xmrig | 778a84b5f54da3441cdec54d445ccf28aa0a7daf0fa03a47c7f83951ef3db7f7

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
Size

1.9MB
MD5

0ac1f0696d5c80f3ddc3848e7737f069
SHA1

0d6546b0c3b2daea160ee4548602701b2cdacc74
SHA256

778a84b5f54da3441cdec54d445ccf28aa0a7daf0fa03a47c7f83951ef3db7f7
SHA512

e7a22ff9eaad26021756518f43122a34aa2cec3368392804bdf5f86edbc69963bb0d6ce1319f06442dcd8fc50eea6392e5bb797d0d38230a69f68208b02bad03
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Ui:NABd

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/2160-52-0x00007FF66E600000-0x00007FF66E9F2000-memory.dmp	xmrig
behavioral2/memory/228-63-0x00007FF7BCB00000-0x00007FF7BCEF2000-memory.dmp	xmrig
behavioral2/memory/5108-79-0x00007FF7081C0000-0x00007FF7085B2000-memory.dmp	xmrig
behavioral2/memory/940-72-0x00007FF66F560000-0x00007FF66F952000-memory.dmp	xmrig
behavioral2/memory/3444-66-0x00007FF6664B0000-0x00007FF6668A2000-memory.dmp	xmrig
behavioral2/memory/5072-61-0x00007FF621A30000-0x00007FF621E22000-memory.dmp	xmrig
behavioral2/memory/2860-58-0x00007FF70DB40000-0x00007FF70DF32000-memory.dmp	xmrig
behavioral2/memory/4832-45-0x00007FF78DAE0000-0x00007FF78DED2000-memory.dmp	xmrig
behavioral2/memory/1076-1251-0x00007FF619510000-0x00007FF619902000-memory.dmp	xmrig
behavioral2/memory/1004-1292-0x00007FF75BC30000-0x00007FF75C022000-memory.dmp	xmrig
behavioral2/memory/2792-1355-0x00007FF770AE0000-0x00007FF770ED2000-memory.dmp	xmrig
behavioral2/memory/3852-1692-0x00007FF74E310000-0x00007FF74E702000-memory.dmp	xmrig
behavioral2/memory/1980-1702-0x00007FF79A300000-0x00007FF79A6F2000-memory.dmp	xmrig
behavioral2/memory/3684-1722-0x00007FF7BB940000-0x00007FF7BBD32000-memory.dmp	xmrig
behavioral2/memory/1284-1729-0x00007FF6452E0000-0x00007FF6456D2000-memory.dmp	xmrig
behavioral2/memory/2256-1769-0x00007FF672EE0000-0x00007FF6732D2000-memory.dmp	xmrig
behavioral2/memory/4656-1750-0x00007FF723890000-0x00007FF723C82000-memory.dmp	xmrig
behavioral2/memory/2504-1733-0x00007FF7BDB90000-0x00007FF7BDF82000-memory.dmp	xmrig
behavioral2/memory/948-1673-0x00007FF6BAAB0000-0x00007FF6BAEA2000-memory.dmp	xmrig
behavioral2/memory/1472-1665-0x00007FF7DA4A0000-0x00007FF7DA892000-memory.dmp	xmrig
behavioral2/memory/3660-1206-0x00007FF6C3CF0000-0x00007FF6C40E2000-memory.dmp	xmrig
behavioral2/memory/5072-1880-0x00007FF621A30000-0x00007FF621E22000-memory.dmp	xmrig
behavioral2/memory/4656-1934-0x00007FF723890000-0x00007FF723C82000-memory.dmp	xmrig
behavioral2/memory/1004-1937-0x00007FF75BC30000-0x00007FF75C022000-memory.dmp	xmrig
behavioral2/memory/1472-1953-0x00007FF7DA4A0000-0x00007FF7DA892000-memory.dmp	xmrig
behavioral2/memory/2860-1980-0x00007FF70DB40000-0x00007FF70DF32000-memory.dmp	xmrig
behavioral2/memory/2256-1974-0x00007FF672EE0000-0x00007FF6732D2000-memory.dmp	xmrig
behavioral2/memory/940-1973-0x00007FF66F560000-0x00007FF66F952000-memory.dmp	xmrig
behavioral2/memory/3852-1962-0x00007FF74E310000-0x00007FF74E702000-memory.dmp	xmrig
behavioral2/memory/1076-1958-0x00007FF619510000-0x00007FF619902000-memory.dmp	xmrig
behavioral2/memory/3660-1955-0x00007FF6C3CF0000-0x00007FF6C40E2000-memory.dmp	xmrig
behavioral2/memory/228-1954-0x00007FF7BCB00000-0x00007FF7BCEF2000-memory.dmp	xmrig
behavioral2/memory/1284-1979-0x00007FF6452E0000-0x00007FF6456D2000-memory.dmp	xmrig
behavioral2/memory/2504-1972-0x00007FF7BDB90000-0x00007FF7BDF82000-memory.dmp	xmrig
behavioral2/memory/4832-1965-0x00007FF78DAE0000-0x00007FF78DED2000-memory.dmp	xmrig
behavioral2/memory/5108-1959-0x00007FF7081C0000-0x00007FF7085B2000-memory.dmp	xmrig
behavioral2/memory/2160-1952-0x00007FF66E600000-0x00007FF66E9F2000-memory.dmp	xmrig
behavioral2/memory/2792-1951-0x00007FF770AE0000-0x00007FF770ED2000-memory.dmp	xmrig
behavioral2/memory/948-1950-0x00007FF6BAAB0000-0x00007FF6BAEA2000-memory.dmp	xmrig
behavioral2/memory/1980-1949-0x00007FF79A300000-0x00007FF79A6F2000-memory.dmp	xmrig
behavioral2/memory/3684-1948-0x00007FF7BB940000-0x00007FF7BBD32000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4376	powershell.exe
5	4376	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3444	GxaYpPy.exe
4832	RenTikb.exe
2160	SFvDkIw.exe
2860	ahExZvs.exe
5072	RXuovdL.exe
940	wJhOGpJ.exe
5108	XfismQp.exe
228	KtmTaeT.exe
3660	sUXRKwW.exe
4656	zROSvRX.exe
1076	jfoeWth.exe
2256	EBWJTcE.exe
1004	sIeowUp.exe
2792	rNYhZft.exe
1472	VvTXdSS.exe
948	piGOLjQ.exe
3852	vNAbTtf.exe
1980	ugiMluv.exe
3684	TcWVqHG.exe
1284	sEaeGaB.exe
2504	xTVtCvG.exe
2796	SuMrdqU.exe
4032	UeKFDwF.exe
2596	QOubyaH.exe
2880	qPxbKcy.exe
2288	ENhbcnc.exe
376	zGsNXKC.exe
3044	JeTxDcy.exe
1332	DFWlXXE.exe
1072	irZqyMh.exe
1168	fZYInsD.exe
4620	mLfIeas.exe
4244	HtwpNBH.exe
3692	QlojgbV.exe
2352	MgjYCAt.exe
1748	ImUJGUg.exe
4780	wgnVEDA.exe
4460	QjdxkYF.exe
4204	cJLtBlB.exe
2304	RCzIWtt.exe
2084	lqJiFjR.exe
5032	KlSQRcH.exe
2120	eEdKyjX.exe
1480	JHnnmzt.exe
4944	YGCwXhK.exe
2988	OeHGpdE.exe
4744	IsDZeKb.exe
3960	LlgDvbB.exe
3048	zVGHkGq.exe
3076	HASfeCo.exe
4496	nUOlTMO.exe
4424	vafPldy.exe
4908	oVQsuOU.exe
1468	uMsCABM.exe
1640	OKsHsbx.exe
3320	hbzRYqU.exe
1796	itCsSrY.exe
3156	KaXIjHV.exe
4928	OXaQUSd.exe
1804	pgScNrR.exe
3896	EsFDlEH.exe
2236	qqRZhdY.exe
5136	SBQKdRb.exe
5160	tcUgwMs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4836-0-0x00007FF6C8AE0000-0x00007FF6C8ED2000-memory.dmp	upx
behavioral2/files/0x000b000000023227-5.dat	upx
behavioral2/files/0x0008000000023267-10.dat	upx
behavioral2/files/0x0007000000023268-26.dat	upx
behavioral2/files/0x000800000002326a-30.dat	upx
behavioral2/files/0x0008000000023269-47.dat	upx
behavioral2/memory/2160-52-0x00007FF66E600000-0x00007FF66E9F2000-memory.dmp	upx
behavioral2/files/0x000700000002326d-62.dat	upx
behavioral2/memory/228-63-0x00007FF7BCB00000-0x00007FF7BCEF2000-memory.dmp	upx
behavioral2/files/0x000700000002326e-67.dat	upx
behavioral2/memory/5108-79-0x00007FF7081C0000-0x00007FF7085B2000-memory.dmp	upx
behavioral2/files/0x0007000000023271-84.dat	upx
behavioral2/files/0x0007000000023272-95.dat	upx
behavioral2/files/0x0007000000023275-109.dat	upx
behavioral2/files/0x000700000002327c-144.dat	upx
behavioral2/files/0x000700000002327f-154.dat	upx
behavioral2/files/0x0007000000023280-167.dat	upx
behavioral2/files/0x0007000000023282-175.dat	upx
behavioral2/files/0x0007000000023284-180.dat	upx
behavioral2/files/0x0007000000023285-183.dat	upx
behavioral2/files/0x0007000000023283-179.dat	upx
behavioral2/files/0x0007000000023281-172.dat	upx
behavioral2/files/0x000700000002327e-157.dat	upx
behavioral2/files/0x000700000002327d-152.dat	upx
behavioral2/files/0x000700000002327b-140.dat	upx
behavioral2/files/0x000700000002327a-137.dat	upx
behavioral2/files/0x0007000000023279-127.dat	upx
behavioral2/files/0x0007000000023278-125.dat	upx
behavioral2/files/0x0007000000023277-120.dat	upx
behavioral2/files/0x0007000000023276-115.dat	upx
behavioral2/files/0x0007000000023274-105.dat	upx
behavioral2/files/0x0007000000023273-99.dat	upx
behavioral2/files/0x0007000000023270-83.dat	upx
behavioral2/files/0x000700000002326f-75.dat	upx
behavioral2/memory/940-72-0x00007FF66F560000-0x00007FF66F952000-memory.dmp	upx
behavioral2/memory/3444-66-0x00007FF6664B0000-0x00007FF6668A2000-memory.dmp	upx
behavioral2/memory/5072-61-0x00007FF621A30000-0x00007FF621E22000-memory.dmp	upx
behavioral2/memory/2860-58-0x00007FF70DB40000-0x00007FF70DF32000-memory.dmp	upx
behavioral2/files/0x000700000002326c-56.dat	upx
behavioral2/files/0x0008000000023265-53.dat	upx
behavioral2/memory/4832-45-0x00007FF78DAE0000-0x00007FF78DED2000-memory.dmp	upx
behavioral2/files/0x000700000002326b-35.dat	upx
behavioral2/memory/1076-1251-0x00007FF619510000-0x00007FF619902000-memory.dmp	upx
behavioral2/memory/1004-1292-0x00007FF75BC30000-0x00007FF75C022000-memory.dmp	upx
behavioral2/memory/2792-1355-0x00007FF770AE0000-0x00007FF770ED2000-memory.dmp	upx
behavioral2/memory/3852-1692-0x00007FF74E310000-0x00007FF74E702000-memory.dmp	upx
behavioral2/memory/1980-1702-0x00007FF79A300000-0x00007FF79A6F2000-memory.dmp	upx
behavioral2/memory/3684-1722-0x00007FF7BB940000-0x00007FF7BBD32000-memory.dmp	upx
behavioral2/memory/1284-1729-0x00007FF6452E0000-0x00007FF6456D2000-memory.dmp	upx
behavioral2/memory/2256-1769-0x00007FF672EE0000-0x00007FF6732D2000-memory.dmp	upx
behavioral2/memory/4656-1750-0x00007FF723890000-0x00007FF723C82000-memory.dmp	upx
behavioral2/memory/2504-1733-0x00007FF7BDB90000-0x00007FF7BDF82000-memory.dmp	upx
behavioral2/memory/948-1673-0x00007FF6BAAB0000-0x00007FF6BAEA2000-memory.dmp	upx
behavioral2/memory/1472-1665-0x00007FF7DA4A0000-0x00007FF7DA892000-memory.dmp	upx
behavioral2/memory/3660-1206-0x00007FF6C3CF0000-0x00007FF6C40E2000-memory.dmp	upx
behavioral2/memory/5072-1880-0x00007FF621A30000-0x00007FF621E22000-memory.dmp	upx
behavioral2/memory/4656-1934-0x00007FF723890000-0x00007FF723C82000-memory.dmp	upx
behavioral2/memory/1004-1937-0x00007FF75BC30000-0x00007FF75C022000-memory.dmp	upx
behavioral2/memory/1472-1953-0x00007FF7DA4A0000-0x00007FF7DA892000-memory.dmp	upx
behavioral2/memory/2860-1980-0x00007FF70DB40000-0x00007FF70DF32000-memory.dmp	upx
behavioral2/memory/2256-1974-0x00007FF672EE0000-0x00007FF6732D2000-memory.dmp	upx
behavioral2/memory/940-1973-0x00007FF66F560000-0x00007FF66F952000-memory.dmp	upx
behavioral2/memory/3852-1962-0x00007FF74E310000-0x00007FF74E702000-memory.dmp	upx
behavioral2/memory/1076-1958-0x00007FF619510000-0x00007FF619902000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OTaatMu.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\nfJrmIH.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\hfiRiNT.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\LxJfxXQ.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\fZYInsD.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\rabdBpO.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\nOGeYtm.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\JmxfHNW.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\fhuoEYK.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\QOubyaH.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\zGsNXKC.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\urEsTUj.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\pSPPLFP.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\qmVHkEI.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\gupiMno.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\AHjdQHn.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\YBveLli.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\zWaQxxX.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\YhWDHch.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\WDjIzHH.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\FJHzWUY.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\SIxVsIr.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\yMZjKxY.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\CcRlFKz.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\XRPekpJ.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\AuaErUb.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\GuGQUnm.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\gAelvBl.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\FxDqPer.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\amylOxG.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\mOEsbQM.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\dApNbWr.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\lDcFVUK.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\KzfvFVX.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\ZyWiqsY.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\UPKnoQb.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\KWnypvx.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\OeHGpdE.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\XiamGXy.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\pOqtZdb.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\BFzEfBs.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\auISzzW.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\SFvDkIw.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\wERtzJz.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\BScxDnF.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\ybuztxh.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\ZyJndyu.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\SUcDobE.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\WTnSFxd.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\HFaiKUA.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\vqWOrHw.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\JxFFMod.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\oJFGjtX.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\GzYuYOy.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\ahExZvs.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\yAunWKt.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\GcAAhPt.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\FdSonyn.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\eAPPuDd.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\dloSIvk.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\mLfIeas.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\LlgDvbB.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\RvGMLsJ.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
File created	C:\Windows\System\AlojaxG.exe	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4376	powershell.exe
4376	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeLockMemoryPrivilege	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4376	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	90
PID 4836 wrote to memory of 4376	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	90
PID 4836 wrote to memory of 3444	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	91
PID 4836 wrote to memory of 3444	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	91
PID 4836 wrote to memory of 4832	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	92
PID 4836 wrote to memory of 4832	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	92
PID 4836 wrote to memory of 2160	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	93
PID 4836 wrote to memory of 2160	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	93
PID 4836 wrote to memory of 2860	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	94
PID 4836 wrote to memory of 2860	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	94
PID 4836 wrote to memory of 5072	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	95
PID 4836 wrote to memory of 5072	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	95
PID 4836 wrote to memory of 940	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	96
PID 4836 wrote to memory of 940	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	96
PID 4836 wrote to memory of 5108	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	97
PID 4836 wrote to memory of 5108	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	97
PID 4836 wrote to memory of 228	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	98
PID 4836 wrote to memory of 228	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	98
PID 4836 wrote to memory of 3660	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	99
PID 4836 wrote to memory of 3660	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	99
PID 4836 wrote to memory of 4656	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	100
PID 4836 wrote to memory of 4656	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	100
PID 4836 wrote to memory of 1076	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	101
PID 4836 wrote to memory of 1076	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	101
PID 4836 wrote to memory of 2256	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	102
PID 4836 wrote to memory of 2256	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	102
PID 4836 wrote to memory of 1004	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	103
PID 4836 wrote to memory of 1004	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	103
PID 4836 wrote to memory of 2792	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	104
PID 4836 wrote to memory of 2792	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	104
PID 4836 wrote to memory of 1472	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	105
PID 4836 wrote to memory of 1472	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	105
PID 4836 wrote to memory of 948	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	106
PID 4836 wrote to memory of 948	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	106
PID 4836 wrote to memory of 3852	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	107
PID 4836 wrote to memory of 3852	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	107
PID 4836 wrote to memory of 1980	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	108
PID 4836 wrote to memory of 1980	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	108
PID 4836 wrote to memory of 3684	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	109
PID 4836 wrote to memory of 3684	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	109
PID 4836 wrote to memory of 1284	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	110
PID 4836 wrote to memory of 1284	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	110
PID 4836 wrote to memory of 2504	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	111
PID 4836 wrote to memory of 2504	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	111
PID 4836 wrote to memory of 2796	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	112
PID 4836 wrote to memory of 2796	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	112
PID 4836 wrote to memory of 4032	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	113
PID 4836 wrote to memory of 4032	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	113
PID 4836 wrote to memory of 2596	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	114
PID 4836 wrote to memory of 2596	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	114
PID 4836 wrote to memory of 2880	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	115
PID 4836 wrote to memory of 2880	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	115
PID 4836 wrote to memory of 2288	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	116
PID 4836 wrote to memory of 2288	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	116
PID 4836 wrote to memory of 376	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	117
PID 4836 wrote to memory of 376	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	117
PID 4836 wrote to memory of 3044	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	118
PID 4836 wrote to memory of 3044	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	118
PID 4836 wrote to memory of 1332	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	119
PID 4836 wrote to memory of 1332	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	119
PID 4836 wrote to memory of 1072	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	120
PID 4836 wrote to memory of 1072	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	120
PID 4836 wrote to memory of 1168	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	121
PID 4836 wrote to memory of 1168	4836	0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe	121

C:\Users\Admin\AppData\Local\Temp\0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ac1f0696d5c80f3ddc3848e7737f069_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\System\GxaYpPy.exe
  C:\Windows\System\GxaYpPy.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\RenTikb.exe
  C:\Windows\System\RenTikb.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\SFvDkIw.exe
  C:\Windows\System\SFvDkIw.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\ahExZvs.exe
  C:\Windows\System\ahExZvs.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\RXuovdL.exe
  C:\Windows\System\RXuovdL.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\wJhOGpJ.exe
  C:\Windows\System\wJhOGpJ.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\XfismQp.exe
  C:\Windows\System\XfismQp.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\KtmTaeT.exe
  C:\Windows\System\KtmTaeT.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\sUXRKwW.exe
  C:\Windows\System\sUXRKwW.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\zROSvRX.exe
  C:\Windows\System\zROSvRX.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\jfoeWth.exe
  C:\Windows\System\jfoeWth.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\EBWJTcE.exe
  C:\Windows\System\EBWJTcE.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\sIeowUp.exe
  C:\Windows\System\sIeowUp.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\rNYhZft.exe
  C:\Windows\System\rNYhZft.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\VvTXdSS.exe
  C:\Windows\System\VvTXdSS.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\piGOLjQ.exe
  C:\Windows\System\piGOLjQ.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\vNAbTtf.exe
  C:\Windows\System\vNAbTtf.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\ugiMluv.exe
  C:\Windows\System\ugiMluv.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\TcWVqHG.exe
  C:\Windows\System\TcWVqHG.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\sEaeGaB.exe
  C:\Windows\System\sEaeGaB.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\xTVtCvG.exe
  C:\Windows\System\xTVtCvG.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\SuMrdqU.exe
  C:\Windows\System\SuMrdqU.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\UeKFDwF.exe
  C:\Windows\System\UeKFDwF.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\QOubyaH.exe
  C:\Windows\System\QOubyaH.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\qPxbKcy.exe
  C:\Windows\System\qPxbKcy.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\ENhbcnc.exe
  C:\Windows\System\ENhbcnc.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\zGsNXKC.exe
  C:\Windows\System\zGsNXKC.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\JeTxDcy.exe
  C:\Windows\System\JeTxDcy.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\DFWlXXE.exe
  C:\Windows\System\DFWlXXE.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\irZqyMh.exe
  C:\Windows\System\irZqyMh.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\fZYInsD.exe
  C:\Windows\System\fZYInsD.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\mLfIeas.exe
  C:\Windows\System\mLfIeas.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\HtwpNBH.exe
  C:\Windows\System\HtwpNBH.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\QlojgbV.exe
  C:\Windows\System\QlojgbV.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\MgjYCAt.exe
  C:\Windows\System\MgjYCAt.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\ImUJGUg.exe
  C:\Windows\System\ImUJGUg.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\wgnVEDA.exe
  C:\Windows\System\wgnVEDA.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\QjdxkYF.exe
  C:\Windows\System\QjdxkYF.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\cJLtBlB.exe
  C:\Windows\System\cJLtBlB.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\RCzIWtt.exe
  C:\Windows\System\RCzIWtt.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\lqJiFjR.exe
  C:\Windows\System\lqJiFjR.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\KlSQRcH.exe
  C:\Windows\System\KlSQRcH.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\eEdKyjX.exe
  C:\Windows\System\eEdKyjX.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\JHnnmzt.exe
  C:\Windows\System\JHnnmzt.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\YGCwXhK.exe
  C:\Windows\System\YGCwXhK.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\OeHGpdE.exe
  C:\Windows\System\OeHGpdE.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\IsDZeKb.exe
  C:\Windows\System\IsDZeKb.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\LlgDvbB.exe
  C:\Windows\System\LlgDvbB.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\zVGHkGq.exe
  C:\Windows\System\zVGHkGq.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\HASfeCo.exe
  C:\Windows\System\HASfeCo.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\nUOlTMO.exe
  C:\Windows\System\nUOlTMO.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\vafPldy.exe
  C:\Windows\System\vafPldy.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\oVQsuOU.exe
  C:\Windows\System\oVQsuOU.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\uMsCABM.exe
  C:\Windows\System\uMsCABM.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\OKsHsbx.exe
  C:\Windows\System\OKsHsbx.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\hbzRYqU.exe
  C:\Windows\System\hbzRYqU.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\itCsSrY.exe
  C:\Windows\System\itCsSrY.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\KaXIjHV.exe
  C:\Windows\System\KaXIjHV.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\OXaQUSd.exe
  C:\Windows\System\OXaQUSd.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\pgScNrR.exe
  C:\Windows\System\pgScNrR.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\EsFDlEH.exe
  C:\Windows\System\EsFDlEH.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\qqRZhdY.exe
  C:\Windows\System\qqRZhdY.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\SBQKdRb.exe
  C:\Windows\System\SBQKdRb.exe
  2⤵
  - Executes dropped EXE
  PID:5136
- C:\Windows\System\tcUgwMs.exe
  C:\Windows\System\tcUgwMs.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\AHjdQHn.exe
  C:\Windows\System\AHjdQHn.exe
  2⤵
  PID:5196
- C:\Windows\System\nyENPdS.exe
  C:\Windows\System\nyENPdS.exe
  2⤵
  PID:5232
- C:\Windows\System\BRLmdNE.exe
  C:\Windows\System\BRLmdNE.exe
  2⤵
  PID:5260
- C:\Windows\System\fglyOyN.exe
  C:\Windows\System\fglyOyN.exe
  2⤵
  PID:5284
- C:\Windows\System\pyPdSRd.exe
  C:\Windows\System\pyPdSRd.exe
  2⤵
  PID:5316
- C:\Windows\System\wuOttVx.exe
  C:\Windows\System\wuOttVx.exe
  2⤵
  PID:5336
- C:\Windows\System\gyhYjWX.exe
  C:\Windows\System\gyhYjWX.exe
  2⤵
  PID:5372
- C:\Windows\System\GuOnKwn.exe
  C:\Windows\System\GuOnKwn.exe
  2⤵
  PID:5400
- C:\Windows\System\UudolIC.exe
  C:\Windows\System\UudolIC.exe
  2⤵
  PID:5432
- C:\Windows\System\VQPMKPq.exe
  C:\Windows\System\VQPMKPq.exe
  2⤵
  PID:5464
- C:\Windows\System\VNklvrH.exe
  C:\Windows\System\VNklvrH.exe
  2⤵
  PID:5504
- C:\Windows\System\vekdTpB.exe
  C:\Windows\System\vekdTpB.exe
  2⤵
  PID:5528
- C:\Windows\System\zjCVQIN.exe
  C:\Windows\System\zjCVQIN.exe
  2⤵
  PID:5552
- C:\Windows\System\pANlrmQ.exe
  C:\Windows\System\pANlrmQ.exe
  2⤵
  PID:5580
- C:\Windows\System\KIOGQGW.exe
  C:\Windows\System\KIOGQGW.exe
  2⤵
  PID:5604
- C:\Windows\System\SnkROFB.exe
  C:\Windows\System\SnkROFB.exe
  2⤵
  PID:5624
- C:\Windows\System\GdImPXg.exe
  C:\Windows\System\GdImPXg.exe
  2⤵
  PID:5656
- C:\Windows\System\FyooyOp.exe
  C:\Windows\System\FyooyOp.exe
  2⤵
  PID:5688
- C:\Windows\System\kQxzcIq.exe
  C:\Windows\System\kQxzcIq.exe
  2⤵
  PID:5716
- C:\Windows\System\BLXblWZ.exe
  C:\Windows\System\BLXblWZ.exe
  2⤵
  PID:5736
- C:\Windows\System\AXFuMki.exe
  C:\Windows\System\AXFuMki.exe
  2⤵
  PID:5816
- C:\Windows\System\xJnXRId.exe
  C:\Windows\System\xJnXRId.exe
  2⤵
  PID:5832
- C:\Windows\System\xkpTaFp.exe
  C:\Windows\System\xkpTaFp.exe
  2⤵
  PID:5856
- C:\Windows\System\BOPBgDn.exe
  C:\Windows\System\BOPBgDn.exe
  2⤵
  PID:5884
- C:\Windows\System\GwTUzPQ.exe
  C:\Windows\System\GwTUzPQ.exe
  2⤵
  PID:5924
- C:\Windows\System\DocgDhz.exe
  C:\Windows\System\DocgDhz.exe
  2⤵
  PID:5952
- C:\Windows\System\qDFgoYZ.exe
  C:\Windows\System\qDFgoYZ.exe
  2⤵
  PID:5996
- C:\Windows\System\TVUTsQc.exe
  C:\Windows\System\TVUTsQc.exe
  2⤵
  PID:6012
- C:\Windows\System\KHmPuuz.exe
  C:\Windows\System\KHmPuuz.exe
  2⤵
  PID:6036
- C:\Windows\System\bZlLmXG.exe
  C:\Windows\System\bZlLmXG.exe
  2⤵
  PID:6056
- C:\Windows\System\vPhYbPQ.exe
  C:\Windows\System\vPhYbPQ.exe
  2⤵
  PID:6080
- C:\Windows\System\HloXCGI.exe
  C:\Windows\System\HloXCGI.exe
  2⤵
  PID:6100
- C:\Windows\System\ONgPfEK.exe
  C:\Windows\System\ONgPfEK.exe
  2⤵
  PID:6116
- C:\Windows\System\pENjZsF.exe
  C:\Windows\System\pENjZsF.exe
  2⤵
  PID:3628
- C:\Windows\System\dLnYTct.exe
  C:\Windows\System\dLnYTct.exe
  2⤵
  PID:1776
- C:\Windows\System\LkYvRaB.exe
  C:\Windows\System\LkYvRaB.exe
  2⤵
  PID:3544
- C:\Windows\System\xwJwKMc.exe
  C:\Windows\System\xwJwKMc.exe
  2⤵
  PID:5168
- C:\Windows\System\GucMqfJ.exe
  C:\Windows\System\GucMqfJ.exe
  2⤵
  PID:5216
- C:\Windows\System\RwYLYsA.exe
  C:\Windows\System\RwYLYsA.exe
  2⤵
  PID:5248
- C:\Windows\System\wijdWbu.exe
  C:\Windows\System\wijdWbu.exe
  2⤵
  PID:5296
- C:\Windows\System\SQwrWsz.exe
  C:\Windows\System\SQwrWsz.exe
  2⤵
  PID:5384
- C:\Windows\System\BxhFmwY.exe
  C:\Windows\System\BxhFmwY.exe
  2⤵
  PID:5420
- C:\Windows\System\hruNGLB.exe
  C:\Windows\System\hruNGLB.exe
  2⤵
  PID:5520
- C:\Windows\System\wERtzJz.exe
  C:\Windows\System\wERtzJz.exe
  2⤵
  PID:5576
- C:\Windows\System\NkhSaJm.exe
  C:\Windows\System\NkhSaJm.exe
  2⤵
  PID:5616
- C:\Windows\System\BFYkVlx.exe
  C:\Windows\System\BFYkVlx.exe
  2⤵
  PID:5644
- C:\Windows\System\gnQtQRj.exe
  C:\Windows\System\gnQtQRj.exe
  2⤵
  PID:5704
- C:\Windows\System\CigdXbp.exe
  C:\Windows\System\CigdXbp.exe
  2⤵
  PID:4348
- C:\Windows\System\cftGzLn.exe
  C:\Windows\System\cftGzLn.exe
  2⤵
  PID:2864
- C:\Windows\System\cIYgOqv.exe
  C:\Windows\System\cIYgOqv.exe
  2⤵
  PID:916
- C:\Windows\System\HQZthlH.exe
  C:\Windows\System\HQZthlH.exe
  2⤵
  PID:1372
- C:\Windows\System\lLLwLLx.exe
  C:\Windows\System\lLLwLLx.exe
  2⤵
  PID:4920
- C:\Windows\System\pOqtZdb.exe
  C:\Windows\System\pOqtZdb.exe
  2⤵
  PID:1704
- C:\Windows\System\iNamfeQ.exe
  C:\Windows\System\iNamfeQ.exe
  2⤵
  PID:2644
- C:\Windows\System\qcbfIeK.exe
  C:\Windows\System\qcbfIeK.exe
  2⤵
  PID:4076
- C:\Windows\System\pOXkHbZ.exe
  C:\Windows\System\pOXkHbZ.exe
  2⤵
  PID:1304
- C:\Windows\System\diQUYgf.exe
  C:\Windows\System\diQUYgf.exe
  2⤵
  PID:3592
- C:\Windows\System\HWHXMfe.exe
  C:\Windows\System\HWHXMfe.exe
  2⤵
  PID:5848
- C:\Windows\System\upVVAtH.exe
  C:\Windows\System\upVVAtH.exe
  2⤵
  PID:5868
- C:\Windows\System\HgEoUEh.exe
  C:\Windows\System\HgEoUEh.exe
  2⤵
  PID:5852
- C:\Windows\System\ycJybnL.exe
  C:\Windows\System\ycJybnL.exe
  2⤵
  PID:5916
- C:\Windows\System\AQNECwb.exe
  C:\Windows\System\AQNECwb.exe
  2⤵
  PID:5948
- C:\Windows\System\MWYrkqs.exe
  C:\Windows\System\MWYrkqs.exe
  2⤵
  PID:5992
- C:\Windows\System\YPEHiOK.exe
  C:\Windows\System\YPEHiOK.exe
  2⤵
  PID:5228
- C:\Windows\System\VducWJm.exe
  C:\Windows\System\VducWJm.exe
  2⤵
  PID:6028
- C:\Windows\System\LfBVVmf.exe
  C:\Windows\System\LfBVVmf.exe
  2⤵
  PID:6048
- C:\Windows\System\ZDOfytd.exe
  C:\Windows\System\ZDOfytd.exe
  2⤵
  PID:6112
- C:\Windows\System\gHYQFQp.exe
  C:\Windows\System\gHYQFQp.exe
  2⤵
  PID:1180
- C:\Windows\System\veHvOUl.exe
  C:\Windows\System\veHvOUl.exe
  2⤵
  PID:1176
- C:\Windows\System\FCQgWWg.exe
  C:\Windows\System\FCQgWWg.exe
  2⤵
  PID:2096
- C:\Windows\System\pFWQras.exe
  C:\Windows\System\pFWQras.exe
  2⤵
  PID:5208
- C:\Windows\System\EpaGSqF.exe
  C:\Windows\System\EpaGSqF.exe
  2⤵
  PID:3932
- C:\Windows\System\hIlwzSR.exe
  C:\Windows\System\hIlwzSR.exe
  2⤵
  PID:5516
- C:\Windows\System\OFgcpsK.exe
  C:\Windows\System\OFgcpsK.exe
  2⤵
  PID:4192
- C:\Windows\System\AsvYVYn.exe
  C:\Windows\System\AsvYVYn.exe
  2⤵
  PID:5776
- C:\Windows\System\aWHxeIo.exe
  C:\Windows\System\aWHxeIo.exe
  2⤵
  PID:5568
- C:\Windows\System\DzMojky.exe
  C:\Windows\System\DzMojky.exe
  2⤵
  PID:3196
- C:\Windows\System\zweMDWK.exe
  C:\Windows\System\zweMDWK.exe
  2⤵
  PID:5768
- C:\Windows\System\hUVZSsB.exe
  C:\Windows\System\hUVZSsB.exe
  2⤵
  PID:5824
- C:\Windows\System\uxBXQfk.exe
  C:\Windows\System\uxBXQfk.exe
  2⤵
  PID:6160
- C:\Windows\System\GVFRFHY.exe
  C:\Windows\System\GVFRFHY.exe
  2⤵
  PID:6180
- C:\Windows\System\VWdyuGZ.exe
  C:\Windows\System\VWdyuGZ.exe
  2⤵
  PID:6200
- C:\Windows\System\PbTMKtl.exe
  C:\Windows\System\PbTMKtl.exe
  2⤵
  PID:6224
- C:\Windows\System\ZKibuQL.exe
  C:\Windows\System\ZKibuQL.exe
  2⤵
  PID:6244
- C:\Windows\System\eMppKlD.exe
  C:\Windows\System\eMppKlD.exe
  2⤵
  PID:6264
- C:\Windows\System\bXsHzMY.exe
  C:\Windows\System\bXsHzMY.exe
  2⤵
  PID:6284
- C:\Windows\System\VqppjII.exe
  C:\Windows\System\VqppjII.exe
  2⤵
  PID:6304
- C:\Windows\System\MbzdXok.exe
  C:\Windows\System\MbzdXok.exe
  2⤵
  PID:6324
- C:\Windows\System\ZkCiDIu.exe
  C:\Windows\System\ZkCiDIu.exe
  2⤵
  PID:6344
- C:\Windows\System\dZObeqb.exe
  C:\Windows\System\dZObeqb.exe
  2⤵
  PID:6360
- C:\Windows\System\zSGdumE.exe
  C:\Windows\System\zSGdumE.exe
  2⤵
  PID:6380
- C:\Windows\System\tweGMui.exe
  C:\Windows\System\tweGMui.exe
  2⤵
  PID:6396
- C:\Windows\System\wiagcpD.exe
  C:\Windows\System\wiagcpD.exe
  2⤵
  PID:6416
- C:\Windows\System\YXmxMDW.exe
  C:\Windows\System\YXmxMDW.exe
  2⤵
  PID:6432
- C:\Windows\System\XVXFtvU.exe
  C:\Windows\System\XVXFtvU.exe
  2⤵
  PID:6448
- C:\Windows\System\vIKizOh.exe
  C:\Windows\System\vIKizOh.exe
  2⤵
  PID:6464
- C:\Windows\System\WdJBgAB.exe
  C:\Windows\System\WdJBgAB.exe
  2⤵
  PID:6480
- C:\Windows\System\gndRPRT.exe
  C:\Windows\System\gndRPRT.exe
  2⤵
  PID:6496
- C:\Windows\System\Yolekry.exe
  C:\Windows\System\Yolekry.exe
  2⤵
  PID:6520
- C:\Windows\System\mQlFvOg.exe
  C:\Windows\System\mQlFvOg.exe
  2⤵
  PID:6548
- C:\Windows\System\YBveLli.exe
  C:\Windows\System\YBveLli.exe
  2⤵
  PID:6568
- C:\Windows\System\cMpkGfL.exe
  C:\Windows\System\cMpkGfL.exe
  2⤵
  PID:6588
- C:\Windows\System\ealBtEv.exe
  C:\Windows\System\ealBtEv.exe
  2⤵
  PID:6612
- C:\Windows\System\CzmVmlU.exe
  C:\Windows\System\CzmVmlU.exe
  2⤵
  PID:6632
- C:\Windows\System\yOMVwqA.exe
  C:\Windows\System\yOMVwqA.exe
  2⤵
  PID:6652
- C:\Windows\System\mDDVzjH.exe
  C:\Windows\System\mDDVzjH.exe
  2⤵
  PID:6676
- C:\Windows\System\izKmpDH.exe
  C:\Windows\System\izKmpDH.exe
  2⤵
  PID:6696
- C:\Windows\System\EwtALQY.exe
  C:\Windows\System\EwtALQY.exe
  2⤵
  PID:6716
- C:\Windows\System\xMXKWtI.exe
  C:\Windows\System\xMXKWtI.exe
  2⤵
  PID:6736
- C:\Windows\System\jgrmiCt.exe
  C:\Windows\System\jgrmiCt.exe
  2⤵
  PID:6760
- C:\Windows\System\AxyBhGB.exe
  C:\Windows\System\AxyBhGB.exe
  2⤵
  PID:6780
- C:\Windows\System\DxDSweW.exe
  C:\Windows\System\DxDSweW.exe
  2⤵
  PID:6800
- C:\Windows\System\mtUOMGr.exe
  C:\Windows\System\mtUOMGr.exe
  2⤵
  PID:6824
- C:\Windows\System\UXgLjyb.exe
  C:\Windows\System\UXgLjyb.exe
  2⤵
  PID:6844
- C:\Windows\System\IlKPXxe.exe
  C:\Windows\System\IlKPXxe.exe
  2⤵
  PID:6868
- C:\Windows\System\QAddXIn.exe
  C:\Windows\System\QAddXIn.exe
  2⤵
  PID:6892
- C:\Windows\System\sRsbpkX.exe
  C:\Windows\System\sRsbpkX.exe
  2⤵
  PID:6912
- C:\Windows\System\TlVzoJv.exe
  C:\Windows\System\TlVzoJv.exe
  2⤵
  PID:6936
- C:\Windows\System\eBwUiaD.exe
  C:\Windows\System\eBwUiaD.exe
  2⤵
  PID:6972
- C:\Windows\System\TdDimba.exe
  C:\Windows\System\TdDimba.exe
  2⤵
  PID:6988
- C:\Windows\System\Bygwoma.exe
  C:\Windows\System\Bygwoma.exe
  2⤵
  PID:7008
- C:\Windows\System\WTnSFxd.exe
  C:\Windows\System\WTnSFxd.exe
  2⤵
  PID:7032
- C:\Windows\System\kBzqbtV.exe
  C:\Windows\System\kBzqbtV.exe
  2⤵
  PID:7048
- C:\Windows\System\turNFTc.exe
  C:\Windows\System\turNFTc.exe
  2⤵
  PID:7068
- C:\Windows\System\yiYUqeA.exe
  C:\Windows\System\yiYUqeA.exe
  2⤵
  PID:7088
- C:\Windows\System\pmTMARo.exe
  C:\Windows\System\pmTMARo.exe
  2⤵
  PID:7104
- C:\Windows\System\GKwYCdL.exe
  C:\Windows\System\GKwYCdL.exe
  2⤵
  PID:7124
- C:\Windows\System\YziIVHN.exe
  C:\Windows\System\YziIVHN.exe
  2⤵
  PID:7148
- C:\Windows\System\fyqryJU.exe
  C:\Windows\System\fyqryJU.exe
  2⤵
  PID:828
- C:\Windows\System\hiYRfzd.exe
  C:\Windows\System\hiYRfzd.exe
  2⤵
  PID:3632
- C:\Windows\System\neInbkT.exe
  C:\Windows\System\neInbkT.exe
  2⤵
  PID:5912
- C:\Windows\System\xWQOVWk.exe
  C:\Windows\System\xWQOVWk.exe
  2⤵
  PID:6044
- C:\Windows\System\PguhCbh.exe
  C:\Windows\System\PguhCbh.exe
  2⤵
  PID:1908
- C:\Windows\System\lKXMiiK.exe
  C:\Windows\System\lKXMiiK.exe
  2⤵
  PID:5412
- C:\Windows\System\rrQdJDU.exe
  C:\Windows\System\rrQdJDU.exe
  2⤵
  PID:2532
- C:\Windows\System\UxsjeIM.exe
  C:\Windows\System\UxsjeIM.exe
  2⤵
  PID:5800
- C:\Windows\System\BhhcGZY.exe
  C:\Windows\System\BhhcGZY.exe
  2⤵
  PID:6216
- C:\Windows\System\EAXngNP.exe
  C:\Windows\System\EAXngNP.exe
  2⤵
  PID:1968
- C:\Windows\System\KdNkDyE.exe
  C:\Windows\System\KdNkDyE.exe
  2⤵
  PID:6052
- C:\Windows\System\BqvyykP.exe
  C:\Windows\System\BqvyykP.exe
  2⤵
  PID:6340
- C:\Windows\System\eKGhnEI.exe
  C:\Windows\System\eKGhnEI.exe
  2⤵
  PID:5244
- C:\Windows\System\pqmtqMw.exe
  C:\Windows\System\pqmtqMw.exe
  2⤵
  PID:6444
- C:\Windows\System\XICuVvX.exe
  C:\Windows\System\XICuVvX.exe
  2⤵
  PID:5500
- C:\Windows\System\sUBzfks.exe
  C:\Windows\System\sUBzfks.exe
  2⤵
  PID:1352
- C:\Windows\System\ZYnxdBj.exe
  C:\Windows\System\ZYnxdBj.exe
  2⤵
  PID:6644
- C:\Windows\System\cnpPzmC.exe
  C:\Windows\System\cnpPzmC.exe
  2⤵
  PID:6776
- C:\Windows\System\kawAglw.exe
  C:\Windows\System\kawAglw.exe
  2⤵
  PID:6820
- C:\Windows\System\eEGtmnZ.exe
  C:\Windows\System\eEGtmnZ.exe
  2⤵
  PID:6260
- C:\Windows\System\ejTDAmm.exe
  C:\Windows\System\ejTDAmm.exe
  2⤵
  PID:7172
- C:\Windows\System\OBxgfGP.exe
  C:\Windows\System\OBxgfGP.exe
  2⤵
  PID:7200
- C:\Windows\System\FzWIuNS.exe
  C:\Windows\System\FzWIuNS.exe
  2⤵
  PID:7220
- C:\Windows\System\FVrIype.exe
  C:\Windows\System\FVrIype.exe
  2⤵
  PID:7240
- C:\Windows\System\gUGtsrW.exe
  C:\Windows\System\gUGtsrW.exe
  2⤵
  PID:7260
- C:\Windows\System\xPnsxOc.exe
  C:\Windows\System\xPnsxOc.exe
  2⤵
  PID:7292
- C:\Windows\System\GuGQUnm.exe
  C:\Windows\System\GuGQUnm.exe
  2⤵
  PID:7312
- C:\Windows\System\LrKtWKS.exe
  C:\Windows\System\LrKtWKS.exe
  2⤵
  PID:7328
- C:\Windows\System\jKYLrXQ.exe
  C:\Windows\System\jKYLrXQ.exe
  2⤵
  PID:7352
- C:\Windows\System\JRATwUV.exe
  C:\Windows\System\JRATwUV.exe
  2⤵
  PID:7372
- C:\Windows\System\jzWqxUX.exe
  C:\Windows\System\jzWqxUX.exe
  2⤵
  PID:7404
- C:\Windows\System\MaqjoRb.exe
  C:\Windows\System\MaqjoRb.exe
  2⤵
  PID:7424
- C:\Windows\System\NQQYber.exe
  C:\Windows\System\NQQYber.exe
  2⤵
  PID:7440
- C:\Windows\System\ahIJkuh.exe
  C:\Windows\System\ahIJkuh.exe
  2⤵
  PID:7468
- C:\Windows\System\OqTktLF.exe
  C:\Windows\System\OqTktLF.exe
  2⤵
  PID:7504
- C:\Windows\System\lZkTPwf.exe
  C:\Windows\System\lZkTPwf.exe
  2⤵
  PID:7524
- C:\Windows\System\xcfzBaZ.exe
  C:\Windows\System\xcfzBaZ.exe
  2⤵
  PID:7548
- C:\Windows\System\TGyEJRR.exe
  C:\Windows\System\TGyEJRR.exe
  2⤵
  PID:7568
- C:\Windows\System\AITwPzN.exe
  C:\Windows\System\AITwPzN.exe
  2⤵
  PID:7592
- C:\Windows\System\BipjiSX.exe
  C:\Windows\System\BipjiSX.exe
  2⤵
  PID:7608
- C:\Windows\System\mrVMNSd.exe
  C:\Windows\System\mrVMNSd.exe
  2⤵
  PID:7636
- C:\Windows\System\mrgrIVy.exe
  C:\Windows\System\mrgrIVy.exe
  2⤵
  PID:7656
- C:\Windows\System\FIGeJSq.exe
  C:\Windows\System\FIGeJSq.exe
  2⤵
  PID:7676
- C:\Windows\System\PfujQNx.exe
  C:\Windows\System\PfujQNx.exe
  2⤵
  PID:7696
- C:\Windows\System\DBklmwD.exe
  C:\Windows\System\DBklmwD.exe
  2⤵
  PID:7720
- C:\Windows\System\hfiRiNT.exe
  C:\Windows\System\hfiRiNT.exe
  2⤵
  PID:7736
- C:\Windows\System\UyNRIAP.exe
  C:\Windows\System\UyNRIAP.exe
  2⤵
  PID:7768
- C:\Windows\System\uelihZU.exe
  C:\Windows\System\uelihZU.exe
  2⤵
  PID:7784
- C:\Windows\System\gipDoXZ.exe
  C:\Windows\System\gipDoXZ.exe
  2⤵
  PID:7804
- C:\Windows\System\irAxXdh.exe
  C:\Windows\System\irAxXdh.exe
  2⤵
  PID:7824
- C:\Windows\System\MzbMlKK.exe
  C:\Windows\System\MzbMlKK.exe
  2⤵
  PID:7848
- C:\Windows\System\PsvXuyd.exe
  C:\Windows\System\PsvXuyd.exe
  2⤵
  PID:7864
- C:\Windows\System\cpcBhjI.exe
  C:\Windows\System\cpcBhjI.exe
  2⤵
  PID:7884
- C:\Windows\System\nxtAHZN.exe
  C:\Windows\System\nxtAHZN.exe
  2⤵
  PID:7904
- C:\Windows\System\XiamGXy.exe
  C:\Windows\System\XiamGXy.exe
  2⤵
  PID:7928
- C:\Windows\System\XLGixIh.exe
  C:\Windows\System\XLGixIh.exe
  2⤵
  PID:7952
- C:\Windows\System\MOAMiZg.exe
  C:\Windows\System\MOAMiZg.exe
  2⤵
  PID:7976
- C:\Windows\System\LuWeyQd.exe
  C:\Windows\System\LuWeyQd.exe
  2⤵
  PID:7996
- C:\Windows\System\VKdlvgF.exe
  C:\Windows\System\VKdlvgF.exe
  2⤵
  PID:8012
- C:\Windows\System\ndDuwbO.exe
  C:\Windows\System\ndDuwbO.exe
  2⤵
  PID:8036
- C:\Windows\System\BaSQZIa.exe
  C:\Windows\System\BaSQZIa.exe
  2⤵
  PID:8056
- C:\Windows\System\WYKJGfN.exe
  C:\Windows\System\WYKJGfN.exe
  2⤵
  PID:8076
- C:\Windows\System\NRmxVaa.exe
  C:\Windows\System\NRmxVaa.exe
  2⤵
  PID:8096
- C:\Windows\System\zVEBYou.exe
  C:\Windows\System\zVEBYou.exe
  2⤵
  PID:8116
- C:\Windows\System\VUPiUpm.exe
  C:\Windows\System\VUPiUpm.exe
  2⤵
  PID:8140
- C:\Windows\System\BSLOYbf.exe
  C:\Windows\System\BSLOYbf.exe
  2⤵
  PID:8156
- C:\Windows\System\szKFQju.exe
  C:\Windows\System\szKFQju.exe
  2⤵
  PID:8180
- C:\Windows\System\CcppMXS.exe
  C:\Windows\System\CcppMXS.exe
  2⤵
  PID:6372
- C:\Windows\System\OHYZWpa.exe
  C:\Windows\System\OHYZWpa.exe
  2⤵
  PID:6428
- C:\Windows\System\Seblfij.exe
  C:\Windows\System\Seblfij.exe
  2⤵
  PID:6456
- C:\Windows\System\MJXjNSo.exe
  C:\Windows\System\MJXjNSo.exe
  2⤵
  PID:5728
- C:\Windows\System\TvGDCJX.exe
  C:\Windows\System\TvGDCJX.exe
  2⤵
  PID:3052
- C:\Windows\System\GunlMye.exe
  C:\Windows\System\GunlMye.exe
  2⤵
  PID:6188
- C:\Windows\System\YEWJDhp.exe
  C:\Windows\System\YEWJDhp.exe
  2⤵
  PID:6684
- C:\Windows\System\SQqEtyy.exe
  C:\Windows\System\SQqEtyy.exe
  2⤵
  PID:6732
- C:\Windows\System\dJgUpCB.exe
  C:\Windows\System\dJgUpCB.exe
  2⤵
  PID:6220
- C:\Windows\System\jajBDbc.exe
  C:\Windows\System\jajBDbc.exe
  2⤵
  PID:6792
- C:\Windows\System\HFaiKUA.exe
  C:\Windows\System\HFaiKUA.exe
  2⤵
  PID:5476
- C:\Windows\System\hAcjTYZ.exe
  C:\Windows\System\hAcjTYZ.exe
  2⤵
  PID:6156
- C:\Windows\System\smhuaNw.exe
  C:\Windows\System\smhuaNw.exe
  2⤵
  PID:6876
- C:\Windows\System\FjKusUC.exe
  C:\Windows\System\FjKusUC.exe
  2⤵
  PID:6900
- C:\Windows\System\pKQvQRg.exe
  C:\Windows\System\pKQvQRg.exe
  2⤵
  PID:6316
- C:\Windows\System\vgUOqWk.exe
  C:\Windows\System\vgUOqWk.exe
  2⤵
  PID:6356
- C:\Windows\System\UbInvEa.exe
  C:\Windows\System\UbInvEa.exe
  2⤵
  PID:7364
- C:\Windows\System\gQxMeqy.exe
  C:\Windows\System\gQxMeqy.exe
  2⤵
  PID:7100
- C:\Windows\System\kXMShxR.exe
  C:\Windows\System\kXMShxR.exe
  2⤵
  PID:436
- C:\Windows\System\urEsTUj.exe
  C:\Windows\System\urEsTUj.exe
  2⤵
  PID:8208
- C:\Windows\System\wimRBJd.exe
  C:\Windows\System\wimRBJd.exe
  2⤵
  PID:8224
- C:\Windows\System\QAXQDTd.exe
  C:\Windows\System\QAXQDTd.exe
  2⤵
  PID:8240
- C:\Windows\System\PSQckLj.exe
  C:\Windows\System\PSQckLj.exe
  2⤵
  PID:8260
- C:\Windows\System\sUYGuDg.exe
  C:\Windows\System\sUYGuDg.exe
  2⤵
  PID:8280
- C:\Windows\System\mBmZGbu.exe
  C:\Windows\System\mBmZGbu.exe
  2⤵
  PID:8296
- C:\Windows\System\QlRJixP.exe
  C:\Windows\System\QlRJixP.exe
  2⤵
  PID:8316
- C:\Windows\System\veASqzT.exe
  C:\Windows\System\veASqzT.exe
  2⤵
  PID:8340
- C:\Windows\System\vBmAIgl.exe
  C:\Windows\System\vBmAIgl.exe
  2⤵
  PID:8360
- C:\Windows\System\wgxqFgW.exe
  C:\Windows\System\wgxqFgW.exe
  2⤵
  PID:8380
- C:\Windows\System\FHbQQCc.exe
  C:\Windows\System\FHbQQCc.exe
  2⤵
  PID:8408
- C:\Windows\System\xYigmSU.exe
  C:\Windows\System\xYigmSU.exe
  2⤵
  PID:8780
- C:\Windows\System\NycvSKF.exe
  C:\Windows\System\NycvSKF.exe
  2⤵
  PID:8800
- C:\Windows\System\EdbaVDF.exe
  C:\Windows\System\EdbaVDF.exe
  2⤵
  PID:8828
- C:\Windows\System\lkDPoCF.exe
  C:\Windows\System\lkDPoCF.exe
  2⤵
  PID:8860
- C:\Windows\System\CDNNtRC.exe
  C:\Windows\System\CDNNtRC.exe
  2⤵
  PID:8880
- C:\Windows\System\hSzAgnu.exe
  C:\Windows\System\hSzAgnu.exe
  2⤵
  PID:8900
- C:\Windows\System\jPSZarw.exe
  C:\Windows\System\jPSZarw.exe
  2⤵
  PID:8920
- C:\Windows\System\fTQXoIo.exe
  C:\Windows\System\fTQXoIo.exe
  2⤵
  PID:8948
- C:\Windows\System\DgkUZsn.exe
  C:\Windows\System\DgkUZsn.exe
  2⤵
  PID:8968
- C:\Windows\System\moQNVsv.exe
  C:\Windows\System\moQNVsv.exe
  2⤵
  PID:8988
- C:\Windows\System\aXYTsEs.exe
  C:\Windows\System\aXYTsEs.exe
  2⤵
  PID:9012
- C:\Windows\System\bcBHOnz.exe
  C:\Windows\System\bcBHOnz.exe
  2⤵
  PID:7080
- C:\Windows\System\LJXIndJ.exe
  C:\Windows\System\LJXIndJ.exe
  2⤵
  PID:6580
- C:\Windows\System\BMmuUoY.exe
  C:\Windows\System\BMmuUoY.exe
  2⤵
  PID:6704
- C:\Windows\System\rYeEuAQ.exe
  C:\Windows\System\rYeEuAQ.exe
  2⤵
  PID:6768
- C:\Windows\System\SbzUFBf.exe
  C:\Windows\System\SbzUFBf.exe
  2⤵
  PID:7564
- C:\Windows\System\qEfCoss.exe
  C:\Windows\System\qEfCoss.exe
  2⤵
  PID:7096
- C:\Windows\System\qkmPjNr.exe
  C:\Windows\System\qkmPjNr.exe
  2⤵
  PID:8232
- C:\Windows\System\bIXVuii.exe
  C:\Windows\System\bIXVuii.exe
  2⤵
  PID:8400
- C:\Windows\System\rabdBpO.exe
  C:\Windows\System\rabdBpO.exe
  2⤵
  PID:8792
- C:\Windows\System\AQiaAvv.exe
  C:\Windows\System\AQiaAvv.exe
  2⤵
  PID:8912
- C:\Windows\System\DPdgVPN.exe
  C:\Windows\System\DPdgVPN.exe
  2⤵
  PID:8960
- C:\Windows\System\NqBtYgM.exe
  C:\Windows\System\NqBtYgM.exe
  2⤵
  PID:7820
- C:\Windows\System\UOWeHed.exe
  C:\Windows\System\UOWeHed.exe
  2⤵
  PID:1120
- C:\Windows\System\OPwyzSm.exe
  C:\Windows\System\OPwyzSm.exe
  2⤵
  PID:6628
- C:\Windows\System\IYpunuq.exe
  C:\Windows\System\IYpunuq.exe
  2⤵
  PID:6240
- C:\Windows\System\aDwxBJn.exe
  C:\Windows\System\aDwxBJn.exe
  2⤵
  PID:7060
- C:\Windows\System\hjjgoeJ.exe
  C:\Windows\System\hjjgoeJ.exe
  2⤵
  PID:8712
- C:\Windows\System\ABWjxvk.exe
  C:\Windows\System\ABWjxvk.exe
  2⤵
  PID:8708
- C:\Windows\System\LBIMmMk.exe
  C:\Windows\System\LBIMmMk.exe
  2⤵
  PID:8888
- C:\Windows\System\vwhrXVr.exe
  C:\Windows\System\vwhrXVr.exe
  2⤵
  PID:8932
- C:\Windows\System\nYdecgn.exe
  C:\Windows\System\nYdecgn.exe
  2⤵
  PID:9004
- C:\Windows\System\EkwfWzj.exe
  C:\Windows\System\EkwfWzj.exe
  2⤵
  PID:9048
- C:\Windows\System\ieCmdqC.exe
  C:\Windows\System\ieCmdqC.exe
  2⤵
  PID:9132
- C:\Windows\System\PSnguhA.exe
  C:\Windows\System\PSnguhA.exe
  2⤵
  PID:7516
- C:\Windows\System\yVRsCvt.exe
  C:\Windows\System\yVRsCvt.exe
  2⤵
  PID:9224
- C:\Windows\System\mWlOnpk.exe
  C:\Windows\System\mWlOnpk.exe
  2⤵
  PID:9240
- C:\Windows\System\aqnhGnG.exe
  C:\Windows\System\aqnhGnG.exe
  2⤵
  PID:9264
- C:\Windows\System\sqnFuOQ.exe
  C:\Windows\System\sqnFuOQ.exe
  2⤵
  PID:9288
- C:\Windows\System\KzaysMH.exe
  C:\Windows\System\KzaysMH.exe
  2⤵
  PID:9304
- C:\Windows\System\DaUhiFs.exe
  C:\Windows\System\DaUhiFs.exe
  2⤵
  PID:9328
- C:\Windows\System\gwKmXbh.exe
  C:\Windows\System\gwKmXbh.exe
  2⤵
  PID:9352
- C:\Windows\System\McXeRue.exe
  C:\Windows\System\McXeRue.exe
  2⤵
  PID:9372
- C:\Windows\System\afrgHdQ.exe
  C:\Windows\System\afrgHdQ.exe
  2⤵
  PID:9392
- C:\Windows\System\KzfvFVX.exe
  C:\Windows\System\KzfvFVX.exe
  2⤵
  PID:9416
- C:\Windows\System\wPDAvDJ.exe
  C:\Windows\System\wPDAvDJ.exe
  2⤵
  PID:9432
- C:\Windows\System\ClgYdWa.exe
  C:\Windows\System\ClgYdWa.exe
  2⤵
  PID:9448
- C:\Windows\System\VKjbUxn.exe
  C:\Windows\System\VKjbUxn.exe
  2⤵
  PID:9464
- C:\Windows\System\oCLVxvv.exe
  C:\Windows\System\oCLVxvv.exe
  2⤵
  PID:9488
- C:\Windows\System\ETnDUVS.exe
  C:\Windows\System\ETnDUVS.exe
  2⤵
  PID:9524
- C:\Windows\System\lYmtbGj.exe
  C:\Windows\System\lYmtbGj.exe
  2⤵
  PID:9544
- C:\Windows\System\YHGkkyq.exe
  C:\Windows\System\YHGkkyq.exe
  2⤵
  PID:9572
- C:\Windows\System\PcndxRK.exe
  C:\Windows\System\PcndxRK.exe
  2⤵
  PID:9592
- C:\Windows\System\rQnQnED.exe
  C:\Windows\System\rQnQnED.exe
  2⤵
  PID:9612
- C:\Windows\System\dMUlRky.exe
  C:\Windows\System\dMUlRky.exe
  2⤵
  PID:9632
- C:\Windows\System\wwtXJNw.exe
  C:\Windows\System\wwtXJNw.exe
  2⤵
  PID:9660
- C:\Windows\System\XIDDPzD.exe
  C:\Windows\System\XIDDPzD.exe
  2⤵
  PID:9676
- C:\Windows\System\UPKnoQb.exe
  C:\Windows\System\UPKnoQb.exe
  2⤵
  PID:9696
- C:\Windows\System\ojQdMeR.exe
  C:\Windows\System\ojQdMeR.exe
  2⤵
  PID:9716
- C:\Windows\System\IZmxpTH.exe
  C:\Windows\System\IZmxpTH.exe
  2⤵
  PID:9736
- C:\Windows\System\EjxqWAF.exe
  C:\Windows\System\EjxqWAF.exe
  2⤵
  PID:9760
- C:\Windows\System\cSAHEFy.exe
  C:\Windows\System\cSAHEFy.exe
  2⤵
  PID:9784
- C:\Windows\System\BNQQCyy.exe
  C:\Windows\System\BNQQCyy.exe
  2⤵
  PID:9808
- C:\Windows\System\BScxDnF.exe
  C:\Windows\System\BScxDnF.exe
  2⤵
  PID:9828
- C:\Windows\System\XRPekpJ.exe
  C:\Windows\System\XRPekpJ.exe
  2⤵
  PID:9844
- C:\Windows\System\TwYqPoh.exe
  C:\Windows\System\TwYqPoh.exe
  2⤵
  PID:9864
- C:\Windows\System\bgQuWkO.exe
  C:\Windows\System\bgQuWkO.exe
  2⤵
  PID:9884
- C:\Windows\System\mmityqK.exe
  C:\Windows\System\mmityqK.exe
  2⤵
  PID:9904
- C:\Windows\System\EtxjUqC.exe
  C:\Windows\System\EtxjUqC.exe
  2⤵
  PID:9924
- C:\Windows\System\zzTljoe.exe
  C:\Windows\System\zzTljoe.exe
  2⤵
  PID:9940
- C:\Windows\System\KFnUOsB.exe
  C:\Windows\System\KFnUOsB.exe
  2⤵
  PID:9960
- C:\Windows\System\EcfjZnq.exe
  C:\Windows\System\EcfjZnq.exe
  2⤵
  PID:9980
- C:\Windows\System\nKoLylF.exe
  C:\Windows\System\nKoLylF.exe
  2⤵
  PID:9996
- C:\Windows\System\xpKDVHI.exe
  C:\Windows\System\xpKDVHI.exe
  2⤵
  PID:10016
- C:\Windows\System\ixHMNUr.exe
  C:\Windows\System\ixHMNUr.exe
  2⤵
  PID:10040
- C:\Windows\System\VcgPySU.exe
  C:\Windows\System\VcgPySU.exe
  2⤵
  PID:10056
- C:\Windows\System\OzdkjUm.exe
  C:\Windows\System\OzdkjUm.exe
  2⤵
  PID:10072
- C:\Windows\System\BFzEfBs.exe
  C:\Windows\System\BFzEfBs.exe
  2⤵
  PID:10088
- C:\Windows\System\KkORHiQ.exe
  C:\Windows\System\KkORHiQ.exe
  2⤵
  PID:10104
- C:\Windows\System\scKRNVI.exe
  C:\Windows\System\scKRNVI.exe
  2⤵
  PID:10120
- C:\Windows\System\gDteFnw.exe
  C:\Windows\System\gDteFnw.exe
  2⤵
  PID:10220
- C:\Windows\System\DmlVJNl.exe
  C:\Windows\System\DmlVJNl.exe
  2⤵
  PID:10236
- C:\Windows\System\GcAAhPt.exe
  C:\Windows\System\GcAAhPt.exe
  2⤵
  PID:6772
- C:\Windows\System\QSiEayi.exe
  C:\Windows\System\QSiEayi.exe
  2⤵
  PID:6928
- C:\Windows\System\RrcVvjc.exe
  C:\Windows\System\RrcVvjc.exe
  2⤵
  PID:8220
- C:\Windows\System\EXZqRbz.exe
  C:\Windows\System\EXZqRbz.exe
  2⤵
  PID:9180
- C:\Windows\System\dvCqzzJ.exe
  C:\Windows\System\dvCqzzJ.exe
  2⤵
  PID:7484
- C:\Windows\System\TBhwFdG.exe
  C:\Windows\System\TBhwFdG.exe
  2⤵
  PID:8808
- C:\Windows\System\ThlwYIo.exe
  C:\Windows\System\ThlwYIo.exe
  2⤵
  PID:7860
- C:\Windows\System\EhoOfsA.exe
  C:\Windows\System\EhoOfsA.exe
  2⤵
  PID:6072
- C:\Windows\System\AVmvgxD.exe
  C:\Windows\System\AVmvgxD.exe
  2⤵
  PID:7120
- C:\Windows\System\YOjRXTt.exe
  C:\Windows\System\YOjRXTt.exe
  2⤵
  PID:7604
- C:\Windows\System\hqbpqhf.exe
  C:\Windows\System\hqbpqhf.exe
  2⤵
  PID:9236
- C:\Windows\System\KosPiMx.exe
  C:\Windows\System\KosPiMx.exe
  2⤵
  PID:5600
- C:\Windows\System\uNFlSFa.exe
  C:\Windows\System\uNFlSFa.exe
  2⤵
  PID:8276
- C:\Windows\System\RJQPmUP.exe
  C:\Windows\System\RJQPmUP.exe
  2⤵
  PID:9496
- C:\Windows\System\NfJOAWE.exe
  C:\Windows\System\NfJOAWE.exe
  2⤵
  PID:9992
- C:\Windows\System\HGqGXcr.exe
  C:\Windows\System\HGqGXcr.exe
  2⤵
  PID:10032
- C:\Windows\System\sTmoBUU.exe
  C:\Windows\System\sTmoBUU.exe
  2⤵
  PID:8872
- C:\Windows\System\lDFxydQ.exe
  C:\Windows\System\lDFxydQ.exe
  2⤵
  PID:8700
- C:\Windows\System\LxvEFRX.exe
  C:\Windows\System\LxvEFRX.exe
  2⤵
  PID:9704
- C:\Windows\System\EXIwzRM.exe
  C:\Windows\System\EXIwzRM.exe
  2⤵
  PID:9232
- C:\Windows\System\jsMKGWH.exe
  C:\Windows\System\jsMKGWH.exe
  2⤵
  PID:9836
- C:\Windows\System\bbytmZj.exe
  C:\Windows\System\bbytmZj.exe
  2⤵
  PID:9316
- C:\Windows\System\nJlYNhx.exe
  C:\Windows\System\nJlYNhx.exe
  2⤵
  PID:9504
- C:\Windows\System\ZCVXtzl.exe
  C:\Windows\System\ZCVXtzl.exe
  2⤵
  PID:9440
- C:\Windows\System\AHSFUPO.exe
  C:\Windows\System\AHSFUPO.exe
  2⤵
  PID:4456
- C:\Windows\System\viGCLUR.exe
  C:\Windows\System\viGCLUR.exe
  2⤵
  PID:10256
- C:\Windows\System\YtRVGUm.exe
  C:\Windows\System\YtRVGUm.exe
  2⤵
  PID:10284
- C:\Windows\System\KWnypvx.exe
  C:\Windows\System\KWnypvx.exe
  2⤵
  PID:10312
- C:\Windows\System\vtdMkil.exe
  C:\Windows\System\vtdMkil.exe
  2⤵
  PID:10332
- C:\Windows\System\pAwFLgQ.exe
  C:\Windows\System\pAwFLgQ.exe
  2⤵
  PID:10348
- C:\Windows\System\VUMimWQ.exe
  C:\Windows\System\VUMimWQ.exe
  2⤵
  PID:10364
- C:\Windows\System\rwVCHFA.exe
  C:\Windows\System\rwVCHFA.exe
  2⤵
  PID:10384
- C:\Windows\System\iSJVxbm.exe
  C:\Windows\System\iSJVxbm.exe
  2⤵
  PID:10404
- C:\Windows\System\uXrWGmY.exe
  C:\Windows\System\uXrWGmY.exe
  2⤵
  PID:10424
- C:\Windows\System\SBosnoH.exe
  C:\Windows\System\SBosnoH.exe
  2⤵
  PID:10452
- C:\Windows\System\MsYxQCP.exe
  C:\Windows\System\MsYxQCP.exe
  2⤵
  PID:10472
- C:\Windows\System\AvcgMEX.exe
  C:\Windows\System\AvcgMEX.exe
  2⤵
  PID:10492
- C:\Windows\System\DvFEcZq.exe
  C:\Windows\System\DvFEcZq.exe
  2⤵
  PID:10508
- C:\Windows\System\dLytKmv.exe
  C:\Windows\System\dLytKmv.exe
  2⤵
  PID:10532
- C:\Windows\System\FJHzWUY.exe
  C:\Windows\System\FJHzWUY.exe
  2⤵
  PID:10576
- C:\Windows\System\TRHmJPP.exe
  C:\Windows\System\TRHmJPP.exe
  2⤵
  PID:10596
- C:\Windows\System\BSCEQkf.exe
  C:\Windows\System\BSCEQkf.exe
  2⤵
  PID:10620
- C:\Windows\System\mYKWcqR.exe
  C:\Windows\System\mYKWcqR.exe
  2⤵
  PID:10640
- C:\Windows\System\AiOWLUD.exe
  C:\Windows\System\AiOWLUD.exe
  2⤵
  PID:10660
- C:\Windows\System\tDBVbYf.exe
  C:\Windows\System\tDBVbYf.exe
  2⤵
  PID:10692
- C:\Windows\System\ZgWignM.exe
  C:\Windows\System\ZgWignM.exe
  2⤵
  PID:10724
- C:\Windows\System\OzPXShm.exe
  C:\Windows\System\OzPXShm.exe
  2⤵
  PID:10756
- C:\Windows\System\jzTLFLL.exe
  C:\Windows\System\jzTLFLL.exe
  2⤵
  PID:10776
- C:\Windows\System\jstSEKG.exe
  C:\Windows\System\jstSEKG.exe
  2⤵
  PID:10796
- C:\Windows\System\SpsRYJs.exe
  C:\Windows\System\SpsRYJs.exe
  2⤵
  PID:10816
- C:\Windows\System\PBytNRh.exe
  C:\Windows\System\PBytNRh.exe
  2⤵
  PID:10840
- C:\Windows\System\lkBiczh.exe
  C:\Windows\System\lkBiczh.exe
  2⤵
  PID:10860
- C:\Windows\System\MpifqUI.exe
  C:\Windows\System\MpifqUI.exe
  2⤵
  PID:10884
- C:\Windows\System\xYIzggM.exe
  C:\Windows\System\xYIzggM.exe
  2⤵
  PID:10900
- C:\Windows\System\FbqJfHc.exe
  C:\Windows\System\FbqJfHc.exe
  2⤵
  PID:10920
- C:\Windows\System\WfLPOov.exe
  C:\Windows\System\WfLPOov.exe
  2⤵
  PID:10944
- C:\Windows\System\aMjZxCI.exe
  C:\Windows\System\aMjZxCI.exe
  2⤵
  PID:10964
- C:\Windows\System\hebCSsS.exe
  C:\Windows\System\hebCSsS.exe
  2⤵
  PID:10984
- C:\Windows\System\RAUYdfS.exe
  C:\Windows\System\RAUYdfS.exe
  2⤵
  PID:11004
- C:\Windows\System\qpCbVUw.exe
  C:\Windows\System\qpCbVUw.exe
  2⤵
  PID:11032
- C:\Windows\System\HpJEMAu.exe
  C:\Windows\System\HpJEMAu.exe
  2⤵
  PID:11048
- C:\Windows\System\yAunWKt.exe
  C:\Windows\System\yAunWKt.exe
  2⤵
  PID:11064
- C:\Windows\System\IEWoCRU.exe
  C:\Windows\System\IEWoCRU.exe
  2⤵
  PID:11080
- C:\Windows\System\tpbKMAo.exe
  C:\Windows\System\tpbKMAo.exe
  2⤵
  PID:11100
- C:\Windows\System\hrmrSyM.exe
  C:\Windows\System\hrmrSyM.exe
  2⤵
  PID:11116
- C:\Windows\System\YvkdmQe.exe
  C:\Windows\System\YvkdmQe.exe
  2⤵
  PID:11140
- C:\Windows\System\imUUhQo.exe
  C:\Windows\System\imUUhQo.exe
  2⤵
  PID:11160
- C:\Windows\System\hraJMub.exe
  C:\Windows\System\hraJMub.exe
  2⤵
  PID:11180
- C:\Windows\System\HBrOvGj.exe
  C:\Windows\System\HBrOvGj.exe
  2⤵
  PID:11196
- C:\Windows\System\DAFyOdV.exe
  C:\Windows\System\DAFyOdV.exe
  2⤵
  PID:11216
- C:\Windows\System\mxyxRFw.exe
  C:\Windows\System\mxyxRFw.exe
  2⤵
  PID:11244
- C:\Windows\System\rrrpPGb.exe
  C:\Windows\System\rrrpPGb.exe
  2⤵
  PID:10212
- C:\Windows\System\jySruar.exe
  C:\Windows\System\jySruar.exe
  2⤵
  PID:6172
- C:\Windows\System\kaKyyUu.exe
  C:\Windows\System\kaKyyUu.exe
  2⤵
  PID:7360
- C:\Windows\System\DmGjpgR.exe
  C:\Windows\System\DmGjpgR.exe
  2⤵
  PID:2788
- C:\Windows\System\kOBmAxJ.exe
  C:\Windows\System\kOBmAxJ.exe
  2⤵
  PID:9936
- C:\Windows\System\jcINJJa.exe
  C:\Windows\System\jcINJJa.exe
  2⤵
  PID:9708
- C:\Windows\System\fZZNKGC.exe
  C:\Windows\System\fZZNKGC.exe
  2⤵
  PID:10320
- C:\Windows\System\PxVgCJT.exe
  C:\Windows\System\PxVgCJT.exe
  2⤵
  PID:10376
- C:\Windows\System\ioxAoXi.exe
  C:\Windows\System\ioxAoXi.exe
  2⤵
  PID:10896
- C:\Windows\System\qdqpyyo.exe
  C:\Windows\System\qdqpyyo.exe
  2⤵
  PID:10416
- C:\Windows\System\JQpNjKh.exe
  C:\Windows\System\JQpNjKh.exe
  2⤵
  PID:11092
- C:\Windows\System\gvvCteK.exe
  C:\Windows\System\gvvCteK.exe
  2⤵
  PID:11168
- C:\Windows\System\KQbvZRs.exe
  C:\Windows\System\KQbvZRs.exe
  2⤵
  PID:8068
- C:\Windows\System\rmjGnqy.exe
  C:\Windows\System\rmjGnqy.exe
  2⤵
  PID:11500
- C:\Windows\System\ECobXCS.exe
  C:\Windows\System\ECobXCS.exe
  2⤵
  PID:11524
- C:\Windows\System\GjRRZQX.exe
  C:\Windows\System\GjRRZQX.exe
  2⤵
  PID:11548
- C:\Windows\System\jRbCTDa.exe
  C:\Windows\System\jRbCTDa.exe
  2⤵
  PID:11620
- C:\Windows\System\blTUhKd.exe
  C:\Windows\System\blTUhKd.exe
  2⤵
  PID:11652
- C:\Windows\System\uPIubWw.exe
  C:\Windows\System\uPIubWw.exe
  2⤵
  PID:11676
- C:\Windows\System\LqZQdVo.exe
  C:\Windows\System\LqZQdVo.exe
  2⤵
  PID:11700
- C:\Windows\System\hIMdJto.exe
  C:\Windows\System\hIMdJto.exe
  2⤵
  PID:11768
- C:\Windows\System\VfyHzCp.exe
  C:\Windows\System\VfyHzCp.exe
  2⤵
  PID:11788
- C:\Windows\System\lCfgXsf.exe
  C:\Windows\System\lCfgXsf.exe
  2⤵
  PID:11812
- C:\Windows\System\FMVpjAx.exe
  C:\Windows\System\FMVpjAx.exe
  2⤵
  PID:11828
- C:\Windows\System\EKPgVnE.exe
  C:\Windows\System\EKPgVnE.exe
  2⤵
  PID:11844
- C:\Windows\System\EvuoFAg.exe
  C:\Windows\System\EvuoFAg.exe
  2⤵
  PID:11860
- C:\Windows\System\ClKeZtj.exe
  C:\Windows\System\ClKeZtj.exe
  2⤵
  PID:11876
- C:\Windows\System\VGyzkEa.exe
  C:\Windows\System\VGyzkEa.exe
  2⤵
  PID:11892
- C:\Windows\System\FDynghR.exe
  C:\Windows\System\FDynghR.exe
  2⤵
  PID:11908
- C:\Windows\System\qIZdIPa.exe
  C:\Windows\System\qIZdIPa.exe
  2⤵
  PID:11928
- C:\Windows\System\rFpUiGr.exe
  C:\Windows\System\rFpUiGr.exe
  2⤵
  PID:11944
- C:\Windows\System\xPgVSlJ.exe
  C:\Windows\System\xPgVSlJ.exe
  2⤵
  PID:11960
- C:\Windows\System\BHbdkwh.exe
  C:\Windows\System\BHbdkwh.exe
  2⤵
  PID:11996
- C:\Windows\System\WKrMrNk.exe
  C:\Windows\System\WKrMrNk.exe
  2⤵
  PID:12012
- C:\Windows\System\xFdqbpl.exe
  C:\Windows\System\xFdqbpl.exe
  2⤵
  PID:12032
- C:\Windows\System\UUZjJGg.exe
  C:\Windows\System\UUZjJGg.exe
  2⤵
  PID:12048
- C:\Windows\System\pbZKosq.exe
  C:\Windows\System\pbZKosq.exe
  2⤵
  PID:12068
- C:\Windows\System\TaaVouy.exe
  C:\Windows\System\TaaVouy.exe
  2⤵
  PID:11072
- C:\Windows\System\OmVonHn.exe
  C:\Windows\System\OmVonHn.exe
  2⤵
  PID:11252
- C:\Windows\System\cTzqFgl.exe
  C:\Windows\System\cTzqFgl.exe
  2⤵
  PID:9972
- C:\Windows\System\tTyayQO.exe
  C:\Windows\System\tTyayQO.exe
  2⤵
  PID:11108
- C:\Windows\System\CWIvMLR.exe
  C:\Windows\System\CWIvMLR.exe
  2⤵
  PID:4960
- C:\Windows\System\MuBJjUP.exe
  C:\Windows\System\MuBJjUP.exe
  2⤵
  PID:10024
- C:\Windows\System\OCdIUpH.exe
  C:\Windows\System\OCdIUpH.exe
  2⤵
  PID:10616
- C:\Windows\System\LgkAMgP.exe
  C:\Windows\System\LgkAMgP.exe
  2⤵
  PID:10524
- C:\Windows\System\cDxQHEw.exe
  C:\Windows\System\cDxQHEw.exe
  2⤵
  PID:3176
- C:\Windows\System\ejSgRLJ.exe
  C:\Windows\System\ejSgRLJ.exe
  2⤵
  PID:11716
- C:\Windows\System\cBcGRcQ.exe
  C:\Windows\System\cBcGRcQ.exe
  2⤵
  PID:10636
- C:\Windows\System\uLLGiSH.exe
  C:\Windows\System\uLLGiSH.exe
  2⤵
  PID:10772
- C:\Windows\System\FWADLOB.exe
  C:\Windows\System\FWADLOB.exe
  2⤵
  PID:11344
- C:\Windows\System\zKoHaCt.exe
  C:\Windows\System\zKoHaCt.exe
  2⤵
  PID:11408
- C:\Windows\System\rNwpBZO.exe
  C:\Windows\System\rNwpBZO.exe
  2⤵
  PID:11856
- C:\Windows\System\nOGeYtm.exe
  C:\Windows\System\nOGeYtm.exe
  2⤵
  PID:12160
- C:\Windows\System\rgEiJak.exe
  C:\Windows\System\rgEiJak.exe
  2⤵
  PID:11640
- C:\Windows\System\gvzialM.exe
  C:\Windows\System\gvzialM.exe
  2⤵
  PID:11804
- C:\Windows\System\ziqVQDb.exe
  C:\Windows\System\ziqVQDb.exe
  2⤵
  PID:12020
- C:\Windows\System\JKoNWzk.exe
  C:\Windows\System\JKoNWzk.exe
  2⤵
  PID:12260
- C:\Windows\System\FeRUtSe.exe
  C:\Windows\System\FeRUtSe.exe
  2⤵
  PID:11192
- C:\Windows\System\dxBdPZQ.exe
  C:\Windows\System\dxBdPZQ.exe
  2⤵
  PID:11012
- C:\Windows\System\PccEgnC.exe
  C:\Windows\System\PccEgnC.exe
  2⤵
  PID:11224
- C:\Windows\System\OaYBlef.exe
  C:\Windows\System\OaYBlef.exe
  2⤵
  PID:10540
- C:\Windows\System\oBqdWBO.exe
  C:\Windows\System\oBqdWBO.exe
  2⤵
  PID:11060
- C:\Windows\System\LDeSlfn.exe
  C:\Windows\System\LDeSlfn.exe
  2⤵
  PID:8292
- C:\Windows\System\TOlQbqg.exe
  C:\Windows\System\TOlQbqg.exe
  2⤵
  PID:10916
- C:\Windows\System\gipusUP.exe
  C:\Windows\System\gipusUP.exe
  2⤵
  PID:9260
- C:\Windows\System\ybuztxh.exe
  C:\Windows\System\ybuztxh.exe
  2⤵
  PID:11436
- C:\Windows\System\rMlJNpZ.exe
  C:\Windows\System\rMlJNpZ.exe
  2⤵
  PID:10784
- C:\Windows\System\JmxfHNW.exe
  C:\Windows\System\JmxfHNW.exe
  2⤵
  PID:11368
- C:\Windows\System\TwDHzcQ.exe
  C:\Windows\System\TwDHzcQ.exe
  2⤵
  PID:11468
- C:\Windows\System\uFmooYD.exe
  C:\Windows\System\uFmooYD.exe
  2⤵
  PID:11628
- C:\Windows\System\FEOvMKc.exe
  C:\Windows\System\FEOvMKc.exe
  2⤵
  PID:11884
- C:\Windows\System\QPgQBAe.exe
  C:\Windows\System\QPgQBAe.exe
  2⤵
  PID:11956
- C:\Windows\System\nsOBKoV.exe
  C:\Windows\System\nsOBKoV.exe
  2⤵
  PID:9712
- C:\Windows\System\sRcGqpm.exe
  C:\Windows\System\sRcGqpm.exe
  2⤵
  PID:12296
- C:\Windows\System\cOIgfPP.exe
  C:\Windows\System\cOIgfPP.exe
  2⤵
  PID:12368
- C:\Windows\System\tdMtrmg.exe
  C:\Windows\System\tdMtrmg.exe
  2⤵
  PID:12400
- C:\Windows\System\oESDdTU.exe
  C:\Windows\System\oESDdTU.exe
  2⤵
  PID:12420
- C:\Windows\System\mnVkfSy.exe
  C:\Windows\System\mnVkfSy.exe
  2⤵
  PID:12440
- C:\Windows\System\pqKnVek.exe
  C:\Windows\System\pqKnVek.exe
  2⤵
  PID:12500
- C:\Windows\System\rlwxEbx.exe
  C:\Windows\System\rlwxEbx.exe
  2⤵
  PID:12520
- C:\Windows\System\PGJsqiF.exe
  C:\Windows\System\PGJsqiF.exe
  2⤵
  PID:12540
- C:\Windows\System\XPhhsOQ.exe
  C:\Windows\System\XPhhsOQ.exe
  2⤵
  PID:12564
- C:\Windows\System\IFZlzfE.exe
  C:\Windows\System\IFZlzfE.exe
  2⤵
  PID:12580
- C:\Windows\System\WfGMWbh.exe
  C:\Windows\System\WfGMWbh.exe
  2⤵
  PID:12600
- C:\Windows\System\EmvUgti.exe
  C:\Windows\System\EmvUgti.exe
  2⤵
  PID:12616
- C:\Windows\System\VLGoTxv.exe
  C:\Windows\System\VLGoTxv.exe
  2⤵
  PID:12648
- C:\Windows\System\GoXDqiO.exe
  C:\Windows\System\GoXDqiO.exe
  2⤵
  PID:12668
- C:\Windows\System\SRFbEFA.exe
  C:\Windows\System\SRFbEFA.exe
  2⤵
  PID:12688
- C:\Windows\System\USTRoSJ.exe
  C:\Windows\System\USTRoSJ.exe
  2⤵
  PID:12712
- C:\Windows\System\NzsxDIG.exe
  C:\Windows\System\NzsxDIG.exe
  2⤵
  PID:12732
- C:\Windows\System\UIQWvzP.exe
  C:\Windows\System\UIQWvzP.exe
  2⤵
  PID:12752
- C:\Windows\System\MKJQueJ.exe
  C:\Windows\System\MKJQueJ.exe
  2⤵
  PID:12772
- C:\Windows\System\aHIxWen.exe
  C:\Windows\System\aHIxWen.exe
  2⤵
  PID:12792
- C:\Windows\System\ZboRXJJ.exe
  C:\Windows\System\ZboRXJJ.exe
  2⤵
  PID:12812
- C:\Windows\System\bwLOWpr.exe
  C:\Windows\System\bwLOWpr.exe
  2⤵
  PID:12836
- C:\Windows\System\sZtjNos.exe
  C:\Windows\System\sZtjNos.exe
  2⤵
  PID:12856
- C:\Windows\System\PYjFLrs.exe
  C:\Windows\System\PYjFLrs.exe
  2⤵
  PID:12876
- C:\Windows\System\xfgWIII.exe
  C:\Windows\System\xfgWIII.exe
  2⤵
  PID:12900
- C:\Windows\System\PiTeDxM.exe
  C:\Windows\System\PiTeDxM.exe
  2⤵
  PID:12920
- C:\Windows\System\SIxVsIr.exe
  C:\Windows\System\SIxVsIr.exe
  2⤵
  PID:12936
- C:\Windows\System\OXiTzel.exe
  C:\Windows\System\OXiTzel.exe
  2⤵
  PID:12956
- C:\Windows\System\zLmzmft.exe
  C:\Windows\System\zLmzmft.exe
  2⤵
  PID:12976
- C:\Windows\System\SAduJBw.exe
  C:\Windows\System\SAduJBw.exe
  2⤵
  PID:13000
- C:\Windows\System\YpBwPGZ.exe
  C:\Windows\System\YpBwPGZ.exe
  2⤵
  PID:13020
- C:\Windows\System\xWDVYCK.exe
  C:\Windows\System\xWDVYCK.exe
  2⤵
  PID:13044
- C:\Windows\System\qpktTAo.exe
  C:\Windows\System\qpktTAo.exe
  2⤵
  PID:13072
- C:\Windows\System\GkNjKzL.exe
  C:\Windows\System\GkNjKzL.exe
  2⤵
  PID:12548
- C:\Windows\System\czOKfnM.exe
  C:\Windows\System\czOKfnM.exe
  2⤵
  PID:12696
- C:\Windows\System\IGoknSZ.exe
  C:\Windows\System\IGoknSZ.exe
  2⤵
  PID:12852
- C:\Windows\System\pJjVCAt.exe
  C:\Windows\System\pJjVCAt.exe
  2⤵
  PID:12892
- C:\Windows\System\zekunnp.exe
  C:\Windows\System\zekunnp.exe
  2⤵
  PID:12764
- C:\Windows\System\JhulHxS.exe
  C:\Windows\System\JhulHxS.exe
  2⤵
  PID:12928
- C:\Windows\System\eIZkvSy.exe
  C:\Windows\System\eIZkvSy.exe
  2⤵
  PID:12972
- C:\Windows\System\KYmTOxW.exe
  C:\Windows\System\KYmTOxW.exe
  2⤵
  PID:13012
- C:\Windows\System\xpQcVBi.exe
  C:\Windows\System\xpQcVBi.exe
  2⤵
  PID:12888
- C:\Windows\System\xJywoJF.exe
  C:\Windows\System\xJywoJF.exe
  2⤵
  PID:12872
- C:\Windows\System\BIuorKF.exe
  C:\Windows\System\BIuorKF.exe
  2⤵
  PID:10052
- C:\Windows\System\SpcKdOX.exe
  C:\Windows\System\SpcKdOX.exe
  2⤵
  PID:12984
- C:\Windows\System\evAPFnF.exe
  C:\Windows\System\evAPFnF.exe
  2⤵
  PID:13208
- C:\Windows\System\LdabuRG.exe
  C:\Windows\System\LdabuRG.exe
  2⤵
  PID:13248
- C:\Windows\System\ApYPHOO.exe
  C:\Windows\System\ApYPHOO.exe
  2⤵
  PID:12864
- C:\Windows\System\SUuKyCD.exe
  C:\Windows\System\SUuKyCD.exe
  2⤵
  PID:13116
- C:\Windows\System\MVjeXzw.exe
  C:\Windows\System\MVjeXzw.exe
  2⤵
  PID:13148
- C:\Windows\System\aaWbcQf.exe
  C:\Windows\System\aaWbcQf.exe
  2⤵
  PID:11764
- C:\Windows\System\bKlYCEn.exe
  C:\Windows\System\bKlYCEn.exe
  2⤵
  PID:12532
- C:\Windows\System\tOpduis.exe
  C:\Windows\System\tOpduis.exe
  2⤵
  PID:12596
- C:\Windows\System\GHazezU.exe
  C:\Windows\System\GHazezU.exe
  2⤵
  PID:1680
- C:\Windows\System\aGovRpD.exe
  C:\Windows\System\aGovRpD.exe
  2⤵
  PID:12848
- C:\Windows\System\ElEloFe.exe
  C:\Windows\System\ElEloFe.exe
  2⤵
  PID:13196
- C:\Windows\System\XnTKIgm.exe
  C:\Windows\System\XnTKIgm.exe
  2⤵
  PID:13140
- C:\Windows\System\SnYnPTG.exe
  C:\Windows\System\SnYnPTG.exe
  2⤵
  PID:13160
- C:\Windows\System\HPrARLX.exe
  C:\Windows\System\HPrARLX.exe
  2⤵
  PID:11056
- C:\Windows\System\xqmCQgk.exe
  C:\Windows\System\xqmCQgk.exe
  2⤵
  PID:11316
- C:\Windows\System\JxfEWVQ.exe
  C:\Windows\System\JxfEWVQ.exe
  2⤵
  PID:12572
- C:\Windows\System\DBQZuZS.exe
  C:\Windows\System\DBQZuZS.exe
  2⤵
  PID:4632
- C:\Windows\System\wxWJSpv.exe
  C:\Windows\System\wxWJSpv.exe
  2⤵
  PID:5008
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 5008 -s 240
    3⤵
    PID:14192
- C:\Windows\System\dOSZSOx.exe
  C:\Windows\System\dOSZSOx.exe
  2⤵
  PID:12004
- C:\Windows\System\xYsErlf.exe
  C:\Windows\System\xYsErlf.exe
  2⤵
  PID:11556
- C:\Windows\System\qORxpMj.exe
  C:\Windows\System\qORxpMj.exe
  2⤵
  PID:3452
- C:\Windows\System\fUwoNJO.exe
  C:\Windows\System\fUwoNJO.exe
  2⤵
  PID:2440
- C:\Windows\System\BCdhlrX.exe
  C:\Windows\System\BCdhlrX.exe
  2⤵
  PID:4956
- C:\Windows\System\ZXOVOZQ.exe
  C:\Windows\System\ZXOVOZQ.exe
  2⤵
  PID:4492
- C:\Windows\System\eAPPuDd.exe
  C:\Windows\System\eAPPuDd.exe
  2⤵
  PID:12528
- C:\Windows\System\PfFpCkR.exe
  C:\Windows\System\PfFpCkR.exe
  2⤵
  PID:1156
- C:\Windows\System\bcAYYrF.exe
  C:\Windows\System\bcAYYrF.exe
  2⤵
  PID:12632
- C:\Windows\System\BisleJS.exe
  C:\Windows\System\BisleJS.exe
  2⤵
  PID:13008
- C:\Windows\System\BNfXAsx.exe
  C:\Windows\System\BNfXAsx.exe
  2⤵
  PID:13328
- C:\Windows\System\XhaNKXW.exe
  C:\Windows\System\XhaNKXW.exe
  2⤵
  PID:13352
- C:\Windows\System\mdZBCyp.exe
  C:\Windows\System\mdZBCyp.exe
  2⤵
  PID:13368
- C:\Windows\System\koeFgrw.exe
  C:\Windows\System\koeFgrw.exe
  2⤵
  PID:13384
- C:\Windows\System\SooWSvB.exe
  C:\Windows\System\SooWSvB.exe
  2⤵
  PID:13400
- C:\Windows\System\APrSoui.exe
  C:\Windows\System\APrSoui.exe
  2⤵
  PID:13420
- C:\Windows\System\acnyjCq.exe
  C:\Windows\System\acnyjCq.exe
  2⤵
  PID:13440
- C:\Windows\System\wWgKvDU.exe
  C:\Windows\System\wWgKvDU.exe
  2⤵
  PID:13456
- C:\Windows\System\SQPQgnu.exe
  C:\Windows\System\SQPQgnu.exe
  2⤵
  PID:13536
- C:\Windows\System\QkqTUCE.exe
  C:\Windows\System\QkqTUCE.exe
  2⤵
  PID:13604
- C:\Windows\System\VzTSrgR.exe
  C:\Windows\System\VzTSrgR.exe
  2⤵
  PID:13628
- C:\Windows\System\fDiMTDa.exe
  C:\Windows\System\fDiMTDa.exe
  2⤵
  PID:13648
- C:\Windows\System\QTVcUWI.exe
  C:\Windows\System\QTVcUWI.exe
  2⤵
  PID:13664
- C:\Windows\System\MkXMbyl.exe
  C:\Windows\System\MkXMbyl.exe
  2⤵
  PID:13700
- C:\Windows\System\zVKaFXK.exe
  C:\Windows\System\zVKaFXK.exe
  2⤵
  PID:13752
- C:\Windows\System\FDVkObZ.exe
  C:\Windows\System\FDVkObZ.exe
  2⤵
  PID:13856
- C:\Windows\System\OXrmnCS.exe
  C:\Windows\System\OXrmnCS.exe
  2⤵
  PID:13876
- C:\Windows\System\GMLbIRO.exe
  C:\Windows\System\GMLbIRO.exe
  2⤵
  PID:14024
- C:\Windows\System\VWXYwul.exe
  C:\Windows\System\VWXYwul.exe
  2⤵
  PID:14048
- C:\Windows\System\CAwiqhX.exe
  C:\Windows\System\CAwiqhX.exe
  2⤵
  PID:14064
- C:\Windows\System\myOAfax.exe
  C:\Windows\System\myOAfax.exe
  2⤵
  PID:14140
- C:\Windows\System\PVHlrbF.exe
  C:\Windows\System\PVHlrbF.exe
  2⤵
  PID:14208
- C:\Windows\System\nqKGBen.exe
  C:\Windows\System\nqKGBen.exe
  2⤵
  PID:12448
- C:\Windows\System\JxFFMod.exe
  C:\Windows\System\JxFFMod.exe
  2⤵
  PID:13428
- C:\Windows\System\FTlfhOw.exe
  C:\Windows\System\FTlfhOw.exe
  2⤵
  PID:13656
- C:\Windows\System\LAwoOhm.exe
  C:\Windows\System\LAwoOhm.exe
  2⤵
  PID:13564
- C:\Windows\System\EIXEANy.exe
  C:\Windows\System\EIXEANy.exe
  2⤵
  PID:5536
- C:\Windows\System\PNubRBG.exe
  C:\Windows\System\PNubRBG.exe
  2⤵
  PID:13672
- C:\Windows\System\grkUKHv.exe
  C:\Windows\System\grkUKHv.exe
  2⤵
  PID:13720
- C:\Windows\System\bJusOYx.exe
  C:\Windows\System\bJusOYx.exe
  2⤵
  PID:13884
- C:\Windows\System\dloSIvk.exe
  C:\Windows\System\dloSIvk.exe
  2⤵
  PID:13776
- C:\Windows\System\QBMVjiI.exe
  C:\Windows\System\QBMVjiI.exe
  2⤵
  PID:1612
- C:\Windows\System\HmIVtCK.exe
  C:\Windows\System\HmIVtCK.exe
  2⤵
  PID:14236
- C:\Windows\System\waKZrVO.exe
  C:\Windows\System\waKZrVO.exe
  2⤵
  PID:5896
- C:\Windows\System\PgNSchG.exe
  C:\Windows\System\PgNSchG.exe
  2⤵
  PID:10996
- C:\Windows\System\pnnnWoa.exe
  C:\Windows\System\pnnnWoa.exe
  2⤵
  PID:14104
- C:\Windows\System\sFwQLcP.exe
  C:\Windows\System\sFwQLcP.exe
  2⤵
  PID:14132
- C:\Windows\System\wtcOlxX.exe
  C:\Windows\System\wtcOlxX.exe
  2⤵
  PID:14168
- C:\Windows\System\MJEbukE.exe
  C:\Windows\System\MJEbukE.exe
  2⤵
  PID:14184
- C:\Windows\System\BFENMmw.exe
  C:\Windows\System\BFENMmw.exe
  2⤵
  PID:13100
- C:\Windows\System\tEwTSpC.exe
  C:\Windows\System\tEwTSpC.exe
  2⤵
  PID:13500
- C:\Windows\System\IvoRvYt.exe
  C:\Windows\System\IvoRvYt.exe
  2⤵
  PID:13392
- C:\Windows\System\reSwBnB.exe
  C:\Windows\System\reSwBnB.exe
  2⤵
  PID:14280
- C:\Windows\System\GAIAPII.exe
  C:\Windows\System\GAIAPII.exe
  2⤵
  PID:1184
- C:\Windows\System\VWcKTCZ.exe
  C:\Windows\System\VWcKTCZ.exe
  2⤵
  PID:3784
- C:\Windows\System\jsQFmNj.exe
  C:\Windows\System\jsQFmNj.exe
  2⤵
  PID:2428
- C:\Windows\System\JqPaGDb.exe
  C:\Windows\System\JqPaGDb.exe
  2⤵
  PID:4904
- C:\Windows\System\JqfUEzl.exe
  C:\Windows\System\JqfUEzl.exe
  2⤵
  PID:392
- C:\Windows\System\dxbflHW.exe
  C:\Windows\System\dxbflHW.exe
  2⤵
  PID:12784
- C:\Windows\System\rkbMQBq.exe
  C:\Windows\System\rkbMQBq.exe
  2⤵
  PID:4388
- C:\Windows\System\vsKoPhy.exe
  C:\Windows\System\vsKoPhy.exe
  2⤵
  PID:13112
- C:\Windows\System\RNjVAUi.exe
  C:\Windows\System\RNjVAUi.exe
  2⤵
  PID:13544
- C:\Windows\System\EwdXkee.exe
  C:\Windows\System\EwdXkee.exe
  2⤵
  PID:3652
- C:\Windows\System\tbrzbWh.exe
  C:\Windows\System\tbrzbWh.exe
  2⤵
  PID:3680
- C:\Windows\System\hSqfyYk.exe
  C:\Windows\System\hSqfyYk.exe
  2⤵
  PID:4560
- C:\Windows\System\TdCwqXb.exe
  C:\Windows\System\TdCwqXb.exe
  2⤵
  PID:12684
- C:\Windows\System\OTaatMu.exe
  C:\Windows\System\OTaatMu.exe
  2⤵
  PID:5980
- C:\Windows\System\FjGKemg.exe
  C:\Windows\System\FjGKemg.exe
  2⤵
  PID:3648
- C:\Windows\System\uwcJVQJ.exe
  C:\Windows\System\uwcJVQJ.exe
  2⤵
  PID:4372
- C:\Windows\System\zWaQxxX.exe
  C:\Windows\System\zWaQxxX.exe
  2⤵
  PID:1652
- C:\Windows\System\PGlbPzb.exe
  C:\Windows\System\PGlbPzb.exe
  2⤵
  PID:2268
- C:\Windows\System\GFCDUHO.exe
  C:\Windows\System\GFCDUHO.exe
  2⤵
  PID:2108
- C:\Windows\System\fqJsRwx.exe
  C:\Windows\System\fqJsRwx.exe
  2⤵
  PID:4324
- C:\Windows\System\xJItRSU.exe
  C:\Windows\System\xJItRSU.exe
  2⤵
  PID:2548
- C:\Windows\System\ZyWiqsY.exe
  C:\Windows\System\ZyWiqsY.exe
  2⤵
  PID:14320
- C:\Windows\System\GuaVvWe.exe
  C:\Windows\System\GuaVvWe.exe
  2⤵
  PID:13556
- C:\Windows\System\TsdziGc.exe
  C:\Windows\System\TsdziGc.exe
  2⤵
  PID:13036
- C:\Windows\System\zahLFaF.exe
  C:\Windows\System\zahLFaF.exe
  2⤵
  PID:1516
- C:\Windows\System\xFmCFhL.exe
  C:\Windows\System\xFmCFhL.exe
  2⤵
  PID:13784
- C:\Windows\System\utLLlEK.exe
  C:\Windows\System\utLLlEK.exe
  2⤵
  PID:10832
- C:\Windows\System\BhKjite.exe
  C:\Windows\System\BhKjite.exe
  2⤵
  PID:14324
- C:\Windows\System\FxDqPer.exe
  C:\Windows\System\FxDqPer.exe
  2⤵
  PID:12588
- C:\Windows\System\rMqjRNa.exe
  C:\Windows\System\rMqjRNa.exe
  2⤵
  PID:5172
- C:\Windows\System\WafkexS.exe
  C:\Windows\System\WafkexS.exe
  2⤵
  PID:14240
- C:\Windows\System\RvGMLsJ.exe
  C:\Windows\System\RvGMLsJ.exe
  2⤵
  PID:14252
- C:\Windows\System\FNkzgdg.exe
  C:\Windows\System\FNkzgdg.exe
  2⤵
  PID:5364
- C:\Windows\System\agajpSj.exe
  C:\Windows\System\agajpSj.exe
  2⤵
  PID:13528
- C:\Windows\System\CcRlFKz.exe
  C:\Windows\System\CcRlFKz.exe
  2⤵
  PID:4564
- C:\Windows\System\zrEtMpa.exe
  C:\Windows\System\zrEtMpa.exe
  2⤵
  PID:14108
- C:\Windows\System\SwJWOgV.exe
  C:\Windows\System\SwJWOgV.exe
  2⤵
  PID:2604
- C:\Windows\System\PiHESQP.exe
  C:\Windows\System\PiHESQP.exe
  2⤵
  PID:3520
- C:\Windows\System\fKhnejN.exe
  C:\Windows\System\fKhnejN.exe
  2⤵
  PID:12364
- C:\Windows\System\xauMpsG.exe
  C:\Windows\System\xauMpsG.exe
  2⤵
  PID:3536
- C:\Windows\System\rCLrJMp.exe
  C:\Windows\System\rCLrJMp.exe
  2⤵
  PID:5148
- C:\Windows\System\glkbObQ.exe
  C:\Windows\System\glkbObQ.exe
  2⤵
  PID:5756
- C:\Windows\System\iicCDdo.exe
  C:\Windows\System\iicCDdo.exe
  2⤵
  PID:14192
- C:\Windows\System\RvyaSYf.exe
  C:\Windows\System\RvyaSYf.exe
  2⤵
  PID:12804
- C:\Windows\System\VCtIKKv.exe
  C:\Windows\System\VCtIKKv.exe
  2⤵
  PID:13452
- C:\Windows\System\SyEFmwY.exe
  C:\Windows\System\SyEFmwY.exe
  2⤵
  PID:12680
- C:\Windows\System\VpCSirn.exe
  C:\Windows\System\VpCSirn.exe
  2⤵
  PID:13256
- C:\Windows\System\gupiMno.exe
  C:\Windows\System\gupiMno.exe
  2⤵
  PID:3676
- C:\Windows\System\nfJrmIH.exe
  C:\Windows\System\nfJrmIH.exe
  2⤵
  PID:13224
- C:\Windows\System\SmASyuD.exe
  C:\Windows\System\SmASyuD.exe
  2⤵
  PID:14228
- C:\Windows\System\ttHlhYM.exe
  C:\Windows\System\ttHlhYM.exe
  2⤵
  PID:2852
- C:\Windows\System\uPBkyHq.exe
  C:\Windows\System\uPBkyHq.exe
  2⤵
  PID:14328
- C:\Windows\System\LKqqTXc.exe
  C:\Windows\System\LKqqTXc.exe
  2⤵
  PID:5976
- C:\Windows\System\gMTiOzn.exe
  C:\Windows\System\gMTiOzn.exe
  2⤵
  PID:13584
- C:\Windows\System\UrspZHO.exe
  C:\Windows\System\UrspZHO.exe
  2⤵
  PID:13676
- C:\Windows\System\IHDmaVd.exe
  C:\Windows\System\IHDmaVd.exe
  2⤵
  PID:2036
- C:\Windows\System\lDcFVUK.exe
  C:\Windows\System\lDcFVUK.exe
  2⤵
  PID:5988
- C:\Windows\System\MKVqOpw.exe
  C:\Windows\System\MKVqOpw.exe
  2⤵
  PID:5804
- C:\Windows\System\xogvZeX.exe
  C:\Windows\System\xogvZeX.exe
  2⤵
  PID:5456
- C:\Windows\System\MgtvnAU.exe
  C:\Windows\System\MgtvnAU.exe
  2⤵
  PID:4364
- C:\Windows\System\zwCQXhN.exe
  C:\Windows\System\zwCQXhN.exe
  2⤵
  PID:4472
- C:\Windows\System\KvimBBL.exe
  C:\Windows\System\KvimBBL.exe
  2⤵
  PID:6136
- C:\Windows\System\WhjKtMX.exe
  C:\Windows\System\WhjKtMX.exe
  2⤵
  PID:13432
- C:\Windows\System\KivMueS.exe
  C:\Windows\System\KivMueS.exe
  2⤵
  PID:13516
- C:\Windows\System\LXMVrvW.exe
  C:\Windows\System\LXMVrvW.exe
  2⤵
  PID:13236
- C:\Windows\System\mLJxWqv.exe
  C:\Windows\System\mLJxWqv.exe
  2⤵
  PID:1296
- C:\Windows\System\jwVtsJT.exe
  C:\Windows\System\jwVtsJT.exe
  2⤵
  PID:6024
- C:\Windows\System\XMxwpuV.exe
  C:\Windows\System\XMxwpuV.exe
  2⤵
  PID:2996
- C:\Windows\System\ZSxuNKE.exe
  C:\Windows\System\ZSxuNKE.exe
  2⤵
  PID:5672
- C:\Windows\System\fNrIBxm.exe
  C:\Windows\System\fNrIBxm.exe
  2⤵
  PID:4784
- C:\Windows\System\NxiCqxh.exe
  C:\Windows\System\NxiCqxh.exe
  2⤵
  PID:4468
- C:\Windows\System\DKxatzY.exe
  C:\Windows\System\DKxatzY.exe
  2⤵
  PID:5676
- C:\Windows\System\PELELcc.exe
  C:\Windows\System\PELELcc.exe
  2⤵
  PID:12456
- C:\Windows\System\JmafwIp.exe
  C:\Windows\System\JmafwIp.exe
  2⤵
  PID:6708
- C:\Windows\System\KNqmRMM.exe
  C:\Windows\System\KNqmRMM.exe
  2⤵
  PID:6604
- C:\Windows\System\IMfGbFV.exe
  C:\Windows\System\IMfGbFV.exe
  2⤵
  PID:2948
- C:\Windows\System\LiAoFQT.exe
  C:\Windows\System\LiAoFQT.exe
  2⤵
  PID:5344
- C:\Windows\System\sBNPFfk.exe
  C:\Windows\System\sBNPFfk.exe
  2⤵
  PID:5020
- C:\Windows\System\acAomWR.exe
  C:\Windows\System\acAomWR.exe
  2⤵
  PID:6920
- C:\Windows\System\sIgcgaz.exe
  C:\Windows\System\sIgcgaz.exe
  2⤵
  PID:5732
- C:\Windows\System\HwxzBDq.exe
  C:\Windows\System\HwxzBDq.exe
  2⤵
  PID:5452
- C:\Windows\System\ZSicyNJ.exe
  C:\Windows\System\ZSicyNJ.exe
  2⤵
  PID:5844
- C:\Windows\System\ODCAHsc.exe
  C:\Windows\System\ODCAHsc.exe
  2⤵
  PID:13504
- C:\Windows\System\YLZmnAn.exe
  C:\Windows\System\YLZmnAn.exe
  2⤵
  PID:2232
- C:\Windows\System\NlkJrnG.exe
  C:\Windows\System\NlkJrnG.exe
  2⤵
  PID:6852
- C:\Windows\System\NjTcPKb.exe
  C:\Windows\System\NjTcPKb.exe
  2⤵
  PID:2004
- C:\Windows\System\OAOqMJQ.exe
  C:\Windows\System\OAOqMJQ.exe
  2⤵
  PID:7452
- C:\Windows\System\nNtwfIR.exe
  C:\Windows\System\nNtwfIR.exe
  2⤵
  PID:2832
- C:\Windows\System\jVgslkv.exe
  C:\Windows\System\jVgslkv.exe
  2⤵
  PID:5712
- C:\Windows\System\jVXXwYj.exe
  C:\Windows\System\jVXXwYj.exe
  2⤵
  PID:6856
- C:\Windows\System\ufEzlvW.exe
  C:\Windows\System\ufEzlvW.exe
  2⤵
  PID:6560
- C:\Windows\System\JohQJlK.exe
  C:\Windows\System\JohQJlK.exe
  2⤵
  PID:6124
- C:\Windows\System\zVVpJfm.exe
  C:\Windows\System\zVVpJfm.exe
  2⤵
  PID:8168
- C:\Windows\System\MtaeOno.exe
  C:\Windows\System\MtaeOno.exe
  2⤵
  PID:5180
- C:\Windows\System\naxkBXl.exe
  C:\Windows\System\naxkBXl.exe
  2⤵
  PID:8404
- C:\Windows\System\BOqXTBf.exe
  C:\Windows\System\BOqXTBf.exe
  2⤵
  PID:6996
- C:\Windows\System\yqVRSog.exe
  C:\Windows\System\yqVRSog.exe
  2⤵
  PID:7936
- C:\Windows\System\plUzaSQ.exe
  C:\Windows\System\plUzaSQ.exe
  2⤵
  PID:1080
- C:\Windows\System\dPihHOB.exe
  C:\Windows\System\dPihHOB.exe
  2⤵
  PID:5840
- C:\Windows\System\yMxUHCh.exe
  C:\Windows\System\yMxUHCh.exe
  2⤵
  PID:6596
- C:\Windows\System\lvLnMUu.exe
  C:\Windows\System\lvLnMUu.exe
  2⤵
  PID:7960
- C:\Windows\System\qbvYKqb.exe
  C:\Windows\System\qbvYKqb.exe
  2⤵
  PID:8464
- C:\Windows\System\SYipnxs.exe
  C:\Windows\System\SYipnxs.exe
  2⤵
  PID:1628
- C:\Windows\System\hkmHhZG.exe
  C:\Windows\System\hkmHhZG.exe
  2⤵
  PID:7940
- C:\Windows\System\irFTvMt.exe
  C:\Windows\System\irFTvMt.exe
  2⤵
  PID:7380
- C:\Windows\System\JZkTvBP.exe
  C:\Windows\System\JZkTvBP.exe
  2⤵
  PID:7628
- C:\Windows\System\DjFLiCc.exe
  C:\Windows\System\DjFLiCc.exe
  2⤵
  PID:8444
- C:\Windows\System\mvHRciJ.exe
  C:\Windows\System\mvHRciJ.exe
  2⤵
  PID:8104
- C:\Windows\System\gTWRJhF.exe
  C:\Windows\System\gTWRJhF.exe
  2⤵
  PID:6812
- C:\Windows\System\oJFGjtX.exe
  C:\Windows\System\oJFGjtX.exe
  2⤵
  PID:13520
- C:\Windows\System\GzYuYOy.exe
  C:\Windows\System\GzYuYOy.exe
  2⤵
  PID:2424
- C:\Windows\System\aDjSHvD.exe
  C:\Windows\System\aDjSHvD.exe
  2⤵
  PID:5292
- C:\Windows\System\fQjtsbx.exe
  C:\Windows\System\fQjtsbx.exe
  2⤵
  PID:8044
- C:\Windows\System\swhOYyn.exe
  C:\Windows\System\swhOYyn.exe
  2⤵
  PID:5940
- C:\Windows\System\JyFGuSf.exe
  C:\Windows\System\JyFGuSf.exe
  2⤵
  PID:8664
- C:\Windows\System\LedbOFt.exe
  C:\Windows\System\LedbOFt.exe
  2⤵
  PID:14364
- C:\Windows\System\BMUtsUL.exe
  C:\Windows\System\BMUtsUL.exe
  2⤵
  PID:14384
- C:\Windows\System\wOAajXU.exe
  C:\Windows\System\wOAajXU.exe
  2⤵
  PID:14404
- C:\Windows\System\rRevHOn.exe
  C:\Windows\System\rRevHOn.exe
  2⤵
  PID:14424
- C:\Windows\System\OLdFwmg.exe
  C:\Windows\System\OLdFwmg.exe
  2⤵
  PID:14448
- C:\Windows\System\nVFJaDk.exe
  C:\Windows\System\nVFJaDk.exe
  2⤵
  PID:14464
- C:\Windows\System\EcHMdtX.exe
  C:\Windows\System\EcHMdtX.exe
  2⤵
  PID:14520
- C:\Windows\System\oFxvhFb.exe
  C:\Windows\System\oFxvhFb.exe
  2⤵
  PID:14536
- C:\Windows\System\PxZTfhX.exe
  C:\Windows\System\PxZTfhX.exe
  2⤵
  PID:14612
- C:\Windows\System\djeqrSQ.exe
  C:\Windows\System\djeqrSQ.exe
  2⤵
  PID:14692
- C:\Windows\System\JphrBdp.exe
  C:\Windows\System\JphrBdp.exe
  2⤵
  PID:14740
- C:\Windows\System\cKaLPgw.exe
  C:\Windows\System\cKaLPgw.exe
  2⤵
  PID:14820
- C:\Windows\System\iOuJsFA.exe
  C:\Windows\System\iOuJsFA.exe
  2⤵
  PID:14856
- C:\Windows\System\mrviVfZ.exe
  C:\Windows\System\mrviVfZ.exe
  2⤵
  PID:14880
- C:\Windows\System\WnKxLHK.exe
  C:\Windows\System\WnKxLHK.exe
  2⤵
  PID:14904
- C:\Windows\System\FQSLmIK.exe
  C:\Windows\System\FQSLmIK.exe
  2⤵
  PID:14928
- C:\Windows\System\qbTviLF.exe
  C:\Windows\System\qbTviLF.exe
  2⤵
  PID:14444
- C:\Windows\System\YdXvgRT.exe
  C:\Windows\System\YdXvgRT.exe
  2⤵
  PID:14412
- C:\Windows\System\waYcjcH.exe
  C:\Windows\System\waYcjcH.exe
  2⤵
  PID:8512
- C:\Windows\System\nJvaxgC.exe
  C:\Windows\System\nJvaxgC.exe
  2⤵
  PID:14556
- C:\Windows\System\JXRsqgb.exe
  C:\Windows\System\JXRsqgb.exe
  2⤵
  PID:14480
- C:\Windows\System\hMBKKtr.exe
  C:\Windows\System\hMBKKtr.exe
  2⤵
  PID:14548
- C:\Windows\System\nMapejQ.exe
  C:\Windows\System\nMapejQ.exe
  2⤵
  PID:8656
- C:\Windows\System\NJrnzTL.exe
  C:\Windows\System\NJrnzTL.exe
  2⤵
  PID:9092
- C:\Windows\System\QXpWPMW.exe
  C:\Windows\System\QXpWPMW.exe
  2⤵
  PID:14780
- C:\Windows\System\ryWaUnc.exe
  C:\Windows\System\ryWaUnc.exe
  2⤵
  PID:14980
- C:\Windows\System\UQOFrMz.exe
  C:\Windows\System\UQOFrMz.exe
  2⤵
  PID:15008
- C:\Windows\System\RBqchXD.exe
  C:\Windows\System\RBqchXD.exe
  2⤵
  PID:12148
- C:\Windows\System\VMevjgP.exe
  C:\Windows\System\VMevjgP.exe
  2⤵
  PID:14792
- C:\Windows\System\mJphbul.exe
  C:\Windows\System\mJphbul.exe
  2⤵
  PID:15080
- C:\Windows\System\gFEQFTu.exe
  C:\Windows\System\gFEQFTu.exe
  2⤵
  PID:9000
- C:\Windows\System\hcMcFyO.exe
  C:\Windows\System\hcMcFyO.exe
  2⤵
  PID:9100
- C:\Windows\System\kZADoqX.exe
  C:\Windows\System\kZADoqX.exe
  2⤵
  PID:15096
- C:\Windows\System\RYtHcnK.exe
  C:\Windows\System\RYtHcnK.exe
  2⤵
  PID:15104
- C:\Windows\System\SSRtzUT.exe
  C:\Windows\System\SSRtzUT.exe
  2⤵
  PID:15160
- C:\Windows\System\GorSenr.exe
  C:\Windows\System\GorSenr.exe
  2⤵
  PID:15224
- C:\Windows\System\UMmtlsL.exe
  C:\Windows\System\UMmtlsL.exe
  2⤵
  PID:15236
- C:\Windows\System\mgEwUyq.exe
  C:\Windows\System\mgEwUyq.exe
  2⤵
  PID:15260
- C:\Windows\System\VmIslIQ.exe
  C:\Windows\System\VmIslIQ.exe
  2⤵
  PID:15056
- C:\Windows\System\PQhnYtn.exe
  C:\Windows\System\PQhnYtn.exe
  2⤵
  PID:11040
- C:\Windows\System\XVroUfl.exe
  C:\Windows\System\XVroUfl.exe
  2⤵
  PID:15296
- C:\Windows\System\QTnxBlF.exe
  C:\Windows\System\QTnxBlF.exe
  2⤵
  PID:4072
- C:\Windows\System\rgVdzwn.exe
  C:\Windows\System\rgVdzwn.exe
  2⤵
  PID:8188
- C:\Windows\System\lWwZbIP.exe
  C:\Windows\System\lWwZbIP.exe
  2⤵
  PID:15188
- C:\Windows\System\HtGOjGR.exe
  C:\Windows\System\HtGOjGR.exe
  2⤵
  PID:15240
- C:\Windows\System\vtpXHAB.exe
  C:\Windows\System\vtpXHAB.exe
  2⤵
  PID:1444
- C:\Windows\System\ItyNlyw.exe
  C:\Windows\System\ItyNlyw.exe
  2⤵
  PID:9152
- C:\Windows\System\jJAsthN.exe
  C:\Windows\System\jJAsthN.exe
  2⤵
  PID:15304
- C:\Windows\System\yayAowU.exe
  C:\Windows\System\yayAowU.exe
  2⤵
  PID:7712
- C:\Windows\System\uVkjCGh.exe
  C:\Windows\System\uVkjCGh.exe
  2⤵
  PID:7708
- C:\Windows\System\QQTonuo.exe
  C:\Windows\System\QQTonuo.exe
  2⤵
  PID:8720
- C:\Windows\System\YwwGnsu.exe
  C:\Windows\System\YwwGnsu.exe
  2⤵
  PID:4720
- C:\Windows\System\znXyJpw.exe
  C:\Windows\System\znXyJpw.exe
  2⤵
  PID:15272
- C:\Windows\System\pBrpVoi.exe
  C:\Windows\System\pBrpVoi.exe
  2⤵
  PID:8816
- C:\Windows\System\MQPepkL.exe
  C:\Windows\System\MQPepkL.exe
  2⤵
  PID:9104
- C:\Windows\System\ylOYJGD.exe
  C:\Windows\System\ylOYJGD.exe
  2⤵
  PID:9136
- C:\Windows\System\DMoOoez.exe
  C:\Windows\System\DMoOoez.exe
  2⤵
  PID:7212
- C:\Windows\System\OBszgdX.exe
  C:\Windows\System\OBszgdX.exe
  2⤵
  PID:7944
- C:\Windows\System\nbDKMji.exe
  C:\Windows\System\nbDKMji.exe
  2⤵
  PID:7256
- C:\Windows\System\eiPXHBb.exe
  C:\Windows\System\eiPXHBb.exe
  2⤵
  PID:7268
- C:\Windows\System\lyHNaOV.exe
  C:\Windows\System\lyHNaOV.exe
  2⤵
  PID:8460
- C:\Windows\System\sYuhilN.exe
  C:\Windows\System\sYuhilN.exe
  2⤵
  PID:8092
- C:\Windows\System\xPAIPaV.exe
  C:\Windows\System\xPAIPaV.exe
  2⤵
  PID:8004
- C:\Windows\System\KAxCkQG.exe
  C:\Windows\System\KAxCkQG.exe
  2⤵
  PID:13464
- C:\Windows\System\sWlrakh.exe
  C:\Windows\System\sWlrakh.exe
  2⤵
  PID:7764
- C:\Windows\System\IpQtHwC.exe
  C:\Windows\System\IpQtHwC.exe
  2⤵
  PID:6332
- C:\Windows\System\WtsDHFd.exe
  C:\Windows\System\WtsDHFd.exe
  2⤵
  PID:8820
- C:\Windows\System\uIwdaCr.exe
  C:\Windows\System\uIwdaCr.exe
  2⤵
  PID:9060
- C:\Windows\System\JunALmj.exe
  C:\Windows\System\JunALmj.exe
  2⤵
  PID:9160
- C:\Windows\System\lIgWKOp.exe
  C:\Windows\System\lIgWKOp.exe
  2⤵
  PID:6880
- C:\Windows\System\YtEUoOv.exe
  C:\Windows\System\YtEUoOv.exe
  2⤵
  PID:8456
- C:\Windows\System\skfTMRj.exe
  C:\Windows\System\skfTMRj.exe
  2⤵
  PID:7948
- C:\Windows\System\hpmmTtf.exe
  C:\Windows\System\hpmmTtf.exe
  2⤵
  PID:8328
- C:\Windows\System\RMNEmCU.exe
  C:\Windows\System\RMNEmCU.exe
  2⤵
  PID:6944
- C:\Windows\System\hHUUOcw.exe
  C:\Windows\System\hHUUOcw.exe
  2⤵
  PID:7600
- C:\Windows\System\hqktHdE.exe
  C:\Windows\System\hqktHdE.exe
  2⤵
  PID:8964
- C:\Windows\System\nQOrRbH.exe
  C:\Windows\System\nQOrRbH.exe
  2⤵
  PID:14916
- C:\Windows\System\AkAGAfU.exe
  C:\Windows\System\AkAGAfU.exe
  2⤵
  PID:9336
- C:\Windows\System\Ofoxfgv.exe
  C:\Windows\System\Ofoxfgv.exe
  2⤵
  PID:7320
- C:\Windows\System\OaTpRKc.exe
  C:\Windows\System\OaTpRKc.exe
  2⤵
  PID:10952
- C:\Windows\System\YqtIGvO.exe
  C:\Windows\System\YqtIGvO.exe
  2⤵
  PID:6408
- C:\Windows\System\wDwvknn.exe
  C:\Windows\System\wDwvknn.exe
  2⤵
  PID:12196
- C:\Windows\System\xGlkSZT.exe
  C:\Windows\System\xGlkSZT.exe
  2⤵
  PID:9560
- C:\Windows\System\Prpoaod.exe
  C:\Windows\System\Prpoaod.exe
  2⤵
  PID:15032
- C:\Windows\System\xcLaTrl.exe
  C:\Windows\System\xcLaTrl.exe
  2⤵
  PID:9040
- C:\Windows\System\mfZcIpP.exe
  C:\Windows\System\mfZcIpP.exe
  2⤵
  PID:8752
- C:\Windows\System\wxRcgzq.exe
  C:\Windows\System\wxRcgzq.exe
  2⤵
  PID:9912
- C:\Windows\System\kfYoCao.exe
  C:\Windows\System\kfYoCao.exe
  2⤵
  PID:15108
- C:\Windows\System\CspEixr.exe
  C:\Windows\System\CspEixr.exe
  2⤵
  PID:15200
- C:\Windows\System\QLobaBm.exe
  C:\Windows\System\QLobaBm.exe
  2⤵
  PID:9204
- C:\Windows\System\PUKiUMN.exe
  C:\Windows\System\PUKiUMN.exe
  2⤵
  PID:7344
- C:\Windows\System\hfMxpga.exe
  C:\Windows\System\hfMxpga.exe
  2⤵
  PID:8856
- C:\Windows\System\OWviUGM.exe
  C:\Windows\System\OWviUGM.exe
  2⤵
  PID:10632
- C:\Windows\System\HnBqQmX.exe
  C:\Windows\System\HnBqQmX.exe
  2⤵
  PID:12356
- C:\Windows\System\btztBGG.exe
  C:\Windows\System\btztBGG.exe
  2⤵
  PID:7964
- C:\Windows\System\VzOIYRh.exe
  C:\Windows\System\VzOIYRh.exe
  2⤵
  PID:10192
- C:\Windows\System\ZOTvqFM.exe
  C:\Windows\System\ZOTvqFM.exe
  2⤵
  PID:10004
- C:\Windows\System\oorSSfu.exe
  C:\Windows\System\oorSSfu.exe
  2⤵
  PID:10928
- C:\Windows\System\TQBkxbJ.exe
  C:\Windows\System\TQBkxbJ.exe
  2⤵
  PID:12704
- C:\Windows\System\NTLHswI.exe
  C:\Windows\System\NTLHswI.exe
  2⤵
  PID:8764
- C:\Windows\System\pbMORie.exe
  C:\Windows\System\pbMORie.exe
  2⤵
  PID:8476
- C:\Windows\System\TwiUZLz.exe
  C:\Windows\System\TwiUZLz.exe
  2⤵
  PID:9768
- C:\Windows\System\EMmpawQ.exe
  C:\Windows\System\EMmpawQ.exe
  2⤵
  PID:7536
- C:\Windows\System\wIyjOGC.exe
  C:\Windows\System\wIyjOGC.exe
  2⤵
  PID:10160
- C:\Windows\System\tWxKmUP.exe
  C:\Windows\System\tWxKmUP.exe
  2⤵
  PID:9196
- C:\Windows\System\YJCwboe.exe
  C:\Windows\System\YJCwboe.exe
  2⤵
  PID:9368
- C:\Windows\System\yVrMGYZ.exe
  C:\Windows\System\yVrMGYZ.exe
  2⤵
  PID:7460
- C:\Windows\System\kiTxBFO.exe
  C:\Windows\System\kiTxBFO.exe
  2⤵
  PID:8396
- C:\Windows\System\CGbFcgJ.exe
  C:\Windows\System\CGbFcgJ.exe
  2⤵
  PID:13280
- C:\Windows\System\aKHlxRK.exe
  C:\Windows\System\aKHlxRK.exe
  2⤵
  PID:14340
- C:\Windows\System\TcvNfJS.exe
  C:\Windows\System\TcvNfJS.exe
  2⤵
  PID:8788
- C:\Windows\System\GMngkNk.exe
  C:\Windows\System\GMngkNk.exe
  2⤵
  PID:8844
- C:\Windows\System\IEEWasL.exe
  C:\Windows\System\IEEWasL.exe
  2⤵
  PID:9752
- C:\Windows\System\rNyEgDS.exe
  C:\Windows\System\rNyEgDS.exe
  2⤵
  PID:8420
- C:\Windows\System\QlXomix.exe
  C:\Windows\System\QlXomix.exe
  2⤵
  PID:8124
- C:\Windows\System\zHKHAoV.exe
  C:\Windows\System\zHKHAoV.exe
  2⤵
  PID:9380
- C:\Windows\System\TieYGeO.exe
  C:\Windows\System\TieYGeO.exe
  2⤵
  PID:6908
- C:\Windows\System\MPZVOAO.exe
  C:\Windows\System\MPZVOAO.exe
  2⤵
  PID:10144
- C:\Windows\System\KQOGIDn.exe
  C:\Windows\System\KQOGIDn.exe
  2⤵
  PID:9480
- C:\Windows\System\jSpTylq.exe
  C:\Windows\System\jSpTylq.exe
  2⤵
  PID:8544
- C:\Windows\System\neXGmML.exe
  C:\Windows\System\neXGmML.exe
  2⤵
  PID:8204
- C:\Windows\System\eCNrFNl.exe
  C:\Windows\System\eCNrFNl.exe
  2⤵
  PID:9584
- C:\Windows\System\cmpxDHe.exe
  C:\Windows\System\cmpxDHe.exe
  2⤵
  PID:12340
- C:\Windows\System\mmViEqI.exe
  C:\Windows\System\mmViEqI.exe
  2⤵
  PID:6624
- C:\Windows\System\roRWBkd.exe
  C:\Windows\System\roRWBkd.exe
  2⤵
  PID:10548
- C:\Windows\System\YiCinhl.exe
  C:\Windows\System\YiCinhl.exe
  2⤵
  PID:7532
- C:\Windows\System\bfKnCrG.exe
  C:\Windows\System\bfKnCrG.exe
  2⤵
  PID:7632
- C:\Windows\System\FZrlDRO.exe
  C:\Windows\System\FZrlDRO.exe
  2⤵
  PID:10148
- C:\Windows\System\iKpEVHs.exe
  C:\Windows\System\iKpEVHs.exe
  2⤵
  PID:9872
- C:\Windows\System\fETayoA.exe
  C:\Windows\System\fETayoA.exe
  2⤵
  PID:10680
- C:\Windows\System\DsAGlad.exe
  C:\Windows\System\DsAGlad.exe
  2⤵
  PID:8704
- C:\Windows\System\TYqpQBh.exe
  C:\Windows\System\TYqpQBh.exe
  2⤵
  PID:9408
- C:\Windows\System\aDghslQ.exe
  C:\Windows\System\aDghslQ.exe
  2⤵
  PID:10216
- C:\Windows\System\AXVvdQh.exe
  C:\Windows\System\AXVvdQh.exe
  2⤵
  PID:9824
- C:\Windows\System\oxPCkqN.exe
  C:\Windows\System\oxPCkqN.exe
  2⤵
  PID:8772
- C:\Windows\System\uvqpykl.exe
  C:\Windows\System\uvqpykl.exe
  2⤵
  PID:6540
- C:\Windows\System\KaYDcrd.exe
  C:\Windows\System\KaYDcrd.exe
  2⤵
  PID:14604
- C:\Windows\System\sHGaoHV.exe
  C:\Windows\System\sHGaoHV.exe
  2⤵
  PID:8164
- C:\Windows\System\KGAwbll.exe
  C:\Windows\System\KGAwbll.exe
  2⤵
  PID:1836
- C:\Windows\System\JBRWmIF.exe
  C:\Windows\System\JBRWmIF.exe
  2⤵
  PID:14576
- C:\Windows\System\QMpExBO.exe
  C:\Windows\System\QMpExBO.exe
  2⤵
  PID:13308
- C:\Windows\System\TLlAmWP.exe
  C:\Windows\System\TLlAmWP.exe
  2⤵
  PID:6668
- C:\Windows\System\MDAJoVY.exe
  C:\Windows\System\MDAJoVY.exe
  2⤵
  PID:8148
- C:\Windows\System\EvWdGwM.exe
  C:\Windows\System\EvWdGwM.exe
  2⤵
  PID:14572
- C:\Windows\System\nmcDWbv.exe
  C:\Windows\System\nmcDWbv.exe
  2⤵
  PID:9200
- C:\Windows\System\BjGlvvD.exe
  C:\Windows\System\BjGlvvD.exe
  2⤵
  PID:15028
- C:\Windows\System\pkNIOae.exe
  C:\Windows\System\pkNIOae.exe
  2⤵
  PID:12352
- C:\Windows\System\kSqwqGz.exe
  C:\Windows\System\kSqwqGz.exe
  2⤵
  PID:4488
- C:\Windows\System\YFWcIbd.exe
  C:\Windows\System\YFWcIbd.exe
  2⤵
  PID:14704
- C:\Windows\System\TUxSntW.exe
  C:\Windows\System\TUxSntW.exe
  2⤵
  PID:3868
- C:\Windows\System\CEFJtkM.exe
  C:\Windows\System\CEFJtkM.exe
  2⤵
  PID:11188
- C:\Windows\System\eKtEqWy.exe
  C:\Windows\System\eKtEqWy.exe
  2⤵
  PID:9412
- C:\Windows\System\omjvspA.exe
  C:\Windows\System\omjvspA.exe
  2⤵
  PID:11404
- C:\Windows\System\zcwmaOU.exe
  C:\Windows\System\zcwmaOU.exe
  2⤵
  PID:11580
- C:\Windows\System\yKrzuMV.exe
  C:\Windows\System\yKrzuMV.exe
  2⤵
  PID:8940
- C:\Windows\System\qOwYxFh.exe
  C:\Windows\System\qOwYxFh.exe
  2⤵
  PID:11308
- C:\Windows\System\mPHZOFj.exe
  C:\Windows\System\mPHZOFj.exe
  2⤵
  PID:11332
- C:\Windows\System\uzFXtIH.exe
  C:\Windows\System\uzFXtIH.exe
  2⤵
  PID:8672
- C:\Windows\System\IuYiXRz.exe
  C:\Windows\System\IuYiXRz.exe
  2⤵
  PID:11276
- C:\Windows\System\oRtufoC.exe
  C:\Windows\System\oRtufoC.exe
  2⤵
  PID:7456
- C:\Windows\System\kYIVrLx.exe
  C:\Windows\System\kYIVrLx.exe
  2⤵
  PID:8724
- C:\Windows\System\leczvqW.exe
  C:\Windows\System\leczvqW.exe
  2⤵
  PID:11748
- C:\Windows\System\oggfQfN.exe
  C:\Windows\System\oggfQfN.exe
  2⤵
  PID:11356
- C:\Windows\System\NisClgK.exe
  C:\Windows\System\NisClgK.exe
  2⤵
  PID:11732
- C:\Windows\System\Mddfzog.exe
  C:\Windows\System\Mddfzog.exe
  2⤵
  PID:12124
- C:\Windows\System\rWwsahq.exe
  C:\Windows\System\rWwsahq.exe
  2⤵
  PID:12212
- C:\Windows\System\IeSzHPM.exe
  C:\Windows\System\IeSzHPM.exe
  2⤵
  PID:10448
- C:\Windows\System\baPfmlX.exe
  C:\Windows\System\baPfmlX.exe
  2⤵
  PID:11724
- C:\Windows\System\wXGxvXt.exe
  C:\Windows\System\wXGxvXt.exe
  2⤵
  PID:11340
- C:\Windows\System\BsuNQfr.exe
  C:\Windows\System\BsuNQfr.exe
  2⤵
  PID:11588
- C:\Windows\System\oEVCGZB.exe
  C:\Windows\System\oEVCGZB.exe
  2⤵
  PID:11564
- C:\Windows\System\xTdsWcN.exe
  C:\Windows\System\xTdsWcN.exe
  2⤵
  PID:10656
- C:\Windows\System\EiwsvqT.exe
  C:\Windows\System\EiwsvqT.exe
  2⤵
  PID:12220
- C:\Windows\System\pCULsmu.exe
  C:\Windows\System\pCULsmu.exe
  2⤵
  PID:12116
- C:\Windows\System\oALbsrX.exe
  C:\Windows\System\oALbsrX.exe
  2⤵
  PID:11660
- C:\Windows\System\XCfsxFB.exe
  C:\Windows\System\XCfsxFB.exe
  2⤵
  PID:12088
- C:\Windows\System\gyRqDvm.exe
  C:\Windows\System\gyRqDvm.exe
  2⤵
  PID:11124
- C:\Windows\System\oPiWRTc.exe
  C:\Windows\System\oPiWRTc.exe
  2⤵
  PID:9124
- C:\Windows\System\blEgHWt.exe
  C:\Windows\System\blEgHWt.exe
  2⤵
  PID:9608
- C:\Windows\System\LBGSkok.exe
  C:\Windows\System\LBGSkok.exe
  2⤵
  PID:3708
- C:\Windows\System\BgUWBZz.exe
  C:\Windows\System\BgUWBZz.exe
  2⤵
  PID:13588
- C:\Windows\System\KIAZIZw.exe
  C:\Windows\System\KIAZIZw.exe
  2⤵
  PID:10764
- C:\Windows\System\RlArvID.exe
  C:\Windows\System\RlArvID.exe
  2⤵
  PID:9184
- C:\Windows\System\ulIFxVL.exe
  C:\Windows\System\ulIFxVL.exe
  2⤵
  PID:10972
- C:\Windows\System\FgwAUlV.exe
  C:\Windows\System\FgwAUlV.exe
  2⤵
  PID:9168
- C:\Windows\System\wMspVrD.exe
  C:\Windows\System\wMspVrD.exe
  2⤵
  PID:8568
- C:\Windows\System\YwXbYnJ.exe
  C:\Windows\System\YwXbYnJ.exe
  2⤵
  PID:11744
- C:\Windows\System\kUadRKF.exe
  C:\Windows\System\kUadRKF.exe
  2⤵
  PID:11132
- C:\Windows\System\tUUHGzH.exe
  C:\Windows\System\tUUHGzH.exe
  2⤵
  PID:10200
- C:\Windows\System\TUPbeMm.exe
  C:\Windows\System\TUPbeMm.exe
  2⤵
  PID:7284
- C:\Windows\System\ewufoTK.exe
  C:\Windows\System\ewufoTK.exe
  2⤵
  PID:12060
- C:\Windows\System\UcaIkPJ.exe
  C:\Windows\System\UcaIkPJ.exe
  2⤵
  PID:10208
- C:\Windows\System\FmbrgUv.exe
  C:\Windows\System\FmbrgUv.exe
  2⤵
  PID:10588
- C:\Windows\System\cwBsJCC.exe
  C:\Windows\System\cwBsJCC.exe
  2⤵
  PID:9212
- C:\Windows\System\rNLNtYe.exe
  C:\Windows\System\rNLNtYe.exe
  2⤵
  PID:15088
- C:\Windows\System\tgnqoKX.exe
  C:\Windows\System\tgnqoKX.exe
  2⤵
  PID:7280
- C:\Windows\System\tSKVuSe.exe
  C:\Windows\System\tSKVuSe.exe
  2⤵
  PID:9800
- C:\Windows\System\RApxtWn.exe
  C:\Windows\System\RApxtWn.exe
  2⤵
  PID:4196
- C:\Windows\System\ASExSLv.exe
  C:\Windows\System\ASExSLv.exe
  2⤵
  PID:10912
- C:\Windows\System\QtNDMbY.exe
  C:\Windows\System\QtNDMbY.exe
  2⤵
  PID:9744
- C:\Windows\System\jvjNpAf.exe
  C:\Windows\System\jvjNpAf.exe
  2⤵
  PID:7880
- C:\Windows\System\IieuFby.exe
  C:\Windows\System\IieuFby.exe
  2⤵
  PID:9276
- C:\Windows\System\FlIRCGA.exe
  C:\Windows\System\FlIRCGA.exe
  2⤵
  PID:11016
- C:\Windows\System\yYbydza.exe
  C:\Windows\System\yYbydza.exe
  2⤵
  PID:5724
- C:\Windows\System\zzMBanb.exe
  C:\Windows\System\zzMBanb.exe
  2⤵
  PID:14432
- C:\Windows\System\AsnKBmY.exe
  C:\Windows\System\AsnKBmY.exe
  2⤵
  PID:8956
- C:\Windows\System\TbTpNkq.exe
  C:\Windows\System\TbTpNkq.exe
  2⤵
  PID:9032
- C:\Windows\System\immdzOe.exe
  C:\Windows\System\immdzOe.exe
  2⤵
  PID:9256
- C:\Windows\System\fjCboRZ.exe
  C:\Windows\System\fjCboRZ.exe
  2⤵
  PID:10940
- C:\Windows\System\QCAAmqf.exe
  C:\Windows\System\QCAAmqf.exe
  2⤵
  PID:756
- C:\Windows\System\IdKrLEn.exe
  C:\Windows\System\IdKrLEn.exe
  2⤵
  PID:10132
- C:\Windows\System\XFZKdea.exe
  C:\Windows\System\XFZKdea.exe
  2⤵
  PID:8688
- C:\Windows\System\eEdmvEj.exe
  C:\Windows\System\eEdmvEj.exe
  2⤵
  PID:9024
- C:\Windows\System\SYObkLz.exe
  C:\Windows\System\SYObkLz.exe
  2⤵
  PID:11228
- C:\Windows\System\KHbYKNG.exe
  C:\Windows\System\KHbYKNG.exe
  2⤵
  PID:8356
- C:\Windows\System\oJewrGW.exe
  C:\Windows\System\oJewrGW.exe
  2⤵
  PID:2408
- C:\Windows\System\wgTMVnB.exe
  C:\Windows\System\wgTMVnB.exe
  2⤵
  PID:10484
- C:\Windows\System\sSmWyqD.exe
  C:\Windows\System\sSmWyqD.exe
  2⤵
  PID:11324
- C:\Windows\System\bnzDJoP.exe
  C:\Windows\System\bnzDJoP.exe
  2⤵
  PID:11616
- C:\Windows\System\kSWBTMo.exe
  C:\Windows\System\kSWBTMo.exe
  2⤵
  PID:9384
- C:\Windows\System\xTQUCEh.exe
  C:\Windows\System\xTQUCEh.exe
  2⤵
  PID:11692
- C:\Windows\System\FhCwkOt.exe
  C:\Windows\System\FhCwkOt.exe
  2⤵
  PID:10116
- C:\Windows\System\pbASFuj.exe
  C:\Windows\System\pbASFuj.exe
  2⤵
  PID:7716
- C:\Windows\System\iKLJwxC.exe
  C:\Windows\System\iKLJwxC.exe
  2⤵
  PID:14488
- C:\Windows\System\rTExwEb.exe
  C:\Windows\System\rTExwEb.exe
  2⤵
  PID:10500
- C:\Windows\System\ioqSrcm.exe
  C:\Windows\System\ioqSrcm.exe
  2⤵
  PID:10604
- C:\Windows\System\vOQpFTL.exe
  C:\Windows\System\vOQpFTL.exe
  2⤵
  PID:9568
- C:\Windows\System\dXzWdiI.exe
  C:\Windows\System\dXzWdiI.exe
  2⤵
  PID:11296
- C:\Windows\System\fOTjFLn.exe
  C:\Windows\System\fOTjFLn.exe
  2⤵
  PID:11532
- C:\Windows\System\avfbZnY.exe
  C:\Windows\System\avfbZnY.exe
  2⤵
  PID:11984
- C:\Windows\System\oJIbwsg.exe
  C:\Windows\System\oJIbwsg.exe
  2⤵
  PID:12240
- C:\Windows\System\TXEXUMu.exe
  C:\Windows\System\TXEXUMu.exe
  2⤵
  PID:11648
- C:\Windows\System\wkdHXdf.exe
  C:\Windows\System\wkdHXdf.exe
  2⤵
  PID:12264
- C:\Windows\System\zDhstYM.exe
  C:\Windows\System\zDhstYM.exe
  2⤵
  PID:12136
- C:\Windows\System\VhkonLP.exe
  C:\Windows\System\VhkonLP.exe
  2⤵
  PID:12028
- C:\Windows\System\rxMYGCQ.exe
  C:\Windows\System\rxMYGCQ.exe
  2⤵
  PID:14996
- C:\Windows\System\VkNDjQb.exe
  C:\Windows\System\VkNDjQb.exe
  2⤵
  PID:14676
- C:\Windows\System\OIWJQUE.exe
  C:\Windows\System\OIWJQUE.exe
  2⤵
  PID:11520
- C:\Windows\System\BYNDMcg.exe
  C:\Windows\System\BYNDMcg.exe
  2⤵
  PID:8312
- C:\Windows\System\UyTHzhI.exe
  C:\Windows\System\UyTHzhI.exe
  2⤵
  PID:10572
- C:\Windows\System\htUbHcO.exe
  C:\Windows\System\htUbHcO.exe
  2⤵
  PID:13600
- C:\Windows\System\jFgLlli.exe
  C:\Windows\System\jFgLlli.exe
  2⤵
  PID:3696
- C:\Windows\System\qDVDQWP.exe
  C:\Windows\System\qDVDQWP.exe
  2⤵
  PID:13724
- C:\Windows\System\klAbzBD.exe
  C:\Windows\System\klAbzBD.exe
  2⤵
  PID:12512
- C:\Windows\System\HADrYsO.exe
  C:\Windows\System\HADrYsO.exe
  2⤵
  PID:13948
- C:\Windows\System\vTagvyw.exe
  C:\Windows\System\vTagvyw.exe
  2⤵
  PID:10868
- C:\Windows\System\xqPadwD.exe
  C:\Windows\System\xqPadwD.exe
  2⤵
  PID:13920
- C:\Windows\System\lvbjIJX.exe
  C:\Windows\System\lvbjIJX.exe
  2⤵
  PID:14720
- C:\Windows\System\DugQxgi.exe
  C:\Windows\System\DugQxgi.exe
  2⤵
  PID:7588
- C:\Windows\System\DPhMRbi.exe
  C:\Windows\System\DPhMRbi.exe
  2⤵
  PID:12284
- C:\Windows\System\XIaVhMS.exe
  C:\Windows\System\XIaVhMS.exe
  2⤵
  PID:11808
- C:\Windows\System\fRhjdwW.exe
  C:\Windows\System\fRhjdwW.exe
  2⤵
  PID:11736
- C:\Windows\System\KTfbQvA.exe
  C:\Windows\System\KTfbQvA.exe
  2⤵
  PID:15364
- C:\Windows\System\qvQbpJR.exe
  C:\Windows\System\qvQbpJR.exe
  2⤵
  PID:15380
- C:\Windows\System\yKZtxpf.exe
  C:\Windows\System\yKZtxpf.exe
  2⤵
  PID:15400
- C:\Windows\System\NGBmtmZ.exe
  C:\Windows\System\NGBmtmZ.exe
  2⤵
  PID:15776
- C:\Windows\System\NPTcyUD.exe
  C:\Windows\System\NPTcyUD.exe
  2⤵
  PID:15804
- C:\Windows\System\CQsbrLk.exe
  C:\Windows\System\CQsbrLk.exe
  2⤵
  PID:15828
- C:\Windows\System\zxTzKPl.exe
  C:\Windows\System\zxTzKPl.exe
  2⤵
  PID:15852
- C:\Windows\System\doRlotJ.exe
  C:\Windows\System\doRlotJ.exe
  2⤵
  PID:15880
- C:\Windows\System\AcwGIvv.exe
  C:\Windows\System\AcwGIvv.exe
  2⤵
  PID:15900
- C:\Windows\System\CcWmeUA.exe
  C:\Windows\System\CcWmeUA.exe
  2⤵
  PID:15924
- C:\Windows\System\hEnRYIi.exe
  C:\Windows\System\hEnRYIi.exe
  2⤵
  PID:15944
- C:\Windows\System\wBMJYmO.exe
  C:\Windows\System\wBMJYmO.exe
  2⤵
  PID:15960
- C:\Windows\System\KFpFoXF.exe
  C:\Windows\System\KFpFoXF.exe
  2⤵
  PID:15980
- C:\Windows\System\ApbLtGs.exe
  C:\Windows\System\ApbLtGs.exe
  2⤵
  PID:16004
- C:\Windows\System\QGRMmsy.exe
  C:\Windows\System\QGRMmsy.exe
  2⤵
  PID:16028
- C:\Windows\System\QkEDbcQ.exe
  C:\Windows\System\QkEDbcQ.exe
  2⤵
  PID:16044
- C:\Windows\System\KFrKMeC.exe
  C:\Windows\System\KFrKMeC.exe
  2⤵
  PID:16068
- C:\Windows\System\FnhbeGb.exe
  C:\Windows\System\FnhbeGb.exe
  2⤵
  PID:16088
- C:\Windows\System\XEgwhCf.exe
  C:\Windows\System\XEgwhCf.exe
  2⤵
  PID:7512
- C:\Windows\System\aTRkepO.exe
  C:\Windows\System\aTRkepO.exe
  2⤵
  PID:12268
- C:\Windows\System\Rcydixe.exe
  C:\Windows\System\Rcydixe.exe
  2⤵
  PID:12244
- C:\Windows\System\LvXdYPr.exe
  C:\Windows\System\LvXdYPr.exe
  2⤵
  PID:13412
- C:\Windows\System\moLbaLi.exe
  C:\Windows\System\moLbaLi.exe
  2⤵
  PID:8876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_refu2mrb.rgi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DFWlXXE.exe

Filesize
1.9MB

MD5
366d73c0c8ea5177a0bd34c110dc378d

SHA1
afe10f6690924554c153cc87abb3b82944fda992

SHA256
20644b086965077f4da761907cd7bd8a5582806a82a3da82fc0bac91bb96cd07

SHA512
bf045e734e21e5fc4427ac923f70bf7537e00de36fe471cee7489908f5e2e771822680cebee4329cda270e1e7676aebb159611f0c0566d670c01cb0530e2802c

Download Submit
C:\Windows\System\EBWJTcE.exe

Filesize
1.9MB

MD5
69c476a8ffa7dacd4270a864c8403b3a

SHA1
4338d28498d8b8e650d75c538128df28f93e7745

SHA256
225e9574a9f714b643441321d7f6fea9bbe40a5053a3a7a8af488182d8c6641f

SHA512
6842be681fd20390c498dac684e71066145de3fe33ead33972c3894bcc3773dcc8d6435a421d98c6b9521f3a202a6e9fab9acfba757ba3f99e31ff6f819b4f42

Download Submit
C:\Windows\System\ENhbcnc.exe

Filesize
1.9MB

MD5
3c48ad50064a808f72b77e26d3883acf

SHA1
0eacc4edcca60b11bc6b51d878702d5fea0296eb

SHA256
90c9aea5f20853178451308b528c96797c3a16df23332b29c4a75980bc32e40b

SHA512
4f9ec19147dc39097948230357cff870e558884ddffd8d6d2d4057a8be7069f0c388d80d6dc96d094a66b4f7d413e51882de9618b76e4ee2f3f88b1d3d63eba5

Download Submit
C:\Windows\System\GxaYpPy.exe

Filesize
1.9MB

MD5
2cd1b732d09d40711caa4ce5dd49577d

SHA1
a299e7dbe56a711a8cdb07b99f59ca4112be8a51

SHA256
d739d0c8d23e11c9f596c5f98f889ec98f67255d060c556c5fd950a60abb3b51

SHA512
9dda3a6a046e2710bcff81104a9e56346783de69abe6d0fe27288f07f63e9aefeed210e5fb242daf9548684f32dd501ae635e8f23ca13f1a9f9edfef92017fa1

Download Submit
C:\Windows\System\HtwpNBH.exe

Filesize
1.9MB

MD5
1e219fcfd2fcc4d3775215d8919175bc

SHA1
c4a596d4837592186f440097188b68ead2841d25

SHA256
086924481f8b24f89a0bc8259e281dafa69594bb682587ff4a364e66c59919b9

SHA512
275d9edfde13f6f2183fb94fc37a9813bd5b01e4a7435dc6dec4fd4836a1688effcf355802dec384a860f4e156f511e07ba6e39cab8308da8cdcf73ef89855f0

Download Submit
C:\Windows\System\JeTxDcy.exe

Filesize
1.9MB

MD5
fab29270a04f533a5a2dadbaed73170c

SHA1
39036cdfb21896779a7be6e7e809ca79d706859d

SHA256
eff57b748b3e5d634c6b50c60ec985c2a736a34c89c01c7902ff29af7b08778d

SHA512
54257c0bd7682f35f637f6ef1b36f4b53eaa6bd2404d53d1237bbf8d637fb2f89354f66697383e3a35d66eb82b2ff2ab65908ea93ddf9b1224764832bf03b734

Download Submit
C:\Windows\System\KtmTaeT.exe

Filesize
1.9MB

MD5
60c52736a93d608102e38249cdff7529

SHA1
390bb130351c6397bde892978af959be2750c41d

SHA256
5650014f72f57b563c7e805ffcbd96c358eda5dd53299f1806721ca1324a2b6d

SHA512
d221c7c0ff1876a705405f63d2b4b6c3ba89cf4d30461c183494f562d6aa31b848e183f206b15bac69ed7303280e675c1de93f7b58b7c9f432ccd87dfcd459f4

Download Submit
C:\Windows\System\QOubyaH.exe

Filesize
1.9MB

MD5
2080ce8103038bd1a409b70790e2aaa6

SHA1
e47adc506073a0c18c3daf7f88675a44188f598f

SHA256
6a313b6b323d702433fcc9a6c9afaa51f78b52a7d8aaddb7fb1ba9c38378ef40

SHA512
dcb01f99e11aebb8c96f7904b3bb31c97ea6966e9e2f37750ab2231af8dfb26ced154c96bb1992ea9dca4506ff5f63d4cb7fc75aa6e77ccfadbcd9d93b59a832

Download Submit
C:\Windows\System\RXuovdL.exe

Filesize
1.9MB

MD5
ee1607f982b39325cb2e7cc051234f57

SHA1
25879e823c6d331b5535f30c2e0320d594b1e779

SHA256
7dcf513540fc88d434dbef5d6a4b33257a4354c18e73b734ca7f5e17bf3a1c5e

SHA512
9a4ba4885e1c6d648792452d544d702cdd916a38b736fc5b6185e7ce60c2ef924d4a0287ee3f2c0a28e8e23f8d3872d48a25442c5f5d1670e93bdc17f1c42022

Download Submit
C:\Windows\System\RenTikb.exe

Filesize
1.9MB

MD5
ed4ba5f32e4f6032206fec2109bef48f

SHA1
6e26feb5ca30b2f312e2e64c72551b078905f537

SHA256
875e3b9ee797616835bc21ced45233b0baa674a4fca61a9d96fdf09cf8648226

SHA512
9740d2f56ceddd37c8fc9986cc03d9053dfcb9247c999598b60763a70d0f9e0ae86f193a30170ba8880bbe2be60de895ad96c9358644e4558b8f87d690ab5187

Download Submit
C:\Windows\System\SFvDkIw.exe

Filesize
1.9MB

MD5
06683766fad57bfbf0b5043a26f7ae50

SHA1
e9d1871935f2b6a0696561ae5760e91665026ba5

SHA256
d4ccd39ea056420086fdd22de78f84669a39cad5fc2bb90ab90adae9a7228138

SHA512
db35cb40861da0c138b6a023524999175c8ea572dd4383d1568e467d5dec02ff69f4f169307a821d03f2ed284878b4a2e8b07871870b5a8d6316f53530962d74

Download Submit
C:\Windows\System\SuMrdqU.exe

Filesize
1.9MB

MD5
9b43b33d9e2e5b48781f58ec4b00ad6b

SHA1
de060b9b575c43fe9a328c77fd218d8ef8c39a9b

SHA256
0be3a5fd2e370ba724c17705445e04a8f464a17b9a0d512b06584a33f260d8ce

SHA512
3e4025041d40035a95649043491a61fde3e5a1a27a18b4390829a5c8e27bb0d58f82df182889d7beeaca7bac73c2c84d1f1a86932b3982e9be2ee2179106bfe4

Download Submit
C:\Windows\System\TcWVqHG.exe

Filesize
1.9MB

MD5
11d4c11e3efd9e9b7f8e11deb0078862

SHA1
13070aefbce2809f6f024bbb800b158bda11ea75

SHA256
609de2d6b89debb09ba716ce9d86ee7744c9941cdc17cfdcdddba5e0cb8c5936

SHA512
b9a9b1527cd01ffab680886065ce1f0d3cc26f89f7ed658700d0cb462dd92a4352781fb0af5d6a5340900042b9e3a271f9a4d96577f13d24c1f7060734e2c8d1

Download Submit
C:\Windows\System\UeKFDwF.exe

Filesize
1.9MB

MD5
0be2b5b1440ec4a3641e7f16e492704f

SHA1
100089252efc7c7549c5b92b1cb35344a37f271b

SHA256
0b06e70022ea567bf41cb6f315064789b8ef825cd89baa411e308ba6e1627a0f

SHA512
f1590161e39cd994f858bc2c9cc11bd9d98c36d8b6076684f50e2e5d614a22f9fe5afdc464bf8590b3b510e008a83ae811a526c1f14237a702846708fcd41dc2

Download Submit
C:\Windows\System\VvTXdSS.exe

Filesize
1.9MB

MD5
9575aaac41a4cbf5b3efbf10951e1423

SHA1
02fb2c2be70734035587ed952ab42e07c1ffaaae

SHA256
0e810c41f7ef70eb1b110d9a9d65e7fe94709492386eb53a9169157200598b06

SHA512
3ca0f443b094b92b4832798427601c42a63e5249e09efbbf8384786d6edffd0ac9280c8d2113fd3c3973faba7dfccbcff7cef030c72333fab0f715d4163a9c96

Download Submit
C:\Windows\System\XfismQp.exe

Filesize
1.9MB

MD5
02523e11d1448f8abe65614847d2731d

SHA1
135474be50c59c08cc1b3de07d5bc5c74dc4323d

SHA256
8c46f1c8a1c270b11b160af356ec11854431f248abd415e9bcf16373448abab5

SHA512
06f296079a691672a74a22e23bbc7e8e871054d6c8af912b7b46576c9bad2e45cdd910860035d2bee685a7441c1fdbb80e478f79f5841346bc78fb3598cf2fed

Download Submit
C:\Windows\System\ahExZvs.exe

Filesize
1.9MB

MD5
5d03d22a08320311f6e40fb915e51f54

SHA1
65f9a2060beb93894abf1cea33aa402643f8eca5

SHA256
ac79416beb25d86fa3e6cd5b19b3b85effec93416bd3351751eab714d88b6449

SHA512
e295f93c09cdd8178f1b1204884d8757d74a587c0428a53fb9068307d76f1f08870d2e1c524eeaecad533e949be2102747eb3ad88ea3d25fc51a09831ef8c843

Download Submit
C:\Windows\System\fZYInsD.exe

Filesize
1.9MB

MD5
6fa8d76ef800cc98888a5440a9739376

SHA1
a5c5f84be53bd0f93334c5e672cd4f4c4c2ddc04

SHA256
0da81ab50103bbaf29fec7292f7de72fbb284ca6d5aacb3166853fad738c0927

SHA512
e63891f3e815b19868001c76c33ee53a8fb73a85f8c7f3912b8a838607a0213f84103d5702405dbec39476a5d27343d33a61c437715f2438db5bd1b6ed940cdf

Download Submit
C:\Windows\System\irZqyMh.exe

Filesize
1.9MB

MD5
412b395c08240ac000524549eb0176a5

SHA1
d0606a6231b9b39c4be40e3e0cb171b7408d42a4

SHA256
f4f08e1709070493c6c5050d278eb343c5c4657dd99c432c59214a8d4804b739

SHA512
edc11f8ba65ada4819202c815d1be6bd41cfb21d6e84b81304f14b19cffca55d877788738d1f9b140728c1ed85edec47be6767ffdf1bf01e1ac4196756c68d8e

Download Submit
C:\Windows\System\jfoeWth.exe

Filesize
1.9MB

MD5
ce560b4b444822239d8e77cae32993e8

SHA1
2ea66f6ad985d7cd25be0ea868e06b1f2a97a4f9

SHA256
2d91de3ae6c71f98ef32e79cdf225b1510acdf06f3a6bdb44451a20434718c7c

SHA512
4a85ac43cb9cf18c62376dc1f677a1168c8ae23816e79228ed86b8ac7dc919536b21acb47abbec6612dcb5125ae85625429f8718142c4221a6599491049b087d

Download Submit
C:\Windows\System\mLfIeas.exe

Filesize
1.9MB

MD5
d12081a110abcfb1243d24e619d3c40b

SHA1
a5cdcbdabf5865b00f87a3d3be99c2f19c054e1b

SHA256
a65bb9586b02aaecc8665354874a7e0a24b4158f343b518541426464c1e2bd30

SHA512
a2ba5a638cb1cebb058140f0d5ac84ca05f51a66113c4864c84bf03d8ab4d75682b8228d6e2df589cc218bd39d309c284c96cc11414d3197d323d5dde75ee936

Download Submit
C:\Windows\System\piGOLjQ.exe

Filesize
1.9MB

MD5
4749e2c4391c3b6db228a6e097a31d91

SHA1
73b3c241f2c6e8212eebf86f504d32374d04a7d1

SHA256
8b5fcd20fcd32603cb6b1eb172c53c3b96f4874501c034558d404d93ddbbd190

SHA512
0b9fc8c899b62eb9b256a8b9b5db3526ab0c916ca186879051484d2cfc552a4c659b84037b77867b4d70e7525009b7a1edca3664e5aba5d5d833d3262a67baee

Download Submit
C:\Windows\System\qPxbKcy.exe

Filesize
1.9MB

MD5
4259d2b7714fa8cfaa1b8a4400650d1f

SHA1
43c0add90af7638f70100668ff3cab77f6bf0d6e

SHA256
32cc4aca70ba0493321e5ad56d1e7643fefa8436a35341d08385614d386b697b

SHA512
0b615bed530841b6c046bc82f07133e9737b296ae3869ab7c09a15c162578a9c4f69cfb2e933f128048f247f0ac886e4817199d689e341afbed55b2ddcd504de

Download Submit
C:\Windows\System\rNYhZft.exe

Filesize
1.9MB

MD5
37f81c3cc6541784b5da7a490ac174ca

SHA1
0ef9f6c9cf63d53fd09f360bc34de896852493cf

SHA256
2c599680106b54c042678f80088c248cf21deac472eff8a35689e8fee012de89

SHA512
2651d26d820148618a3314f11bff462e30faaa78d9bef224c2d06f1113fb16d51658b7d7a2bc05d91f85feae1363149d96519de1489bd77e700c32716836cb18

Download Submit
C:\Windows\System\sEaeGaB.exe

Filesize
1.9MB

MD5
1da3c9da2bc4dde671303689cc39311c

SHA1
e28c5e1f323ff9e1a3d76adac0b62177bb053925

SHA256
3f045e1307e5881d939a04fcb1a69fdf025222f68427d44f3623f5af34ce4021

SHA512
cd17a13d38db5d039938ba2c334ccfdb1aa17f6a9e50448a9270e8338bbaa69c87934b941602c9d5db21120c42911d025e99f6b508b6e9b23fcc5d556328a5a2

Download Submit
C:\Windows\System\sIeowUp.exe

Filesize
1.9MB

MD5
8fac43467b5ab7a2a910d08a1e052d23

SHA1
67e633cabdb6a69a9e78279c475fc2911cd97653

SHA256
fa01d6efa8001cf30ea70a9a91086b58caff4f5064b182b414401fbe142ce414

SHA512
b8304b81cab7512b68693032d159958f3eb4713b7a9795ea947005ce8697ccebb2a07b9b169f87e85073ea796c4510ee29e78dfa0970015e2ec22bdc9a35d911

Download Submit
C:\Windows\System\sUXRKwW.exe

Filesize
1.9MB

MD5
3e72636b78ca3bbfac2a28fbbbd9203b

SHA1
7e8996a21e88fbbfffa8d39609eea72e7e26984b

SHA256
d509c55f1b3a0d0661a6debfcf9b7b45b50e1ef078479dce2557e23085a0fefa

SHA512
4b591ec10a95aa9a705034f2b58671e40bc564fef601ca04595c1c38a462a94b8d1d71bee043357d8aa7e67a36096d46a75e81a6a874612830cfbafd797679f6

Download Submit
C:\Windows\System\ugiMluv.exe

Filesize
1.9MB

MD5
dade3ebdd16e6590473778ad3244c7c6

SHA1
9cecfb7a600b3eb131157728009cec2cecf61b90

SHA256
fd6487dc8f51c5bcee4db09e01246f89408eafc3fd0fbee8bf41ccf501d7dab6

SHA512
c0a0b10c326d63dab8278bbd573f79a1275c0b841cef836c0d995682061e677f20db873ace378d19fef643a76194c0a330656a4daa971dffa9ee33fc0010457c

Download Submit
C:\Windows\System\vNAbTtf.exe

Filesize
1.9MB

MD5
80c33d7d100bef7d6906ed901a29b008

SHA1
68dcbffaeaae7d9002cae54fc8d94c4b055964d0

SHA256
46717592671451e5b86865c2b6dce9ab3a298ab2d2a6e5b42b049aa0a0adc15b

SHA512
5aa059be4041479186c28bb44d555a1eac848c1dd2e5ece90da40b177fd5fe88bf240d4df1ab646ad21287e1315138882a74cc3a0cf0fdea0dd14bb162621408

Download Submit
C:\Windows\System\wJhOGpJ.exe

Filesize
1.9MB

MD5
bfaaaa0d0584b1d58de200e049923be0

SHA1
07457f48b3f272576d250665e82246259ba3d747

SHA256
fb900188cf9fee80d2ad85e4efa75f6f35f3a2ba605f229613a87c996cb59923

SHA512
e1e56529cba3eed4427b8c47fec1ac8b28f415489a92539d1d7c1e0df3dcd5e2ab635b46d5a29cb06adec68d20f9b0dfaf9768d19125fb2db0a3cce8db90a60d

Download Submit
C:\Windows\System\xTVtCvG.exe

Filesize
1.9MB

MD5
ec1a88d9c1d17e8e61f179b79d158c8f

SHA1
5d2a8ffbb22f331521ebcf4d20cc82199e99f151

SHA256
8abd8cbd28e0f4b4e5d2231605a8cc7112b194b59c2315205dc1b61c7d0956b0

SHA512
24fe467a695d011ac09509af01b6d8b454a053d104ef8b0cf74917648567d4ac747357433782a9e5c0eb7e17a9679131bf0e48b7fc87f06ae0269e3322e1c1a8

Download Submit
C:\Windows\System\zGsNXKC.exe

Filesize
1.9MB

MD5
1bd21adb935b9c7a298cef85be3863e6

SHA1
da526cb806be77b20c17a4f28592d884194bfc44

SHA256
1f84a3d08091c047fa59a07f9f6d2943a111cbc72e5c47a7a4371cd85e692406

SHA512
7f27ac4321feaf6fe8448612d2b5b3a7e7bb2191b353f7f8f9edf5a994ffe380daa94880afa2c049c6d090d89c7f9c6cc42788b0a750a7efe70006e65de62515

Download Submit
C:\Windows\System\zROSvRX.exe

Filesize
1.9MB

MD5
d7b2754c25416b4bc3b7379707c35894

SHA1
65b872a6191f759f4109d91badf7ccccda4b57d2

SHA256
77821964d24ffce71789bba6460032e4a1be1ef67fbc2b082ec6dbd4167ef3e6

SHA512
72e39541e5db54ee085c7f7f281e3bed11c6173d90e0a5eab8e57437afcc23788dc670f2d5524ae8b087c9b86191730266b7bdddc9efc7a25275ca5999cf980d

Download Submit
memory/228-63-0x00007FF7BCB00000-0x00007FF7BCEF2000-memory.dmp

Filesize
3.9MB

Download
memory/228-1954-0x00007FF7BCB00000-0x00007FF7BCEF2000-memory.dmp

Filesize
3.9MB

Download
memory/940-1973-0x00007FF66F560000-0x00007FF66F952000-memory.dmp

Filesize
3.9MB

Download
memory/940-72-0x00007FF66F560000-0x00007FF66F952000-memory.dmp

Filesize
3.9MB

Download
memory/948-1673-0x00007FF6BAAB0000-0x00007FF6BAEA2000-memory.dmp

Filesize
3.9MB

Download
memory/948-1950-0x00007FF6BAAB0000-0x00007FF6BAEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1004-1937-0x00007FF75BC30000-0x00007FF75C022000-memory.dmp

Filesize
3.9MB

Download
memory/1004-1292-0x00007FF75BC30000-0x00007FF75C022000-memory.dmp

Filesize
3.9MB

Download
memory/1076-1958-0x00007FF619510000-0x00007FF619902000-memory.dmp

Filesize
3.9MB

Download
memory/1076-1251-0x00007FF619510000-0x00007FF619902000-memory.dmp

Filesize
3.9MB

Download
memory/1284-1729-0x00007FF6452E0000-0x00007FF6456D2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-1979-0x00007FF6452E0000-0x00007FF6456D2000-memory.dmp

Filesize
3.9MB

Download
memory/1472-1665-0x00007FF7DA4A0000-0x00007FF7DA892000-memory.dmp

Filesize
3.9MB

Download
memory/1472-1953-0x00007FF7DA4A0000-0x00007FF7DA892000-memory.dmp

Filesize
3.9MB

Download
memory/1980-1702-0x00007FF79A300000-0x00007FF79A6F2000-memory.dmp

Filesize
3.9MB

Download
memory/1980-1949-0x00007FF79A300000-0x00007FF79A6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-52-0x00007FF66E600000-0x00007FF66E9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-1952-0x00007FF66E600000-0x00007FF66E9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-1974-0x00007FF672EE0000-0x00007FF6732D2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-1769-0x00007FF672EE0000-0x00007FF6732D2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-1972-0x00007FF7BDB90000-0x00007FF7BDF82000-memory.dmp

Filesize
3.9MB

Download
memory/2504-1733-0x00007FF7BDB90000-0x00007FF7BDF82000-memory.dmp

Filesize
3.9MB

Download
memory/2792-1355-0x00007FF770AE0000-0x00007FF770ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-1951-0x00007FF770AE0000-0x00007FF770ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-58-0x00007FF70DB40000-0x00007FF70DF32000-memory.dmp

Filesize
3.9MB

Download
memory/2860-1980-0x00007FF70DB40000-0x00007FF70DF32000-memory.dmp

Filesize
3.9MB

Download
memory/3444-66-0x00007FF6664B0000-0x00007FF6668A2000-memory.dmp

Filesize
3.9MB

Download
memory/3660-1206-0x00007FF6C3CF0000-0x00007FF6C40E2000-memory.dmp

Filesize
3.9MB

Download
memory/3660-1955-0x00007FF6C3CF0000-0x00007FF6C40E2000-memory.dmp

Filesize
3.9MB

Download
memory/3684-1722-0x00007FF7BB940000-0x00007FF7BBD32000-memory.dmp

Filesize
3.9MB

Download
memory/3684-1948-0x00007FF7BB940000-0x00007FF7BBD32000-memory.dmp

Filesize
3.9MB

Download
memory/3852-1962-0x00007FF74E310000-0x00007FF74E702000-memory.dmp

Filesize
3.9MB

Download
memory/3852-1692-0x00007FF74E310000-0x00007FF74E702000-memory.dmp

Filesize
3.9MB

Download
memory/4376-281-0x000001B1621C0000-0x000001B162966000-memory.dmp

Filesize
7.6MB

Download
memory/4376-39-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmp

Filesize
10.8MB

Download
memory/4376-46-0x000001B160B50000-0x000001B160B60000-memory.dmp

Filesize
64KB

Download
memory/4376-41-0x000001B160B50000-0x000001B160B60000-memory.dmp

Filesize
64KB

Download
memory/4376-12-0x000001B160B10000-0x000001B160B32000-memory.dmp

Filesize
136KB

Download
memory/4656-1934-0x00007FF723890000-0x00007FF723C82000-memory.dmp

Filesize
3.9MB

Download
memory/4656-1750-0x00007FF723890000-0x00007FF723C82000-memory.dmp

Filesize
3.9MB

Download
memory/4832-1965-0x00007FF78DAE0000-0x00007FF78DED2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-45-0x00007FF78DAE0000-0x00007FF78DED2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-0-0x00007FF6C8AE0000-0x00007FF6C8ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-1-0x0000027D7D4F0000-0x0000027D7D500000-memory.dmp

Filesize
64KB

Download
memory/5072-1880-0x00007FF621A30000-0x00007FF621E22000-memory.dmp

Filesize
3.9MB

Download
memory/5072-61-0x00007FF621A30000-0x00007FF621E22000-memory.dmp

Filesize
3.9MB

Download
memory/5108-79-0x00007FF7081C0000-0x00007FF7085B2000-memory.dmp

Filesize
3.9MB

Download
memory/5108-1959-0x00007FF7081C0000-0x00007FF7085B2000-memory.dmp

Filesize
3.9MB

Download