xmrig | 457937d4693c6185db52de9d60c08163792241ff130d344037e9deb7fe6a10c6

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
Size

2.2MB
MD5

0c4dd5acce8af0c0304c7997ca7efb3a
SHA1

13188a9b5df84552d5379e5323d7f2b8cf27de2e
SHA256

457937d4693c6185db52de9d60c08163792241ff130d344037e9deb7fe6a10c6
SHA512

31367e06b93c9c33341fad075e99db91794882b5bcd07025042c5f22bf0f7ca123b8b08cfed1bc641cf4684bd1a3727e81aeeae900991e04b12ca0e415bd69df
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr8+Phm:NABh

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1576-21-0x00007FF624670000-0x00007FF624A62000-memory.dmp	xmrig
behavioral2/memory/3852-53-0x00007FF68BA70000-0x00007FF68BE62000-memory.dmp	xmrig
behavioral2/memory/1224-54-0x00007FF627400000-0x00007FF6277F2000-memory.dmp	xmrig
behavioral2/memory/3216-55-0x00007FF6F5FE0000-0x00007FF6F63D2000-memory.dmp	xmrig
behavioral2/memory/3132-62-0x00007FF77ACD0000-0x00007FF77B0C2000-memory.dmp	xmrig
behavioral2/memory/3352-105-0x00007FF7CB700000-0x00007FF7CBAF2000-memory.dmp	xmrig
behavioral2/memory/1372-106-0x00007FF650F60000-0x00007FF651352000-memory.dmp	xmrig
behavioral2/memory/1736-100-0x00007FF634CB0000-0x00007FF6350A2000-memory.dmp	xmrig
behavioral2/memory/3352-219-0x00007FF7CB700000-0x00007FF7CBAF2000-memory.dmp	xmrig
behavioral2/memory/716-221-0x00007FF7FCE30000-0x00007FF7FD222000-memory.dmp	xmrig
behavioral2/memory/4608-220-0x00007FF648380000-0x00007FF648772000-memory.dmp	xmrig
behavioral2/memory/1576-229-0x00007FF624670000-0x00007FF624A62000-memory.dmp	xmrig
behavioral2/memory/2828-234-0x00007FF7D2D40000-0x00007FF7D3132000-memory.dmp	xmrig
behavioral2/memory/1060-240-0x00007FF7DCE90000-0x00007FF7DD282000-memory.dmp	xmrig
behavioral2/memory/2320-243-0x00007FF717A10000-0x00007FF717E02000-memory.dmp	xmrig
behavioral2/memory/3284-246-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp	xmrig
behavioral2/memory/2348-247-0x00007FF7B8BB0000-0x00007FF7B8FA2000-memory.dmp	xmrig
behavioral2/memory/2028-245-0x00007FF77E550000-0x00007FF77E942000-memory.dmp	xmrig
behavioral2/memory/4988-244-0x00007FF68B650000-0x00007FF68BA42000-memory.dmp	xmrig
behavioral2/memory/4560-239-0x00007FF7CD880000-0x00007FF7CDC72000-memory.dmp	xmrig
behavioral2/memory/4568-236-0x00007FF7ABF80000-0x00007FF7AC372000-memory.dmp	xmrig
behavioral2/memory/1184-235-0x00007FF604CB0000-0x00007FF6050A2000-memory.dmp	xmrig
behavioral2/memory/1576-1693-0x00007FF624670000-0x00007FF624A62000-memory.dmp	xmrig
behavioral2/memory/1224-1729-0x00007FF627400000-0x00007FF6277F2000-memory.dmp	xmrig
behavioral2/memory/3216-1755-0x00007FF6F5FE0000-0x00007FF6F63D2000-memory.dmp	xmrig
behavioral2/memory/3852-1752-0x00007FF68BA70000-0x00007FF68BE62000-memory.dmp	xmrig
behavioral2/memory/4608-1709-0x00007FF648380000-0x00007FF648772000-memory.dmp	xmrig
behavioral2/memory/716-1668-0x00007FF7FCE30000-0x00007FF7FD222000-memory.dmp	xmrig
behavioral2/memory/3132-1683-0x00007FF77ACD0000-0x00007FF77B0C2000-memory.dmp	xmrig
behavioral2/memory/1636-1934-0x00007FF62F8E0000-0x00007FF62FCD2000-memory.dmp	xmrig
behavioral2/memory/4932-1947-0x00007FF6215A0000-0x00007FF621992000-memory.dmp	xmrig
behavioral2/memory/2320-1955-0x00007FF717A10000-0x00007FF717E02000-memory.dmp	xmrig
behavioral2/memory/2028-2031-0x00007FF77E550000-0x00007FF77E942000-memory.dmp	xmrig
behavioral2/memory/3284-2037-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp	xmrig
behavioral2/memory/4988-1996-0x00007FF68B650000-0x00007FF68BA42000-memory.dmp	xmrig
behavioral2/memory/4560-1951-0x00007FF7CD880000-0x00007FF7CDC72000-memory.dmp	xmrig
behavioral2/memory/1060-1950-0x00007FF7DCE90000-0x00007FF7DD282000-memory.dmp	xmrig
behavioral2/memory/1184-1946-0x00007FF604CB0000-0x00007FF6050A2000-memory.dmp	xmrig
behavioral2/memory/1700-1943-0x00007FF608300000-0x00007FF6086F2000-memory.dmp	xmrig
behavioral2/memory/2672-1941-0x00007FF783FB0000-0x00007FF7843A2000-memory.dmp	xmrig
behavioral2/memory/1372-1937-0x00007FF650F60000-0x00007FF651352000-memory.dmp	xmrig
behavioral2/memory/4652-1924-0x00007FF767B90000-0x00007FF767F82000-memory.dmp	xmrig
behavioral2/memory/2348-2203-0x00007FF7B8BB0000-0x00007FF7B8FA2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2244	powershell.exe
6	2244	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4608	KlYfFNx.exe
716	iDmnQGC.exe
1576	BgXJQQO.exe
3132	FtCGzOC.exe
3852	FBZVOdt.exe
1224	RjfHDYH.exe
3216	shPIWse.exe
2828	YVFnCez.exe
1636	jZzfGQj.exe
4652	BdsrUQq.exe
4932	FzIouSO.exe
2672	ItUkIqY.exe
1736	QufAZWN.exe
1700	TcjRdID.exe
1372	irueiOQ.exe
1184	LfAfkNH.exe
4568	vXAKOUG.exe
4560	GvFLpjU.exe
1060	VaIuezJ.exe
2320	GLnCGwN.exe
4988	kuEMaNO.exe
2028	qflRJfW.exe
3284	oekerpJ.exe
2348	AjRWISj.exe
4472	DwhsdIa.exe
2356	LFNsMMT.exe
2520	AMQvptW.exe
312	nzHNUhS.exe
3464	eFfROHG.exe
4208	cgxUCCd.exe
3692	EjuCjso.exe
980	KFogsBh.exe
3904	UdTuZfN.exe
1804	zGdtnWr.exe
2292	yeWPLjY.exe
4864	zTgqglR.exe
3804	feknxVQ.exe
5116	LgeaEFf.exe
3024	ZAvhDPh.exe
1912	NJiJfFw.exe
2524	BuOotAL.exe
3260	VCwkjTq.exe
4420	bVTxzrm.exe
1536	hdXUWCf.exe
4996	ZDazUXa.exe
2316	cKjpniX.exe
2156	OpaDYbx.exe
4636	GifisPv.exe
4836	kqxukBk.exe
3704	clrfAMH.exe
4176	IbWuZXy.exe
3328	BMxBFfH.exe
4140	dOPIfNc.exe
1272	oqdKncc.exe
4664	evFOFHZ.exe
3732	aitONyy.exe
1456	FRrCXiQ.exe
4308	wNXKDqd.exe
4564	MNWsnVW.exe
3308	DUsFcaY.exe
1144	zAZjoFG.exe
3020	yzhBEhY.exe
1376	GKLiXzw.exe
2712	veOMFgh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3352-0-0x00007FF7CB700000-0x00007FF7CBAF2000-memory.dmp	upx
behavioral2/files/0x0008000000023269-5.dat	upx
behavioral2/memory/4608-8-0x00007FF648380000-0x00007FF648772000-memory.dmp	upx
behavioral2/files/0x000800000002326c-13.dat	upx
behavioral2/files/0x000700000002326f-10.dat	upx
behavioral2/memory/1576-21-0x00007FF624670000-0x00007FF624A62000-memory.dmp	upx
behavioral2/memory/716-17-0x00007FF7FCE30000-0x00007FF7FD222000-memory.dmp	upx
behavioral2/files/0x0007000000023270-25.dat	upx
behavioral2/files/0x0007000000023271-38.dat	upx
behavioral2/files/0x000900000002326d-43.dat	upx
behavioral2/files/0x0008000000023272-50.dat	upx
behavioral2/memory/3852-53-0x00007FF68BA70000-0x00007FF68BE62000-memory.dmp	upx
behavioral2/memory/1224-54-0x00007FF627400000-0x00007FF6277F2000-memory.dmp	upx
behavioral2/memory/3216-55-0x00007FF6F5FE0000-0x00007FF6F63D2000-memory.dmp	upx
behavioral2/files/0x0007000000023273-59.dat	upx
behavioral2/files/0x0007000000023277-73.dat	upx
behavioral2/files/0x0007000000023276-72.dat	upx
behavioral2/memory/2828-76-0x00007FF7D2D40000-0x00007FF7D3132000-memory.dmp	upx
behavioral2/memory/1636-77-0x00007FF62F8E0000-0x00007FF62FCD2000-memory.dmp	upx
behavioral2/memory/4652-78-0x00007FF767B90000-0x00007FF767F82000-memory.dmp	upx
behavioral2/memory/2672-75-0x00007FF783FB0000-0x00007FF7843A2000-memory.dmp	upx
behavioral2/memory/4932-74-0x00007FF6215A0000-0x00007FF621992000-memory.dmp	upx
behavioral2/files/0x0007000000023275-69.dat	upx
behavioral2/files/0x0007000000023274-63.dat	upx
behavioral2/memory/3132-62-0x00007FF77ACD0000-0x00007FF77B0C2000-memory.dmp	upx
behavioral2/files/0x0007000000023279-92.dat	upx
behavioral2/files/0x000700000002327a-97.dat	upx
behavioral2/files/0x0007000000023278-101.dat	upx
behavioral2/memory/1700-103-0x00007FF608300000-0x00007FF6086F2000-memory.dmp	upx
behavioral2/memory/3352-105-0x00007FF7CB700000-0x00007FF7CBAF2000-memory.dmp	upx
behavioral2/memory/1372-106-0x00007FF650F60000-0x00007FF651352000-memory.dmp	upx
behavioral2/memory/1736-100-0x00007FF634CB0000-0x00007FF6350A2000-memory.dmp	upx
behavioral2/files/0x000700000002327c-115.dat	upx
behavioral2/files/0x000700000002327e-125.dat	upx
behavioral2/files/0x000700000002327f-129.dat	upx
behavioral2/files/0x000700000002327d-120.dat	upx
behavioral2/files/0x0007000000023280-135.dat	upx
behavioral2/files/0x0007000000023281-140.dat	upx
behavioral2/files/0x0007000000023282-145.dat	upx
behavioral2/files/0x0007000000023283-149.dat	upx
behavioral2/files/0x0007000000023284-158.dat	upx
behavioral2/files/0x0007000000023286-165.dat	upx
behavioral2/files/0x0007000000023288-175.dat	upx
behavioral2/files/0x0007000000023289-181.dat	upx
behavioral2/files/0x000700000002328a-185.dat	upx
behavioral2/files/0x000700000002328b-190.dat	upx
behavioral2/memory/3352-219-0x00007FF7CB700000-0x00007FF7CBAF2000-memory.dmp	upx
behavioral2/memory/716-221-0x00007FF7FCE30000-0x00007FF7FD222000-memory.dmp	upx
behavioral2/memory/4608-220-0x00007FF648380000-0x00007FF648772000-memory.dmp	upx
behavioral2/memory/1576-229-0x00007FF624670000-0x00007FF624A62000-memory.dmp	upx
behavioral2/memory/2828-234-0x00007FF7D2D40000-0x00007FF7D3132000-memory.dmp	upx
behavioral2/memory/1060-240-0x00007FF7DCE90000-0x00007FF7DD282000-memory.dmp	upx
behavioral2/memory/2320-243-0x00007FF717A10000-0x00007FF717E02000-memory.dmp	upx
behavioral2/memory/3284-246-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp	upx
behavioral2/memory/2348-247-0x00007FF7B8BB0000-0x00007FF7B8FA2000-memory.dmp	upx
behavioral2/memory/2028-245-0x00007FF77E550000-0x00007FF77E942000-memory.dmp	upx
behavioral2/memory/4988-244-0x00007FF68B650000-0x00007FF68BA42000-memory.dmp	upx
behavioral2/memory/4560-239-0x00007FF7CD880000-0x00007FF7CDC72000-memory.dmp	upx
behavioral2/memory/4568-236-0x00007FF7ABF80000-0x00007FF7AC372000-memory.dmp	upx
behavioral2/memory/1184-235-0x00007FF604CB0000-0x00007FF6050A2000-memory.dmp	upx
behavioral2/files/0x0007000000023287-173.dat	upx
behavioral2/files/0x0007000000023285-160.dat	upx
behavioral2/files/0x000700000002327b-110.dat	upx
behavioral2/memory/1576-1693-0x00007FF624670000-0x00007FF624A62000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EJoOzgX.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ZTHjIVY.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\Zxcchbq.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\nzHNUhS.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\cgxUCCd.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\GSmyIee.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\VldRKkG.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\eSZgVbv.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\TYEVHcI.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\yzhBEhY.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\SObAqji.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\NanprYF.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ChGZSya.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\MCGuhjV.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\wCegXVI.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\mddScfr.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\xVrBKew.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\BaMmHpf.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\IcPMaAo.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\qxRlJnM.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\HSBfehq.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\IjGofSs.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\vcXUzRk.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\bHLuGbF.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\syByMEj.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\bGYiJgP.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\HdgngiC.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\JmOsQqU.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\OtawQkf.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ERVYGkA.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\UILxhXI.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\FAIdEeM.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\YVFnCez.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\OuCfKTM.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\nXGbYts.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\CsqUuuF.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\tpRDTMy.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\jDfINEp.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\cluPxku.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\yansekZ.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\FBZVOdt.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\jXbtGml.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\KjJcdZJ.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\YuVoQEY.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\HwffzhZ.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\VaIuezJ.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\LKrswMX.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\kvQcgBz.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\YeYetji.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\pPAHHfM.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\PadNoVm.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\xYTozjU.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\InCmmww.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\IbWuZXy.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\DlCEOxn.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\jCBeigP.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\bFeaeiL.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\awYsFfF.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\qnLiNxk.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\bQBrnzw.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\rrjhaLj.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\mRLUTRU.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\dOPIfNc.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\YLyjxLz.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2244	powershell.exe
2244	powershell.exe
2244	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeLockMemoryPrivilege	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2244	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	92
PID 3352 wrote to memory of 2244	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	92
PID 3352 wrote to memory of 4608	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	93
PID 3352 wrote to memory of 4608	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	93
PID 3352 wrote to memory of 716	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	94
PID 3352 wrote to memory of 716	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	94
PID 3352 wrote to memory of 1576	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	95
PID 3352 wrote to memory of 1576	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	95
PID 3352 wrote to memory of 3132	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	96
PID 3352 wrote to memory of 3132	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	96
PID 3352 wrote to memory of 3852	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	97
PID 3352 wrote to memory of 3852	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	97
PID 3352 wrote to memory of 1224	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	98
PID 3352 wrote to memory of 1224	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	98
PID 3352 wrote to memory of 3216	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	99
PID 3352 wrote to memory of 3216	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	99
PID 3352 wrote to memory of 2828	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	100
PID 3352 wrote to memory of 2828	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	100
PID 3352 wrote to memory of 1636	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	101
PID 3352 wrote to memory of 1636	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	101
PID 3352 wrote to memory of 4652	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	102
PID 3352 wrote to memory of 4652	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	102
PID 3352 wrote to memory of 4932	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	103
PID 3352 wrote to memory of 4932	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	103
PID 3352 wrote to memory of 2672	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	104
PID 3352 wrote to memory of 2672	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	104
PID 3352 wrote to memory of 1372	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	105
PID 3352 wrote to memory of 1372	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	105
PID 3352 wrote to memory of 1736	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	106
PID 3352 wrote to memory of 1736	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	106
PID 3352 wrote to memory of 1700	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	107
PID 3352 wrote to memory of 1700	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	107
PID 3352 wrote to memory of 1184	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	108
PID 3352 wrote to memory of 1184	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	108
PID 3352 wrote to memory of 4568	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	109
PID 3352 wrote to memory of 4568	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	109
PID 3352 wrote to memory of 4560	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	110
PID 3352 wrote to memory of 4560	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	110
PID 3352 wrote to memory of 1060	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	111
PID 3352 wrote to memory of 1060	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	111
PID 3352 wrote to memory of 2320	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	112
PID 3352 wrote to memory of 2320	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	112
PID 3352 wrote to memory of 4988	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	113
PID 3352 wrote to memory of 4988	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	113
PID 3352 wrote to memory of 2028	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	114
PID 3352 wrote to memory of 2028	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	114
PID 3352 wrote to memory of 3284	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	115
PID 3352 wrote to memory of 3284	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	115
PID 3352 wrote to memory of 2348	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	116
PID 3352 wrote to memory of 2348	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	116
PID 3352 wrote to memory of 4472	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	117
PID 3352 wrote to memory of 4472	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	117
PID 3352 wrote to memory of 2356	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	118
PID 3352 wrote to memory of 2356	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	118
PID 3352 wrote to memory of 2520	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	119
PID 3352 wrote to memory of 2520	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	119
PID 3352 wrote to memory of 312	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	120
PID 3352 wrote to memory of 312	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	120
PID 3352 wrote to memory of 3464	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	121
PID 3352 wrote to memory of 3464	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	121
PID 3352 wrote to memory of 4208	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	122
PID 3352 wrote to memory of 4208	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	122
PID 3352 wrote to memory of 3692	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	123
PID 3352 wrote to memory of 3692	3352	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\System\KlYfFNx.exe
  C:\Windows\System\KlYfFNx.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\iDmnQGC.exe
  C:\Windows\System\iDmnQGC.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\BgXJQQO.exe
  C:\Windows\System\BgXJQQO.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\FtCGzOC.exe
  C:\Windows\System\FtCGzOC.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\FBZVOdt.exe
  C:\Windows\System\FBZVOdt.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\RjfHDYH.exe
  C:\Windows\System\RjfHDYH.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\shPIWse.exe
  C:\Windows\System\shPIWse.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\YVFnCez.exe
  C:\Windows\System\YVFnCez.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\jZzfGQj.exe
  C:\Windows\System\jZzfGQj.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\BdsrUQq.exe
  C:\Windows\System\BdsrUQq.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\FzIouSO.exe
  C:\Windows\System\FzIouSO.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\ItUkIqY.exe
  C:\Windows\System\ItUkIqY.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\irueiOQ.exe
  C:\Windows\System\irueiOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\QufAZWN.exe
  C:\Windows\System\QufAZWN.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\TcjRdID.exe
  C:\Windows\System\TcjRdID.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\LfAfkNH.exe
  C:\Windows\System\LfAfkNH.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\vXAKOUG.exe
  C:\Windows\System\vXAKOUG.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\GvFLpjU.exe
  C:\Windows\System\GvFLpjU.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\VaIuezJ.exe
  C:\Windows\System\VaIuezJ.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\GLnCGwN.exe
  C:\Windows\System\GLnCGwN.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\kuEMaNO.exe
  C:\Windows\System\kuEMaNO.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\qflRJfW.exe
  C:\Windows\System\qflRJfW.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\oekerpJ.exe
  C:\Windows\System\oekerpJ.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\AjRWISj.exe
  C:\Windows\System\AjRWISj.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\DwhsdIa.exe
  C:\Windows\System\DwhsdIa.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\LFNsMMT.exe
  C:\Windows\System\LFNsMMT.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\AMQvptW.exe
  C:\Windows\System\AMQvptW.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\nzHNUhS.exe
  C:\Windows\System\nzHNUhS.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\eFfROHG.exe
  C:\Windows\System\eFfROHG.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\cgxUCCd.exe
  C:\Windows\System\cgxUCCd.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\EjuCjso.exe
  C:\Windows\System\EjuCjso.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\KFogsBh.exe
  C:\Windows\System\KFogsBh.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\UdTuZfN.exe
  C:\Windows\System\UdTuZfN.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\zGdtnWr.exe
  C:\Windows\System\zGdtnWr.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\yeWPLjY.exe
  C:\Windows\System\yeWPLjY.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\zTgqglR.exe
  C:\Windows\System\zTgqglR.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\feknxVQ.exe
  C:\Windows\System\feknxVQ.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\LgeaEFf.exe
  C:\Windows\System\LgeaEFf.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\ZAvhDPh.exe
  C:\Windows\System\ZAvhDPh.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\NJiJfFw.exe
  C:\Windows\System\NJiJfFw.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\BuOotAL.exe
  C:\Windows\System\BuOotAL.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\VCwkjTq.exe
  C:\Windows\System\VCwkjTq.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\bVTxzrm.exe
  C:\Windows\System\bVTxzrm.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\hdXUWCf.exe
  C:\Windows\System\hdXUWCf.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\ZDazUXa.exe
  C:\Windows\System\ZDazUXa.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\cKjpniX.exe
  C:\Windows\System\cKjpniX.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\OpaDYbx.exe
  C:\Windows\System\OpaDYbx.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\GifisPv.exe
  C:\Windows\System\GifisPv.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\kqxukBk.exe
  C:\Windows\System\kqxukBk.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\clrfAMH.exe
  C:\Windows\System\clrfAMH.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\IbWuZXy.exe
  C:\Windows\System\IbWuZXy.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\BMxBFfH.exe
  C:\Windows\System\BMxBFfH.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\dOPIfNc.exe
  C:\Windows\System\dOPIfNc.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\oqdKncc.exe
  C:\Windows\System\oqdKncc.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\evFOFHZ.exe
  C:\Windows\System\evFOFHZ.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\aitONyy.exe
  C:\Windows\System\aitONyy.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\FRrCXiQ.exe
  C:\Windows\System\FRrCXiQ.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\wNXKDqd.exe
  C:\Windows\System\wNXKDqd.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\MNWsnVW.exe
  C:\Windows\System\MNWsnVW.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\DUsFcaY.exe
  C:\Windows\System\DUsFcaY.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\zAZjoFG.exe
  C:\Windows\System\zAZjoFG.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\yzhBEhY.exe
  C:\Windows\System\yzhBEhY.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\GKLiXzw.exe
  C:\Windows\System\GKLiXzw.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\veOMFgh.exe
  C:\Windows\System\veOMFgh.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\iDjFREJ.exe
  C:\Windows\System\iDjFREJ.exe
  2⤵
  PID:1316
- C:\Windows\System\fdmkOIC.exe
  C:\Windows\System\fdmkOIC.exe
  2⤵
  PID:1360
- C:\Windows\System\jHKJfwQ.exe
  C:\Windows\System\jHKJfwQ.exe
  2⤵
  PID:3348
- C:\Windows\System\CxEraPR.exe
  C:\Windows\System\CxEraPR.exe
  2⤵
  PID:2360
- C:\Windows\System\wJMJAvk.exe
  C:\Windows\System\wJMJAvk.exe
  2⤵
  PID:4260
- C:\Windows\System\JGZftCg.exe
  C:\Windows\System\JGZftCg.exe
  2⤵
  PID:2408
- C:\Windows\System\MOwiwQd.exe
  C:\Windows\System\MOwiwQd.exe
  2⤵
  PID:1016
- C:\Windows\System\rzgKahc.exe
  C:\Windows\System\rzgKahc.exe
  2⤵
  PID:4492
- C:\Windows\System\QQkgBpJ.exe
  C:\Windows\System\QQkgBpJ.exe
  2⤵
  PID:5128
- C:\Windows\System\NIeazBQ.exe
  C:\Windows\System\NIeazBQ.exe
  2⤵
  PID:5148
- C:\Windows\System\cTeOctD.exe
  C:\Windows\System\cTeOctD.exe
  2⤵
  PID:5176
- C:\Windows\System\gheAjBD.exe
  C:\Windows\System\gheAjBD.exe
  2⤵
  PID:5196
- C:\Windows\System\RfnDqCG.exe
  C:\Windows\System\RfnDqCG.exe
  2⤵
  PID:5220
- C:\Windows\System\UgFNBmT.exe
  C:\Windows\System\UgFNBmT.exe
  2⤵
  PID:5244
- C:\Windows\System\SAfRpgu.exe
  C:\Windows\System\SAfRpgu.exe
  2⤵
  PID:5276
- C:\Windows\System\VldRKkG.exe
  C:\Windows\System\VldRKkG.exe
  2⤵
  PID:5300
- C:\Windows\System\nYBOooN.exe
  C:\Windows\System\nYBOooN.exe
  2⤵
  PID:5324
- C:\Windows\System\oVAVVgq.exe
  C:\Windows\System\oVAVVgq.exe
  2⤵
  PID:5340
- C:\Windows\System\qHEgoIU.exe
  C:\Windows\System\qHEgoIU.exe
  2⤵
  PID:5364
- C:\Windows\System\SzCUTfA.exe
  C:\Windows\System\SzCUTfA.exe
  2⤵
  PID:5384
- C:\Windows\System\veMIVpu.exe
  C:\Windows\System\veMIVpu.exe
  2⤵
  PID:5408
- C:\Windows\System\nbEbYDG.exe
  C:\Windows\System\nbEbYDG.exe
  2⤵
  PID:5428
- C:\Windows\System\duQMcug.exe
  C:\Windows\System\duQMcug.exe
  2⤵
  PID:5452
- C:\Windows\System\odimisj.exe
  C:\Windows\System\odimisj.exe
  2⤵
  PID:5472
- C:\Windows\System\xKFEHnn.exe
  C:\Windows\System\xKFEHnn.exe
  2⤵
  PID:5492
- C:\Windows\System\ZiTNqFJ.exe
  C:\Windows\System\ZiTNqFJ.exe
  2⤵
  PID:5520
- C:\Windows\System\NOKqCgk.exe
  C:\Windows\System\NOKqCgk.exe
  2⤵
  PID:5548
- C:\Windows\System\ROIEONp.exe
  C:\Windows\System\ROIEONp.exe
  2⤵
  PID:5568
- C:\Windows\System\GSmyIee.exe
  C:\Windows\System\GSmyIee.exe
  2⤵
  PID:5592
- C:\Windows\System\mddScfr.exe
  C:\Windows\System\mddScfr.exe
  2⤵
  PID:5612
- C:\Windows\System\PZAMwNB.exe
  C:\Windows\System\PZAMwNB.exe
  2⤵
  PID:5636
- C:\Windows\System\weFfOXe.exe
  C:\Windows\System\weFfOXe.exe
  2⤵
  PID:5656
- C:\Windows\System\HSViyBk.exe
  C:\Windows\System\HSViyBk.exe
  2⤵
  PID:5672
- C:\Windows\System\AHZiCAb.exe
  C:\Windows\System\AHZiCAb.exe
  2⤵
  PID:5692
- C:\Windows\System\UvELXze.exe
  C:\Windows\System\UvELXze.exe
  2⤵
  PID:5716
- C:\Windows\System\EJoOzgX.exe
  C:\Windows\System\EJoOzgX.exe
  2⤵
  PID:5748
- C:\Windows\System\ozolPqs.exe
  C:\Windows\System\ozolPqs.exe
  2⤵
  PID:5768
- C:\Windows\System\DdJZCXX.exe
  C:\Windows\System\DdJZCXX.exe
  2⤵
  PID:5792
- C:\Windows\System\awYsFfF.exe
  C:\Windows\System\awYsFfF.exe
  2⤵
  PID:5816
- C:\Windows\System\UbQwkwJ.exe
  C:\Windows\System\UbQwkwJ.exe
  2⤵
  PID:5832
- C:\Windows\System\DdzeLHm.exe
  C:\Windows\System\DdzeLHm.exe
  2⤵
  PID:5856
- C:\Windows\System\jXbtGml.exe
  C:\Windows\System\jXbtGml.exe
  2⤵
  PID:5920
- C:\Windows\System\IWuBVwF.exe
  C:\Windows\System\IWuBVwF.exe
  2⤵
  PID:5940
- C:\Windows\System\mVIkfCr.exe
  C:\Windows\System\mVIkfCr.exe
  2⤵
  PID:5972
- C:\Windows\System\YLyjxLz.exe
  C:\Windows\System\YLyjxLz.exe
  2⤵
  PID:5996
- C:\Windows\System\Zxcchbq.exe
  C:\Windows\System\Zxcchbq.exe
  2⤵
  PID:6016
- C:\Windows\System\wmApkqW.exe
  C:\Windows\System\wmApkqW.exe
  2⤵
  PID:6040
- C:\Windows\System\SswSBNw.exe
  C:\Windows\System\SswSBNw.exe
  2⤵
  PID:6072
- C:\Windows\System\gZcxWIR.exe
  C:\Windows\System\gZcxWIR.exe
  2⤵
  PID:6088
- C:\Windows\System\KjJcdZJ.exe
  C:\Windows\System\KjJcdZJ.exe
  2⤵
  PID:6112
- C:\Windows\System\mQkoJdp.exe
  C:\Windows\System\mQkoJdp.exe
  2⤵
  PID:6136
- C:\Windows\System\tZFFzVF.exe
  C:\Windows\System\tZFFzVF.exe
  2⤵
  PID:5140
- C:\Windows\System\bGYiJgP.exe
  C:\Windows\System\bGYiJgP.exe
  2⤵
  PID:5192
- C:\Windows\System\sQuXmKD.exe
  C:\Windows\System\sQuXmKD.exe
  2⤵
  PID:5376
- C:\Windows\System\VLMklSA.exe
  C:\Windows\System\VLMklSA.exe
  2⤵
  PID:5480
- C:\Windows\System\qQZhMcC.exe
  C:\Windows\System\qQZhMcC.exe
  2⤵
  PID:5464
- C:\Windows\System\cjrOzOb.exe
  C:\Windows\System\cjrOzOb.exe
  2⤵
  PID:5652
- C:\Windows\System\lDasxpR.exe
  C:\Windows\System\lDasxpR.exe
  2⤵
  PID:5604
- C:\Windows\System\jIwRWqd.exe
  C:\Windows\System\jIwRWqd.exe
  2⤵
  PID:5608
- C:\Windows\System\efpYUHL.exe
  C:\Windows\System\efpYUHL.exe
  2⤵
  PID:5840
- C:\Windows\System\vYHQvoK.exe
  C:\Windows\System\vYHQvoK.exe
  2⤵
  PID:5932
- C:\Windows\System\tQqLIIi.exe
  C:\Windows\System\tQqLIIi.exe
  2⤵
  PID:5764
- C:\Windows\System\ZJHWRCM.exe
  C:\Windows\System\ZJHWRCM.exe
  2⤵
  PID:5968
- C:\Windows\System\nlNoOXI.exe
  C:\Windows\System\nlNoOXI.exe
  2⤵
  PID:5888
- C:\Windows\System\sJHsKKn.exe
  C:\Windows\System\sJHsKKn.exe
  2⤵
  PID:5208
- C:\Windows\System\YJlEPad.exe
  C:\Windows\System\YJlEPad.exe
  2⤵
  PID:6096
- C:\Windows\System\ZDbgkYK.exe
  C:\Windows\System\ZDbgkYK.exe
  2⤵
  PID:5424
- C:\Windows\System\mdteEGm.exe
  C:\Windows\System\mdteEGm.exe
  2⤵
  PID:5584
- C:\Windows\System\fnskRqi.exe
  C:\Windows\System\fnskRqi.exe
  2⤵
  PID:5684
- C:\Windows\System\QZlQTrn.exe
  C:\Windows\System\QZlQTrn.exe
  2⤵
  PID:5540
- C:\Windows\System\WbcqkmN.exe
  C:\Windows\System\WbcqkmN.exe
  2⤵
  PID:6008
- C:\Windows\System\rskERMh.exe
  C:\Windows\System\rskERMh.exe
  2⤵
  PID:6160
- C:\Windows\System\zwdGmRF.exe
  C:\Windows\System\zwdGmRF.exe
  2⤵
  PID:6184
- C:\Windows\System\SObAqji.exe
  C:\Windows\System\SObAqji.exe
  2⤵
  PID:6204
- C:\Windows\System\wdmSpgM.exe
  C:\Windows\System\wdmSpgM.exe
  2⤵
  PID:6224
- C:\Windows\System\DlCEOxn.exe
  C:\Windows\System\DlCEOxn.exe
  2⤵
  PID:6252
- C:\Windows\System\cWOvBbT.exe
  C:\Windows\System\cWOvBbT.exe
  2⤵
  PID:6272
- C:\Windows\System\LveEOYT.exe
  C:\Windows\System\LveEOYT.exe
  2⤵
  PID:6304
- C:\Windows\System\AXXdaGq.exe
  C:\Windows\System\AXXdaGq.exe
  2⤵
  PID:6324
- C:\Windows\System\kJqzygx.exe
  C:\Windows\System\kJqzygx.exe
  2⤵
  PID:6368
- C:\Windows\System\CsqUuuF.exe
  C:\Windows\System\CsqUuuF.exe
  2⤵
  PID:6388
- C:\Windows\System\KeJibpI.exe
  C:\Windows\System\KeJibpI.exe
  2⤵
  PID:6412
- C:\Windows\System\AGFqVBe.exe
  C:\Windows\System\AGFqVBe.exe
  2⤵
  PID:6436
- C:\Windows\System\dvLadNu.exe
  C:\Windows\System\dvLadNu.exe
  2⤵
  PID:6456
- C:\Windows\System\nDajOGy.exe
  C:\Windows\System\nDajOGy.exe
  2⤵
  PID:6472
- C:\Windows\System\vMHePcn.exe
  C:\Windows\System\vMHePcn.exe
  2⤵
  PID:6492
- C:\Windows\System\GWDLuWr.exe
  C:\Windows\System\GWDLuWr.exe
  2⤵
  PID:6516
- C:\Windows\System\VmdtCuq.exe
  C:\Windows\System\VmdtCuq.exe
  2⤵
  PID:6540
- C:\Windows\System\OwExasK.exe
  C:\Windows\System\OwExasK.exe
  2⤵
  PID:6560
- C:\Windows\System\sKqWLva.exe
  C:\Windows\System\sKqWLva.exe
  2⤵
  PID:6580
- C:\Windows\System\XSVEZLF.exe
  C:\Windows\System\XSVEZLF.exe
  2⤵
  PID:6608
- C:\Windows\System\deHvECM.exe
  C:\Windows\System\deHvECM.exe
  2⤵
  PID:6628
- C:\Windows\System\HdgngiC.exe
  C:\Windows\System\HdgngiC.exe
  2⤵
  PID:6656
- C:\Windows\System\HLWsHay.exe
  C:\Windows\System\HLWsHay.exe
  2⤵
  PID:6684
- C:\Windows\System\OuCfKTM.exe
  C:\Windows\System\OuCfKTM.exe
  2⤵
  PID:6700
- C:\Windows\System\aGtFCRW.exe
  C:\Windows\System\aGtFCRW.exe
  2⤵
  PID:6728
- C:\Windows\System\wSBoLqA.exe
  C:\Windows\System\wSBoLqA.exe
  2⤵
  PID:6752
- C:\Windows\System\xuGSciG.exe
  C:\Windows\System\xuGSciG.exe
  2⤵
  PID:6776
- C:\Windows\System\fXDaijT.exe
  C:\Windows\System\fXDaijT.exe
  2⤵
  PID:6796
- C:\Windows\System\fDQXiqT.exe
  C:\Windows\System\fDQXiqT.exe
  2⤵
  PID:6816
- C:\Windows\System\qOVyirs.exe
  C:\Windows\System\qOVyirs.exe
  2⤵
  PID:6840
- C:\Windows\System\ZaPEYHs.exe
  C:\Windows\System\ZaPEYHs.exe
  2⤵
  PID:6860
- C:\Windows\System\uNkImHi.exe
  C:\Windows\System\uNkImHi.exe
  2⤵
  PID:6880
- C:\Windows\System\cuHugPl.exe
  C:\Windows\System\cuHugPl.exe
  2⤵
  PID:6912
- C:\Windows\System\XcQAVry.exe
  C:\Windows\System\XcQAVry.exe
  2⤵
  PID:6932
- C:\Windows\System\OCsljqt.exe
  C:\Windows\System\OCsljqt.exe
  2⤵
  PID:6952
- C:\Windows\System\uqPbkVJ.exe
  C:\Windows\System\uqPbkVJ.exe
  2⤵
  PID:6984
- C:\Windows\System\qxRlJnM.exe
  C:\Windows\System\qxRlJnM.exe
  2⤵
  PID:7008
- C:\Windows\System\UAoHVUc.exe
  C:\Windows\System\UAoHVUc.exe
  2⤵
  PID:7028
- C:\Windows\System\CfKnkGD.exe
  C:\Windows\System\CfKnkGD.exe
  2⤵
  PID:7048
- C:\Windows\System\dMmMyHO.exe
  C:\Windows\System\dMmMyHO.exe
  2⤵
  PID:7072
- C:\Windows\System\DBDVwyo.exe
  C:\Windows\System\DBDVwyo.exe
  2⤵
  PID:7100
- C:\Windows\System\qTzNsdg.exe
  C:\Windows\System\qTzNsdg.exe
  2⤵
  PID:7120
- C:\Windows\System\UuQBAGv.exe
  C:\Windows\System\UuQBAGv.exe
  2⤵
  PID:7136
- C:\Windows\System\oiwiYyz.exe
  C:\Windows\System\oiwiYyz.exe
  2⤵
  PID:7156
- C:\Windows\System\WTsiNaG.exe
  C:\Windows\System\WTsiNaG.exe
  2⤵
  PID:5516
- C:\Windows\System\YpSylzV.exe
  C:\Windows\System\YpSylzV.exe
  2⤵
  PID:6012
- C:\Windows\System\rrjhaLj.exe
  C:\Windows\System\rrjhaLj.exe
  2⤵
  PID:5824
- C:\Windows\System\TbfsNeN.exe
  C:\Windows\System\TbfsNeN.exe
  2⤵
  PID:5960
- C:\Windows\System\wguESCB.exe
  C:\Windows\System\wguESCB.exe
  2⤵
  PID:5136
- C:\Windows\System\OtawQkf.exe
  C:\Windows\System\OtawQkf.exe
  2⤵
  PID:6364
- C:\Windows\System\qnLiNxk.exe
  C:\Windows\System\qnLiNxk.exe
  2⤵
  PID:6420
- C:\Windows\System\nkdFRzk.exe
  C:\Windows\System\nkdFRzk.exe
  2⤵
  PID:6836
- C:\Windows\System\sSkBkmY.exe
  C:\Windows\System\sSkBkmY.exe
  2⤵
  PID:6708
- C:\Windows\System\wjbYccS.exe
  C:\Windows\System\wjbYccS.exe
  2⤵
  PID:6920
- C:\Windows\System\zOmFVsm.exe
  C:\Windows\System\zOmFVsm.exe
  2⤵
  PID:6556
- C:\Windows\System\KpusbsW.exe
  C:\Windows\System\KpusbsW.exe
  2⤵
  PID:6624
- C:\Windows\System\URBkCjm.exe
  C:\Windows\System\URBkCjm.exe
  2⤵
  PID:6032
- C:\Windows\System\sIhBAVb.exe
  C:\Windows\System\sIhBAVb.exe
  2⤵
  PID:6948
- C:\Windows\System\WOJYSFY.exe
  C:\Windows\System\WOJYSFY.exe
  2⤵
  PID:7108
- C:\Windows\System\tyZGYVz.exe
  C:\Windows\System\tyZGYVz.exe
  2⤵
  PID:6900
- C:\Windows\System\IpvtcjN.exe
  C:\Windows\System\IpvtcjN.exe
  2⤵
  PID:7064
- C:\Windows\System\nXGbYts.exe
  C:\Windows\System\nXGbYts.exe
  2⤵
  PID:6292
- C:\Windows\System\KIKSymf.exe
  C:\Windows\System\KIKSymf.exe
  2⤵
  PID:5600
- C:\Windows\System\MscLcmD.exe
  C:\Windows\System\MscLcmD.exe
  2⤵
  PID:5188
- C:\Windows\System\HCGJWXB.exe
  C:\Windows\System\HCGJWXB.exe
  2⤵
  PID:5916
- C:\Windows\System\oTNhCSS.exe
  C:\Windows\System\oTNhCSS.exe
  2⤵
  PID:7188
- C:\Windows\System\jCBeigP.exe
  C:\Windows\System\jCBeigP.exe
  2⤵
  PID:7208
- C:\Windows\System\EhkuQHB.exe
  C:\Windows\System\EhkuQHB.exe
  2⤵
  PID:7228
- C:\Windows\System\MFHyLgN.exe
  C:\Windows\System\MFHyLgN.exe
  2⤵
  PID:7252
- C:\Windows\System\EqHmSnI.exe
  C:\Windows\System\EqHmSnI.exe
  2⤵
  PID:7276
- C:\Windows\System\NanprYF.exe
  C:\Windows\System\NanprYF.exe
  2⤵
  PID:7296
- C:\Windows\System\QHfDjKM.exe
  C:\Windows\System\QHfDjKM.exe
  2⤵
  PID:7316
- C:\Windows\System\LLGscYz.exe
  C:\Windows\System\LLGscYz.exe
  2⤵
  PID:7344
- C:\Windows\System\jVPCtWr.exe
  C:\Windows\System\jVPCtWr.exe
  2⤵
  PID:7504
- C:\Windows\System\BcPWszG.exe
  C:\Windows\System\BcPWszG.exe
  2⤵
  PID:7592
- C:\Windows\System\erbTxPA.exe
  C:\Windows\System\erbTxPA.exe
  2⤵
  PID:7632
- C:\Windows\System\qzAecwl.exe
  C:\Windows\System\qzAecwl.exe
  2⤵
  PID:7652
- C:\Windows\System\brFqmLu.exe
  C:\Windows\System\brFqmLu.exe
  2⤵
  PID:7676
- C:\Windows\System\tpRDTMy.exe
  C:\Windows\System\tpRDTMy.exe
  2⤵
  PID:7696
- C:\Windows\System\wOeTYzl.exe
  C:\Windows\System\wOeTYzl.exe
  2⤵
  PID:7736
- C:\Windows\System\OVVnCEG.exe
  C:\Windows\System\OVVnCEG.exe
  2⤵
  PID:7772
- C:\Windows\System\hqYYNLf.exe
  C:\Windows\System\hqYYNLf.exe
  2⤵
  PID:7796
- C:\Windows\System\PvodeQH.exe
  C:\Windows\System\PvodeQH.exe
  2⤵
  PID:7956
- C:\Windows\System\FfiGPqC.exe
  C:\Windows\System\FfiGPqC.exe
  2⤵
  PID:7980
- C:\Windows\System\nxfQWyO.exe
  C:\Windows\System\nxfQWyO.exe
  2⤵
  PID:8012
- C:\Windows\System\oOejrZG.exe
  C:\Windows\System\oOejrZG.exe
  2⤵
  PID:8036
- C:\Windows\System\ehGXKoX.exe
  C:\Windows\System\ehGXKoX.exe
  2⤵
  PID:8056
- C:\Windows\System\DgjvxIp.exe
  C:\Windows\System\DgjvxIp.exe
  2⤵
  PID:8080
- C:\Windows\System\OTKdizO.exe
  C:\Windows\System\OTKdizO.exe
  2⤵
  PID:8096
- C:\Windows\System\oHmLVZv.exe
  C:\Windows\System\oHmLVZv.exe
  2⤵
  PID:8112
- C:\Windows\System\zDdlQFw.exe
  C:\Windows\System\zDdlQFw.exe
  2⤵
  PID:8132
- C:\Windows\System\GJsXXIM.exe
  C:\Windows\System\GJsXXIM.exe
  2⤵
  PID:8152
- C:\Windows\System\xVrBKew.exe
  C:\Windows\System\xVrBKew.exe
  2⤵
  PID:8172
- C:\Windows\System\UHsWRcQ.exe
  C:\Windows\System\UHsWRcQ.exe
  2⤵
  PID:5732
- C:\Windows\System\qXRVXhc.exe
  C:\Windows\System\qXRVXhc.exe
  2⤵
  PID:6644
- C:\Windows\System\gekmJMV.exe
  C:\Windows\System\gekmJMV.exe
  2⤵
  PID:7164
- C:\Windows\System\xYQXnWR.exe
  C:\Windows\System\xYQXnWR.exe
  2⤵
  PID:7216
- C:\Windows\System\mQYElCp.exe
  C:\Windows\System\mQYElCp.exe
  2⤵
  PID:6832
- C:\Windows\System\RTnUvhw.exe
  C:\Windows\System\RTnUvhw.exe
  2⤵
  PID:6808
- C:\Windows\System\wzZQXGj.exe
  C:\Windows\System\wzZQXGj.exe
  2⤵
  PID:7304
- C:\Windows\System\gBhTgbX.exe
  C:\Windows\System\gBhTgbX.exe
  2⤵
  PID:6500
- C:\Windows\System\soDpYlN.exe
  C:\Windows\System\soDpYlN.exe
  2⤵
  PID:7220
- C:\Windows\System\IyLIbDB.exe
  C:\Windows\System\IyLIbDB.exe
  2⤵
  PID:7528
- C:\Windows\System\FNDdDfS.exe
  C:\Windows\System\FNDdDfS.exe
  2⤵
  PID:7480
- C:\Windows\System\IcPMaAo.exe
  C:\Windows\System\IcPMaAo.exe
  2⤵
  PID:7584
- C:\Windows\System\OCFLjtt.exe
  C:\Windows\System\OCFLjtt.exe
  2⤵
  PID:7512
- C:\Windows\System\obRBOrR.exe
  C:\Windows\System\obRBOrR.exe
  2⤵
  PID:7688
- C:\Windows\System\TqhGtQd.exe
  C:\Windows\System\TqhGtQd.exe
  2⤵
  PID:7484
- C:\Windows\System\LSzVosb.exe
  C:\Windows\System\LSzVosb.exe
  2⤵
  PID:7836
- C:\Windows\System\zmbSduC.exe
  C:\Windows\System\zmbSduC.exe
  2⤵
  PID:7748
- C:\Windows\System\FLvYmOF.exe
  C:\Windows\System\FLvYmOF.exe
  2⤵
  PID:7788
- C:\Windows\System\TPmERND.exe
  C:\Windows\System\TPmERND.exe
  2⤵
  PID:7964
- C:\Windows\System\VemymwU.exe
  C:\Windows\System\VemymwU.exe
  2⤵
  PID:7948
- C:\Windows\System\vgNTdQM.exe
  C:\Windows\System\vgNTdQM.exe
  2⤵
  PID:8068
- C:\Windows\System\YqRfrMr.exe
  C:\Windows\System\YqRfrMr.exe
  2⤵
  PID:8072
- C:\Windows\System\gfOQeVn.exe
  C:\Windows\System\gfOQeVn.exe
  2⤵
  PID:8144
- C:\Windows\System\YeYetji.exe
  C:\Windows\System\YeYetji.exe
  2⤵
  PID:8120
- C:\Windows\System\lTxoJjJ.exe
  C:\Windows\System\lTxoJjJ.exe
  2⤵
  PID:8148
- C:\Windows\System\UwGRjLc.exe
  C:\Windows\System\UwGRjLc.exe
  2⤵
  PID:6408
- C:\Windows\System\LQKSmkx.exe
  C:\Windows\System\LQKSmkx.exe
  2⤵
  PID:6896
- C:\Windows\System\mAbqlTA.exe
  C:\Windows\System\mAbqlTA.exe
  2⤵
  PID:7036
- C:\Windows\System\wXoWCrs.exe
  C:\Windows\System\wXoWCrs.exe
  2⤵
  PID:4828
- C:\Windows\System\RmPWzrb.exe
  C:\Windows\System\RmPWzrb.exe
  2⤵
  PID:7648
- C:\Windows\System\AHFkXZM.exe
  C:\Windows\System\AHFkXZM.exe
  2⤵
  PID:8024
- C:\Windows\System\NxUNkCt.exe
  C:\Windows\System\NxUNkCt.exe
  2⤵
  PID:6360
- C:\Windows\System\kxOUCwh.exe
  C:\Windows\System\kxOUCwh.exe
  2⤵
  PID:6788
- C:\Windows\System\uveiNDx.exe
  C:\Windows\System\uveiNDx.exe
  2⤵
  PID:8028
- C:\Windows\System\klvFxwL.exe
  C:\Windows\System\klvFxwL.exe
  2⤵
  PID:7892
- C:\Windows\System\kbOaGaZ.exe
  C:\Windows\System\kbOaGaZ.exe
  2⤵
  PID:7996
- C:\Windows\System\NvlNQyl.exe
  C:\Windows\System\NvlNQyl.exe
  2⤵
  PID:8212
- C:\Windows\System\REUHqGY.exe
  C:\Windows\System\REUHqGY.exe
  2⤵
  PID:8236
- C:\Windows\System\gsHRRWm.exe
  C:\Windows\System\gsHRRWm.exe
  2⤵
  PID:8260
- C:\Windows\System\DmnpQEp.exe
  C:\Windows\System\DmnpQEp.exe
  2⤵
  PID:8280
- C:\Windows\System\ERVYGkA.exe
  C:\Windows\System\ERVYGkA.exe
  2⤵
  PID:8296
- C:\Windows\System\tdgeVGM.exe
  C:\Windows\System\tdgeVGM.exe
  2⤵
  PID:8316
- C:\Windows\System\bPWGVok.exe
  C:\Windows\System\bPWGVok.exe
  2⤵
  PID:8340
- C:\Windows\System\jDfINEp.exe
  C:\Windows\System\jDfINEp.exe
  2⤵
  PID:8360
- C:\Windows\System\TWXSsNy.exe
  C:\Windows\System\TWXSsNy.exe
  2⤵
  PID:8380
- C:\Windows\System\BozJDMs.exe
  C:\Windows\System\BozJDMs.exe
  2⤵
  PID:8404
- C:\Windows\System\RrffPoO.exe
  C:\Windows\System\RrffPoO.exe
  2⤵
  PID:8420
- C:\Windows\System\GXFPXCF.exe
  C:\Windows\System\GXFPXCF.exe
  2⤵
  PID:8444
- C:\Windows\System\cluPxku.exe
  C:\Windows\System\cluPxku.exe
  2⤵
  PID:8468
- C:\Windows\System\irbgYpr.exe
  C:\Windows\System\irbgYpr.exe
  2⤵
  PID:8484
- C:\Windows\System\SugsTfw.exe
  C:\Windows\System\SugsTfw.exe
  2⤵
  PID:8508
- C:\Windows\System\dSfwrKB.exe
  C:\Windows\System\dSfwrKB.exe
  2⤵
  PID:8532
- C:\Windows\System\PFfLosW.exe
  C:\Windows\System\PFfLosW.exe
  2⤵
  PID:8552
- C:\Windows\System\PbHYoSo.exe
  C:\Windows\System\PbHYoSo.exe
  2⤵
  PID:8572
- C:\Windows\System\QjVjzCq.exe
  C:\Windows\System\QjVjzCq.exe
  2⤵
  PID:8592
- C:\Windows\System\lcKDxlp.exe
  C:\Windows\System\lcKDxlp.exe
  2⤵
  PID:8616
- C:\Windows\System\dlbqldJ.exe
  C:\Windows\System\dlbqldJ.exe
  2⤵
  PID:8636
- C:\Windows\System\UPeQKgd.exe
  C:\Windows\System\UPeQKgd.exe
  2⤵
  PID:8660
- C:\Windows\System\KGpoUXL.exe
  C:\Windows\System\KGpoUXL.exe
  2⤵
  PID:8680
- C:\Windows\System\WLQVLMy.exe
  C:\Windows\System\WLQVLMy.exe
  2⤵
  PID:8704
- C:\Windows\System\PoijIRH.exe
  C:\Windows\System\PoijIRH.exe
  2⤵
  PID:8724
- C:\Windows\System\Oihbbnv.exe
  C:\Windows\System\Oihbbnv.exe
  2⤵
  PID:8752
- C:\Windows\System\DxrwnlJ.exe
  C:\Windows\System\DxrwnlJ.exe
  2⤵
  PID:8768
- C:\Windows\System\xHqUGlb.exe
  C:\Windows\System\xHqUGlb.exe
  2⤵
  PID:8784
- C:\Windows\System\PyYFWRI.exe
  C:\Windows\System\PyYFWRI.exe
  2⤵
  PID:8808
- C:\Windows\System\tozzHxZ.exe
  C:\Windows\System\tozzHxZ.exe
  2⤵
  PID:8944
- C:\Windows\System\JfvcQrO.exe
  C:\Windows\System\JfvcQrO.exe
  2⤵
  PID:8968
- C:\Windows\System\anPvIWF.exe
  C:\Windows\System\anPvIWF.exe
  2⤵
  PID:9000
- C:\Windows\System\YvENZPM.exe
  C:\Windows\System\YvENZPM.exe
  2⤵
  PID:9024
- C:\Windows\System\JGQeKxO.exe
  C:\Windows\System\JGQeKxO.exe
  2⤵
  PID:9040
- C:\Windows\System\jfxVsLC.exe
  C:\Windows\System\jfxVsLC.exe
  2⤵
  PID:9060
- C:\Windows\System\VyBnzkP.exe
  C:\Windows\System\VyBnzkP.exe
  2⤵
  PID:9084
- C:\Windows\System\lGobJxx.exe
  C:\Windows\System\lGobJxx.exe
  2⤵
  PID:9108
- C:\Windows\System\aVTmXaF.exe
  C:\Windows\System\aVTmXaF.exe
  2⤵
  PID:9136
- C:\Windows\System\nroSKot.exe
  C:\Windows\System\nroSKot.exe
  2⤵
  PID:9156
- C:\Windows\System\qSxmmGk.exe
  C:\Windows\System\qSxmmGk.exe
  2⤵
  PID:9180
- C:\Windows\System\hhkBDmz.exe
  C:\Windows\System\hhkBDmz.exe
  2⤵
  PID:7440
- C:\Windows\System\wTUszNK.exe
  C:\Windows\System\wTUszNK.exe
  2⤵
  PID:6696
- C:\Windows\System\ypoaEhX.exe
  C:\Windows\System\ypoaEhX.exe
  2⤵
  PID:7260
- C:\Windows\System\GoSYslz.exe
  C:\Windows\System\GoSYslz.exe
  2⤵
  PID:8304
- C:\Windows\System\aooxCFI.exe
  C:\Windows\System\aooxCFI.exe
  2⤵
  PID:7808
- C:\Windows\System\xGnwfCI.exe
  C:\Windows\System\xGnwfCI.exe
  2⤵
  PID:8376
- C:\Windows\System\WzQqyGj.exe
  C:\Windows\System\WzQqyGj.exe
  2⤵
  PID:8412
- C:\Windows\System\QuXOlqn.exe
  C:\Windows\System\QuXOlqn.exe
  2⤵
  PID:8516
- C:\Windows\System\yCAbTXc.exe
  C:\Windows\System\yCAbTXc.exe
  2⤵
  PID:8356
- C:\Windows\System\mqVDtsF.exe
  C:\Windows\System\mqVDtsF.exe
  2⤵
  PID:8612
- C:\Windows\System\NMKKmqV.exe
  C:\Windows\System\NMKKmqV.exe
  2⤵
  PID:8272
- C:\Windows\System\ChGZSya.exe
  C:\Windows\System\ChGZSya.exe
  2⤵
  PID:8792
- C:\Windows\System\stYWgjE.exe
  C:\Windows\System\stYWgjE.exe
  2⤵
  PID:8840
- C:\Windows\System\LWpzlTT.exe
  C:\Windows\System\LWpzlTT.exe
  2⤵
  PID:8416
- C:\Windows\System\xIlKCdW.exe
  C:\Windows\System\xIlKCdW.exe
  2⤵
  PID:8656
- C:\Windows\System\ocqLGfl.exe
  C:\Windows\System\ocqLGfl.exe
  2⤵
  PID:8544
- C:\Windows\System\lpGpxHT.exe
  C:\Windows\System\lpGpxHT.exe
  2⤵
  PID:8940
- C:\Windows\System\YteQoNV.exe
  C:\Windows\System\YteQoNV.exe
  2⤵
  PID:9068
- C:\Windows\System\JmOsQqU.exe
  C:\Windows\System\JmOsQqU.exe
  2⤵
  PID:9172
- C:\Windows\System\hpUHNrb.exe
  C:\Windows\System\hpUHNrb.exe
  2⤵
  PID:8880
- C:\Windows\System\yirNuPv.exe
  C:\Windows\System\yirNuPv.exe
  2⤵
  PID:8720
- C:\Windows\System\MCGuhjV.exe
  C:\Windows\System\MCGuhjV.exe
  2⤵
  PID:8932
- C:\Windows\System\yansekZ.exe
  C:\Windows\System\yansekZ.exe
  2⤵
  PID:9232
- C:\Windows\System\yBHpFJV.exe
  C:\Windows\System\yBHpFJV.exe
  2⤵
  PID:9252
- C:\Windows\System\weVLOIm.exe
  C:\Windows\System\weVLOIm.exe
  2⤵
  PID:9268
- C:\Windows\System\bQBrnzw.exe
  C:\Windows\System\bQBrnzw.exe
  2⤵
  PID:9288
- C:\Windows\System\WQUPyqG.exe
  C:\Windows\System\WQUPyqG.exe
  2⤵
  PID:9308
- C:\Windows\System\OOjlVDG.exe
  C:\Windows\System\OOjlVDG.exe
  2⤵
  PID:9328
- C:\Windows\System\OSdWJpw.exe
  C:\Windows\System\OSdWJpw.exe
  2⤵
  PID:9352
- C:\Windows\System\MYcUHSY.exe
  C:\Windows\System\MYcUHSY.exe
  2⤵
  PID:9372
- C:\Windows\System\ZDtakJd.exe
  C:\Windows\System\ZDtakJd.exe
  2⤵
  PID:9392
- C:\Windows\System\zxuwNoS.exe
  C:\Windows\System\zxuwNoS.exe
  2⤵
  PID:9416
- C:\Windows\System\ZTHjIVY.exe
  C:\Windows\System\ZTHjIVY.exe
  2⤵
  PID:9432
- C:\Windows\System\JLpAdFB.exe
  C:\Windows\System\JLpAdFB.exe
  2⤵
  PID:9452
- C:\Windows\System\JERaEiX.exe
  C:\Windows\System\JERaEiX.exe
  2⤵
  PID:9476
- C:\Windows\System\IjGofSs.exe
  C:\Windows\System\IjGofSs.exe
  2⤵
  PID:9500
- C:\Windows\System\ulJbyFF.exe
  C:\Windows\System\ulJbyFF.exe
  2⤵
  PID:9520
- C:\Windows\System\tYlPVhp.exe
  C:\Windows\System\tYlPVhp.exe
  2⤵
  PID:9540
- C:\Windows\System\COSOvxl.exe
  C:\Windows\System\COSOvxl.exe
  2⤵
  PID:9564
- C:\Windows\System\LKrswMX.exe
  C:\Windows\System\LKrswMX.exe
  2⤵
  PID:9584
- C:\Windows\System\QQpwFca.exe
  C:\Windows\System\QQpwFca.exe
  2⤵
  PID:9604
- C:\Windows\System\UILxhXI.exe
  C:\Windows\System\UILxhXI.exe
  2⤵
  PID:9632
- C:\Windows\System\HSBfehq.exe
  C:\Windows\System\HSBfehq.exe
  2⤵
  PID:9652
- C:\Windows\System\BYlCBdO.exe
  C:\Windows\System\BYlCBdO.exe
  2⤵
  PID:9672
- C:\Windows\System\QXVkBlo.exe
  C:\Windows\System\QXVkBlo.exe
  2⤵
  PID:9696
- C:\Windows\System\xBFVviB.exe
  C:\Windows\System\xBFVviB.exe
  2⤵
  PID:9724
- C:\Windows\System\gklecEv.exe
  C:\Windows\System\gklecEv.exe
  2⤵
  PID:9740
- C:\Windows\System\uJQwsPR.exe
  C:\Windows\System\uJQwsPR.exe
  2⤵
  PID:9764
- C:\Windows\System\EQKALgA.exe
  C:\Windows\System\EQKALgA.exe
  2⤵
  PID:9784
- C:\Windows\System\SHAgxOR.exe
  C:\Windows\System\SHAgxOR.exe
  2⤵
  PID:9808
- C:\Windows\System\fjXsuZF.exe
  C:\Windows\System\fjXsuZF.exe
  2⤵
  PID:9828
- C:\Windows\System\whgoflw.exe
  C:\Windows\System\whgoflw.exe
  2⤵
  PID:9848
- C:\Windows\System\jIifiyz.exe
  C:\Windows\System\jIifiyz.exe
  2⤵
  PID:9868
- C:\Windows\System\zdhKPoD.exe
  C:\Windows\System\zdhKPoD.exe
  2⤵
  PID:9888
- C:\Windows\System\NcicIkQ.exe
  C:\Windows\System\NcicIkQ.exe
  2⤵
  PID:9908
- C:\Windows\System\UhHaJtd.exe
  C:\Windows\System\UhHaJtd.exe
  2⤵
  PID:9928
- C:\Windows\System\gLIbdCG.exe
  C:\Windows\System\gLIbdCG.exe
  2⤵
  PID:9948
- C:\Windows\System\aXuMntQ.exe
  C:\Windows\System\aXuMntQ.exe
  2⤵
  PID:9972
- C:\Windows\System\vcXUzRk.exe
  C:\Windows\System\vcXUzRk.exe
  2⤵
  PID:9988
- C:\Windows\System\dixnToK.exe
  C:\Windows\System\dixnToK.exe
  2⤵
  PID:10012
- C:\Windows\System\KSHoBuo.exe
  C:\Windows\System\KSHoBuo.exe
  2⤵
  PID:10048
- C:\Windows\System\uQPxMzy.exe
  C:\Windows\System\uQPxMzy.exe
  2⤵
  PID:10068
- C:\Windows\System\sdVMBTN.exe
  C:\Windows\System\sdVMBTN.exe
  2⤵
  PID:10088
- C:\Windows\System\thxGicf.exe
  C:\Windows\System\thxGicf.exe
  2⤵
  PID:10112
- C:\Windows\System\rctwfan.exe
  C:\Windows\System\rctwfan.exe
  2⤵
  PID:9816
- C:\Windows\System\ARVWOyL.exe
  C:\Windows\System\ARVWOyL.exe
  2⤵
  PID:9276
- C:\Windows\System\aldBibQ.exe
  C:\Windows\System\aldBibQ.exe
  2⤵
  PID:9924
- C:\Windows\System\UqhUMEg.exe
  C:\Windows\System\UqhUMEg.exe
  2⤵
  PID:8064
- C:\Windows\System\KxorXch.exe
  C:\Windows\System\KxorXch.exe
  2⤵
  PID:9980
- C:\Windows\System\HBCRtJV.exe
  C:\Windows\System\HBCRtJV.exe
  2⤵
  PID:10020
- C:\Windows\System\XzedYRp.exe
  C:\Windows\System\XzedYRp.exe
  2⤵
  PID:10060
- C:\Windows\System\HNxyLBR.exe
  C:\Windows\System\HNxyLBR.exe
  2⤵
  PID:10108
- C:\Windows\System\kVChaPp.exe
  C:\Windows\System\kVChaPp.exe
  2⤵
  PID:10160
- C:\Windows\System\dJuqscM.exe
  C:\Windows\System\dJuqscM.exe
  2⤵
  PID:9792
- C:\Windows\System\jvrsYQX.exe
  C:\Windows\System\jvrsYQX.exe
  2⤵
  PID:8672
- C:\Windows\System\AJpNBcw.exe
  C:\Windows\System\AJpNBcw.exe
  2⤵
  PID:4624
- C:\Windows\System\eSZgVbv.exe
  C:\Windows\System\eSZgVbv.exe
  2⤵
  PID:8696
- C:\Windows\System\FAIdEeM.exe
  C:\Windows\System\FAIdEeM.exe
  2⤵
  PID:6968
- C:\Windows\System\bEjvitt.exe
  C:\Windows\System\bEjvitt.exe
  2⤵
  PID:9284
- C:\Windows\System\vTPQCPO.exe
  C:\Windows\System\vTPQCPO.exe
  2⤵
  PID:8764
- C:\Windows\System\GcrgpNn.exe
  C:\Windows\System\GcrgpNn.exe
  2⤵
  PID:9780
- C:\Windows\System\MNLZLUX.exe
  C:\Windows\System\MNLZLUX.exe
  2⤵
  PID:9548
- C:\Windows\System\eblcgvs.exe
  C:\Windows\System\eblcgvs.exe
  2⤵
  PID:9860
- C:\Windows\System\ziFeaOa.exe
  C:\Windows\System\ziFeaOa.exe
  2⤵
  PID:7336
- C:\Windows\System\IEidVqf.exe
  C:\Windows\System\IEidVqf.exe
  2⤵
  PID:10032
- C:\Windows\System\CqRwegm.exe
  C:\Windows\System\CqRwegm.exe
  2⤵
  PID:3184
- C:\Windows\System\PzlgYHo.exe
  C:\Windows\System\PzlgYHo.exe
  2⤵
  PID:940
- C:\Windows\System\wCegXVI.exe
  C:\Windows\System\wCegXVI.exe
  2⤵
  PID:1088
- C:\Windows\System\NakVtsw.exe
  C:\Windows\System\NakVtsw.exe
  2⤵
  PID:10264
- C:\Windows\System\uyEaolg.exe
  C:\Windows\System\uyEaolg.exe
  2⤵
  PID:10284
- C:\Windows\System\YvOQdBS.exe
  C:\Windows\System\YvOQdBS.exe
  2⤵
  PID:10304
- C:\Windows\System\TbDOQIx.exe
  C:\Windows\System\TbDOQIx.exe
  2⤵
  PID:10328
- C:\Windows\System\bFeaeiL.exe
  C:\Windows\System\bFeaeiL.exe
  2⤵
  PID:10348
- C:\Windows\System\NPEoeZD.exe
  C:\Windows\System\NPEoeZD.exe
  2⤵
  PID:10368
- C:\Windows\System\pPAHHfM.exe
  C:\Windows\System\pPAHHfM.exe
  2⤵
  PID:10388
- C:\Windows\System\QhCmwMr.exe
  C:\Windows\System\QhCmwMr.exe
  2⤵
  PID:10408
- C:\Windows\System\TEGFNom.exe
  C:\Windows\System\TEGFNom.exe
  2⤵
  PID:10424
- C:\Windows\System\ywIGefh.exe
  C:\Windows\System\ywIGefh.exe
  2⤵
  PID:10460
- C:\Windows\System\dwgJfkk.exe
  C:\Windows\System\dwgJfkk.exe
  2⤵
  PID:10476
- C:\Windows\System\tYufDMY.exe
  C:\Windows\System\tYufDMY.exe
  2⤵
  PID:10504
- C:\Windows\System\YbFHWmb.exe
  C:\Windows\System\YbFHWmb.exe
  2⤵
  PID:10524
- C:\Windows\System\DxmjTvY.exe
  C:\Windows\System\DxmjTvY.exe
  2⤵
  PID:10632
- C:\Windows\System\BaMmHpf.exe
  C:\Windows\System\BaMmHpf.exe
  2⤵
  PID:10656
- C:\Windows\System\LbNwPrh.exe
  C:\Windows\System\LbNwPrh.exe
  2⤵
  PID:10684
- C:\Windows\System\jKbuKxo.exe
  C:\Windows\System\jKbuKxo.exe
  2⤵
  PID:10704
- C:\Windows\System\tAimAdk.exe
  C:\Windows\System\tAimAdk.exe
  2⤵
  PID:10732
- C:\Windows\System\TybdgJu.exe
  C:\Windows\System\TybdgJu.exe
  2⤵
  PID:10756
- C:\Windows\System\bcfStDk.exe
  C:\Windows\System\bcfStDk.exe
  2⤵
  PID:10776
- C:\Windows\System\PadNoVm.exe
  C:\Windows\System\PadNoVm.exe
  2⤵
  PID:10800
- C:\Windows\System\kvQcgBz.exe
  C:\Windows\System\kvQcgBz.exe
  2⤵
  PID:10828
- C:\Windows\System\VuCJYrE.exe
  C:\Windows\System\VuCJYrE.exe
  2⤵
  PID:10852
- C:\Windows\System\jZCCXxA.exe
  C:\Windows\System\jZCCXxA.exe
  2⤵
  PID:10876
- C:\Windows\System\cdFezaD.exe
  C:\Windows\System\cdFezaD.exe
  2⤵
  PID:10904
- C:\Windows\System\COHxlcG.exe
  C:\Windows\System\COHxlcG.exe
  2⤵
  PID:10924
- C:\Windows\System\tHhrXOt.exe
  C:\Windows\System\tHhrXOt.exe
  2⤵
  PID:10948
- C:\Windows\System\SEKVFbO.exe
  C:\Windows\System\SEKVFbO.exe
  2⤵
  PID:10972
- C:\Windows\System\LLupEjZ.exe
  C:\Windows\System\LLupEjZ.exe
  2⤵
  PID:10996
- C:\Windows\System\MzaKYsz.exe
  C:\Windows\System\MzaKYsz.exe
  2⤵
  PID:11020
- C:\Windows\System\YuVoQEY.exe
  C:\Windows\System\YuVoQEY.exe
  2⤵
  PID:11040
- C:\Windows\System\qhEcncc.exe
  C:\Windows\System\qhEcncc.exe
  2⤵
  PID:11060
- C:\Windows\System\bHLuGbF.exe
  C:\Windows\System\bHLuGbF.exe
  2⤵
  PID:11080
- C:\Windows\System\YiNQHly.exe
  C:\Windows\System\YiNQHly.exe
  2⤵
  PID:11100
- C:\Windows\System\TMqnyKJ.exe
  C:\Windows\System\TMqnyKJ.exe
  2⤵
  PID:11120
- C:\Windows\System\TfwJXil.exe
  C:\Windows\System\TfwJXil.exe
  2⤵
  PID:11136
- C:\Windows\System\xYTozjU.exe
  C:\Windows\System\xYTozjU.exe
  2⤵
  PID:11160
- C:\Windows\System\ZHHVdPt.exe
  C:\Windows\System\ZHHVdPt.exe
  2⤵
  PID:11184
- C:\Windows\System\nvVocpj.exe
  C:\Windows\System\nvVocpj.exe
  2⤵
  PID:11204
- C:\Windows\System\USSmHvK.exe
  C:\Windows\System\USSmHvK.exe
  2⤵
  PID:11232
- C:\Windows\System\MvbtEbB.exe
  C:\Windows\System\MvbtEbB.exe
  2⤵
  PID:11256
- C:\Windows\System\SwDToEY.exe
  C:\Windows\System\SwDToEY.exe
  2⤵
  PID:9264
- C:\Windows\System\HwffzhZ.exe
  C:\Windows\System\HwffzhZ.exe
  2⤵
  PID:10228
- C:\Windows\System\kVPKllj.exe
  C:\Windows\System\kVPKllj.exe
  2⤵
  PID:8712
- C:\Windows\System\XpxkuXB.exe
  C:\Windows\System\XpxkuXB.exe
  2⤵
  PID:10184
- C:\Windows\System\JFZIjyT.exe
  C:\Windows\System\JFZIjyT.exe
  2⤵
  PID:10356
- C:\Windows\System\zTvhbeg.exe
  C:\Windows\System\zTvhbeg.exe
  2⤵
  PID:10400
- C:\Windows\System\bBplrjL.exe
  C:\Windows\System\bBplrjL.exe
  2⤵
  PID:10436
- C:\Windows\System\UAMXJCr.exe
  C:\Windows\System\UAMXJCr.exe
  2⤵
  PID:9532
- C:\Windows\System\sWttjMN.exe
  C:\Windows\System\sWttjMN.exe
  2⤵
  PID:10244
- C:\Windows\System\lFiMJVM.exe
  C:\Windows\System\lFiMJVM.exe
  2⤵
  PID:4724
- C:\Windows\System\cNPCnLj.exe
  C:\Windows\System\cNPCnLj.exe
  2⤵
  PID:10548
- C:\Windows\System\xwMdJLp.exe
  C:\Windows\System\xwMdJLp.exe
  2⤵
  PID:10484
- C:\Windows\System\lefwDfy.exe
  C:\Windows\System\lefwDfy.exe
  2⤵
  PID:10860
- C:\Windows\System\fcxBLwl.exe
  C:\Windows\System\fcxBLwl.exe
  2⤵
  PID:10932
- C:\Windows\System\LAqkwLD.exe
  C:\Windows\System\LAqkwLD.exe
  2⤵
  PID:11028
- C:\Windows\System\lQYhNVd.exe
  C:\Windows\System\lQYhNVd.exe
  2⤵
  PID:11072
- C:\Windows\System\grxBMDI.exe
  C:\Windows\System\grxBMDI.exe
  2⤵
  PID:11112
- C:\Windows\System\InCmmww.exe
  C:\Windows\System\InCmmww.exe
  2⤵
  PID:11176
- C:\Windows\System\syByMEj.exe
  C:\Windows\System\syByMEj.exe
  2⤵
  PID:10988
- C:\Windows\System\mRLUTRU.exe
  C:\Windows\System\mRLUTRU.exe
  2⤵
  PID:10752
- C:\Windows\System\yVYCzcN.exe
  C:\Windows\System\yVYCzcN.exe
  2⤵
  PID:9020
- C:\Windows\System\TYEVHcI.exe
  C:\Windows\System\TYEVHcI.exe
  2⤵
  PID:10872
- C:\Windows\System\bBKefgD.exe
  C:\Windows\System\bBKefgD.exe
  2⤵
  PID:9364
- C:\Windows\System\mGjxZuw.exe
  C:\Windows\System\mGjxZuw.exe
  2⤵
  PID:11456
- C:\Windows\System\anRovnr.exe
  C:\Windows\System\anRovnr.exe
  2⤵
  PID:11476
- C:\Windows\System\eUqQuBt.exe
  C:\Windows\System\eUqQuBt.exe
  2⤵
  PID:11500
- C:\Windows\System\iAOYWDq.exe
  C:\Windows\System\iAOYWDq.exe
  2⤵
  PID:11528
- C:\Windows\System\CSVWyva.exe
  C:\Windows\System\CSVWyva.exe
  2⤵
  PID:11552
- C:\Windows\System\FugselS.exe
  C:\Windows\System\FugselS.exe
  2⤵
  PID:11628
- C:\Windows\System\QnednQp.exe
  C:\Windows\System\QnednQp.exe
  2⤵
  PID:11696
- C:\Windows\System\iMYnBYH.exe
  C:\Windows\System\iMYnBYH.exe
  2⤵
  PID:11724
- C:\Windows\System\WBucaML.exe
  C:\Windows\System\WBucaML.exe
  2⤵
  PID:11744
- C:\Windows\System\bfJihBq.exe
  C:\Windows\System\bfJihBq.exe
  2⤵
  PID:11764
- C:\Windows\System\yGZCSqx.exe
  C:\Windows\System\yGZCSqx.exe
  2⤵
  PID:11788
- C:\Windows\System\dQOQxsB.exe
  C:\Windows\System\dQOQxsB.exe
  2⤵
  PID:11820
- C:\Windows\System\PHvSgQq.exe
  C:\Windows\System\PHvSgQq.exe
  2⤵
  PID:11836
- C:\Windows\System\kDPkBnS.exe
  C:\Windows\System\kDPkBnS.exe
  2⤵
  PID:11860
- C:\Windows\System\aLdWwXz.exe
  C:\Windows\System\aLdWwXz.exe
  2⤵
  PID:11888
- C:\Windows\System\zznPApH.exe
  C:\Windows\System\zznPApH.exe
  2⤵
  PID:11920
- C:\Windows\System\VRlhTVj.exe
  C:\Windows\System\VRlhTVj.exe
  2⤵
  PID:11936
- C:\Windows\System\PqOWWvb.exe
  C:\Windows\System\PqOWWvb.exe
  2⤵
  PID:11952
- C:\Windows\System\wMGcQJG.exe
  C:\Windows\System\wMGcQJG.exe
  2⤵
  PID:11968
- C:\Windows\System\gUlgaUA.exe
  C:\Windows\System\gUlgaUA.exe
  2⤵
  PID:11984
- C:\Windows\System\KImCJJM.exe
  C:\Windows\System\KImCJJM.exe
  2⤵
  PID:12000
- C:\Windows\System\llawGAy.exe
  C:\Windows\System\llawGAy.exe
  2⤵
  PID:12016
- C:\Windows\System\RYGWRAj.exe
  C:\Windows\System\RYGWRAj.exe
  2⤵
  PID:12040
- C:\Windows\System\hrJotDn.exe
  C:\Windows\System\hrJotDn.exe
  2⤵
  PID:12060
- C:\Windows\System\CfsFHBc.exe
  C:\Windows\System\CfsFHBc.exe
  2⤵
  PID:12148
- C:\Windows\System\CYtUIHI.exe
  C:\Windows\System\CYtUIHI.exe
  2⤵
  PID:12176
- C:\Windows\System\fmctfPN.exe
  C:\Windows\System\fmctfPN.exe
  2⤵
  PID:12200
- C:\Windows\System\yyATTcq.exe
  C:\Windows\System\yyATTcq.exe
  2⤵
  PID:12220
- C:\Windows\System\cNfxtpD.exe
  C:\Windows\System\cNfxtpD.exe
  2⤵
  PID:12244
- C:\Windows\System\vcrgWTZ.exe
  C:\Windows\System\vcrgWTZ.exe
  2⤵
  PID:12260
- C:\Windows\System\BnPihSR.exe
  C:\Windows\System\BnPihSR.exe
  2⤵
  PID:12276
- C:\Windows\System\uPshtML.exe
  C:\Windows\System\uPshtML.exe
  2⤵
  PID:1368
- C:\Windows\System\xbluwCm.exe
  C:\Windows\System\xbluwCm.exe
  2⤵
  PID:11092
- C:\Windows\System\ekrkxdg.exe
  C:\Windows\System\ekrkxdg.exe
  2⤵
  PID:10364
- C:\Windows\System\IaHJjES.exe
  C:\Windows\System\IaHJjES.exe
  2⤵
  PID:10592
- C:\Windows\System\AULoNSn.exe
  C:\Windows\System\AULoNSn.exe
  2⤵
  PID:10916
- C:\Windows\System\vYozBFT.exe
  C:\Windows\System\vYozBFT.exe
  2⤵
  PID:10960
- C:\Windows\System\qnTSvkS.exe
  C:\Windows\System\qnTSvkS.exe
  2⤵
  PID:10712
- C:\Windows\System\SttRBhO.exe
  C:\Windows\System\SttRBhO.exe
  2⤵
  PID:11156
- C:\Windows\System\cOBpkxI.exe
  C:\Windows\System\cOBpkxI.exe
  2⤵
  PID:11396
- C:\Windows\System\bibmmzQ.exe
  C:\Windows\System\bibmmzQ.exe
  2⤵
  PID:10676
- C:\Windows\System\vuPbROA.exe
  C:\Windows\System\vuPbROA.exe
  2⤵
  PID:11444
- C:\Windows\System\YhHkXXZ.exe
  C:\Windows\System\YhHkXXZ.exe
  2⤵
  PID:11484
- C:\Windows\System\DrgxGQD.exe
  C:\Windows\System\DrgxGQD.exe
  2⤵
  PID:11508
- C:\Windows\System\sGUYUPt.exe
  C:\Windows\System\sGUYUPt.exe
  2⤵
  PID:11540
- C:\Windows\System\ZcwnypY.exe
  C:\Windows\System\ZcwnypY.exe
  2⤵
  PID:8748
- C:\Windows\System\iIViWpV.exe
  C:\Windows\System\iIViWpV.exe
  2⤵
  PID:11596
- C:\Windows\System\vorYmqd.exe
  C:\Windows\System\vorYmqd.exe
  2⤵
  PID:11624
- C:\Windows\System\MfivVXv.exe
  C:\Windows\System\MfivVXv.exe
  2⤵
  PID:11740
- C:\Windows\System\FVqusYD.exe
  C:\Windows\System\FVqusYD.exe
  2⤵
  PID:11796
- C:\Windows\System\McawUzG.exe
  C:\Windows\System\McawUzG.exe
  2⤵
  PID:11704
- C:\Windows\System\yJJErxg.exe
  C:\Windows\System\yJJErxg.exe
  2⤵
  PID:11944
- C:\Windows\System\RpAUwXv.exe
  C:\Windows\System\RpAUwXv.exe
  2⤵
  PID:11760
- C:\Windows\System\shRNLWG.exe
  C:\Windows\System\shRNLWG.exe
  2⤵
  PID:12272
- C:\Windows\System\OpPIEAi.exe
  C:\Windows\System\OpPIEAi.exe
  2⤵
  PID:4252
- C:\Windows\System\jjamhAL.exe
  C:\Windows\System\jjamhAL.exe
  2⤵
  PID:11468
- C:\Windows\System\HvpDtMd.exe
  C:\Windows\System\HvpDtMd.exe
  2⤵
  PID:11524
- C:\Windows\System\tAxMNBl.exe
  C:\Windows\System\tAxMNBl.exe
  2⤵
  PID:10964
- C:\Windows\System\aogIotb.exe
  C:\Windows\System\aogIotb.exe
  2⤵
  PID:10560
- C:\Windows\System\UfMDLfG.exe
  C:\Windows\System\UfMDLfG.exe
  2⤵
  PID:10272
- C:\Windows\System\VgxmvlA.exe
  C:\Windows\System\VgxmvlA.exe
  2⤵
  PID:11844
- C:\Windows\System\oBemJFW.exe
  C:\Windows\System\oBemJFW.exe
  2⤵
  PID:12292
- C:\Windows\System\FamAWCy.exe
  C:\Windows\System\FamAWCy.exe
  2⤵
  PID:12320
- C:\Windows\System\KmpDVYW.exe
  C:\Windows\System\KmpDVYW.exe
  2⤵
  PID:12340
- C:\Windows\System\MiyOpve.exe
  C:\Windows\System\MiyOpve.exe
  2⤵
  PID:12364
- C:\Windows\System\qhDNFJT.exe
  C:\Windows\System\qhDNFJT.exe
  2⤵
  PID:12384
- C:\Windows\System\RbUgvZM.exe
  C:\Windows\System\RbUgvZM.exe
  2⤵
  PID:12432
- C:\Windows\System\YBEsCEQ.exe
  C:\Windows\System\YBEsCEQ.exe
  2⤵
  PID:12456
- C:\Windows\System\ZaFwIkt.exe
  C:\Windows\System\ZaFwIkt.exe
  2⤵
  PID:12472
- C:\Windows\System\UGLqaYo.exe
  C:\Windows\System\UGLqaYo.exe
  2⤵
  PID:12500
- C:\Windows\System\hvLYsfH.exe
  C:\Windows\System\hvLYsfH.exe
  2⤵
  PID:12520
- C:\Windows\System\oQAQktM.exe
  C:\Windows\System\oQAQktM.exe
  2⤵
  PID:12540
- C:\Windows\System\hmwwQTN.exe
  C:\Windows\System\hmwwQTN.exe
  2⤵
  PID:12564
- C:\Windows\System\uEHKbHi.exe
  C:\Windows\System\uEHKbHi.exe
  2⤵
  PID:12584
- C:\Windows\System\cmUPWUB.exe
  C:\Windows\System\cmUPWUB.exe
  2⤵
  PID:12604
- C:\Windows\System\vdtVuWI.exe
  C:\Windows\System\vdtVuWI.exe
  2⤵
  PID:12636
- C:\Windows\System\uxrIxRI.exe
  C:\Windows\System\uxrIxRI.exe
  2⤵
  PID:12656
- C:\Windows\System\rFDWcFd.exe
  C:\Windows\System\rFDWcFd.exe
  2⤵
  PID:12676
- C:\Windows\System\iTSMBfh.exe
  C:\Windows\System\iTSMBfh.exe
  2⤵
  PID:12696
- C:\Windows\System\bkIQBQx.exe
  C:\Windows\System\bkIQBQx.exe
  2⤵
  PID:12720
- C:\Windows\System\FIfJuXM.exe
  C:\Windows\System\FIfJuXM.exe
  2⤵
  PID:12744
- C:\Windows\System\KqbJOJD.exe
  C:\Windows\System\KqbJOJD.exe
  2⤵
  PID:12764
- C:\Windows\System\dtcZDgY.exe
  C:\Windows\System\dtcZDgY.exe
  2⤵
  PID:12788
- C:\Windows\System\gsPOUuy.exe
  C:\Windows\System\gsPOUuy.exe
  2⤵
  PID:12808
- C:\Windows\System\zAZJJCC.exe
  C:\Windows\System\zAZJJCC.exe
  2⤵
  PID:12828
- C:\Windows\System\CIshEYz.exe
  C:\Windows\System\CIshEYz.exe
  2⤵
  PID:12852
- C:\Windows\System\PutnfXv.exe
  C:\Windows\System\PutnfXv.exe
  2⤵
  PID:12876
- C:\Windows\System\cPTAxCh.exe
  C:\Windows\System\cPTAxCh.exe
  2⤵
  PID:12896
- C:\Windows\System\nkjismn.exe
  C:\Windows\System\nkjismn.exe
  2⤵
  PID:12920
- C:\Windows\System\wvDrGms.exe
  C:\Windows\System\wvDrGms.exe
  2⤵
  PID:12944
- C:\Windows\System\eGFLhog.exe
  C:\Windows\System\eGFLhog.exe
  2⤵
  PID:11720
- C:\Windows\System\RRlfiKf.exe
  C:\Windows\System\RRlfiKf.exe
  2⤵
  PID:12352
- C:\Windows\System\WRepJSt.exe
  C:\Windows\System\WRepJSt.exe
  2⤵
  PID:10808
- C:\Windows\System\pSjSkjE.exe
  C:\Windows\System\pSjSkjE.exe
  2⤵
  PID:3516
- C:\Windows\System\ENRBWyc.exe
  C:\Windows\System\ENRBWyc.exe
  2⤵
  PID:10944
- C:\Windows\System\ljVqwEJ.exe
  C:\Windows\System\ljVqwEJ.exe
  2⤵
  PID:12848
- C:\Windows\System\FzAUmkg.exe
  C:\Windows\System\FzAUmkg.exe
  2⤵
  PID:12904
- C:\Windows\System\cntPeRt.exe
  C:\Windows\System\cntPeRt.exe
  2⤵
  PID:12692
- C:\Windows\System\mKqmuqf.exe
  C:\Windows\System\mKqmuqf.exe
  2⤵
  PID:11992
- C:\Windows\System\DJWACoy.exe
  C:\Windows\System\DJWACoy.exe
  2⤵
  PID:12316
- C:\Windows\System\TbUZAGN.exe
  C:\Windows\System\TbUZAGN.exe
  2⤵
  PID:12452
- C:\Windows\System\KayQqoI.exe
  C:\Windows\System\KayQqoI.exe
  2⤵
  PID:12508
- C:\Windows\System\qMVDVuD.exe
  C:\Windows\System\qMVDVuD.exe
  2⤵
  PID:12548
- C:\Windows\System\JAhYzQq.exe
  C:\Windows\System\JAhYzQq.exe
  2⤵
  PID:12612
- C:\Windows\System\dhUhMFV.exe
  C:\Windows\System\dhUhMFV.exe
  2⤵
  PID:12668
- C:\Windows\System\mSQXEEY.exe
  C:\Windows\System\mSQXEEY.exe
  2⤵
  PID:12756
- C:\Windows\System\awAkxFh.exe
  C:\Windows\System\awAkxFh.exe
  2⤵
  PID:12752
- C:\Windows\System\xeRYAhF.exe
  C:\Windows\System\xeRYAhF.exe
  2⤵
  PID:9736
- C:\Windows\System\jwXDFlm.exe
  C:\Windows\System\jwXDFlm.exe
  2⤵
  PID:13184
- C:\Windows\System\YZvZRrW.exe
  C:\Windows\System\YZvZRrW.exe
  2⤵
  PID:380
- C:\Windows\System\TPUNUqP.exe
  C:\Windows\System\TPUNUqP.exe
  2⤵
  PID:12480
- C:\Windows\System\qZvVTvd.exe
  C:\Windows\System\qZvVTvd.exe
  2⤵
  PID:1648
- C:\Windows\System\PRMQcSx.exe
  C:\Windows\System\PRMQcSx.exe
  2⤵
  PID:13168
- C:\Windows\System\BxcaQsK.exe
  C:\Windows\System\BxcaQsK.exe
  2⤵
  PID:13264
- C:\Windows\System\GfGuuHQ.exe
  C:\Windows\System\GfGuuHQ.exe
  2⤵
  PID:11108
- C:\Windows\System\XDLNVKa.exe
  C:\Windows\System\XDLNVKa.exe
  2⤵
  PID:12864
- C:\Windows\System\JculjQn.exe
  C:\Windows\System\JculjQn.exe
  2⤵
  PID:4272
- C:\Windows\System\GdzhHPe.exe
  C:\Windows\System\GdzhHPe.exe
  2⤵
  PID:12740
- C:\Windows\System\BOVfKxd.exe
  C:\Windows\System\BOVfKxd.exe
  2⤵
  PID:10648
- C:\Windows\System\WdycPaZ.exe
  C:\Windows\System\WdycPaZ.exe
  2⤵
  PID:12664
- C:\Windows\System\RVSgqzl.exe
  C:\Windows\System\RVSgqzl.exe
  2⤵
  PID:2468
- C:\Windows\System\jAFmhod.exe
  C:\Windows\System\jAFmhod.exe
  2⤵
  PID:11132
- C:\Windows\System\QemOpLA.exe
  C:\Windows\System\QemOpLA.exe
  2⤵
  PID:5108
- C:\Windows\System\RQSKyAY.exe
  C:\Windows\System\RQSKyAY.exe
  2⤵
  PID:3668
- C:\Windows\System\MzpyyXM.exe
  C:\Windows\System\MzpyyXM.exe
  2⤵
  PID:444
- C:\Windows\System\EjTltHR.exe
  C:\Windows\System\EjTltHR.exe
  2⤵
  PID:4872
- C:\Windows\System\AddbbcQ.exe
  C:\Windows\System\AddbbcQ.exe
  2⤵
  PID:2100
- C:\Windows\System\qsLSgvW.exe
  C:\Windows\System\qsLSgvW.exe
  2⤵
  PID:11592
- C:\Windows\System\oTsTfRp.exe
  C:\Windows\System\oTsTfRp.exe
  2⤵
  PID:3968
- C:\Windows\System\ZKtECHu.exe
  C:\Windows\System\ZKtECHu.exe
  2⤵
  PID:4604
- C:\Windows\System\ZaPyUeF.exe
  C:\Windows\System\ZaPyUeF.exe
  2⤵
  PID:3304
- C:\Windows\System\jBkIckK.exe
  C:\Windows\System\jBkIckK.exe
  2⤵
  PID:2116
- C:\Windows\System\jZkvDsg.exe
  C:\Windows\System\jZkvDsg.exe
  2⤵
  PID:13248
- C:\Windows\System\eWlGnZN.exe
  C:\Windows\System\eWlGnZN.exe
  2⤵
  PID:4216
- C:\Windows\System\JtKzbrC.exe
  C:\Windows\System\JtKzbrC.exe
  2⤵
  PID:13300
- C:\Windows\System\wUzlXYz.exe
  C:\Windows\System\wUzlXYz.exe
  2⤵
  PID:13408
- C:\Windows\System\cBIAQDq.exe
  C:\Windows\System\cBIAQDq.exe
  2⤵
  PID:13656
- C:\Windows\System\enkBSzw.exe
  C:\Windows\System\enkBSzw.exe
  2⤵
  PID:13684
- C:\Windows\System\QZIGEir.exe
  C:\Windows\System\QZIGEir.exe
  2⤵
  PID:13724
- C:\Windows\System\YjTdgUr.exe
  C:\Windows\System\YjTdgUr.exe
  2⤵
  PID:13740
- C:\Windows\System\zqGKaIt.exe
  C:\Windows\System\zqGKaIt.exe
  2⤵
  PID:13756
- C:\Windows\System\ggpAxTu.exe
  C:\Windows\System\ggpAxTu.exe
  2⤵
  PID:13840
- C:\Windows\System\fOGatpn.exe
  C:\Windows\System\fOGatpn.exe
  2⤵
  PID:14052
- C:\Windows\System\XeQBDSb.exe
  C:\Windows\System\XeQBDSb.exe
  2⤵
  PID:14068
- C:\Windows\System\VeDUjOo.exe
  C:\Windows\System\VeDUjOo.exe
  2⤵
  PID:14084
- C:\Windows\System\yDMHrMk.exe
  C:\Windows\System\yDMHrMk.exe
  2⤵
  PID:14104
- C:\Windows\System\hfkKhfF.exe
  C:\Windows\System\hfkKhfF.exe
  2⤵
  PID:14132
- C:\Windows\System\AAxFJPo.exe
  C:\Windows\System\AAxFJPo.exe
  2⤵
  PID:14296
- C:\Windows\System\OhzGdAP.exe
  C:\Windows\System\OhzGdAP.exe
  2⤵
  PID:4000
- C:\Windows\System\UNUnqSq.exe
  C:\Windows\System\UNUnqSq.exe
  2⤵
  PID:13356
- C:\Windows\System\pzqBsVu.exe
  C:\Windows\System\pzqBsVu.exe
  2⤵
  PID:12648
- C:\Windows\System\IAWhMYx.exe
  C:\Windows\System\IAWhMYx.exe
  2⤵
  PID:13376
- C:\Windows\System\yccrrRa.exe
  C:\Windows\System\yccrrRa.exe
  2⤵
  PID:4296
- C:\Windows\System\oyaXYfk.exe
  C:\Windows\System\oyaXYfk.exe
  2⤵
  PID:3960
- C:\Windows\System\guzsbrc.exe
  C:\Windows\System\guzsbrc.exe
  2⤵
  PID:1624
- C:\Windows\System\pgeYtlJ.exe
  C:\Windows\System\pgeYtlJ.exe
  2⤵
  PID:5228
- C:\Windows\System\IyzVgHO.exe
  C:\Windows\System\IyzVgHO.exe
  2⤵
  PID:2248
- C:\Windows\System\ncrFQDX.exe
  C:\Windows\System\ncrFQDX.exe
  2⤵
  PID:13512
- C:\Windows\System\fzbvBwe.exe
  C:\Windows\System\fzbvBwe.exe
  2⤵
  PID:13872
- C:\Windows\System\mLiUClH.exe
  C:\Windows\System\mLiUClH.exe
  2⤵
  PID:13964
- C:\Windows\System\ypauXda.exe
  C:\Windows\System\ypauXda.exe
  2⤵
  PID:13988
- C:\Windows\System\iDvQtKy.exe
  C:\Windows\System\iDvQtKy.exe
  2⤵
  PID:13556
- C:\Windows\System\ehGAhcq.exe
  C:\Windows\System\ehGAhcq.exe
  2⤵
  PID:13604
- C:\Windows\System\RMVTzQq.exe
  C:\Windows\System\RMVTzQq.exe
  2⤵
  PID:14028
- C:\Windows\System\FjQvuFd.exe
  C:\Windows\System\FjQvuFd.exe
  2⤵
  PID:13644
- C:\Windows\System\vxlczxQ.exe
  C:\Windows\System\vxlczxQ.exe
  2⤵
  PID:13972
- C:\Windows\System\hRVunmw.exe
  C:\Windows\System\hRVunmw.exe
  2⤵
  PID:14196
- C:\Windows\System\AOVjeLP.exe
  C:\Windows\System\AOVjeLP.exe
  2⤵
  PID:13864
- C:\Windows\System\ADXflXe.exe
  C:\Windows\System\ADXflXe.exe
  2⤵
  PID:3984
- C:\Windows\System\uNkqkrb.exe
  C:\Windows\System\uNkqkrb.exe
  2⤵
  PID:13908
- C:\Windows\System\kOZfbuz.exe
  C:\Windows\System\kOZfbuz.exe
  2⤵
  PID:13308
- C:\Windows\System\smzehyF.exe
  C:\Windows\System\smzehyF.exe
  2⤵
  PID:14156
- C:\Windows\System\rBMZwPZ.exe
  C:\Windows\System\rBMZwPZ.exe
  2⤵
  PID:14116
- C:\Windows\System\EVWqPcQ.exe
  C:\Windows\System\EVWqPcQ.exe
  2⤵
  PID:13732
- C:\Windows\System\nhdpjuv.exe
  C:\Windows\System\nhdpjuv.exe
  2⤵
  PID:3456
- C:\Windows\System\hDIwfpV.exe
  C:\Windows\System\hDIwfpV.exe
  2⤵
  PID:14188
- C:\Windows\System\wRZWDUE.exe
  C:\Windows\System\wRZWDUE.exe
  2⤵
  PID:13152
- C:\Windows\System\uPYbfJQ.exe
  C:\Windows\System\uPYbfJQ.exe
  2⤵
  PID:14204
- C:\Windows\System\dBIwrLy.exe
  C:\Windows\System\dBIwrLy.exe
  2⤵
  PID:14252
- C:\Windows\System\cImHEPc.exe
  C:\Windows\System\cImHEPc.exe
  2⤵
  PID:14312
- C:\Windows\System\LosonSh.exe
  C:\Windows\System\LosonSh.exe
  2⤵
  PID:13232
- C:\Windows\System\UDhsopx.exe
  C:\Windows\System\UDhsopx.exe
  2⤵
  PID:14164
- C:\Windows\System\CSTNWWl.exe
  C:\Windows\System\CSTNWWl.exe
  2⤵
  PID:14200
- C:\Windows\System\rcNSxOZ.exe
  C:\Windows\System\rcNSxOZ.exe
  2⤵
  PID:4572
- C:\Windows\System\hqOIjiy.exe
  C:\Windows\System\hqOIjiy.exe
  2⤵
  PID:14288
- C:\Windows\System\PnQUJkh.exe
  C:\Windows\System\PnQUJkh.exe
  2⤵
  PID:12844
- C:\Windows\System\zbCktDc.exe
  C:\Windows\System\zbCktDc.exe
  2⤵
  PID:13524
- C:\Windows\System\SUYmjMf.exe
  C:\Windows\System\SUYmjMf.exe
  2⤵
  PID:1800
- C:\Windows\System\hRqsWYg.exe
  C:\Windows\System\hRqsWYg.exe
  2⤵
  PID:13624
- C:\Windows\System\JETmdMB.exe
  C:\Windows\System\JETmdMB.exe
  2⤵
  PID:13804
- C:\Windows\System\XCXUPSD.exe
  C:\Windows\System\XCXUPSD.exe
  2⤵
  PID:13628
- C:\Windows\System\xQtsfSC.exe
  C:\Windows\System\xQtsfSC.exe
  2⤵
  PID:2892
- C:\Windows\System\jdgUKgW.exe
  C:\Windows\System\jdgUKgW.exe
  2⤵
  PID:14236
- C:\Windows\System\KTYNyPF.exe
  C:\Windows\System\KTYNyPF.exe
  2⤵
  PID:14044
- C:\Windows\System\gVvbCAz.exe
  C:\Windows\System\gVvbCAz.exe
  2⤵
  PID:13784
- C:\Windows\System\ktiCjCp.exe
  C:\Windows\System\ktiCjCp.exe
  2⤵
  PID:14284
- C:\Windows\System\ILurtWm.exe
  C:\Windows\System\ILurtWm.exe
  2⤵
  PID:5532
- C:\Windows\System\KiGHLdy.exe
  C:\Windows\System\KiGHLdy.exe
  2⤵
  PID:2916
- C:\Windows\System\LsKBTOg.exe
  C:\Windows\System\LsKBTOg.exe
  2⤵
  PID:14172
- C:\Windows\System\ppqEiXd.exe
  C:\Windows\System\ppqEiXd.exe
  2⤵
  PID:13424
- C:\Windows\System\wxpknpM.exe
  C:\Windows\System\wxpknpM.exe
  2⤵
  PID:3552
- C:\Windows\System\rRtPRsK.exe
  C:\Windows\System\rRtPRsK.exe
  2⤵
  PID:13216
- C:\Windows\System\hMWkvhq.exe
  C:\Windows\System\hMWkvhq.exe
  2⤵
  PID:2412
- C:\Windows\System\pbdFutm.exe
  C:\Windows\System\pbdFutm.exe
  2⤵
  PID:1832
- C:\Windows\System\IsFpYme.exe
  C:\Windows\System\IsFpYme.exe
  2⤵
  PID:408
- C:\Windows\System\nsDSqbt.exe
  C:\Windows\System\nsDSqbt.exe
  2⤵
  PID:1104
- C:\Windows\System\AZtanKv.exe
  C:\Windows\System\AZtanKv.exe
  2⤵
  PID:13836
- C:\Windows\System\TrGYpjJ.exe
  C:\Windows\System\TrGYpjJ.exe
  2⤵
  PID:4132
- C:\Windows\System\yhOgaqL.exe
  C:\Windows\System\yhOgaqL.exe
  2⤵
  PID:3900
- C:\Windows\System\cafEjxx.exe
  C:\Windows\System\cafEjxx.exe
  2⤵
  PID:4020
- C:\Windows\System\ZVVMWgR.exe
  C:\Windows\System\ZVVMWgR.exe
  2⤵
  PID:12440
- C:\Windows\System\nInhBDh.exe
  C:\Windows\System\nInhBDh.exe
  2⤵
  PID:13752
- C:\Windows\System\doDqVYa.exe
  C:\Windows\System\doDqVYa.exe
  2⤵
  PID:14224
- C:\Windows\System\RuYSUVZ.exe
  C:\Windows\System\RuYSUVZ.exe
  2⤵
  PID:12772
- C:\Windows\System\rhRSQGR.exe
  C:\Windows\System\rhRSQGR.exe
  2⤵
  PID:13492
- C:\Windows\System\mmGYEaG.exe
  C:\Windows\System\mmGYEaG.exe
  2⤵
  PID:2204
- C:\Windows\System\ZasoSFx.exe
  C:\Windows\System\ZasoSFx.exe
  2⤵
  PID:2480
- C:\Windows\System\ryYIqBJ.exe
  C:\Windows\System\ryYIqBJ.exe
  2⤵
  PID:4960
- C:\Windows\System\ZOCImhD.exe
  C:\Windows\System\ZOCImhD.exe
  2⤵
  PID:13888
- C:\Windows\System\CEkfZuE.exe
  C:\Windows\System\CEkfZuE.exe
  2⤵
  PID:6068
- C:\Windows\System\aleesZa.exe
  C:\Windows\System\aleesZa.exe
  2⤵
  PID:14036
- C:\Windows\System\jrYmcTk.exe
  C:\Windows\System\jrYmcTk.exe
  2⤵
  PID:14124
- C:\Windows\System\WQvWqsh.exe
  C:\Windows\System\WQvWqsh.exe
  2⤵
  PID:5700
- C:\Windows\System\CnKMIhc.exe
  C:\Windows\System\CnKMIhc.exe
  2⤵
  PID:5780
- C:\Windows\System\nMtDmHH.exe
  C:\Windows\System\nMtDmHH.exe
  2⤵
  PID:5864
- C:\Windows\System\WaFWAld.exe
  C:\Windows\System\WaFWAld.exe
  2⤵
  PID:5292
- C:\Windows\System\mxzqzcj.exe
  C:\Windows\System\mxzqzcj.exe
  2⤵
  PID:5984
- C:\Windows\System\catgwnN.exe
  C:\Windows\System\catgwnN.exe
  2⤵
  PID:5588
- C:\Windows\System\eNjYMzo.exe
  C:\Windows\System\eNjYMzo.exe
  2⤵
  PID:1628
- C:\Windows\System\EPizmaJ.exe
  C:\Windows\System\EPizmaJ.exe
  2⤵
  PID:14012
- C:\Windows\System\DvdOjSJ.exe
  C:\Windows\System\DvdOjSJ.exe
  2⤵
  PID:6876
- C:\Windows\System\GiEFZTL.exe
  C:\Windows\System\GiEFZTL.exe
  2⤵
  PID:3164
- C:\Windows\System\kAxUvxB.exe
  C:\Windows\System\kAxUvxB.exe
  2⤵
  PID:6720
- C:\Windows\System\aemgBbM.exe
  C:\Windows\System\aemgBbM.exe
  2⤵
  PID:768
- C:\Windows\System\NpitTBB.exe
  C:\Windows\System\NpitTBB.exe
  2⤵
  PID:13348
- C:\Windows\System\QIkmSSP.exe
  C:\Windows\System\QIkmSSP.exe
  2⤵
  PID:6400
- C:\Windows\System\RtXPgzb.exe
  C:\Windows\System\RtXPgzb.exe
  2⤵
  PID:14040
- C:\Windows\System\dDyxBLg.exe
  C:\Windows\System\dDyxBLg.exe
  2⤵
  PID:5260
- C:\Windows\System\fJLUirU.exe
  C:\Windows\System\fJLUirU.exe
  2⤵
  PID:6576
- C:\Windows\System\vyyDNgY.exe
  C:\Windows\System\vyyDNgY.exe
  2⤵
  PID:7148
- C:\Windows\System\isJzarP.exe
  C:\Windows\System\isJzarP.exe
  2⤵
  PID:5080
- C:\Windows\System\IHXytIk.exe
  C:\Windows\System\IHXytIk.exe
  2⤵
  PID:6296
- C:\Windows\System\DsxxuBl.exe
  C:\Windows\System\DsxxuBl.exe
  2⤵
  PID:13636
- C:\Windows\System\YdYcvjI.exe
  C:\Windows\System\YdYcvjI.exe
  2⤵
  PID:12996
- C:\Windows\System\aFmiqnz.exe
  C:\Windows\System\aFmiqnz.exe
  2⤵
  PID:13488
- C:\Windows\System\jnyKWsC.exe
  C:\Windows\System\jnyKWsC.exe
  2⤵
  PID:5252
- C:\Windows\System\HOZxzKd.exe
  C:\Windows\System\HOZxzKd.exe
  2⤵
  PID:3592
- C:\Windows\System\ntvlins.exe
  C:\Windows\System\ntvlins.exe
  2⤵
  PID:6200
- C:\Windows\System\giEZTgb.exe
  C:\Windows\System\giEZTgb.exe
  2⤵
  PID:5332
- C:\Windows\System\oBmRThR.exe
  C:\Windows\System\oBmRThR.exe
  2⤵
  PID:1244
- C:\Windows\System\fBbufrE.exe
  C:\Windows\System\fBbufrE.exe
  2⤵
  PID:5308
- C:\Windows\System\nBPVSeS.exe
  C:\Windows\System\nBPVSeS.exe
  2⤵
  PID:13920
- C:\Windows\System\qcbQCVI.exe
  C:\Windows\System\qcbQCVI.exe
  2⤵
  PID:6220
- C:\Windows\System\dIhnGIW.exe
  C:\Windows\System\dIhnGIW.exe
  2⤵
  PID:5872
- C:\Windows\System\JTiBpXB.exe
  C:\Windows\System\JTiBpXB.exe
  2⤵
  PID:6980
- C:\Windows\System\NZEwiwS.exe
  C:\Windows\System\NZEwiwS.exe
  2⤵
  PID:13984
- C:\Windows\System\IEFHGKn.exe
  C:\Windows\System\IEFHGKn.exe
  2⤵
  PID:13736
- C:\Windows\System\quohBpZ.exe
  C:\Windows\System\quohBpZ.exe
  2⤵
  PID:6380
- C:\Windows\System\nJNvNmX.exe
  C:\Windows\System\nJNvNmX.exe
  2⤵
  PID:14244
- C:\Windows\System\hDILZgX.exe
  C:\Windows\System\hDILZgX.exe
  2⤵
  PID:6448
- C:\Windows\System\OedDdth.exe
  C:\Windows\System\OedDdth.exe
  2⤵
  PID:6480
- C:\Windows\System\XJmIlAL.exe
  C:\Windows\System\XJmIlAL.exe
  2⤵
  PID:6772
- C:\Windows\System\qqtTcVT.exe
  C:\Windows\System\qqtTcVT.exe
  2⤵
  PID:6572
- C:\Windows\System\pCmpMmT.exe
  C:\Windows\System\pCmpMmT.exe
  2⤵
  PID:7000
- C:\Windows\System\ixWXXrq.exe
  C:\Windows\System\ixWXXrq.exe
  2⤵
  PID:6004
- C:\Windows\System\OYTrAsI.exe
  C:\Windows\System\OYTrAsI.exe
  2⤵
  PID:5576
- C:\Windows\System\kiErVSb.exe
  C:\Windows\System\kiErVSb.exe
  2⤵
  PID:14280
- C:\Windows\System\TgqwZoB.exe
  C:\Windows\System\TgqwZoB.exe
  2⤵
  PID:7040
- C:\Windows\System\JrcqdMu.exe
  C:\Windows\System\JrcqdMu.exe
  2⤵
  PID:5988
- C:\Windows\System\IrOCMZa.exe
  C:\Windows\System\IrOCMZa.exe
  2⤵
  PID:2352
- C:\Windows\System\qGOuXru.exe
  C:\Windows\System\qGOuXru.exe
  2⤵
  PID:7356
- C:\Windows\System\FXOAofw.exe
  C:\Windows\System\FXOAofw.exe
  2⤵
  PID:7396
- C:\Windows\System\pNIdXPD.exe
  C:\Windows\System\pNIdXPD.exe
  2⤵
  PID:5868
- C:\Windows\System\EnaHqaW.exe
  C:\Windows\System\EnaHqaW.exe
  2⤵
  PID:7372
- C:\Windows\System\DWkCjaw.exe
  C:\Windows\System\DWkCjaw.exe
  2⤵
  PID:7376
- C:\Windows\System\YlnbTNs.exe
  C:\Windows\System\YlnbTNs.exe
  2⤵
  PID:7400
- C:\Windows\System\LIhczUN.exe
  C:\Windows\System\LIhczUN.exe
  2⤵
  PID:13240
- C:\Windows\System\kSVFeiE.exe
  C:\Windows\System\kSVFeiE.exe
  2⤵
  PID:2004
- C:\Windows\System\xpaUrcF.exe
  C:\Windows\System\xpaUrcF.exe
  2⤵
  PID:14148
- C:\Windows\System\zlBYuEC.exe
  C:\Windows\System\zlBYuEC.exe
  2⤵
  PID:13720
- C:\Windows\System\rQLXcqL.exe
  C:\Windows\System\rQLXcqL.exe
  2⤵
  PID:2308
- C:\Windows\System\kkVQdAx.exe
  C:\Windows\System\kkVQdAx.exe
  2⤵
  PID:7452
- C:\Windows\System\uuUmome.exe
  C:\Windows\System\uuUmome.exe
  2⤵
  PID:7608
- C:\Windows\System\HPCVlMT.exe
  C:\Windows\System\HPCVlMT.exe
  2⤵
  PID:7720
- C:\Windows\System\gmYmpQY.exe
  C:\Windows\System\gmYmpQY.exe
  2⤵
  PID:7472
- C:\Windows\System\gApZLAN.exe
  C:\Windows\System\gApZLAN.exe
  2⤵
  PID:7536
- C:\Windows\System\aKFZSOD.exe
  C:\Windows\System\aKFZSOD.exe
  2⤵
  PID:7560
- C:\Windows\System\rEbyBDb.exe
  C:\Windows\System\rEbyBDb.exe
  2⤵
  PID:7056
- C:\Windows\System\jLxUanQ.exe
  C:\Windows\System\jLxUanQ.exe
  2⤵
  PID:7900
- C:\Windows\System\xTaucLV.exe
  C:\Windows\System\xTaucLV.exe
  2⤵
  PID:13820
- C:\Windows\System\VHxyCsj.exe
  C:\Windows\System\VHxyCsj.exe
  2⤵
  PID:7920
- C:\Windows\System\UpWYGKr.exe
  C:\Windows\System\UpWYGKr.exe
  2⤵
  PID:492
- C:\Windows\System\mLIayXt.exe
  C:\Windows\System\mLIayXt.exe
  2⤵
  PID:7524
- C:\Windows\System\sayqQfK.exe
  C:\Windows\System\sayqQfK.exe
  2⤵
  PID:13992
- C:\Windows\System\mkEBpIb.exe
  C:\Windows\System\mkEBpIb.exe
  2⤵
  PID:2596
- C:\Windows\System\eNJpAAm.exe
  C:\Windows\System\eNJpAAm.exe
  2⤵
  PID:13440
- C:\Windows\System\nakwRTu.exe
  C:\Windows\System\nakwRTu.exe
  2⤵
  PID:7888
- C:\Windows\System\PpOGuIR.exe
  C:\Windows\System\PpOGuIR.exe
  2⤵
  PID:5536
- C:\Windows\System\tnDVQbJ.exe
  C:\Windows\System\tnDVQbJ.exe
  2⤵
  PID:7828
- C:\Windows\System\OEuuCJH.exe
  C:\Windows\System\OEuuCJH.exe
  2⤵
  PID:7872
- C:\Windows\System\NKqDCXs.exe
  C:\Windows\System\NKqDCXs.exe
  2⤵
  PID:5948
- C:\Windows\System\ukHdDhf.exe
  C:\Windows\System\ukHdDhf.exe
  2⤵
  PID:5688
- C:\Windows\System\gKnQddn.exe
  C:\Windows\System\gKnQddn.exe
  2⤵
  PID:7392
- C:\Windows\System\rKgFPlp.exe
  C:\Windows\System\rKgFPlp.exe
  2⤵
  PID:6316
- C:\Windows\System\gYFfmNT.exe
  C:\Windows\System\gYFfmNT.exe
  2⤵
  PID:6320
- C:\Windows\System\vtywQny.exe
  C:\Windows\System\vtywQny.exe
  2⤵
  PID:5880
- C:\Windows\System\kmAPHOl.exe
  C:\Windows\System\kmAPHOl.exe
  2⤵
  PID:3948
- C:\Windows\System\kDnVIKL.exe
  C:\Windows\System\kDnVIKL.exe
  2⤵
  PID:6548
- C:\Windows\System\dwamnIJ.exe
  C:\Windows\System\dwamnIJ.exe
  2⤵
  PID:7244
- C:\Windows\System\pLqvszK.exe
  C:\Windows\System\pLqvszK.exe
  2⤵
  PID:7684
- C:\Windows\System\CpHgcjT.exe
  C:\Windows\System\CpHgcjT.exe
  2⤵
  PID:7248
- C:\Windows\System\PpWEAaB.exe
  C:\Windows\System\PpWEAaB.exe
  2⤵
  PID:7384
- C:\Windows\System\yaocDAr.exe
  C:\Windows\System\yaocDAr.exe
  2⤵
  PID:5348
- C:\Windows\System\jGezcRd.exe
  C:\Windows\System\jGezcRd.exe
  2⤵
  PID:5724
- C:\Windows\System\WBElIHr.exe
  C:\Windows\System\WBElIHr.exe
  2⤵
  PID:14352
- C:\Windows\System\lDuAwjq.exe
  C:\Windows\System\lDuAwjq.exe
  2⤵
  PID:14380
- C:\Windows\System\wSdcPva.exe
  C:\Windows\System\wSdcPva.exe
  2⤵
  PID:14400
- C:\Windows\System\WzTnbcR.exe
  C:\Windows\System\WzTnbcR.exe
  2⤵
  PID:14428
- C:\Windows\System\gSqKMmn.exe
  C:\Windows\System\gSqKMmn.exe
  2⤵
  PID:14456
- C:\Windows\System\MuEkSiU.exe
  C:\Windows\System\MuEkSiU.exe
  2⤵
  PID:14476
- C:\Windows\System\XjlHZTQ.exe
  C:\Windows\System\XjlHZTQ.exe
  2⤵
  PID:14504
- C:\Windows\System\klFBCha.exe
  C:\Windows\System\klFBCha.exe
  2⤵
  PID:14524
- C:\Windows\System\WBXgJgQ.exe
  C:\Windows\System\WBXgJgQ.exe
  2⤵
  PID:14544
- C:\Windows\System\oSDfHRA.exe
  C:\Windows\System\oSDfHRA.exe
  2⤵
  PID:14572
- C:\Windows\System\gwFnmpS.exe
  C:\Windows\System\gwFnmpS.exe
  2⤵
  PID:14600
- C:\Windows\System\FIlyynb.exe
  C:\Windows\System\FIlyynb.exe
  2⤵
  PID:14616
- C:\Windows\System\GwyIVHH.exe
  C:\Windows\System\GwyIVHH.exe
  2⤵
  PID:14644
- C:\Windows\System\pynFPBr.exe
  C:\Windows\System\pynFPBr.exe
  2⤵
  PID:14668
- C:\Windows\System\eJyHvUI.exe
  C:\Windows\System\eJyHvUI.exe
  2⤵
  PID:14696
- C:\Windows\System\tSxjIdM.exe
  C:\Windows\System\tSxjIdM.exe
  2⤵
  PID:14716
- C:\Windows\System\WrfNIMn.exe
  C:\Windows\System\WrfNIMn.exe
  2⤵
  PID:14752
- C:\Windows\System\qCJZKJP.exe
  C:\Windows\System\qCJZKJP.exe
  2⤵
  PID:14776
- C:\Windows\System\xxDDMOo.exe
  C:\Windows\System\xxDDMOo.exe
  2⤵
  PID:14800
- C:\Windows\System\ySIDwKT.exe
  C:\Windows\System\ySIDwKT.exe
  2⤵
  PID:14816
- C:\Windows\System\RoJcRyJ.exe
  C:\Windows\System\RoJcRyJ.exe
  2⤵
  PID:14836
- C:\Windows\System\uqNYJkg.exe
  C:\Windows\System\uqNYJkg.exe
  2⤵
  PID:14852
- C:\Windows\System\ipIQHJr.exe
  C:\Windows\System\ipIQHJr.exe
  2⤵
  PID:14868
- C:\Windows\System\kbmqyzF.exe
  C:\Windows\System\kbmqyzF.exe
  2⤵
  PID:14888
- C:\Windows\System\MVvDAJc.exe
  C:\Windows\System\MVvDAJc.exe
  2⤵
  PID:14912
- C:\Windows\System\fPdrPtK.exe
  C:\Windows\System\fPdrPtK.exe
  2⤵
  PID:14940
- C:\Windows\System\ceyqqKa.exe
  C:\Windows\System\ceyqqKa.exe
  2⤵
  PID:14956
- C:\Windows\System\AqQBwmc.exe
  C:\Windows\System\AqQBwmc.exe
  2⤵
  PID:14976
- C:\Windows\System\YGMDRUc.exe
  C:\Windows\System\YGMDRUc.exe
  2⤵
  PID:15000
- C:\Windows\System\XGVTMGA.exe
  C:\Windows\System\XGVTMGA.exe
  2⤵
  PID:15028
- C:\Windows\System\CbMOdBN.exe
  C:\Windows\System\CbMOdBN.exe
  2⤵
  PID:15048
- C:\Windows\System\scnrxZM.exe
  C:\Windows\System\scnrxZM.exe
  2⤵
  PID:15068
- C:\Windows\System\ChnoLHE.exe
  C:\Windows\System\ChnoLHE.exe
  2⤵
  PID:15092
- C:\Windows\System\lfrpYUl.exe
  C:\Windows\System\lfrpYUl.exe
  2⤵
  PID:15112
- C:\Windows\System\ZVWdfRb.exe
  C:\Windows\System\ZVWdfRb.exe
  2⤵
  PID:15132
- C:\Windows\System\ZhkaBvy.exe
  C:\Windows\System\ZhkaBvy.exe
  2⤵
  PID:15156
- C:\Windows\System\PdMdKPZ.exe
  C:\Windows\System\PdMdKPZ.exe
  2⤵
  PID:15180
- C:\Windows\System\grdLwxI.exe
  C:\Windows\System\grdLwxI.exe
  2⤵
  PID:15204
- C:\Windows\System\ASYoIJl.exe
  C:\Windows\System\ASYoIJl.exe
  2⤵
  PID:7444
- C:\Windows\System\bvyBucE.exe
  C:\Windows\System\bvyBucE.exe
  2⤵
  PID:7520
- C:\Windows\System\WEHCnRl.exe
  C:\Windows\System\WEHCnRl.exe
  2⤵
  PID:7672
- C:\Windows\System\tSZVAyD.exe
  C:\Windows\System\tSZVAyD.exe
  2⤵
  PID:7388
- C:\Windows\System\xuIhhxs.exe
  C:\Windows\System\xuIhhxs.exe
  2⤵
  PID:5072
- C:\Windows\System\lbOMNGw.exe
  C:\Windows\System\lbOMNGw.exe
  2⤵
  PID:8008
- C:\Windows\System\JRJvlFy.exe
  C:\Windows\System\JRJvlFy.exe
  2⤵
  PID:6664
- C:\Windows\System\NUNsDui.exe
  C:\Windows\System\NUNsDui.exe
  2⤵
  PID:8252
- C:\Windows\System\dUFySSd.exe
  C:\Windows\System\dUFySSd.exe
  2⤵
  PID:7196
- C:\Windows\System\YdccaRD.exe
  C:\Windows\System\YdccaRD.exe
  2⤵
  PID:7112
- C:\Windows\System\erajlLK.exe
  C:\Windows\System\erajlLK.exe
  2⤵
  PID:7488
- C:\Windows\System\BSytXRO.exe
  C:\Windows\System\BSytXRO.exe
  2⤵
  PID:6928
- C:\Windows\System\DTRJGME.exe
  C:\Windows\System\DTRJGME.exe
  2⤵
  PID:7904
- C:\Windows\System\nVkxsTn.exe
  C:\Windows\System\nVkxsTn.exe
  2⤵
  PID:7992
- C:\Windows\System\gLAXyiX.exe
  C:\Windows\System\gLAXyiX.exe
  2⤵
  PID:14948
- C:\Windows\System\gnLYKzs.exe
  C:\Windows\System\gnLYKzs.exe
  2⤵
  PID:6892
- C:\Windows\System\YhpxHBp.exe
  C:\Windows\System\YhpxHBp.exe
  2⤵
  PID:15060
- C:\Windows\System\LUDdoyu.exe
  C:\Windows\System\LUDdoyu.exe
  2⤵
  PID:14344
- C:\Windows\System\KWfNhDL.exe
  C:\Windows\System\KWfNhDL.exe
  2⤵
  PID:15236
- C:\Windows\System\iDryljK.exe
  C:\Windows\System\iDryljK.exe
  2⤵
  PID:7172
- C:\Windows\System\zeuqAWE.exe
  C:\Windows\System\zeuqAWE.exe
  2⤵
  PID:8228
- C:\Windows\System\hAiDyay.exe
  C:\Windows\System\hAiDyay.exe
  2⤵
  PID:14552
- C:\Windows\System\lFGvoNM.exe
  C:\Windows\System\lFGvoNM.exe
  2⤵
  PID:15264
- C:\Windows\System\dyjSTxs.exe
  C:\Windows\System\dyjSTxs.exe
  2⤵
  PID:14632
- C:\Windows\System\hLKsjEE.exe
  C:\Windows\System\hLKsjEE.exe
  2⤵
  PID:8736
- C:\Windows\System\yHoDGKP.exe
  C:\Windows\System\yHoDGKP.exe
  2⤵
  PID:7732
- C:\Windows\System\upycDxS.exe
  C:\Windows\System\upycDxS.exe
  2⤵
  PID:8984
- C:\Windows\System\grnkesf.exe
  C:\Windows\System\grnkesf.exe
  2⤵
  PID:14844
- C:\Windows\System\WyloGkl.exe
  C:\Windows\System\WyloGkl.exe
  2⤵
  PID:8648
- C:\Windows\System\pHcgybC.exe
  C:\Windows\System\pHcgybC.exe
  2⤵
  PID:8000
- C:\Windows\System\azNUdtg.exe
  C:\Windows\System\azNUdtg.exe
  2⤵
  PID:13808
- C:\Windows\System\NDEMjHI.exe
  C:\Windows\System\NDEMjHI.exe
  2⤵
  PID:14004
- C:\Windows\System\WGsNoMY.exe
  C:\Windows\System\WGsNoMY.exe
  2⤵
  PID:3280
- C:\Windows\System\lOvolbY.exe
  C:\Windows\System\lOvolbY.exe
  2⤵
  PID:8292
- C:\Windows\System\MnBTPGg.exe
  C:\Windows\System\MnBTPGg.exe
  2⤵
  PID:15008
- C:\Windows\System\OiYQmuf.exe
  C:\Windows\System\OiYQmuf.exe
  2⤵
  PID:9072
- C:\Windows\System\kBfhovE.exe
  C:\Windows\System\kBfhovE.exe
  2⤵
  PID:15108
- C:\Windows\System\bLWGQum.exe
  C:\Windows\System\bLWGQum.exe
  2⤵
  PID:15128
- C:\Windows\System\nHlewpe.exe
  C:\Windows\System\nHlewpe.exe
  2⤵
  PID:8780
- C:\Windows\System\jEgVycv.exe
  C:\Windows\System\jEgVycv.exe
  2⤵
  PID:7448
- C:\Windows\System\uZPhAxo.exe
  C:\Windows\System\uZPhAxo.exe
  2⤵
  PID:7612
- C:\Windows\System\EipQcwc.exe
  C:\Windows\System\EipQcwc.exe
  2⤵
  PID:14468
- C:\Windows\System\eCnlnTy.exe
  C:\Windows\System\eCnlnTy.exe
  2⤵
  PID:15252
- C:\Windows\System\oxogNmB.exe
  C:\Windows\System\oxogNmB.exe
  2⤵
  PID:14812
- C:\Windows\System\WOVqcBC.exe
  C:\Windows\System\WOVqcBC.exe
  2⤵
  PID:14828
- C:\Windows\System\SITjmBY.exe
  C:\Windows\System\SITjmBY.exe
  2⤵
  PID:9196
- C:\Windows\System\uvjlBIz.exe
  C:\Windows\System\uvjlBIz.exe
  2⤵
  PID:9464
- C:\Windows\System\VncqRII.exe
  C:\Windows\System\VncqRII.exe
  2⤵
  PID:9048
- C:\Windows\System\NsMdyJf.exe
  C:\Windows\System\NsMdyJf.exe
  2⤵
  PID:10168
- C:\Windows\System\XcBypMy.exe
  C:\Windows\System\XcBypMy.exe
  2⤵
  PID:15164
- C:\Windows\System\SjRzxRE.exe
  C:\Windows\System\SjRzxRE.exe
  2⤵
  PID:9056
- C:\Windows\System\xqoQGvx.exe
  C:\Windows\System\xqoQGvx.exe
  2⤵
  PID:9628
- C:\Windows\System\AnAfWUh.exe
  C:\Windows\System\AnAfWUh.exe
  2⤵
  PID:15088
- C:\Windows\System\LfTrRFk.exe
  C:\Windows\System\LfTrRFk.exe
  2⤵
  PID:12048
- C:\Windows\System\aYdgixs.exe
  C:\Windows\System\aYdgixs.exe
  2⤵
  PID:10444
- C:\Windows\System\sINJPRI.exe
  C:\Windows\System\sINJPRI.exe
  2⤵
  PID:8196
- C:\Windows\System\HtLnKWI.exe
  C:\Windows\System\HtLnKWI.exe
  2⤵
  PID:9732
- C:\Windows\System\IcCToDp.exe
  C:\Windows\System\IcCToDp.exe
  2⤵
  PID:9776
- C:\Windows\System\PHOWQdh.exe
  C:\Windows\System\PHOWQdh.exe
  2⤵
  PID:10144
- C:\Windows\System\coNSLjE.exe
  C:\Windows\System\coNSLjE.exe
  2⤵
  PID:10096
- C:\Windows\System\PtBkBWg.exe
  C:\Windows\System\PtBkBWg.exe
  2⤵
  PID:10724
- C:\Windows\System\oagTQYI.exe
  C:\Windows\System\oagTQYI.exe
  2⤵
  PID:11048
- C:\Windows\System\KCuMuJo.exe
  C:\Windows\System\KCuMuJo.exe
  2⤵
  PID:10336
- C:\Windows\System\ttPmWYF.exe
  C:\Windows\System\ttPmWYF.exe
  2⤵
  PID:8716
- C:\Windows\System\QLUHxIM.exe
  C:\Windows\System\QLUHxIM.exe
  2⤵
  PID:9804
- C:\Windows\System\KebagIA.exe
  C:\Windows\System\KebagIA.exe
  2⤵
  PID:9428
- C:\Windows\System\FYOenSu.exe
  C:\Windows\System\FYOenSu.exe
  2⤵
  PID:9840
- C:\Windows\System\LjmphJh.exe
  C:\Windows\System\LjmphJh.exe
  2⤵
  PID:14396
- C:\Windows\System\ctQwdXT.exe
  C:\Windows\System\ctQwdXT.exe
  2⤵
  PID:10204
- C:\Windows\System\AUKgGRT.exe
  C:\Windows\System\AUKgGRT.exe
  2⤵
  PID:10216
- C:\Windows\System\lszVDkx.exe
  C:\Windows\System\lszVDkx.exe
  2⤵
  PID:8828
- C:\Windows\System\aVHXEAA.exe
  C:\Windows\System\aVHXEAA.exe
  2⤵
  PID:9296
- C:\Windows\System\wANTrOt.exe
  C:\Windows\System\wANTrOt.exe
  2⤵
  PID:8952
- C:\Windows\System\auEVrdo.exe
  C:\Windows\System\auEVrdo.exe
  2⤵
  PID:10220
- C:\Windows\System\mAtbfMs.exe
  C:\Windows\System\mAtbfMs.exe
  2⤵
  PID:15372
- C:\Windows\System\mLqmEQI.exe
  C:\Windows\System\mLqmEQI.exe
  2⤵
  PID:15392
- C:\Windows\System\oqkSYoE.exe
  C:\Windows\System\oqkSYoE.exe
  2⤵
  PID:15416
- C:\Windows\System\hcBrRWg.exe
  C:\Windows\System\hcBrRWg.exe
  2⤵
  PID:15436
- C:\Windows\System\GgJeyaX.exe
  C:\Windows\System\GgJeyaX.exe
  2⤵
  PID:15460
- C:\Windows\System\wwXhQFq.exe
  C:\Windows\System\wwXhQFq.exe
  2⤵
  PID:15480
- C:\Windows\System\XFEQjIk.exe
  C:\Windows\System\XFEQjIk.exe
  2⤵
  PID:15504
- C:\Windows\System\iKhOxpS.exe
  C:\Windows\System\iKhOxpS.exe
  2⤵
  PID:15544
- C:\Windows\System\hZOJQkh.exe
  C:\Windows\System\hZOJQkh.exe
  2⤵
  PID:15564
- C:\Windows\System\vqZrQFV.exe
  C:\Windows\System\vqZrQFV.exe
  2⤵
  PID:15900
- C:\Windows\System\azkRJuQ.exe
  C:\Windows\System\azkRJuQ.exe
  2⤵
  PID:15928
- C:\Windows\System\IDkcuHX.exe
  C:\Windows\System\IDkcuHX.exe
  2⤵
  PID:15960
- C:\Windows\System\PvVpRjg.exe
  C:\Windows\System\PvVpRjg.exe
  2⤵
  PID:15976
- C:\Windows\System\aLcobjt.exe
  C:\Windows\System\aLcobjt.exe
  2⤵
  PID:16012
- C:\Windows\System\tiGsldy.exe
  C:\Windows\System\tiGsldy.exe
  2⤵
  PID:16028
- C:\Windows\System\HphxYFt.exe
  C:\Windows\System\HphxYFt.exe
  2⤵
  PID:16044
- C:\Windows\System\XLOlPVO.exe
  C:\Windows\System\XLOlPVO.exe
  2⤵
  PID:16064
- C:\Windows\System\LltTyTj.exe
  C:\Windows\System\LltTyTj.exe
  2⤵
  PID:16080
- C:\Windows\System\bzayZaM.exe
  C:\Windows\System\bzayZaM.exe
  2⤵
  PID:16104
- C:\Windows\System\LZXPMPE.exe
  C:\Windows\System\LZXPMPE.exe
  2⤵
  PID:16124
- C:\Windows\System\GsIajPb.exe
  C:\Windows\System\GsIajPb.exe
  2⤵
  PID:16144
- C:\Windows\System\QqrEpsz.exe
  C:\Windows\System\QqrEpsz.exe
  2⤵
  PID:16160
- C:\Windows\System\vstRIPK.exe
  C:\Windows\System\vstRIPK.exe
  2⤵
  PID:16176
- C:\Windows\System\lKakNZv.exe
  C:\Windows\System\lKakNZv.exe
  2⤵
  PID:16192
- C:\Windows\System\PFFPAlY.exe
  C:\Windows\System\PFFPAlY.exe
  2⤵
  PID:16208
- C:\Windows\System\HWwlYTG.exe
  C:\Windows\System\HWwlYTG.exe
  2⤵
  PID:16232
- C:\Windows\System\AYQmupl.exe
  C:\Windows\System\AYQmupl.exe
  2⤵
  PID:16252
- C:\Windows\System\URrmaet.exe
  C:\Windows\System\URrmaet.exe
  2⤵
  PID:16276
- C:\Windows\System\JuPytTC.exe
  C:\Windows\System\JuPytTC.exe
  2⤵
  PID:16292
- C:\Windows\System\DZbWGNc.exe
  C:\Windows\System\DZbWGNc.exe
  2⤵
  PID:16312
- C:\Windows\System\GaMsVNC.exe
  C:\Windows\System\GaMsVNC.exe
  2⤵
  PID:16328
- C:\Windows\System\ulNLyDR.exe
  C:\Windows\System\ulNLyDR.exe
  2⤵
  PID:16348
- C:\Windows\System\ksencoO.exe
  C:\Windows\System\ksencoO.exe
  2⤵
  PID:16364
- C:\Windows\System\rCEcPnc.exe
  C:\Windows\System\rCEcPnc.exe
  2⤵
  PID:16380
- C:\Windows\System\SulXUOX.exe
  C:\Windows\System\SulXUOX.exe
  2⤵
  PID:6300
- C:\Windows\System\AUwcqDP.exe
  C:\Windows\System\AUwcqDP.exe
  2⤵
  PID:7020
- C:\Windows\System\yOCArlI.exe
  C:\Windows\System\yOCArlI.exe
  2⤵
  PID:6716
- C:\Windows\System\xmDxeaP.exe
  C:\Windows\System\xmDxeaP.exe
  2⤵
  PID:14516
- C:\Windows\System\wtsNeKx.exe
  C:\Windows\System\wtsNeKx.exe
  2⤵
  PID:8632
- C:\Windows\System\rTczKvg.exe
  C:\Windows\System\rTczKvg.exe
  2⤵
  PID:9164
- C:\Windows\System\kEwlvYh.exe
  C:\Windows\System\kEwlvYh.exe
  2⤵
  PID:9512
- C:\Windows\System\oZsWqve.exe
  C:\Windows\System\oZsWqve.exe
  2⤵
  PID:14532
- C:\Windows\System\qnvCAGM.exe
  C:\Windows\System\qnvCAGM.exe
  2⤵
  PID:8396
- C:\Windows\System\uOLVhOO.exe
  C:\Windows\System\uOLVhOO.exe
  2⤵
  PID:10588
- C:\Windows\System\ilyRszP.exe
  C:\Windows\System\ilyRszP.exe
  2⤵
  PID:8624
- C:\Windows\System\qXJoAIJ.exe
  C:\Windows\System\qXJoAIJ.exe
  2⤵
  PID:10140
- C:\Windows\System\LBVPAfG.exe
  C:\Windows\System\LBVPAfG.exe
  2⤵
  PID:6356
- C:\Windows\System\SAGAwIX.exe
  C:\Windows\System\SAGAwIX.exe
  2⤵
  PID:9640
- C:\Windows\System\FLDVtYC.exe
  C:\Windows\System\FLDVtYC.exe
  2⤵
  PID:6280
- C:\Windows\System\eltqPfc.exe
  C:\Windows\System\eltqPfc.exe
  2⤵
  PID:11452
- C:\Windows\System\ERsvCih.exe
  C:\Windows\System\ERsvCih.exe
  2⤵
  PID:9600
- C:\Windows\System\TsjaLnT.exe
  C:\Windows\System\TsjaLnT.exe
  2⤵
  PID:9800
- C:\Windows\System\ftTWOGd.exe
  C:\Windows\System\ftTWOGd.exe
  2⤵
  PID:10984
- C:\Windows\System\taeJZRe.exe
  C:\Windows\System\taeJZRe.exe
  2⤵
  PID:10652
- C:\Windows\System\hEwpJKK.exe
  C:\Windows\System\hEwpJKK.exe
  2⤵
  PID:9248
- C:\Windows\System\yRWhXiR.exe
  C:\Windows\System\yRWhXiR.exe
  2⤵
  PID:10628
- C:\Windows\System\lJwGhKJ.exe
  C:\Windows\System\lJwGhKJ.exe
  2⤵
  PID:11268
- C:\Windows\System\NnIpLkz.exe
  C:\Windows\System\NnIpLkz.exe
  2⤵
  PID:10768
- C:\Windows\System\ivAgZQE.exe
  C:\Windows\System\ivAgZQE.exe
  2⤵
  PID:7884
- C:\Windows\System\MMeRhRe.exe
  C:\Windows\System\MMeRhRe.exe
  2⤵
  PID:10604
- C:\Windows\System\fLeZviY.exe
  C:\Windows\System\fLeZviY.exe
  2⤵
  PID:10680
- C:\Windows\System\FvBGfCz.exe
  C:\Windows\System\FvBGfCz.exe
  2⤵
  PID:11252
- C:\Windows\System\tAgplyl.exe
  C:\Windows\System\tAgplyl.exe
  2⤵
  PID:15380
- C:\Windows\System\FRgErjE.exe
  C:\Windows\System\FRgErjE.exe
  2⤵
  PID:15024
- C:\Windows\System\MCovQBP.exe
  C:\Windows\System\MCovQBP.exe
  2⤵
  PID:15456
- C:\Windows\System\VCQfdCc.exe
  C:\Windows\System\VCQfdCc.exe
  2⤵
  PID:9772
- C:\Windows\System\ffekKRR.exe
  C:\Windows\System\ffekKRR.exe
  2⤵
  PID:11344
- C:\Windows\System\UPuywnH.exe
  C:\Windows\System\UPuywnH.exe
  2⤵
  PID:8200
- C:\Windows\System\vhOeHvC.exe
  C:\Windows\System\vhOeHvC.exe
  2⤵
  PID:15600
- C:\Windows\System\BofmeNW.exe
  C:\Windows\System\BofmeNW.exe
  2⤵
  PID:11376
- C:\Windows\System\TaUqSmh.exe
  C:\Windows\System\TaUqSmh.exe
  2⤵
  PID:11424
- C:\Windows\System\AFrENMt.exe
  C:\Windows\System\AFrENMt.exe
  2⤵
  PID:15644
- C:\Windows\System\NrcRIaT.exe
  C:\Windows\System\NrcRIaT.exe
  2⤵
  PID:11336
- C:\Windows\System\lIkDqCq.exe
  C:\Windows\System\lIkDqCq.exe
  2⤵
  PID:9448
- C:\Windows\System\PaXJaKH.exe
  C:\Windows\System\PaXJaKH.exe
  2⤵
  PID:11612
- C:\Windows\System\TAWnORe.exe
  C:\Windows\System\TAWnORe.exe
  2⤵
  PID:16340
- C:\Windows\System\qkjiePz.exe
  C:\Windows\System\qkjiePz.exe
  2⤵
  PID:15224
- C:\Windows\System\AamMjry.exe
  C:\Windows\System\AamMjry.exe
  2⤵
  PID:15828
- C:\Windows\System\riebPHW.exe
  C:\Windows\System\riebPHW.exe
  2⤵
  PID:10844
- C:\Windows\System\edoYWBI.exe
  C:\Windows\System\edoYWBI.exe
  2⤵
  PID:15840
- C:\Windows\System\DZRIAnW.exe
  C:\Windows\System\DZRIAnW.exe
  2⤵
  PID:9304
- C:\Windows\System\PBXLyGD.exe
  C:\Windows\System\PBXLyGD.exe
  2⤵
  PID:11600
- C:\Windows\System\jnsqeKB.exe
  C:\Windows\System\jnsqeKB.exe
  2⤵
  PID:16024
- C:\Windows\System\anvgBbw.exe
  C:\Windows\System\anvgBbw.exe
  2⤵
  PID:16100
- C:\Windows\System\IWyqThG.exe
  C:\Windows\System\IWyqThG.exe
  2⤵
  PID:11248
- C:\Windows\System\HavJgVs.exe
  C:\Windows\System\HavJgVs.exe
  2⤵
  PID:12096
- C:\Windows\System\RvjgXMk.exe
  C:\Windows\System\RvjgXMk.exe
  2⤵
  PID:13008
- C:\Windows\System\YLhFAfw.exe
  C:\Windows\System\YLhFAfw.exe
  2⤵
  PID:9116
- C:\Windows\System\EjNiBLZ.exe
  C:\Windows\System\EjNiBLZ.exe
  2⤵
  PID:11360
- C:\Windows\System\wyqPXjp.exe
  C:\Windows\System\wyqPXjp.exe
  2⤵
  PID:11680
- C:\Windows\System\CGKFMsc.exe
  C:\Windows\System\CGKFMsc.exe
  2⤵
  PID:10040
- C:\Windows\System\iHKIMWH.exe
  C:\Windows\System\iHKIMWH.exe
  2⤵
  PID:8904
- C:\Windows\System\IvNmEgo.exe
  C:\Windows\System\IvNmEgo.exe
  2⤵
  PID:10836
- C:\Windows\System\HnzcuZp.exe
  C:\Windows\System\HnzcuZp.exe
  2⤵
  PID:9660
- C:\Windows\System\LZLxwuk.exe
  C:\Windows\System\LZLxwuk.exe
  2⤵
  PID:11856
- C:\Windows\System\TNShUDZ.exe
  C:\Windows\System\TNShUDZ.exe
  2⤵
  PID:14680
- C:\Windows\System\gpNERRi.exe
  C:\Windows\System\gpNERRi.exe
  2⤵
  PID:12488
- C:\Windows\System\ATZhTcc.exe
  C:\Windows\System\ATZhTcc.exe
  2⤵
  PID:11980
- C:\Windows\System\siumWjK.exe
  C:\Windows\System\siumWjK.exe
  2⤵
  PID:13012
- C:\Windows\System\vopZqQr.exe
  C:\Windows\System\vopZqQr.exe
  2⤵
  PID:10700
- C:\Windows\System\CHEyUvd.exe
  C:\Windows\System\CHEyUvd.exe
  2⤵
  PID:12964
- C:\Windows\System\EsDfoiU.exe
  C:\Windows\System\EsDfoiU.exe
  2⤵
  PID:10784
- C:\Windows\System\DUzfcPF.exe
  C:\Windows\System\DUzfcPF.exe
  2⤵
  PID:9204
- C:\Windows\System\cUujCiz.exe
  C:\Windows\System\cUujCiz.exe
  2⤵
  PID:13892
- C:\Windows\System\JjMMZVF.exe
  C:\Windows\System\JjMMZVF.exe
  2⤵
  PID:10672
- C:\Windows\System\TqAIsBV.exe
  C:\Windows\System\TqAIsBV.exe
  2⤵
  PID:11636
- C:\Windows\System\YvERXvx.exe
  C:\Windows\System\YvERXvx.exe
  2⤵
  PID:10024
- C:\Windows\System\zmkEoII.exe
  C:\Windows\System\zmkEoII.exe
  2⤵
  PID:10492
- C:\Windows\System\vUePcKC.exe
  C:\Windows\System\vUePcKC.exe
  2⤵
  PID:12984
- C:\Windows\System\NrhPDmk.exe
  C:\Windows\System\NrhPDmk.exe
  2⤵
  PID:15492
- C:\Windows\System\tVqEWxI.exe
  C:\Windows\System\tVqEWxI.exe
  2⤵
  PID:15556
- C:\Windows\System\GlbeMOU.exe
  C:\Windows\System\GlbeMOU.exe
  2⤵
  PID:14520
- C:\Windows\System\AjAaTLL.exe
  C:\Windows\System\AjAaTLL.exe
  2⤵
  PID:9596
- C:\Windows\System\DupqKIf.exe
  C:\Windows\System\DupqKIf.exe
  2⤵
  PID:16172
- C:\Windows\System\nnecGCK.exe
  C:\Windows\System\nnecGCK.exe
  2⤵
  PID:12976
- C:\Windows\System\BLYZtzd.exe
  C:\Windows\System\BLYZtzd.exe
  2⤵
  PID:13088
- C:\Windows\System\tvqFbZe.exe
  C:\Windows\System\tvqFbZe.exe
  2⤵
  PID:13132
- C:\Windows\System\jxVbYtL.exe
  C:\Windows\System\jxVbYtL.exe
  2⤵
  PID:13228
- C:\Windows\System\BhhlXFs.exe
  C:\Windows\System\BhhlXFs.exe
  2⤵
  PID:13180
- C:\Windows\System\AFZnpAE.exe
  C:\Windows\System\AFZnpAE.exe
  2⤵
  PID:16156
- C:\Windows\System\sDqUzzs.exe
  C:\Windows\System\sDqUzzs.exe
  2⤵
  PID:12872
- C:\Windows\System\ibqaPJf.exe
  C:\Windows\System\ibqaPJf.exe
  2⤵
  PID:13072
- C:\Windows\System\dWDRcZS.exe
  C:\Windows\System\dWDRcZS.exe
  2⤵
  PID:12216
- C:\Windows\System\lfXzaXv.exe
  C:\Windows\System\lfXzaXv.exe
  2⤵
  PID:12628
- C:\Windows\System\Aeruiae.exe
  C:\Windows\System\Aeruiae.exe
  2⤵
  PID:12980
- C:\Windows\System\NmaUtnf.exe
  C:\Windows\System\NmaUtnf.exe
  2⤵
  PID:12936
- C:\Windows\System\aukkpfp.exe
  C:\Windows\System\aukkpfp.exe
  2⤵
  PID:11520
- C:\Windows\System\HpXdrZO.exe
  C:\Windows\System\HpXdrZO.exe
  2⤵
  PID:9244
- C:\Windows\System\gxPmArj.exe
  C:\Windows\System\gxPmArj.exe
  2⤵
  PID:4904
- C:\Windows\System\thnwkyA.exe
  C:\Windows\System\thnwkyA.exe
  2⤵
  PID:10344
- C:\Windows\System\wWSlgWM.exe
  C:\Windows\System\wWSlgWM.exe
  2⤵
  PID:16092
- C:\Windows\System\sKkaBNJ.exe
  C:\Windows\System\sKkaBNJ.exe
  2⤵
  PID:12784
- C:\Windows\System\LKkzaxo.exe
  C:\Windows\System\LKkzaxo.exe
  2⤵
  PID:12400
- C:\Windows\System\URXZUNT.exe
  C:\Windows\System\URXZUNT.exe
  2⤵
  PID:15172
- C:\Windows\System\fDCZyOJ.exe
  C:\Windows\System\fDCZyOJ.exe
  2⤵
  PID:12868
- C:\Windows\System\QittZmE.exe
  C:\Windows\System\QittZmE.exe
  2⤵
  PID:12780
- C:\Windows\System\XviIYId.exe
  C:\Windows\System\XviIYId.exe
  2⤵
  PID:15672
- C:\Windows\System\wZURSgG.exe
  C:\Windows\System\wZURSgG.exe
  2⤵
  PID:12128
- C:\Windows\System\qKyHvQD.exe
  C:\Windows\System\qKyHvQD.exe
  2⤵
  PID:15772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=138985144238272 --process=260 /prefetch:7 --thread=3520
1⤵
PID:13240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xqnwtu4t.0uz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AMQvptW.exe

Filesize
2.2MB

MD5
b5e1202e7179b0a056d5e0903ef2a8e1

SHA1
cf1ddef0319cccead0773b00dabf2f9e28776f08

SHA256
37d8d6c58273a225bcf33906c279ebad22100dcf20ba61a6c3bac3b20e93f7cf

SHA512
991e5959235cd5cc0d80221773a5559279227c575e00cd36c844db81bfcad463d49c6928d442f5c151ba39c93e0c87192373d8e9a117540a7645a5f71f2e1284

Download Submit
C:\Windows\System\AjRWISj.exe

Filesize
2.2MB

MD5
dde9b6ef6ec79f5119e7da36bc72155b

SHA1
f3c64fc5910a30b4cd8916a40cfa1fd5cfe85e25

SHA256
0720846d396971e13322d56ed2080d0aeaafc2bcbf17f35b8f534a0fc6cba748

SHA512
9494351c85aa67878a40691a3b4e766db8f648bc63f7bcbb15a54bfdbc618a7fd7beb3721eddbf9e9ad05195d53e9b1d772c48acdee68d33b493dea90c3eb875

Download Submit
C:\Windows\System\BdsrUQq.exe

Filesize
2.2MB

MD5
d2560bc06e6ca12de9309d0aebafce05

SHA1
22deb1addf54f2622380eb5bed2a35e71ca494df

SHA256
e254a70045fd3a63040acf5ff3cceb24c83ee2b6b73eb4b04f4094aade4cb797

SHA512
eb6f3f4d7f415b38e037a4344058d8964605164c6fdf372cfcea51176feb9fa9e6be3b36e1f14a19cda35cd718e77e66e286963848e315cc7b868159e204ae79

Download Submit
C:\Windows\System\BgXJQQO.exe

Filesize
2.2MB

MD5
293df1ea79ab2aef5c276dc81589ecf1

SHA1
9ea0262169e374cc759e11b4aca9a0d4a7e5b12e

SHA256
1dce950858e4384d2712206f513b61c8e11e7e7772bfdcb06e94f93111270695

SHA512
3d5b7b60247ca6bea1d8f4de127a2c1d7ae6e4da9e0b7e221edcb29daf326cccd92651d53e82bd812bd686742152c5c242fb589e1044cf44dae936681ab1d6be

Download Submit
C:\Windows\System\DwhsdIa.exe

Filesize
2.2MB

MD5
8040f0a5f0384b8adf9a6ac5b25afa23

SHA1
b69d4dff28fe9074c4267fa6d9a1c0e541b75cca

SHA256
97abad950073157c78163611dbbe23f899cad8670e19a6e12c23a218bf2e4a60

SHA512
5b80962b72ab3d280966c9f29f004bd2645841db99b35655eb0222fb79dca46530da1d7ac3f06b8e7d353491fb8323bd07083e34728709e86c81f2420f9c0438

Download Submit
C:\Windows\System\EjuCjso.exe

Filesize
2.2MB

MD5
49194bac26a8a3608ac260b1dc290fae

SHA1
8597b0359d58af3fa24cc5c1d00f0e8b0f5b04e7

SHA256
b20c97c9191e7a4feb4037b8442f349e468579e50127d23fce8dd13b626a89ec

SHA512
19c2e5208a110d5e8f5e365c146145fa1a56316fff9d25c721493caaee2d7fd401e41226429652051cf07f51504010313eaa14f29f247026fdf661e9ad07a08b

Download Submit
C:\Windows\System\FBZVOdt.exe

Filesize
2.2MB

MD5
802479b636bcacedc30b42491e7b6823

SHA1
53379e7969ff0aa4b0daf71e49c0a1c723a2ce74

SHA256
82dc9e9a26ddc16592ce3adca9433565d8af265a592ae9c5e50b50467351ef21

SHA512
7fba4c26bfa0c83657ca1251743ef70cb1cf7e4c94b71ee7d60d7366c629abada8a39cf9f4417c9011de341b3078e151bed2b2194e0e2746772da67d27cb2c69

Download Submit
C:\Windows\System\FtCGzOC.exe

Filesize
2.2MB

MD5
aff37b2f54b4e78aed1f18a72a2732d2

SHA1
e8b8765a4be6841fcff4bb3a965e62eeb67c5699

SHA256
b0fb9f6a273e15a9adfa3e982d78f65103843a3e60e8bc4297a479a73d0bfee0

SHA512
f5abfc0930bc1d61276b6947ca9f1fea13d94308337cbf89c558b3b17126739c40c6e213513c258682961627443794a0745c9828f9cb6f491bda6da33c5bc851

Download Submit
C:\Windows\System\FzIouSO.exe

Filesize
2.2MB

MD5
6c8abf5f097f35d362f951467b151312

SHA1
423f772bd4e45f8a6859c5770cc3bb9cc7b8fe9a

SHA256
518bffd75ffebb15eeb8fe2644485c0eee1b25f7eab8e0fbaf90ff8f41b5d789

SHA512
53d9ee56d18bb6371279b8b0920050b92b063a5883bcb06eea80bd24817659b0f70130d1cf5a9f87fbc7c2ed097c204586955af6b71192da127e288c40006056

Download Submit
C:\Windows\System\GLnCGwN.exe

Filesize
2.2MB

MD5
6d5f725fa785add29ff6cec207888cf3

SHA1
b17a3825c5d3383514b42a833be182d9e118594e

SHA256
dbb60c086134206a0315592a09696e0dd361ed29931568f1d634be07758ba56d

SHA512
613ca0617ddfa45a96ad5ec105ea6266c12c65c4de1672e5d49c4e8514068e6637f41ee03e84008ca900dc7065452288a1d7928c140ffe6a26486b3e4a893654

Download Submit
C:\Windows\System\GvFLpjU.exe

Filesize
2.2MB

MD5
f4b0324bd704abc3479bfa98d2c4fa19

SHA1
04b916545eab49822a8912ed84c7e8edb4cd5b8d

SHA256
425ac2b7f0b38382892bd83d797ef5db690082399632039b103a9f015e3a955e

SHA512
e79796cfa8e481f25c5718adee52f64bcf35571b76b0e52f4efaab7a727bcbc15055c15a6afd0ee8fcef6c628adfc01cba76a45fc4f2def222cbed65ef238e47

Download Submit
C:\Windows\System\ItUkIqY.exe

Filesize
2.2MB

MD5
719bce5bbeacb9abe14677a71ded84a9

SHA1
8a71804b49b3de1fdb9c9f62447c633a424894e4

SHA256
020770e65501a878dae8c1ed9c10241d2ccf54dcce5639c9c651624224ad69f4

SHA512
29af4f9371567fa5c3b4cbbcc4c2eb7674f6910a8ee737aaa3782afb8d6e392e3ce36f619ac27e2be04be0682ed4f5b0ce300c65024d8b7f16200309df075304

Download Submit
C:\Windows\System\KFogsBh.exe

Filesize
2.2MB

MD5
ea92973c601c2ddbaad432b8c6f8474b

SHA1
4759335b1439490f4b8c55b25e93f1224f898906

SHA256
a05f473e0dd4641362a00beb5ae6b244708d119248dd6bf11112288bd41ac984

SHA512
ea32f27cb5f3458112e4725fa4fa77aaace38516d944175bece3d0e86818b3559d3dcd19eaf28c1ea3efa97f6bc6f371745b6b236e40a67348ea31acc585fa13

Download Submit
C:\Windows\System\KlYfFNx.exe

Filesize
2.2MB

MD5
86d1099e5072350648a85283d0c074e3

SHA1
25481ce0d4117ca9c420787bc314f54454f4d2d9

SHA256
dca25457039c631b87dd1c3555652824e37b97ff07e102ed953242b620132445

SHA512
5bc905d538fa019a3057716fd348090ab7ac9ec2cdbbeedced733154f0cf2a1eaf3b1080348636387f3115befdd7174f35baeadebcb287a0c2a643ea174818c8

Download Submit
C:\Windows\System\LFNsMMT.exe

Filesize
2.2MB

MD5
80a133daf4ee896e9d2d1848820a24ee

SHA1
2cb50ab0232efb85d7d471096f7ee3d7dc6c7e8f

SHA256
16921a3d4687143f75d1ac057415695dc606983fcd28370933da1a5ca9c22e3b

SHA512
cace40715652aa51869d40c493b7113c02a16ac832c568af7759a3373c3ea72882cd3b08835b4ca454063bd5fa03a67c41cb1613a0b5bee1c97944e9552de57d

Download Submit
C:\Windows\System\LfAfkNH.exe

Filesize
2.2MB

MD5
120e59d0b5b76ab8227897259d24b5af

SHA1
5a96e33fd48d333e8f8cd24e8eeda06055c6ad6a

SHA256
990cf89c1fcddea648e3fd2d37a4b2066bdf88db94e0141cef4131faa4580673

SHA512
16c14232986f36b0520e8d56ba47af7c60b52e62358909b6ca9c6c9ce1ed51bb1e3cce76c4b3656ac75efce6450a670febc85372c8aebc1bca421b12ceabcc4e

Download Submit
C:\Windows\System\QufAZWN.exe

Filesize
2.2MB

MD5
1618407b5ea5b53e9dba7b703d1ebfc8

SHA1
ded24398164c733094cedf7fde2252c3b918b818

SHA256
d2db91b3dc8ecd028f00838fc6c34291c2a5cd1dd13c0d62e6db5ab2e422d98f

SHA512
b169f9fa8ae3df69e8ecd097f6ca7df0508bd38b55b25fc72ff39ce5f48b5b7faf476d1171eaf653837bb7d5b3c769cfb31f581ac69bc45ceb10ba4620669a22

Download Submit
C:\Windows\System\RjfHDYH.exe

Filesize
2.2MB

MD5
33bd64167c2420b9f5df9f59356d4a0d

SHA1
3ab17a1adbdb1c91a07c641c4640f34a0d01ecb3

SHA256
fb3a7df69aea5d2a7e39cc4c5613ea7f8611892e6b5e61fc57accfe1899e6c8e

SHA512
fc0237645143a280435b6c86b4aec59120f7b73c2cf74c65f8faef6b2f517556c12e8bd100e4042580301588696c3fbce1cf4759edb8720418d1c569adbacb86

Download Submit
C:\Windows\System\TcjRdID.exe

Filesize
2.2MB

MD5
38c0564b992afd026eaecc6cd14c9b29

SHA1
23ba47d3abba63f91e0bf43412041e84fb685b34

SHA256
684e2fc58553c5c8efb5c3c74609c480f464228fcdbc39fa0d29ccc0dcf66679

SHA512
bcdd06e55e4a12236192704f71a6cd2bd9e515466c017bb5bb3da48bdaf94570fccf7606114c96d8e34b00c8c904209e5659095023ff61ae67fc846dbba566dc

Download Submit
C:\Windows\System\VaIuezJ.exe

Filesize
2.2MB

MD5
d19f402773a9b7beb6d7fa4f62746de6

SHA1
4bd4399f9e747680875712a731181992ee885ad9

SHA256
0627106095a4dbed0ab7907124a44f99395febc5a579e6d0ea8a6732dc4a7bf0

SHA512
6dafd0f1bad1d107a1b2952bd4f1ace5b5ef97fb768a4f0f87e074dbd1e6b3638235db7268bb5132e477801f1a3e22cd55a7418d07b4c22e98de60b54cacb344

Download Submit
C:\Windows\System\YVFnCez.exe

Filesize
2.2MB

MD5
67eed21dfc3777f195d4dc402b31781b

SHA1
c226ecb06f246beaf43c33bbb28b2aafd601f8f7

SHA256
649afe8420b66fd788cc8d5641248898431de06f4424613ed4ed71b9d2478beb

SHA512
3eb0d51a46ef1ace8fa28d8b7e5d9d38057d0bc3d9656a30d7aa087432672c76144f8a1cfb9990631f83e5b62e0ea2c421fb52eb80271d3854290a10a5af398b

Download Submit
C:\Windows\System\cgxUCCd.exe

Filesize
2.2MB

MD5
7e2a51e08f8f5bcee0a59ad1e0370329

SHA1
9d132eb8f1d53d502313de1386cf3da7085ad922

SHA256
b6c939bd1f68843c4e9a37522e3d51717d7afccd8f067f8bdb6e2740d90a8c33

SHA512
6b1d8618351bb10f0c72759210c80f2fac7e26005e34d87f43459780fdb029afc1ef14790b3e800d572aef6be5dbf0fa07e96204a5e62f3e74392dddfccb941d

Download Submit
C:\Windows\System\eFfROHG.exe

Filesize
2.2MB

MD5
d0d4e12c9a8680aa748acb34fcf58de8

SHA1
02ab9c42c29b1373cde85bd29896ab81dc132192

SHA256
bb5f6fd17b5476b052eaa80a3d328b168aab304d83a5dc166721374cf7d67a4d

SHA512
ebff355fbd739f1760bb7f7ced7d6ffb1fb71509b508a9c2ebc497f5a091950e8720361dcb68414de11186ae8bcaa87e570ae9dd458fb18119a64a8394a5ca92

Download Submit
C:\Windows\System\iDmnQGC.exe

Filesize
2.2MB

MD5
7451cee208c28c311246ea7bbc2239f2

SHA1
d037603221eaab432c7ce763d31bd689e459c676

SHA256
d5d6c9639d1c29f97269102fd11848035cd3b02158f7b5011ee0d328a15ba357

SHA512
1a4657fcf9af821a270366f445a7a7dc96b9dbe8c8f0897a6e720a348275271636ad39ab6d00d992906b374f0817bee306c54ae1c06d71a778ccf5fe9b77266a

Download Submit
C:\Windows\System\irueiOQ.exe

Filesize
2.2MB

MD5
55df462fde0d3b278c2cc8d711c392da

SHA1
8151db15837364eaf542d130a5663fb2365450bd

SHA256
c2a328181efa2d7537f1659e5fbe54997a411742028c21df66b7c8c03988d838

SHA512
836099a083942404f47d164117421acbef043bfef7c0f6e0f011c704c3f6eaa812d29c93ed33b5e4024ad003e3062b72396ff430141160031d1b7eb6a6f4377a

Download Submit
C:\Windows\System\jZzfGQj.exe

Filesize
2.2MB

MD5
ccec1fd012839e6187fa6383d8f76468

SHA1
5540f1509c4a51f6910919c9eb7279ae6c5f557d

SHA256
57b08386be9d062f0f6c106df8030130fa24e8002596c512ed7a8c51ab08c268

SHA512
96b5a3c58612077d323d0f621558fa5851a6c24d3287e42f9d716f42666fb63d7949e992d94228a40ded3f43172b83dd5527240fcdb2d05409886995d49b8fc4

Download Submit
C:\Windows\System\kuEMaNO.exe

Filesize
2.2MB

MD5
5de4b0914be21b1598ba21ab6b62bdb4

SHA1
a07060ac75c7c7a335da75d55f9a49f2c3236861

SHA256
52ad0684e80716db42b446e9a509795bb186e842488829647f78f4d2cee37c7b

SHA512
71034db40162ff99f9cdbbfa7c8a0de084e6e1ae22448f26ae24da48305e1f065176c190d08a81fcdfaf2fe2a8f06fa6f605dfb6a690089022eaf95c6815db1a

Download Submit
C:\Windows\System\nzHNUhS.exe

Filesize
2.2MB

MD5
daaaed8ae762a3192f267f2bbcd49d9d

SHA1
83528bc86bc9c94c2cc661da6853190eb01e0bd1

SHA256
696532f9f4880f7366c178f9313c8337fc5d6044fec92477dd8ad55ef581af5a

SHA512
b699a5571812d316b1916ee8bd9122c8c29aa07f7aaa2b64ab7c5a65c4cdfd3197a01477362d2cc5b7551f48e596ae1deb3a8f23410a2d7ef921a50257fa5127

Download Submit
C:\Windows\System\oekerpJ.exe

Filesize
2.2MB

MD5
676580ff19233f40d86fcc63ac8b6aee

SHA1
f602e95cda806a92dda597be95f576575757c897

SHA256
9fc03646e8f343408e051f4e2d653cb90558a07c9a438d9af0b2a6aef48776d8

SHA512
eb8c8819505dda2e9d991a70845208b0843cf4ff413613d02332eceb425327c16b2796da2a7f191e2539d2ed78bf5cacb59e1304c37b295218e5ad7f692852ea

Download Submit
C:\Windows\System\qflRJfW.exe

Filesize
2.2MB

MD5
61250b941f5b375f049bfbf91d11c673

SHA1
d66d6c9fc00e25cfbbb5af2f25301c68a74fae05

SHA256
62a0179aa7dfc99a77b05150b40c7b22f7b4482ce2f52a2c6e80a59b6b24489d

SHA512
2f5e1f764cf2037ea51b9c58fbef241d0289b889d3454d38f03560e3d278c02f39e46c81dae369e9a482f4dfd7ee25a0d306da8968b26f4f870114a341dbf936

Download Submit
C:\Windows\System\shPIWse.exe

Filesize
2.2MB

MD5
968cad6de120a3e48f2748b1ad34d587

SHA1
5978aa23fbea20de00b6b76e2e46a0765771bd3e

SHA256
4b8d656b557af7da88f1502b88be7664ef9065497746f770a07de1cdf08cfaf5

SHA512
5af9f9f42d82563b2fc8c3fab66d13e23f9611342d1d73ab5c43a2065cd3dde09057dfd2074f69f773e9ae6889c1a66c2558daf241efcc5a6f1f30f3b0736ffe

Download Submit
C:\Windows\System\vXAKOUG.exe

Filesize
2.2MB

MD5
f8936d4921dbfa817840986f25989867

SHA1
95b96d5e39041bc6e4bc8283ad88b2ac3ff1a935

SHA256
71834dc00ef6e43c0fed73ec95c902c921f620b98f44a785e047079e3987ee62

SHA512
d32074f5e558da98507e25021f19c8bc2439800b025f2a58476564a3d6c381563c1e6137a6cd6b209430e5c45b8559a38d8abc126435e7f5310bc2739de30f4d

Download Submit
memory/716-221-0x00007FF7FCE30000-0x00007FF7FD222000-memory.dmp

Filesize
3.9MB

Download
memory/716-1668-0x00007FF7FCE30000-0x00007FF7FD222000-memory.dmp

Filesize
3.9MB

Download
memory/716-17-0x00007FF7FCE30000-0x00007FF7FD222000-memory.dmp

Filesize
3.9MB

Download
memory/1060-240-0x00007FF7DCE90000-0x00007FF7DD282000-memory.dmp

Filesize
3.9MB

Download
memory/1060-1950-0x00007FF7DCE90000-0x00007FF7DD282000-memory.dmp

Filesize
3.9MB

Download
memory/1184-1946-0x00007FF604CB0000-0x00007FF6050A2000-memory.dmp

Filesize
3.9MB

Download
memory/1184-235-0x00007FF604CB0000-0x00007FF6050A2000-memory.dmp

Filesize
3.9MB

Download
memory/1224-1729-0x00007FF627400000-0x00007FF6277F2000-memory.dmp

Filesize
3.9MB

Download
memory/1224-54-0x00007FF627400000-0x00007FF6277F2000-memory.dmp

Filesize
3.9MB

Download
memory/1372-106-0x00007FF650F60000-0x00007FF651352000-memory.dmp

Filesize
3.9MB

Download
memory/1372-1937-0x00007FF650F60000-0x00007FF651352000-memory.dmp

Filesize
3.9MB

Download
memory/1576-1693-0x00007FF624670000-0x00007FF624A62000-memory.dmp

Filesize
3.9MB

Download
memory/1576-21-0x00007FF624670000-0x00007FF624A62000-memory.dmp

Filesize
3.9MB

Download
memory/1576-229-0x00007FF624670000-0x00007FF624A62000-memory.dmp

Filesize
3.9MB

Download
memory/1636-77-0x00007FF62F8E0000-0x00007FF62FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-1934-0x00007FF62F8E0000-0x00007FF62FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1700-1943-0x00007FF608300000-0x00007FF6086F2000-memory.dmp

Filesize
3.9MB

Download
memory/1700-103-0x00007FF608300000-0x00007FF6086F2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-100-0x00007FF634CB0000-0x00007FF6350A2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-2031-0x00007FF77E550000-0x00007FF77E942000-memory.dmp

Filesize
3.9MB

Download
memory/2028-245-0x00007FF77E550000-0x00007FF77E942000-memory.dmp

Filesize
3.9MB

Download
memory/2244-11-0x00007FF9D5CB3000-0x00007FF9D5CB5000-memory.dmp

Filesize
8KB

Download
memory/2244-5430-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/2244-2291-0x00007FF9D5CB3000-0x00007FF9D5CB5000-memory.dmp

Filesize
8KB

Download
memory/2244-37-0x00000216ED550000-0x00000216ED572000-memory.dmp

Filesize
136KB

Download
memory/2244-6511-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/2244-58-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/2244-52-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/2244-223-0x00000216F0390000-0x00000216F0B36000-memory.dmp

Filesize
7.6MB

Download
memory/2320-1955-0x00007FF717A10000-0x00007FF717E02000-memory.dmp

Filesize
3.9MB

Download
memory/2320-243-0x00007FF717A10000-0x00007FF717E02000-memory.dmp

Filesize
3.9MB

Download
memory/2348-247-0x00007FF7B8BB0000-0x00007FF7B8FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-2203-0x00007FF7B8BB0000-0x00007FF7B8FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-1941-0x00007FF783FB0000-0x00007FF7843A2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-75-0x00007FF783FB0000-0x00007FF7843A2000-memory.dmp

Filesize
3.9MB

Download
memory/2828-76-0x00007FF7D2D40000-0x00007FF7D3132000-memory.dmp

Filesize
3.9MB

Download
memory/2828-234-0x00007FF7D2D40000-0x00007FF7D3132000-memory.dmp

Filesize
3.9MB

Download
memory/3132-1683-0x00007FF77ACD0000-0x00007FF77B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/3132-62-0x00007FF77ACD0000-0x00007FF77B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-1755-0x00007FF6F5FE0000-0x00007FF6F63D2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-55-0x00007FF6F5FE0000-0x00007FF6F63D2000-memory.dmp

Filesize
3.9MB

Download
memory/3284-246-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp

Filesize
3.9MB

Download
memory/3284-2037-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp

Filesize
3.9MB

Download
memory/3352-219-0x00007FF7CB700000-0x00007FF7CBAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3352-0-0x00007FF7CB700000-0x00007FF7CBAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3352-1-0x000001DA15210000-0x000001DA15220000-memory.dmp

Filesize
64KB

Download
memory/3352-105-0x00007FF7CB700000-0x00007FF7CBAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3852-1752-0x00007FF68BA70000-0x00007FF68BE62000-memory.dmp

Filesize
3.9MB

Download
memory/3852-53-0x00007FF68BA70000-0x00007FF68BE62000-memory.dmp

Filesize
3.9MB

Download
memory/4560-239-0x00007FF7CD880000-0x00007FF7CDC72000-memory.dmp

Filesize
3.9MB

Download
memory/4560-1951-0x00007FF7CD880000-0x00007FF7CDC72000-memory.dmp

Filesize
3.9MB

Download
memory/4568-236-0x00007FF7ABF80000-0x00007FF7AC372000-memory.dmp

Filesize
3.9MB

Download
memory/4608-1709-0x00007FF648380000-0x00007FF648772000-memory.dmp

Filesize
3.9MB

Download
memory/4608-220-0x00007FF648380000-0x00007FF648772000-memory.dmp

Filesize
3.9MB

Download
memory/4608-8-0x00007FF648380000-0x00007FF648772000-memory.dmp

Filesize
3.9MB

Download
memory/4652-78-0x00007FF767B90000-0x00007FF767F82000-memory.dmp

Filesize
3.9MB

Download
memory/4652-1924-0x00007FF767B90000-0x00007FF767F82000-memory.dmp

Filesize
3.9MB

Download
memory/4932-1947-0x00007FF6215A0000-0x00007FF621992000-memory.dmp

Filesize
3.9MB

Download
memory/4932-74-0x00007FF6215A0000-0x00007FF621992000-memory.dmp

Filesize
3.9MB

Download
memory/4988-1996-0x00007FF68B650000-0x00007FF68BA42000-memory.dmp

Filesize
3.9MB

Download
memory/4988-244-0x00007FF68B650000-0x00007FF68BA42000-memory.dmp

Filesize
3.9MB

Download