xmrig | ce9ba08c3aa4f837c92d54bd3c791a0fc7a452a38ebbfebe8bcfb19e4c05f912

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
Size

2.0MB
MD5

23a6177a91a52011c04e7fc2225da063
SHA1

4ce2605cef1b63d9cbfa6a9c16f17808e1644653
SHA256

ce9ba08c3aa4f837c92d54bd3c791a0fc7a452a38ebbfebe8bcfb19e4c05f912
SHA512

57da395eedf6fa6ca6054849e9fe6bdbaa4dc75578ce8f778f2e5b7a011874ff25b9393a09bc8ddf9f32b298e6c65f8a778b8b23420f6172d400808e121e9268
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafG:NABx

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/1676-40-0x00007FF690520000-0x00007FF690912000-memory.dmp	xmrig
behavioral2/memory/3372-41-0x00007FF6AD510000-0x00007FF6AD902000-memory.dmp	xmrig
behavioral2/memory/744-70-0x00007FF70C620000-0x00007FF70CA12000-memory.dmp	xmrig
behavioral2/memory/1616-199-0x00007FF65C740000-0x00007FF65CB32000-memory.dmp	xmrig
behavioral2/memory/2104-198-0x00007FF7FF430000-0x00007FF7FF822000-memory.dmp	xmrig
behavioral2/memory/4384-195-0x00007FF6BB6A0000-0x00007FF6BBA92000-memory.dmp	xmrig
behavioral2/memory/3568-194-0x00007FF6371C0000-0x00007FF6375B2000-memory.dmp	xmrig
behavioral2/memory/3632-193-0x00007FF705450000-0x00007FF705842000-memory.dmp	xmrig
behavioral2/memory/2452-189-0x00007FF6DD1F0000-0x00007FF6DD5E2000-memory.dmp	xmrig
behavioral2/memory/4860-179-0x00007FF6CEBF0000-0x00007FF6CEFE2000-memory.dmp	xmrig
behavioral2/memory/2316-173-0x00007FF7645F0000-0x00007FF7649E2000-memory.dmp	xmrig
behavioral2/memory/4312-172-0x00007FF637920000-0x00007FF637D12000-memory.dmp	xmrig
behavioral2/memory/1492-164-0x00007FF7A32F0000-0x00007FF7A36E2000-memory.dmp	xmrig
behavioral2/memory/3584-154-0x00007FF61F1A0000-0x00007FF61F592000-memory.dmp	xmrig
behavioral2/memory/4568-143-0x00007FF6A3180000-0x00007FF6A3572000-memory.dmp	xmrig
behavioral2/memory/4636-137-0x00007FF707AF0000-0x00007FF707EE2000-memory.dmp	xmrig
behavioral2/memory/2044-126-0x00007FF7153A0000-0x00007FF715792000-memory.dmp	xmrig
behavioral2/memory/1264-118-0x00007FF66B920000-0x00007FF66BD12000-memory.dmp	xmrig
behavioral2/memory/1676-1914-0x00007FF690520000-0x00007FF690912000-memory.dmp	xmrig
behavioral2/memory/3372-1927-0x00007FF6AD510000-0x00007FF6AD902000-memory.dmp	xmrig
behavioral2/memory/212-1924-0x00007FF68D390000-0x00007FF68D782000-memory.dmp	xmrig
behavioral2/memory/4556-2009-0x00007FF67A6A0000-0x00007FF67AA92000-memory.dmp	xmrig
behavioral2/memory/4548-2010-0x00007FF6C6FD0000-0x00007FF6C73C2000-memory.dmp	xmrig
behavioral2/memory/4568-2060-0x00007FF6A3180000-0x00007FF6A3572000-memory.dmp	xmrig
behavioral2/memory/4628-2064-0x00007FF743DD0000-0x00007FF7441C2000-memory.dmp	xmrig
behavioral2/memory/3892-2025-0x00007FF636B40000-0x00007FF636F32000-memory.dmp	xmrig
behavioral2/memory/3944-2023-0x00007FF7C3350000-0x00007FF7C3742000-memory.dmp	xmrig
behavioral2/memory/4312-2084-0x00007FF637920000-0x00007FF637D12000-memory.dmp	xmrig
behavioral2/memory/1492-2127-0x00007FF7A32F0000-0x00007FF7A36E2000-memory.dmp	xmrig
behavioral2/memory/3568-2128-0x00007FF6371C0000-0x00007FF6375B2000-memory.dmp	xmrig
behavioral2/memory/1616-2123-0x00007FF65C740000-0x00007FF65CB32000-memory.dmp	xmrig
behavioral2/memory/4384-2122-0x00007FF6BB6A0000-0x00007FF6BBA92000-memory.dmp	xmrig
behavioral2/memory/2104-2106-0x00007FF7FF430000-0x00007FF7FF822000-memory.dmp	xmrig
behavioral2/memory/2452-2103-0x00007FF6DD1F0000-0x00007FF6DD5E2000-memory.dmp	xmrig
behavioral2/memory/2316-2101-0x00007FF7645F0000-0x00007FF7649E2000-memory.dmp	xmrig
behavioral2/memory/3632-2085-0x00007FF705450000-0x00007FF705842000-memory.dmp	xmrig
behavioral2/memory/3584-2138-0x00007FF61F1A0000-0x00007FF61F592000-memory.dmp	xmrig
behavioral2/memory/4860-2131-0x00007FF6CEBF0000-0x00007FF6CEFE2000-memory.dmp	xmrig
behavioral2/memory/4628-88-0x00007FF743DD0000-0x00007FF7441C2000-memory.dmp	xmrig
behavioral2/memory/3944-80-0x00007FF7C3350000-0x00007FF7C3742000-memory.dmp	xmrig
behavioral2/memory/4556-79-0x00007FF67A6A0000-0x00007FF67AA92000-memory.dmp	xmrig
behavioral2/memory/3892-67-0x00007FF636B40000-0x00007FF636F32000-memory.dmp	xmrig
behavioral2/memory/212-66-0x00007FF68D390000-0x00007FF68D782000-memory.dmp	xmrig
behavioral2/memory/3192-5404-0x00007FF7B4DC0000-0x00007FF7B51B2000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
3	4036	powershell.exe
6	4036	powershell.exe
11	4036	powershell.exe
12	4036	powershell.exe
14	4036	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4036	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1676	MFlAZyd.exe
3372	pCYPHhX.exe
212	jfdOyoZ.exe
3892	zrPTxDS.exe
744	XFPnJdN.exe
1264	Gfmwfge.exe
4556	UcwFfvd.exe
3944	PXoITwq.exe
2044	EFmMWLf.exe
4548	RxiuafB.exe
4636	RnmfvsM.exe
4568	rpOhtmX.exe
4628	sUfifPT.exe
3632	adJkdyK.exe
3584	cdUJrZg.exe
1492	UVaCQaa.exe
3568	BXlVtGm.exe
4312	XLcOJwc.exe
2316	QarJONV.exe
4860	dujtETQ.exe
4384	QLBDlgQ.exe
2104	whaeqOw.exe
1616	SAKotbA.exe
2452	VYPQDRJ.exe
4712	LhxNpxi.exe
4344	qLLnpBe.exe
4396	VhEVKam.exe
4112	AtLjsoU.exe
2664	FTdbPOY.exe
4988	xsxrGEo.exe
2128	HKeRHKO.exe
3780	pQAIPZz.exe
1688	iAMHqfe.exe
3232	CYvSSFF.exe
2600	ZpdjQFI.exe
4876	tnwjkiU.exe
928	lWMpIMT.exe
2572	NdolQdu.exe
4404	TOqJCTr.exe
4348	xJjvbSt.exe
2244	XVBqOAs.exe
4028	eTEFZFt.exe
4340	dtDyYPu.exe
4468	JhEFntO.exe
4588	MBUmQLB.exe
3656	eJvpRsa.exe
3560	SsNJsbs.exe
2532	ibDrVrt.exe
4460	EPpdHAn.exe
2140	Kijsspu.exe
1132	xOdVNUp.exe
4352	xFfqGcz.exe
4964	JeLSEhQ.exe
3932	EAFAtEJ.exe
1524	rxqGWPT.exe
3476	pPeqSBw.exe
988	CWwhaci.exe
1260	EflVPVw.exe
1588	GQEnFjK.exe
3720	NfmkWtF.exe
4592	blziIIZ.exe
5032	LXIvOeR.exe
2800	jWPCaWv.exe
5188	LWSFfkN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3192-0-0x00007FF7B4DC0000-0x00007FF7B51B2000-memory.dmp	upx
behavioral2/files/0x000800000002324f-6.dat	upx
behavioral2/files/0x0008000000023252-19.dat	upx
behavioral2/files/0x0009000000023253-20.dat	upx
behavioral2/files/0x0009000000023255-32.dat	upx
behavioral2/files/0x0008000000023257-35.dat	upx
behavioral2/memory/1676-40-0x00007FF690520000-0x00007FF690912000-memory.dmp	upx
behavioral2/files/0x0007000000023258-43.dat	upx
behavioral2/files/0x000700000002325a-50.dat	upx
behavioral2/files/0x000700000002325b-55.dat	upx
behavioral2/memory/3372-41-0x00007FF6AD510000-0x00007FF6AD902000-memory.dmp	upx
behavioral2/files/0x000700000002325d-63.dat	upx
behavioral2/memory/744-70-0x00007FF70C620000-0x00007FF70CA12000-memory.dmp	upx
behavioral2/files/0x000700000002325e-81.dat	upx
behavioral2/files/0x0007000000023260-83.dat	upx
behavioral2/files/0x0007000000023263-98.dat	upx
behavioral2/files/0x0007000000023264-104.dat	upx
behavioral2/files/0x0007000000023267-116.dat	upx
behavioral2/files/0x0007000000023265-125.dat	upx
behavioral2/files/0x000700000002326c-149.dat	upx
behavioral2/files/0x000700000002326f-163.dat	upx
behavioral2/files/0x000700000002326e-180.dat	upx
behavioral2/files/0x0007000000023273-191.dat	upx
behavioral2/memory/1616-199-0x00007FF65C740000-0x00007FF65CB32000-memory.dmp	upx
behavioral2/memory/2104-198-0x00007FF7FF430000-0x00007FF7FF822000-memory.dmp	upx
behavioral2/memory/4384-195-0x00007FF6BB6A0000-0x00007FF6BBA92000-memory.dmp	upx
behavioral2/memory/3568-194-0x00007FF6371C0000-0x00007FF6375B2000-memory.dmp	upx
behavioral2/memory/3632-193-0x00007FF705450000-0x00007FF705842000-memory.dmp	upx
behavioral2/files/0x0007000000023272-190.dat	upx
behavioral2/memory/2452-189-0x00007FF6DD1F0000-0x00007FF6DD5E2000-memory.dmp	upx
behavioral2/files/0x0007000000023271-185.dat	upx
behavioral2/files/0x0007000000023270-183.dat	upx
behavioral2/memory/4860-179-0x00007FF6CEBF0000-0x00007FF6CEFE2000-memory.dmp	upx
behavioral2/files/0x000700000002326d-177.dat	upx
behavioral2/memory/2316-173-0x00007FF7645F0000-0x00007FF7649E2000-memory.dmp	upx
behavioral2/memory/4312-172-0x00007FF637920000-0x00007FF637D12000-memory.dmp	upx
behavioral2/memory/1492-164-0x00007FF7A32F0000-0x00007FF7A36E2000-memory.dmp	upx
behavioral2/files/0x000700000002326b-157.dat	upx
behavioral2/files/0x000700000002326a-156.dat	upx
behavioral2/memory/3584-154-0x00007FF61F1A0000-0x00007FF61F592000-memory.dmp	upx
behavioral2/files/0x0007000000023269-146.dat	upx
behavioral2/memory/4568-143-0x00007FF6A3180000-0x00007FF6A3572000-memory.dmp	upx
behavioral2/memory/4636-137-0x00007FF707AF0000-0x00007FF707EE2000-memory.dmp	upx
behavioral2/files/0x0007000000023266-130.dat	upx
behavioral2/files/0x0007000000023268-129.dat	upx
behavioral2/memory/2044-126-0x00007FF7153A0000-0x00007FF715792000-memory.dmp	upx
behavioral2/memory/1264-118-0x00007FF66B920000-0x00007FF66BD12000-memory.dmp	upx
behavioral2/files/0x0007000000023261-117.dat	upx
behavioral2/files/0x0007000000023262-110.dat	upx
behavioral2/memory/1676-1914-0x00007FF690520000-0x00007FF690912000-memory.dmp	upx
behavioral2/memory/3372-1927-0x00007FF6AD510000-0x00007FF6AD902000-memory.dmp	upx
behavioral2/memory/212-1924-0x00007FF68D390000-0x00007FF68D782000-memory.dmp	upx
behavioral2/memory/4556-2009-0x00007FF67A6A0000-0x00007FF67AA92000-memory.dmp	upx
behavioral2/memory/4548-2010-0x00007FF6C6FD0000-0x00007FF6C73C2000-memory.dmp	upx
behavioral2/memory/4568-2060-0x00007FF6A3180000-0x00007FF6A3572000-memory.dmp	upx
behavioral2/memory/4628-2064-0x00007FF743DD0000-0x00007FF7441C2000-memory.dmp	upx
behavioral2/memory/3892-2025-0x00007FF636B40000-0x00007FF636F32000-memory.dmp	upx
behavioral2/memory/3944-2023-0x00007FF7C3350000-0x00007FF7C3742000-memory.dmp	upx
behavioral2/memory/4312-2084-0x00007FF637920000-0x00007FF637D12000-memory.dmp	upx
behavioral2/memory/1492-2127-0x00007FF7A32F0000-0x00007FF7A36E2000-memory.dmp	upx
behavioral2/memory/3568-2128-0x00007FF6371C0000-0x00007FF6375B2000-memory.dmp	upx
behavioral2/memory/1616-2123-0x00007FF65C740000-0x00007FF65CB32000-memory.dmp	upx
behavioral2/memory/4384-2122-0x00007FF6BB6A0000-0x00007FF6BBA92000-memory.dmp	upx
behavioral2/memory/2104-2106-0x00007FF7FF430000-0x00007FF7FF822000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JTSKUGZ.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\mgrRcGw.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\TyHBgSe.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\MnsLlKO.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\gzCQsoJ.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\RxiuafB.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\dRCxciS.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\otnmjsI.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\USuEKDl.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\QarJONV.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\cUsFzwf.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\gOjTRuU.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\HCzaRtS.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\wrEDaBU.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\adJkdyK.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\lDeHGFs.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\HlEEdpR.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\VhEVKam.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\yRHPINj.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\XVBqOAs.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\GQEnFjK.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\MpnnpGM.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\DiWSQxb.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\rpOhtmX.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\EcJoAco.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\BUygyvn.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\UjlIDjX.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\HstcXWi.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\rxqGWPT.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\oEwpcNd.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\MhzddqK.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\ibDrVrt.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\ahOtNTx.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\vluOcoJ.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\BPWSpOl.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\RTBToNl.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\cKjmZUA.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\MBUmQLB.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\IjoHkxy.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\jguTvJZ.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\vGiDHim.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\LxZOkGB.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\lixKQAe.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\Kijsspu.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\ZIWENzX.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\iIAHmuh.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\jsJfOBG.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\qPlLBsv.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\kjGMvYv.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\MsiLLik.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\Gfmwfge.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\HvsBzZU.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\bfrteom.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\mYrabhG.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\DxsKTMW.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\LhxNpxi.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\jhMQqqC.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\pcgWrxo.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\cpbTVAu.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\eJvpRsa.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\xOdVNUp.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\bZsHIhs.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\dtDyYPu.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\XLcOJwc.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4036	powershell.exe
4036	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeLockMemoryPrivilege	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 4036	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	93
PID 3192 wrote to memory of 4036	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	93
PID 3192 wrote to memory of 1676	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	94
PID 3192 wrote to memory of 1676	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	94
PID 3192 wrote to memory of 3372	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	95
PID 3192 wrote to memory of 3372	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	95
PID 3192 wrote to memory of 212	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	96
PID 3192 wrote to memory of 212	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	96
PID 3192 wrote to memory of 3892	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	97
PID 3192 wrote to memory of 3892	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	97
PID 3192 wrote to memory of 744	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	98
PID 3192 wrote to memory of 744	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	98
PID 3192 wrote to memory of 1264	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	99
PID 3192 wrote to memory of 1264	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	99
PID 3192 wrote to memory of 4556	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	100
PID 3192 wrote to memory of 4556	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	100
PID 3192 wrote to memory of 3944	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	101
PID 3192 wrote to memory of 3944	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	101
PID 3192 wrote to memory of 2044	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	102
PID 3192 wrote to memory of 2044	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	102
PID 3192 wrote to memory of 4548	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	103
PID 3192 wrote to memory of 4548	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	103
PID 3192 wrote to memory of 4636	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	104
PID 3192 wrote to memory of 4636	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	104
PID 3192 wrote to memory of 4568	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	105
PID 3192 wrote to memory of 4568	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	105
PID 3192 wrote to memory of 4628	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	106
PID 3192 wrote to memory of 4628	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	106
PID 3192 wrote to memory of 3632	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	107
PID 3192 wrote to memory of 3632	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	107
PID 3192 wrote to memory of 3584	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	108
PID 3192 wrote to memory of 3584	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	108
PID 3192 wrote to memory of 1492	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	109
PID 3192 wrote to memory of 1492	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	109
PID 3192 wrote to memory of 3568	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	110
PID 3192 wrote to memory of 3568	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	110
PID 3192 wrote to memory of 4312	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	111
PID 3192 wrote to memory of 4312	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	111
PID 3192 wrote to memory of 2316	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	112
PID 3192 wrote to memory of 2316	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	112
PID 3192 wrote to memory of 4860	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	113
PID 3192 wrote to memory of 4860	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	113
PID 3192 wrote to memory of 4384	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	114
PID 3192 wrote to memory of 4384	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	114
PID 3192 wrote to memory of 2104	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	115
PID 3192 wrote to memory of 2104	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	115
PID 3192 wrote to memory of 1616	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	116
PID 3192 wrote to memory of 1616	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	116
PID 3192 wrote to memory of 2452	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	117
PID 3192 wrote to memory of 2452	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	117
PID 3192 wrote to memory of 4712	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	118
PID 3192 wrote to memory of 4712	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	118
PID 3192 wrote to memory of 4344	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	119
PID 3192 wrote to memory of 4344	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	119
PID 3192 wrote to memory of 4396	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	120
PID 3192 wrote to memory of 4396	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	120
PID 3192 wrote to memory of 4112	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	121
PID 3192 wrote to memory of 4112	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	121
PID 3192 wrote to memory of 2664	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	122
PID 3192 wrote to memory of 2664	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	122
PID 3192 wrote to memory of 4988	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	123
PID 3192 wrote to memory of 4988	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	123
PID 3192 wrote to memory of 2128	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	124
PID 3192 wrote to memory of 2128	3192	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	124

C:\Users\Admin\AppData\Local\Temp\23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4036
- C:\Windows\System\MFlAZyd.exe
  C:\Windows\System\MFlAZyd.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\pCYPHhX.exe
  C:\Windows\System\pCYPHhX.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\jfdOyoZ.exe
  C:\Windows\System\jfdOyoZ.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\zrPTxDS.exe
  C:\Windows\System\zrPTxDS.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\XFPnJdN.exe
  C:\Windows\System\XFPnJdN.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\Gfmwfge.exe
  C:\Windows\System\Gfmwfge.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\UcwFfvd.exe
  C:\Windows\System\UcwFfvd.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\PXoITwq.exe
  C:\Windows\System\PXoITwq.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\EFmMWLf.exe
  C:\Windows\System\EFmMWLf.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\RxiuafB.exe
  C:\Windows\System\RxiuafB.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\RnmfvsM.exe
  C:\Windows\System\RnmfvsM.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\rpOhtmX.exe
  C:\Windows\System\rpOhtmX.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\sUfifPT.exe
  C:\Windows\System\sUfifPT.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\adJkdyK.exe
  C:\Windows\System\adJkdyK.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\cdUJrZg.exe
  C:\Windows\System\cdUJrZg.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\UVaCQaa.exe
  C:\Windows\System\UVaCQaa.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\BXlVtGm.exe
  C:\Windows\System\BXlVtGm.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\XLcOJwc.exe
  C:\Windows\System\XLcOJwc.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\QarJONV.exe
  C:\Windows\System\QarJONV.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\dujtETQ.exe
  C:\Windows\System\dujtETQ.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\QLBDlgQ.exe
  C:\Windows\System\QLBDlgQ.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\whaeqOw.exe
  C:\Windows\System\whaeqOw.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\SAKotbA.exe
  C:\Windows\System\SAKotbA.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\VYPQDRJ.exe
  C:\Windows\System\VYPQDRJ.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\LhxNpxi.exe
  C:\Windows\System\LhxNpxi.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\qLLnpBe.exe
  C:\Windows\System\qLLnpBe.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\VhEVKam.exe
  C:\Windows\System\VhEVKam.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\AtLjsoU.exe
  C:\Windows\System\AtLjsoU.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\FTdbPOY.exe
  C:\Windows\System\FTdbPOY.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\xsxrGEo.exe
  C:\Windows\System\xsxrGEo.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\HKeRHKO.exe
  C:\Windows\System\HKeRHKO.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\pQAIPZz.exe
  C:\Windows\System\pQAIPZz.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\iAMHqfe.exe
  C:\Windows\System\iAMHqfe.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\CYvSSFF.exe
  C:\Windows\System\CYvSSFF.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\ZpdjQFI.exe
  C:\Windows\System\ZpdjQFI.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\tnwjkiU.exe
  C:\Windows\System\tnwjkiU.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\lWMpIMT.exe
  C:\Windows\System\lWMpIMT.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\NdolQdu.exe
  C:\Windows\System\NdolQdu.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\TOqJCTr.exe
  C:\Windows\System\TOqJCTr.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\xJjvbSt.exe
  C:\Windows\System\xJjvbSt.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\XVBqOAs.exe
  C:\Windows\System\XVBqOAs.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\eTEFZFt.exe
  C:\Windows\System\eTEFZFt.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\dtDyYPu.exe
  C:\Windows\System\dtDyYPu.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\JhEFntO.exe
  C:\Windows\System\JhEFntO.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\MBUmQLB.exe
  C:\Windows\System\MBUmQLB.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\eJvpRsa.exe
  C:\Windows\System\eJvpRsa.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\SsNJsbs.exe
  C:\Windows\System\SsNJsbs.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\ibDrVrt.exe
  C:\Windows\System\ibDrVrt.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\EPpdHAn.exe
  C:\Windows\System\EPpdHAn.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\Kijsspu.exe
  C:\Windows\System\Kijsspu.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\xOdVNUp.exe
  C:\Windows\System\xOdVNUp.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\xFfqGcz.exe
  C:\Windows\System\xFfqGcz.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\JeLSEhQ.exe
  C:\Windows\System\JeLSEhQ.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\EAFAtEJ.exe
  C:\Windows\System\EAFAtEJ.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\rxqGWPT.exe
  C:\Windows\System\rxqGWPT.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\pPeqSBw.exe
  C:\Windows\System\pPeqSBw.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\CWwhaci.exe
  C:\Windows\System\CWwhaci.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\EflVPVw.exe
  C:\Windows\System\EflVPVw.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\GQEnFjK.exe
  C:\Windows\System\GQEnFjK.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\NfmkWtF.exe
  C:\Windows\System\NfmkWtF.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\blziIIZ.exe
  C:\Windows\System\blziIIZ.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\LXIvOeR.exe
  C:\Windows\System\LXIvOeR.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\jWPCaWv.exe
  C:\Windows\System\jWPCaWv.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\oJtzjNN.exe
  C:\Windows\System\oJtzjNN.exe
  2⤵
  PID:5152
- C:\Windows\System\LWSFfkN.exe
  C:\Windows\System\LWSFfkN.exe
  2⤵
  - Executes dropped EXE
  PID:5188
- C:\Windows\System\AGzLhNs.exe
  C:\Windows\System\AGzLhNs.exe
  2⤵
  PID:5208
- C:\Windows\System\IbnCaCT.exe
  C:\Windows\System\IbnCaCT.exe
  2⤵
  PID:5232
- C:\Windows\System\yDVAgVg.exe
  C:\Windows\System\yDVAgVg.exe
  2⤵
  PID:5284
- C:\Windows\System\JVrJzNn.exe
  C:\Windows\System\JVrJzNn.exe
  2⤵
  PID:5336
- C:\Windows\System\QbtEXZQ.exe
  C:\Windows\System\QbtEXZQ.exe
  2⤵
  PID:5360
- C:\Windows\System\MhzddqK.exe
  C:\Windows\System\MhzddqK.exe
  2⤵
  PID:5392
- C:\Windows\System\yYSvWrn.exe
  C:\Windows\System\yYSvWrn.exe
  2⤵
  PID:5436
- C:\Windows\System\zkFLFGQ.exe
  C:\Windows\System\zkFLFGQ.exe
  2⤵
  PID:5468
- C:\Windows\System\RuqzaMa.exe
  C:\Windows\System\RuqzaMa.exe
  2⤵
  PID:5496
- C:\Windows\System\aZJqtsG.exe
  C:\Windows\System\aZJqtsG.exe
  2⤵
  PID:5524
- C:\Windows\System\JTSKUGZ.exe
  C:\Windows\System\JTSKUGZ.exe
  2⤵
  PID:5564
- C:\Windows\System\dZrpmwb.exe
  C:\Windows\System\dZrpmwb.exe
  2⤵
  PID:5660
- C:\Windows\System\DBBldfs.exe
  C:\Windows\System\DBBldfs.exe
  2⤵
  PID:5684
- C:\Windows\System\mgrRcGw.exe
  C:\Windows\System\mgrRcGw.exe
  2⤵
  PID:5724
- C:\Windows\System\KOfpyCZ.exe
  C:\Windows\System\KOfpyCZ.exe
  2⤵
  PID:5748
- C:\Windows\System\YcahlUg.exe
  C:\Windows\System\YcahlUg.exe
  2⤵
  PID:5780
- C:\Windows\System\tjVeslK.exe
  C:\Windows\System\tjVeslK.exe
  2⤵
  PID:5840
- C:\Windows\System\aoOCtWH.exe
  C:\Windows\System\aoOCtWH.exe
  2⤵
  PID:5872
- C:\Windows\System\isAjTjm.exe
  C:\Windows\System\isAjTjm.exe
  2⤵
  PID:5904
- C:\Windows\System\kyTcgHm.exe
  C:\Windows\System\kyTcgHm.exe
  2⤵
  PID:5944
- C:\Windows\System\ahOtNTx.exe
  C:\Windows\System\ahOtNTx.exe
  2⤵
  PID:6032
- C:\Windows\System\USuEKDl.exe
  C:\Windows\System\USuEKDl.exe
  2⤵
  PID:6068
- C:\Windows\System\SRgGOtM.exe
  C:\Windows\System\SRgGOtM.exe
  2⤵
  PID:6088
- C:\Windows\System\DQBZzlT.exe
  C:\Windows\System\DQBZzlT.exe
  2⤵
  PID:6108
- C:\Windows\System\CGHkjsl.exe
  C:\Windows\System\CGHkjsl.exe
  2⤵
  PID:6132
- C:\Windows\System\mUyUqNz.exe
  C:\Windows\System\mUyUqNz.exe
  2⤵
  PID:1536
- C:\Windows\System\jhMQqqC.exe
  C:\Windows\System\jhMQqqC.exe
  2⤵
  PID:1540
- C:\Windows\System\xJYmPUK.exe
  C:\Windows\System\xJYmPUK.exe
  2⤵
  PID:4436
- C:\Windows\System\XgyYiqS.exe
  C:\Windows\System\XgyYiqS.exe
  2⤵
  PID:5180
- C:\Windows\System\qKYBGYF.exe
  C:\Windows\System\qKYBGYF.exe
  2⤵
  PID:5172
- C:\Windows\System\IJaCFZX.exe
  C:\Windows\System\IJaCFZX.exe
  2⤵
  PID:5300
- C:\Windows\System\bfrteom.exe
  C:\Windows\System\bfrteom.exe
  2⤵
  PID:5268
- C:\Windows\System\krRQAIK.exe
  C:\Windows\System\krRQAIK.exe
  2⤵
  PID:5240
- C:\Windows\System\ZIWENzX.exe
  C:\Windows\System\ZIWENzX.exe
  2⤵
  PID:5420
- C:\Windows\System\OJqJBzB.exe
  C:\Windows\System\OJqJBzB.exe
  2⤵
  PID:5368
- C:\Windows\System\FTefphT.exe
  C:\Windows\System\FTefphT.exe
  2⤵
  PID:5400
- C:\Windows\System\hXqtYIX.exe
  C:\Windows\System\hXqtYIX.exe
  2⤵
  PID:5552
- C:\Windows\System\YKxzkbS.exe
  C:\Windows\System\YKxzkbS.exe
  2⤵
  PID:5452
- C:\Windows\System\jchMyWw.exe
  C:\Windows\System\jchMyWw.exe
  2⤵
  PID:5460
- C:\Windows\System\aqQcSwy.exe
  C:\Windows\System\aqQcSwy.exe
  2⤵
  PID:5572
- C:\Windows\System\vluOcoJ.exe
  C:\Windows\System\vluOcoJ.exe
  2⤵
  PID:5604
- C:\Windows\System\IjoHkxy.exe
  C:\Windows\System\IjoHkxy.exe
  2⤵
  PID:5672
- C:\Windows\System\HstcXWi.exe
  C:\Windows\System\HstcXWi.exe
  2⤵
  PID:5732
- C:\Windows\System\UhUHzBa.exe
  C:\Windows\System\UhUHzBa.exe
  2⤵
  PID:5808
- C:\Windows\System\jJfhvKZ.exe
  C:\Windows\System\jJfhvKZ.exe
  2⤵
  PID:5928
- C:\Windows\System\LRyBrvw.exe
  C:\Windows\System\LRyBrvw.exe
  2⤵
  PID:5736
- C:\Windows\System\MFlKpNj.exe
  C:\Windows\System\MFlKpNj.exe
  2⤵
  PID:5792
- C:\Windows\System\hWMyLJt.exe
  C:\Windows\System\hWMyLJt.exe
  2⤵
  PID:5848
- C:\Windows\System\LGYRneh.exe
  C:\Windows\System\LGYRneh.exe
  2⤵
  PID:5760
- C:\Windows\System\evLcklX.exe
  C:\Windows\System\evLcklX.exe
  2⤵
  PID:5912
- C:\Windows\System\AtOlkfJ.exe
  C:\Windows\System\AtOlkfJ.exe
  2⤵
  PID:6100
- C:\Windows\System\BPWSpOl.exe
  C:\Windows\System\BPWSpOl.exe
  2⤵
  PID:2428
- C:\Windows\System\syzfXUt.exe
  C:\Windows\System\syzfXUt.exe
  2⤵
  PID:3544
- C:\Windows\System\lemhIAe.exe
  C:\Windows\System\lemhIAe.exe
  2⤵
  PID:3820
- C:\Windows\System\BqvyStA.exe
  C:\Windows\System\BqvyStA.exe
  2⤵
  PID:5204
- C:\Windows\System\eZkmRVg.exe
  C:\Windows\System\eZkmRVg.exe
  2⤵
  PID:5148
- C:\Windows\System\lnmeDtW.exe
  C:\Windows\System\lnmeDtW.exe
  2⤵
  PID:5176
- C:\Windows\System\ookBLPV.exe
  C:\Windows\System\ookBLPV.exe
  2⤵
  PID:3732
- C:\Windows\System\FaHwxQN.exe
  C:\Windows\System\FaHwxQN.exe
  2⤵
  PID:5656
- C:\Windows\System\GidLUek.exe
  C:\Windows\System\GidLUek.exe
  2⤵
  PID:5404
- C:\Windows\System\lDeHGFs.exe
  C:\Windows\System\lDeHGFs.exe
  2⤵
  PID:4608
- C:\Windows\System\fQoFMyV.exe
  C:\Windows\System\fQoFMyV.exe
  2⤵
  PID:3664
- C:\Windows\System\UjlIDjX.exe
  C:\Windows\System\UjlIDjX.exe
  2⤵
  PID:5884
- C:\Windows\System\ODHHrbw.exe
  C:\Windows\System\ODHHrbw.exe
  2⤵
  PID:4696
- C:\Windows\System\ygtbvMO.exe
  C:\Windows\System\ygtbvMO.exe
  2⤵
  PID:5976
- C:\Windows\System\cUsFzwf.exe
  C:\Windows\System\cUsFzwf.exe
  2⤵
  PID:3968
- C:\Windows\System\RTBToNl.exe
  C:\Windows\System\RTBToNl.exe
  2⤵
  PID:2340
- C:\Windows\System\RvquCUy.exe
  C:\Windows\System\RvquCUy.exe
  2⤵
  PID:6156
- C:\Windows\System\GDtcazw.exe
  C:\Windows\System\GDtcazw.exe
  2⤵
  PID:6172
- C:\Windows\System\dRCxciS.exe
  C:\Windows\System\dRCxciS.exe
  2⤵
  PID:6192
- C:\Windows\System\TyHBgSe.exe
  C:\Windows\System\TyHBgSe.exe
  2⤵
  PID:6216
- C:\Windows\System\mVsHVCY.exe
  C:\Windows\System\mVsHVCY.exe
  2⤵
  PID:6248
- C:\Windows\System\zJhDeQt.exe
  C:\Windows\System\zJhDeQt.exe
  2⤵
  PID:6284
- C:\Windows\System\mYrabhG.exe
  C:\Windows\System\mYrabhG.exe
  2⤵
  PID:6308
- C:\Windows\System\LmHMGUv.exe
  C:\Windows\System\LmHMGUv.exe
  2⤵
  PID:6328
- C:\Windows\System\VpKPVNN.exe
  C:\Windows\System\VpKPVNN.exe
  2⤵
  PID:6348
- C:\Windows\System\jguTvJZ.exe
  C:\Windows\System\jguTvJZ.exe
  2⤵
  PID:6372
- C:\Windows\System\VzaleVn.exe
  C:\Windows\System\VzaleVn.exe
  2⤵
  PID:6404
- C:\Windows\System\phargVa.exe
  C:\Windows\System\phargVa.exe
  2⤵
  PID:6428
- C:\Windows\System\DxsKTMW.exe
  C:\Windows\System\DxsKTMW.exe
  2⤵
  PID:6448
- C:\Windows\System\hxKdfhF.exe
  C:\Windows\System\hxKdfhF.exe
  2⤵
  PID:6472
- C:\Windows\System\KvsXFGt.exe
  C:\Windows\System\KvsXFGt.exe
  2⤵
  PID:6492
- C:\Windows\System\DmOPlJU.exe
  C:\Windows\System\DmOPlJU.exe
  2⤵
  PID:6512
- C:\Windows\System\iIAHmuh.exe
  C:\Windows\System\iIAHmuh.exe
  2⤵
  PID:6532
- C:\Windows\System\IlShyek.exe
  C:\Windows\System\IlShyek.exe
  2⤵
  PID:6564
- C:\Windows\System\iXLUNJZ.exe
  C:\Windows\System\iXLUNJZ.exe
  2⤵
  PID:6580
- C:\Windows\System\GnkINhg.exe
  C:\Windows\System\GnkINhg.exe
  2⤵
  PID:6600
- C:\Windows\System\rzSJXTC.exe
  C:\Windows\System\rzSJXTC.exe
  2⤵
  PID:6624
- C:\Windows\System\giSxKee.exe
  C:\Windows\System\giSxKee.exe
  2⤵
  PID:6644
- C:\Windows\System\BhMtqrA.exe
  C:\Windows\System\BhMtqrA.exe
  2⤵
  PID:6668
- C:\Windows\System\zIPbbST.exe
  C:\Windows\System\zIPbbST.exe
  2⤵
  PID:6684
- C:\Windows\System\bVagwix.exe
  C:\Windows\System\bVagwix.exe
  2⤵
  PID:6708
- C:\Windows\System\FtRqQCn.exe
  C:\Windows\System\FtRqQCn.exe
  2⤵
  PID:6732
- C:\Windows\System\AcYEzsz.exe
  C:\Windows\System\AcYEzsz.exe
  2⤵
  PID:6752
- C:\Windows\System\hrUXnsU.exe
  C:\Windows\System\hrUXnsU.exe
  2⤵
  PID:6776
- C:\Windows\System\gOjTRuU.exe
  C:\Windows\System\gOjTRuU.exe
  2⤵
  PID:6800
- C:\Windows\System\QsTUXLd.exe
  C:\Windows\System\QsTUXLd.exe
  2⤵
  PID:6824
- C:\Windows\System\bvLYtpn.exe
  C:\Windows\System\bvLYtpn.exe
  2⤵
  PID:6848
- C:\Windows\System\MnsLlKO.exe
  C:\Windows\System\MnsLlKO.exe
  2⤵
  PID:6864
- C:\Windows\System\KpDTJSF.exe
  C:\Windows\System\KpDTJSF.exe
  2⤵
  PID:6888
- C:\Windows\System\VdVStlv.exe
  C:\Windows\System\VdVStlv.exe
  2⤵
  PID:6912
- C:\Windows\System\cvthJgQ.exe
  C:\Windows\System\cvthJgQ.exe
  2⤵
  PID:6932
- C:\Windows\System\bJmnMor.exe
  C:\Windows\System\bJmnMor.exe
  2⤵
  PID:6952
- C:\Windows\System\pcgWrxo.exe
  C:\Windows\System\pcgWrxo.exe
  2⤵
  PID:6968
- C:\Windows\System\itDtyye.exe
  C:\Windows\System\itDtyye.exe
  2⤵
  PID:6992
- C:\Windows\System\Rovjsvw.exe
  C:\Windows\System\Rovjsvw.exe
  2⤵
  PID:7016
- C:\Windows\System\WSnVZNA.exe
  C:\Windows\System\WSnVZNA.exe
  2⤵
  PID:7032
- C:\Windows\System\fnaWrFp.exe
  C:\Windows\System\fnaWrFp.exe
  2⤵
  PID:7056
- C:\Windows\System\cABFiBj.exe
  C:\Windows\System\cABFiBj.exe
  2⤵
  PID:7076
- C:\Windows\System\HCzaRtS.exe
  C:\Windows\System\HCzaRtS.exe
  2⤵
  PID:7096
- C:\Windows\System\hcHrFve.exe
  C:\Windows\System\hcHrFve.exe
  2⤵
  PID:7124
- C:\Windows\System\yUdjsEW.exe
  C:\Windows\System\yUdjsEW.exe
  2⤵
  PID:7140
- C:\Windows\System\mPoCSOo.exe
  C:\Windows\System\mPoCSOo.exe
  2⤵
  PID:7164
- C:\Windows\System\FtlavpC.exe
  C:\Windows\System\FtlavpC.exe
  2⤵
  PID:5940
- C:\Windows\System\TwTpEkm.exe
  C:\Windows\System\TwTpEkm.exe
  2⤵
  PID:5960
- C:\Windows\System\UdNRxjr.exe
  C:\Windows\System\UdNRxjr.exe
  2⤵
  PID:6020
- C:\Windows\System\sIjLXWg.exe
  C:\Windows\System\sIjLXWg.exe
  2⤵
  PID:5376
- C:\Windows\System\HALnAuf.exe
  C:\Windows\System\HALnAuf.exe
  2⤵
  PID:6180
- C:\Windows\System\QLHtxsk.exe
  C:\Windows\System\QLHtxsk.exe
  2⤵
  PID:6224
- C:\Windows\System\yXJluzt.exe
  C:\Windows\System\yXJluzt.exe
  2⤵
  PID:6300
- C:\Windows\System\Xrvhwyt.exe
  C:\Windows\System\Xrvhwyt.exe
  2⤵
  PID:6356
- C:\Windows\System\wmDWpot.exe
  C:\Windows\System\wmDWpot.exe
  2⤵
  PID:6416
- C:\Windows\System\wJGhvMf.exe
  C:\Windows\System\wJGhvMf.exe
  2⤵
  PID:6444
- C:\Windows\System\EtapRIA.exe
  C:\Windows\System\EtapRIA.exe
  2⤵
  PID:6484
- C:\Windows\System\jsJfOBG.exe
  C:\Windows\System\jsJfOBG.exe
  2⤵
  PID:2852
- C:\Windows\System\EASiwsX.exe
  C:\Windows\System\EASiwsX.exe
  2⤵
  PID:6324
- C:\Windows\System\nJgIPEv.exe
  C:\Windows\System\nJgIPEv.exe
  2⤵
  PID:6588
- C:\Windows\System\tnGpVEK.exe
  C:\Windows\System\tnGpVEK.exe
  2⤵
  PID:6656
- C:\Windows\System\NrjUivZ.exe
  C:\Windows\System\NrjUivZ.exe
  2⤵
  PID:4688
- C:\Windows\System\FjYCfdr.exe
  C:\Windows\System\FjYCfdr.exe
  2⤵
  PID:5448
- C:\Windows\System\dyiOHWs.exe
  C:\Windows\System\dyiOHWs.exe
  2⤵
  PID:6464
- C:\Windows\System\XeUNsHm.exe
  C:\Windows\System\XeUNsHm.exe
  2⤵
  PID:6292
- C:\Windows\System\gOPJaHI.exe
  C:\Windows\System\gOPJaHI.exe
  2⤵
  PID:6544
- C:\Windows\System\KhTSekq.exe
  C:\Windows\System\KhTSekq.exe
  2⤵
  PID:6880
- C:\Windows\System\qCUJWpC.exe
  C:\Windows\System\qCUJWpC.exe
  2⤵
  PID:6676
- C:\Windows\System\FihIAof.exe
  C:\Windows\System\FihIAof.exe
  2⤵
  PID:6984
- C:\Windows\System\otnmjsI.exe
  C:\Windows\System\otnmjsI.exe
  2⤵
  PID:7172
- C:\Windows\System\gqQaFlW.exe
  C:\Windows\System\gqQaFlW.exe
  2⤵
  PID:7192
- C:\Windows\System\qPlLBsv.exe
  C:\Windows\System\qPlLBsv.exe
  2⤵
  PID:7368
- C:\Windows\System\bZsHIhs.exe
  C:\Windows\System\bZsHIhs.exe
  2⤵
  PID:7388
- C:\Windows\System\oEwpcNd.exe
  C:\Windows\System\oEwpcNd.exe
  2⤵
  PID:7408
- C:\Windows\System\vGiDHim.exe
  C:\Windows\System\vGiDHim.exe
  2⤵
  PID:7432
- C:\Windows\System\DNGvupM.exe
  C:\Windows\System\DNGvupM.exe
  2⤵
  PID:7452
- C:\Windows\System\yRHPINj.exe
  C:\Windows\System\yRHPINj.exe
  2⤵
  PID:7472
- C:\Windows\System\yJqfzkq.exe
  C:\Windows\System\yJqfzkq.exe
  2⤵
  PID:7492
- C:\Windows\System\LxZOkGB.exe
  C:\Windows\System\LxZOkGB.exe
  2⤵
  PID:7512
- C:\Windows\System\kvZrEFI.exe
  C:\Windows\System\kvZrEFI.exe
  2⤵
  PID:7536
- C:\Windows\System\BCURxZW.exe
  C:\Windows\System\BCURxZW.exe
  2⤵
  PID:7556
- C:\Windows\System\iMwtxKn.exe
  C:\Windows\System\iMwtxKn.exe
  2⤵
  PID:7576
- C:\Windows\System\XwYGaEk.exe
  C:\Windows\System\XwYGaEk.exe
  2⤵
  PID:7596
- C:\Windows\System\QzPItgp.exe
  C:\Windows\System\QzPItgp.exe
  2⤵
  PID:7616
- C:\Windows\System\rJXuOiB.exe
  C:\Windows\System\rJXuOiB.exe
  2⤵
  PID:7664
- C:\Windows\System\EcJoAco.exe
  C:\Windows\System\EcJoAco.exe
  2⤵
  PID:7688
- C:\Windows\System\GcJWSpz.exe
  C:\Windows\System\GcJWSpz.exe
  2⤵
  PID:7712
- C:\Windows\System\ySiyObb.exe
  C:\Windows\System\ySiyObb.exe
  2⤵
  PID:7740
- C:\Windows\System\QWKwEzp.exe
  C:\Windows\System\QWKwEzp.exe
  2⤵
  PID:7760
- C:\Windows\System\XQwZUTC.exe
  C:\Windows\System\XQwZUTC.exe
  2⤵
  PID:7788
- C:\Windows\System\HvsBzZU.exe
  C:\Windows\System\HvsBzZU.exe
  2⤵
  PID:7808
- C:\Windows\System\FipylXa.exe
  C:\Windows\System\FipylXa.exe
  2⤵
  PID:7844
- C:\Windows\System\uMgZSFx.exe
  C:\Windows\System\uMgZSFx.exe
  2⤵
  PID:7864
- C:\Windows\System\jCMLlKN.exe
  C:\Windows\System\jCMLlKN.exe
  2⤵
  PID:7888
- C:\Windows\System\MpnnpGM.exe
  C:\Windows\System\MpnnpGM.exe
  2⤵
  PID:7908
- C:\Windows\System\JZfizqF.exe
  C:\Windows\System\JZfizqF.exe
  2⤵
  PID:7928
- C:\Windows\System\VtLJWWT.exe
  C:\Windows\System\VtLJWWT.exe
  2⤵
  PID:7952
- C:\Windows\System\VqVTlQL.exe
  C:\Windows\System\VqVTlQL.exe
  2⤵
  PID:7972
- C:\Windows\System\ZGKFTKJ.exe
  C:\Windows\System\ZGKFTKJ.exe
  2⤵
  PID:7992
- C:\Windows\System\BUygyvn.exe
  C:\Windows\System\BUygyvn.exe
  2⤵
  PID:8012
- C:\Windows\System\oZKJbfx.exe
  C:\Windows\System\oZKJbfx.exe
  2⤵
  PID:8032
- C:\Windows\System\cKjmZUA.exe
  C:\Windows\System\cKjmZUA.exe
  2⤵
  PID:8048
- C:\Windows\System\DiWSQxb.exe
  C:\Windows\System\DiWSQxb.exe
  2⤵
  PID:8068
- C:\Windows\System\MreitOu.exe
  C:\Windows\System\MreitOu.exe
  2⤵
  PID:8096
- C:\Windows\System\wrEDaBU.exe
  C:\Windows\System\wrEDaBU.exe
  2⤵
  PID:8112
- C:\Windows\System\VXcJAhN.exe
  C:\Windows\System\VXcJAhN.exe
  2⤵
  PID:8136
- C:\Windows\System\gzCQsoJ.exe
  C:\Windows\System\gzCQsoJ.exe
  2⤵
  PID:8152
- C:\Windows\System\cpbTVAu.exe
  C:\Windows\System\cpbTVAu.exe
  2⤵
  PID:8172
- C:\Windows\System\kjGMvYv.exe
  C:\Windows\System\kjGMvYv.exe
  2⤵
  PID:7068
- C:\Windows\System\HlEEdpR.exe
  C:\Windows\System\HlEEdpR.exe
  2⤵
  PID:968
- C:\Windows\System\idKWHBn.exe
  C:\Windows\System\idKWHBn.exe
  2⤵
  PID:6164
- C:\Windows\System\GfBhLPi.exe
  C:\Windows\System\GfBhLPi.exe
  2⤵
  PID:5720
- C:\Windows\System\FQieaEK.exe
  C:\Windows\System\FQieaEK.exe
  2⤵
  PID:6784
- C:\Windows\System\gxXbWdq.exe
  C:\Windows\System\gxXbWdq.exe
  2⤵
  PID:6344
- C:\Windows\System\MsiLLik.exe
  C:\Windows\System\MsiLLik.exe
  2⤵
  PID:6920
- C:\Windows\System\lixKQAe.exe
  C:\Windows\System\lixKQAe.exe
  2⤵
  PID:6364
- C:\Windows\System\WdAQmLW.exe
  C:\Windows\System\WdAQmLW.exe
  2⤵
  PID:7048
- C:\Windows\System\ECXMkpB.exe
  C:\Windows\System\ECXMkpB.exe
  2⤵
  PID:7108
- C:\Windows\System\raNZIPK.exe
  C:\Windows\System\raNZIPK.exe
  2⤵
  PID:5296
- C:\Windows\System\cDmCLGB.exe
  C:\Windows\System\cDmCLGB.exe
  2⤵
  PID:5864
- C:\Windows\System\XpqjtxJ.exe
  C:\Windows\System\XpqjtxJ.exe
  2⤵
  PID:7584
- C:\Windows\System\hnGcnbM.exe
  C:\Windows\System\hnGcnbM.exe
  2⤵
  PID:7768
- C:\Windows\System\dBKqSYk.exe
  C:\Windows\System\dBKqSYk.exe
  2⤵
  PID:7832
- C:\Windows\System\rGyWvtQ.exe
  C:\Windows\System\rGyWvtQ.exe
  2⤵
  PID:8004
- C:\Windows\System\VcWEJKT.exe
  C:\Windows\System\VcWEJKT.exe
  2⤵
  PID:8120
- C:\Windows\System\qcHVApR.exe
  C:\Windows\System\qcHVApR.exe
  2⤵
  PID:6236
- C:\Windows\System\EnQuMut.exe
  C:\Windows\System\EnQuMut.exe
  2⤵
  PID:6960
- C:\Windows\System\cycNstj.exe
  C:\Windows\System\cycNstj.exe
  2⤵
  PID:7940
- C:\Windows\System\gfivnxc.exe
  C:\Windows\System\gfivnxc.exe
  2⤵
  PID:7660
- C:\Windows\System\OpyXZEH.exe
  C:\Windows\System\OpyXZEH.exe
  2⤵
  PID:7800
- C:\Windows\System\zhYkZHQ.exe
  C:\Windows\System\zhYkZHQ.exe
  2⤵
  PID:7924
- C:\Windows\System\oDToIDb.exe
  C:\Windows\System\oDToIDb.exe
  2⤵
  PID:6728
- C:\Windows\System\wnfRxXV.exe
  C:\Windows\System\wnfRxXV.exe
  2⤵
  PID:8208
- C:\Windows\System\yrtqgEZ.exe
  C:\Windows\System\yrtqgEZ.exe
  2⤵
  PID:8224
- C:\Windows\System\cgQMndc.exe
  C:\Windows\System\cgQMndc.exe
  2⤵
  PID:8256
- C:\Windows\System\dpISClC.exe
  C:\Windows\System\dpISClC.exe
  2⤵
  PID:8280
- C:\Windows\System\DYdCUxx.exe
  C:\Windows\System\DYdCUxx.exe
  2⤵
  PID:8312
- C:\Windows\System\FSgQXyM.exe
  C:\Windows\System\FSgQXyM.exe
  2⤵
  PID:8336
- C:\Windows\System\yIAdGQX.exe
  C:\Windows\System\yIAdGQX.exe
  2⤵
  PID:8356
- C:\Windows\System\jLkqUnO.exe
  C:\Windows\System\jLkqUnO.exe
  2⤵
  PID:8380
- C:\Windows\System\WZDReom.exe
  C:\Windows\System\WZDReom.exe
  2⤵
  PID:8416
- C:\Windows\System\WnlvmQn.exe
  C:\Windows\System\WnlvmQn.exe
  2⤵
  PID:8444
- C:\Windows\System\LzSwIOa.exe
  C:\Windows\System\LzSwIOa.exe
  2⤵
  PID:8464
- C:\Windows\System\WAZopmA.exe
  C:\Windows\System\WAZopmA.exe
  2⤵
  PID:8492
- C:\Windows\System\kvnWEDT.exe
  C:\Windows\System\kvnWEDT.exe
  2⤵
  PID:8512
- C:\Windows\System\QPPaWoV.exe
  C:\Windows\System\QPPaWoV.exe
  2⤵
  PID:8540
- C:\Windows\System\pMHDRhn.exe
  C:\Windows\System\pMHDRhn.exe
  2⤵
  PID:8568
- C:\Windows\System\wFlHEzL.exe
  C:\Windows\System\wFlHEzL.exe
  2⤵
  PID:8604
- C:\Windows\System\rznfWXP.exe
  C:\Windows\System\rznfWXP.exe
  2⤵
  PID:8632
- C:\Windows\System\qjGFfyO.exe
  C:\Windows\System\qjGFfyO.exe
  2⤵
  PID:8668
- C:\Windows\System\asZwuDD.exe
  C:\Windows\System\asZwuDD.exe
  2⤵
  PID:8692
- C:\Windows\System\SFLhndC.exe
  C:\Windows\System\SFLhndC.exe
  2⤵
  PID:9028
- C:\Windows\System\GxCykov.exe
  C:\Windows\System\GxCykov.exe
  2⤵
  PID:9044
- C:\Windows\System\tEhkCGJ.exe
  C:\Windows\System\tEhkCGJ.exe
  2⤵
  PID:9064
- C:\Windows\System\ltimcjN.exe
  C:\Windows\System\ltimcjN.exe
  2⤵
  PID:9088
- C:\Windows\System\ycRYnCp.exe
  C:\Windows\System\ycRYnCp.exe
  2⤵
  PID:9112
- C:\Windows\System\zGrMRHy.exe
  C:\Windows\System\zGrMRHy.exe
  2⤵
  PID:9132
- C:\Windows\System\rCcpLoB.exe
  C:\Windows\System\rCcpLoB.exe
  2⤵
  PID:9156
- C:\Windows\System\ykKQqbm.exe
  C:\Windows\System\ykKQqbm.exe
  2⤵
  PID:9180
- C:\Windows\System\qCQKLXT.exe
  C:\Windows\System\qCQKLXT.exe
  2⤵
  PID:9208
- C:\Windows\System\jLqTzvH.exe
  C:\Windows\System\jLqTzvH.exe
  2⤵
  PID:6924
- C:\Windows\System\mjaxrkm.exe
  C:\Windows\System\mjaxrkm.exe
  2⤵
  PID:7568
- C:\Windows\System\aKUYwuR.exe
  C:\Windows\System\aKUYwuR.exe
  2⤵
  PID:8108
- C:\Windows\System\GIpJJlx.exe
  C:\Windows\System\GIpJJlx.exe
  2⤵
  PID:7396
- C:\Windows\System\syUwFkA.exe
  C:\Windows\System\syUwFkA.exe
  2⤵
  PID:7880
- C:\Windows\System\LZaKnhv.exe
  C:\Windows\System\LZaKnhv.exe
  2⤵
  PID:7904
- C:\Windows\System\ApnwVLw.exe
  C:\Windows\System\ApnwVLw.exe
  2⤵
  PID:8348
- C:\Windows\System\nsZYIgL.exe
  C:\Windows\System\nsZYIgL.exe
  2⤵
  PID:8560
- C:\Windows\System\XoYkWpp.exe
  C:\Windows\System\XoYkWpp.exe
  2⤵
  PID:6796
- C:\Windows\System\WNkOcfO.exe
  C:\Windows\System\WNkOcfO.exe
  2⤵
  PID:8460
- C:\Windows\System\hPimKBu.exe
  C:\Windows\System\hPimKBu.exe
  2⤵
  PID:7420
- C:\Windows\System\ZMvNVEs.exe
  C:\Windows\System\ZMvNVEs.exe
  2⤵
  PID:8748
- C:\Windows\System\JZZLRBm.exe
  C:\Windows\System\JZZLRBm.exe
  2⤵
  PID:8436
- C:\Windows\System\GRbiFcb.exe
  C:\Windows\System\GRbiFcb.exe
  2⤵
  PID:8488
- C:\Windows\System\trFJiVE.exe
  C:\Windows\System\trFJiVE.exe
  2⤵
  PID:8372
- C:\Windows\System\eyfmDbp.exe
  C:\Windows\System\eyfmDbp.exe
  2⤵
  PID:8656
- C:\Windows\System\kKXyDYe.exe
  C:\Windows\System\kKXyDYe.exe
  2⤵
  PID:8880
- C:\Windows\System\NVocWdc.exe
  C:\Windows\System\NVocWdc.exe
  2⤵
  PID:8500
- C:\Windows\System\XVlXncc.exe
  C:\Windows\System\XVlXncc.exe
  2⤵
  PID:9036
- C:\Windows\System\QnzeIDp.exe
  C:\Windows\System\QnzeIDp.exe
  2⤵
  PID:9128
- C:\Windows\System\mHYvPJF.exe
  C:\Windows\System\mHYvPJF.exe
  2⤵
  PID:9168
- C:\Windows\System\ceiFBtH.exe
  C:\Windows\System\ceiFBtH.exe
  2⤵
  PID:8556
- C:\Windows\System\HXfHmvh.exe
  C:\Windows\System\HXfHmvh.exe
  2⤵
  PID:8652
- C:\Windows\System\QugMtNK.exe
  C:\Windows\System\QugMtNK.exe
  2⤵
  PID:2256
- C:\Windows\System\BqWLiSv.exe
  C:\Windows\System\BqWLiSv.exe
  2⤵
  PID:8912
- C:\Windows\System\LTHZCDc.exe
  C:\Windows\System\LTHZCDc.exe
  2⤵
  PID:9060
- C:\Windows\System\JpmwHKY.exe
  C:\Windows\System\JpmwHKY.exe
  2⤵
  PID:9100
- C:\Windows\System\pYoTXml.exe
  C:\Windows\System\pYoTXml.exe
  2⤵
  PID:8968
- C:\Windows\System\AffPLGn.exe
  C:\Windows\System\AffPLGn.exe
  2⤵
  PID:8764
- C:\Windows\System\uvfQnDu.exe
  C:\Windows\System\uvfQnDu.exe
  2⤵
  PID:8232
- C:\Windows\System\ehChknQ.exe
  C:\Windows\System\ehChknQ.exe
  2⤵
  PID:8624
- C:\Windows\System\IQDxHBx.exe
  C:\Windows\System\IQDxHBx.exe
  2⤵
  PID:8288
- C:\Windows\System\Cefsyne.exe
  C:\Windows\System\Cefsyne.exe
  2⤵
  PID:8728
- C:\Windows\System\gLtBqMR.exe
  C:\Windows\System\gLtBqMR.exe
  2⤵
  PID:9232
- C:\Windows\System\UALmDgO.exe
  C:\Windows\System\UALmDgO.exe
  2⤵
  PID:9260
- C:\Windows\System\LOSOPMp.exe
  C:\Windows\System\LOSOPMp.exe
  2⤵
  PID:9276
- C:\Windows\System\rcCDcYW.exe
  C:\Windows\System\rcCDcYW.exe
  2⤵
  PID:9304
- C:\Windows\System\rPaSUra.exe
  C:\Windows\System\rPaSUra.exe
  2⤵
  PID:9324
- C:\Windows\System\StvhacX.exe
  C:\Windows\System\StvhacX.exe
  2⤵
  PID:9352
- C:\Windows\System\YONKmMF.exe
  C:\Windows\System\YONKmMF.exe
  2⤵
  PID:9380
- C:\Windows\System\BkBwXBa.exe
  C:\Windows\System\BkBwXBa.exe
  2⤵
  PID:9396
- C:\Windows\System\qIloztm.exe
  C:\Windows\System\qIloztm.exe
  2⤵
  PID:9428
- C:\Windows\System\JyqvGkI.exe
  C:\Windows\System\JyqvGkI.exe
  2⤵
  PID:9444
- C:\Windows\System\BKhMfyC.exe
  C:\Windows\System\BKhMfyC.exe
  2⤵
  PID:9464
- C:\Windows\System\NdAYjIJ.exe
  C:\Windows\System\NdAYjIJ.exe
  2⤵
  PID:9484
- C:\Windows\System\JqIlJHG.exe
  C:\Windows\System\JqIlJHG.exe
  2⤵
  PID:9504
- C:\Windows\System\xwNIbCY.exe
  C:\Windows\System\xwNIbCY.exe
  2⤵
  PID:9528
- C:\Windows\System\rJHtNhi.exe
  C:\Windows\System\rJHtNhi.exe
  2⤵
  PID:9560
- C:\Windows\System\AhWhqBO.exe
  C:\Windows\System\AhWhqBO.exe
  2⤵
  PID:9584
- C:\Windows\System\iFLLRYW.exe
  C:\Windows\System\iFLLRYW.exe
  2⤵
  PID:9604
- C:\Windows\System\wlXijDg.exe
  C:\Windows\System\wlXijDg.exe
  2⤵
  PID:9624
- C:\Windows\System\Gwngoiv.exe
  C:\Windows\System\Gwngoiv.exe
  2⤵
  PID:9652
- C:\Windows\System\rMXhBNk.exe
  C:\Windows\System\rMXhBNk.exe
  2⤵
  PID:9692
- C:\Windows\System\WYmOWXi.exe
  C:\Windows\System\WYmOWXi.exe
  2⤵
  PID:9716
- C:\Windows\System\vGwiDIY.exe
  C:\Windows\System\vGwiDIY.exe
  2⤵
  PID:9748
- C:\Windows\System\SuxRWWY.exe
  C:\Windows\System\SuxRWWY.exe
  2⤵
  PID:9768
- C:\Windows\System\zVloldZ.exe
  C:\Windows\System\zVloldZ.exe
  2⤵
  PID:9896
- C:\Windows\System\bnHvSGj.exe
  C:\Windows\System\bnHvSGj.exe
  2⤵
  PID:9916
- C:\Windows\System\MvZMbwE.exe
  C:\Windows\System\MvZMbwE.exe
  2⤵
  PID:9940
- C:\Windows\System\GOkIucx.exe
  C:\Windows\System\GOkIucx.exe
  2⤵
  PID:9972
- C:\Windows\System\dMyUmuq.exe
  C:\Windows\System\dMyUmuq.exe
  2⤵
  PID:9996
- C:\Windows\System\iEPNqmn.exe
  C:\Windows\System\iEPNqmn.exe
  2⤵
  PID:10024
- C:\Windows\System\rJIwHPJ.exe
  C:\Windows\System\rJIwHPJ.exe
  2⤵
  PID:10056
- C:\Windows\System\YKKnRHp.exe
  C:\Windows\System\YKKnRHp.exe
  2⤵
  PID:10076
- C:\Windows\System\LfEvgmE.exe
  C:\Windows\System\LfEvgmE.exe
  2⤵
  PID:10096
- C:\Windows\System\yfIPOaH.exe
  C:\Windows\System\yfIPOaH.exe
  2⤵
  PID:10120
- C:\Windows\System\vVcNLgI.exe
  C:\Windows\System\vVcNLgI.exe
  2⤵
  PID:10144
- C:\Windows\System\ImDQXuD.exe
  C:\Windows\System\ImDQXuD.exe
  2⤵
  PID:10164
- C:\Windows\System\zSXIKhT.exe
  C:\Windows\System\zSXIKhT.exe
  2⤵
  PID:4832
- C:\Windows\System\thUFqyr.exe
  C:\Windows\System\thUFqyr.exe
  2⤵
  PID:9544
- C:\Windows\System\onwkNQx.exe
  C:\Windows\System\onwkNQx.exe
  2⤵
  PID:9596
- C:\Windows\System\KBDOIHM.exe
  C:\Windows\System\KBDOIHM.exe
  2⤵
  PID:1932
- C:\Windows\System\xHsjhdv.exe
  C:\Windows\System\xHsjhdv.exe
  2⤵
  PID:6168
- C:\Windows\System\fDhMWXa.exe
  C:\Windows\System\fDhMWXa.exe
  2⤵
  PID:8328
- C:\Windows\System\erQBisO.exe
  C:\Windows\System\erQBisO.exe
  2⤵
  PID:648
- C:\Windows\System\kcCuZZG.exe
  C:\Windows\System\kcCuZZG.exe
  2⤵
  PID:9788
- C:\Windows\System\nutmZRE.exe
  C:\Windows\System\nutmZRE.exe
  2⤵
  PID:8388
- C:\Windows\System\zTJCgzP.exe
  C:\Windows\System\zTJCgzP.exe
  2⤵
  PID:8648
- C:\Windows\System\ymcvqIH.exe
  C:\Windows\System\ymcvqIH.exe
  2⤵
  PID:8684
- C:\Windows\System\yFHIeos.exe
  C:\Windows\System\yFHIeos.exe
  2⤵
  PID:9284
- C:\Windows\System\mAzcLAb.exe
  C:\Windows\System\mAzcLAb.exe
  2⤵
  PID:9372
- C:\Windows\System\BinqwEg.exe
  C:\Windows\System\BinqwEg.exe
  2⤵
  PID:4540
- C:\Windows\System\pBmABvH.exe
  C:\Windows\System\pBmABvH.exe
  2⤵
  PID:9456
- C:\Windows\System\RFItIxt.exe
  C:\Windows\System\RFItIxt.exe
  2⤵
  PID:9500
- C:\Windows\System\zYcwzcE.exe
  C:\Windows\System\zYcwzcE.exe
  2⤵
  PID:10084
- C:\Windows\System\BgUUSAd.exe
  C:\Windows\System\BgUUSAd.exe
  2⤵
  PID:10128
- C:\Windows\System\mdgYhqM.exe
  C:\Windows\System\mdgYhqM.exe
  2⤵
  PID:9576
- C:\Windows\System\cbauhLi.exe
  C:\Windows\System\cbauhLi.exe
  2⤵
  PID:9644
- C:\Windows\System\tKRleSS.exe
  C:\Windows\System\tKRleSS.exe
  2⤵
  PID:9684
- C:\Windows\System\dSaTPgY.exe
  C:\Windows\System\dSaTPgY.exe
  2⤵
  PID:9736
- C:\Windows\System\mwwahND.exe
  C:\Windows\System\mwwahND.exe
  2⤵
  PID:9912
- C:\Windows\System\KbUnHyk.exe
  C:\Windows\System\KbUnHyk.exe
  2⤵
  PID:10264
- C:\Windows\System\gnpTLYq.exe
  C:\Windows\System\gnpTLYq.exe
  2⤵
  PID:10308
- C:\Windows\System\YblRpxp.exe
  C:\Windows\System\YblRpxp.exe
  2⤵
  PID:10336
- C:\Windows\System\FkIGZvk.exe
  C:\Windows\System\FkIGZvk.exe
  2⤵
  PID:10368
- C:\Windows\System\PDPiIge.exe
  C:\Windows\System\PDPiIge.exe
  2⤵
  PID:10388
- C:\Windows\System\juGvZxu.exe
  C:\Windows\System\juGvZxu.exe
  2⤵
  PID:10404
- C:\Windows\System\LKiMNkj.exe
  C:\Windows\System\LKiMNkj.exe
  2⤵
  PID:10420
- C:\Windows\System\JzvVDDL.exe
  C:\Windows\System\JzvVDDL.exe
  2⤵
  PID:10436
- C:\Windows\System\JzIaquM.exe
  C:\Windows\System\JzIaquM.exe
  2⤵
  PID:10452
- C:\Windows\System\bcOtmnn.exe
  C:\Windows\System\bcOtmnn.exe
  2⤵
  PID:10476
- C:\Windows\System\mgNQRKx.exe
  C:\Windows\System\mgNQRKx.exe
  2⤵
  PID:10496
- C:\Windows\System\uLeIEzS.exe
  C:\Windows\System\uLeIEzS.exe
  2⤵
  PID:10516
- C:\Windows\System\rCfPjlX.exe
  C:\Windows\System\rCfPjlX.exe
  2⤵
  PID:10540
- C:\Windows\System\FilwXRI.exe
  C:\Windows\System\FilwXRI.exe
  2⤵
  PID:10564
- C:\Windows\System\zCWIyaQ.exe
  C:\Windows\System\zCWIyaQ.exe
  2⤵
  PID:10584
- C:\Windows\System\ccOmJqc.exe
  C:\Windows\System\ccOmJqc.exe
  2⤵
  PID:10604
- C:\Windows\System\RDVchgQ.exe
  C:\Windows\System\RDVchgQ.exe
  2⤵
  PID:10624
- C:\Windows\System\VEDrSTv.exe
  C:\Windows\System\VEDrSTv.exe
  2⤵
  PID:10644
- C:\Windows\System\ZOZrdNe.exe
  C:\Windows\System\ZOZrdNe.exe
  2⤵
  PID:10912
- C:\Windows\System\auIDjxX.exe
  C:\Windows\System\auIDjxX.exe
  2⤵
  PID:10932
- C:\Windows\System\ZxhjCRg.exe
  C:\Windows\System\ZxhjCRg.exe
  2⤵
  PID:10996
- C:\Windows\System\SMPvtfO.exe
  C:\Windows\System\SMPvtfO.exe
  2⤵
  PID:11020
- C:\Windows\System\xnohbpe.exe
  C:\Windows\System\xnohbpe.exe
  2⤵
  PID:11036
- C:\Windows\System\WYZdiXY.exe
  C:\Windows\System\WYZdiXY.exe
  2⤵
  PID:11056
- C:\Windows\System\uZDEPkX.exe
  C:\Windows\System\uZDEPkX.exe
  2⤵
  PID:11080
- C:\Windows\System\oFgwedM.exe
  C:\Windows\System\oFgwedM.exe
  2⤵
  PID:11108
- C:\Windows\System\EjScdgc.exe
  C:\Windows\System\EjScdgc.exe
  2⤵
  PID:11124
- C:\Windows\System\fFGaLci.exe
  C:\Windows\System\fFGaLci.exe
  2⤵
  PID:9876
- C:\Windows\System\SUMybMa.exe
  C:\Windows\System\SUMybMa.exe
  2⤵
  PID:9948
- C:\Windows\System\mPMMeZF.exe
  C:\Windows\System\mPMMeZF.exe
  2⤵
  PID:10228
- C:\Windows\System\NquMFsV.exe
  C:\Windows\System\NquMFsV.exe
  2⤵
  PID:10272
- C:\Windows\System\TRdmRKf.exe
  C:\Windows\System\TRdmRKf.exe
  2⤵
  PID:9152
- C:\Windows\System\LjKjcKi.exe
  C:\Windows\System\LjKjcKi.exe
  2⤵
  PID:10064
- C:\Windows\System\GxnsaSU.exe
  C:\Windows\System\GxnsaSU.exe
  2⤵
  PID:8664
- C:\Windows\System\jXtYYfq.exe
  C:\Windows\System\jXtYYfq.exe
  2⤵
  PID:10620
- C:\Windows\System\qzObPbC.exe
  C:\Windows\System\qzObPbC.exe
  2⤵
  PID:9228
- C:\Windows\System\KOIolkt.exe
  C:\Windows\System\KOIolkt.exe
  2⤵
  PID:9340
- C:\Windows\System\wMRlxOy.exe
  C:\Windows\System\wMRlxOy.exe
  2⤵
  PID:4968
- C:\Windows\System\iTAHUiQ.exe
  C:\Windows\System\iTAHUiQ.exe
  2⤵
  PID:8408
- C:\Windows\System\tEIGYIa.exe
  C:\Windows\System\tEIGYIa.exe
  2⤵
  PID:10572
- C:\Windows\System\ptwpijL.exe
  C:\Windows\System\ptwpijL.exe
  2⤵
  PID:10796
- C:\Windows\System\HuYpIlN.exe
  C:\Windows\System\HuYpIlN.exe
  2⤵
  PID:9840
- C:\Windows\System\NHtPdzB.exe
  C:\Windows\System\NHtPdzB.exe
  2⤵
  PID:9928
- C:\Windows\System\BhsGqET.exe
  C:\Windows\System\BhsGqET.exe
  2⤵
  PID:10700
- C:\Windows\System\diNZHpr.exe
  C:\Windows\System\diNZHpr.exe
  2⤵
  PID:10356
- C:\Windows\System\YQHwdwK.exe
  C:\Windows\System\YQHwdwK.exe
  2⤵
  PID:10736
- C:\Windows\System\AhsrSBZ.exe
  C:\Windows\System\AhsrSBZ.exe
  2⤵
  PID:10428
- C:\Windows\System\TWeIwJF.exe
  C:\Windows\System\TWeIwJF.exe
  2⤵
  PID:10460
- C:\Windows\System\luYCmJi.exe
  C:\Windows\System\luYCmJi.exe
  2⤵
  PID:10524
- C:\Windows\System\xDaVzaO.exe
  C:\Windows\System\xDaVzaO.exe
  2⤵
  PID:10556
- C:\Windows\System\CXqwYSn.exe
  C:\Windows\System\CXqwYSn.exe
  2⤵
  PID:10732
- C:\Windows\System\RrOPCHD.exe
  C:\Windows\System\RrOPCHD.exe
  2⤵
  PID:10836
- C:\Windows\System\FzAOfAR.exe
  C:\Windows\System\FzAOfAR.exe
  2⤵
  PID:10892
- C:\Windows\System\lZuygHC.exe
  C:\Windows\System\lZuygHC.exe
  2⤵
  PID:11032
- C:\Windows\System\iWfIhkU.exe
  C:\Windows\System\iWfIhkU.exe
  2⤵
  PID:11188
- C:\Windows\System\foIROAF.exe
  C:\Windows\System\foIROAF.exe
  2⤵
  PID:10044
- C:\Windows\System\cNwCzvi.exe
  C:\Windows\System\cNwCzvi.exe
  2⤵
  PID:11252
- C:\Windows\System\fhORpBm.exe
  C:\Windows\System\fhORpBm.exe
  2⤵
  PID:10612
- C:\Windows\System\MEJeLih.exe
  C:\Windows\System\MEJeLih.exe
  2⤵
  PID:11044
- C:\Windows\System\DpTTLkR.exe
  C:\Windows\System\DpTTLkR.exe
  2⤵
  PID:11088
- C:\Windows\System\YhRRTdp.exe
  C:\Windows\System\YhRRTdp.exe
  2⤵
  PID:11136
- C:\Windows\System\mXGCHGK.exe
  C:\Windows\System\mXGCHGK.exe
  2⤵
  PID:9268
- C:\Windows\System\LMdmvLX.exe
  C:\Windows\System\LMdmvLX.exe
  2⤵
  PID:3148
- C:\Windows\System\zYysqWV.exe
  C:\Windows\System\zYysqWV.exe
  2⤵
  PID:9440
- C:\Windows\System\JFUBEms.exe
  C:\Windows\System\JFUBEms.exe
  2⤵
  PID:9864
- C:\Windows\System\cOUEFwd.exe
  C:\Windows\System\cOUEFwd.exe
  2⤵
  PID:9960
- C:\Windows\System\UFfWcGQ.exe
  C:\Windows\System\UFfWcGQ.exe
  2⤵
  PID:10116
- C:\Windows\System\rixCaDN.exe
  C:\Windows\System\rixCaDN.exe
  2⤵
  PID:5408
- C:\Windows\System\bxJgjru.exe
  C:\Windows\System\bxJgjru.exe
  2⤵
  PID:11272
- C:\Windows\System\WghdUuq.exe
  C:\Windows\System\WghdUuq.exe
  2⤵
  PID:11292
- C:\Windows\System\JzMXqvL.exe
  C:\Windows\System\JzMXqvL.exe
  2⤵
  PID:11316
- C:\Windows\System\WaIAJDO.exe
  C:\Windows\System\WaIAJDO.exe
  2⤵
  PID:11336
- C:\Windows\System\hZlBtrR.exe
  C:\Windows\System\hZlBtrR.exe
  2⤵
  PID:11356
- C:\Windows\System\WUHoZfm.exe
  C:\Windows\System\WUHoZfm.exe
  2⤵
  PID:11376
- C:\Windows\System\bnQVSlV.exe
  C:\Windows\System\bnQVSlV.exe
  2⤵
  PID:11580
- C:\Windows\System\gePyPxD.exe
  C:\Windows\System\gePyPxD.exe
  2⤵
  PID:11600
- C:\Windows\System\CHFwXrs.exe
  C:\Windows\System\CHFwXrs.exe
  2⤵
  PID:11620
- C:\Windows\System\QNPnfwQ.exe
  C:\Windows\System\QNPnfwQ.exe
  2⤵
  PID:11640
- C:\Windows\System\BcRJjUg.exe
  C:\Windows\System\BcRJjUg.exe
  2⤵
  PID:11656
- C:\Windows\System\PVPmjpn.exe
  C:\Windows\System\PVPmjpn.exe
  2⤵
  PID:11680
- C:\Windows\System\IOxLkOG.exe
  C:\Windows\System\IOxLkOG.exe
  2⤵
  PID:11712
- C:\Windows\System\NPOTnyA.exe
  C:\Windows\System\NPOTnyA.exe
  2⤵
  PID:11740
- C:\Windows\System\zJuPNMm.exe
  C:\Windows\System\zJuPNMm.exe
  2⤵
  PID:11760
- C:\Windows\System\sxhwHYU.exe
  C:\Windows\System\sxhwHYU.exe
  2⤵
  PID:11780
- C:\Windows\System\bFteyAh.exe
  C:\Windows\System\bFteyAh.exe
  2⤵
  PID:11804
- C:\Windows\System\WWUcZQH.exe
  C:\Windows\System\WWUcZQH.exe
  2⤵
  PID:11824
- C:\Windows\System\XtaQqIN.exe
  C:\Windows\System\XtaQqIN.exe
  2⤵
  PID:11844
- C:\Windows\System\IsLksJE.exe
  C:\Windows\System\IsLksJE.exe
  2⤵
  PID:11872
- C:\Windows\System\EMPGTiV.exe
  C:\Windows\System\EMPGTiV.exe
  2⤵
  PID:11896
- C:\Windows\System\JKKTlbQ.exe
  C:\Windows\System\JKKTlbQ.exe
  2⤵
  PID:11920
- C:\Windows\System\lTwOEoC.exe
  C:\Windows\System\lTwOEoC.exe
  2⤵
  PID:11940
- C:\Windows\System\xCXUwZp.exe
  C:\Windows\System\xCXUwZp.exe
  2⤵
  PID:11960
- C:\Windows\System\OlwfKbT.exe
  C:\Windows\System\OlwfKbT.exe
  2⤵
  PID:11976
- C:\Windows\System\DTFyntq.exe
  C:\Windows\System\DTFyntq.exe
  2⤵
  PID:11992
- C:\Windows\System\PkSRNAp.exe
  C:\Windows\System\PkSRNAp.exe
  2⤵
  PID:12008
- C:\Windows\System\iOGhkRZ.exe
  C:\Windows\System\iOGhkRZ.exe
  2⤵
  PID:12024
- C:\Windows\System\HZLBncR.exe
  C:\Windows\System\HZLBncR.exe
  2⤵
  PID:12040
- C:\Windows\System\Autlvcy.exe
  C:\Windows\System\Autlvcy.exe
  2⤵
  PID:12060
- C:\Windows\System\aLuOjtq.exe
  C:\Windows\System\aLuOjtq.exe
  2⤵
  PID:12080
- C:\Windows\System\KLKcgTI.exe
  C:\Windows\System\KLKcgTI.exe
  2⤵
  PID:12108
- C:\Windows\System\QOQqjWR.exe
  C:\Windows\System\QOQqjWR.exe
  2⤵
  PID:12128
- C:\Windows\System\YqqeGdK.exe
  C:\Windows\System\YqqeGdK.exe
  2⤵
  PID:12152
- C:\Windows\System\LHUCJfA.exe
  C:\Windows\System\LHUCJfA.exe
  2⤵
  PID:12276
- C:\Windows\System\mCGkPFj.exe
  C:\Windows\System\mCGkPFj.exe
  2⤵
  PID:9320
- C:\Windows\System\EeFppcw.exe
  C:\Windows\System\EeFppcw.exe
  2⤵
  PID:10928
- C:\Windows\System\OmSugyu.exe
  C:\Windows\System\OmSugyu.exe
  2⤵
  PID:11540
- C:\Windows\System\HDeXoXD.exe
  C:\Windows\System\HDeXoXD.exe
  2⤵
  PID:11932
- C:\Windows\System\smPbPtb.exe
  C:\Windows\System\smPbPtb.exe
  2⤵
  PID:11956
- C:\Windows\System\YGQIwsx.exe
  C:\Windows\System\YGQIwsx.exe
  2⤵
  PID:11596
- C:\Windows\System\ROJoxHW.exe
  C:\Windows\System\ROJoxHW.exe
  2⤵
  PID:11612
- C:\Windows\System\NPnuwUL.exe
  C:\Windows\System\NPnuwUL.exe
  2⤵
  PID:11164
- C:\Windows\System\kpVMEDQ.exe
  C:\Windows\System\kpVMEDQ.exe
  2⤵
  PID:11836
- C:\Windows\System\pepYTEX.exe
  C:\Windows\System\pepYTEX.exe
  2⤵
  PID:11988
- C:\Windows\System\WsYJLAz.exe
  C:\Windows\System\WsYJLAz.exe
  2⤵
  PID:12036
- C:\Windows\System\UweRMwY.exe
  C:\Windows\System\UweRMwY.exe
  2⤵
  PID:5508
- C:\Windows\System\qlgmeyb.exe
  C:\Windows\System\qlgmeyb.exe
  2⤵
  PID:11348
- C:\Windows\System\pJXFVRi.exe
  C:\Windows\System\pJXFVRi.exe
  2⤵
  PID:10448
- C:\Windows\System\mvltWyh.exe
  C:\Windows\System\mvltWyh.exe
  2⤵
  PID:10324
- C:\Windows\System\CpAbvBO.exe
  C:\Windows\System\CpAbvBO.exe
  2⤵
  PID:11052
- C:\Windows\System\NvubhuS.exe
  C:\Windows\System\NvubhuS.exe
  2⤵
  PID:11312
- C:\Windows\System\umTWvZE.exe
  C:\Windows\System\umTWvZE.exe
  2⤵
  PID:11560
- C:\Windows\System\kVheFLC.exe
  C:\Windows\System\kVheFLC.exe
  2⤵
  PID:8548
- C:\Windows\System\aZRjsNS.exe
  C:\Windows\System\aZRjsNS.exe
  2⤵
  PID:10276
- C:\Windows\System\mPaZKan.exe
  C:\Windows\System\mPaZKan.exe
  2⤵
  PID:11076
- C:\Windows\System\ECWtUqz.exe
  C:\Windows\System\ECWtUqz.exe
  2⤵
  PID:10956
- C:\Windows\System\GBbOwGY.exe
  C:\Windows\System\GBbOwGY.exe
  2⤵
  PID:11888
- C:\Windows\System\GfCtRcg.exe
  C:\Windows\System\GfCtRcg.exe
  2⤵
  PID:2284
- C:\Windows\System\FbWMEwu.exe
  C:\Windows\System\FbWMEwu.exe
  2⤵
  PID:9200
- C:\Windows\System\GLjuRFl.exe
  C:\Windows\System\GLjuRFl.exe
  2⤵
  PID:11412
- C:\Windows\System\MVFNGJy.exe
  C:\Windows\System\MVFNGJy.exe
  2⤵
  PID:11520
- C:\Windows\System\WFcQbrd.exe
  C:\Windows\System\WFcQbrd.exe
  2⤵
  PID:12172
- C:\Windows\System\DcpEjiX.exe
  C:\Windows\System\DcpEjiX.exe
  2⤵
  PID:11972
- C:\Windows\System\XOfKlJa.exe
  C:\Windows\System\XOfKlJa.exe
  2⤵
  PID:11508
- C:\Windows\System\nnLNLvM.exe
  C:\Windows\System\nnLNLvM.exe
  2⤵
  PID:9760
- C:\Windows\System\sxrrJTz.exe
  C:\Windows\System\sxrrJTz.exe
  2⤵
  PID:4188
- C:\Windows\System\coCRSNx.exe
  C:\Windows\System\coCRSNx.exe
  2⤵
  PID:12076
- C:\Windows\System\HVBXXUq.exe
  C:\Windows\System\HVBXXUq.exe
  2⤵
  PID:11700
- C:\Windows\System\yDRMflh.exe
  C:\Windows\System\yDRMflh.exe
  2⤵
  PID:12072
- C:\Windows\System\KDCJLHK.exe
  C:\Windows\System\KDCJLHK.exe
  2⤵
  PID:11704
- C:\Windows\System\OvoWMOR.exe
  C:\Windows\System\OvoWMOR.exe
  2⤵
  PID:12400
- C:\Windows\System\mLRKfcC.exe
  C:\Windows\System\mLRKfcC.exe
  2⤵
  PID:12456
- C:\Windows\System\UuWvjaz.exe
  C:\Windows\System\UuWvjaz.exe
  2⤵
  PID:12472
- C:\Windows\System\yVMMTIJ.exe
  C:\Windows\System\yVMMTIJ.exe
  2⤵
  PID:12700
- C:\Windows\System\iCZHjdh.exe
  C:\Windows\System\iCZHjdh.exe
  2⤵
  PID:12836
- C:\Windows\System\zXMOYfY.exe
  C:\Windows\System\zXMOYfY.exe
  2⤵
  PID:12856
- C:\Windows\System\OYvFuUW.exe
  C:\Windows\System\OYvFuUW.exe
  2⤵
  PID:12880
- C:\Windows\System\CnKcFtB.exe
  C:\Windows\System\CnKcFtB.exe
  2⤵
  PID:12896
- C:\Windows\System\RLxOAIv.exe
  C:\Windows\System\RLxOAIv.exe
  2⤵
  PID:12972
- C:\Windows\System\lBGEYBN.exe
  C:\Windows\System\lBGEYBN.exe
  2⤵
  PID:12992
- C:\Windows\System\ndEbZsU.exe
  C:\Windows\System\ndEbZsU.exe
  2⤵
  PID:13008
- C:\Windows\System\bMwZjcp.exe
  C:\Windows\System\bMwZjcp.exe
  2⤵
  PID:13092
- C:\Windows\System\FkGQoPN.exe
  C:\Windows\System\FkGQoPN.exe
  2⤵
  PID:13108
- C:\Windows\System\wGzlhTH.exe
  C:\Windows\System\wGzlhTH.exe
  2⤵
  PID:13140
- C:\Windows\System\kMzMyOR.exe
  C:\Windows\System\kMzMyOR.exe
  2⤵
  PID:13260
- C:\Windows\System\VcTsGDo.exe
  C:\Windows\System\VcTsGDo.exe
  2⤵
  PID:13284
- C:\Windows\System\jIipCrb.exe
  C:\Windows\System\jIipCrb.exe
  2⤵
  PID:11592
- C:\Windows\System\KXIpdEw.exe
  C:\Windows\System\KXIpdEw.exe
  2⤵
  PID:12312
- C:\Windows\System\SUWMIyF.exe
  C:\Windows\System\SUWMIyF.exe
  2⤵
  PID:12336
- C:\Windows\System\VHJuvCY.exe
  C:\Windows\System\VHJuvCY.exe
  2⤵
  PID:12356
- C:\Windows\System\aTpAThl.exe
  C:\Windows\System\aTpAThl.exe
  2⤵
  PID:12300
- C:\Windows\System\gtUeoYd.exe
  C:\Windows\System\gtUeoYd.exe
  2⤵
  PID:12464
- C:\Windows\System\louDdAf.exe
  C:\Windows\System\louDdAf.exe
  2⤵
  PID:3464
- C:\Windows\System\BzvUpsh.exe
  C:\Windows\System\BzvUpsh.exe
  2⤵
  PID:12636
- C:\Windows\System\jMyucRp.exe
  C:\Windows\System\jMyucRp.exe
  2⤵
  PID:12672
- C:\Windows\System\sWxxvUO.exe
  C:\Windows\System\sWxxvUO.exe
  2⤵
  PID:3288
- C:\Windows\System\DpxVdgx.exe
  C:\Windows\System\DpxVdgx.exe
  2⤵
  PID:700
- C:\Windows\System\ScpFhMi.exe
  C:\Windows\System\ScpFhMi.exe
  2⤵
  PID:12764
- C:\Windows\System\LXEIopi.exe
  C:\Windows\System\LXEIopi.exe
  2⤵
  PID:12944
- C:\Windows\System\mNwysgn.exe
  C:\Windows\System\mNwysgn.exe
  2⤵
  PID:12832
- C:\Windows\System\JuCTkTd.exe
  C:\Windows\System\JuCTkTd.exe
  2⤵
  PID:12864
- C:\Windows\System\GnVOQWw.exe
  C:\Windows\System\GnVOQWw.exe
  2⤵
  PID:12780
- C:\Windows\System\qutbjIs.exe
  C:\Windows\System\qutbjIs.exe
  2⤵
  PID:12940
- C:\Windows\System\QlJiMDw.exe
  C:\Windows\System\QlJiMDw.exe
  2⤵
  PID:13072
- C:\Windows\System\KfrwbNZ.exe
  C:\Windows\System\KfrwbNZ.exe
  2⤵
  PID:13088
- C:\Windows\System\xGmuoKo.exe
  C:\Windows\System\xGmuoKo.exe
  2⤵
  PID:13148
- C:\Windows\System\aZgDVTP.exe
  C:\Windows\System\aZgDVTP.exe
  2⤵
  PID:12716
- C:\Windows\System\YPzLhBI.exe
  C:\Windows\System\YPzLhBI.exe
  2⤵
  PID:4488
- C:\Windows\System\nghQoFE.exe
  C:\Windows\System\nghQoFE.exe
  2⤵
  PID:4004
- C:\Windows\System\nSWorFa.exe
  C:\Windows\System\nSWorFa.exe
  2⤵
  PID:2796
- C:\Windows\System\vanFArs.exe
  C:\Windows\System\vanFArs.exe
  2⤵
  PID:13196
- C:\Windows\System\VwnjZTQ.exe
  C:\Windows\System\VwnjZTQ.exe
  2⤵
  PID:2724
- C:\Windows\System\VOSNPcj.exe
  C:\Windows\System\VOSNPcj.exe
  2⤵
  PID:2168
- C:\Windows\System\DUFOsBY.exe
  C:\Windows\System\DUFOsBY.exe
  2⤵
  PID:3088
- C:\Windows\System\GUMUale.exe
  C:\Windows\System\GUMUale.exe
  2⤵
  PID:2100
- C:\Windows\System\TVhQsDu.exe
  C:\Windows\System\TVhQsDu.exe
  2⤵
  PID:2864
- C:\Windows\System\vdImorH.exe
  C:\Windows\System\vdImorH.exe
  2⤵
  PID:4480
- C:\Windows\System\PDoZUsx.exe
  C:\Windows\System\PDoZUsx.exe
  2⤵
  PID:13304
- C:\Windows\System\fEVRwuK.exe
  C:\Windows\System\fEVRwuK.exe
  2⤵
  PID:12512
- C:\Windows\System\maaboil.exe
  C:\Windows\System\maaboil.exe
  2⤵
  PID:12340
- C:\Windows\System\cWpTgXK.exe
  C:\Windows\System\cWpTgXK.exe
  2⤵
  PID:4332
- C:\Windows\System\rtVxGje.exe
  C:\Windows\System\rtVxGje.exe
  2⤵
  PID:12540
- C:\Windows\System\ziSfneC.exe
  C:\Windows\System\ziSfneC.exe
  2⤵
  PID:13084
- C:\Windows\System\VYbVMsG.exe
  C:\Windows\System\VYbVMsG.exe
  2⤵
  PID:10552
- C:\Windows\System\sHTiTvP.exe
  C:\Windows\System\sHTiTvP.exe
  2⤵
  PID:13020
- C:\Windows\System\QuJYiJu.exe
  C:\Windows\System\QuJYiJu.exe
  2⤵
  PID:12332
- C:\Windows\System\JLljFoM.exe
  C:\Windows\System\JLljFoM.exe
  2⤵
  PID:12516
- C:\Windows\System\SxPbBOv.exe
  C:\Windows\System\SxPbBOv.exe
  2⤵
  PID:12392
- C:\Windows\System\NEoOhMg.exe
  C:\Windows\System\NEoOhMg.exe
  2⤵
  PID:12440
- C:\Windows\System\ymjUJyB.exe
  C:\Windows\System\ymjUJyB.exe
  2⤵
  PID:412
- C:\Windows\System\qpNHQBd.exe
  C:\Windows\System\qpNHQBd.exe
  2⤵
  PID:1128
- C:\Windows\System\lhfjYcI.exe
  C:\Windows\System\lhfjYcI.exe
  2⤵
  PID:12652
- C:\Windows\System\nwCpXwe.exe
  C:\Windows\System\nwCpXwe.exe
  2⤵
  PID:13212
- C:\Windows\System\UfMaxkE.exe
  C:\Windows\System\UfMaxkE.exe
  2⤵
  PID:13064
- C:\Windows\System\afNJwgc.exe
  C:\Windows\System\afNJwgc.exe
  2⤵
  PID:12752
- C:\Windows\System\vXkjntK.exe
  C:\Windows\System\vXkjntK.exe
  2⤵
  PID:13080
- C:\Windows\System\qCDVHOe.exe
  C:\Windows\System\qCDVHOe.exe
  2⤵
  PID:4660
- C:\Windows\System\IqFwOea.exe
  C:\Windows\System\IqFwOea.exe
  2⤵
  PID:3220
- C:\Windows\System\CFFKytR.exe
  C:\Windows\System\CFFKytR.exe
  2⤵
  PID:2300
- C:\Windows\System\zwdqvUz.exe
  C:\Windows\System\zwdqvUz.exe
  2⤵
  PID:12616
- C:\Windows\System\kDJaQCO.exe
  C:\Windows\System\kDJaQCO.exe
  2⤵
  PID:3604
- C:\Windows\System\WPvTIMm.exe
  C:\Windows\System\WPvTIMm.exe
  2⤵
  PID:1448
- C:\Windows\System\MJqgUYk.exe
  C:\Windows\System\MJqgUYk.exe
  2⤵
  PID:560
- C:\Windows\System\vZBSBQW.exe
  C:\Windows\System\vZBSBQW.exe
  2⤵
  PID:12508
- C:\Windows\System\uDGIKcG.exe
  C:\Windows\System\uDGIKcG.exe
  2⤵
  PID:12348
- C:\Windows\System\QTMBWoZ.exe
  C:\Windows\System\QTMBWoZ.exe
  2⤵
  PID:4444
- C:\Windows\System\uNrvuEs.exe
  C:\Windows\System\uNrvuEs.exe
  2⤵
  PID:13172
- C:\Windows\System\TKSycBx.exe
  C:\Windows\System\TKSycBx.exe
  2⤵
  PID:4524
- C:\Windows\System\sGMnpQm.exe
  C:\Windows\System\sGMnpQm.exe
  2⤵
  PID:2344
- C:\Windows\System\spnlrms.exe
  C:\Windows\System\spnlrms.exe
  2⤵
  PID:12904
- C:\Windows\System\XaJUJvw.exe
  C:\Windows\System\XaJUJvw.exe
  2⤵
  PID:1160
- C:\Windows\System\fJmIvdH.exe
  C:\Windows\System\fJmIvdH.exe
  2⤵
  PID:12912
- C:\Windows\System\ePYudrR.exe
  C:\Windows\System\ePYudrR.exe
  2⤵
  PID:5260
- C:\Windows\System\CsiWmmv.exe
  C:\Windows\System\CsiWmmv.exe
  2⤵
  PID:12376
- C:\Windows\System\wuHdPrg.exe
  C:\Windows\System\wuHdPrg.exe
  2⤵
  PID:1640
- C:\Windows\System\cuZovkj.exe
  C:\Windows\System\cuZovkj.exe
  2⤵
  PID:5164
- C:\Windows\System\tvNiWDG.exe
  C:\Windows\System\tvNiWDG.exe
  2⤵
  PID:2584
- C:\Windows\System\fmduUpA.exe
  C:\Windows\System\fmduUpA.exe
  2⤵
  PID:4420
- C:\Windows\System\FoQdckq.exe
  C:\Windows\System\FoQdckq.exe
  2⤵
  PID:5492
- C:\Windows\System\HznWBUx.exe
  C:\Windows\System\HznWBUx.exe
  2⤵
  PID:4056
- C:\Windows\System\apxpFlg.exe
  C:\Windows\System\apxpFlg.exe
  2⤵
  PID:12360
- C:\Windows\System\dfGSLpO.exe
  C:\Windows\System\dfGSLpO.exe
  2⤵
  PID:3788
- C:\Windows\System\jSnUzge.exe
  C:\Windows\System\jSnUzge.exe
  2⤵
  PID:4564
- C:\Windows\System\hxlyJzs.exe
  C:\Windows\System\hxlyJzs.exe
  2⤵
  PID:5668
- C:\Windows\System\ThOvJOs.exe
  C:\Windows\System\ThOvJOs.exe
  2⤵
  PID:5332
- C:\Windows\System\LlVTAwU.exe
  C:\Windows\System\LlVTAwU.exe
  2⤵
  PID:2068
- C:\Windows\System\kPnFLtx.exe
  C:\Windows\System\kPnFLtx.exe
  2⤵
  PID:5704
- C:\Windows\System\jspvqhx.exe
  C:\Windows\System\jspvqhx.exe
  2⤵
  PID:4040
- C:\Windows\System\zxVYkgf.exe
  C:\Windows\System\zxVYkgf.exe
  2⤵
  PID:5432
- C:\Windows\System\IzxeBhk.exe
  C:\Windows\System\IzxeBhk.exe
  2⤵
  PID:2788
- C:\Windows\System\WiNZvOS.exe
  C:\Windows\System\WiNZvOS.exe
  2⤵
  PID:4600
- C:\Windows\System\AfBqbHM.exe
  C:\Windows\System\AfBqbHM.exe
  2⤵
  PID:4816
- C:\Windows\System\hHyQNof.exe
  C:\Windows\System\hHyQNof.exe
  2⤵
  PID:5964
- C:\Windows\System\eezSQbE.exe
  C:\Windows\System\eezSQbE.exe
  2⤵
  PID:5484
- C:\Windows\System\rqBDUDD.exe
  C:\Windows\System\rqBDUDD.exe
  2⤵
  PID:5548
- C:\Windows\System\ovyVQho.exe
  C:\Windows\System\ovyVQho.exe
  2⤵
  PID:4400
- C:\Windows\System\aOdiRqY.exe
  C:\Windows\System\aOdiRqY.exe
  2⤵
  PID:6280
- C:\Windows\System\OZSMptn.exe
  C:\Windows\System\OZSMptn.exe
  2⤵
  PID:5772
- C:\Windows\System\WtJLELf.exe
  C:\Windows\System\WtJLELf.exe
  2⤵
  PID:6016
- C:\Windows\System\lRvYGWp.exe
  C:\Windows\System\lRvYGWp.exe
  2⤵
  PID:5480
- C:\Windows\System\djtOCnw.exe
  C:\Windows\System\djtOCnw.exe
  2⤵
  PID:6480
- C:\Windows\System\llnrSSB.exe
  C:\Windows\System\llnrSSB.exe
  2⤵
  PID:2520
- C:\Windows\System\usDGBvz.exe
  C:\Windows\System\usDGBvz.exe
  2⤵
  PID:6872
- C:\Windows\System\LDVejGu.exe
  C:\Windows\System\LDVejGu.exe
  2⤵
  PID:5624
- C:\Windows\System\jOCfYPJ.exe
  C:\Windows\System\jOCfYPJ.exe
  2⤵
  PID:4684
- C:\Windows\System\tAnxRgl.exe
  C:\Windows\System\tAnxRgl.exe
  2⤵
  PID:2236
- C:\Windows\System\xOSdOkB.exe
  C:\Windows\System\xOSdOkB.exe
  2⤵
  PID:10304
- C:\Windows\System\yIBEoKv.exe
  C:\Windows\System\yIBEoKv.exe
  2⤵
  PID:5256
- C:\Windows\System\KCEDPaH.exe
  C:\Windows\System\KCEDPaH.exe
  2⤵
  PID:12964
- C:\Windows\System\LOnTcAQ.exe
  C:\Windows\System\LOnTcAQ.exe
  2⤵
  PID:5068
- C:\Windows\System\naiInLl.exe
  C:\Windows\System\naiInLl.exe
  2⤵
  PID:5244
- C:\Windows\System\PsGApXc.exe
  C:\Windows\System\PsGApXc.exe
  2⤵
  PID:6844
- C:\Windows\System\VHZxpUa.exe
  C:\Windows\System\VHZxpUa.exe
  2⤵
  PID:6304
- C:\Windows\System\WNgopqZ.exe
  C:\Windows\System\WNgopqZ.exe
  2⤵
  PID:3992
- C:\Windows\System\KCaLUIT.exe
  C:\Windows\System\KCaLUIT.exe
  2⤵
  PID:6552
- C:\Windows\System\HkDvEwa.exe
  C:\Windows\System\HkDvEwa.exe
  2⤵
  PID:6660
- C:\Windows\System\qutrxxQ.exe
  C:\Windows\System\qutrxxQ.exe
  2⤵
  PID:5248
- C:\Windows\System\FjrxLhw.exe
  C:\Windows\System\FjrxLhw.exe
  2⤵
  PID:2240
- C:\Windows\System\OcZkJLs.exe
  C:\Windows\System\OcZkJLs.exe
  2⤵
  PID:6940
- C:\Windows\System\ltLPfgN.exe
  C:\Windows\System\ltLPfgN.exe
  2⤵
  PID:7340
- C:\Windows\System\PuXhLCf.exe
  C:\Windows\System\PuXhLCf.exe
  2⤵
  PID:7272
- C:\Windows\System\iQtzNxE.exe
  C:\Windows\System\iQtzNxE.exe
  2⤵
  PID:6636
- C:\Windows\System\RdJbnMq.exe
  C:\Windows\System\RdJbnMq.exe
  2⤵
  PID:7260
- C:\Windows\System\yxkkzSd.exe
  C:\Windows\System\yxkkzSd.exe
  2⤵
  PID:7316
- C:\Windows\System\VLxoqUb.exe
  C:\Windows\System\VLxoqUb.exe
  2⤵
  PID:6384
- C:\Windows\System\hdDWRjO.exe
  C:\Windows\System\hdDWRjO.exe
  2⤵
  PID:6388
- C:\Windows\System\njAgAqW.exe
  C:\Windows\System\njAgAqW.exe
  2⤵
  PID:7448
- C:\Windows\System\owxLhVb.exe
  C:\Windows\System\owxLhVb.exe
  2⤵
  PID:8088
- C:\Windows\System\WrJkaRW.exe
  C:\Windows\System\WrJkaRW.exe
  2⤵
  PID:7876
- C:\Windows\System\CywxttV.exe
  C:\Windows\System\CywxttV.exe
  2⤵
  PID:6632
- C:\Windows\System\sGchzMl.exe
  C:\Windows\System\sGchzMl.exe
  2⤵
  PID:4032
- C:\Windows\System\vaEstwf.exe
  C:\Windows\System\vaEstwf.exe
  2⤵
  PID:5476
- C:\Windows\System\KirurBC.exe
  C:\Windows\System\KirurBC.exe
  2⤵
  PID:6468
- C:\Windows\System\DbrZJek.exe
  C:\Windows\System\DbrZJek.exe
  2⤵
  PID:6764
- C:\Windows\System\aCBRxfG.exe
  C:\Windows\System\aCBRxfG.exe
  2⤵
  PID:9416
- C:\Windows\System\aGuLljB.exe
  C:\Windows\System\aGuLljB.exe
  2⤵
  PID:8020
- C:\Windows\System\KhiGgoP.exe
  C:\Windows\System\KhiGgoP.exe
  2⤵
  PID:5860
- C:\Windows\System\yzNxolK.exe
  C:\Windows\System\yzNxolK.exe
  2⤵
  PID:12368
- C:\Windows\System\pooIsds.exe
  C:\Windows\System\pooIsds.exe
  2⤵
  PID:6560
- C:\Windows\System\HOQaWmE.exe
  C:\Windows\System\HOQaWmE.exe
  2⤵
  PID:552
- C:\Windows\System\arNXACu.exe
  C:\Windows\System\arNXACu.exe
  2⤵
  PID:8144
- C:\Windows\System\nNzRMtb.exe
  C:\Windows\System\nNzRMtb.exe
  2⤵
  PID:6976
- C:\Windows\System\UujMgec.exe
  C:\Windows\System\UujMgec.exe
  2⤵
  PID:5428
- C:\Windows\System\qzkzqWO.exe
  C:\Windows\System\qzkzqWO.exe
  2⤵
  PID:6772
- C:\Windows\System\wUJAFdV.exe
  C:\Windows\System\wUJAFdV.exe
  2⤵
  PID:7728
- C:\Windows\System\jAKWKpl.exe
  C:\Windows\System\jAKWKpl.exe
  2⤵
  PID:5140
- C:\Windows\System\dxGvgJb.exe
  C:\Windows\System\dxGvgJb.exe
  2⤵
  PID:7004
- C:\Windows\System\MGXsNxd.exe
  C:\Windows\System\MGXsNxd.exe
  2⤵
  PID:7300
- C:\Windows\System\fDCTSAy.exe
  C:\Windows\System\fDCTSAy.exe
  2⤵
  PID:6212
- C:\Windows\System\qjEOleS.exe
  C:\Windows\System\qjEOleS.exe
  2⤵
  PID:6964
- C:\Windows\System\aZhEUxG.exe
  C:\Windows\System\aZhEUxG.exe
  2⤵
  PID:13316
- C:\Windows\System\vviZcvb.exe
  C:\Windows\System\vviZcvb.exe
  2⤵
  PID:13336
- C:\Windows\System\HNshLmF.exe
  C:\Windows\System\HNshLmF.exe
  2⤵
  PID:13364
- C:\Windows\System\cuiAgDC.exe
  C:\Windows\System\cuiAgDC.exe
  2⤵
  PID:13388
- C:\Windows\System\QdRfseN.exe
  C:\Windows\System\QdRfseN.exe
  2⤵
  PID:13408
- C:\Windows\System\HTcPwoh.exe
  C:\Windows\System\HTcPwoh.exe
  2⤵
  PID:13436
- C:\Windows\System\lwdHery.exe
  C:\Windows\System\lwdHery.exe
  2⤵
  PID:13892
- C:\Windows\System\iFpBdTS.exe
  C:\Windows\System\iFpBdTS.exe
  2⤵
  PID:13908
- C:\Windows\System\LMNHgVT.exe
  C:\Windows\System\LMNHgVT.exe
  2⤵
  PID:13928
- C:\Windows\System\GYIpjcc.exe
  C:\Windows\System\GYIpjcc.exe
  2⤵
  PID:13944
- C:\Windows\System\eRNFBJH.exe
  C:\Windows\System\eRNFBJH.exe
  2⤵
  PID:13964
- C:\Windows\System\OlYYwKp.exe
  C:\Windows\System\OlYYwKp.exe
  2⤵
  PID:13984
- C:\Windows\System\AyblfFG.exe
  C:\Windows\System\AyblfFG.exe
  2⤵
  PID:14000
- C:\Windows\System\SjUpbCL.exe
  C:\Windows\System\SjUpbCL.exe
  2⤵
  PID:14016
- C:\Windows\System\gVbnXVd.exe
  C:\Windows\System\gVbnXVd.exe
  2⤵
  PID:14032
- C:\Windows\System\WDXOcoW.exe
  C:\Windows\System\WDXOcoW.exe
  2⤵
  PID:14048
- C:\Windows\System\ZeqUvae.exe
  C:\Windows\System\ZeqUvae.exe
  2⤵
  PID:14064
- C:\Windows\System\enFmzih.exe
  C:\Windows\System\enFmzih.exe
  2⤵
  PID:14080
- C:\Windows\System\BxjZZYy.exe
  C:\Windows\System\BxjZZYy.exe
  2⤵
  PID:14112
- C:\Windows\System\RxnkLZp.exe
  C:\Windows\System\RxnkLZp.exe
  2⤵
  PID:14152
- C:\Windows\System\ytNqXqS.exe
  C:\Windows\System\ytNqXqS.exe
  2⤵
  PID:14196
- C:\Windows\System\jTEwBBh.exe
  C:\Windows\System\jTEwBBh.exe
  2⤵
  PID:14224
- C:\Windows\System\SVMNVcq.exe
  C:\Windows\System\SVMNVcq.exe
  2⤵
  PID:14272
- C:\Windows\System\DNwuHlv.exe
  C:\Windows\System\DNwuHlv.exe
  2⤵
  PID:14288
- C:\Windows\System\jWYTNjh.exe
  C:\Windows\System\jWYTNjh.exe
  2⤵
  PID:14304
- C:\Windows\System\VmLfYTd.exe
  C:\Windows\System\VmLfYTd.exe
  2⤵
  PID:14324
- C:\Windows\System\oMHvHOx.exe
  C:\Windows\System\oMHvHOx.exe
  2⤵
  PID:12664
- C:\Windows\System\DzigolV.exe
  C:\Windows\System\DzigolV.exe
  2⤵
  PID:7520
- C:\Windows\System\xudNokd.exe
  C:\Windows\System\xudNokd.exe
  2⤵
  PID:7804
- C:\Windows\System\oRVjzbk.exe
  C:\Windows\System\oRVjzbk.exe
  2⤵
  PID:5824
- C:\Windows\System\euyzqqK.exe
  C:\Windows\System\euyzqqK.exe
  2⤵
  PID:7624
- C:\Windows\System\VjYoayN.exe
  C:\Windows\System\VjYoayN.exe
  2⤵
  PID:7136
- C:\Windows\System\cDFwAEC.exe
  C:\Windows\System\cDFwAEC.exe
  2⤵
  PID:13432
- C:\Windows\System\YZeUqhF.exe
  C:\Windows\System\YZeUqhF.exe
  2⤵
  PID:5352
- C:\Windows\System\oQurCzR.exe
  C:\Windows\System\oQurCzR.exe
  2⤵
  PID:11204
- C:\Windows\System\hRObmud.exe
  C:\Windows\System\hRObmud.exe
  2⤵
  PID:9472
- C:\Windows\System\jajnQEx.exe
  C:\Windows\System\jajnQEx.exe
  2⤵
  PID:10576
- C:\Windows\System\lBMakLX.exe
  C:\Windows\System\lBMakLX.exe
  2⤵
  PID:9016
- C:\Windows\System\fpCqIpd.exe
  C:\Windows\System\fpCqIpd.exe
  2⤵
  PID:7132
- C:\Windows\System\YsCJCQv.exe
  C:\Windows\System\YsCJCQv.exe
  2⤵
  PID:6692
- C:\Windows\System\UQyFazo.exe
  C:\Windows\System\UQyFazo.exe
  2⤵
  PID:7724
- C:\Windows\System\FCvXeyD.exe
  C:\Windows\System\FCvXeyD.exe
  2⤵
  PID:8028
- C:\Windows\System\LQekgDX.exe
  C:\Windows\System\LQekgDX.exe
  2⤵
  PID:13332
- C:\Windows\System\rdbHnCG.exe
  C:\Windows\System\rdbHnCG.exe
  2⤵
  PID:6704
- C:\Windows\System\MCstlWf.exe
  C:\Windows\System\MCstlWf.exe
  2⤵
  PID:13556
- C:\Windows\System\FTOBYMf.exe
  C:\Windows\System\FTOBYMf.exe
  2⤵
  PID:13428
- C:\Windows\System\ppxXlGk.exe
  C:\Windows\System\ppxXlGk.exe
  2⤵
  PID:8620
- C:\Windows\System\kwnBjIP.exe
  C:\Windows\System\kwnBjIP.exe
  2⤵
  PID:4316
- C:\Windows\System\HYzebwZ.exe
  C:\Windows\System\HYzebwZ.exe
  2⤵
  PID:8644
- C:\Windows\System\jlYIgvY.exe
  C:\Windows\System\jlYIgvY.exe
  2⤵
  PID:11572
- C:\Windows\System\yAxzkrY.exe
  C:\Windows\System\yAxzkrY.exe
  2⤵
  PID:3644
- C:\Windows\System\aWgbXoQ.exe
  C:\Windows\System\aWgbXoQ.exe
  2⤵
  PID:11720
- C:\Windows\System\JxXEyyC.exe
  C:\Windows\System\JxXEyyC.exe
  2⤵
  PID:11752
- C:\Windows\System\vZOBenW.exe
  C:\Windows\System\vZOBenW.exe
  2⤵
  PID:11800
- C:\Windows\System\zxTXNcN.exe
  C:\Windows\System\zxTXNcN.exe
  2⤵
  PID:8252
- C:\Windows\System\hcbjfLf.exe
  C:\Windows\System\hcbjfLf.exe
  2⤵
  PID:8720
- C:\Windows\System\ElawgCV.exe
  C:\Windows\System\ElawgCV.exe
  2⤵
  PID:8104
- C:\Windows\System\MephdGc.exe
  C:\Windows\System\MephdGc.exe
  2⤵
  PID:7696
- C:\Windows\System\YHLLQbF.exe
  C:\Windows\System\YHLLQbF.exe
  2⤵
  PID:13656
- C:\Windows\System\iNifIlM.exe
  C:\Windows\System\iNifIlM.exe
  2⤵
  PID:7776
- C:\Windows\System\OEDOyOg.exe
  C:\Windows\System\OEDOyOg.exe
  2⤵
  PID:7296
- C:\Windows\System\xVSZaTN.exe
  C:\Windows\System\xVSZaTN.exe
  2⤵
  PID:13348
- C:\Windows\System\SELfvXd.exe
  C:\Windows\System\SELfvXd.exe
  2⤵
  PID:13328
- C:\Windows\System\vnSmGuV.exe
  C:\Windows\System\vnSmGuV.exe
  2⤵
  PID:8864
- C:\Windows\System\KRzXHPE.exe
  C:\Windows\System\KRzXHPE.exe
  2⤵
  PID:13752
- C:\Windows\System\wTDZRwb.exe
  C:\Windows\System\wTDZRwb.exe
  2⤵
  PID:8000
- C:\Windows\System\XPmyBBj.exe
  C:\Windows\System\XPmyBBj.exe
  2⤵
  PID:13792
- C:\Windows\System\mxbEhSn.exe
  C:\Windows\System\mxbEhSn.exe
  2⤵
  PID:13812
- C:\Windows\System\ZncqORZ.exe
  C:\Windows\System\ZncqORZ.exe
  2⤵
  PID:9008
- C:\Windows\System\cXHApyG.exe
  C:\Windows\System\cXHApyG.exe
  2⤵
  PID:13824
- C:\Windows\System\YpzjmEQ.exe
  C:\Windows\System\YpzjmEQ.exe
  2⤵
  PID:13600
- C:\Windows\System\IwLTTty.exe
  C:\Windows\System\IwLTTty.exe
  2⤵
  PID:13604
- C:\Windows\System\wPscnlH.exe
  C:\Windows\System\wPscnlH.exe
  2⤵
  PID:12268
- C:\Windows\System\PTydUTO.exe
  C:\Windows\System\PTydUTO.exe
  2⤵
  PID:4632
- C:\Windows\System\HMPOEvS.exe
  C:\Windows\System\HMPOEvS.exe
  2⤵
  PID:8060
- C:\Windows\System\oPGckTR.exe
  C:\Windows\System\oPGckTR.exe
  2⤵
  PID:7920
- C:\Windows\System\GdWuvTs.exe
  C:\Windows\System\GdWuvTs.exe
  2⤵
  PID:13860
- C:\Windows\System\UCKzQSJ.exe
  C:\Windows\System\UCKzQSJ.exe
  2⤵
  PID:13668
- C:\Windows\System\VOdUZtr.exe
  C:\Windows\System\VOdUZtr.exe
  2⤵
  PID:9732
- C:\Windows\System\IPQDENf.exe
  C:\Windows\System\IPQDENf.exe
  2⤵
  PID:13916
- C:\Windows\System\FlPXtgd.exe
  C:\Windows\System\FlPXtgd.exe
  2⤵
  PID:4944
- C:\Windows\System\wtSBBPP.exe
  C:\Windows\System\wtSBBPP.exe
  2⤵
  PID:14232
- C:\Windows\System\PwNoIAC.exe
  C:\Windows\System\PwNoIAC.exe
  2⤵
  PID:14256
- C:\Windows\System\gVeHDzQ.exe
  C:\Windows\System\gVeHDzQ.exe
  2⤵
  PID:10988
- C:\Windows\System\eDRvuNZ.exe
  C:\Windows\System\eDRvuNZ.exe
  2⤵
  PID:9412
- C:\Windows\System\BmiplXb.exe
  C:\Windows\System\BmiplXb.exe
  2⤵
  PID:5108
- C:\Windows\System\xuxDUGc.exe
  C:\Windows\System\xuxDUGc.exe
  2⤵
  PID:8960
- C:\Windows\System\HabbMVj.exe
  C:\Windows\System\HabbMVj.exe
  2⤵
  PID:8896
- C:\Windows\System\voJYned.exe
  C:\Windows\System\voJYned.exe
  2⤵
  PID:7212
- C:\Windows\System\nTUhEFA.exe
  C:\Windows\System\nTUhEFA.exe
  2⤵
  PID:8056
- C:\Windows\System\YaGPoXz.exe
  C:\Windows\System\YaGPoXz.exe
  2⤵
  PID:3112
- C:\Windows\System\fHMgVyz.exe
  C:\Windows\System\fHMgVyz.exe
  2⤵
  PID:11820
- C:\Windows\System\kXkyMKd.exe
  C:\Windows\System\kXkyMKd.exe
  2⤵
  PID:11748
- C:\Windows\System\NWsxadq.exe
  C:\Windows\System\NWsxadq.exe
  2⤵
  PID:14320
- C:\Windows\System\QBjeUXK.exe
  C:\Windows\System\QBjeUXK.exe
  2⤵
  PID:12408
- C:\Windows\System\yNfNwRm.exe
  C:\Windows\System\yNfNwRm.exe
  2⤵
  PID:12720
- C:\Windows\System\WnuzijY.exe
  C:\Windows\System\WnuzijY.exe
  2⤵
  PID:9516
- C:\Windows\System\esAmiXM.exe
  C:\Windows\System\esAmiXM.exe
  2⤵
  PID:8860
- C:\Windows\System\niHukrn.exe
  C:\Windows\System\niHukrn.exe
  2⤵
  PID:7248
- C:\Windows\System\Plaujwf.exe
  C:\Windows\System\Plaujwf.exe
  2⤵
  PID:5316
- C:\Windows\System\oVSfOWZ.exe
  C:\Windows\System\oVSfOWZ.exe
  2⤵
  PID:8732
- C:\Windows\System\xpOGRKg.exe
  C:\Windows\System\xpOGRKg.exe
  2⤵
  PID:8320
- C:\Windows\System\odiAbqS.exe
  C:\Windows\System\odiAbqS.exe
  2⤵
  PID:12136
- C:\Windows\System\xHkSfbg.exe
  C:\Windows\System\xHkSfbg.exe
  2⤵
  PID:8660
- C:\Windows\System\RymITfq.exe
  C:\Windows\System\RymITfq.exe
  2⤵
  PID:8776
- C:\Windows\System\CfZXHby.exe
  C:\Windows\System\CfZXHby.exe
  2⤵
  PID:5540
- C:\Windows\System\ECJaMYo.exe
  C:\Windows\System\ECJaMYo.exe
  2⤵
  PID:9572
- C:\Windows\System\rWzMdzJ.exe
  C:\Windows\System\rWzMdzJ.exe
  2⤵
  PID:10364
- C:\Windows\System\WYqwPIY.exe
  C:\Windows\System\WYqwPIY.exe
  2⤵
  PID:7180
- C:\Windows\System\rkBoDfD.exe
  C:\Windows\System\rkBoDfD.exe
  2⤵
  PID:13664
- C:\Windows\System\KEzvggH.exe
  C:\Windows\System\KEzvggH.exe
  2⤵
  PID:10216
- C:\Windows\System\juefZcW.exe
  C:\Windows\System\juefZcW.exe
  2⤵
  PID:12924
- C:\Windows\System\WLzkgXt.exe
  C:\Windows\System\WLzkgXt.exe
  2⤵
  PID:7604
- C:\Windows\System\nnbplMJ.exe
  C:\Windows\System\nnbplMJ.exe
  2⤵
  PID:9632
- C:\Windows\System\fXrcjUd.exe
  C:\Windows\System\fXrcjUd.exe
  2⤵
  PID:13692
- C:\Windows\System\MzwawUM.exe
  C:\Windows\System\MzwawUM.exe
  2⤵
  PID:8200
- C:\Windows\System\dQWRRMG.exe
  C:\Windows\System\dQWRRMG.exe
  2⤵
  PID:10748
- C:\Windows\System\HVDtxWA.exe
  C:\Windows\System\HVDtxWA.exe
  2⤵
  PID:7780
- C:\Windows\System\wqhuSOu.exe
  C:\Windows\System\wqhuSOu.exe
  2⤵
  PID:6744
- C:\Windows\System\AFNmMBL.exe
  C:\Windows\System\AFNmMBL.exe
  2⤵
  PID:4452
- C:\Windows\System\BMMmGwX.exe
  C:\Windows\System\BMMmGwX.exe
  2⤵
  PID:7444
- C:\Windows\System\hpuYyFZ.exe
  C:\Windows\System\hpuYyFZ.exe
  2⤵
  PID:10880
- C:\Windows\System\tjUQiav.exe
  C:\Windows\System\tjUQiav.exe
  2⤵
  PID:8292
- C:\Windows\System\vlKlnSu.exe
  C:\Windows\System\vlKlnSu.exe
  2⤵
  PID:2308
- C:\Windows\System\rhoulgn.exe
  C:\Windows\System\rhoulgn.exe
  2⤵
  PID:11500
- C:\Windows\System\vkTbqsJ.exe
  C:\Windows\System\vkTbqsJ.exe
  2⤵
  PID:11816
- C:\Windows\System\YIoCpTe.exe
  C:\Windows\System\YIoCpTe.exe
  2⤵
  PID:10900
- C:\Windows\System\piKvJdQ.exe
  C:\Windows\System\piKvJdQ.exe
  2⤵
  PID:7008
- C:\Windows\System\rBkElsn.exe
  C:\Windows\System\rBkElsn.exe
  2⤵
  PID:3428
- C:\Windows\System\vpTsciE.exe
  C:\Windows\System\vpTsciE.exe
  2⤵
  PID:10652
- C:\Windows\System\kynADqB.exe
  C:\Windows\System\kynADqB.exe
  2⤵
  PID:13796
- C:\Windows\System\wGITfWH.exe
  C:\Windows\System\wGITfWH.exe
  2⤵
  PID:6152
- C:\Windows\System\qMeiwEP.exe
  C:\Windows\System\qMeiwEP.exe
  2⤵
  PID:13492
- C:\Windows\System\PIUSFPE.exe
  C:\Windows\System\PIUSFPE.exe
  2⤵
  PID:10908
- C:\Windows\System\PUdKYFT.exe
  C:\Windows\System\PUdKYFT.exe
  2⤵
  PID:10960
- C:\Windows\System\HzkDfOT.exe
  C:\Windows\System\HzkDfOT.exe
  2⤵
  PID:6904
- C:\Windows\System\bzJsysj.exe
  C:\Windows\System\bzJsysj.exe
  2⤵
  PID:11068
- C:\Windows\System\vFAcGrK.exe
  C:\Windows\System\vFAcGrK.exe
  2⤵
  PID:10212
- C:\Windows\System\pgngCTN.exe
  C:\Windows\System\pgngCTN.exe
  2⤵
  PID:11144
- C:\Windows\System\uDEgyFD.exe
  C:\Windows\System\uDEgyFD.exe
  2⤵
  PID:12808
- C:\Windows\System\avqbsqD.exe
  C:\Windows\System\avqbsqD.exe
  2⤵
  PID:11168
- C:\Windows\System\XyzbcLn.exe
  C:\Windows\System\XyzbcLn.exe
  2⤵
  PID:7652
- C:\Windows\System\WSDkhdQ.exe
  C:\Windows\System\WSDkhdQ.exe
  2⤵
  PID:9120
- C:\Windows\System\QnYOjAl.exe
  C:\Windows\System\QnYOjAl.exe
  2⤵
  PID:8132
- C:\Windows\System\CAqYmhU.exe
  C:\Windows\System\CAqYmhU.exe
  2⤵
  PID:10788
- C:\Windows\System\yKrEwIT.exe
  C:\Windows\System\yKrEwIT.exe
  2⤵
  PID:12584
- C:\Windows\System\zAOUXqH.exe
  C:\Windows\System\zAOUXqH.exe
  2⤵
  PID:12984
- C:\Windows\System\iDCpxNR.exe
  C:\Windows\System\iDCpxNR.exe
  2⤵
  PID:1644
- C:\Windows\System\Orgvhhe.exe
  C:\Windows\System\Orgvhhe.exe
  2⤵
  PID:9880
- C:\Windows\System\hmxkcTt.exe
  C:\Windows\System\hmxkcTt.exe
  2⤵
  PID:10904
- C:\Windows\System\jGpNAwB.exe
  C:\Windows\System\jGpNAwB.exe
  2⤵
  PID:10536
- C:\Windows\System\RmwFtHX.exe
  C:\Windows\System\RmwFtHX.exe
  2⤵
  PID:9548
- C:\Windows\System\peHnfnt.exe
  C:\Windows\System\peHnfnt.exe
  2⤵
  PID:12820
- C:\Windows\System\HzxAlvC.exe
  C:\Windows\System\HzxAlvC.exe
  2⤵
  PID:13780
- C:\Windows\System\lwQxbeH.exe
  C:\Windows\System\lwQxbeH.exe
  2⤵
  PID:10772
- C:\Windows\System\PCSTavo.exe
  C:\Windows\System\PCSTavo.exe
  2⤵
  PID:8396
- C:\Windows\System\CAPPJEb.exe
  C:\Windows\System\CAPPJEb.exe
  2⤵
  PID:14316
- C:\Windows\System\YojkABw.exe
  C:\Windows\System\YojkABw.exe
  2⤵
  PID:12712
- C:\Windows\System\CWYWSFU.exe
  C:\Windows\System\CWYWSFU.exe
  2⤵
  PID:10020
- C:\Windows\System\NjIvRQf.exe
  C:\Windows\System\NjIvRQf.exe
  2⤵
  PID:9424
- C:\Windows\System\tjyycZj.exe
  C:\Windows\System\tjyycZj.exe
  2⤵
  PID:9784
- C:\Windows\System\DxbSrVw.exe
  C:\Windows\System\DxbSrVw.exe
  2⤵
  PID:12168
- C:\Windows\System\XJiHqJd.exe
  C:\Windows\System\XJiHqJd.exe
  2⤵
  PID:10108
- C:\Windows\System\sLPGBig.exe
  C:\Windows\System\sLPGBig.exe
  2⤵
  PID:13516
- C:\Windows\System\gfEiZUc.exe
  C:\Windows\System\gfEiZUc.exe
  2⤵
  PID:8836
- C:\Windows\System\bGGrZIR.exe
  C:\Windows\System\bGGrZIR.exe
  2⤵
  PID:7548
- C:\Windows\System\kYSaXYI.exe
  C:\Windows\System\kYSaXYI.exe
  2⤵
  PID:13456
- C:\Windows\System\vfcBDhF.exe
  C:\Windows\System\vfcBDhF.exe
  2⤵
  PID:10176
- C:\Windows\System\EMYYjJU.exe
  C:\Windows\System\EMYYjJU.exe
  2⤵
  PID:11016
- C:\Windows\System\ZiHalpb.exe
  C:\Windows\System\ZiHalpb.exe
  2⤵
  PID:10012
- C:\Windows\System\HQytEgx.exe
  C:\Windows\System\HQytEgx.exe
  2⤵
  PID:10764
- C:\Windows\System\aGkeZRa.exe
  C:\Windows\System\aGkeZRa.exe
  2⤵
  PID:8148
- C:\Windows\System\AZPrHIy.exe
  C:\Windows\System\AZPrHIy.exe
  2⤵
  PID:9800
- C:\Windows\System\rWXtUEH.exe
  C:\Windows\System\rWXtUEH.exe
  2⤵
  PID:11092
- C:\Windows\System\LstbUOB.exe
  C:\Windows\System\LstbUOB.exe
  2⤵
  PID:11224
- C:\Windows\System\fUGrGba.exe
  C:\Windows\System\fUGrGba.exe
  2⤵
  PID:10864
- C:\Windows\System\yeVQRtQ.exe
  C:\Windows\System\yeVQRtQ.exe
  2⤵
  PID:11456
- C:\Windows\System\OjGyGWw.exe
  C:\Windows\System\OjGyGWw.exe
  2⤵
  PID:12264
- C:\Windows\System\VwXEpQK.exe
  C:\Windows\System\VwXEpQK.exe
  2⤵
  PID:10680
- C:\Windows\System\iXIsKBS.exe
  C:\Windows\System\iXIsKBS.exe
  2⤵
  PID:9364
- C:\Windows\System\wVCVZyo.exe
  C:\Windows\System\wVCVZyo.exe
  2⤵
  PID:11564
- C:\Windows\System\ZhWeALD.exe
  C:\Windows\System\ZhWeALD.exe
  2⤵
  PID:10136
- C:\Windows\System\btQiEBp.exe
  C:\Windows\System\btQiEBp.exe
  2⤵
  PID:14072
- C:\Windows\System\oSVfVEz.exe
  C:\Windows\System\oSVfVEz.exe
  2⤵
  PID:8892
- C:\Windows\System\nAkqsFB.exe
  C:\Windows\System\nAkqsFB.exe
  2⤵
  PID:11436
- C:\Windows\System\hdXNnBg.exe
  C:\Windows\System\hdXNnBg.exe
  2⤵
  PID:13624
- C:\Windows\System\GUHmPdg.exe
  C:\Windows\System\GUHmPdg.exe
  2⤵
  PID:12004
- C:\Windows\System\QMiKLPm.exe
  C:\Windows\System\QMiKLPm.exe
  2⤵
  PID:11856
- C:\Windows\System\flNIZuZ.exe
  C:\Windows\System\flNIZuZ.exe
  2⤵
  PID:9084
- C:\Windows\System\eQKnGwp.exe
  C:\Windows\System\eQKnGwp.exe
  2⤵
  PID:12220
- C:\Windows\System\OuBpobt.exe
  C:\Windows\System\OuBpobt.exe
  2⤵
  PID:10664
- C:\Windows\System\sbhawiH.exe
  C:\Windows\System\sbhawiH.exe
  2⤵
  PID:11408
- C:\Windows\System\hlbmuPN.exe
  C:\Windows\System\hlbmuPN.exe
  2⤵
  PID:10512
- C:\Windows\System\WuMeHFc.exe
  C:\Windows\System\WuMeHFc.exe
  2⤵
  PID:12212
- C:\Windows\System\zRloApf.exe
  C:\Windows\System\zRloApf.exe
  2⤵
  PID:10468
- C:\Windows\System\kxxiCLJ.exe
  C:\Windows\System\kxxiCLJ.exe
  2⤵
  PID:11072
- C:\Windows\System\OTgtPAC.exe
  C:\Windows\System\OTgtPAC.exe
  2⤵
  PID:10940
- C:\Windows\System\bZXKUOt.exe
  C:\Windows\System\bZXKUOt.exe
  2⤵
  PID:10068
- C:\Windows\System\oTIOfrh.exe
  C:\Windows\System\oTIOfrh.exe
  2⤵
  PID:13308
- C:\Windows\System\ozPguZA.exe
  C:\Windows\System\ozPguZA.exe
  2⤵
  PID:8992
- C:\Windows\System\acBtneL.exe
  C:\Windows\System\acBtneL.exe
  2⤵
  PID:9204
- C:\Windows\System\aRCThDc.exe
  C:\Windows\System\aRCThDc.exe
  2⤵
  PID:7896
- C:\Windows\System\cByMPzM.exe
  C:\Windows\System\cByMPzM.exe
  2⤵
  PID:10856
- C:\Windows\System\jWCTcQb.exe
  C:\Windows\System\jWCTcQb.exe
  2⤵
  PID:9848
- C:\Windows\System\pfJITmV.exe
  C:\Windows\System\pfJITmV.exe
  2⤵
  PID:11768
- C:\Windows\System\QeFMHwx.exe
  C:\Windows\System\QeFMHwx.exe
  2⤵
  PID:11568
- C:\Windows\System\nEpwyhz.exe
  C:\Windows\System\nEpwyhz.exe
  2⤵
  PID:11472
- C:\Windows\System\kLBSKSq.exe
  C:\Windows\System\kLBSKSq.exe
  2⤵
  PID:12208
- C:\Windows\System\MrPPKkn.exe
  C:\Windows\System\MrPPKkn.exe
  2⤵
  PID:11372
- C:\Windows\System\XtMPIGi.exe
  C:\Windows\System\XtMPIGi.exe
  2⤵
  PID:11424
- C:\Windows\System\bpxzJkI.exe
  C:\Windows\System\bpxzJkI.exe
  2⤵
  PID:13744
- C:\Windows\System\QpaPXgF.exe
  C:\Windows\System\QpaPXgF.exe
  2⤵
  PID:9188
- C:\Windows\System\IqUjKtZ.exe
  C:\Windows\System\IqUjKtZ.exe
  2⤵
  PID:9492
- C:\Windows\System\FjPQCac.exe
  C:\Windows\System\FjPQCac.exe
  2⤵
  PID:11396
- C:\Windows\System\ghpahsv.exe
  C:\Windows\System\ghpahsv.exe
  2⤵
  PID:14120
- C:\Windows\System\rsDZqMn.exe
  C:\Windows\System\rsDZqMn.exe
  2⤵
  PID:9076
- C:\Windows\System\DksLSgZ.exe
  C:\Windows\System\DksLSgZ.exe
  2⤵
  PID:9924
- C:\Windows\System\zJfRcxG.exe
  C:\Windows\System\zJfRcxG.exe
  2⤵
  PID:9248
- C:\Windows\System\ozoMmsu.exe
  C:\Windows\System\ozoMmsu.exe
  2⤵
  PID:8040
- C:\Windows\System\lUselED.exe
  C:\Windows\System\lUselED.exe
  2⤵
  PID:9252
- C:\Windows\System\fviMozE.exe
  C:\Windows\System\fviMozE.exe
  2⤵
  PID:12248
- C:\Windows\System\DmHhsgS.exe
  C:\Windows\System\DmHhsgS.exe
  2⤵
  PID:11476
- C:\Windows\System\rSalKEV.exe
  C:\Windows\System\rSalKEV.exe
  2⤵
  PID:8508
- C:\Windows\System\IKHqRYg.exe
  C:\Windows\System\IKHqRYg.exe
  2⤵
  PID:10756
- C:\Windows\System\OUvvwqx.exe
  C:\Windows\System\OUvvwqx.exe
  2⤵
  PID:10868
- C:\Windows\System\sSiLpkH.exe
  C:\Windows\System\sSiLpkH.exe
  2⤵
  PID:10976
- C:\Windows\System\QNreaOL.exe
  C:\Windows\System\QNreaOL.exe
  2⤵
  PID:8412
- C:\Windows\System\oYwcdBu.exe
  C:\Windows\System\oYwcdBu.exe
  2⤵
  PID:9968
- C:\Windows\System\fMPxRyN.exe
  C:\Windows\System\fMPxRyN.exe
  2⤵
  PID:4084
- C:\Windows\System\dQQiYtn.exe
  C:\Windows\System\dQQiYtn.exe
  2⤵
  PID:9764
- C:\Windows\System\bpvLorJ.exe
  C:\Windows\System\bpvLorJ.exe
  2⤵
  PID:12188
- C:\Windows\System\iQhpFWe.exe
  C:\Windows\System\iQhpFWe.exe
  2⤵
  PID:11268
- C:\Windows\System\cqkuauW.exe
  C:\Windows\System\cqkuauW.exe
  2⤵
  PID:9220
- C:\Windows\System\QjRwpQf.exe
  C:\Windows\System\QjRwpQf.exe
  2⤵
  PID:9080
- C:\Windows\System\vXOxabu.exe
  C:\Windows\System\vXOxabu.exe
  2⤵
  PID:11516
- C:\Windows\System\MIInmMJ.exe
  C:\Windows\System\MIInmMJ.exe
  2⤵
  PID:9436
- C:\Windows\System\JtQaAYT.exe
  C:\Windows\System\JtQaAYT.exe
  2⤵
  PID:12120
- C:\Windows\System\YFKvlLU.exe
  C:\Windows\System\YFKvlLU.exe
  2⤵
  PID:13900
- C:\Windows\System\icUHphx.exe
  C:\Windows\System\icUHphx.exe
  2⤵
  PID:10472
- C:\Windows\System\bbZIuod.exe
  C:\Windows\System\bbZIuod.exe
  2⤵
  PID:6548
- C:\Windows\System\qbaqchH.exe
  C:\Windows\System\qbaqchH.exe
  2⤵
  PID:10824
- C:\Windows\System\oKVGMwF.exe
  C:\Windows\System\oKVGMwF.exe
  2⤵
  PID:14356
- C:\Windows\System\cQMdeuX.exe
  C:\Windows\System\cQMdeuX.exe
  2⤵
  PID:14380
- C:\Windows\System\nVoZQqC.exe
  C:\Windows\System\nVoZQqC.exe
  2⤵
  PID:14404
- C:\Windows\System\GSlRjYp.exe
  C:\Windows\System\GSlRjYp.exe
  2⤵
  PID:14424
- C:\Windows\System\MymVCwF.exe
  C:\Windows\System\MymVCwF.exe
  2⤵
  PID:14444
- C:\Windows\System\GjWhgxi.exe
  C:\Windows\System\GjWhgxi.exe
  2⤵
  PID:14468
- C:\Windows\System\dUHmEvn.exe
  C:\Windows\System\dUHmEvn.exe
  2⤵
  PID:14492
- C:\Windows\System\OJNHZsY.exe
  C:\Windows\System\OJNHZsY.exe
  2⤵
  PID:14576
- C:\Windows\System\xRAbCOk.exe
  C:\Windows\System\xRAbCOk.exe
  2⤵
  PID:14596
- C:\Windows\System\WpraEGJ.exe
  C:\Windows\System\WpraEGJ.exe
  2⤵
  PID:14612
- C:\Windows\System\VpKHIdj.exe
  C:\Windows\System\VpKHIdj.exe
  2⤵
  PID:14632
- C:\Windows\System\ZzSbeZY.exe
  C:\Windows\System\ZzSbeZY.exe
  2⤵
  PID:14656
- C:\Windows\System\edgZEmy.exe
  C:\Windows\System\edgZEmy.exe
  2⤵
  PID:14676
- C:\Windows\System\WPOEBEq.exe
  C:\Windows\System\WPOEBEq.exe
  2⤵
  PID:14700
- C:\Windows\System\cAFPGSL.exe
  C:\Windows\System\cAFPGSL.exe
  2⤵
  PID:14728
- C:\Windows\System\IrEaupj.exe
  C:\Windows\System\IrEaupj.exe
  2⤵
  PID:14744
- C:\Windows\System\gdNQwIa.exe
  C:\Windows\System\gdNQwIa.exe
  2⤵
  PID:14764
- C:\Windows\System\CVlqwfJ.exe
  C:\Windows\System\CVlqwfJ.exe
  2⤵
  PID:14784
- C:\Windows\System\UzyYSQs.exe
  C:\Windows\System\UzyYSQs.exe
  2⤵
  PID:14804
- C:\Windows\System\pNXncxg.exe
  C:\Windows\System\pNXncxg.exe
  2⤵
  PID:14832
- C:\Windows\System\wnFcDwX.exe
  C:\Windows\System\wnFcDwX.exe
  2⤵
  PID:14852
- C:\Windows\System\BjKdvqN.exe
  C:\Windows\System\BjKdvqN.exe
  2⤵
  PID:14872
- C:\Windows\System\hEMDBXm.exe
  C:\Windows\System\hEMDBXm.exe
  2⤵
  PID:14896
- C:\Windows\System\upaHMuj.exe
  C:\Windows\System\upaHMuj.exe
  2⤵
  PID:14920
- C:\Windows\System\EQVhhcM.exe
  C:\Windows\System\EQVhhcM.exe
  2⤵
  PID:14940
- C:\Windows\System\kyGZTAH.exe
  C:\Windows\System\kyGZTAH.exe
  2⤵
  PID:14964
- C:\Windows\System\HgkNLjZ.exe
  C:\Windows\System\HgkNLjZ.exe
  2⤵
  PID:14988
- C:\Windows\System\kWcMSmR.exe
  C:\Windows\System\kWcMSmR.exe
  2⤵
  PID:15012
- C:\Windows\System\VrCvtPj.exe
  C:\Windows\System\VrCvtPj.exe
  2⤵
  PID:15036
- C:\Windows\System\aJcEvqE.exe
  C:\Windows\System\aJcEvqE.exe
  2⤵
  PID:15068
- C:\Windows\System\REBEvTj.exe
  C:\Windows\System\REBEvTj.exe
  2⤵
  PID:15088
- C:\Windows\System\osqMktn.exe
  C:\Windows\System\osqMktn.exe
  2⤵
  PID:15112
- C:\Windows\System\mQFlVwC.exe
  C:\Windows\System\mQFlVwC.exe
  2⤵
  PID:15136
- C:\Windows\System\FyybpHF.exe
  C:\Windows\System\FyybpHF.exe
  2⤵
  PID:15168
- C:\Windows\System\UoKAevW.exe
  C:\Windows\System\UoKAevW.exe
  2⤵
  PID:2144
- C:\Windows\System\SkXqUHr.exe
  C:\Windows\System\SkXqUHr.exe
  2⤵
  PID:5388
- C:\Windows\System\WofWfci.exe
  C:\Windows\System\WofWfci.exe
  2⤵
  PID:10832
- C:\Windows\System\tGGrvQL.exe
  C:\Windows\System\tGGrvQL.exe
  2⤵
  PID:9316
- C:\Windows\System\fehSFoL.exe
  C:\Windows\System\fehSFoL.exe
  2⤵
  PID:10260
- C:\Windows\System\zYPJBqd.exe
  C:\Windows\System\zYPJBqd.exe
  2⤵
  PID:8528
- C:\Windows\System\GxYHPhv.exe
  C:\Windows\System\GxYHPhv.exe
  2⤵
  PID:12056
- C:\Windows\System\kWKFoIV.exe
  C:\Windows\System\kWKFoIV.exe
  2⤵
  PID:10292
- C:\Windows\System\vRatZXH.exe
  C:\Windows\System\vRatZXH.exe
  2⤵
  PID:14760
- C:\Windows\System\gVFMAuO.exe
  C:\Windows\System\gVFMAuO.exe
  2⤵
  PID:8888
- C:\Windows\System\QJBkYiA.exe
  C:\Windows\System\QJBkYiA.exe
  2⤵
  PID:9348
- C:\Windows\System\DMDjPUT.exe
  C:\Windows\System\DMDjPUT.exe
  2⤵
  PID:10316
- C:\Windows\System\xxlEtwq.exe
  C:\Windows\System\xxlEtwq.exe
  2⤵
  PID:7264
- C:\Windows\System\PiDaIxY.exe
  C:\Windows\System\PiDaIxY.exe
  2⤵
  PID:11392
- C:\Windows\System\YopzwQs.exe
  C:\Windows\System\YopzwQs.exe
  2⤵
  PID:13128
- C:\Windows\System\OCrWGhV.exe
  C:\Windows\System\OCrWGhV.exe
  2⤵
  PID:13480
- C:\Windows\System\onJCxJX.exe
  C:\Windows\System\onJCxJX.exe
  2⤵
  PID:14412
- C:\Windows\System\SXNYWRQ.exe
  C:\Windows\System\SXNYWRQ.exe
  2⤵
  PID:14488
- C:\Windows\System\hqBrucE.exe
  C:\Windows\System\hqBrucE.exe
  2⤵
  PID:9792
- C:\Windows\System\BFbnDic.exe
  C:\Windows\System\BFbnDic.exe
  2⤵
  PID:15336
- C:\Windows\System\yxZXvdj.exe
  C:\Windows\System\yxZXvdj.exe
  2⤵
  PID:14736
- C:\Windows\System\puKZVFc.exe
  C:\Windows\System\puKZVFc.exe
  2⤵
  PID:10504
- C:\Windows\System\NccyOTY.exe
  C:\Windows\System\NccyOTY.exe
  2⤵
  PID:11200
- C:\Windows\System\ITnXgYj.exe
  C:\Windows\System\ITnXgYj.exe
  2⤵
  PID:15108
- C:\Windows\System\qpcngrn.exe
  C:\Windows\System\qpcngrn.exe
  2⤵
  PID:10812
- C:\Windows\System\NDlEKoG.exe
  C:\Windows\System\NDlEKoG.exe
  2⤵
  PID:11308
- C:\Windows\System\OMMfQCE.exe
  C:\Windows\System\OMMfQCE.exe
  2⤵
  PID:15164
- C:\Windows\System\leGmUFT.exe
  C:\Windows\System\leGmUFT.exe
  2⤵
  PID:11552
- C:\Windows\System\trGbFoF.exe
  C:\Windows\System\trGbFoF.exe
  2⤵
  PID:11248
- C:\Windows\System\MrchrIL.exe
  C:\Windows\System\MrchrIL.exe
  2⤵
  PID:14284
- C:\Windows\System\hbImEeQ.exe
  C:\Windows\System\hbImEeQ.exe
  2⤵
  PID:15232
- C:\Windows\System\JSYkrfg.exe
  C:\Windows\System\JSYkrfg.exe
  2⤵
  PID:14560
- C:\Windows\System\fKcOwfQ.exe
  C:\Windows\System\fKcOwfQ.exe
  2⤵
  PID:14716
- C:\Windows\System\LJVQRMn.exe
  C:\Windows\System\LJVQRMn.exe
  2⤵
  PID:14844
- C:\Windows\System\kYhGjPM.exe
  C:\Windows\System\kYhGjPM.exe
  2⤵
  PID:14864
- C:\Windows\System\YIFvlNu.exe
  C:\Windows\System\YIFvlNu.exe
  2⤵
  PID:14928
- C:\Windows\System\oSYuXAE.exe
  C:\Windows\System\oSYuXAE.exe
  2⤵
  PID:15000
- C:\Windows\System\erlmJem.exe
  C:\Windows\System\erlmJem.exe
  2⤵
  PID:15044
- C:\Windows\System\zjmUWEz.exe
  C:\Windows\System\zjmUWEz.exe
  2⤵
  PID:15080
- C:\Windows\System\CnqIjyO.exe
  C:\Windows\System\CnqIjyO.exe
  2⤵
  PID:12500
- C:\Windows\System\wEnbWgn.exe
  C:\Windows\System\wEnbWgn.exe
  2⤵
  PID:15388
- C:\Windows\System\jMIxkhl.exe
  C:\Windows\System\jMIxkhl.exe
  2⤵
  PID:15408
- C:\Windows\System\MKrEpvG.exe
  C:\Windows\System\MKrEpvG.exe
  2⤵
  PID:15428
- C:\Windows\System\yXUmOeq.exe
  C:\Windows\System\yXUmOeq.exe
  2⤵
  PID:15460
- C:\Windows\System\SeTRzxC.exe
  C:\Windows\System\SeTRzxC.exe
  2⤵
  PID:15484
- C:\Windows\System\cRuIWWq.exe
  C:\Windows\System\cRuIWWq.exe
  2⤵
  PID:15508
- C:\Windows\System\lfnSCYN.exe
  C:\Windows\System\lfnSCYN.exe
  2⤵
  PID:15532
- C:\Windows\System\TKIRwkf.exe
  C:\Windows\System\TKIRwkf.exe
  2⤵
  PID:15552
- C:\Windows\System\LgTOrCq.exe
  C:\Windows\System\LgTOrCq.exe
  2⤵
  PID:15572
- C:\Windows\System\byGGuDg.exe
  C:\Windows\System\byGGuDg.exe
  2⤵
  PID:15592
- C:\Windows\System\TCArZFI.exe
  C:\Windows\System\TCArZFI.exe
  2⤵
  PID:15612
- C:\Windows\System\QmVDomL.exe
  C:\Windows\System\QmVDomL.exe
  2⤵
  PID:15636
- C:\Windows\System\kiKoSwn.exe
  C:\Windows\System\kiKoSwn.exe
  2⤵
  PID:15664
- C:\Windows\System\AiJvUUL.exe
  C:\Windows\System\AiJvUUL.exe
  2⤵
  PID:15684
- C:\Windows\System\BiLfeCS.exe
  C:\Windows\System\BiLfeCS.exe
  2⤵
  PID:15716
- C:\Windows\System\GYoMKhn.exe
  C:\Windows\System\GYoMKhn.exe
  2⤵
  PID:15740
- C:\Windows\System\GQjUQye.exe
  C:\Windows\System\GQjUQye.exe
  2⤵
  PID:15760
- C:\Windows\System\VAwITrb.exe
  C:\Windows\System\VAwITrb.exe
  2⤵
  PID:15784
- C:\Windows\System\ERtILQa.exe
  C:\Windows\System\ERtILQa.exe
  2⤵
  PID:15808
- C:\Windows\System\gkmfWsz.exe
  C:\Windows\System\gkmfWsz.exe
  2⤵
  PID:15828
- C:\Windows\System\AabggCZ.exe
  C:\Windows\System\AabggCZ.exe
  2⤵
  PID:15852
- C:\Windows\System\QVMiDez.exe
  C:\Windows\System\QVMiDez.exe
  2⤵
  PID:15880
- C:\Windows\System\JUibPLg.exe
  C:\Windows\System\JUibPLg.exe
  2⤵
  PID:15904
- C:\Windows\System\kwVMaKG.exe
  C:\Windows\System\kwVMaKG.exe
  2⤵
  PID:15928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ycogv4d.vvq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AtLjsoU.exe

Filesize
2.0MB

MD5
162266f94051eaf15d0c567a904eea2b

SHA1
c74ace078fc3dc8e08189132c1f2d460eae8e111

SHA256
3cac686dfdbdf6d62805907161d5ebc4318624d84ed770dd60aa3dfbbd1d064c

SHA512
c6bed453944d127314accb9aa781d763e79523bdcf13800ac657c6221d9c1e56e03c06d3a12ba566b810e1d476982ef6f66dc3f91d303d535587faf6783df086

Download Submit
C:\Windows\System\BXlVtGm.exe

Filesize
2.0MB

MD5
9980c20cd5a5cd04b6297e71d7fd66b5

SHA1
b029c4381ba0fbaf1e99bb7e29a10c28cfb0f246

SHA256
777a7ef43a78bf2499523aa031b643a2159c7b888c2c255d8f4a529b7cdf444f

SHA512
33c9d7d4a689da71e09ec57f6859efafbbb9d11ba88324ce1578d30c6d21b80742f4687f7ee738ae8b24fbee6de8ed53700bc4d92459967d32bea4b079da5aad

Download Submit
C:\Windows\System\EFmMWLf.exe

Filesize
2.0MB

MD5
f940a7c914d06b30cf51ebdc96d70e75

SHA1
457ba78316b4cf36883c35d9da6666470dc8258d

SHA256
217143d15aacde6562187540d7a45a1ee10266a02b5d2d50bfef51b8593a5a74

SHA512
9332a2a64067f54df634aa52e92040ee4731775e8cb5392bd70958905ed0cd6b4ddfa52b4ca9828eb8693eae76073f04d059948aa3a063160f2bbbff5a76ce6d

Download Submit
C:\Windows\System\FTdbPOY.exe

Filesize
2.0MB

MD5
3335345a3ab1ca9b54aab13cc2dec81a

SHA1
ad9815f764d8b3d5ac25380feb98ea1f1226b53a

SHA256
b164c093ed8b4f9bd91b6d1a0ef705e70cf9d1595509d3550a25e3a671569692

SHA512
f728f83e0b3be002874db7c5079254cb6421529401b4a3bc68d4085343df1537b59c0c5ff42a98a5d6f15de78435864cb082573b54a1e25fcb64f6a3f9ec3718

Download Submit
C:\Windows\System\Gfmwfge.exe

Filesize
2.0MB

MD5
06085708335b7722c106574578c58416

SHA1
c20b39659666697f916c828142774dc1320d412c

SHA256
95b92191b8464974ea3f5ef3fd525a1111e65c6420d4642bdb47c99fbdad0b91

SHA512
96540dc1b28cde04f331c5d7d2de3510982a791919719bacfe16ad6601311df1b80ff78d3285198fafc472d37634c55b162309155e8b78fa53d907113170b0ea

Download Submit
C:\Windows\System\HKeRHKO.exe

Filesize
2.0MB

MD5
3a65dedbd6930161b3af3f4e669d5776

SHA1
ce8f5d5b04df07788cd5b9131993a945a395b3ee

SHA256
a31c856efa4d3411564fae93c53b71460c3bd41678ff330629592c3a31af7dce

SHA512
bf78bf74d6dc84e9b2e4ac7a7a213b25f18c80b9a7b08601ebced2503ead4c34021e0bc1c7ff1ad86bca510a205ecc44f87d5b7f1a2786eb4233ae42da998192

Download Submit
C:\Windows\System\LhxNpxi.exe

Filesize
2.0MB

MD5
3433a3f409499459aa604254d8a4b791

SHA1
68c3b1456677f1c0c42fb1e200361569cc5a9a6b

SHA256
e7b9bf2700406980184cce81a36d0816d50f837f1537547ea56bfdc603dc85d3

SHA512
d7dc3162918478b85e0837d71653eec0f8610e72e42964e95e0bbdaee79594f2eb085b3e58ae0422d0b2f494fa572e98b9f58a709d76db6c98b118b97ecfbbdd

Download Submit
C:\Windows\System\MFlAZyd.exe

Filesize
2.0MB

MD5
54bb2d3484f7ef1d3e7699e9edceb19f

SHA1
3b59be21201cdf4a6a0eac33907d5e2783341534

SHA256
b0a13c834802009d84b2aa061e3710daa10046129aeb03998a2c1465499fa424

SHA512
8f02d5b62ff4884e7ccd5e0abbe5b8e0fe8bab903e3da2951267e54c19dddc18b8ecaed58f1e379a38559bc0cb88303b0b549d7fec7776051d2bc330e261c557

Download Submit
C:\Windows\System\PXoITwq.exe

Filesize
2.0MB

MD5
44f4b060cf5ff5e7152e14b0fc6441d9

SHA1
92710a3f35cab6982541a0dec8ed5fdb0327abfe

SHA256
b9b3d99049e6892a6f4df35ee9bc490f7a34480d0b26c91710773d901afe332a

SHA512
f7d39b41e59655bdb42e869f484605de13bc3c17c7e1682bb16f3698b21e9ab72a99b522cbc52ba47218103a9fc044d6d04af44885664f0b59bf8723f9a29a51

Download Submit
C:\Windows\System\QLBDlgQ.exe

Filesize
2.0MB

MD5
ed1fbb9ce2e8ff3034cffeb7e5d1001b

SHA1
5cde3635d09a075bdadcc02041f38928fccf3445

SHA256
2b33ddab1ddc07a7c50662291ba73d0c8c3bfb985b850b129631bf51e4060dd2

SHA512
629f0b56f18d9acfb38ab212e5b2f44e85bb149a46e6d878f06c70297513a4f93618f9a456716a49ba4ba94e585d8aace0ac6888278bccb746583a64507f5fc4

Download Submit
C:\Windows\System\QarJONV.exe

Filesize
2.0MB

MD5
f4d5abd9be673b8530123fb743c38d7a

SHA1
270db62a892135164c8be01549ed25d0bb5e34f7

SHA256
13ef3daaca5a5dc29f24d300aed4427c7452c32591dddd37845d1a287a94c91d

SHA512
0b04c577886bc8558ccaaeb340224705abcc3b24cddf19625b4ba28e7ece50877d63d0c3090a8a5f5d96e6a3054ff60a8ca1cab1446f0f0382756ec2797a1ca9

Download Submit
C:\Windows\System\RnmfvsM.exe

Filesize
2.0MB

MD5
c8fe68507c3146e420e4f0d022129d67

SHA1
e9b524aa2f9e7eb4c86e45747b2f9f5316288e42

SHA256
3511338f3c059ef1ee9ab276b615a3047c1054df490f07f7be0274dd9bf12a40

SHA512
0e493848fe1af3883a29639c5133c58e1ffa19546054fe71d0ae0be9cda2be8f0914e0c672561d90d488a0454fc9d78067a1b9da4fbed3d4b228c188b48da40c

Download Submit
C:\Windows\System\RxiuafB.exe

Filesize
2.0MB

MD5
a801dd3b9c8f7d71bc171a0b98d38605

SHA1
58d91434600344bbc55dec895848728b82c509b3

SHA256
678e52f83bc49170eeb48bb983c8025af7c8b8e31f3663a5799fa4834abe5f97

SHA512
19dddb174060a7caaebdf9573fa9dcbbd0f67276d25df1ae2e34c4dcdb97770aa83131045e04c90f9892a59f4c0b25ccdb5e8214b8dd4ebe69ab785244730b4c

Download Submit
C:\Windows\System\SAKotbA.exe

Filesize
2.0MB

MD5
50f3f46effa192422da74c8b9659af2c

SHA1
98e1ab179a9d58ee297367f7f7d3ebd5bc57ed56

SHA256
12bbd84bedc7a3203300a2242cbc2d45dbac6f4c15f95e71f66ec29c152dd564

SHA512
d3a89ab6be838d7c4ec8fd0eff25ba36e38f1f2f98d7b8cb3c170a2e25fbee7a2978f84b6839be635cd81ac325722d19429501699c43d0507dd11ebefd53f9c7

Download Submit
C:\Windows\System\UVaCQaa.exe

Filesize
2.0MB

MD5
5a3d600a2f5f2819f58d7f8c5653def4

SHA1
6fb6b99a70b7b57e14388d17e3795e1563b0bbcf

SHA256
3bab7a9bc0207bada026ffb506f6be7c3a83a4a2c04cb3e6dd016449d4151b6e

SHA512
2b139090e65902ef10be18b296508b71a55ce50f45a6912bcf4de486c30c4c05cdd38682d5eb1671ade266e569c31d35fb65f75b8416b28c99a30705b77b68ac

Download Submit
C:\Windows\System\UcwFfvd.exe

Filesize
2.0MB

MD5
a2faf62f3270a0c5551a6652eefc4836

SHA1
a33d33171e4237994a1a0b7e0c4b5ccca5a33f4e

SHA256
1e9461814738b365edfbe233ea5c1b9344ebadade5b84b607af4acdbbe85677b

SHA512
66b9a91a08abcc248b9072f23f6e567e2de109230c4635fc7734129e40e4a1ef22b6e82ba5fdcd2e5e1f9eb5addd72a9bc862823f690ced2ee8d05c8f502472c

Download Submit
C:\Windows\System\VYPQDRJ.exe

Filesize
2.0MB

MD5
db4aec5000102f0551156c2bd770d1b4

SHA1
dbe646286a20a39f1b9c5b82daccb425ecd92ea5

SHA256
6f8bcedab2cdb2f7b4ac9904b926085dcfa200b2f71ccc3bdf6e4069d4c793e3

SHA512
5b6bce7a861ef474bfa0f85b7cf18f3e4c646c4c420f8223cec768ea3be375a117e6e1e6eb9994ad9064ceb584099f5b53ad5bcd27e654788a8d874fdc4435a5

Download Submit
C:\Windows\System\VhEVKam.exe

Filesize
2.0MB

MD5
0e707b1b3cf35db32cdaa4e6e3eebc68

SHA1
ec60fbc315c428abb7552676f855355b038a38cd

SHA256
09bbfd294d8754ef13fa781248b073ba86736f517d71460b575e66946c00c3ab

SHA512
9a2f78d17d35503d7cc728cb23138b2969fe0cd1bab76a977d04daefaa09b0d22d902b25468cebf1cec35ca146219a522d188b6c2de4078f334bd34840e909b2

Download Submit
C:\Windows\System\XFPnJdN.exe

Filesize
2.0MB

MD5
d215845e17779aa65cf5326477c9222a

SHA1
1f698ba6e033ecff6c126796297e2c64ed80cd8b

SHA256
293e8739644503b3aaf5624019bca7dd46b42e5c4672ca8ddd1b93c5518ff473

SHA512
9efbaa274ed274c78ab4bbeaccd0212b4554bb1e1a327a6ef55937a32ba497cf6ea299e851186747327b697b3b88ca12fba7dc51ba732c0bf3fb0ea11bedaca1

Download Submit
C:\Windows\System\XLcOJwc.exe

Filesize
2.0MB

MD5
3f34c137c115c9faf548cfe8ad09873c

SHA1
aa0b0952d6dc6f275e9ebcbd8a1032c879f329a7

SHA256
eef3dcf49011d4d90492cd8cfed34577e57ac9b8a8fc9f75f79f97b5ea43593c

SHA512
6515432063eb375a2099b0c4eb577c479068396d82336ae30bbe5758c759764c81e37fa5cb204061eb1625f5086cb14dbb1b1f2d248349c06da315ba27b86bbb

Download Submit
C:\Windows\System\YhjeEYB.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\System\adJkdyK.exe

Filesize
2.0MB

MD5
e3cb1bfe4534118b7a377a404f427a42

SHA1
860e168b2c3d75568d8f8f6eed4e33f46ed09593

SHA256
59ad5f0baa5c4f9da2925b122bafb439bcc7db97e16c4fb4fe1bf5495e212599

SHA512
3292d83c10ba8d82243ea7dbf206f28e27d34c985e183dbf7bb97fd7ed34cadedb8003e614eea15fd67e97394660c9ecc726f99296ee562c2404ab06f5481220

Download Submit
C:\Windows\System\cdUJrZg.exe

Filesize
2.0MB

MD5
1d610f8452376b9c8a7976ad457e97e5

SHA1
46d549a08a30f81d8d2f6c5d4abfca57f72c7b77

SHA256
bf79bb847308eda498e7bf57dbda4cff68d2290d362e582e638130d90f640245

SHA512
e47ec734daf2793c4de2f4ca00974452f33809bd247b440126b52867795b3b6fb62d19a3eafd45d91ba9118a3d5e8a581e0270b85959d384fb813ff83c3e4a3f

Download Submit
C:\Windows\System\dujtETQ.exe

Filesize
2.0MB

MD5
ee3223d404fcac24db94a96c90a6c53b

SHA1
8b8d3ad05f615b4e8dca662d68fc4c1ee3b5d59d

SHA256
7a2116aa5c37258975422c508cf9f1e7633718931fe7b77bf57f8924b064a705

SHA512
dcea99a8d6f70cf0a67ef50a81cbfdde2ccf9a1c6553adf43b830f71adc0dd9844ec33a3bbd61090ea8f05692d5245c2de4416335ce0015a3931d30b467c2277

Download Submit
C:\Windows\System\jfdOyoZ.exe

Filesize
2.0MB

MD5
a88b3fec7967cda03d64850ca584315d

SHA1
e7af792509ccddb360310e3fcc0c702e5da9533e

SHA256
474cf979298a9da3378b4f5180e1ec5711cf49b7bfc2bdf4d92392058bca00fb

SHA512
633f398b80e99e9d29695fedff5479f921ad262c166ae321c04f1d870830db52960ea825ef7d86d7b8871d1211ac07ac69ed0eed51e7cecbf1528cdff44beab2

Download Submit
C:\Windows\System\pCYPHhX.exe

Filesize
2.0MB

MD5
89db8f37c91b73004c000bb66f242a12

SHA1
bbc50e7191e98747e9d05a054b0f62de39210a87

SHA256
3a7afe52e19b70c85cb2781eb9e5c5f9ab6f85fa016ed3a98f1c71cb5339c9e7

SHA512
ef5192fe8694ad5c0b59345d276821c59bfad8281fe0752722d6120167e5d64ac0a9c9f201c1c399c4edc86c438ba04e775683728224ef4e82b51def1352e304

Download Submit
C:\Windows\System\pQAIPZz.exe

Filesize
2.0MB

MD5
e8ce3421cb6d735bbc38c920576bfd4c

SHA1
3eb3600ee18360340f5aecf52fcf8e076081accd

SHA256
1e6e29a3b2ae3b46fa24d928272dc866f3341c3e23c5cdb06998d40c84a2f2aa

SHA512
fb42bd6c0b3e1e2460140b48e8b598c78b58ce8c6fe9a2bb62d79dc2d4146192a0d25926ed5308fcb917f88910bfc992e6f5dde28c9cd32db69fd676d26eae40

Download Submit
C:\Windows\System\qLLnpBe.exe

Filesize
2.0MB

MD5
f005c223a6d7475641dd060459556daf

SHA1
dbecac0ce3880e710e34ee97d80af2528d284439

SHA256
d46835d056036187e2caa9154968e3d80d818e1bcf7248af5eeb06ca06627496

SHA512
8fa2f41e5eddba500e9a599c4f843317181f70d9854c57538a6fccad35558a62a123d703a6ead39205d3e9ace4c59b2e5e3525e4a833e4022fdea02caa539fd7

Download Submit
C:\Windows\System\rpOhtmX.exe

Filesize
2.0MB

MD5
bdf405360b8523172ed2fc339aa8083a

SHA1
76cd204498c30b0a26643daede81162b811a3fb4

SHA256
c40556d881660c6e39a5ff1775ce1ef17235763fb05f27d0730471b210603cc9

SHA512
8b299bf60fb3e9140021717cb8e9b9e830af03bcd63f4c063325c32586c00bf3e3a314e8c07fb8750e20286b12eef2a96d4cff80784f6a95e5ee538f9bfc8846

Download Submit
C:\Windows\System\sUfifPT.exe

Filesize
2.0MB

MD5
a92ad4e4c7f24fc6bb5486257ab27b1d

SHA1
961cb3d8b5cbd71356f40fe6c60e22f4df72f5f9

SHA256
571c2a6236db0498eca9ced54fd49dacf83a71842bca6f7bf95a2db321372edc

SHA512
97b72f098c0a818e12843a7104e96badbc8faea2d6d1d8b82206d61c1b4207201a1aa001516d5c091d9bb59d7c4cb2c9bf98007dc57f92a25f603d8a52b60531

Download Submit
C:\Windows\System\whaeqOw.exe

Filesize
2.0MB

MD5
eb7e299b0ae40edb7bf5a2148d2b84d2

SHA1
8bcdcde23f9186641c9a8369dba2c176cfd7ba2b

SHA256
90dd169a7adc2640b3b951eacbf87d22520e85444b5173ed86928484d372534a

SHA512
e6cbd96b93a6288a5da5ea74cd4cbf2743b346440c217be825ef2ab24e9e95f1e97007feb77158df6f188889ea5b88f5f8443f5ad2276df9afcd86d12832b1fb

Download Submit
C:\Windows\System\xsxrGEo.exe

Filesize
2.0MB

MD5
202ae7e2dc1f6f3836723ba8e180285f

SHA1
d607b296cbcee7211962baa0aad217b0386bd3db

SHA256
fbe94e13064c48f6f1c59813d96e01a2a2d0117b0a7ff88b4665e39166d591df

SHA512
229c21683f60448cd9c336911b87eceb2890ab1f39fdad0f3590dc431f4f6097b6c27791f07abfd43eb318aa1821a58c47753cd1dd2819d54c192864df0283db

Download Submit
C:\Windows\System\zrPTxDS.exe

Filesize
2.0MB

MD5
331c12a4cef104bbf543752b0dc9c841

SHA1
08627a5b99c1abb95626651f61361a33814584de

SHA256
21b4ee2a201072be0de0d783479aa39c11c89bb2efab0fc2ac6e037b79d7c714

SHA512
a9264398b8385bb1a50979d38ce53dbff4ec78f262cfec30439a817bf426c4673cee6c2550bdf44acbd5dd816b84a347191de0a926dc3e9c8dc08975cc686cb9

Download Submit
memory/212-1924-0x00007FF68D390000-0x00007FF68D782000-memory.dmp

Filesize
3.9MB

Download
memory/212-66-0x00007FF68D390000-0x00007FF68D782000-memory.dmp

Filesize
3.9MB

Download
memory/744-70-0x00007FF70C620000-0x00007FF70CA12000-memory.dmp

Filesize
3.9MB

Download
memory/1264-118-0x00007FF66B920000-0x00007FF66BD12000-memory.dmp

Filesize
3.9MB

Download
memory/1492-2127-0x00007FF7A32F0000-0x00007FF7A36E2000-memory.dmp

Filesize
3.9MB

Download
memory/1492-164-0x00007FF7A32F0000-0x00007FF7A36E2000-memory.dmp

Filesize
3.9MB

Download
memory/1616-2123-0x00007FF65C740000-0x00007FF65CB32000-memory.dmp

Filesize
3.9MB

Download
memory/1616-199-0x00007FF65C740000-0x00007FF65CB32000-memory.dmp

Filesize
3.9MB

Download
memory/1676-1914-0x00007FF690520000-0x00007FF690912000-memory.dmp

Filesize
3.9MB

Download
memory/1676-40-0x00007FF690520000-0x00007FF690912000-memory.dmp

Filesize
3.9MB

Download
memory/2044-126-0x00007FF7153A0000-0x00007FF715792000-memory.dmp

Filesize
3.9MB

Download
memory/2104-2106-0x00007FF7FF430000-0x00007FF7FF822000-memory.dmp

Filesize
3.9MB

Download
memory/2104-198-0x00007FF7FF430000-0x00007FF7FF822000-memory.dmp

Filesize
3.9MB

Download
memory/2316-2101-0x00007FF7645F0000-0x00007FF7649E2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-173-0x00007FF7645F0000-0x00007FF7649E2000-memory.dmp

Filesize
3.9MB

Download
memory/2452-189-0x00007FF6DD1F0000-0x00007FF6DD5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2452-2103-0x00007FF6DD1F0000-0x00007FF6DD5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-5404-0x00007FF7B4DC0000-0x00007FF7B51B2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-1-0x000002BF76DC0000-0x000002BF76DD0000-memory.dmp

Filesize
64KB

Download
memory/3192-0-0x00007FF7B4DC0000-0x00007FF7B51B2000-memory.dmp

Filesize
3.9MB

Download
memory/3372-41-0x00007FF6AD510000-0x00007FF6AD902000-memory.dmp

Filesize
3.9MB

Download
memory/3372-1927-0x00007FF6AD510000-0x00007FF6AD902000-memory.dmp

Filesize
3.9MB

Download
memory/3568-2128-0x00007FF6371C0000-0x00007FF6375B2000-memory.dmp

Filesize
3.9MB

Download
memory/3568-194-0x00007FF6371C0000-0x00007FF6375B2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-154-0x00007FF61F1A0000-0x00007FF61F592000-memory.dmp

Filesize
3.9MB

Download
memory/3584-2138-0x00007FF61F1A0000-0x00007FF61F592000-memory.dmp

Filesize
3.9MB

Download
memory/3632-2085-0x00007FF705450000-0x00007FF705842000-memory.dmp

Filesize
3.9MB

Download
memory/3632-193-0x00007FF705450000-0x00007FF705842000-memory.dmp

Filesize
3.9MB

Download
memory/3892-2025-0x00007FF636B40000-0x00007FF636F32000-memory.dmp

Filesize
3.9MB

Download
memory/3892-67-0x00007FF636B40000-0x00007FF636F32000-memory.dmp

Filesize
3.9MB

Download
memory/3944-80-0x00007FF7C3350000-0x00007FF7C3742000-memory.dmp

Filesize
3.9MB

Download
memory/3944-2023-0x00007FF7C3350000-0x00007FF7C3742000-memory.dmp

Filesize
3.9MB

Download
memory/4036-201-0x00000243B6280000-0x00000243B6A26000-memory.dmp

Filesize
7.6MB

Download
memory/4036-3-0x00007FFED7BA3000-0x00007FFED7BA5000-memory.dmp

Filesize
8KB

Download
memory/4036-6133-0x00007FFED7BA3000-0x00007FFED7BA5000-memory.dmp

Filesize
8KB

Download
memory/4036-22-0x00000243B3560000-0x00000243B3582000-memory.dmp

Filesize
136KB

Download
memory/4036-101-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/4036-57-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/4036-39-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/4312-2084-0x00007FF637920000-0x00007FF637D12000-memory.dmp

Filesize
3.9MB

Download
memory/4312-172-0x00007FF637920000-0x00007FF637D12000-memory.dmp

Filesize
3.9MB

Download
memory/4384-195-0x00007FF6BB6A0000-0x00007FF6BBA92000-memory.dmp

Filesize
3.9MB

Download
memory/4384-2122-0x00007FF6BB6A0000-0x00007FF6BBA92000-memory.dmp

Filesize
3.9MB

Download
memory/4548-2010-0x00007FF6C6FD0000-0x00007FF6C73C2000-memory.dmp

Filesize
3.9MB

Download
memory/4548-82-0x00007FF6C6FD0000-0x00007FF6C73C2000-memory.dmp

Filesize
3.9MB

Download
memory/4556-79-0x00007FF67A6A0000-0x00007FF67AA92000-memory.dmp

Filesize
3.9MB

Download
memory/4556-2009-0x00007FF67A6A0000-0x00007FF67AA92000-memory.dmp

Filesize
3.9MB

Download
memory/4568-2060-0x00007FF6A3180000-0x00007FF6A3572000-memory.dmp

Filesize
3.9MB

Download
memory/4568-143-0x00007FF6A3180000-0x00007FF6A3572000-memory.dmp

Filesize
3.9MB

Download
memory/4628-88-0x00007FF743DD0000-0x00007FF7441C2000-memory.dmp

Filesize
3.9MB

Download
memory/4628-2064-0x00007FF743DD0000-0x00007FF7441C2000-memory.dmp

Filesize
3.9MB

Download
memory/4636-137-0x00007FF707AF0000-0x00007FF707EE2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-2131-0x00007FF6CEBF0000-0x00007FF6CEFE2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-179-0x00007FF6CEBF0000-0x00007FF6CEFE2000-memory.dmp

Filesize
3.9MB

Download