79FAA0000-0x00007FF79FE92000-memory.dmp

Filesize
3.9MB

Download
memory/5896-147-0x00007FF6EE440000-0x00007FF6EE832000-memory.dmp

Filesize
3.9MB

Download
memory/5896-2169-0x00007FF6EE440000-0x00007FF6EE832000-memory.dmp

Filesize
3.9MB

Download
memory/5948-143-0x00007FF68D8D0000-0x00007FF68DCC2000-memory.dmp

Filesize
3.9MB

Download
memory/5948-2167-0x00007FF68D8D0000-0x00007FF68DCC2000-memory.dmp

Filesize
3.9MB

Download
memory/5972-2148-0x00007FF710710000-0x00007FF710B02000-memory.dmp

Filesize
3.9MB

Download
memory/5972-157-0x00007FF710710000-0x00007FF710B02000-memory.dmp

Filesize
3.9MB

Download
memory/5992-2143-0x00007FF680440000-0x00007FF680832000-memory.dmp

Filesize
3.9MB

Download
memory/5992-150-0x00007FF680440000-0x00007FF680832000-memory.dmp

Filesize
3.9MB

Download